chore: configure actuator warmup

Author: malikzh

src/main/java/kz/ncanode/configuration/WarmupConfiguration.java

@@ -0,0 +1,55 @@
+package kz.ncanode.configuration;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import kz.ncanode.exception.WarmupException;
+import kz.ncanode.service.WarmupService;
+import lombok.RequiredArgsConstructor;
+import org.springframework.boot.actuate.health.Health;
+import org.springframework.boot.actuate.health.HealthIndicator;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.HandlerInterceptor;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+/**
+ * Пока не скачаны сертификаты УЦ / не обновлены CRL:
+ * <ul>
+ *   <li>{@code /actuator/health} показывает компоненты {@code ca} / {@code crl} со статусом DOWN
+ *       (а значит и общий статус — DOWN);</li>
+ *   <li>эндпоинты {@code /*}{@code /verify} отвечают 503.</li>
+ * </ul>
+ */
+@Configuration
+@RequiredArgsConstructor
+public class WarmupConfiguration implements WebMvcConfigurer {
+    private final WarmupService warmupService;
+
+    @Bean
+    public HealthIndicator caHealthIndicator() {
+        return () -> warmupService.isCaReady()
+            ? Health.up().build()
+            : Health.down().withDetail("reason", "CA certificates are not downloaded yet").build();
+    }
+
+    @Bean
+    public HealthIndicator crlHealthIndicator() {
+        return () -> warmupService.isCrlReady()
+            ? Health.up().build()
+            : Health.down().withDetail("reason", "CRL cache is not updated yet").build();
+    }
+
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        registry.addInterceptor(new HandlerInterceptor() {
+            @Override
+            public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
+                if (!warmupService.isReady()) {
+                    throw new WarmupException();
+                }
+                return true;
+            }
+        }).addPathPatterns("/*/verify");
+    }
+}

src/main/java/kz/ncanode/exception/WarmupException.java

@@ -0,0 +1,17 @@
+package kz.ncanode.exception;
+
+import org.springframework.http.HttpStatus;
+
+/**
+ * Сервер ещё не прогрелся: не скачаны сертификаты УЦ / не обновлены CRL.
+ */
+public class WarmupException extends ApplicationException {
+    public WarmupException() {
+        super("Service is warming up: CA certificate and CRL caches are not ready yet. Try again shortly.");
+    }
+
+    @Override
+    public Integer getStatus() {
+        return HttpStatus.SERVICE_UNAVAILABLE.value();
+    }
+}

src/main/java/kz/ncanode/service/CaService.java

@@ -157,6 +157,21 @@ public List<CertificateWrapper> buildChain(CertificateWrapper leaf) {
         return chain;
     }
 
+    /**
+     * Прогрет ли кэш УЦ: сертификаты скачаны и читаются (или фича выключена).
+     */
+    public boolean isCacheReady() {
+        if (!caConfiguration.isEnabled()) {
+            return true;
+        }
+
+        try {
+            return !getRootCertificates().isEmpty();
+        } catch (RuntimeException e) {
+            return false;
+        }
+    }
+
     public List<CertificateWrapper> getRootCertificates() {
         synchronized (directoryService) {
             synchronized (certificates) {

src/main/java/kz/ncanode/service/CrlService.java

@@ -77,6 +77,21 @@ private void initializeDeltaScheduler() {
         taskScheduler.schedule(() -> updateCache(false, crlConfiguration.getDelta(), CRL_CACHE_DELTA_DIR_NAME), periodicTrigger);
     }
 
+    /**
+     * Прогрет ли кэш CRL: хотя бы один full-CRL скачан (или фича/расписание выключены).
+     */
+    public boolean isCacheReady() {
+        if (!crlConfiguration.isEnabled() || crlConfiguration.getTtl() == null || crlConfiguration.getTtl() < 1) {
+            return true;
+        }
+
+        try {
+            return !getCrlFiles(CRL_CACHE_FULL_DIR_NAME).isEmpty();
+        } catch (RuntimeException e) {
+            return false;
+        }
+    }
+
     /**
      * Проверка сертификата в CRL
      *

src/main/java/kz/ncanode/service/WarmupService.java

@@ -0,0 +1,29 @@
+package kz.ncanode.service;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.List;
+
+/**
+ * Признак «прогрева» сервера: скачаны сертификаты УЦ и обновлены CRL.
+ * Пока не прогрет — {@code /actuator/health} отдаёт DOWN, а эндпоинты verify — 503.
+ */
+@Service
+@RequiredArgsConstructor
+public class WarmupService {
+    private final CaService caService;
+    private final List<CrlService> crlServices;
+
+    public boolean isCaReady() {
+        return caService.isCacheReady();
+    }
+
+    public boolean isCrlReady() {
+        return crlServices.stream().allMatch(CrlService::isCacheReady);
+    }
+
+    public boolean isReady() {
+        return isCaReady() && isCrlReady();
+    }
+}

src/main/resources/application.yml

@@ -37,6 +37,11 @@ ncanode:
   tsp:
     url: ${NCANODE_TSP_URL:http://tsp.pki.gov.kz/}
     retries: ${NCANODE_TSP_RETRIES:3}
+management:
+  endpoint:
+    health:
+      show-components: always
+      show-details: always
 springdoc:
   show-actuator: true
   swagger-ui:

src/test/groovy/kz/ncanode/unit/service/CaServiceExtraTest.groovy

@@ -148,6 +148,40 @@ class CaServiceExtraTest extends Specification implements WithTestData {
         caService.getRootCertificateFor(root).isEmpty()
     }
 
+    def "isCacheReady is true when the CA feature is disabled"() {
+        given:
+        def service = standalone()
+        caConfiguration.isEnabled() >> false
+
+        expect:
+        service.isCacheReady()
+    }
+
+    def "isCacheReady is false when root certificates cannot be loaded"() {
+        given:
+        def service = standalone()
+        caConfiguration.isEnabled() >> true
+        directoryService.getCachePathFor('ca') >> Optional.empty()
+
+        expect:
+        !service.isCacheReady()
+    }
+
+    def "isCacheReady is true once a CA certificate is cached"() {
+        given:
+        def service = standalone()
+        def dir = File.createTempDir()
+        new File(dir, 'root.cer').bytes = rootBytes()
+        caConfiguration.isEnabled() >> true
+        directoryService.getCachePathFor('ca') >> Optional.of(dir)
+
+        expect:
+        service.isCacheReady()
+
+        cleanup:
+        dir.deleteDir()
+    }
+
     def "updateCache(false) is a no-op when the CA feature is disabled"() {
         given:
         def service = standalone()

src/test/groovy/kz/ncanode/unit/service/CrlServiceExtraTest.groovy

@@ -52,6 +52,30 @@ class CrlServiceExtraTest extends Specification implements WithTestData {
         ResourceUtils.getFile("classpath:crl/${name}").bytes
     }
 
+    def "isCacheReady is true when CRL scheduling is disabled"() {
+        given:
+        crlConfiguration.isEnabled() >> false
+
+        expect:
+        service.isCacheReady()
+    }
+
+    def "isCacheReady reflects presence of a full CRL file"() {
+        given:
+        crlConfiguration.isEnabled() >> true
+        crlConfiguration.getTtl() >> 10
+        directoryService.getCachePathFor('crl/full') >> Optional.of(cacheDir)
+
+        expect:
+        !service.isCacheReady()
+
+        when:
+        new File(cacheDir, 'x.crl').text = 'x'
+
+        then:
+        service.isCacheReady()
+    }
+
     def "verify returns ACTIVE immediately when CRL checking is disabled"() {
         given:
         crlConfiguration.isEnabled() >> false

src/test/groovy/kz/ncanode/unit/service/WarmupServiceTest.groovy

@@ -0,0 +1,45 @@
+package kz.ncanode.unit.service
+
+import kz.ncanode.service.CaService
+import kz.ncanode.service.CrlService
+import kz.ncanode.service.WarmupService
+import spock.lang.Specification
+
+class WarmupServiceTest extends Specification {
+
+    CaService caService = Mock()
+    CrlService crlA = Mock()
+    CrlService crlB = Mock()
+
+    WarmupService service() {
+        new WarmupService(caService, [crlA, crlB])
+    }
+
+    def "isReady requires CA and every CRL service to be ready"() {
+        given:
+        caService.isCacheReady() >> ca
+        crlA.isCacheReady() >> a
+        crlB.isCacheReady() >> b
+
+        expect:
+        service().isReady() == expected
+
+        where:
+        ca    | a     | b     || expected
+        true  | true  | true  || true
+        false | true  | true  || false
+        true  | false | true  || false
+        true  | true  | false || false
+    }
+
+    def "exposes per-module readiness"() {
+        given:
+        caService.isCacheReady() >> true
+        crlA.isCacheReady() >> true
+        crlB.isCacheReady() >> false
+
+        expect:
+        service().isCaReady()
+        !service().isCrlReady()
+    }
+}