Janady13/missionmatch / cmd/api/main.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / cmd/api/main.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	3be46ba89edb737182075a2b320509b42dc916f8
Branch	workstream-d-missionmatch
Path or archive member	cmd/api/main.go
Original SHA-256	b03e78649f34d623cec886996134cc3ad186819d89bdd36e5fe385b6996b8afe
Git blob SHA	bd5023690d1e14b5d76eaf6c7d2dfb6874bd2aff
Reading-copy SHA-256	b03e78649f34d623cec886996134cc3ad186819d89bdd36e5fe385b6996b8afe
Original source ↗
Every recorded occurrence

These 5 records contain identical original source bytes. Their paths and revisions remain part of the archive.
Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / cmd/api/main.go	workstream-d-missionmatch	3be46ba89edb737182075a2b320509b42dc916f8	Open original
Janady13/missionmatch / cmd/api/main.go	workstream-e-dataflow-deploy	433815a042f9741411e60fa553fe72143e9b10db	Open original
Janady13/missionmatch / cmd/api/main.go	ai-intelligence-layer	5d5ddff70393a197c5f54a45280bb5dd42b24755	Open original
Janady13/missionmatch / cmd/api/main.go	workstream-e-dataflow-deploy	433815a042f9741411e60fa553fe72143e9b10db	Open original
Janady13/missionmatch / cmd/api/main.go	workstream-d-missionmatch	3be46ba89edb737182075a2b320509b42dc916f8	Open original
Recovered source transcript

Download complete source text ↓360 lines · 14.9 KB
// Command api is the missionMATCH HTTP server entrypoint.
//
// It wires configuration, the FIPS startup guard and self test, the Postgres pool (NOBYPASSRLS app
// role), the embedding provider, the authentication module, and the tenant scoped API. Cloud and
// provider selection are configuration (the portability mandate); no cloud SDK is imported here.
package main

import (
	"context"
	"crypto/fips140"
	"crypto/pbkdf2"
	"crypto/rand"
	"crypto/sha256"
	"encoding/json"
	"errors"
	"log"
	"net/http"
	"os/signal"
	"syscall"
	"time"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"

	"github.com/missionworkforce/missionmatch/internal/modules/auth"
	"github.com/missionworkforce/missionmatch/internal/modules/awards"
	"github.com/missionworkforce/missionmatch/internal/modules/commandcenter"
	"github.com/missionworkforce/missionmatch/internal/modules/eeo"
	"github.com/missionworkforce/missionmatch/internal/modules/governance"
	"github.com/missionworkforce/missionmatch/internal/modules/matching"
	"github.com/missionworkforce/missionmatch/internal/modules/missionmatch"
	"github.com/missionworkforce/missionmatch/internal/modules/opportunities"
	oppintel "github.com/missionworkforce/missionmatch/internal/modules/opportunity_intelligence"
	"github.com/missionworkforce/missionmatch/internal/modules/screenmatch"
	"github.com/missionworkforce/missionmatch/internal/modules/slatematch"
	"github.com/missionworkforce/missionmatch/internal/modules/sourcing"
	"github.com/missionworkforce/missionmatch/internal/modules/wages"
	"github.com/missionworkforce/missionmatch/internal/platform/audit"
	"github.com/missionworkforce/missionmatch/internal/platform/config"
	"github.com/missionworkforce/missionmatch/internal/platform/database"
	"github.com/missionworkforce/missionmatch/internal/platform/embeddings"
	"github.com/missionworkforce/missionmatch/internal/platform/extraction"
	"github.com/missionworkforce/missionmatch/internal/platform/obs"
	"github.com/missionworkforce/missionmatch/internal/platform/ratelimit"
	"github.com/missionworkforce/missionmatch/internal/platform/security"
	"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)

func main() {
	cfg, err := config.Load()
	if err != nil {
		log.Fatalf("config: %v", err)
	}

	// Structured JSON logging for the request path (debug level in dev, info in production): the obs
	// middleware logs every request through slog. The one time boot and shutdown messages below stay on
	// the standard logger, since they are operator facing startup output, not the high volume hot path.
	obs.Setup(!cfg.IsProduction())

	// FIPS startup guard: in a FIPS deployment, refuse to start with crypto outside the validated module.
	if cfg.RequireFIPS && !fips140.Enabled() {
		log.Fatalf("FIPS required but OFF, build with GOFIPS140=v1.0.0 and run with GODEBUG=fips140=on")
	}
	// FIPS self test: actually derive a PBKDF2 key at the configured cost under the active module and
	// fail closed if it errors, so a broken crypto path is caught at boot, not at first login.
	if err := fipsSelfTest(); err != nil {
		log.Fatalf("FIPS self test (PBKDF2 HMAC SHA 256) failed: %v", err)
	}
	log.Printf("missionMATCH starting: env=%s cloud=%s fips_enabled=%v module=%s",
		cfg.Env, cfg.Cloud, fips140.Enabled(), fips140.Version())

	ctx := context.Background()
	var db *tenant.DB
	if cfg.AppDatabaseURL != "" {
		pool, err := database.NewPool(ctx, cfg.AppDatabaseURL)
		if err != nil {
			log.Fatalf("db pool: %v", err)
		}
		// Fail closed unless this pool is the NOBYPASSRLS app role, so a swapped or over privileged DSN
		// can never silently bypass RLS.
		if err := database.AssertRole(ctx, pool, "missionmatch_app"); err != nil {
			log.Fatalf("app pool role check: %v", err)
		}
		db = tenant.New(pool)
		defer db.Close()
	} else {
		log.Printf("WARNING: MM_DATABASE_URL unset, DB backed routes return 503")
	}

	// The compliance pool authenticates as the compliance role and is the ONLY pool with eeo access.
	// It drives adverse impact reporting; the app pool above can never read demographics.
	var complianceDB *tenant.DB
	if cfg.ComplianceDatabaseURL != "" {
		pool, err := database.NewPool(ctx, cfg.ComplianceDatabaseURL)
		if err != nil {
			log.Fatalf("compliance db pool: %v", err)
		}
		// Fail closed unless this is the NOBYPASSRLS compliance role. A BYPASSRLS DSN here would leak
		// every tenant's demographics cross org through the adverse impact join.
		if err := database.AssertRole(ctx, pool, "missionmatch_compliance"); err != nil {
			log.Fatalf("compliance pool role check: %v", err)
		}
		complianceDB = tenant.New(pool)
		defer complianceDB.Close()
	} else {
		log.Printf("WARNING: MM_COMPLIANCE_DATABASE_URL unset, adverse impact reporting returns 503")
	}

	emb, err := embeddings.New(cfg.Embeddings)
	if err != nil {
		log.Fatalf("embeddings: %v", err)
	}

	ext, err := extraction.New(cfg.Extraction)
	if err != nil {
		log.Fatalf("extraction: %v", err)
	}

	auditW := audit.New(db)
	authSvc, err := buildAuthService(cfg, db, auditW)
	if err != nil {
		log.Fatalf("auth: %v", err)
	}
	csrf := security.NewCSRF(authKey(cfg.Auth.CSRFKey, 32, "MM_CSRF_KEY", cfg.IsProduction()))
	authH := auth.NewHandler(authSvc, csrf, cfg.Auth.CookieSecure, cfg.AllowedOrigins, cfg.TrustedProxyHeader)

	svc := matching.NewService(db, matching.NewEmbeddingSkillMatcher(emb), auditW).WithExtractor(ext)
	h := matching.NewHandler(svc)
	screenH := screenmatch.NewHandler(h)
	slateH := slatematch.NewHandler(h)
	ccH := commandcenter.NewHandler(commandcenter.NewServiceWithAudit(db, auditW))
	missionH := missionmatch.NewHandler(h, ccH)
	oppH := opportunities.NewHandler(opportunities.NewService(db))
	oppIntelH := oppintel.NewHandler(oppintel.NewService(db))
	awardsH := awards.NewHandler(awards.NewService(db))
	wagesH := wages.NewHandler(wages.NewService(db))
	sourcingH := sourcing.NewHandler(sourcing.NewService(db, auditW))
	eeoH := eeo.NewHandler(eeo.NewService(complianceDB))
	govH := governance.NewHandler(governance.NewService(db, auditW, cfg.DecisionRetentionDays))

	// Resolve the tenant middleware. In a release build this is always the session resolver; the dev
	// X-Org-ID path only exists in a dev tagged build. Assert that positively in production.
	sessionMW, resolverKind := chooseResolver(cfg, authH)
	if cfg.IsProduction() && resolverKind != "session" {
		log.Fatalf("production must resolve the tenant from a validated session, got resolver %q", resolverKind)
	}
	log.Printf("tenant resolver: %s", resolverKind)
	if !cfg.Auth.MFARequired {
		log.Printf("WARNING: MM_MFA_REQUIRED is false, login is password only with no TOTP step (pilot only, this weakens the auth posture)")
	}

	csrfMW := csrf.Protect(authH.CSRFCookieName(), auth.CSRFHeader, cfg.AllowedOrigins)

	// Metrics registry, fed the database pool gauges so /metrics reports connection saturation.
	metrics := obs.NewRegistry()
	metrics.SetPoolStats(func() map[string]float64 {
		out := map[string]float64{}
		if db != nil && db.Pool != nil {
			s := db.Pool.Stat()
			out["app_acquired"] = float64(s.AcquiredConns())
			out["app_idle"] = float64(s.IdleConns())
			out["app_total"] = float64(s.TotalConns())
			out["app_max"] = float64(s.MaxConns())
		}
		if complianceDB != nil && complianceDB.Pool != nil {
			out["compliance_total"] = float64(complianceDB.Pool.Stat().TotalConns())
		}
		return out
	})

	// Rate limiters: a generous per IP cap on the whole API, and a strict one on the public auth routes
	// (login, CSRF, recovery) to blunt credential stuffing. Account lockout in the auth service is the
	// deeper control; this is the transport layer defense in depth. Sweepers bound memory.
	stopSweep := make(chan struct{})
	defer close(stopSweep)
	apiLimiter := ratelimit.New(50, 100)
	apiLimiter.StartSweeper(stopSweep, time.Minute, 10*time.Minute)
	authLimiter := ratelimit.New(1, 10)
	authLimiter.StartSweeper(stopSweep, time.Minute, 10*time.Minute)

	r := chi.NewRouter()
	r.Use(middleware.RequestID)
	// NOTE: middleware.RealIP is deliberately NOT used; it trusts spoofable client headers (deprecated
	// in chi for that reason). The auth handler and the rate limiter derive the client IP from the TCP
	// peer, or from MM_TRUSTED_PROXY_HEADER only when the app is behind a trusted reverse proxy.
	r.Use(middleware.Recoverer)
	r.Use(metrics.Middleware) // access log + metrics, outside the timeout so timed out requests still record
	r.Use(middleware.Timeout(60 * time.Second))

	// Liveness: the process is up. Cheap, never touches the database (a probe must not be coupled to the DB).
	r.Get("/healthz", func(w http.ResponseWriter, _ *http.Request) {
		w.WriteHeader(http.StatusOK)
		_, _ = w.Write([]byte("ok"))
	})
	// Readiness: the process can serve, the database pools answer. A failing pool returns 503 so a load
	// balancer stops routing to a node that cannot reach Postgres (the old /healthz reported healthy even
	// with a dead DB).
	r.Get("/readyz", func(w http.ResponseWriter, req *http.Request) {
		ctx, cancel := context.WithTimeout(req.Context(), 2*time.Second)
		defer cancel()
		if db != nil && db.Pool != nil {
			if err := db.Pool.Ping(ctx); err != nil {
				http.Error(w, "app database not ready", http.StatusServiceUnavailable)
				return
			}
		}
		if complianceDB != nil && complianceDB.Pool != nil {
			if err := complianceDB.Pool.Ping(ctx); err != nil {
				http.Error(w, "compliance database not ready", http.StatusServiceUnavailable)
				return
			}
		}
		w.WriteHeader(http.StatusOK)
		_, _ = w.Write([]byte("ready"))
	})
	r.Get("/healthz/fips", func(w http.ResponseWriter, _ *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(map[string]any{
			"fips_enabled":     fips140.Enabled(),
			"fips_enforced":    fips140.Enforced(),
			"module":           fips140.Version(),
			"pbkdf2_self_test": true, // a failure would have aborted startup
		})
	})
	// Metrics are unauthenticated operational data carrying no PII; production firewalls this to the
	// scraping network. It sits outside /api so the API rate limiter never throttles a scrape.
	r.Handle("/metrics", metrics.Handler())

	r.Route("/api", func(r chi.Router) {
		r.Use(apiLimiter.Middleware(cfg.TrustedProxyHeader))
		// Public pre tenant auth: runs before any org is known. Behind the strict auth rate limiter, the
		// CSRF Origin allowlist, and the signed double submit, but NOT the session resolver (these operate
		// on a pre MFA session or no session and read the cookie themselves).
		r.Group(func(r chi.Router) {
			r.Use(authLimiter.Middleware(cfg.TrustedProxyHeader))
			r.Use(csrfMW)
			authH.PublicRoutes(r)
		})
		// Tenant scoped: the session resolver feeds app.current_org_id, then CSRF, then per route RBAC.
		r.Group(func(r chi.Router) {
			r.Use(sessionMW)
			r.Use(csrfMW)
			// Flat alias surface: the pre split paths (POST /match, /slates/..., /candidates, ...) stay
			// working so existing clients and the screenmatch.thatwebhostingguy.com redirect never break.
			h.Routes(r)
			// Canonical tool namespaces over the same shared core: screenMATCH, slateMATCH, missionMATCH.
			r.Route("/screenmatch", screenH.Routes)
			r.Route("/slatematch", slateH.Routes)
			r.Route("/missionmatch", missionH.Routes)
			ccH.Routes(r)
			oppH.Routes(r)
			oppIntelH.Routes(r)
			awardsH.Routes(r)
			wagesH.Routes(r)
			sourcingH.Routes(r)
			eeoH.Routes(r)
			govH.Routes(r)
			authH.TenantRoutes(r)
		})
	})

	srv := &http.Server{
		Addr:              cfg.HTTPAddr,
		Handler:           r,
		ReadHeaderTimeout: 10 * time.Second,
		ReadTimeout:       30 * time.Second,
		WriteTimeout:      60 * time.Second,
		IdleTimeout:       120 * time.Second,
	}

	// Graceful shutdown: on SIGINT or SIGTERM, stop accepting and let in flight requests (and their
	// tenant transactions) drain before exit, so a redeploy never severs a write mid commit.
	shutdownCtx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
	defer stop()
	go func() {
		log.Printf("listening on %s", cfg.HTTPAddr)
		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
			log.Fatalf("server: %v", err)
		}
	}()
	<-shutdownCtx.Done()
	log.Printf("shutdown signal received, draining in flight requests")
	drainCtx, cancel := context.WithTimeout(context.Background(), 25*time.Second)
	defer cancel()
	if err := srv.Shutdown(drainCtx); err != nil {
		log.Printf("graceful shutdown error: %v", err)
	}
	log.Printf("stopped")
}

// fipsSelfTest derives one PBKDF2 key at the production iteration count under the active crypto module.
func fipsSelfTest() error {
	_, err := pbkdf2.Key(sha256.New, "missionmatch fips self test", []byte("self test salt"), security.PBKDF2Iterations, 32)
	return err
}

// buildAuthService assembles the auth service from config. In production every key is present
// (config.Validate enforces it). In development a missing key falls back to an ephemeral random key
// with a loud warning, so the server still starts for local work.
func buildAuthService(cfg config.Config, db *tenant.DB, auditW *audit.Writer) (*auth.Service, error) {
	prod := cfg.IsProduction()
	pepperKeys := map[int][]byte{
		cfg.Auth.PepperVersion: authKey(cfg.Auth.Pepper, 32, "MM_CREDENTIAL_PEPPER", prod),
	}
	if len(cfg.Auth.PepperPrevious) > 0 {
		pepperKeys[cfg.Auth.PepperVersion-1] = cfg.Auth.PepperPrevious
	}
	pepper, err := security.NewPepper(cfg.Auth.PepperVersion, pepperKeys)
	if err != nil {
		return nil, err
	}
	hasher, err := security.NewHasher(pepper, security.PBKDF2Iterations)
	if err != nil {
		return nil, err
	}
	tagger, err := security.NewTagger(authKey(cfg.Auth.RecoveryLookupKey, 32, "MM_RECOVERY_LOOKUP_KEY", prod))
	if err != nil {
		return nil, err
	}
	// The KEK map carries the active version plus an optional prior version so a rotated KEK still
	// decrypts TOTP secrets sealed under the old one, mirroring the pepper rotation above.
	totpKEKs := map[int][]byte{
		cfg.Auth.TOTPKEKVersion: authKey(cfg.Auth.TOTPKEK, 32, "MM_TOTP_KEK", prod),
	}
	if len(cfg.Auth.TOTPKEKPrevious) > 0 {
		totpKEKs[cfg.Auth.TOTPKEKVersion-1] = cfg.Auth.TOTPKEKPrevious
	}
	return auth.NewService(auth.Deps{
		DB:              db,
		Audit:           auditW,
		Hasher:          hasher,
		Tagger:          tagger,
		TOTP:            security.TOTP{},
		TOTPKEKs:        totpKEKs,
		TOTPKEKActive:   cfg.Auth.TOTPKEKVersion,
		TOTPIssuer:      cfg.Auth.TOTPIssuer,
		IdleSeconds:     cfg.Auth.SessionIdleSeconds,
		AbsoluteSeconds: cfg.Auth.SessionAbsoluteSeconds,
		PendingSeconds:  cfg.Auth.PendingAbsoluteSeconds,
		InviteSeconds:   cfg.Auth.InviteExpirySeconds,
		CookieSecure:    cfg.Auth.CookieSecure,
		MFADisabled:     !cfg.Auth.MFARequired,
	})
}

// authKey returns the configured key, or an ephemeral random key in development when it is unset.
func authKey(set []byte, size int, name string, prod bool) []byte {
	if len(set) > 0 {
		return set
	}
	if prod {
		// config.Validate already fatals before here; this is a defensive backstop.
		log.Fatalf("%s required in production", name)
	}
	b := make([]byte, size)
	_, _ = rand.Read(b)
	log.Printf("WARNING: %s unset, using an ephemeral dev key (sessions and credentials will not survive a restart; set %s for a stable dev database)", name, name)
	return b
}