| | | 1 | | using Amazon.SQS; |
| | | 2 | | using Microsoft.Extensions.Options; |
| | | 3 | | using System.Diagnostics; |
| | | 4 | | using System.Net; |
| | | 5 | | using System.Security.Cryptography; |
| | | 6 | | using System.Text; |
| | | 7 | | using System.Text.Json; |
| | | 8 | | |
| | | 9 | | namespace AsyncResponse.Transports.SQS; |
| | | 10 | | |
| | | 11 | | /// <summary>Publishes <see cref="WorkerJobEnvelope"/> messages to an AWS SQS queue.</summary> |
| | | 12 | | /// <remarks> |
| | | 13 | | /// The worker queue URL is resolved lazily (a queue configured by name goes through |
| | | 14 | | /// <c>GetQueueUrl</c> once) and cached for the lifetime of the transport; a transient resolution |
| | | 15 | | /// failure on the first publish is not cached, so the next publish retries. When the worker queue |
| | | 16 | | /// is a FIFO queue (name or URL ending in <c>.fifo</c>), the correlation id becomes the |
| | | 17 | | /// <c>MessageGroupId</c> so one flow's jobs stay ordered (an id SQS would reject there — longer |
| | | 18 | | /// than 128 characters, or anything outside ASCII letters, digits and punctuation — is replaced by |
| | | 19 | | /// a stable hash of itself), and every message carries a unique |
| | | 20 | | /// <c>MessageDeduplicationId</c> so distinct jobs of the same flow are never deduplicated away. |
| | | 21 | | /// </remarks> |
| | | 22 | | public sealed class SqsWorkerTransport : IWorkerTransport, IDelayedWorkerTransport, IWorkerTransportInFlightLimit, IAsyn |
| | | 23 | | { |
| | | 24 | | /// <summary>The SQS per-message <c>DelaySeconds</c> ceiling (15 minutes).</summary> |
| | 5 | 25 | | internal static readonly TimeSpan SqsMaxDelay = TimeSpan.FromSeconds(900); |
| | | 26 | | |
| | | 27 | | /// <summary> |
| | | 28 | | /// The SQS in-flight ceiling: a message stays invisible for at most 12 hours counted from the |
| | | 29 | | /// <c>ReceiveMessage</c> that delivered it. Extending the visibility timeout does not reset |
| | | 30 | | /// that clock, and a <c>ChangeMessageVisibility</c> that would cross it is rejected. |
| | | 31 | | /// https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-visibility-timeout.html |
| | | 32 | | /// </summary> |
| | 5 | 33 | | internal static readonly TimeSpan SqsMaxInFlightDuration = TimeSpan.FromHours(12); |
| | | 34 | | |
| | | 35 | | /// <summary>The SQS <c>MessageGroupId</c> length limit.</summary> |
| | | 36 | | private const int MaxMessageGroupIdLength = 128; |
| | | 37 | | |
| | | 38 | | /// <summary>Marks a <c>MessageGroupId</c> derived by hashing a correlation id SQS would reject.</summary> |
| | | 39 | | private const string HashedMessageGroupIdPrefix = "sha256-"; |
| | | 40 | | |
| | | 41 | | private readonly SqsAsyncResponseOptions _options; |
| | | 42 | | private readonly ISqsClient _client; |
| | | 43 | | private readonly bool _disposeClient; |
| | | 44 | | private readonly bool _isFifoQueue; |
| | 256 | 45 | | private readonly SemaphoreSlim _queueUrlGate = new(1, 1); |
| | | 46 | | private string? _queueUrl; |
| | | 47 | | private int _disposeGate; |
| | | 48 | | private bool _disposed; |
| | | 49 | | |
| | | 50 | | /// <summary>Creates a worker transport backed by a client built from the configured options.</summary> |
| | | 51 | | public SqsWorkerTransport(IOptions<SqsAsyncResponseOptions> options) |
| | 2 | 52 | | : this(options, SqsClientFactory.Create(options.Value), disposeClient: true) |
| | | 53 | | { |
| | 2 | 54 | | } |
| | | 55 | | |
| | | 56 | | internal SqsWorkerTransport( |
| | | 57 | | IOptions<SqsAsyncResponseOptions> options, |
| | | 58 | | ISqsClient client) |
| | 254 | 59 | | : this(options, client, disposeClient: false) |
| | | 60 | | { |
| | 226 | 61 | | } |
| | | 62 | | |
| | 256 | 63 | | private SqsWorkerTransport( |
| | 256 | 64 | | IOptions<SqsAsyncResponseOptions> options, |
| | 256 | 65 | | ISqsClient client, |
| | 256 | 66 | | bool disposeClient) |
| | | 67 | | { |
| | 256 | 68 | | _options = options.Value; |
| | 256 | 69 | | SqsOptionsValidator.ValidateCommon(_options); |
| | 228 | 70 | | _client = client; |
| | 228 | 71 | | _disposeClient = disposeClient; |
| | 228 | 72 | | _isFifoQueue = SqsQueueAddress.IsFifo(_options.WorkerQueue); |
| | 228 | 73 | | } |
| | | 74 | | |
| | | 75 | | private async Task<string> GetQueueUrlAsync(CancellationToken cancellationToken) |
| | | 76 | | { |
| | 448 | 77 | | var queueUrl = Volatile.Read(ref _queueUrl); |
| | 448 | 78 | | if (queueUrl is not null) |
| | 223 | 79 | | return queueUrl; |
| | | 80 | | |
| | 225 | 81 | | await _queueUrlGate.WaitAsync(cancellationToken).ConfigureAwait(false); |
| | | 82 | | try |
| | | 83 | | { |
| | 225 | 84 | | ObjectDisposedException.ThrowIf(_disposed, this); |
| | 221 | 85 | | if (_queueUrl is not null) |
| | 2 | 86 | | return _queueUrl; |
| | | 87 | | |
| | | 88 | | // Assign only after the await succeeds, so a faulted resolution is not cached and the |
| | | 89 | | // next publish retries instead of reusing a permanently failed lookup. |
| | 219 | 90 | | var resolved = SqsQueueAddress.IsUrl(_options.WorkerQueue) |
| | 219 | 91 | | ? _options.WorkerQueue |
| | 219 | 92 | | : await _client.GetQueueUrlAsync(_options.WorkerQueue, cancellationToken).ConfigureAwait(false); |
| | 217 | 93 | | _queueUrl = resolved; |
| | 217 | 94 | | return resolved; |
| | | 95 | | } |
| | | 96 | | finally |
| | | 97 | | { |
| | 225 | 98 | | _queueUrlGate.Release(); |
| | | 99 | | } |
| | 442 | 100 | | } |
| | | 101 | | |
| | | 102 | | /// <summary>Publishes the supplied worker job.</summary> |
| | | 103 | | public Task PublishAsync(WorkerJobEnvelope job, CancellationToken cancellationToken = default) |
| | 449 | 104 | | => PublishCoreAsync(job, delay: null, cancellationToken); |
| | | 105 | | |
| | | 106 | | /// <inheritdoc/> |
| | | 107 | | /// <remarks> |
| | | 108 | | /// SQS caps a single hop at 15 minutes (<c>DelaySeconds</c> ≤ 900); longer waits ride the |
| | | 109 | | /// <see cref="WorkerJobEnvelope.NotBeforeUtc"/> re-publish chain, 15 minutes per hop. |
| | | 110 | | /// A FIFO worker queue reports <see cref="TimeSpan.Zero"/>: SQS rejects per-message |
| | | 111 | | /// <c>DelaySeconds</c> on FIFO queues, and advertising a capability the publish would then |
| | | 112 | | /// throw on lets a durable flow persist itself as sleeping before the enqueue fails — |
| | | 113 | | /// stranding the run. Zero routes the engine to its in-process fallback instead. |
| | | 114 | | /// </remarks> |
| | 5 | 115 | | public TimeSpan MaxPublishDelay => _isFifoQueue ? TimeSpan.Zero : SqsMaxDelay; |
| | | 116 | | |
| | | 117 | | /// <inheritdoc/> |
| | | 118 | | /// <remarks> |
| | | 119 | | /// SQS redelivers a message the moment its visibility lapses, however alive its handler is. |
| | | 120 | | /// With <see cref="SqsSubscriberOptions.VisibilityRenewalInterval"/> set, the worker |
| | | 121 | | /// subscriber keeps extending the visibility until the 12-hour SQS maximum, which nothing can |
| | | 122 | | /// extend past. Without renewal an explicit <see cref="SqsSubscriberOptions.VisibilityTimeout"/> |
| | | 123 | | /// is itself the ceiling and is reported as such; when that is unset too, the queue's own |
| | | 124 | | /// visibility timeout governs — a value this transport never reads — so only the 12-hour |
| | | 125 | | /// upper bound can be reported: set <c>VisibilityTimeout</c> to advertise the real one. |
| | | 126 | | /// <c>null</c> in <see cref="SqsAckMode.AckAfterEnqueue"/>, where the message is deleted before |
| | | 127 | | /// its handler runs and nothing stays in flight at the broker. |
| | | 128 | | /// </remarks> |
| | | 129 | | public TimeSpan? MaxInFlightDuration |
| | 240 | 130 | | => _options.WorkerSubscriber switch |
| | 240 | 131 | | { |
| | 0 | 132 | | { AckMode: SqsAckMode.AckAfterEnqueue } => null, |
| | 240 | 133 | | // The positivity guard covers a publisher-only process, where the subscriber options |
| | 240 | 134 | | // are never validated because no subscriber starts. |
| | 0 | 135 | | { VisibilityRenewalInterval: null, VisibilityTimeout: { } visibilityTimeout } when visibilityTimeout > TimeS |
| | 0 | 136 | | => visibilityTimeout, |
| | 240 | 137 | | _ => SqsMaxInFlightDuration |
| | 240 | 138 | | }; |
| | | 139 | | |
| | | 140 | | /// <inheritdoc/> |
| | | 141 | | public Task PublishAsync(WorkerJobEnvelope job, TimeSpan delay, CancellationToken cancellationToken = default) |
| | | 142 | | { |
| | 1 | 143 | | if (_isFifoQueue && delay > TimeSpan.Zero) |
| | | 144 | | { |
| | | 145 | | // SQS rejects per-message DelaySeconds on FIFO queues (queue-level delay only), and a |
| | | 146 | | // silently dropped delay would break every due-time above. Fail loudly with the way out. |
| | 0 | 147 | | throw new InvalidOperationException( |
| | 0 | 148 | | $"SQS FIFO queues do not support per-message delays, so delayed worker jobs (and suspended durable-flow |
| | 0 | 149 | | "Use a standard worker queue for delayed delivery, or keep timers in process by leaving the transport wi |
| | | 150 | | } |
| | | 151 | | |
| | 1 | 152 | | ArgumentOutOfRangeException.ThrowIfGreaterThan(delay, MaxPublishDelay); |
| | 1 | 153 | | return PublishCoreAsync(job, delay > TimeSpan.Zero ? delay : null, cancellationToken); |
| | | 154 | | } |
| | | 155 | | |
| | | 156 | | private async Task PublishCoreAsync(WorkerJobEnvelope job, TimeSpan? delay, CancellationToken cancellationToken) |
| | | 157 | | { |
| | 450 | 158 | | ArgumentNullException.ThrowIfNull(job); |
| | | 159 | | |
| | 448 | 160 | | using var activity = AsyncResponseDiagnostics.StartActivity( |
| | 448 | 161 | | "asyncresponse.worker.publish", |
| | 448 | 162 | | ActivityKind.Producer, |
| | 448 | 163 | | job.CorrelationId); |
| | 448 | 164 | | activity?.SetTag("asyncresponse.transport", "aws_sqs"); |
| | 448 | 165 | | activity?.SetTag("messaging.system", "aws_sqs"); |
| | 448 | 166 | | activity?.SetTag("messaging.destination.name", _options.WorkerQueue); |
| | 448 | 167 | | AsyncResponseDiagnostics.SetReplyTarget(activity, job.ReplyTarget); |
| | 448 | 168 | | AsyncResponseDiagnostics.SetWorker(activity, job.Call); |
| | | 169 | | |
| | | 170 | | try |
| | | 171 | | { |
| | 448 | 172 | | var messageAttributes = new Dictionary<string, string>(StringComparer.Ordinal); |
| | 448 | 173 | | if (!string.IsNullOrWhiteSpace(job.CorrelationId)) |
| | 125 | 174 | | messageAttributes[_options.CorrelationIdAttribute] = job.CorrelationId; |
| | | 175 | | |
| | 448 | 176 | | var queueUrl = await GetQueueUrlAsync(cancellationToken).ConfigureAwait(false); |
| | 442 | 177 | | var message = new SqsOutboundMessage( |
| | 442 | 178 | | queueUrl, |
| | 442 | 179 | | AsyncResponseJson.Serialize(job), |
| | 442 | 180 | | string.IsNullOrWhiteSpace(job.CorrelationId) ? null : job.CorrelationId, |
| | 442 | 181 | | MessageGroupId: _isFifoQueue |
| | 442 | 182 | | ? (string.IsNullOrWhiteSpace(job.CorrelationId) ? _options.FifoMessageGroupIdFallback : ToMessageGro |
| | 442 | 183 | | : null, |
| | 442 | 184 | | MessageDeduplicationId: _isFifoQueue ? Guid.NewGuid().ToString("N") : null, |
| | 442 | 185 | | messageAttributes, |
| | 442 | 186 | | DelaySeconds: delay is { } pending ? (int)Math.Ceiling(pending.TotalSeconds) : null); |
| | 442 | 187 | | if (delay is { } delayTag) |
| | 1 | 188 | | activity?.SetTag("asyncresponse.worker.delay_seconds", delayTag.TotalSeconds); |
| | | 189 | | |
| | 442 | 190 | | var messageId = await SendWithRetryAsync(message, cancellationToken).ConfigureAwait(false); |
| | 436 | 191 | | activity?.SetTag("messaging.message.id", messageId); |
| | 436 | 192 | | } |
| | 12 | 193 | | catch (Exception ex) |
| | | 194 | | { |
| | 12 | 195 | | AsyncResponseDiagnostics.SetError(activity, ex); |
| | 12 | 196 | | throw; |
| | | 197 | | } |
| | 436 | 198 | | } |
| | | 199 | | |
| | | 200 | | /// <summary> |
| | | 201 | | /// Maps a correlation id onto a <c>MessageGroupId</c> SQS accepts. A correlation id is portable |
| | | 202 | | /// text — spaces, non-ASCII, up to 400 characters — while SQS allows at most 128 characters of |
| | | 203 | | /// ASCII letters, digits and punctuation there and rejects the whole <c>SendMessage</c> |
| | | 204 | | /// otherwise, so every FIFO publish for such an id failed. Conforming ids pass through |
| | | 205 | | /// unchanged (existing groups keep their ordering); the rest become a stable SHA-256 of the id, |
| | | 206 | | /// so one id still always lands in one group. |
| | | 207 | | /// </summary> |
| | | 208 | | internal static string ToMessageGroupId(string correlationId) |
| | 4 | 209 | | => IsValidMessageGroupId(correlationId) |
| | 4 | 210 | | ? correlationId |
| | 4 | 211 | | // Uppercase hex: ToHexStringLower is .NET 9+, and this package still targets net8.0. |
| | 4 | 212 | | : HashedMessageGroupIdPrefix + Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(correlationId))); |
| | | 213 | | |
| | | 214 | | /// <summary>Whether SQS accepts the value as a <c>MessageGroupId</c> (or <c>MessageDeduplicationId</c>).</summary> |
| | | 215 | | internal static bool IsValidMessageGroupId(string value) |
| | | 216 | | { |
| | 4 | 217 | | if (value.Length is 0 or > MaxMessageGroupIdLength) |
| | 0 | 218 | | return false; |
| | | 219 | | |
| | 80 | 220 | | foreach (var character in value) |
| | | 221 | | { |
| | | 222 | | // ASCII letters, digits and punctuation: exactly the printable range minus the space. |
| | 36 | 223 | | if (character is <= ' ' or > '~') |
| | 0 | 224 | | return false; |
| | | 225 | | } |
| | | 226 | | |
| | 4 | 227 | | return true; |
| | | 228 | | } |
| | | 229 | | |
| | | 230 | | private async Task<string> SendWithRetryAsync( |
| | | 231 | | SqsOutboundMessage message, |
| | | 232 | | CancellationToken cancellationToken) |
| | | 233 | | { |
| | 448 | 234 | | for (var attempt = 1; ; attempt++) |
| | | 235 | | { |
| | | 236 | | try |
| | | 237 | | { |
| | 448 | 238 | | return await _client.SendMessageAsync(message, cancellationToken).ConfigureAwait(false); |
| | | 239 | | } |
| | 12 | 240 | | catch (Exception ex) when (IsTransient(ex) && attempt < _options.PublishMaxAttempts && !cancellationToken.Is |
| | | 241 | | { |
| | 6 | 242 | | var delay = AsyncResponseRetry.Backoff(attempt, _options.PublishRetryBaseDelay, _options.PublishRetryMax |
| | 6 | 243 | | await Task.Delay(delay, cancellationToken).ConfigureAwait(false); |
| | | 244 | | } |
| | | 245 | | } |
| | 436 | 246 | | } |
| | | 247 | | |
| | | 248 | | /// <summary>Classifies AWS SQS send failures worth retrying at the transport level.</summary> |
| | | 249 | | internal static bool IsTransient(Exception exception) |
| | 22 | 250 | | => exception is AmazonSQSException sqsException |
| | 22 | 251 | | && (sqsException.Retryable is not null |
| | 22 | 252 | | || sqsException.StatusCode >= HttpStatusCode.InternalServerError |
| | 22 | 253 | | || string.Equals(sqsException.ErrorCode, "RequestThrottled", StringComparison.Ordinal) |
| | 22 | 254 | | || string.Equals(sqsException.ErrorCode, "ThrottlingException", StringComparison.Ordinal)); |
| | | 255 | | |
| | | 256 | | /// <summary>Releases resources held by this instance.</summary> |
| | | 257 | | public async ValueTask DisposeAsync() |
| | | 258 | | { |
| | 402 | 259 | | if (Interlocked.Exchange(ref _disposeGate, 1) != 0) |
| | 198 | 260 | | return; |
| | | 261 | | |
| | 204 | 262 | | await _queueUrlGate.WaitAsync().ConfigureAwait(false); |
| | | 263 | | try |
| | | 264 | | { |
| | 204 | 265 | | _disposed = true; |
| | 204 | 266 | | if (_disposeClient) |
| | 2 | 267 | | await _client.DisposeAsync().ConfigureAwait(false); |
| | 204 | 268 | | } |
| | | 269 | | finally |
| | | 270 | | { |
| | | 271 | | // Release, never Dispose: SemaphoreSlim.Dispose does not complete pending WaitAsync |
| | | 272 | | // waiters, so disposing here would strand publishers parked on the gate forever (and |
| | | 273 | | // the first woken waiter's finally would throw trying to Release a disposed |
| | | 274 | | // semaphore, never handing the permit on). Released, each parked waiter wakes in |
| | | 275 | | // turn and observes _disposed; the gate holds no unmanaged resources, so leaving it |
| | | 276 | | // undisposed leaks nothing. |
| | 204 | 277 | | _queueUrlGate.Release(); |
| | | 278 | | } |
| | 402 | 279 | | } |
| | | 280 | | } |