Cyrene_v2/internal/services/backthink/push_outlet.go

package backthink

import (
	"bytes"
	"context"
	"encoding/json"
	"fmt"
	"io"
	"log/slog"
	"net/http"
	"strings"
	"time"

	"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/adapter"
	"git.yeij.top/AskaEth/Cyrene_v2/internal/logger"
)

// The push outlet (D1, design/12 §4/§6): proactive messages are mirrored to an
// external push service so the owner's mobile client is reached even when no
// WebSocket client or IM channel is live. Delivery is two-tier by design:
//
//  1. the owner's self-hosted unified push service (primary; PUSH_EXPORTER_URL),
//  2. Getui (个推) as the fallback for when the self-hosted service is down.
//
// Tier 2 has no SDK integration yet, so an unavailable primary logs an explicit
// "Getui fallback not integrated" note and reports not-delivered instead of
// pretending the message went out. The hook is fire-and-forget: it never delays
// or breaks the existing active-client / IM delivery.

// defaultExportTimeout bounds one export attempt so a hung endpoint cannot pin a
// goroutine forever.
const defaultExportTimeout = 5 * time.Second

// maxExportResponseBytes caps how much of the outlet's response body is drained
// before the connection is reused, so a hostile/buggy endpoint cannot stream an
// unbounded body into memory.
const maxExportResponseBytes = 4 << 10

// PushExporter reports one proactive message to an external push outlet. Export
// must be safe for concurrent use and must honor ctx. A nil error with
// delivered=false means the outlet could not deliver (for example the fallback
// tier is not wired); the caller treats that as a logged miss, never a failure
// of the local push path.
type PushExporter interface {
	Export(ctx context.Context, msg adapter.UnifiedMessage) (delivered bool, err error)
}

// PushOutletConfig carries the push-outlet wiring. Enabled=false disables the
// hook entirely (NewPushOutlet returns nil). URL/Token/Timeout describe the
// self-hosted primary service; the Getui* fields are reserved for the deferred
// fallback and are not consumed yet.
type PushOutletConfig struct {
	// Enabled turns the outlet hook on.
	Enabled bool
	// URL is the self-hosted unified push service endpoint (HTTP POST JSON).
	// Empty leaves the primary tier unconfigured.
	URL string
	// Token is sent as "Authorization: Bearer <token>". It is never logged.
	Token string
	// Timeout bounds one export attempt. Zero uses defaultExportTimeout.
	Timeout time.Duration
	// Log is the base logger. Nil uses a discard logger.
	Log *slog.Logger
}

// NewPushOutlet builds the two-tier push outlet from cfg. It returns nil when
// the hook is disabled, so the pusher simply skips the export step. When it is
// enabled the primary tier is the self-hosted HTTP endpoint (present only when
// URL is set) and the fallback tier is Getui, which is not integrated yet.
func NewPushOutlet(cfg PushOutletConfig) PushExporter {
	if !cfg.Enabled {
		return nil
	}
	log := logger.WithSource(baseLog(cfg.Log), "services/backthink/push_outlet")
	timeout := cfg.Timeout
	if timeout <= 0 {
		timeout = defaultExportTimeout
	}
	var primary PushExporter
	if url := strings.TrimSpace(cfg.URL); url != "" {
		primary = &httpPushExporter{
			url:    url,
			token:  cfg.Token,
			client: &http.Client{Timeout: timeout},
		}
	} else {
		log.Warn("push outlet enabled but PUSH_EXPORTER_URL is empty; only the (unwired) Getui fallback remains")
	}
	log.Info("push outlet configured", "primary", primary != nil, "fallback", "getui (not integrated)")
	return &pushOutlet{primary: primary, log: log}
}

// pushOutlet is the two-tier exporter: self-hosted service first, Getui second.
// The fallback is nil until the Getui SDK is integrated, so a primary miss is
// logged and reported as not delivered rather than silently dropped.
type pushOutlet struct {
	primary  PushExporter
	fallback PushExporter
	log      *slog.Logger
}

// Export implements PushExporter. It tries the primary tier and, when that does
// not deliver, the fallback tier. With no fallback wired it logs the pending
// integration and returns (false, nil): the caller treats that as a miss, never
// as a reason to fail the proactive push.
func (o *pushOutlet) Export(ctx context.Context, msg adapter.UnifiedMessage) (bool, error) {
	if o.primary != nil {
		delivered, err := o.primary.Export(ctx, msg)
		if err == nil && delivered {
			return true, nil
		}
		if err != nil {
			o.log.Warn("push outlet primary failed", "error", err)
		} else {
			o.log.Warn("push outlet primary did not deliver")
		}
	}
	if o.fallback != nil {
		return o.fallback.Export(ctx, msg)
	}
	o.log.Info("push outlet not delivered; getui fallback not integrated",
		"hint", "wire the Getui SDK + GETUI_* credentials to enable the fallback tier")
	return false, nil
}

// pushExportPayload is the JSON body POSTed to the self-hosted push service. It
// is deliberately small and stable: the service owns device targeting, the
// message carries only what is needed to render and de-duplicate it.
type pushExportPayload struct {
	// Source identifies the producer so the service can route/filter.
	Source string `json:"source"`
	// Title is a short display title (the persona name).
	Title string `json:"title"`
	// Content is the proactive message body (already stripped of internal
	// decision markers by buildProactiveMessage).
	Content string `json:"content"`
	// Platform is the outbound platform tag (cyrene-backthink or a concrete IM
	// platform).
	Platform string `json:"platform"`
	// Timestamp is the message time in Unix milliseconds.
	Timestamp int64 `json:"timestamp"`
}

// httpPushExporter posts the message to the self-hosted push service. A 2xx
// response means delivered; any other status or transport error is an error.
// The token travels only in the Authorization header and never reaches a log.
type httpPushExporter struct {
	url    string
	token  string
	client *http.Client
}

// Export implements PushExporter over HTTP POST JSON.
func (e *httpPushExporter) Export(ctx context.Context, msg adapter.UnifiedMessage) (bool, error) {
	body, err := json.Marshal(pushExportPayload{
		Source:    "cyrene/backthink",
		Title:     msg.Sender.DisplayName,
		Content:   msg.Content,
		Platform:  msg.Platform,
		Timestamp: msg.Timestamp.UnixMilli(),
	})
	if err != nil {
		return false, fmt.Errorf("push outlet: marshal payload: %w", err)
	}
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, e.url, bytes.NewReader(body))
	if err != nil {
		return false, fmt.Errorf("push outlet: build request: %w", e.redact(err))
	}
	req.Header.Set("Content-Type", "application/json")
	if e.token != "" {
		req.Header.Set("Authorization", "Bearer "+e.token)
	}
	resp, err := e.client.Do(req)
	if err != nil {
		return false, fmt.Errorf("push outlet: post: %w", e.redact(err))
	}
	defer func() { _ = resp.Body.Close() }()
	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, maxExportResponseBytes))
	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
		return false, fmt.Errorf("push outlet: unexpected status %d", resp.StatusCode)
	}
	return true, nil
}

// redact removes the endpoint URL from a transport error so a secret embedded in
// the URL (for example a query token) never reaches a log line.
func (e *httpPushExporter) redact(err error) error {
	if err == nil || e.url == "" {
		return err
	}
	msg := strings.ReplaceAll(err.Error(), e.url, "[push-outlet-url]")
	return fmt.Errorf("%s", msg)
}