Add a security interface slot to FastThriftServer

Summary: Adds `FastThriftServer::setSecurityInterface`, the fast_thrift counterpart of `ThriftServer::setSecurityInterface`, wiring a `SecurityServerInterface` marker as a fourth auxiliary composite child after monitoring/status/debug.

Reviewed By: robertroeser

Differential Revision: D116959429

fbshipit-source-id: 635ec1fb97c964c5f2395c99922d105b35ca0dbe

Author: Ankit Kumar

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/interface/security/SecurityServerInterface.h

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <thrift/lib/cpp2/fast_thrift/thrift/server/adapter/ThriftServerAppAdapterFactory.h>
+
+namespace apache::thrift::fast_thrift {
+
+/**
+ * A marker base class for a fast_thrift service intended for reading security
+ * metadata (the fast_thrift counterpart of
+ * apache::thrift::SecurityServerInterface from
+ * thrift/lib/cpp2/server/SecurityServerInterface.h).
+ *
+ * Security-metadata introspection RPCs — "who am I to this server", which
+ * interface owns a method, what the server's enforcement posture is — are
+ * answered on this interface. Marker exists purely as a type-system
+ * guardrail: passing a user-facing handler to setSecurityInterface is a
+ * compile error.
+ *
+ * Unlike the monitoring / status / debug slots, no IDL ships alongside this
+ * header: the canonical security-metadata service depends on Meta-internal
+ * types that cannot live in this tree. The embedder supplies both the IDL
+ * and the FastServiceHandler that implements it.
+ *
+ * Naming contract for that service: authorization gates exempt these RPCs by
+ * matching the `Service.method` name against a fixed allowlist of interface
+ * prefixes (facebook::services::isInternalMethod). Two consequences for an
+ * embedder. The service name must be one the allowlist already recognizes,
+ * and — because a fast_thrift method name on the wire is bare — a gate must
+ * qualify it with the service name before matching. An unqualified name never
+ * matches, which denies the request rather than exempting it.
+ *
+ * DO NOT inherit this type if the ThriftServerAppAdapter returned by your
+ * class handles non-security methods.
+ */
+class SecurityServerInterface
+    : public virtual thrift::ThriftServerAppAdapterFactory {};
+
+} // namespace apache::thrift::fast_thrift

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/thrift/server/FastThriftServer.cpp

@@ -97,6 +97,19 @@ void FastThriftServer::setDebugInterface(
   auxInterfaces_.debugHandler = std::move(handler);
 }
 
+void FastThriftServer::setSecurityInterface(
+    std::shared_ptr<fast_thrift::SecurityServerInterface> handler) {
+  std::lock_guard<std::mutex> lock(lifecycleMutex_);
+  CHECK(state_ == State::kNotStarted)
+      << "FastThriftServer::setSecurityInterface must be called before "
+         "start()/serve()";
+  CHECK(handler)
+      << "FastThriftServer::setSecurityInterface requires a non-null handler";
+  CHECK(!auxInterfaces_.securityHandler)
+      << "FastThriftServer::setSecurityInterface called more than once";
+  auxInterfaces_.securityHandler = std::move(handler);
+}
+
 void FastThriftServer::setStats(std::shared_ptr<ServerStats> stats) {
   std::lock_guard<std::mutex> lock(lifecycleMutex_);
   CHECK(state_ == State::kNotStarted)
@@ -293,6 +306,9 @@ void FastThriftServer::start() {
     if (auxInterfaces_.debugHandler) {
       auxInterfaces_.debugHandler->getServiceMetadata(*resp);
     }
+    if (auxInterfaces_.securityHandler) {
+      auxInterfaces_.securityHandler->getServiceMetadata(*resp);
+    }
     handler_->getServiceMetadata(*resp);
     metadataResponse_ = std::move(resp);
   }
@@ -354,6 +370,7 @@ void FastThriftServer::start() {
       .monitoringHandler = auxInterfaces_.monitoringHandler,
       .statusHandler = auxInterfaces_.statusHandler,
       .debugHandler = auxInterfaces_.debugHandler,
+      .securityHandler = auxInterfaces_.securityHandler,
       .metadataResponse = metadataResponse_,
       .zeroCopyThreshold = config_.zeroCopyThreshold,
       .enableRequestContext = config_.enableRequestContext,

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/thrift/server/FastThriftServer.h

@@ -35,6 +35,7 @@
 #include <thrift/lib/cpp2/fast_thrift/connection/SocketOptions.h>
 #include <thrift/lib/cpp2/fast_thrift/interface/debug/DebugServerInterface.h>
 #include <thrift/lib/cpp2/fast_thrift/interface/monitor/MonitoringServerInterface.h>
+#include <thrift/lib/cpp2/fast_thrift/interface/security/SecurityServerInterface.h>
 #include <thrift/lib/cpp2/fast_thrift/interface/status/StatusServerInterface.h>
 #include <thrift/lib/cpp2/fast_thrift/security/FizzServerCertConfig.h>
 #include <thrift/lib/cpp2/fast_thrift/security/ThriftTlsConfig.h>
@@ -134,6 +135,22 @@ class FastThriftServer {
   void setDebugInterface(
       std::shared_ptr<fast_thrift::DebugServerInterface> handler);
 
+  /**
+   * Attach a Security handler. Methods on the security handler are dispatched
+   * on the same connection as the user handler; routing is by method name
+   * with the user handler winning on conflict (mirrors
+   * ThriftServer::setSecurityInterface). Must be called before
+   * start()/serve().
+   *
+   * Security-metadata introspection clients call into this interface.
+   *
+   * The handler must derive from fast_thrift::SecurityServerInterface — a
+   * marker base that exists purely as a type-system guardrail. See that
+   * header for the service-naming contract an authorization gate relies on.
+   */
+  void setSecurityInterface(
+      std::shared_ptr<fast_thrift::SecurityServerInterface> handler);
+
   /**
    * Attach server counters. Wires the rocket- and thrift-layer metrics
    * handlers into every connection built after this point; leaving it unset
@@ -352,6 +369,9 @@ class FastThriftServer {
   bool hasDebugHandler() const noexcept {
     return static_cast<bool>(auxInterfaces_.debugHandler);
   }
+  bool hasSecurityHandler() const noexcept {
+    return static_cast<bool>(auxInterfaces_.securityHandler);
+  }
 
  private:
   // Lifecycle states. Transitions are linear: kNotStarted → kRunning →
@@ -373,6 +393,8 @@ class FastThriftServer {
         nullptr};
     std::shared_ptr<fast_thrift::StatusServerInterface> statusHandler{nullptr};
     std::shared_ptr<fast_thrift::DebugServerInterface> debugHandler{nullptr};
+    std::shared_ptr<fast_thrift::SecurityServerInterface> securityHandler{
+        nullptr};
   };
 
   const FastThriftServerConfig config_;

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/thrift/server/ThriftServerConnectionFactory.cpp

@@ -87,6 +87,7 @@ ThriftServerConnectionFactory::ThriftServerConnectionFactory(
           static_cast<bool>(config_.monitoringHandler) ||
           static_cast<bool>(config_.statusHandler) ||
           static_cast<bool>(config_.debugHandler) ||
+          static_cast<bool>(config_.securityHandler) ||
           static_cast<bool>(config_.metadataResponse)) {
   CHECK(config_.handler)
       << "ThriftServerConnectionFactory requires a non-null handler";
@@ -169,6 +170,11 @@ ThriftServerConnection ThriftServerConnectionFactory::buildCompositeConnection(
         config_.debugHandler->getAppAdapter(config_.debugHandler));
     attachCPUExecutor(*tail.children.back());
   }
+  if (config_.securityHandler) {
+    tail.children.push_back(
+        config_.securityHandler->getAppAdapter(config_.securityHandler));
+    attachCPUExecutor(*tail.children.back());
+  }
   // Deliberately not offloaded: MetadataAppAdapter is hand-written rather
   // than generated, so it never consults cpuExecutor() and completes through
   // the EventBase-only writeResponse overload. Attaching an executor would

third-party/thrift/src/thrift/lib/cpp2/fast_thrift/thrift/server/ThriftServerConnectionFactory.h

@@ -35,6 +35,7 @@
 #include <thrift/lib/cpp2/fast_thrift/frame/write/IntervalBatchingHandlerConfig.h>
 #include <thrift/lib/cpp2/fast_thrift/interface/debug/DebugServerInterface.h>
 #include <thrift/lib/cpp2/fast_thrift/interface/monitor/MonitoringServerInterface.h>
+#include <thrift/lib/cpp2/fast_thrift/interface/security/SecurityServerInterface.h>
 #include <thrift/lib/cpp2/fast_thrift/interface/status/StatusServerInterface.h>
 #include <thrift/lib/cpp2/fast_thrift/rocket/server/adapter/RocketServerAppAdapter.h>
 #include <thrift/lib/cpp2/fast_thrift/rocket/server/handler/RocketServerSetupFrameHandler.h>
@@ -57,9 +58,10 @@ struct ThriftServerConnectionFactoryConfig {
   // Executor that handler methods are dispatched to. Null keeps dispatch
   // inline on the connection's EventBase.
   //
-  // Applied to the user handler and to the monitoring / status / debug aux
-  // interfaces alike. Methods that must stay on the EventBase — the liveness
-  // probe and the counter scrapes — are pinned per-method in their IDLs with
+  // Applied to the user handler and to the monitoring / status / debug /
+  // security aux interfaces alike. Methods that must stay on the EventBase —
+  // the liveness probe and the counter scrapes — are pinned per-method in
+  // their IDLs with
   // @cpp.ProcessInEbThreadUnsafe, mirroring what the legacy stack pins in
   // common/thrift/thrift/status.thrift and fb303/thrift/fb303_core.thrift.
   //
@@ -70,6 +72,7 @@ struct ThriftServerConnectionFactoryConfig {
   std::shared_ptr<fast_thrift::MonitoringServerInterface> monitoringHandler;
   std::shared_ptr<fast_thrift::StatusServerInterface> statusHandler;
   std::shared_ptr<fast_thrift::DebugServerInterface> debugHandler;
+  std::shared_ptr<fast_thrift::SecurityServerInterface> securityHandler;
   std::shared_ptr<const apache::thrift::metadata::ThriftServiceMetadataResponse>
       metadataResponse;
   // Per-connection MSG_ZEROCOPY threshold; 0 disables zero-copy.