Внедрение KESL на ВМ2 + замена CLAMAV на KESL

VM2_services/codebase/services/message-safety/app/service.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import asyncio
 import uuid
 from datetime import UTC, datetime, timedelta
 from time import perf_counter
@@ -14,7 +15,7 @@ from app.db import (
     TaskStatus,
     TextRulesCache,
 )
-from app.file_pipeline import validate_metadata
+from app.file_pipeline import Antivirus, DependencyFailure, validate_metadata
 from app.fingerprint import fingerprint
 from app.normalization import normalize_text
 from app.rate_limit import ConservativeRateLimiter
@@ -52,6 +53,7 @@ class SafetyService:
         links_ready: bool = True,
         files_ready: bool = True,
         signatures_version: str = "unverified",
+        antivirus: Antivirus | None = None,
     ) -> None:
         self.repository = repository
         self.config = config
@@ -60,11 +62,40 @@ class SafetyService:
         self.links_ready = links_ready
         self.files_ready = files_ready
         self.signatures_version = signatures_version
+        self.antivirus = antivirus
+        self._antivirus_checked_at = 0.0
+        self._antivirus_check_lock = asyncio.Lock()
         self.rate_limiter = ConservativeRateLimiter(
             config.document["rate"]["text_rps"], config.document["rate"]["file_rps"]
         )
         record_runtime_state("mock" if mode.mock else "standard", config.version)
 
+    async def refresh_antivirus(self) -> bool:
+        if self.mode.mock:
+            self.files_ready = False
+            return False
+        if self.antivirus is None:
+            return self.files_ready
+        if perf_counter() - self._antivirus_checked_at < 5:
+            return self.files_ready
+        async with self._antivirus_check_lock:
+            if perf_counter() - self._antivirus_checked_at < 5:
+                return self.files_ready
+            try:
+                status = await self.antivirus.status()
+                maximum_age = timedelta(
+                    hours=self.config.document["antivirus"]["max_signature_age_hours"]
+                )
+                if datetime.now(UTC) - status.databases_date > maximum_age:
+                    raise DependencyFailure("KESL databases are stale")
+                self.signatures_version = status.signatures_version
+                self.files_ready = True
+            except DependencyFailure:
+                self.signatures_version = "unavailable"
+                self.files_ready = False
+            self._antivirus_checked_at = perf_counter()
+        return self.files_ready
+
     def _verdict(
         self,
         allow: bool,
@@ -222,7 +253,7 @@ class SafetyService:
         )
 
     async def _check_file(self, request: FileCheck, digest: bytes) -> Verdict | Pending:
-        if not self.files_ready:
+        if not await self.refresh_antivirus():
             raise CapabilityUnavailable("files")
         rule = validate_metadata(
             request.attachment,
@@ -274,7 +305,7 @@ class SafetyService:
             declared_checksum=request.attachment.checksum,
             rules_version=self.config.rules_version,
             detector_version=self.config.detector.version,
-            scanner_engine="clamav",
+            scanner_engine="kesl",
             signatures_version=self.signatures_version,
             origin_trace_id=trace_id,
             origin_span_id=span_id,