added CEL cyntax validation and graceful shutdown of servers

Author: Azeru548

general/cmd/server/main.go

@@ -3,22 +3,56 @@ package main
 import (
 	"context"
 	"encoding/json"
-	"log"
-	"net/http"
-	"time"
-
 	"general/internal/db"
 	"general/internal/engine"
 	"general/internal/middleware"
+	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
 
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+type Config struct {
+	DBHost     string
+	DBPort     string
+	DBUser     string
+	DBPassword string
+	DBName     string
+	Port       string
+	JWTSecret  string
+}
+
+func loadConfig() *Config {
+	return &Config{
+		DBHost:     getEnv("DB_HOST", "localhost"),
+		DBPort:     getEnv("DB_PORT", "5433"),
+		DBUser:     getEnv("DB_USER", "asguard"),
+		DBPassword: getEnv("DB_PASSWORD", "devpassword"),
+		DBName:     getEnv("DB_NAME", "general_engine"),
+		Port:       getEnv("PORT", "8083"),
+		JWTSecret:  getEnv("JWT_SECRET", ""),
+	}
+
+}
+
+func getEnv(key, defaultValue string) string {
+	if value := os.Getenv(key); value != "" {
+		return value
+	}
+
+	return defaultValue
+}
+
 func main() {
-	connString := "postgres://asguard:devpassword@localhost:5433/general_engine?sslmode=disable"
 
+	cfg := loadConfig()
+	connString := "postgres://" + cfg.DBUser + ":" + cfg.DBPassword + "@" + cfg.DBHost + ":" + cfg.DBPort + "/" + cfg.DBName + "?sslmode=disable"
 	conn, err := pgx.Connect(context.Background(), connString)
 	if err != nil {
 		log.Fatalf("Failed to connect to database: %v", err)
@@ -68,12 +102,34 @@ func main() {
 		}
 	})
 
-	// WRAP WITH MIDDLEWARE - This is the key line
-	handler := middleware.AuthMiddleware(mux)
+	// WRAP WITH MIDDLEWARE
+	handler := middleware.AuthMiddleware([]byte(cfg.JWTSecret))(mux)
 
-	port := "8083"
-	log.Printf("General Validation Engine starting on port %s", port)
-	log.Fatal(http.ListenAndServe(":"+port, handler)) // Use handler, not nil
+	srv := &http.Server{
+		Addr:    ":" + cfg.Port,
+		Handler: handler,
+	}
+
+	quit := make(chan os.Signal, 1)
+	signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
+
+	go func() {
+		log.Printf("General Validation Engine starting on port %s", cfg.Port)
+		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			log.Fatalf("listen: %s\n", err)
+		}
+	}()
+
+	<-quit
+	log.Println("Shutting Down Server.....")
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	if err := srv.Shutdown(ctx); err != nil {
+		log.Fatalf("Server shutdown failed: %v", err)
+	}
+	log.Println("Server shutdown successfully")
 }
 
 func healthHandler(w http.ResponseWriter, r *http.Request) {
@@ -187,19 +243,25 @@ func createRuleHandler(queries *db.Queries, ruleEngine *engine.RuleEngine) http.
 		}
 
 		// Validate required fields
-		if req.Name == "" || req.Context == "" || req.Action == "" {
-			http.Error(w, "Mising required fields", http.StatusBadRequest)
+		if req.Name == "" || req.Context == "" || req.Condition == "" || req.Action == "" {
+			http.Error(w, "Missing required fields: name, context, condition, action", http.StatusBadRequest)
 			return
 		}
 
+		//validate action type
 		validActions := map[string]bool{"allow": true, "block": true, "challenge": true, "flag": true, "score": true}
 		if !validActions[req.Action] {
 			http.Error(w, "Invalid action. Must be: allow, block, challenge, flag, score", http.StatusBadRequest)
 			return
 		}
 
-		ctx := r.Context()
+		// validate CEL syntax
+		if _, err := ruleEngine.Evaluator.CompileRule(req.Condition); err != nil {
+			http.Error(w, "Invalid CEL syntax: "+err.Error(), http.StatusBadRequest)
+			return
+		}
 
+		ctx := r.Context()
 		// Extract tenant ID from JWT context (works with UUID strings and slugs alike)
 		tenantIDStr := middleware.GetTenantID(ctx)
 		if tenantIDStr == "" {
@@ -295,6 +357,11 @@ func updateRuleHandler(queries *db.Queries, ruleEngine *engine.RuleEngine, id st
 			return
 		}
 
+		if _, err := ruleEngine.Evaluator.CompileRule(req.Condition); err != nil {
+			http.Error(w, "Invalid CEL syntax: "+err.Error(), http.StatusBadRequest)
+			return
+		}
+
 		ctx := r.Context()
 
 		tenantIDStr := middleware.GetTenantID(ctx)

general/internal/engine/engine.go

@@ -16,7 +16,7 @@ import (
 // RuleEngine orchestrates validation
 type RuleEngine struct {
 	queries       *db.Queries
-	evaluator     *Evaluator
+	Evaluator     *Evaluator
 	programeCache sync.Map //// map[string]cel.Program (key = rule ID as string)
 }
 
@@ -29,7 +29,7 @@ func NewRuleEngine(queries *db.Queries) (*RuleEngine, error) {
 
 	return &RuleEngine{
 		queries:   queries,
-		evaluator: eval,
+		Evaluator: eval,
 	}, nil
 }
 
@@ -135,7 +135,7 @@ func (re *RuleEngine) Validate(ctx context.Context, tenantID pgtype.UUID, req Va
 		progIface, ok := re.programeCache.Load(cacheKey)
 		var program cel.Program
 		if !ok {
-			prog, err := re.evaluator.CompileRule(rule.Condition)
+			prog, err := re.Evaluator.CompileRule(rule.Condition)
 			if err != nil {
 				fmt.Printf("Failed to compile rule %s: %v\n", rule.Name, err)
 				continue
@@ -147,7 +147,7 @@ func (re *RuleEngine) Validate(ctx context.Context, tenantID pgtype.UUID, req Va
 		}
 
 		// Evaluate
-		matched, err := re.evaluator.Evaluate(program, req.Input)
+		matched, err := re.Evaluator.Evaluate(program, req.Input)
 		if err != nil {
 			fmt.Printf("Failed to evaluate rule %s: %v\n", rule.Name, err)
 			continue
@@ -294,7 +294,7 @@ func (re *RuleEngine) InvalidateRule(tenantID pgtype.UUID, ruleID pgtype.UUID) {
 
 // StoreRule compiles and caches a rule. Returns error if compilation fails.
 func (re *RuleEngine) StoreRule(tenantID pgtype.UUID, ruleID pgtype.UUID, condition string) error {
-	prog, err := re.evaluator.CompileRule(condition)
+	prog, err := re.Evaluator.CompileRule(condition)
 	if err != nil {
 		return err
 	}

general/internal/middleware/autho.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"net/http"
-	"os"
 	"strings"
 
 	"general/internal/auth"
@@ -14,51 +13,51 @@ import (
 
 type tenantKey struct{}
 
-var jwtSecret = []byte(os.Getenv("JWT_SECRET"))
+func AuthMiddleware(secret []byte) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path == "/health" {
+				next.ServeHTTP(w, r)
+				return
+			}
 
-func AuthMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/health" {
-			next.ServeHTTP(w, r)
-			return
-		}
+			authHeader := r.Header.Get("Authorization")
+			if authHeader == "" {
+				http.Error(w, `{"error":"missing authorization header"}`, http.StatusUnauthorized)
+				return
+			}
 
-		authHeader := r.Header.Get("Authorization")
-		if authHeader == "" {
-			http.Error(w, `{"error":"missing authorization header"}`, http.StatusUnauthorized)
-			return
-		}
+			parts := strings.SplitN(authHeader, " ", 2)
+			if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
+				http.Error(w, `{"error":"invalid authorization header format"}`, http.StatusUnauthorized)
+				return
+			}
 
-		parts := strings.SplitN(authHeader, " ", 2)
-		if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
-			http.Error(w, `{"error":"invalid authorization header format"}`, http.StatusUnauthorized)
-			return
-		}
+			tokenString := parts[1]
 
-		tokenString := parts[1]
+			// Use the shared struct
+			var claims auth.Claims
+			token, err := jwt.ParseWithClaims(tokenString, &claims, func(token *jwt.Token) (interface{}, error) {
+				if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+					return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+				}
+				return secret, nil
+			})
 
-		// Use the shared struct
-		var claims auth.Claims
-		token, err := jwt.ParseWithClaims(tokenString, &claims, func(token *jwt.Token) (interface{}, error) {
-			if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
-				return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+			if err != nil || !token.Valid {
+				http.Error(w, `{"error":"invalid token"}`, http.StatusUnauthorized)
+				return
 			}
-			return jwtSecret, nil
-		})
 
-		if err != nil || !token.Valid {
-			http.Error(w, `{"error":"invalid token"}`, http.StatusUnauthorized)
-			return
-		}
-
-		if claims.TenantID == "" {
-			http.Error(w, `{"error":"missing tenant_id"}`, http.StatusUnauthorized)
-			return
-		}
+			if claims.TenantID == "" {
+				http.Error(w, `{"error":"missing tenant_id"}`, http.StatusUnauthorized)
+				return
+			}
 
-		ctx := context.WithValue(r.Context(), tenantKey{}, claims.TenantID)
-		next.ServeHTTP(w, r.WithContext(ctx))
-	})
+			ctx := context.WithValue(r.Context(), tenantKey{}, claims.TenantID)
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
 }
 
 func GetTenantID(ctx context.Context) string {