wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(iwooos): bound control plane source latency

Browse Source
This commit is contained in:
ogt
2026-07-11 20:19:51 +08:00
parent 5d75655177
commit 9726703a91
2 changed files with 137 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

137
apps/api/src/services/iwooos_security_asset_control_plane.py
View File

@@ -15,7 +15,8 @@ from src.db.base import get_db_context
logger = structlog.get_logger(__name__)
_SCHEMA_VERSION = "iwooos_security_asset_control_plane_v1"
_QUERY_TIMEOUT_SECONDS = 5.0
_QUERY_TIMEOUT_SECONDS = 6.0
_SOURCE_QUERY_TIMEOUT_SECONDS = 4.0
_DISCOVERY_FRESHNESS_SECONDS = 2 * 60 * 60
_WINDOW_HOURS = 24
@@ -1272,30 +1273,45 @@ def build_unavailable_iwooos_security_asset_control_plane(
async def _read_public_source(
db: Any,
*,
project_id: str,
source_id: str,
statement: Any,
result_mode: str,
default: Any,
) -> tuple[Any, dict[str, Any]]:
"""Isolate one aggregate query so an optional source cannot abort the readback."""
try:
async with db.begin_nested():
async def execute_source() -> Any:
async with get_db_context(project_id) as db:
result = await db.execute(statement)
if result_mode == "all":
value = result.fetchall()
elif result_mode == "one":
value = result.one()
elif result_mode == "one_or_none":
value = result.one_or_none()
else:
raise ValueError("unsupported_result_mode")
return result.fetchall()
if result_mode == "one":
return result.one()
if result_mode == "one_or_none":
return result.one_or_none()
raise ValueError("unsupported_result_mode")
try:
value = await asyncio.wait_for(
execute_source(), timeout=_SOURCE_QUERY_TIMEOUT_SECONDS
)
return value, {
"source_id": source_id,
"status": "ready",
"reason_code": None,
}
except TimeoutError:
logger.warning(
"iwooos_security_asset_control_plane_source_timeout",
source_id=source_id,
)
return default, {
"source_id": source_id,
"status": "unavailable",
"reason_code": f"{source_id}_query_timeout",
}
except Exception as exc: # noqa: BLE001 - isolate and redact source failures
logger.warning(
"iwooos_security_asset_control_plane_source_unavailable",
@@ -1332,11 +1348,9 @@ class IwoooSSecurityAssetControlPlaneService:
)
async def _load_snapshot(self) -> dict[str, Any]:
async with get_db_context("awoooi") as db:
source_health: list[dict[str, Any]] = []
discovery_row, health = await _read_public_source(
db,
source_results = await asyncio.gather(
_read_public_source(
project_id="awoooi",
source_id="asset_discovery",
statement=_sql(
"""
@@ -1369,11 +1383,9 @@ class IwoooSSecurityAssetControlPlaneService:
),
result_mode="one_or_none",
default=None,
)
source_health.append(health)
inventory_rows, health = await _read_public_source(
db,
),
_read_public_source(
project_id="awoooi",
source_id="asset_inventory",
statement=_sql(
"""
@@ -1394,11 +1406,9 @@ class IwoooSSecurityAssetControlPlaneService:
),
result_mode="all",
default=[],
)
source_health.append(health)
coverage_rows, health = await _read_public_source(
db,
),
_read_public_source(
project_id="awoooi",
source_id="automation_coverage",
statement=_sql(
"""
@@ -1417,11 +1427,9 @@ class IwoooSSecurityAssetControlPlaneService:
),
result_mode="all",
default=[],
)
source_health.append(health)
relationship_row, health = await _read_public_source(
db,
),
_read_public_source(
project_id="awoooi",
source_id="asset_relationship",
statement=_sql(
"""
@@ -1441,11 +1449,9 @@ class IwoooSSecurityAssetControlPlaneService:
),
result_mode="one",
default={},
)
source_health.append(health)
compliance_rows, health = await _read_public_source(
db,
),
_read_public_source(
project_id="awoooi",
source_id="security_compliance",
statement=_sql(
"""
@@ -1463,11 +1469,9 @@ class IwoooSSecurityAssetControlPlaneService:
),
result_mode="all",
default=[],
)
source_health.append(health)
automation_rows, health = await _read_public_source(
db,
),
_read_public_source(
project_id="awoooi",
source_id="automation_operations",
statement=_sql(
"""
@@ -1480,11 +1484,9 @@ class IwoooSSecurityAssetControlPlaneService:
),
result_mode="all",
default=[],
)
source_health.append(health)
ai_trace_row, health = await _read_public_source(
db,
),
_read_public_source(
project_id="awoooi",
source_id="ai_decision_trace",
statement=_sql(
"""
@@ -1498,11 +1500,9 @@ class IwoooSSecurityAssetControlPlaneService:
),
result_mode="one",
default={},
)
source_health.append(health)
siem_row, health = await _read_public_source(
db,
),
_read_public_source(
project_id="awoooi",
source_id="siem_runtime",
statement=_sql(
"""
@@ -1548,11 +1548,9 @@ class IwoooSSecurityAssetControlPlaneService:
),
result_mode="one",
default={},
)
source_health.append(health)
audit_row, health = await _read_public_source(
db,
),
_read_public_source(
project_id="awoooi",
source_id="audit_runtime",
statement=_sql(
"""
@@ -1584,8 +1582,31 @@ class IwoooSSecurityAssetControlPlaneService:
),
result_mode="one",
default={},
)
source_health.append(health)
),
)
(
(discovery_row, discovery_health),
(inventory_rows, inventory_health),
(coverage_rows, coverage_health),
(relationship_row, relationship_health),
(compliance_rows, compliance_health),
(automation_rows, automation_health),
(ai_trace_row, ai_trace_health),
(siem_row, siem_health),
(audit_row, audit_health),
) = source_results
source_health = [
discovery_health,
inventory_health,
coverage_health,
relationship_health,
compliance_health,
automation_health,
ai_trace_health,
siem_health,
audit_health,
]
return build_iwooos_security_asset_control_plane(
discovery_row=discovery_row,