From 90f94ff4f2b85c496b59738fc24871c8a7e858f5 Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Mon, 7 Apr 2025 13:50:24 +0200
Subject: [PATCH] cluster/PublishEvent:: Make event non-const

We want to introduce a hook that can modify the cluster event instances, so
need to pass around a non-const version of it.
---
 src/broker/Manager.cc              |  2 +-
 src/broker/Manager.h               |  2 +-
 src/cluster/Backend.cc             |  2 +-
 src/cluster/Backend.h              | 11 +++++++----
 src/cluster/websocket/WebSocket.cc |  2 +-
 5 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc
index 0fe9332830..ce94c72b69 100644
--- a/src/broker/Manager.cc
+++ b/src/broker/Manager.cc
@@ -624,7 +624,7 @@ std::vector<broker::peer_info> Manager::Peers() const {
 
 std::string Manager::NodeID() const { return to_string(bstate->endpoint.node_id()); }
 
-bool Manager::DoPublishEvent(const std::string& topic, const cluster::detail::Event& event) {
+bool Manager::DoPublishEvent(const std::string& topic, cluster::detail::Event& event) {
     auto maybe_ev = zeek::cluster::detail::to_broker_event(event);
     if ( ! maybe_ev )
         return false;
diff --git a/src/broker/Manager.h b/src/broker/Manager.h
index e72e5d0df5..c9e7f3c8e9 100644
--- a/src/broker/Manager.h
+++ b/src/broker/Manager.h
@@ -396,7 +396,7 @@ private:
     void DoTerminate() override;
 
     // Broker overrides this to do its own serialization.
-    bool DoPublishEvent(const std::string& topic, const cluster::detail::Event& event) override;
+    bool DoPublishEvent(const std::string& topic, cluster::detail::Event& event) override;
 
     // This should never be reached, broker itself doesn't call this and overrides
     // the generic DoPublishEvent() method that would call this.
diff --git a/src/cluster/Backend.cc b/src/cluster/Backend.cc
index 92d9dd4624..5729755437 100644
--- a/src/cluster/Backend.cc
+++ b/src/cluster/Backend.cc
@@ -91,7 +91,7 @@ std::optional<detail::Event> Backend::MakeClusterEvent(FuncValPtr handler, ArgsS
 }
 
 // Default implementation doing the serialization.
-bool Backend::DoPublishEvent(const std::string& topic, const cluster::detail::Event& event) {
+bool Backend::DoPublishEvent(const std::string& topic, cluster::detail::Event& event) {
     cluster::detail::byte_buffer buf;
 
     if ( ! event_serializer->SerializeEvent(buf, event) )
diff --git a/src/cluster/Backend.h b/src/cluster/Backend.h
index 794b270eff..0709cd10ba 100644
--- a/src/cluster/Backend.h
+++ b/src/cluster/Backend.h
@@ -178,14 +178,17 @@ public:
     /**
      * Publish a cluster::detail::Event instance to a given topic.
      *
+     * The event is allowed to be modified by plugins, e.g. to add additional
+     * metadata, modify the arguments, or rewrite it in other ways, too. The
+     * caller will observe these changes on the event as it is passed by
+     * reference.
+     *
      * @param topic The topic string to publish the event to.
      * @param event The event to publish.
      *
      * @return true if the event was successfully published.
      */
-    bool PublishEvent(const std::string& topic, const cluster::detail::Event& event) {
-        return DoPublishEvent(topic, event);
-    }
+    bool PublishEvent(const std::string& topic, cluster::detail::Event& event) { return DoPublishEvent(topic, event); }
 
     /**
      * Status codes for callbacks.
@@ -319,7 +322,7 @@ private:
      * This hook method only exists for the existing Broker implementation that
      * short-circuits serialization. Other backends should not override this.
      */
-    virtual bool DoPublishEvent(const std::string& topic, const cluster::detail::Event& event);
+    virtual bool DoPublishEvent(const std::string& topic, cluster::detail::Event& event);
 
     /**
      * Send a serialized cluster::detail::Event to the given topic.
diff --git a/src/cluster/websocket/WebSocket.cc b/src/cluster/websocket/WebSocket.cc
index fa2efb51ae..4d9f4da30a 100644
--- a/src/cluster/websocket/WebSocket.cc
+++ b/src/cluster/websocket/WebSocket.cc
@@ -454,7 +454,7 @@ void WebSocketEventDispatcher::HandleEvent(WebSocketClientEntry& entry, std::str
     //
     // Switching to a JSON v2 format that ensures all Zeek types are represented
     // explicitly would help.
-    const auto& zeek_ev = cluster::detail::to_zeek_event(broker_ev);
+    auto zeek_ev = cluster::detail::to_zeek_event(broker_ev);
     if ( ! zeek_ev ) {
         entry.wsc->SendError(broker::enum_str(broker::ec::deserialization_failed), "failed to create Zeek event");
         return;