feat(lib): use new challenge creation flow (#749)

* feat(decaymap): add Delete method Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(lib/challenge): refactor Validate to take ValidateInput Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(lib): implement store interface Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(lib/store): all metapackage to import all store implementations Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(policy): import all store backends Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(lib): use new challenge creation flow Previously Anubis constructed challenge strings from request metadata. This was a good idea in spirit, but has turned out to be a very bad idea in practice. This new flow reuses the Store facility to dynamically create challenge values with completely random data. This is a fairly big rewrite of how Anubis processes challenges. Right now it defaults to using the in-memory storage backend, but on-disk (boltdb) and valkey-based adaptors will come soon. Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(decaymap): fix documentation typo Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(lib): fix SA4004 Signed-off-by: Xe Iaso <me@xeiaso.net> * test(lib/store): make generic storage interface test adaptor Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: spelling Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(decaymap): invert locking process for Delete Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(lib/store): add bbolt store implementation Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: spelling Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: go mod tidy Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(devcontainer): adapt to docker compose, add valkey service Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(lib): make challenges live for 30 minutes by default Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(lib/store): implement valkey backend Signed-off-by: Xe Iaso <me@xeiaso.net> * test(lib/store/valkey): disable tests if not using docker Signed-off-by: Xe Iaso <me@xeiaso.net> * test(lib/policy/config): ensure valkey stores can be loaded Signed-off-by: Xe Iaso <me@xeiaso.net> * Update metadata check-spelling run (pull_request) for Xe/store-interface Signed-off-by: check-spelling-bot <check-spelling-bot@users.noreply.github.com> on-behalf-of: @check-spelling <check-spelling-bot@check-spelling.dev> * chore(devcontainer): remove port forwards because vs code handles that for you Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(default-config): add a nudge to the storage backends section of the docs Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(docs): listen on 0.0.0.0 for dev container support Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(policy): document storage backends Signed-off-by: Xe Iaso <me@xeiaso.net> * docs: update CHANGELOG and internal links Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(admin/policies): don't start a sentence with as Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: fixes found in review Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Signed-off-by: check-spelling-bot <check-spelling-bot@users.noreply.github.com>
2025-07-04 20:42:28 +00:00 · 2025-07-04 20:42:28 +00:00 · dff2176beb
commit dff2176beb
parent 506d8817d5
43 changed files with 1539 additions and 140 deletions
--- a/lib/store/memory/memory.go
+++ b/lib/store/memory/memory.go
@ -0,0 +1,74 @@
+package memory
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/TecharoHQ/anubis/decaymap"
+	"github.com/TecharoHQ/anubis/lib/store"
+)
+
+type factory struct{}
+
+func (factory) Build(ctx context.Context, _ json.RawMessage) (store.Interface, error) {
+	return New(ctx), nil
+}
+
+func (factory) Valid(json.RawMessage) error { return nil }
+
+func init() {
+	store.Register("memory", factory{})
+}
+
+type impl struct {
+	store *decaymap.Impl[string, []byte]
+}
+
+func (i *impl) Delete(_ context.Context, key string) error {
+	if !i.store.Delete(key) {
+		return fmt.Errorf("%w: %q", store.ErrNotFound, key)
+	}
+
+	return nil
+}
+
+func (i *impl) Get(_ context.Context, key string) ([]byte, error) {
+	result, ok := i.store.Get(key)
+	if !ok {
+		return nil, fmt.Errorf("%w: %q", store.ErrNotFound, key)
+	}
+
+	return result, nil
+}
+
+func (i *impl) Set(_ context.Context, key string, value []byte, expiry time.Duration) error {
+	i.store.Set(key, value, expiry)
+	return nil
+}
+
+func (i *impl) cleanupThread(ctx context.Context) {
+	t := time.NewTicker(5 * time.Minute)
+	defer t.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			i.store.Cleanup()
+		}
+	}
+}
+
+// New creates a simple in-memory store. This will not scale to multiple Anubis instances.
+func New(ctx context.Context) store.Interface {
+	result := &impl{
+		store: decaymap.New[string, []byte](),
+	}
+
+	go result.cleanupThread(ctx)
+
+	return result
+}
--- a/lib/store/memory/memory_test.go
+++ b/lib/store/memory/memory_test.go
@ -0,0 +1,11 @@
+package memory
+
+import (
+	"testing"
+
+	"github.com/TecharoHQ/anubis/lib/store/storetest"
+)
+
+func TestImpl(t *testing.T) {
+	storetest.Common(t, factory{}, nil)
+}