| | | 1 | | using System.Threading.Channels; |
| | | 2 | | using ArturRios.Heimdall.Command.Services; |
| | | 3 | | |
| | | 4 | | namespace ArturRios.Heimdall.WebApi.Email; |
| | | 5 | | |
| | | 6 | | /// <summary> |
| | | 7 | | /// The in-process queue between UC-12's handler and <see cref="PasswordRecoveryDispatcher" />. |
| | | 8 | | /// Bounded, never blocks the caller, and holds only what the caller sent: an address and an |
| | | 9 | | /// optional scope. |
| | | 10 | | /// </summary> |
| | | 11 | | /// <remarks> |
| | | 12 | | /// <para> |
| | | 13 | | /// <b>Why a queue, and why in memory.</b> AF-12a's anti-enumeration promise needs the request |
| | | 14 | | /// path to do the same work for every address. Two shapes were considered: |
| | | 15 | | /// </para> |
| | | 16 | | /// <list type="bullet"> |
| | | 17 | | /// <item> |
| | | 18 | | /// A constant response-time floor. To hide a Mailgun round trip it would have to exceed |
| | | 19 | | /// Mailgun's worst latency — the client's timeout, a hundred seconds — or leak exactly on |
| | | 20 | | /// the slow sends, and it would hold every caller's connection open for that long, which |
| | | 21 | | /// turns the endpoint into a cheap way to tie up the server. |
| | | 22 | | /// </item> |
| | | 23 | | /// <item> |
| | | 24 | | /// A durable outbox in the database. It survives a restart, but it would keep every |
| | | 25 | | /// address anybody typed — registered or not — at rest, which is personal data of people |
| | | 26 | | /// who are not users, with no retention rule covering it. And nothing here is worth that: |
| | | 27 | | /// a lost request is one the caller simply repeats, since UC-12 promises nothing more |
| | | 28 | | /// than "if the address is registered, a link is on its way". |
| | | 29 | | /// </item> |
| | | 30 | | /// </list> |
| | | 31 | | /// <para> |
| | | 32 | | /// The queue holds no secret: the reset token is created by the dispatcher, after the |
| | | 33 | | /// request has left. It lives as long as the process does, and a restart drops whatever was |
| | | 34 | | /// waiting — at most a few seconds' worth, given the per-address rate limit in front of it. |
| | | 35 | | /// </para> |
| | | 36 | | /// <para> |
| | | 37 | | /// <b>Bounded, and dropping when full.</b> <see cref="Capacity" /> caps the memory a burst can |
| | | 38 | | /// take while Mailgun is slow or down. A request that does not fit is dropped and logged |
| | | 39 | | /// rather than waited for, because waiting would put Mailgun's latency back on the request |
| | | 40 | | /// path — the thing the queue exists to remove. |
| | | 41 | | /// </para> |
| | | 42 | | /// </remarks> |
| | 902 | 43 | | public sealed class PasswordRecoveryQueue(ILogger<PasswordRecoveryQueue> logger) : IPasswordRecoveryQueue |
| | | 44 | | { |
| | | 45 | | /// <summary>Requests held at most while the dispatcher catches up.</summary> |
| | | 46 | | public const int Capacity = 1024; |
| | | 47 | | |
| | 902 | 48 | | private readonly Channel<PasswordRecoveryRequest> _channel = Channel.CreateBounded<PasswordRecoveryRequest>( |
| | 902 | 49 | | new BoundedChannelOptions(Capacity) |
| | 902 | 50 | | { |
| | 902 | 51 | | // Wait, not one of the Drop modes: TryWrite never waits in any mode, and Wait is the one |
| | 902 | 52 | | // where a full queue makes TryWrite report false instead of silently discarding an item. |
| | 902 | 53 | | FullMode = BoundedChannelFullMode.Wait, |
| | 902 | 54 | | SingleReader = true |
| | 902 | 55 | | }); |
| | | 56 | | |
| | | 57 | | /// <summary>The dispatcher's end of the queue.</summary> |
| | 901 | 58 | | public ChannelReader<PasswordRecoveryRequest> Reader => _channel.Reader; |
| | | 59 | | |
| | | 60 | | public bool TryEnqueue(PasswordRecoveryRequest request) |
| | | 61 | | { |
| | 1056 | 62 | | if (_channel.Writer.TryWrite(request)) |
| | | 63 | | { |
| | 1055 | 64 | | return true; |
| | | 65 | | } |
| | | 66 | | |
| | | 67 | | // No address in the log (NFR-22): which request was dropped does not matter, that one was. |
| | 1 | 68 | | logger.LogWarning( |
| | 1 | 69 | | "The password recovery queue is full ({Capacity}); a recovery request was dropped", Capacity); |
| | | 70 | | |
| | 1 | 71 | | return false; |
| | | 72 | | } |
| | | 73 | | } |