AUT-90: ensure request IDs are unique (#920)

* add uuid module to prep for better request ids

* feat: use uuids for request ids to guarantee uniqueness

go.mod

@@ -40,6 +40,7 @@ require (
 	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b // indirect
 	github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6 // indirect
 	github.com/golang/protobuf v1.3.2 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/gax-go/v2 v2.0.5 // indirect
 	github.com/goware/prefixer v0.0.0-20160118172347-395022866408 // indirect
 	github.com/howeyc/gopass v0.0.0-20170109162249-bf9dde6d0d2c // indirect

go.sum

@@ -114,6 +114,8 @@ github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXi
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/shlex v0.0.0-20181106134648-c34317bd91bf/go.mod h1:RpwtwJQFrIEPstU94h88MWPXP2ektJZ8cZ0YntAmXiE=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5 h1:sjZBwGj9Jlw33ImPtvFviGYvseOtDM7hkSKB7+Tv3SM=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=

middleware.go

@@ -1,9 +1,10 @@
 package main
 
 import (
-	"math/rand"
 	"net/http"
 	"time"
+
+	"github.com/google/uuid"
 )
 
 // Middleware wraps an http.Handler with additional functionality
@@ -27,13 +28,18 @@ func setResponseHeaders() Middleware {
 func setRequestID() Middleware {
 	return func(h http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			rid := make([]rune, 16)
-			letters := []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789")
-			for i := range rid {
-				rid[i] = letters[rand.Intn(len(letters))]
+			// NewV7 is used instead of New because the latter will panic
+			// if can't generate a UUID. It's preferably for us to have
+			// worse request ids than panic.
+			uuid, err := uuid.NewV7()
+			var rid string
+			if err != nil {
+				rid = "-"
+			} else {
+				rid = uuid.String()
 			}
 
-			h.ServeHTTP(w, addToContext(r, contextKeyRequestID, string(rid)))
+			h.ServeHTTP(w, addToContext(r, contextKeyRequestID, rid))
 		})
 	}
 }

middleware_test.go

@@ -0,0 +1,30 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+func TestRequestIDWellFormed(t *testing.T) {
+	// This method of testing middleware is cribbed from
+	// https://stackoverflow.com/questions/51201056/testing-golang-middleware-that-modifies-the-request
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		val := r.Context().Value(contextKeyRequestID).(string)
+		if uuid.Validate(val) != nil {
+			t.Errorf("requestID is not a valid uuid! %v", val)
+		}
+	})
+
+	handlerToTest := setRequestID()(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://foo.bar/", nil)
+
+	handlerToTest.ServeHTTP(httptest.NewRecorder(), req)
+}