Janady13/missionmatch / cmd/missionclass-sync/main.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / cmd/missionclass-sync/main.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	cmd/missionclass-sync/main.go
Original SHA-256	49b120962ac85373afb8b84113bf449c6d98910d0e1a155d32d3abeeec5a1262
Git blob SHA	e6e5a8313e660052861d4604a14fcd19d6fe8c40
Reading-copy SHA-256	49b120962ac85373afb8b84113bf449c6d98910d0e1a155d32d3abeeec5a1262

Original source ↗

Every recorded occurrence

These 15 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / cmd/missionclass-sync/main.go	feature/opportunity-to-outcome	720d47fae476b0d38477ae4401697d372b1ea2bc	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	collision-deconfliction	4ee5a09972608ed89f8377c6665542d5f450f0a6	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	m5-price-to-win	41000ad30fff4129fdaf5ec84e15ba14c27d4890	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	ws8-teaching-loop	c823f0fb6bb2aba0f39001eb6de96f4000d9321f	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	mag-substrate	b82c7100a492dec67dfd1eda6b3f53def859be35	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	time-to-fill-survival	b66e1e505863d4f17741a4b9ede73509e45bd6c6	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	graphrag-foundation	b0ddeb9f633fd138d09309d1a17b7d13bc3a67f7	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	ws9-bench-ingestion	f585a9ef32fa554663ce1fba9a414a54b6e49cf0	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	vendor-intelligence	fe9796a19c261951d3f2565206c0c1b5ac294465	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	ws7-federal-signal	6a9f6ce9cfb13345ffb47770d4960e7c2d9c17c2	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	phase2-connectors	e038d4c687aec16f8bd9bc4d907eea14d91f8704	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original
Janady13/missionmatch / cmd/missionclass-sync/main.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original

Recovered source transcript

Download complete source text ↓132 lines · 5.7 KB

// Command missionclass-sync runs the WS7 federal signal classification pass. It reads the global
// opportunity_records, usaspending_awards, and sam_opportunities catalogs, runs the pure deterministic
// missionclass classifier over the record text plus, for SAM notices, the text extracted from their
// attachments, and upserts mission tags (federal_mission_tags) and incumbent labor roles
// (award_incumbent_roles) idempotently. It writes ONE append only audit event per run with counts only,
// never any PII or record text. It is a one shot job and a cron candidate like mm-opp-sync, safe to
// rerun: every upsert is idempotent.
//
// Mission tags are reference data, NEVER a scoring input, and the pass never reaches the eeo schema.
//
// Env (server side only): MM_MIGRATOR_DATABASE_URL (the BYPASSRLS migrator DSN, the global catalogs are
// app read only; falls back to MM_DATABASE_URL), SAM_API_KEY (required for SAM attachment mining),
// SAM_API_BASE (optional), MM_OPP_RAW_DIR (object storage root for retained attachments, default
// ./data/opp-raw).
//
// Flags: -max-attachments bounds how many SAM notices the run fetches attachments for, so one run stays
// within the SAM API daily quota.
//
// Build and run FIPS validated: CGO_ENABLED=0 GOFIPS140=v1.0.0 go build, run with GODEBUG=fips140=on.
package main

import (
	"context"
	"crypto/fips140"
	"crypto/pbkdf2"
	"crypto/sha256"
	"flag"
	"log"
	"os"
	"strings"
	"time"

	"github.com/jackc/pgx/v5/pgxpool"

	"github.com/missionworkforce/missionmatch/internal/modules/federalsignal"
	"github.com/missionworkforce/missionmatch/internal/platform/audit"
	"github.com/missionworkforce/missionmatch/internal/platform/database"
	"github.com/missionworkforce/missionmatch/internal/platform/security"
	"github.com/missionworkforce/missionmatch/internal/platform/storage"
	"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)

func main() {
	maxAttachments := flag.Int("max-attachments", 50, "max SAM notices to fetch attachments for in one run, bounds SAM API quota use")
	flag.Parse()

	// FIPS self test: derive one PBKDF2 key at the production cost under the active crypto module and fail
	// closed if it errors, so a build that dropped the validated module is caught at boot, not mid run.
	// This is the same in build FIPS gate the api binary uses, the only FIPS path the repo ships.
	if err := fipsSelfTest(); err != nil {
		log.Fatalf("missionclass-sync: FIPS self test (PBKDF2 HMAC SHA 256) failed: %v", err)
	}
	log.Printf("missionclass-sync: fips_enabled=%v module=%s", fips140.Enabled(), fips140.Version())

	dsn := firstNonEmpty(os.Getenv("MM_MIGRATOR_DATABASE_URL"), os.Getenv("MM_DATABASE_URL"))
	if dsn == "" {
		log.Fatal("missionclass-sync: set MM_MIGRATOR_DATABASE_URL (the migrator DSN)")
	}
	samKey := strings.TrimSpace(os.Getenv("SAM_API_KEY"))
	if samKey == "" {
		// SAM attachment mining is the only path that needs the key. Without it, mission tags and award
		// incumbent roles are still written; only the SAM notice incumbent roles are skipped. Make the
		// degraded mode explicit rather than failing the whole run.
		log.Print("missionclass-sync: SAM_API_KEY not set, SAM attachment mining disabled for this run")
	}
	rawDir := firstNonEmpty(os.Getenv("MM_OPP_RAW_DIR"), "./data/opp-raw")

	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
	defer cancel()

	pool, err := pgxpool.New(ctx, dsn)
	if err != nil {
		log.Fatalf("missionclass-sync: db connect: %v", err)
	}
	defer pool.Close()
	if err := pool.Ping(ctx); err != nil {
		log.Fatalf("missionclass-sync: db ping: %v", err)
	}
	// federal_mission_tags and award_incumbent_roles are global catalogs the application role may only
	// read, so this writer needs the BYPASSRLS migrator DSN; assert it now for a legible failure instead
	// of a mid run permission denied.
	if err := database.AssertMigratorRole(ctx, pool); err != nil {
		log.Fatalf("missionclass-sync: %v", err)
	}

	store, err := storage.NewLocal(rawDir)
	if err != nil {
		log.Fatalf("missionclass-sync: storage: %v", err)
	}

	// The SAM fetch client holds the api_key server side only. New registers the production SAM hosts
	// (api.sam.gov and sam.gov) by default, so the key is appended only to a SAM URL and never to a
	// foreign resource link. Retained raw attachments land under the federalsignal prefix for retention.
	fetcher := federalsignal.New(samKey, federalsignal.WithStore(store, "federalsignal"))

	// When the key is absent, disable SAM attachment fetching by bounding at zero so the pass still tags
	// mission areas and mines award incumbent roles, and reports the SAM notices as skipped.
	bound := *maxAttachments
	if samKey == "" {
		bound = 0
	}

	repo := federalsignal.NewRepo(pool)
	auditor := audit.New(tenant.New(pool))
	svc := federalsignal.NewService(repo, fetcher, auditor, bound)

	res, err := svc.ClassifyAll(ctx)
	if err != nil {
		log.Fatalf("missionclass-sync: classify: %v", err)
	}

	log.Printf("missionclass-sync: DONE, scanned %d records, wrote %d mission tags and %d incumbent roles, fetched %d SAM notices, skipped %d over the attachment cap",
		res.RecordsScanned, res.MissionTagsWritten, res.IncumbentRoles, res.SamFetched, res.SamSkippedCap)
}

// fipsSelfTest derives one PBKDF2 key at the production iteration count under the active crypto module.
// It is the in build FIPS gate, identical to the api binary self test, so the sync binary is held to the
// same validated crypto posture.
func fipsSelfTest() error {
	_, err := pbkdf2.Key(sha256.New, "missionmatch fips self test", []byte("self test salt"), security.PBKDF2Iterations, 32)
	return err
}

func firstNonEmpty(vals ...string) string {
	for _, v := range vals {
		if s := strings.TrimSpace(v); s != "" {
			return s
		}
	}
	return ""
}