Merge branch 'master' of https://git.eactive.synology.me:8090/eapim/djbank/eapim-online.git

Jenkinsfile

@@ -0,0 +1,162 @@
+pipeline {
+  agent { label 'djb-vm' }
+
+  options {
+    timestamps()
+    disableConcurrentBuilds()
+    buildDiscarder(logRotator(numToKeepStr: '20', artifactNumToKeepStr: '20'))
+  }
+
+  environment {
+    JAVA_HOME = '/apps/opts/jdk8'
+    JAVA_HOME_TOMCAT = '/apps/opts/jdk17'
+    GRADLE_HOME = '/apps/opts/gradle-8.7'
+    GRADLE_USER_HOME = '/apps/opts/gradle-home'
+    NODE_HOME = '/apps/opts/node-v24'
+    PATH = "/apps/opts/jdk8/bin:/apps/opts/gradle-8.7/bin:/apps/opts/node-v24/bin:/apps/opts/bin:${env.PATH}"
+    GIT_SSH_COMMAND = 'ssh -o StrictHostKeyChecking=accept-new'
+    CATALINA_BASE = '/prod/eapim/apigw'
+    CATALINA_HOME = '/prod/eapim/apache-tomcat-9.0.116'
+    CATALINA_PID = '/prod/eapim/apigw/logs/catalina.pid'
+    DEPLOY_HTTP_PORT = '39110'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        checkout scm
+      }
+    }
+
+    stage('Checkout modules') {
+      steps {
+        sh '''
+          set -eu
+
+          for REPO in elink-online-core elink-online-transformer elink-online-common elink-online-emsclient elink-online-core-jpa; do
+            if [ ! -e "$REPO/.git" ]; then
+              rm -rf "$REPO"
+              git clone --depth=1 --branch master \
+                "ssh://git@172.30.1.50:2222/djb-eapim/$REPO.git" \
+                "$REPO"
+            else
+              git -C "$REPO" fetch --depth=1 origin master
+              git -C "$REPO" reset --hard origin/master
+              git -C "$REPO" clean -fdx
+            fi
+          done
+        '''
+      }
+    }
+
+    stage('Verify toolchain') {
+      steps {
+        sh '''
+          set -eu
+          java -version
+          gradle --version
+        '''
+      }
+    }
+
+    stage('Build WAR') {
+      steps {
+        sh 'gradle clean build -x test --no-daemon'
+      }
+      post {
+        success {
+          sh '''
+            set -eu
+            cd build/libs
+            sha1sum eapim-online.war > SHA1SUMS
+            sha256sum eapim-online.war > SHA256SUMS
+          '''
+          archiveArtifacts artifacts: 'build/libs/eapim-online.war,build/libs/SHA1SUMS,build/libs/SHA256SUMS', fingerprint: true
+        }
+      }
+    }
+
+    stage('Stop Tomcat') {
+      steps {
+        sh '''
+          set +e
+          systemctl --user stop eapim-apigw 2>/dev/null
+
+          if [ -f "$CATALINA_PID" ] && kill -0 "$(cat "$CATALINA_PID")" 2>/dev/null; then
+            JAVA_HOME="$JAVA_HOME_TOMCAT" "$CATALINA_HOME/bin/shutdown.sh" 30 -force || true
+            for i in $(seq 1 30); do
+              [ -f "$CATALINA_PID" ] && kill -0 "$(cat "$CATALINA_PID")" 2>/dev/null || break
+              sleep 1
+            done
+          fi
+          rm -f "$CATALINA_PID"
+        '''
+      }
+    }
+
+    stage('Deploy ROOT.war') {
+      steps {
+        sh '''
+          set -eu
+          DEPLOY_DIR="$CATALINA_BASE/webapps"
+          rm -rf "$DEPLOY_DIR/ROOT" "$DEPLOY_DIR/ROOT.war"
+          cp build/libs/eapim-online.war "$DEPLOY_DIR/ROOT.war"
+          ls -la "$DEPLOY_DIR"
+        '''
+      }
+    }
+
+    stage('Start Tomcat and readiness') {
+      steps {
+        sh '''
+          set -eu
+          LOG="$CATALINA_BASE/logs/catalina.$(date +%Y-%m-%d).log"
+          BEFORE=0
+          [ -f "$LOG" ] && BEFORE=$(stat -c %s "$LOG")
+
+          systemctl --user start eapim-apigw
+
+          PROBE_URL="http://localhost:$DEPLOY_HTTP_PORT/"
+          DEADLINE=$(($(date +%s) + 300))
+          STATUS=000
+
+          while [ "$(date +%s)" -lt "$DEADLINE" ]; do
+            STATUS=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 3 \
+              "$PROBE_URL" 2>/dev/null || echo "000")
+            case "$STATUS" in
+              200|302|401|403|404)
+                echo "Readiness OK ($PROBE_URL HTTP $STATUS)"
+                break
+                ;;
+            esac
+
+            if [ -f "$LOG" ] && tail -c +$((BEFORE+1)) "$LOG" | grep -qE "Application listener .* Exception|SEVERE.*startup.Catalina"; then
+              echo "Startup error detected in log"
+              tail -c +$((BEFORE+1)) "$LOG" | tail -80
+              exit 1
+            fi
+            sleep 2
+          done
+
+          case "$STATUS" in
+            200|302|401|403|404) ;;
+            *)
+              echo "Readiness probe failed within 300s, last HTTP status: $STATUS"
+              echo "--- last 300 lines of catalina log ---"
+              [ -f "$LOG" ] && tail -c +$((BEFORE+1)) "$LOG" | tail -300
+              echo "--- systemd unit status ---"
+              systemctl --user status eapim-apigw --no-pager || true
+              echo "--- listening ports ---"
+              ss -tlnp 2>/dev/null | grep -E ":$DEPLOY_HTTP_PORT\\b" || echo "(port $DEPLOY_HTTP_PORT not listening)"
+              exit 1
+              ;;
+          esac
+
+          echo "--- key boot log lines ---"
+          tail -c +$((BEFORE+1)) "$LOG" | grep -E "Server startup|Deployment of web" | head -10 || true
+        '''
+      }
+    }
+  }
+
+}

src/main/java/com/eactive/eai/custom/adapter/http/dynamic/filter/HSMKeyCryptoFilter.java

@@ -0,0 +1,76 @@
+package com.eactive.eai.custom.adapter.http.dynamic.filter;
+
+import java.security.KeyStore;
+import java.util.Base64;
+import java.util.Properties;
+
+import javax.crypto.SecretKey;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.json.simple.JSONObject;
+import org.springframework.http.HttpStatus;
+
+import com.eactive.eai.adapter.http.dynamic.filter.FilterException;
+import com.eactive.eai.adapter.http.dynamic.filter.HttpAdapterFilter;
+import com.eactive.eai.common.hsm.HsmManager;
+import com.eactive.eai.common.util.Logger;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+
+public class HSMKeyCryptoFilter implements HttpAdapterFilter {
+
+	private static final Logger logger = Logger.getLogger(Logger.LOGGER_ADAPTER);
+	
+	private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+
+	@Override
+	public Object doPreFilter(String adptGrpName, String adptName, Object message, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		try {
+			ObjectNode rootNode = null;
+			String jsonStr = null;
+			if (message instanceof String) {
+				jsonStr = (String) message;
+			} else if (message instanceof JSONObject) {
+				jsonStr = ((JSONObject) message).toJSONString();
+			} else {
+				return message;
+			}
+			rootNode = (ObjectNode)OBJECT_MAPPER.readTree(jsonStr);
+			
+			JsonNode hsmKeyAlias = rootNode.get("hsmKeyAlias");
+			if (hsmKeyAlias != null) {
+				String hsmKeyAliasValue = hsmKeyAlias.textValue();
+				KeyStore keyStore = HsmManager.getInstance().getKeyStore();
+				
+				java.security.Key key = keyStore.getKey(hsmKeyAliasValue, null);
+				if (key instanceof SecretKey) {
+					SecretKey secretKey = (SecretKey) key;
+					byte[] encoded = secretKey.getEncoded();
+					if (encoded != null) {
+						String encBase64 = Base64.getEncoder().encodeToString(encoded);
+						logger.debug("HsmManager] HSM - {} : [{}]", hsmKeyAliasValue, encBase64);
+						rootNode.put("hsmKeyBase64", encBase64);
+						rootNode.put("hsmKeyRaw", new String(encoded));
+					} else {
+						logger.debug("HsmManager] HSM - secretKey null {} : [{}]", hsmKeyAliasValue, secretKey);
+					}
+				}
+			}
+			String jsonString = OBJECT_MAPPER.writeValueAsString(rootNode);
+			return jsonString;
+
+		} catch (Exception e) {
+			throw new FilterException("HSM key 가져오기 실패", ERROR_PRE_FAIL, HttpStatus.INTERNAL_SERVER_ERROR.value(), e);
+		}
+	}
+
+	@Override
+	public Object doPostFilter(String adptGrpName, String adptName, Object resultMessage, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		return resultMessage;
+	}
+
+}