graphql.go

package retraced

import (
	"bytes"
	"encoding/json"
	"fmt"
	"html/template"
	"io"
	"log"
	"net/http"
	"strconv"
	"strings"
	"time"
)

type StructuredQuery struct {
	Action        string
	CRUD          string
	ReceivedStart time.Time
	ReceivedEnd   time.Time
	CreatedStart  time.Time
	CreatedEnd    time.Time
	ActorName     string
	ActorID       string
	Description   string
	Location      string
}

func maybeRFC3339(t time.Time) string {
	if t.IsZero() {
		return ""
	}
	return t.Format(time.RFC3339)
}

func (sq *StructuredQuery) String() string {
	var params []string

	if sq.Action != "" {
		param := fmt.Sprintf("action:%q", sq.Action)
		params = append(params, param)
	}
	if sq.CRUD != "" {
		param := fmt.Sprintf("crud:%q", sq.CRUD)
		params = append(params, param)
	}
	received := fmt.Sprintf("%s,%s", maybeRFC3339(sq.ReceivedStart), maybeRFC3339(sq.ReceivedEnd))
	if received != "," {
		params = append(params, "received:"+received)
	}
	created := fmt.Sprintf("%s,%s", maybeRFC3339(sq.CreatedStart), maybeRFC3339(sq.CreatedEnd))
	if created != "," {
		params = append(params, "created:"+created)
	}
	if sq.ActorID != "" {
		param := fmt.Sprintf("actor.id:%s", sq.ActorID)
		params = append(params, param)
	}
	if sq.ActorName != "" {
		param := fmt.Sprintf("actor.name:%q" + sq.ActorName)
		params = append(params, param)
	}
	if sq.Description != "" {
		param := fmt.Sprintf("description:%q", sq.Description)
		params = append(params, param)
	}
	if sq.Location != "" {
		param := fmt.Sprintf("location:%q", sq.Location)
		params = append(params, param)
	}

	return strings.Join(params, " ")
}

// EventNode represents an event returned from the Retraced GraphQL API. Some
// fields are identical to the reported Event field and others are modified or
// added.
type EventNode struct {
	// ID is the uuid generated by the Retraced API when the event was
	// reported.
	ID string `json:"id"`

	// Action is the reported Action.
	Action string `json:"action"`

	// Group contains an augmented form of the reported group: if the
	// reported event included a group.ID and no group.Name, but the group
	// Name could be inferred from the group.ID at the time of creation,
	// then group.Name will be defined.
	Group *Group `json:"group"`

	// Created is the reported Created timestamp.
	Created time.Time `json:"created"`

	// CRUD is the reported CRUD field.
	CRUD string

	// Target is an augmented form of the reported target. If the reported
	// event included a target.ID, then target.Name, target.Type,
	// target.Href, and target.Fields will be populated with any data known
	// about the target at the time the event was reported.
	Target *Target `json:"target"`

	// Description is the reported Description.
	Description string `json:"description"`

	// SourceIP is the reported SourceIP.
	SourceIP string `json:"source_ip"`

	// Actor is an augmented form of the reported actor. If the reported
	// event included an actor.ID, then actor.Name, actor.Href, and
	// actor.Fields will be populated with any data known about the actor
	// at the time the event was reported.
	Actor *Actor `json:"actor"`

	// Fields contains the reported Fields.
	Fields Fields `json:"fields"`

	// IsFailure is the reported IsFailure flag.
	IsFailure bool `json:"is_failure"`

	// IsAnonymous is the reported IsAnonymous flag.
	IsAnonymous bool `json:"is_anonymous"`

	// Component is the reported Component.
	Component string `json:"component"`

	// Version is the reported Version.
	Version string `json:"version"`

	// Display the holds the display templates for the event.
	Display *Display `json:"display"`

	// Country is populated from the reported SourceIP.
	Country string `json:"country"`

	// LocSubdiv1 is populated from the reported SourceIP.
	LocSubdiv1 string `json:"loc_subdiv1"`

	// LocSubdiv2 is populated from the reported SourceIP.
	LocSubdiv2 string `json:"loc_subdiv2"`

	// Received is the timestamp the Retraced API received the reported event.
	Received time.Time `json:"received"`

	// CanonicalTime is the reported Created timestamp if defined, else the
	// Received time.
	CanonicalTime time.Time `json:"canonical_time"`

	// Raw is the json of the original reported event.
	Raw string `json:"raw"`

	ExternalID string `json:"external_id"`

	Metadata Fields `json:"metadata"`
}

// https://preview.retraced.io/documentation/advanced-retraced/display-templates/
type Display struct {
	Markdown string `json:"markdown"`
}

// EventNodeMask specifies fields to retrieve in a GraphQL search.
type EventNodeMask struct {
	ID            bool
	Action        bool
	CRUD          bool
	Description   bool
	IsFailure     bool
	IsAnonymous   bool
	SourceIP      bool
	Country       bool
	LocSubdiv1    bool
	LocSubdiv2    bool
	Received      bool
	Created       bool
	CanonicalTime bool
	Component     bool
	Version       bool
	Fields        bool
	Raw           bool
	ExternalID    bool
	Metadata 			bool

	GroupID   bool
	GroupName bool

	ActorID     bool
	ActorName   bool
	ActorHref   bool
	ActorFields bool

	TargetID     bool
	TargetName   bool
	TargetHref   bool
	TargetType   bool
	TargetFields bool

	DisplayMarkdown bool
}

// AnyGroup is true iff any group field (id or name) is on.
func (mask *EventNodeMask) AnyGroup() bool {
	return mask.GroupID || mask.GroupName
}

// AnyActor is true iff any actor field is on.
func (mask *EventNodeMask) AnyActor() bool {
	return mask.ActorID || mask.ActorName || mask.ActorHref || mask.ActorFields
}

// AnyTarget is true iff any target field is on.
func (mask *EventNodeMask) AnyTarget() bool {
	return mask.TargetID || mask.TargetName || mask.TargetHref || mask.TargetType || mask.TargetFields
}

// AnyDisplay is true iff any display field is on.
func (mask *EventNodeMask) AnyDisplay() bool {
	return mask.DisplayMarkdown
}

var searchTmplSource = `query Search($query: String!, $last: Int, $before: String) {
	search(query: $query, last: $last, before: $before) {
		totalCount,
		pageInfo {
			hasPreviousPage
		}
		edges {
			cursor
			node {
				{{if .ID -}}		id		{{- end}}
				{{if .Action -}}	action		{{- end}}
				{{if .CRUD -}}		crud		{{- end}}
				{{if .Description -}}	description	{{- end}}
				{{if .IsFailure -}}	is_failure	{{- end}}
				{{if .IsAnonymous -}}	is_anonymous	{{- end}}
				{{if .SourceIP -}}	source_ip	{{- end}}
				{{if .Country -}}	country		{{- end}}
				{{if .LocSubdiv1 -}}	loc_subdiv1	{{- end}}
				{{if .LocSubdiv2 -}}	loc_subdiv2	{{- end}}
				{{if .Received -}}	received	{{- end}}
				{{if .Created -}}	created		{{- end}}
				{{if .CanonicalTime -}}	canonical_time	{{- end}}
				{{if .Component -}}	component	{{- end}}
				{{if .Version -}}	version		{{- end}}
				{{if .Raw -}}		raw		{{- end}}
				{{if .Fields -}}	fields {
								key
								value
							}		{{- end}}
				{{if .ExternalID -}}	external_id		{{- end}}
				{{if .Metadata -}}  metadata {
								key
								value
							}		{{- end}}
				{{if .AnyGroup -}}	group {
					{{if .GroupID -}}	id	{{- end}}
					{{if .GroupName -}}	name	{{- end}}
				}{{end}}
				{{if .AnyActor -}}	actor {
					{{if .ActorID -}}	id	{{- end}}
					{{if .ActorName -}}	name	{{- end}}
					{{if .ActorHref -}}	href	{{- end}}
					{{if .ActorFields -}}	fields {
									key
									value
								}	{{- end}}
				}{{end}}
				{{if .AnyTarget -}}	target {
					{{if .TargetID -}}	id	{{- end}}
					{{if .TargetName -}}	name	{{- end}}
					{{if .TargetHref -}}	href	{{- end}}
					{{if .TargetType -}}	type	{{- end}}
					{{if .TargetFields -}}	fields {
									key
									value
								}	{{- end}}
				}{{end}}
				{{if .AnyDisplay -}}	display{
					{{if .DisplayMarkdown }}markdown{{end}}
				}{{end}}
			}
		}
	}
}`
var searchTmpl = template.Must(template.New("search").Parse(searchTmplSource))

// SearchOpQuery generates the graphQL query body string for a search operation.
func (mask *EventNodeMask) SearchOpQuery() (string, error) {
	var buf bytes.Buffer
	err := searchTmpl.Execute(&buf, mask)
	if err != nil {
		return "", err
	}

	return buf.String(), nil
}

// CSVHeaders generates a row of header fields
func (mask *EventNodeMask) CSVHeaders() []string {
	var headers []string

	if mask.ID {
		headers = append(headers, "id")
	}
	if mask.Action {
		headers = append(headers, "action")
	}
	if mask.CRUD {
		headers = append(headers, "crud")
	}
	if mask.Description {
		headers = append(headers, "description")
	}
	if mask.IsFailure {
		headers = append(headers, "is_failure")
	}
	if mask.IsAnonymous {
		headers = append(headers, "is_anonymous")
	}
	if mask.SourceIP {
		headers = append(headers, "source_ip")
	}
	if mask.Country {
		headers = append(headers, "country")
	}
	if mask.LocSubdiv1 {
		headers = append(headers, "loc_subdiv1")
	}
	if mask.LocSubdiv2 {
		headers = append(headers, "loc_subdiv2")
	}
	if mask.Received {
		headers = append(headers, "received")
	}
	if mask.Created {
		headers = append(headers, "created")
	}
	if mask.CanonicalTime {
		headers = append(headers, "canonical_time")
	}
	if mask.Component {
		headers = append(headers, "component")
	}
	if mask.Version {
		headers = append(headers, "version")
	}
	if mask.Fields {
		headers = append(headers, "fields")
	}
	if mask.Raw {
		headers = append(headers, "raw")
	}
	if mask.ExternalID {
		headers = append(headers, "external_id")
	}
	if mask.Metadata {
		headers = append(headers, "metadata")
	}
	if mask.GroupID {
		headers = append(headers, "group_id")
	}
	if mask.GroupName {
		headers = append(headers, "group_name")
	}
	if mask.ActorID {
		headers = append(headers, "actor_id")
	}
	if mask.ActorName {
		headers = append(headers, "actor_name")
	}
	if mask.ActorHref {
		headers = append(headers, "actor_href")
	}
	if mask.ActorFields {
		headers = append(headers, "actor_fields")
	}
	if mask.TargetID {
		headers = append(headers, "target_id")
	}
	if mask.TargetName {
		headers = append(headers, "target_name")
	}
	if mask.TargetHref {
		headers = append(headers, "target_href")
	}
	if mask.TargetType {
		headers = append(headers, "target_type")
	}
	if mask.TargetFields {
		headers = append(headers, "target_fields")
	}
	if mask.DisplayMarkdown {
		headers = append(headers, "display_markdown")
	}

	return headers
}

// CSVRow formats an event as a csv row
func (mask *EventNodeMask) CSVRow(e *EventNode) []string {
	var fields []string

	if mask.ID {
		fields = append(fields, e.ID)
	}
	if mask.Action {
		fields = append(fields, e.Action)
	}
	if mask.CRUD {
		fields = append(fields, e.CRUD)
	}
	if mask.Description {
		fields = append(fields, e.Description)
	}
	if mask.IsFailure {
		fields = append(fields, strconv.FormatBool(e.IsFailure))
	}
	if mask.IsAnonymous {
		fields = append(fields, strconv.FormatBool(e.IsAnonymous))
	}
	if mask.SourceIP {
		fields = append(fields, e.SourceIP)
	}
	if mask.Country {
		fields = append(fields, e.Country)
	}
	if mask.LocSubdiv1 {
		fields = append(fields, e.LocSubdiv1)
	}
	if mask.LocSubdiv2 {
		fields = append(fields, e.LocSubdiv2)
	}
	if mask.Received {
		fields = append(fields, e.Received.Format(time.RFC3339))
	}
	if mask.Created {
		fields = append(fields, e.Created.Format(time.RFC3339))
	}
	if mask.CanonicalTime {
		fields = append(fields, e.CanonicalTime.Format(time.RFC3339))
	}
	if mask.Component {
		fields = append(fields, e.Component)
	}
	if mask.Version {
		fields = append(fields, e.Version)
	}
	if mask.Fields {
		fields = append(fields, e.Fields.String())
	}
	if mask.Raw {
		fields = append(fields, e.Raw)
	}
	if mask.ExternalID {
		fields = append(fields, e.ExternalID)
	}
	if mask.Metadata {
		fields = append(fields, e.Metadata.String())
	}
	if mask.GroupID {
		var groupID string
		if e.Group != nil {
			groupID = e.Group.ID
		}
		fields = append(fields, groupID)
	}
	if mask.GroupName {
		var groupName string
		if e.Group != nil {
			groupName = e.Group.Name
		}
		fields = append(fields, groupName)
	}
	if mask.ActorID {
		var actorID string
		if e.Actor != nil {
			actorID = e.Actor.ID
		}
		fields = append(fields, actorID)
	}
	if mask.ActorName {
		var actorName string
		if e.Actor != nil {
			actorName = e.Actor.Name
		}
		fields = append(fields, actorName)
	}
	if mask.ActorHref {
		var actorHref string
		if e.Actor != nil {
			actorHref = e.Actor.Href
		}
		fields = append(fields, actorHref)
	}
	if mask.ActorFields {
		var actorFields string
		if e.Actor != nil {
			actorFields = e.Actor.Fields.String()
		}
		fields = append(fields, actorFields)
	}
	if mask.TargetID {
		var targetID string
		if e.Target != nil {
			targetID = e.Target.ID
		}
		fields = append(fields, targetID)
	}
	if mask.TargetName {
		var targetName string
		if e.Target != nil {
			targetName = e.Target.Name
		}
		fields = append(fields, targetName)
	}
	if mask.TargetHref {
		var targetHref string
		if e.Target != nil {
			targetHref = e.Target.Href
		}
		fields = append(fields, targetHref)
	}
	if mask.TargetType {
		var targetType string
		if e.Target != nil {
			targetType = e.Target.Type
		}
		fields = append(fields, targetType)
	}
	if mask.TargetFields {
		var targetFields string
		if e.Target != nil {
			targetFields = e.Target.Fields.String()
		}
		fields = append(fields, targetFields)
	}
	if mask.DisplayMarkdown {
		var displayMarkdown string
		if e.Display != nil {
			displayMarkdown = e.Display.Markdown
		}
		fields = append(fields, displayMarkdown)
	}

	return fields
}

type graphQLSearchVariables struct {
	Last   int    `json:"last,omitempty"`
	Before string `json:"before,omitempty"`
	Query  string `json:"query"`
}

type graphQLSearchBody struct {
	Query     string                  `json:"query"`
	Variables *graphQLSearchVariables `json:"variables,omitempty"`
}

type pageInfo struct {
	HasPreviousPage bool `json:"hasPreviousPage"`
}

type EventEdge struct {
	Cursor string     `json:"cursor"`
	Node   *EventNode `json:"node"`
}

type graphQLSearch struct {
	TotalCount int          `json:"totalCount"`
	PageInfo   pageInfo     `json:"pageInfo"`
	Edges      []*EventEdge `json:"edges"`
}

type graphQLSearchData struct {
	Search graphQLSearch `json:"search"`
}

type graphQLSearchRoot struct {
	Data graphQLSearchData `json:"data"`
}

// EventsConnection handles cursor-based pagination over query results.
type EventsConnection struct {
	url             string
	authorization   string
	structuredQuery *StructuredQuery
	mask            *EventNodeMask
	cursors         []string
	pageSize        int

	httpClient *http.Client

	// If this connection's mask specifies fields in a nested struct, then
	// that struct will be non-nil for results. For example, if the mask
	// specifies GroupID, then Group will be non-nil even on events reported
	// without a group ID.
	currentResults []*EventNode
	totalCount     int
	// 1-indexed
	currentPageNumber int
}

func (ec *EventsConnection) NextPage() error {
	return ec.call()
}

func (ec *EventsConnection) TotalPages() int {
	pages := ec.totalCount / ec.pageSize
	if ec.totalCount%ec.pageSize != 0 {
		pages++
	}
	return pages
}

func (ec *EventsConnection) HasNextPage() bool {
	return ec.currentPageNumber < ec.TotalPages()
}

func (ec *EventsConnection) HasPreviousPage() bool {
	return ec.currentPageNumber > 1
}

func (ec *EventsConnection) CurrentPageNumber() int {
	return ec.currentPageNumber
}

func (ec *EventsConnection) CurrentResults() []*EventNode {
	return ec.currentResults
}

func (ec *EventsConnection) TotalCount() int {
	return ec.totalCount
}

// cursor returns the last item in EventsConnection.cursors
func (ec *EventsConnection) cursor() string {
	n := len(ec.cursors)
	if n == 0 {
		ec.cursors = []string{""}
		n = 1
	}
	return ec.cursors[n-1]
}

func (ec *EventsConnection) call() error {
	graphQLQuery, err := ec.mask.SearchOpQuery()
	if err != nil {
		return err
	}
	eventQuery := ""
	if ec.structuredQuery != nil {
		eventQuery = ec.structuredQuery.String()
	}
	encoded, err := json.Marshal(&graphQLSearchBody{
		Query: graphQLQuery,
		Variables: &graphQLSearchVariables{
			Last:   ec.pageSize,
			Before: ec.cursor(),
			Query:  eventQuery,
		},
	})
	if err != nil {
		return err
	}
	req, err := http.NewRequest("POST", ec.url, bytes.NewBuffer(encoded))
	if err != nil {
		return err
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", ec.authorization)
	req.Header.Set("Accept", "application/json")

	resp, err := ec.httpClient.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		if body, err := io.ReadAll(resp.Body); err == nil {
			log.Printf("GraphQL error response: %s", body)
		}
		return fmt.Errorf("unexpected response from retraced api endpoint %s: %d", req.URL.String(), resp.StatusCode)
	}

	root := &graphQLSearchRoot{}
	err = json.NewDecoder(resp.Body).Decode(root)
	if err != nil {
		return err
	}

	ec.totalCount = root.Data.Search.TotalCount
	ec.currentPageNumber = len(ec.cursors)

	hits := len(root.Data.Search.Edges)
	events := make([]*EventNode, 0, hits)
	for i, edge := range root.Data.Search.Edges {
		event := edge.Node
		if ec.mask.AnyGroup() && event.Group == nil {
			event.Group = &Group{}
		}
		if ec.mask.AnyActor() && event.Actor == nil {
			event.Actor = &Actor{}
		}
		if ec.mask.AnyTarget() && event.Target == nil {
			event.Target = &Target{}
		}
		if ec.mask.AnyDisplay() && event.Display == nil {
			event.Display = &Display{}
		}
		events = append(events, edge.Node)

		if root.Data.Search.PageInfo.HasPreviousPage && i == hits-1 {
			ec.cursors = append(ec.cursors, edge.Cursor)
		}
	}
	ec.currentResults = events

	return nil
}