chore(graph): disable HTTP or eventhandlers by configuration - #3293
Open
pbleser-oc wants to merge 3 commits into
Open
chore(graph): disable HTTP or eventhandlers by configuration#3293pbleser-oc wants to merge 3 commits into
pbleser-oc wants to merge 3 commits into
Conversation
8 tasks
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| Security | 1 critical |
🟢 Metrics 103 complexity · 475 duplication
Metric Results Complexity 103 Duplication 475
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
pbleser-oc
force-pushed
the
chore/#1312-graph-event-handler-split
branch
2 times, most recently
from
August 13, 2026 10:09
24e32d8 to
d892695
Compare
In the scope of the broader issue opencloud-eu#1312, this PR deals with performing those changes for the `graph` service, namely to add the ability to disable the HTTP API or to disable the events API handler by configuration. It also adds metrics for the events processing, and tests for the events processing. The previous implementation was combining the HTTP server service and the events consumption, which is why this PR refactors the composition of those services: * the event consumption has been moved into its own service * the identity.Backend is created beforehand, and then injected as a collaborator in both the HTTP service as well as the event consumer service It also adds metrics, mainly for the event processing. To encourage re-use in latter implementations and changes, it also introduces two top-level package changes: * internal/eventstest/events_test_helpers: contains a TestBus implementation to unit-test event consumers without NATS * internal/metricstest/metrics_test_helpers: contains assertion functions to test Prometheus metrics Additional boy-scouting: * in identity/backend.go: modify the UpdateLastSignInDate function to return a bool in addition to the error to clarify whether the operation was even attempted or not, to be able to detect when the operation is unsupported, and log errors (or not) accordingly
pbleser-oc
force-pushed
the
chore/#1312-graph-event-handler-split
branch
from
August 13, 2026 11:42
d892695 to
ec49989
Compare
Introduce LDAP client abstraction interface to be able to wrap the go-ldap client API with metrics transparently (and possibly hooks and such in the future) Has two implementations: * a go-ldap adapter implementation that directly delegates * a time measuring and metrics collecting implementation that delegates to another LdapClient The metrics collecting one is disabled by default, can be enabled with GRAPH_LDAP_METRICS_DISABLE=false Add an HTTP middleware that measures how long Graph API requests take, storing taken time into a histogram along with labels for method, path pattern (from the chi routes), Graph API version prefix, and Graph API resource name, as well as the resulting status code. Disabled by default, can be enabled with GRAPH_HTTP_METRICS_DISABLE=false Make some internal changes to how some of the LDAP client API operations work in the LDAP backend: * check whether searches for a singular entry returns more than one result, in which case a new error TooManyResults is returned, instead of leaving that undetected, blindly taking the first result, and potentially risking data inconsistencies * DeleteUser() does not return an error any more when the user to delete cannot be found in LDAP: instead, it now also returns a bool following the 'ok' idiom, and callers can deal with whether that is supposed to end up in an error or not on their level * GetUser() and UpdateUser() also go not return an error when the user entry is not found in LDAP; instead, they returns nil for the user, which must now be checked for nilness by callers, and dealt with as they see fit depending on the context of the operation Callers have been modified accordingly, checking for nilness of the returned user in order to behave the same way as before, returning an ItemNotFound error on their level. Furthermore, due to the execution time measuring metrics that are introduced with this change, the implementation pattern of the public LDAP identity backend functions had to be changed, using named return values instead, as that is the least intrusive option to record elapsed time using defer and being able to also set a metric label value for whether the operation succeeded or not (looking at the function-global error variable that is returned). Improve the loggers in identity backends by adding attributes for their request targets (Reva gateway address or LDAP URI, respectively). Also add a "backend" attribute for all Graph API logs (set to "ldap" or "cs3"), to help debug potential issues. The LDAP identity backend logger also has two new attributes to help debugging with logs: * write (bool): whether write operations are enabled * refint (bol): whether refint is enabled or not Introduce metrics for the LDAP identity backend. Metrics measure execution time for all the higher-level LDAP identity backend operations (create-user, delete-user, update-user, get-user, filter-users, update-last-signin-date). An additional set of metrics measure the execution time for all LDAP client operations, as referred to in the LDAP Client interface introduction referred to above. Also adds a dedicated counter for user password change operations. Minor campfire improvements: * add a constructor func for the CS3 backend * add a constructor func for the LDAP backend * in the LDAP identity backend, in searchLDAPEntryByFilter (used by all search/get public functions), errors that occur when performing LDAP SEARCH operations were blindly mapped to a ItemNotFound error, instead of being analyzed as it could be caused by a technical error
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
In the scope of the broader issue #1312, this PR deals with performing those changes for the
graphservice, namely to add the ability to disable the HTTP API or to disable the events API handler by configuration.It also adds metrics for the events processing, and tests for the events processing.
The previous implementation was combining the HTTP server service and the events consumption, which is why this PR refactors the composition of those services:
It also adds metrics, mainly for the event processing.
To encourage re-use in latter implementations and changes, it also introduces two top-level package changes:
Additional boy-scouting:
Related Issue
Motivation and Context
Details can be found in #1312
GRAPH_HTTP_DISABLED)GRAPH_EVENTS_DISABLE_CONSUMER)internal/eventstestandinternal/metricstestwith utilities for testing event consumers and Prometheus metrics, respectivelyHow Has This Been Tested?
Tested the HTTP API (when enabled) using:
Tested the event API (when enabled) using:
Tested combinations of enabling/disabling the events and HTTP APIs.
When both are disabled, the service refuses to start and exits early with an error message.
Types of changes
Checklist: