Updates to sync with dev

Signed-off-by: Lukasz Gryglicki <[email protected]>

Assisted by [OpenAI](https://platform.openai.com/)

Assisted by [GitHub Copilot](https://github.com/features/copilot)

Author: lukaszgryglicki

cla-backend-go/cmd/gitlab/auth/main.go

@@ -10,6 +10,7 @@ import (
 	"net/url"
 	"os"
 	"strconv"
+	"sync"
 
 	"github.com/gin-gonic/gin"
 	"github.com/go-resty/resty/v2"
@@ -39,6 +40,8 @@ var passingUsers = map[string]bool{
 	"[email protected]": true,
 }
 
+var passingUsersMutex sync.RWMutex // Protects passingUsers map
+
 func main() {
 	r := gin.Default()
 	r.GET("/gitlab/sign", func(c *gin.Context) {
@@ -265,7 +268,11 @@ func setCommitStatus(projectID interface{}, commitSha string, userEmail string,
 	setState := gitlab.Failed
 
 	if forceState == "" {
-		if passingUsers[userEmail] {
+		passingUsersMutex.RLock()
+		isPassingUser := passingUsers[userEmail]
+		passingUsersMutex.RUnlock()
+
+		if isPassingUser {
 			setState = gitlab.Success
 		}
 	} else {

cla-backend-go/cmd/migrate_approval_list/main.go

@@ -50,6 +50,7 @@ var ghOrgRepo github_organizations.Repository
 var gerritService gerrits.Service
 var eventsByType []*v1Models.Event
 var toUpdateApprovalItems []approvals.ApprovalItem
+var toUpdateApprovalItemsMutex sync.Mutex // Protects toUpdateApprovalItems slice
 
 type combinedRepo struct {
 	users.UserRepository
@@ -252,7 +253,9 @@ func updateApprovalsTable(signature *signatures.ItemSignature) error {
 				Active:              true,
 			}
 
+			toUpdateApprovalItemsMutex.Lock()
 			toUpdateApprovalItems = append(toUpdateApprovalItems, approvalItem)
+			toUpdateApprovalItemsMutex.Unlock()
 		}
 	}
 

cla-backend-go/health/service.go

@@ -78,6 +78,7 @@ func (s Service) HealthCheck(ctx context.Context) (*models.Health, error) {
 // getDynamoTableStatus queries the dynamodb tables and reports if it is healthy
 func getDynamoTableStatus() []*models.HealthStatus {
 	var allStatus []*models.HealthStatus
+	var mu sync.Mutex
 
 	tableNames := []string{
 		"cla-" + ini.GetStage() + "-ccla-whitelist-requests",
@@ -114,7 +115,9 @@ func getDynamoTableStatus() []*models.HealthStatus {
 				Name:     "EasyCLA - Dynamodb - " + tableName,
 				Duration: dynamoDuration.String()}
 
+			mu.Lock()
 			allStatus = append(allStatus, &dy)
+			mu.Unlock()
 		}(tableName)
 	}
 

cla-backend-go/template/repository.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"sort"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/linuxfoundation/easycla/cla-backend-go/utils"
@@ -33,6 +34,7 @@ var (
 	ApacheStyleTemplateID = "fb4cc144-a76c-4c17-8a52-c648f158fded"
 	// ASWFStyleTemplateID is template id for ASWF
 	ASWFStyleTemplateID = "18b8ad08-d7d4-4d75-ad25-30bbfffd59cf"
+	templateMapMutex    sync.RWMutex // Protects templateMap
 )
 
 // RepositoryInterface interface functions
@@ -117,9 +119,12 @@ func (r Repository) GetTemplates(ctx context.Context) ([]models.Template, error)
 
 	log.WithFields(f).Debug("Loading templates...")
 	var templates []models.Template
+
+	templateMapMutex.RLock()
 	for _, template := range templateMap {
 		templates = append(templates, template)
 	}
+	templateMapMutex.RUnlock()
 
 	// Sort the template list based on the name
 	log.WithFields(f).Debug("Sorting templates...")
@@ -139,6 +144,8 @@ func (r Repository) GetTemplateName(ctx context.Context, templateID string) (str
 	}
 
 	// For each template...
+	templateMapMutex.RLock()
+	defer templateMapMutex.RUnlock()
 	for _, template := range templateMap {
 		// If we have a match
 		if template.ID == templateID {
@@ -152,7 +159,10 @@ func (r Repository) GetTemplateName(ctx context.Context, templateID string) (str
 
 // GetTemplate returns the template based on the template ID
 func (r Repository) GetTemplate(templateID string) (models.Template, error) {
+	templateMapMutex.RLock()
 	template, ok := templateMap[templateID]
+	templateMapMutex.RUnlock()
+
 	if !ok {
 		return models.Template{}, ErrTemplateNotFound
 	}
@@ -162,7 +172,9 @@ func (r Repository) GetTemplate(templateID string) (models.Template, error) {
 
 // CLAGroupTemplateExists return true if the specified template ID exists, false otherwise
 func (r Repository) CLAGroupTemplateExists(ctx context.Context, templateID string) bool {
+	templateMapMutex.RLock()
 	_, ok := templateMap[templateID]
+	templateMapMutex.RUnlock()
 	return ok
 }
 

cla-backend-go/token/token.go

@@ -6,6 +6,7 @@ package token
 import (
 	"errors"
 	"fmt"
+	"sync"
 	"time"
 
 	"github.com/sirupsen/logrus"
@@ -25,6 +26,7 @@ var (
 	oauthTokenURL string
 	token         string
 	expiry        time.Time
+	tokenMutex    sync.RWMutex // Protects token and expiry variables
 )
 
 type tokenGen struct {
@@ -55,9 +57,11 @@ func Init(paramClientID, paramClientSecret, paramAuth0URL, paramAudience string)
 	audience = paramAudience
 	oauthTokenURL = paramAuth0URL
 
+	tokenMutex.Lock()
 	if expiry.Year() == 1 {
 		expiry = time.Now()
 	}
+	tokenMutex.Unlock()
 
 	go retrieveToken() //nolint
 }
@@ -95,17 +99,23 @@ func retrieveToken() error {
 		return err
 	}
 
-	//token = tr.TokenType + " " + tr.AccessToken
-	token = tr.AccessToken
 	if tr.AccessToken == "" || tr.TokenType == "" {
 		err = errors.New("error fetching authentication token - response value is empty")
 		log.WithFields(f).WithError(err).Warn("empty response from auth server")
 		return err
 	}
 
+	tokenMutex.Lock()
+	//token = tr.TokenType + " " + tr.AccessToken
+	token = tr.AccessToken
 	expiry = time.Now()
+	tokenMutex.Unlock()
+
 	tokenExpiry := time.Now().Add(time.Second * time.Duration(tr.ExpiresIn))
-	log.WithFields(f).Debugf("retrieved token: %s... expires: %s", token[0:8], tokenExpiry.UTC().String())
+	tokenMutex.RLock()
+	tokenForLog := token
+	tokenMutex.RUnlock()
+	log.WithFields(f).Debugf("retrieved token: %s... expires: %s", tokenForLog[0:8], tokenExpiry.UTC().String())
 
 	return nil
 }
@@ -116,15 +126,24 @@ func GetToken() (string, error) {
 		"functionName": "token.GetToken",
 	}
 
+	tokenMutex.RLock()
+	currentToken := token
+	currentExpiry := expiry
+	tokenMutex.RUnlock()
+
 	// set 2.75 hrs duration for new token
-	if (time.Now().Unix()-expiry.Unix()) > 9900 || token == "" {
+	if (time.Now().Unix()-currentExpiry.Unix()) > 9900 || currentToken == "" {
 		log.WithFields(f).Debug("token is either empty or expired, retrieving new token")
 		err := retrieveToken()
 		if err != nil {
 			log.WithFields(f).WithError(err).Warn("unable to retrieve a new token")
 			return "", err
 		}
+
+		tokenMutex.RLock()
+		currentToken = token
+		tokenMutex.RUnlock()
 	}
 
-	return token, nil
+	return currentToken, nil
 }

cla-backend-go/v2/signatures/zip_builder.go

@@ -5,7 +5,9 @@ package signatures
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
+	"net/http"
 	"strings"
 	"sync"
 
@@ -29,7 +31,7 @@ import (
 
 // constants
 const (
-	ParallelDownloader = 100
+	ParallelDownloader = 10
 )
 
 // Zipper implements ZipBuilder interface
@@ -111,8 +113,9 @@ func (z *Zipper) buildPDFZip(claType string, claGroupID string) error {
 	}
 	var zipUpdated bool
 	log.WithFields(f).Debug("getting s3 files")
-	downloaderInputChan := make(chan *DownloadFileInput)
-	downloaderOutputChan := make(chan *FileContent)
+	downloaderInputChan := make(chan *DownloadFileInput, 16)
+	downloaderOutputChan := make(chan *FileContent, 16)
+	listErrCh := make(chan error, 1)
 	var wg sync.WaitGroup
 	wg.Add(ParallelDownloader)
 	for i := 1; i <= ParallelDownloader; i++ {
@@ -123,7 +126,7 @@ func (z *Zipper) buildPDFZip(claType string, claGroupID string) error {
 		close(downloaderOutputChan)
 	}()
 	go func() {
-		err = z.s3.ListObjectsPages(&s3.ListObjectsInput{
+		localErr := z.s3.ListObjectsPages(&s3.ListObjectsInput{
 			Bucket: aws.String(z.bucketName),
 			Prefix: aws.String(s3ZipPrefix(claType, claGroupID)),
 		}, func(output *s3.ListObjectsOutput, b bool) bool {
@@ -147,12 +150,19 @@ func (z *Zipper) buildPDFZip(claType string, claGroupID string) error {
 			return true
 		})
 		close(downloaderInputChan)
+		listErrCh <- localErr
 	}()
 	zipUpdated = writeFileToZip(writer, downloaderOutputChan)
-	if err != nil {
-		return err
+	if listErr := <-listErrCh; listErr != nil {
+		if cerr := writer.Close(); cerr != nil {
+			log.Warnf("zip writer close failed: %v", cerr)
+			return errors.Join(listErr, cerr)
+		}
+		return listErr
+	}
+	if cerr := writer.Close(); cerr != nil {
+		return cerr
 	}
-	writer.Close()
 	if zipUpdated {
 		remoteZipFileKey := s3ZipFilepath(claType, claGroupID)
 		log.Debugf("Uploading zip file %s", remoteZipFileKey)
@@ -264,13 +274,16 @@ func getZipWriter(buff *bytes.Buffer) (*zip.Writer, error) {
 func (z *Zipper) getZipFileFromS3(claType string, claGroupID string) (*bytes.Buffer, error) {
 	var buff aws.WriteAtBuffer
 	remoteFileKey := s3ZipFilepath(claType, claGroupID)
-	_, err := z.s3.GetObject(&s3.GetObjectInput{
+	_, err := z.s3.HeadObject(&s3.HeadObjectInput{
 		Bucket: aws.String(z.bucketName),
 		Key:    aws.String(remoteFileKey),
 	})
 	if err != nil {
-		aerr, ok := err.(awserr.Error)
-		if ok && aerr.Code() == s3.ErrCodeNoSuchKey {
+		if rf, ok := err.(awserr.RequestFailure); ok && rf.StatusCode() == http.StatusNotFound {
+			log.Debugf("zip file %s does not exist on s3", remoteFileKey)
+			return bytes.NewBuffer(buff.Bytes()), nil
+		}
+		if aerr, ok := err.(awserr.Error); ok && (aerr.Code() == s3.ErrCodeNoSuchKey || aerr.Code() == "NotFound") {
 			log.Debugf("zip file %s does not exist on s3", remoteFileKey)
 			return bytes.NewBuffer(buff.Bytes()), nil
 		}