feat: deliver authenticated task APIs, SDK and P1 regression

cmd/orbit-admin/main.go

@@ -0,0 +1,93 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"git.yuntuo.hk/k2safe/orbit/internal/config"
+	"git.yuntuo.hk/k2safe/orbit/internal/storage/mysql"
+)
+
+func main() {
+	if err := run(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+func run() error {
+	if len(os.Args) < 2 || os.Args[1] != "bootstrap" {
+		return errors.New("usage: orbit-admin bootstrap --application NAME --namespace NAME --environment NAME --queue NAME --output NEW_FILE")
+	}
+	flags := flag.NewFlagSet("bootstrap", flag.ContinueOnError)
+	var in mysql.BootstrapInput
+	var output string
+	flags.StringVar(&in.Application, "application", "", "new application name")
+	flags.StringVar(&in.Namespace, "namespace", "", "new namespace name")
+	flags.StringVar(&in.Environment, "environment", "", "environment name")
+	flags.StringVar(&in.Queue, "queue", "", "initial queue name")
+	flags.StringVar(&output, "output", "", "new private credentials JSON file")
+	if err := flags.Parse(os.Args[2:]); err != nil {
+		return err
+	}
+	if flags.NArg() != 0 || output == "" {
+		return errors.New("--output and named resource arguments are required")
+	}
+	cfg, err := config.Load()
+	if err != nil {
+		return err
+	}
+	file, err := os.OpenFile(output, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600)
+	if err != nil {
+		return errors.New("cannot create new private output file (existing files are never overwritten)")
+	}
+	defer file.Close()
+	delivered := false
+	defer func() {
+		if !delivered {
+			_ = os.Remove(output)
+		}
+	}()
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	db, err := mysql.Open(ctx, cfg.MySQLDSN, 2, 1)
+	if err != nil {
+		return err
+	}
+	defer db.Close()
+	err = mysql.Bootstrap(ctx, db, in, func(result mysql.BootstrapResult) error {
+		if err := json.NewEncoder(file).Encode(result); err != nil {
+			return err
+		}
+		if err := file.Sync(); err != nil {
+			return err
+		}
+		directory, err := os.Open(filepath.Dir(output))
+		if err != nil {
+			return err
+		}
+		err = directory.Sync()
+		closeErr := directory.Close()
+		if err != nil {
+			return err
+		}
+		if closeErr != nil {
+			return closeErr
+		}
+		delivered = true
+		return nil
+	})
+	if err != nil {
+		if delivered {
+			return errors.New("bootstrap commit could not be confirmed; private output was retained; verify its credential before retrying")
+		}
+		return errors.New("bootstrap failed before credential delivery; check schema, names and database access")
+	}
+	fmt.Println("Bootstrap committed. Credentials saved in the requested private file; valid for 30 days.")
+	return nil
+}

cmd/orbit/main.go

@@ -14,6 +14,7 @@ import (
 	"git.yuntuo.hk/k2safe/orbit/internal/config"
 	"git.yuntuo.hk/k2safe/orbit/internal/storage/mysql"
 	"git.yuntuo.hk/k2safe/orbit/internal/transport/httpserver"
+	"git.yuntuo.hk/k2safe/orbit/pulse/service"
 )
 
 func main() {
@@ -32,24 +33,29 @@ func run() error {
 	defer stop()
 	startup, cancel := context.WithTimeout(root, 10*time.Second)
 	db, err := mysql.Open(startup, cfg.MySQLDSN, cfg.MaxOpen, cfg.MaxIdle)
-	cancel()
 	if err != nil {
+		cancel()
 		return err
 	}
 	defer db.Close()
+	if err := mysql.CheckSchema(startup, db); err != nil {
+		cancel()
+		return err
+	}
+	cancel()
 	server := httpserver.New(cfg.HTTPAddr, func(ctx context.Context) error {
 		if err := db.PingContext(ctx); err != nil {
 			return err
 		}
 		return mysql.CheckSchema(ctx, db)
-	})
+	}, service.New(mysql.NewTaskStore(db)))
 	listener, err := net.Listen("tcp", cfg.HTTPAddr)
 	if err != nil {
 		return err
 	}
 	done := make(chan error, 1)
 	go func() { done <- server.Serve(listener) }()
-	slog.Info("Orbit bootstrap HTTP server starting", "address", listener.Addr().String(), "scope", "health endpoints only")
+	slog.Info("Orbit HTTP server starting", "address", listener.Addr().String(), "scope", "health, task and queue management")
 	select {
 	case err := <-done:
 		if errors.Is(err, http.ErrServerClosed) {