fix(discovery): validate plugin callback resolves to client address

compose/auth_proxy.yml

@@ -7,6 +7,7 @@ services:
       CRYOSTAT_HTTP_PROXY_PORT: "${CRYOSTAT_HTTP_PORT}"
       QUARKUS_HTTP_PROXY_PROXY_ADDRESS_FORWARDING: "true"
       QUARKUS_HTTP_PROXY_ALLOW_X_FORWARDED: "true"
+      QUARKUS_HTTP_PROXY_TRUSTED_PROXIES: "auth"
       QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_HOST: "true"
       QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_PREFIX: "true"
   auth:

schema-generator/dependency-reduced-pom.xml

@@ -15,6 +15,10 @@
           <release>21</release>
         </configuration>
       </plugin>
+      <plugin>
+        <artifactId>maven-surefire-plugin</artifactId>
+        <version>3.5.6</version>
+      </plugin>
       <plugin>
         <artifactId>maven-jar-plugin</artifactId>
         <version>3.5.1</version>
@@ -101,12 +105,35 @@
       </plugin>
     </plugins>
   </build>
+  <dependencies>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter</artifactId>
+      <version>5.13.4</version>
+      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>junit-jupiter-api</artifactId>
+          <groupId>org.junit.jupiter</groupId>
+        </exclusion>
+        <exclusion>
+          <artifactId>junit-jupiter-params</artifactId>
+          <groupId>org.junit.jupiter</groupId>
+        </exclusion>
+        <exclusion>
+          <artifactId>junit-jupiter-engine</artifactId>
+          <groupId>org.junit.jupiter</groupId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+  </dependencies>
   <properties>
     <maven.compiler.release>21</maven.compiler.release>
     <com.diffplug.spotless.maven.plugin.version>3.7.0</com.diffplug.spotless.maven.plugin.version>
     <maven.compiler.target>21</maven.compiler.target>
     <maven.compiler.source>21</maven.compiler.source>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <junit.jupiter.version>5.13.4</junit.jupiter.version>
     <com.google.java-format.version>1.33.0</com.google.java-format.version>
     <com.mycila.license.maven.plugin.version>5.0.0</com.mycila.license.maven.plugin.version>
   </properties>

schema-generator/pom.xml

@@ -17,6 +17,7 @@
         <maven.compiler.target>21</maven.compiler.target>
         <maven.compiler.release>21</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <junit.jupiter.version>5.13.4</junit.jupiter.version>
 
         <!-- Code quality plugins -->
         <com.diffplug.spotless.maven.plugin.version>3.7.0</com.diffplug.spotless.maven.plugin.version>
@@ -38,6 +39,13 @@
             <artifactId>snakeyaml</artifactId>
             <version>2.6</version>
         </dependency>
+
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter</artifactId>
+            <version>${junit.jupiter.version}</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
@@ -51,6 +59,12 @@
                 </configuration>
             </plugin>
 
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <version>3.5.6</version>
+            </plugin>
+
             <!-- Create executable JAR -->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -146,4 +160,4 @@
             </plugin>
         </plugins>
     </build>
-</project>
+</project>

schema-generator/src/main/java/io/cryostat/schema/PayloadTypeAnalyzer.java

@@ -28,8 +28,10 @@
 
 import com.github.javaparser.StaticJavaParser;
 import com.github.javaparser.ast.CompilationUnit;
+import com.github.javaparser.ast.Node;
 import com.github.javaparser.ast.body.ClassOrInterfaceDeclaration;
 import com.github.javaparser.ast.body.RecordDeclaration;
+import com.github.javaparser.ast.body.TypeDeclaration;
 import com.github.javaparser.ast.expr.Expression;
 import com.github.javaparser.ast.expr.MethodCallExpr;
 import com.github.javaparser.ast.expr.NameExpr;
@@ -322,7 +324,7 @@ private Map<String, Object> analyzeRecord(RecordDeclaration record) {
                         param -> {
                             String fieldName = param.getNameAsString();
                             String fieldType = param.getTypeAsString();
-                            properties.put(fieldName, analyzeFieldType(fieldType));
+                            properties.put(fieldName, analyzeFieldType(fieldType, param));
                         });
 
         if (!properties.isEmpty()) {
@@ -381,7 +383,8 @@ private Map<String, Object> analyzeClass(ClassOrInterfaceDeclaration classDecl)
                                                     String fieldName = var.getNameAsString();
                                                     String fieldType = var.getTypeAsString();
                                                     properties.put(
-                                                            fieldName, analyzeFieldType(fieldType));
+                                                            fieldName,
+                                                            analyzeFieldType(fieldType, var));
                                                 });
                             }
                         });
@@ -393,7 +396,8 @@ private Map<String, Object> analyzeClass(ClassOrInterfaceDeclaration classDecl)
         return schema;
     }
 
-    private Map<String, Object> analyzeFieldType(String fieldType) {
+    private Map<String, Object> analyzeFieldType(
+            String fieldType, com.github.javaparser.ast.Node context) {
         // Remove generic type parameters for analysis
         String baseType = fieldType.replaceAll("<.*>", "");
 
@@ -422,13 +426,66 @@ private Map<String, Object> analyzeFieldType(String fieldType) {
             default:
                 // For complex types, try to analyze them inline (avoid circular references)
                 if (!analyzedTypes.contains(baseType)) {
+                    Optional<RecordDeclaration> contextualRecord =
+                            findContextualRecordDeclaration(context, baseType);
+                    if (contextualRecord.isPresent()) {
+                        analyzedTypes.add(baseType);
+                        return analyzeRecord(contextualRecord.get());
+                    }
                     return analyzeType(baseType);
                 }
                 // If already analyzed (circular reference), just describe it
                 return createObjectSchema(baseType);
         }
     }
 
+    Optional<RecordDeclaration> findContextualRecordDeclaration(Node context, String typeName) {
+        Node ancestor = context;
+        while ((ancestor = ancestor.getParentNode().orElse(null)) != null) {
+            if (!(ancestor instanceof TypeDeclaration<?> enclosingType)) {
+                continue;
+            }
+
+            if (enclosingType instanceof RecordDeclaration enclosingRecord
+                    && matchesTypeName(
+                            enclosingRecord.getNameAsString(),
+                            enclosingRecord.getFullyQualifiedName().orElse(""),
+                            typeName)) {
+                return Optional.of(enclosingRecord);
+            }
+
+            Optional<RecordDeclaration> memberRecord =
+                    enclosingType.getMembers().stream()
+                            .filter(RecordDeclaration.class::isInstance)
+                            .map(RecordDeclaration.class::cast)
+                            .filter(
+                                    record ->
+                                            matchesTypeName(
+                                                    record.getNameAsString(),
+                                                    record.getFullyQualifiedName().orElse(""),
+                                                    typeName))
+                            .findFirst();
+            if (memberRecord.isPresent()) {
+                return memberRecord;
+            }
+        }
+
+        return context.findCompilationUnit()
+                .flatMap(
+                        cu ->
+                                cu.getTypes().stream()
+                                        .filter(RecordDeclaration.class::isInstance)
+                                        .map(RecordDeclaration.class::cast)
+                                        .filter(
+                                                record ->
+                                                        matchesTypeName(
+                                                                record.getNameAsString(),
+                                                                record.getFullyQualifiedName()
+                                                                        .orElse(""),
+                                                                typeName))
+                                        .findFirst());
+    }
+
     private Map<String, Object> createMapSchema() {
         Map<String, Object> schema = new LinkedHashMap<>();
         schema.put("type", "object");

schema-generator/src/test/java/io/cryostat/schema/PayloadTypeAnalyzerTest.java

@@ -0,0 +1,74 @@
+/*
+ * Copyright The Cryostat Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.cryostat.schema;
+
+import static org.junit.jupiter.api.Assertions.assertSame;
+
+import java.nio.file.Path;
+
+import com.github.javaparser.JavaParser;
+import com.github.javaparser.ParserConfiguration;
+import com.github.javaparser.ast.body.ClassOrInterfaceDeclaration;
+import com.github.javaparser.ast.body.RecordDeclaration;
+import org.junit.jupiter.api.Test;
+
+class PayloadTypeAnalyzerTest {
+
+    @Test
+    void shouldResolveNestedRecordFromLexicalScope() {
+        var compilationUnit =
+                new JavaParser(
+                                new ParserConfiguration()
+                                        .setLanguageLevel(
+                                                ParserConfiguration.LanguageLevel.JAVA_21))
+                        .parse(
+                                """
+                                package example;
+
+                                class First {
+                                    record Payload(String first) {}
+                                    record Event(Payload payload) {}
+                                }
+
+                                class Second {
+                                    record Payload(String second) {}
+                                    record Event(Payload payload) {}
+                                }
+                                """)
+                        .getResult()
+                        .orElseThrow();
+        ClassOrInterfaceDeclaration second = compilationUnit.getClassByName("Second").orElseThrow();
+        RecordDeclaration expected = findNestedRecord(second, "Payload");
+        RecordDeclaration event = findNestedRecord(second, "Event");
+
+        var analyzer = new PayloadTypeAnalyzer(Path.of("."));
+
+        assertSame(
+                expected,
+                analyzer.findContextualRecordDeclaration(event.getParameter(0), "Payload")
+                        .orElseThrow());
+    }
+
+    private static RecordDeclaration findNestedRecord(
+            ClassOrInterfaceDeclaration enclosingType, String name) {
+        return enclosingType.getMembers().stream()
+                .filter(RecordDeclaration.class::isInstance)
+                .map(RecordDeclaration.class::cast)
+                .filter(record -> record.getNameAsString().equals(name))
+                .findFirst()
+                .orElseThrow();
+    }
+}

src/main/java/io/cryostat/discovery/Discovery.java

@@ -875,7 +875,22 @@ private CallbackValidation validateCallback(
                             ConfigProperties.AGENT_TLS_REQUIRED));
         }
 
-        return new CallbackValidation(callbackUri, unauthCallback, remoteAddress);
+        try {
+            for (InetAddress callbackAddress : InetAddress.getAllByName(callbackUri.getHost())) {
+                if (remoteAddress.equals(callbackAddress)) {
+                    return new CallbackValidation(callbackUri, unauthCallback, remoteAddress);
+                }
+            }
+        } catch (UnknownHostException e) {
+            throw new BadRequestException(
+                    String.format("%s host could not be resolved: %s", parameterName, callbackUri),
+                    e);
+        }
+
+        throw new BadRequestException(
+                String.format(
+                        "%s host does not resolve to the client address %s: %s",
+                        parameterName, remoteAddress.getHostAddress(), callbackUri));
     }
 
     private DiscoveryPlugin findOrCreatePlugin(
@@ -1448,11 +1463,6 @@ private InetAddress getRemoteAddress(RoutingContext ctx) {
         if (ctx.request() != null && ctx.request().remoteAddress() != null) {
             addr = jwtValidator.tryResolveAddress(addr, ctx.request().remoteAddress().host());
         }
-        if (ctx.request() != null && ctx.request().headers() != null) {
-            addr =
-                    jwtValidator.tryResolveAddress(
-                            addr, ctx.request().headers().get(X_FORWARDED_FOR));
-        }
         return addr;
     }
 

src/main/java/io/cryostat/discovery/DiscoveryJwtValidator.java

@@ -31,7 +31,6 @@
 import com.nimbusds.jwt.JWT;
 import com.nimbusds.jwt.proc.BadJWTException;
 import io.quarkus.security.UnauthorizedException;
-import io.vertx.core.MultiMap;
 import io.vertx.core.http.HttpServerRequest;
 import io.vertx.ext.web.RoutingContext;
 import jakarta.enterprise.context.ApplicationScoped;
@@ -74,8 +73,9 @@ public JWT validateJwt(
         if (req.remoteAddress() != null) {
             addr = tryResolveAddress(addr, req.remoteAddress().host());
         }
-        MultiMap headers = req.headers();
-        addr = tryResolveAddress(addr, headers.get(Discovery.X_FORWARDED_FOR));
+        if (addr == null) {
+            throw new UnauthorizedException("Could not determine request address");
+        }
 
         URI hostUri =
                 new URI(