add dukcapil

internal/client/dukcapil_client.go

@@ -0,0 +1,168 @@
+package client
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"go-backend-template/config"
+	"go-backend-template/internal/contract"
+	"go-backend-template/internal/logger"
+)
+
+// DukcapilClient performs HTTPS calls to the Dukcapil 1:N face recognition
+// endpoint (CALL_FN). It loads and caches the configured RSA public key used
+// to encrypt sensitive credentials.
+type DukcapilClient struct {
+	cfg    config.Dukcapil
+	http   *http.Client
+	pubKey *rsa.PublicKey
+	keyMu  sync.Mutex
+}
+
+func NewDukcapilClient(cfg config.Dukcapil) *DukcapilClient {
+	return &DukcapilClient{
+		cfg: cfg,
+		http: &http.Client{
+			Timeout: cfg.Timeout(),
+		},
+	}
+}
+
+// FaceMatch performs a 1:N face match call. user_id/password are encrypted
+// with the configured public key (RSA PKCS1v15 -> base64). The image must
+// already be base64 encoded.
+func (c *DukcapilClient) FaceMatch(ctx context.Context, req *contract.FaceMatchRequest) (*contract.DukcapilFaceResponse, error) {
+	if c.cfg.BaseURL == "" || c.cfg.CustomerID == "" || c.cfg.Methode == "" {
+		return nil, errors.New("dukcapil: incomplete configuration")
+	}
+
+	pub, err := c.loadPublicKey()
+	if err != nil {
+		return nil, fmt.Errorf("dukcapil: load public key: %w", err)
+	}
+
+	encUserID, err := encryptAndEncode(pub, []byte(c.cfg.UserID))
+	if err != nil {
+		return nil, fmt.Errorf("dukcapil: encrypt user_id: %w", err)
+	}
+	encPassword, err := encryptAndEncode(pub, []byte(c.cfg.Password))
+	if err != nil {
+		return nil, fmt.Errorf("dukcapil: encrypt password: %w", err)
+	}
+
+	ip := req.IP
+	if strings.TrimSpace(ip) == "" {
+		ip = c.cfg.DefaultIP
+	}
+
+	body := contract.DukcapilFaceRequest{
+		TransactionID:     req.TransactionID,
+		TransactionSource: req.TransactionSource,
+		Threshold:         req.Threshold,
+		Image:             req.Image,
+		UserID:            encUserID,
+		Password:          encPassword,
+		IP:                ip,
+	}
+
+	payload, err := json.Marshal(body)
+	if err != nil {
+		return nil, fmt.Errorf("dukcapil: marshal request: %w", err)
+	}
+
+	url := fmt.Sprintf("%s/%s/%s",
+		strings.TrimRight(c.cfg.BaseURL, "/"),
+		c.cfg.CustomerID,
+		c.cfg.Methode,
+	)
+
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(payload))
+	if err != nil {
+		return nil, fmt.Errorf("dukcapil: build request: %w", err)
+	}
+	httpReq.Header.Set("Accept", "application/json")
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	start := time.Now()
+	resp, err := c.http.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("dukcapil: do request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("dukcapil: read response: %w", err)
+	}
+
+	logger.FromContext(ctx).Infof("DukcapilClient::FaceMatch -> status=%d duration=%s", resp.StatusCode, time.Since(start))
+
+	if resp.StatusCode >= 500 {
+		return nil, fmt.Errorf("dukcapil: upstream status %d: %s", resp.StatusCode, string(respBytes))
+	}
+
+	var out contract.DukcapilFaceResponse
+	if err := json.Unmarshal(respBytes, &out); err != nil {
+		return nil, fmt.Errorf("dukcapil: decode response: %w (body=%s)", err, string(respBytes))
+	}
+	return &out, nil
+}
+
+func (c *DukcapilClient) loadPublicKey() (*rsa.PublicKey, error) {
+	c.keyMu.Lock()
+	defer c.keyMu.Unlock()
+	if c.pubKey != nil {
+		return c.pubKey, nil
+	}
+	if c.cfg.PublicKeyPath == "" {
+		return nil, errors.New("public key path not configured")
+	}
+	raw, err := os.ReadFile(c.cfg.PublicKeyPath)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(raw)
+	if block == nil {
+		return nil, errors.New("invalid PEM file")
+	}
+
+	// Try PKIX first (BEGIN PUBLIC KEY) then PKCS1 (BEGIN RSA PUBLIC KEY).
+	if pub, err := x509.ParsePKIXPublicKey(block.Bytes); err == nil {
+		rsaPub, ok := pub.(*rsa.PublicKey)
+		if !ok {
+			return nil, errors.New("public key is not RSA")
+		}
+		c.pubKey = rsaPub
+		return rsaPub, nil
+	}
+	rsaPub, err := x509.ParsePKCS1PublicKey(block.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("parse rsa public key: %w", err)
+	}
+	c.pubKey = rsaPub
+	return rsaPub, nil
+}
+
+// encryptAndEncode mimics PHP openssl_public_encrypt (default padding =
+// PKCS1v15) and base64-encodes the ciphertext.
+func encryptAndEncode(pub *rsa.PublicKey, plaintext []byte) (string, error) {
+	cipherBytes, err := rsa.EncryptPKCS1v15(rand.Reader, pub, plaintext)
+	if err != nil {
+		return "", err
+	}
+	return base64.StdEncoding.EncodeToString(cipherBytes), nil
+}