internal/notify
github.com/ensera-ai/taisce/internal/notify · 4 files · 544 lines · 8 tests · source
Package notify decides where a formation notification may be sent, and signs it.
What this package is allowed to decide, and what it must not
It decides whether a destination is permitted and what a signature is. It decides nothing about when a notification is owed, what it says, or how often it is retried — those are the store's and the sender's, because they are about the log and about failure, and this is about egress.
Why this is the most dangerous string in the product
Every other place memory or metadata leaves this system goes to an address an OPERATOR wrote down once: the model endpoint, the database. A notification goes to an address a CUSTOMER supplies through the API, with a credential they already hold. That is a request this deployment makes, to wherever it is told, from inside whatever network it runs in — the classic shape of an attack where the interesting target is not on the internet at all but one hop away on a private address.
So two independent things have to be true, and neither is a default. An operator must name the hosts a project may nominate, which means notifications do not exist until somebody deliberately turns them on. And the address must not resolve into this deployment's own neighbourhood, checked at the moment of sending rather than at the moment of registration, because a name that answered with a public address on Tuesday can answer with a private one on Wednesday.
Where it sits
Imports: none in this repository
Imported by: cmd/taisce, internal/api, internal/formation
Files
| File | Lines | Declarations | What it is for |
|---|---|---|---|
| config.go | 32 | 2 | The operator's two variables, and what their absence means. |
| destination.go | 151 | 7 | Carries the package documentation. |
| sender.go | 284 | 14 | Payload is the whole of what a notification says. |
| signature.go | 77 | 4 | SignatureHeader carries the version, the time and the signature, in one header. |
8 tests hold this package's behaviour; the list is named for what each one proves.