Store cluster ID in database

This makes the cluster ID (previously system UUID) available to other instances and services.

Instead of `Config.getInstance().getSystemUuid()`, `ClusterInfo.getClusterId()` must be used from now on.

As the cluster ID is only generated once and then never updated, it will only be loaded upon first invocation of `ClusterInfo.getClusterId()`.

Updating of the cluster ID via API or UI is prevented by marking it as read-only.

Relates to DependencyTrack/hyades#925

Signed-off-by: nscuro <[email protected]>

src/main/java/org/dependencytrack/common/ClusterInfo.java

@@ -0,0 +1,64 @@
+/*
+ * This file is part of Dependency-Track.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * Copyright (c) OWASP Foundation. All Rights Reserved.
+ */
+package org.dependencytrack.common;
+
+import alpine.Config;
+import alpine.model.ConfigProperty;
+import com.google.common.base.Supplier;
+import com.google.common.base.Suppliers;
+import org.dependencytrack.model.ConfigPropertyConstants;
+import org.dependencytrack.persistence.QueryManager;
+
+import javax.jdo.Query;
+import java.util.UUID;
+
+import static java.util.Objects.requireNonNull;
+
+public final class ClusterInfo {
+
+    private static final Supplier<String> CLUSTER_ID_SUPPLIER = Suppliers.memoize(ClusterInfo::loadClusterId);
+
+    public static String getClusterId() {
+        return CLUSTER_ID_SUPPLIER.get();
+    }
+
+    private static String loadClusterId() {
+        if (Config.isUnitTestsEnabled()) {
+            return UUID.randomUUID().toString();
+        }
+
+        try (final var qm = new QueryManager()) {
+            final Query<ConfigProperty> query = qm.getPersistenceManager().newQuery(ConfigProperty.class);
+            query.setFilter("groupName == :groupName && propertyName == :propertyName");
+            query.setParameters(
+                    ConfigPropertyConstants.INTERNAL_CLUSTER_ID.getGroupName(),
+                    ConfigPropertyConstants.INTERNAL_CLUSTER_ID.getPropertyName()
+            );
+            query.setResult("propertyValue");
+
+            try {
+                final String clusterId = query.executeResultUnique(String.class);
+                return requireNonNull(clusterId, "Cluster ID must not be null");
+            } finally {
+                query.closeAll();
+            }
+        }
+    }
+
+}

src/main/java/org/dependencytrack/common/ManagedHttpClientFactory.java

@@ -90,7 +90,7 @@ public final class ManagedHttpClientFactory {
                 + SystemUtil.getOsName() + "; "
                 + SystemUtil.getOsVersion()
                 + ") ManagedHttpClient/"
-                + Config.getInstance().getSystemUuid();
+                + ClusterInfo.getClusterId();
     }
 
     private ManagedHttpClientFactory() { }

src/main/java/org/dependencytrack/model/ConfigPropertyAccessMode.java

@@ -0,0 +1,27 @@
+/*
+ * This file is part of Dependency-Track.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * Copyright (c) OWASP Foundation. All Rights Reserved.
+ */
+package org.dependencytrack.model;
+
+public enum ConfigPropertyAccessMode {
+
+    READ_ONLY,
+
+    READ_WRITE
+
+}

src/main/java/org/dependencytrack/resources/v1/AbstractConfigPropertyResource.java

@@ -24,6 +24,7 @@
 import alpine.model.IConfigProperty;
 import alpine.security.crypto.DataEncryption;
 import alpine.server.resources.AlpineResource;
+import org.dependencytrack.model.ConfigPropertyAccessMode;
 import org.dependencytrack.model.ConfigPropertyConstants;
 import org.dependencytrack.persistence.QueryManager;
 
@@ -55,6 +56,14 @@ Response updatePropertyValue(QueryManager qm, IConfigProperty json, IConfigPrope
     }
 
     private Response updatePropertyValueInternal(IConfigProperty json, IConfigProperty property) {
+        final ConfigPropertyConstants wellKnownProperty = ConfigPropertyConstants.ofProperty(property);
+        if (wellKnownProperty != null && wellKnownProperty.getAccessMode() == ConfigPropertyAccessMode.READ_ONLY) {
+            return Response
+                    .status(Response.Status.BAD_REQUEST)
+                    .entity("The property %s.%s can not be modified".formatted(property.getGroupName(), property.getPropertyName()))
+                    .build();
+        }
+
         if (property.getPropertyType() == IConfigProperty.PropertyType.BOOLEAN) {
             property.setPropertyValue(String.valueOf(BooleanUtil.valueOf(json.getPropertyValue())));
         } else if (property.getPropertyType() == IConfigProperty.PropertyType.INTEGER) {

src/test/java/org/dependencytrack/common/HttpClientPoolTest.java

@@ -18,12 +18,19 @@
  */
 package org.dependencytrack.common;
 
+import alpine.Config;
 import io.jsonwebtoken.lang.Assert;
 import org.apache.http.impl.client.CloseableHttpClient;
+import org.junit.BeforeClass;
 import org.junit.Test;
 
 public class HttpClientPoolTest {
 
+    @BeforeClass
+    public static void beforeClass() {
+        Config.enableUnitTests();
+    }
+
     @Test
     public void getClientTest() {
         CloseableHttpClient client = HttpClientPool.getClient();

src/test/java/org/dependencytrack/common/ManagedHttpClientFactoryTest.java

@@ -25,6 +25,7 @@
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.junit.Assert;
 import org.junit.Before;
+import org.junit.BeforeClass;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.contrib.java.lang.system.EnvironmentVariables;
@@ -34,6 +35,11 @@ public class ManagedHttpClientFactoryTest {
     @Rule
     public EnvironmentVariables environmentVariables = new EnvironmentVariables();
 
+    @BeforeClass
+    public static void beforeClass() {
+        Config.enableUnitTests();
+    }
+
     @Before
     public void before() {
         environmentVariables.set("http_proxy", "http://acme%5Cusername:[email protected]:1080");

src/test/java/org/dependencytrack/resources/v1/ConfigPropertyResourceTest.java

@@ -38,6 +38,8 @@
 import javax.ws.rs.core.Response;
 import java.util.Arrays;
 
+import static org.assertj.core.api.Assertions.assertThat;
+
 public class ConfigPropertyResourceTest extends ResourceTest {
 
     @Override
@@ -212,6 +214,30 @@ public void updateConfigPropertyEncryptedStringTest() {
         Assert.assertEquals("A encrypted string", json.getString("description"));
     }
 
+    @Test
+    public void updateConfigPropertyReadOnlyTest() {
+        qm.createConfigProperty(
+                ConfigPropertyConstants.INTERNAL_CLUSTER_ID.getGroupName(),
+                ConfigPropertyConstants.INTERNAL_CLUSTER_ID.getPropertyName(),
+                ConfigPropertyConstants.INTERNAL_CLUSTER_ID.getDefaultPropertyValue(),
+                ConfigPropertyConstants.INTERNAL_CLUSTER_ID.getPropertyType(),
+                ConfigPropertyConstants.INTERNAL_CLUSTER_ID.getDescription()
+        );
+
+        final Response response = target(V1_CONFIG_PROPERTY).request()
+                .header(X_API_KEY, apiKey)
+                .post(Entity.entity("""
+                        {
+                          "groupName": "internal",
+                          "propertyName": "cluster.id",
+                          "propertyValue": "foobar"
+                        }
+                        """, MediaType.APPLICATION_JSON));
+
+        assertThat(response.getStatus()).isEqualTo(400);
+        assertThat(getPlainTextBody(response)).isEqualTo("The property internal.cluster.id can not be modified");
+    }
+
     @Test
     public void updateConfigPropertiesAggregateTest() {
         ConfigProperty prop1 = qm.createConfigProperty("my.group", "my.string1", "ABC", IConfigProperty.PropertyType.STRING, "A string");
@@ -239,4 +265,5 @@ public void updateConfigPropertiesAggregateTest() {
         String body = json.getString(3);
         Assert.assertEquals("A Task scheduler cadence ("+prop4.getPropertyName()+") cannot be inferior to one hour.A value of -2 was provided.", body);
     }
+
 }