Workflows/ci/bff

.github/workflows/bff-ci.yml

@@ -0,0 +1,134 @@
+name: BFF Service CI (Rust)
+
+on:
+  push:
+    branches: ["dev", "master"]
+    paths:
+      - "backend/service/bff_service/**"
+      - "backend/libs/rust-core/**"
+      - "backend/proto/**"
+      - ".github/workflows/bff-ci.yml"
+  pull_request:
+    branches: ["dev", "master"]
+    paths:
+      - "backend/service/bff_service/**"
+      - "backend/libs/rust-core/**"
+      - "backend/proto/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  WORKING_DIR: backend/service/bff_service
+
+jobs:
+  lint-and-format:
+    name: Code Quality (Fmt & Clippy)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Protoc (Required for tonic-build)
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: backend
+
+      - name: Check Formatting
+        working-directory: ${{ env.WORKING_DIR }}
+        run: cargo fmt --all -- --check
+
+      - name: Run Clippy (Strict Mode)
+        working-directory: ${{ env.WORKING_DIR }}
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+
+  security-audit:
+    name: Security Audit (Cargo Audit)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@cargo-audit
+
+      - name: Run Vulnerability Scan
+        working-directory: ${{ env.WORKING_DIR }}
+        run: cargo audit
+
+  test-and-coverage:
+    name: Unit & Integration Tests
+    runs-on: ubuntu-latest
+    needs: [lint-and-format, security-audit]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Protoc
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: backend
+
+      - name: Run Tests & Generate Coverage
+        working-directory: ${{ env.WORKING_DIR }}
+        run: cargo llvm-cov test --all-features --workspace --lcov --output-path lcov.info --fail-under-lines 80
+
+      - name: Upload Coverage to Codecov (Optional)
+        uses: codecov/codecov-action@v4
+        with:
+          file: ${{ env.WORKING_DIR }}/lcov.info
+          fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+  docker-build-scan:
+    name: Build Docker & Trivy Scan
+    runs-on: ubuntu-latest
+    needs: test-and-coverage
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build Docker Image
+        uses: docker/build-push-action@v5
+        with:
+          context: backend
+          file: backend/service/bff_service/Dockerfile
+          push: false
+          tags: stremo/bff-service:dev-test
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "stremo/bff-service:dev-test"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL,HIGH"

backend/proto/auth.proto

@@ -0,0 +1,30 @@
+syntax = "proto3";
+
+package stremo.auth.v1;
+
+service AuthService {
+  rpc Login(LoginRequest) returns (LoginResponse);
+  rpc Register(RegisterRequest) returns (RegisterResponse);
+}
+
+message LoginRequest {
+  string email = 1;
+  string password = 2;
+}
+
+message LoginResponse {
+  string access_token = 1;
+  string refresh_token = 2;
+  uint32 expires_in = 3;
+}
+
+message RegisterRequest {
+  string username = 1;
+  string email = 2;
+  string password = 3;
+}
+
+message RegisterResponse {
+  string id = 1;
+  string message = 2;
+}

backend/proto/stream_meta.proto

@@ -0,0 +1,24 @@
+syntax = "proto3";
+
+package stremo.stream_meta.v1;
+
+service StreamMetaService {
+  rpc GetLiveStreams(GetLiveStreamsRequest) returns (GetLiveStreamsResponse);
+}
+
+message GetLiveStreamsRequest {
+  int32 limit = 1;
+  string cursor = 2;
+}
+
+message StreamDto {
+  string stream_id = 1;
+  string title = 2;
+  string category = 3;
+  int32 viewers_count = 4;
+}
+
+message GetLiveStreamsResponse {
+  repeated StreamDto streams = 1;
+  string next_cursor = 2;
+}

backend/service/bff_service/.dockerignore

@@ -0,0 +1,6 @@
+target/
+**/*.rs.bk
+Cargo.lock
+.git/
+.env
+Dockerfile

backend/service/bff_service/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "bff-service"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+rust-core = { path = "../../libs/rust-core" }
+axum = "0.7"
+tokio = { version = "1.37", features = ["full"] }
+tower = "0.4"
+tower-http = { version = "0.5", features = ["trace", "cors"] }
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+thiserror = "1.0"
+jsonwebtoken = "9.3"
+tonic = "0.11"
+prost = "0.12"
+redis = { version = "0.25", features = ["tokio-comp"] }
+bb8 = "0.8"
+bb8-redis = "0.15"
+dotenvy = "0.15"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+uuid = { version = "1.8", features = ["v4", "serde"] }
+anyhow = "1.0.102"
+[build-dependencies]
+tonic-build = "0.11"

backend/service/bff_service/Dockerfile

@@ -0,0 +1,14 @@
+FROM rust:1.85-slim-bookworm AS builder
+RUN apt-get update && apt-get install -y pkg-config libssl-dev cmake build-essential
+WORKDIR /app
+
+COPY . .
+RUN cargo build --release -p bff-service
+
+FROM gcr.io/distroless/cc-debian12
+WORKDIR /app
+COPY --from=builder /app/target/release/bff-service /app/bff-service
+ENV RUST_LOG=info
+ENV PORT=8000
+EXPOSE 8000
+CMD ["/app/bff-service"]

backend/service/bff_service/build.rs

@@ -0,0 +1,20 @@
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    println!("cargo:rerun-if-changed=../../proto/auth.proto");
+    println!("cargo:rerun-if-changed=../../proto/stream_meta.proto");
+    println!("cargo:rerun-if-changed=../../proto/errors.proto");
+
+    tonic_build::configure()
+        .build_server(false)
+        .build_client(true)
+        .out_dir(std::env::var("OUT_DIR").unwrap())
+        .compile(
+            &[
+                "../../proto/auth.proto",
+                "../../proto/stream_meta.proto",
+                "../../proto/errors.proto",
+            ],
+            &["../../proto"],
+        )?;
+
+    Ok(())
+}

backend/service/bff_service/src/api/handlers/auth.rs

@@ -0,0 +1,51 @@
+use axum::{extract::State, Json};
+use std::sync::Arc;
+
+use crate::{
+    models::{
+        requests::{LoginRequest, RegisterRequest},
+        responses::{LoginResponse, RegisterResponse},
+    },
+    utils::errors::AppError,
+    utils::state::AppState,
+};
+
+pub async fn login_handler(
+    State(state): State<Arc<AppState>>,
+    Json(payload): Json<LoginRequest>,
+) -> Result<Json<LoginResponse>, AppError> {
+    if payload.email.is_empty() || payload.password.is_empty() {
+        return Err(AppError::BadRequest(
+            "Email and password are required".to_string(),
+        ));
+    }
+
+    let mut auth_client = state.auth_grpc_client.clone();
+
+    let grpc_res = auth_client.login(payload.email, payload.password).await?;
+
+    Ok(Json(LoginResponse {
+        access_token: grpc_res.access_token,
+        refresh_token: grpc_res.refresh_token,
+        expires_in: grpc_res.expires_in,
+    }))
+}
+
+pub async fn register_handler(
+    State(state): State<Arc<AppState>>,
+    Json(payload): Json<RegisterRequest>,
+) -> Result<Json<RegisterResponse>, AppError> {
+    if payload.username.is_empty() {
+        return Err(AppError::BadRequest("Username is required".to_string()));
+    }
+
+    let mut auth_client = state.auth_grpc_client.clone();
+    let grpc_res = auth_client
+        .register(payload.username, payload.email, payload.password)
+        .await?;
+
+    Ok(Json(RegisterResponse {
+        id: grpc_res.id,
+        message: grpc_res.message,
+    }))
+}

backend/service/bff_service/src/api/handlers/mod.rs

@@ -0,0 +1,2 @@
+pub mod auth;
+pub mod stream;

backend/service/bff_service/src/api/handlers/stream.rs

@@ -0,0 +1,41 @@
+use axum::{
+    extract::{Query, State},
+    Json,
+};
+use std::sync::Arc;
+
+use crate::{
+    models::{
+        requests::GetStreamsQuery,
+        responses::{StreamCatalogItem, StreamCatalogResponse},
+    },
+    utils::errors::AppError,
+    utils::state::AppState,
+};
+
+pub async fn get_live_streams_handler(
+    State(state): State<Arc<AppState>>,
+    Query(query): Query<GetStreamsQuery>,
+) -> Result<Json<StreamCatalogResponse>, AppError> {
+    let limit = query.limit.unwrap_or(20);
+    let cursor = query.cursor.unwrap_or_default();
+
+    let mut stream_client = state.stream_meta_grpc_client.clone();
+    let grpc_res = stream_client.get_live_streams(limit, cursor).await?;
+
+    let streams = grpc_res
+        .streams
+        .into_iter()
+        .map(|s| StreamCatalogItem {
+            stream_id: s.stream_id,
+            title: s.title,
+            category: s.category,
+            viewers_count: s.viewers_count,
+        })
+        .collect();
+
+    Ok(Json(StreamCatalogResponse {
+        data: streams,
+        next_cursor: grpc_res.next_cursor,
+    }))
+}

backend/service/bff_service/src/api/mod.rs

@@ -0,0 +1,2 @@
+pub mod handlers;
+pub mod routes;

backend/service/bff_service/src/api/routes/auth.rs

@@ -0,0 +1,9 @@
+use crate::{api::handlers::auth, utils::state::AppState};
+use axum::{routing::post, Router};
+use std::sync::Arc;
+
+pub fn router() -> Router<Arc<AppState>> {
+    Router::new()
+        .route("/login", post(auth::login_handler))
+        .route("/register", post(auth::register_handler))
+}

backend/service/bff_service/src/api/routes/mod.rs

@@ -0,0 +1,2 @@
+pub mod auth;
+pub mod stream;

backend/service/bff_service/src/api/routes/stream.rs

@@ -0,0 +1,7 @@
+use crate::{api::handlers::stream, utils::state::AppState};
+use axum::{routing::get, Router};
+use std::sync::Arc;
+
+pub fn router() -> Router<Arc<AppState>> {
+    Router::new().route("/live", get(stream::get_live_streams_handler))
+}