Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 alex
|
22c035984e | ||
|
alex
|
d35037df01 |
@@ -1,3 +0,0 @@
|
||||
{
|
||||
"fingerprint": "fdea8a74bb4c7449c01c4bd61646c895b10ede78"
|
||||
}
|
||||
@@ -1,36 +0,0 @@
|
||||
# Skill Registry — headquarter
|
||||
|
||||
<!-- Auto-generated by gentle-pi extensions/skill-registry.ts. Run /skill-registry:refresh to regenerate. -->
|
||||
|
||||
Last updated: 2026-05-28
|
||||
|
||||
## Sources scanned
|
||||
|
||||
- .opencode/skills
|
||||
- .claude/skills
|
||||
- /home/alex/.config/opencode/skills
|
||||
|
||||
## Contract
|
||||
|
||||
**Delegator use only.** This registry is an index, not a summary. Any agent that launches subagents reads it to select relevant skills, then passes exact `SKILL.md` paths for the subagent to read before work.
|
||||
|
||||
`SKILL.md` remains the source of truth. Do not inject generated summaries or compact rules by default; pass paths so subagents load the full runtime contract and preserve author intent.
|
||||
|
||||
## Skills
|
||||
|
||||
| Skill | Trigger / description | Scope | Path |
|
||||
| --- | --- | --- | --- |
|
||||
| `auto-commit` | Use when you are making multiple edits or completing significant work in a git repository to automatically create commits | user | `/home/alex/.config/opencode/skills/auto-commit/SKILL.md` |
|
||||
| `openspec` | Use OpenSpec as the source of truth for planning, implementation, verification, and archive discipline. | user | `/home/alex/.config/opencode/skills/openspec/SKILL.md` |
|
||||
| `openspec-apply-change` | Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks. | project | `/home/alex/projects/headquarter/.opencode/skills/openspec-apply-change/SKILL.md` |
|
||||
| `openspec-archive-change` | Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete. | project | `/home/alex/projects/headquarter/.opencode/skills/openspec-archive-change/SKILL.md` |
|
||||
| `openspec-explore` | Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change. | project | `/home/alex/projects/headquarter/.opencode/skills/openspec-explore/SKILL.md` |
|
||||
| `openspec-propose` | Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation. | project | `/home/alex/projects/headquarter/.opencode/skills/openspec-propose/SKILL.md` |
|
||||
| `sift-backlog` | Triage and organize backlog tasks into actionable plans. Use when asked to review the backlog, prioritize tasks, create plans from backlog items, or move tasks from backlog to open status. Handles the full workflow of listing backlog tasks, grouping related tasks into plans, setting priorities and dependencies, activating plans, and changing task status from backlog to open. | project | `/home/alex/projects/headquarter/.claude/skills/sift-backlog/SKILL.md` |
|
||||
|
||||
## Loading protocol
|
||||
|
||||
1. Match task context and target files against the `Trigger / description` column.
|
||||
2. Pass only the matching `Path` values to the subagent under `## Skills to load before work`.
|
||||
3. Instruct the subagent to read those exact `SKILL.md` files before reading, writing, reviewing, testing, or creating artifacts.
|
||||
4. If no matching skill exists, proceed without project skill injection and report `skill_resolution: none`.
|
||||
@@ -1,195 +0,0 @@
|
||||
---
|
||||
name: sift-backlog
|
||||
description: Triage and organize backlog tasks into actionable plans. Use when asked to review the backlog, prioritize tasks, create plans from backlog items, or move tasks from backlog to open status. Handles the full workflow of listing backlog tasks, grouping related tasks into plans, setting priorities and dependencies, activating plans, and changing task status from backlog to open.
|
||||
---
|
||||
|
||||
# Sift Backlog
|
||||
|
||||
Triage backlog tasks: prioritize, group into plans, set dependencies, and activate.
|
||||
|
||||
## Overview
|
||||
|
||||
1. List backlog tasks (`sf task backlog`)
|
||||
2. Clarify and enrich each task (titles, descriptions)
|
||||
3. Identify groupings and create draft plans
|
||||
4. Add tasks to plans and set dependencies
|
||||
5. Activate plans
|
||||
6. Set task status to open
|
||||
|
||||
## Workflow
|
||||
|
||||
### Step 1: List Backlog Tasks
|
||||
|
||||
```bash
|
||||
sf task backlog
|
||||
```
|
||||
|
||||
### Step 2: Clarify and Enrich Tasks
|
||||
|
||||
Backlog tasks often have only a brief title with no description. Before organizing, ensure each task is well-defined.
|
||||
|
||||
**For each task, evaluate:**
|
||||
|
||||
- Is the title clear and actionable?
|
||||
- Is there a description? Check with `sf task describe <task-id> --show`
|
||||
- Is the scope unambiguous?
|
||||
|
||||
**If the title is unclear**, update it:
|
||||
|
||||
```bash
|
||||
sf update <task-id> --title "Clear, actionable title"
|
||||
```
|
||||
|
||||
**Add a description** with context, scope, and acceptance criteria:
|
||||
|
||||
```bash
|
||||
sf task describe <task-id> --content "Description with:
|
||||
- What needs to be done
|
||||
- Why it matters
|
||||
- Acceptance criteria
|
||||
- Any relevant context"
|
||||
```
|
||||
|
||||
**Use your best judgment** to interpret tasks and make reasonable decisions about scope, grouping, and priority. You have context about the codebase, project patterns, and typical development practices—leverage this knowledge rather than deferring to the user for routine decisions.
|
||||
|
||||
**Only ask the user for clarity when absolutely necessary:**
|
||||
|
||||
- The task is fundamentally ambiguous (multiple mutually exclusive interpretations)
|
||||
- Critical business logic or user-facing behavior that could go wrong in meaningful ways
|
||||
- External dependencies or integrations you cannot verify
|
||||
|
||||
**Do NOT ask about:**
|
||||
|
||||
- Implementation details you can reasonably infer
|
||||
- Priority or grouping decisions—use your judgment
|
||||
- Standard development practices (testing, code style, etc.)
|
||||
- Tasks where a reasonable interpretation exists
|
||||
|
||||
### Step 3: Create Draft Plans
|
||||
|
||||
Group related tasks into plans using your best judgment. Plans start as drafts (tasks won't be dispatched until activated).
|
||||
|
||||
**Grouping guidance:**
|
||||
|
||||
- Group tasks that share a common theme, feature area, or goal
|
||||
- Consider technical dependencies when grouping (tasks that touch the same files/modules)
|
||||
- Separate unrelated work into distinct plans for parallel execution
|
||||
- Don't over-group—if tasks are truly independent, separate plans enable better parallelism
|
||||
- Don't under-group—related tasks benefit from shared context and coordinated execution
|
||||
|
||||
```bash
|
||||
sf plan create --title "Plan Name"
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
sf plan create --title "Authentication Improvements"
|
||||
# Output: Created plan el-abc123
|
||||
```
|
||||
|
||||
### Step 4: Add Tasks to Plans
|
||||
|
||||
```bash
|
||||
sf plan add-task <plan-id> <task-id>
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
sf plan add-task el-abc123 el-task1
|
||||
sf plan add-task el-abc123 el-task2
|
||||
```
|
||||
|
||||
### Step 5: Set Dependencies Between Tasks
|
||||
|
||||
Use `blocks` dependency when one task must complete before another can start.
|
||||
|
||||
```bash
|
||||
sf dependency add <blocked-id> <blocker-id> --type blocks
|
||||
```
|
||||
|
||||
**Semantics:** The first ID is blocked BY the second ID. The blocker must complete first.
|
||||
|
||||
**Example:** Task 2 can't start until Task 1 completes:
|
||||
|
||||
```bash
|
||||
sf dependency add el-task2 el-task1 --type blocks
|
||||
```
|
||||
|
||||
### Step 6: Update Priorities
|
||||
|
||||
Set priorities based on your assessment of impact, urgency, and dependencies. Use your judgment—you don't need user confirmation for routine prioritization.
|
||||
|
||||
**Priority guidance:**
|
||||
|
||||
- **Critical (1):** Blocking issues, security vulnerabilities, production bugs
|
||||
- **High (2):** Important features with deadlines, significant user impact
|
||||
- **Medium (3):** Standard feature work, most tasks default here
|
||||
- **Low (4):** Nice-to-haves, minor improvements, tech debt
|
||||
- **Minimal (5):** Backlog cleanup, documentation, exploratory work
|
||||
|
||||
```bash
|
||||
sf update <task-id> --priority <1-5>
|
||||
```
|
||||
|
||||
| Value | Level |
|
||||
| ----- | -------- |
|
||||
| 1 | Critical |
|
||||
| 2 | High |
|
||||
| 3 | Medium |
|
||||
| 4 | Low |
|
||||
| 5 | Minimal |
|
||||
|
||||
### Step 7: Activate Plans
|
||||
|
||||
Once tasks are organized with dependencies set, activate plans to enable dispatch.
|
||||
|
||||
```bash
|
||||
sf plan activate <plan-id>
|
||||
```
|
||||
|
||||
### Step 8: Set Task Status to Open
|
||||
|
||||
Move tasks from backlog to open so they become ready for work.
|
||||
|
||||
```bash
|
||||
sf update <id> --status open
|
||||
```
|
||||
|
||||
## Other Actions
|
||||
|
||||
**Close obsolete tasks:**
|
||||
|
||||
```bash
|
||||
sf task close <id> --reason "Won't do: <reason>"
|
||||
```
|
||||
|
||||
**Defer tasks:**
|
||||
|
||||
```bash
|
||||
sf task defer <id> --until <date>
|
||||
```
|
||||
|
||||
**View existing plans:**
|
||||
|
||||
```bash
|
||||
sf plan list
|
||||
```
|
||||
|
||||
**View tasks in a plan:**
|
||||
|
||||
```bash
|
||||
sf plan tasks <plan-id>
|
||||
```
|
||||
|
||||
## Tips
|
||||
|
||||
- **Use your best judgment** for grouping, prioritization, and task interpretation—don't defer routine decisions to the user
|
||||
- **Only escalate to the user** when ambiguity is fundamental and could lead to wasted work (mutually exclusive interpretations, critical business decisions)
|
||||
- Make reasonable inferences about implementation details, scope, and priority based on codebase context
|
||||
- Create plans before setting dependencies to avoid dispatch race conditions
|
||||
- Always activate plans after dependencies are set
|
||||
- Focus on oldest backlog items first (sorted by creation date)
|
||||
- Every task should have a clear title and description before activation
|
||||
- When uncertain about a minor detail, make a reasonable choice and document it in the task description—workers can ask if needed
|
||||
@@ -48,9 +48,3 @@ apps/web/dist/
|
||||
# OS
|
||||
.DS_Store
|
||||
Thumbs.db
|
||||
/.stoneforge/.worktrees/
|
||||
# Pi / agent cache
|
||||
.pi/
|
||||
.atl/
|
||||
.sisyphus/
|
||||
.pi-lens/
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
{}
|
||||
@@ -1,10 +0,0 @@
|
||||
{
|
||||
"sessionID": "ses_1da2608b1ffergOzow3NQt1mGr",
|
||||
"updatedAt": "2026-05-15T23:50:42.832Z",
|
||||
"sources": {
|
||||
"background-task": {
|
||||
"state": "idle",
|
||||
"updatedAt": "2026-05-15T23:50:42.832Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,2 +0,0 @@
|
||||
262629
|
||||
1779624255076
|
||||
@@ -1,6 +0,0 @@
|
||||
# Runtime data
|
||||
*.db
|
||||
*.db-journal
|
||||
*.db-wal
|
||||
*.db-shm
|
||||
daemon-state.json
|
||||
@@ -1,20 +0,0 @@
|
||||
# Stoneforge Configuration
|
||||
|
||||
database: stoneforge.db
|
||||
sync:
|
||||
auto_export: true
|
||||
elements_file: elements.jsonl
|
||||
dependencies_file: dependencies.jsonl
|
||||
playbooks:
|
||||
paths:
|
||||
- playbooks
|
||||
identity:
|
||||
mode: soft
|
||||
merge:
|
||||
auto_merge: true
|
||||
target_branch: null
|
||||
require_approval: false
|
||||
workflow:
|
||||
preset: auto
|
||||
agents:
|
||||
permission_model: unrestricted
|
||||
@@ -1,43 +0,0 @@
|
||||
{"blockedId":"el-1of","blockerId":"el-258","type":"parent-child","createdAt":"2026-05-24T09:44:58.759Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-5fe","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:40.892Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1nj","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:41.010Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1bn","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:41.127Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-4hr","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:41.244Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-62c","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:41.372Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-5z8","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:41.490Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1t7","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:41.607Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-5j5","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:41.726Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-2xl","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:41.844Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-4bc","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:41.959Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-107","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:42.074Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-32e","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:42.195Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-3ou","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:42.311Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-14w","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:42.425Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1ou","blockerId":"el-20no","type":"parent-child","createdAt":"2026-05-24T12:44:42.541Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1nj","blockerId":"el-5fe","type":"blocks","createdAt":"2026-05-24T12:44:42.651Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1bn","blockerId":"el-5fe","type":"blocks","createdAt":"2026-05-24T12:44:42.761Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-4hr","blockerId":"el-5fe","type":"blocks","createdAt":"2026-05-24T12:44:42.868Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-62c","blockerId":"el-1nj","type":"blocks","createdAt":"2026-05-24T12:44:42.979Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-62c","blockerId":"el-1bn","type":"blocks","createdAt":"2026-05-24T12:44:43.092Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-5z8","blockerId":"el-1nj","type":"blocks","createdAt":"2026-05-24T12:44:43.205Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-5z8","blockerId":"el-4hr","type":"blocks","createdAt":"2026-05-24T12:44:43.313Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1t7","blockerId":"el-1bn","type":"blocks","createdAt":"2026-05-24T12:44:43.422Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1t7","blockerId":"el-4hr","type":"blocks","createdAt":"2026-05-24T12:44:43.529Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1t7","blockerId":"el-62c","type":"blocks","createdAt":"2026-05-24T12:44:43.647Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-5j5","blockerId":"el-1t7","type":"blocks","createdAt":"2026-05-24T12:44:43.758Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-2xl","blockerId":"el-1t7","type":"blocks","createdAt":"2026-05-24T12:44:43.876Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-4bc","blockerId":"el-1nj","type":"blocks","createdAt":"2026-05-24T12:44:43.987Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-4bc","blockerId":"el-1bn","type":"blocks","createdAt":"2026-05-24T12:44:44.096Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-4bc","blockerId":"el-62c","type":"blocks","createdAt":"2026-05-24T12:44:44.208Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-107","blockerId":"el-5z8","type":"blocks","createdAt":"2026-05-24T12:44:44.319Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-32e","blockerId":"el-5j5","type":"blocks","createdAt":"2026-05-24T12:44:44.429Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-32e","blockerId":"el-2xl","type":"blocks","createdAt":"2026-05-24T12:44:44.539Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-3ou","blockerId":"el-4bc","type":"blocks","createdAt":"2026-05-24T12:44:44.650Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-3ou","blockerId":"el-107","type":"blocks","createdAt":"2026-05-24T12:44:44.761Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-14w","blockerId":"el-32e","type":"blocks","createdAt":"2026-05-24T12:44:44.873Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1ou","blockerId":"el-3ou","type":"blocks","createdAt":"2026-05-24T12:44:44.987Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-1ou","blockerId":"el-14w","type":"blocks","createdAt":"2026-05-24T12:44:45.107Z","createdBy":"el-2jua"}
|
||||
{"blockedId":"el-375","blockerId":"el-26p","type":"replies-to","createdAt":"2026-05-24T13:21:42.486Z","createdBy":"el-2i1s"}
|
||||
{"blockedId":"el-3n4","blockerId":"el-31p","type":"replies-to","createdAt":"2026-05-24T13:21:46.044Z","createdBy":"el-13ju"}
|
||||
{"blockedId":"el-3jer","blockerId":"el-1xx","type":"replies-to","createdAt":"2026-05-24T13:24:47.580Z","createdBy":"el-4350"}
|
||||
{"blockedId":"el-1afv","blockerId":"el-1ozw","type":"replies-to","createdAt":"2026-05-24T13:32:42.658Z","createdBy":"el-51a8"}
|
||||
File diff suppressed because one or more lines are too long
@@ -4,10 +4,6 @@
|
||||
|
||||
OpenSpec is the source of truth. Superpowers is the default workflow. Keep changes small, scoped, and verified.
|
||||
|
||||
## Communication
|
||||
|
||||
All agent output, code comments, commit messages, documentation, and artifacts must be in **English** unless the user explicitly requests another language.
|
||||
|
||||
## Priority order
|
||||
|
||||
1. Current user instruction
|
||||
@@ -91,31 +87,6 @@ Do not claim completion without verification evidence.
|
||||
|
||||
## Git workflow
|
||||
|
||||
### Branching strategy
|
||||
|
||||
For every spec change or new functionality:
|
||||
|
||||
1. Create a new branch from `dev` with a proper prefix:
|
||||
- `feat/` for new features (e.g., `feat/tool-workshop`)
|
||||
- `fix/` for bug fixes (e.g., `fix/terminal-tty`)
|
||||
- `refactor/` for refactors (e.g., `refactor/api-cleanup`)
|
||||
- `docs/` for documentation (e.g., `docs/api-guide`)
|
||||
- `chore/` for maintenance (e.g., `chore/update-deps`)
|
||||
2. Branch name should reference the OpenSpec change name when applicable.
|
||||
3. Do not commit directly to `main` or `dev`.
|
||||
|
||||
### Completion and merge
|
||||
|
||||
When implementation is complete and verified:
|
||||
|
||||
1. Ensure all tests pass and quality gates are met.
|
||||
2. Stage all changes with `git add -A`.
|
||||
3. Create a commit with a proper conventional commit message (see below).
|
||||
4. Switch to `dev`: `git checkout dev`.
|
||||
5. Merge the feature branch: `git merge --no-ff <branch-name>`.
|
||||
6. Push to remote: `git push origin dev`.
|
||||
7. Delete the local feature branch if desired: `git branch -d <branch-name>`.
|
||||
|
||||
### Auto-commit on spec completion
|
||||
|
||||
When an OpenSpec change is fully implemented and all tasks are complete:
|
||||
|
||||
-568
@@ -1,568 +0,0 @@
|
||||
{
|
||||
"version": "v2",
|
||||
"timestamp": 1779889907001,
|
||||
"ruleHash": "fd9b2b15f2ac8993",
|
||||
"queries": [
|
||||
{
|
||||
"id": "bare-except",
|
||||
"name": "Bare Except Clause",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Bare 'except:' clause — catches SystemExit, KeyboardInterrupt",
|
||||
"query": " (except_clause\n \"except\") @CLAUSE",
|
||||
"metavars": [
|
||||
"CLAUSE"
|
||||
],
|
||||
"post_filter": "bare_except_only",
|
||||
"defect_class": "silent-error",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/bare-except.yml"
|
||||
},
|
||||
{
|
||||
"id": "eval-exec",
|
||||
"name": "Eval/Exec Usage",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "{{FUNC}}() detected — security risk, code injection vulnerability",
|
||||
"query": " (call\n function: (identifier) @FUNC\n (#match? @FUNC \"^(eval|exec)$\")\n arguments: (argument_list) @ARGS)",
|
||||
"metavars": [
|
||||
"FUNC",
|
||||
"ARGS"
|
||||
],
|
||||
"defect_class": "injection",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/eval-exec.yml"
|
||||
},
|
||||
{
|
||||
"id": "exit-signature-check",
|
||||
"name": "__exit__ Missing Parameters",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "__exit__ should accept type, value, and traceback arguments",
|
||||
"query": " (function_definition\n name: (identifier) @NAME (#eq? @NAME \"__exit__\")\n parameters: (parameters\n (_) @SELF\n . (_) @PARAM1?\n . (_) @PARAM2?\n . (_) @PARAM3?))",
|
||||
"metavars": [
|
||||
"NAME",
|
||||
"SELF",
|
||||
"PARAM1",
|
||||
"PARAM2",
|
||||
"PARAM3"
|
||||
],
|
||||
"post_filter": "exit_params_insufficient",
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/exit-signature-check.yml"
|
||||
},
|
||||
{
|
||||
"id": "in-operator-unsupported",
|
||||
"name": "In and Not In Operators Should Be Used on Valid Objects",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "'in' operator used on object that may not support containment",
|
||||
"query": " (comparison_operator\n (identifier) @OBJ\n \"in\"\n (identifier) @TARGET)\n (comparison_operator\n (identifier) @OBJ\n \"not\"\n \"in\"\n (identifier) @TARGET)",
|
||||
"metavars": [
|
||||
"OBJ",
|
||||
"TARGET"
|
||||
],
|
||||
"post_filter": "check_in_operator_types",
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/in-operator-unsupported.yml"
|
||||
},
|
||||
{
|
||||
"id": "is-vs-equals",
|
||||
"name": "Is vs Equals for Literals",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Using 'is' with literal — use '==' for value comparison",
|
||||
"query": " (comparison_operator\n (identifier)\n (\"is\")\n (string) @LITERAL)\n (comparison_operator\n (identifier)\n (\"is not\")\n (string) @LITERAL)\n (comparison_operator\n (identifier)\n (\"is\")\n (integer) @LITERAL)\n (comparison_operator\n (identifier)\n (\"is not\")\n (integer) @LITERAL)",
|
||||
"metavars": [
|
||||
"LITERAL"
|
||||
],
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/is-vs-equals.yml"
|
||||
},
|
||||
{
|
||||
"id": "iter-return-iterator",
|
||||
"name": "__iter__ Should Return Iterator",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "__iter__ should return an iterator (object with __next__ method)",
|
||||
"query": " (function_definition\n name: (identifier) @NAME (#eq? @NAME \"__iter__\")\n body: (block\n (return_statement) @RETURN))",
|
||||
"metavars": [
|
||||
"NAME",
|
||||
"RETURN"
|
||||
],
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/iter-return-iterator.yml"
|
||||
},
|
||||
{
|
||||
"id": "mutable-default-arg",
|
||||
"name": "Mutable Default Argument",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Mutable default argument — list/dict/set as default value",
|
||||
"query": " (function_definition\n (parameters\n (default_parameter\n (identifier) @PARAM\n [(list) (dictionary) (set)] @MUTABLE)))",
|
||||
"metavars": [
|
||||
"PARAM",
|
||||
"MUTABLE"
|
||||
],
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/mutable-default-arg.yml"
|
||||
},
|
||||
{
|
||||
"id": "no-super-torchscript",
|
||||
"name": "super Should Not Be Used in TorchScript Methods",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "super() calls should not be used in TorchScript methods",
|
||||
"query": " (function_definition\n (decorator\n (call\n function: (identifier) @DEC (#match? @DEC \"^(torch\\.jit\\.script|jit\\.script)$\")))\n body: (block\n (call\n function: (identifier) @FUNC (#eq? @FUNC \"super\")) @CALL))",
|
||||
"metavars": [
|
||||
"DEC",
|
||||
"FUNC",
|
||||
"CALL"
|
||||
],
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/no-super-torchscript.yml"
|
||||
},
|
||||
{
|
||||
"id": "notimplemented-boolean-context",
|
||||
"name": "NotImplemented in Boolean Context",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "NotImplemented should not be used in boolean contexts",
|
||||
"query": " (if_statement\n condition: (identifier) @COND (#eq? @COND \"NotImplemented\"))\n (while_statement\n condition: (identifier) @COND (#eq? @COND \"NotImplemented\"))\n (binary_operator\n (identifier) @COND (#eq? @COND \"NotImplemented\")\n (\"and\" | \"or\"))\n (boolean_operator\n (identifier) @COND (#eq? @COND \"NotImplemented\"))\n (unary_operator\n operator: (\"not\")\n argument: (identifier) @COND (#eq? @COND \"NotImplemented\"))",
|
||||
"metavars": [
|
||||
"COND"
|
||||
],
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/notimplemented-boolean-context.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-assert-production",
|
||||
"name": "Assert in Production Code",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "assert statement stripped by Python -O flag — use explicit checks with exceptions in production code",
|
||||
"query": " (assert_statement) @ASSERT",
|
||||
"metavars": [
|
||||
"ASSERT"
|
||||
],
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-assert-production.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-command-injection",
|
||||
"name": "Command Injection Sink",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "Potential command injection sink — avoid shell execution with dynamic input",
|
||||
"query": " (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FN)\n arguments: (argument_list) @ARGS\n (#eq? @MOD \"os\")\n (#match? @FN \"^(system|popen)$\"))\n\n (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FN)\n arguments: (argument_list\n (keyword_argument\n name: (identifier) @KW\n value: (true)))\n (#eq? @MOD \"subprocess\")\n (#match? @FN \"^(run|Popen|call|check_output|check_call)$\")\n (#eq? @KW \"shell\"))",
|
||||
"metavars": [
|
||||
"MOD",
|
||||
"FN",
|
||||
"ARGS",
|
||||
"KW"
|
||||
],
|
||||
"post_filter": "py_command_injection_sink",
|
||||
"defect_class": "injection",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-command-injection.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-cross-language-method",
|
||||
"name": "Cross-Language Method Leakage",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "'{METHOD}' is not a Python method — likely a {LANG} idiom leaking in",
|
||||
"query": " (call\n function: (attribute\n object: (_) @OBJ\n attribute: (identifier) @METHOD)\n (#match? @METHOD \"^(push|forEach|indexOf|charAt|substring|hasOwnProperty|unshift|flatMap|padStart|padEnd|trimStart|trimEnd|equals|isEmpty|println|printf|getClass|hashCode|toCharArray|getBytes|compareTo|equalsIgnoreCase|startsWith|endsWith|each|collect|select|reject|detect|inject|chomp|chop|gsub|upcase|downcase|present|blank|Add|Contains|ToLower|ToUpper|Trim|Substring|WriteLine|ReadLine|TryParse|forEach|includes|assign|freeze|splice|unshift|shift|flatMap)$\"))",
|
||||
"metavars": [
|
||||
"OBJ",
|
||||
"METHOD"
|
||||
],
|
||||
"post_filter": "match_captures",
|
||||
"post_filter_params": {
|
||||
"METHOD": "^(push|forEach|indexOf|charAt|substring|hasOwnProperty|unshift|flatMap|padStart|padEnd|trimStart|trimEnd|equals|isEmpty|println|printf|getClass|hashCode|toCharArray|getBytes|compareTo|equalsIgnoreCase|startsWith|endsWith|each|collect|select|reject|detect|inject|chomp|chop|gsub|upcase|downcase|present|blank|Add|Contains|ToLower|ToUpper|Trim|Substring|WriteLine|ReadLine|TryParse|forEach|includes|assign|freeze|splice|unshift|shift|flatMap)$"
|
||||
},
|
||||
"defect_class": "hallucination",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-cross-language-method.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-debugger",
|
||||
"name": "Debugger Statement",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Debugger call '{{FUNC}}' — remove before committing",
|
||||
"query": " (call\n function: (identifier) @FUNC\n (#eq? @FUNC \"breakpoint\"))\n\n (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FUNC)\n (#eq? @MOD \"pdb\")\n (#match? @FUNC \"^(set_trace|post_mortem|pm|run|runcall)$\"))",
|
||||
"metavars": [
|
||||
"FUNC",
|
||||
"MOD"
|
||||
],
|
||||
"defect_class": "safety",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-debugger.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-empty-except",
|
||||
"name": "Empty Except Block",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Except block only contains 'pass' — handle or re-raise the exception",
|
||||
"query": " (try_statement\n (except_clause\n body: (block) @BODY))",
|
||||
"metavars": [
|
||||
"BODY"
|
||||
],
|
||||
"post_filter": "python_empty_except",
|
||||
"defect_class": "silent-error",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-empty-except.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-hallucinated-import",
|
||||
"name": "Hallucinated Import",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Hallucinated import — '{NAME}' does not exist in '{MODULE}'",
|
||||
"query": " (import_from_statement\n module_name: (dotted_name) @MODULE\n name: (dotted_name) @NAME)",
|
||||
"metavars": [
|
||||
"MODULE",
|
||||
"NAME"
|
||||
],
|
||||
"post_filter": "match_captures",
|
||||
"post_filter_params": {
|
||||
"MODULE": "^(requests|flask|django|typing|collections|asyncio|json|unittest|pytest|urllib|sqlalchemy)$",
|
||||
"NAME": "^(JSONResponse|HTMLResponse|RedirectResponse|StreamingResponse|Depends|Query|Path|Body|Header|Cookie|Form|File|UploadFile|FastAPI|APIRouter|HTTPException|BackgroundTasks|dataclass|fields|BaseModel|Field|validator|aiohttp|parse|stringify|fixture|TestCase|get|post|put|delete|Model|Session|Column|Integer|String)$"
|
||||
},
|
||||
"defect_class": "hallucination",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-hallucinated-import.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-hardcoded-secrets",
|
||||
"name": "Hardcoded Secret",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Hardcoded {{VARNAME}} — use environment variables or a secrets manager",
|
||||
"query": " (assignment\n left: (identifier) @VARNAME\n right: (string) @VALUE)",
|
||||
"metavars": [
|
||||
"VARNAME",
|
||||
"VALUE"
|
||||
],
|
||||
"post_filter": "check_secret_pattern",
|
||||
"defect_class": "secrets",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-hardcoded-secrets.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-insecure-deserialization",
|
||||
"name": "Insecure Deserialization",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "Potential insecure deserialization sink — avoid unsafe loaders",
|
||||
"query": " (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FN)\n arguments: (argument_list (_) @DATA)\n (#match? @MOD \"^(pickle|yaml)$\")\n (#match? @FN \"^(load|loads|unsafe_load)$\"))",
|
||||
"metavars": [
|
||||
"MOD",
|
||||
"FN",
|
||||
"DATA"
|
||||
],
|
||||
"post_filter": "py_insecure_deserialization_sink",
|
||||
"defect_class": "injection",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-insecure-deserialization.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-insecure-random",
|
||||
"name": "Insecure Randomness",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Insecure randomness source detected — use secrets or os.urandom for security-sensitive values",
|
||||
"query": " (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FN)\n arguments: (argument_list) @ARGS\n (#eq? @MOD \"random\")\n (#match? @FN \"^(random|randint|randrange|choice|choices)$\"))",
|
||||
"metavars": [
|
||||
"MOD",
|
||||
"FN",
|
||||
"ARGS"
|
||||
],
|
||||
"defect_class": "injection",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-insecure-random.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-mutable-class-attr",
|
||||
"name": "Mutable Class Attribute",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Class attribute '{{VARNAME}}' is mutable — shared across all instances",
|
||||
"query": " (class_definition\n body: (block\n (expression_statement\n (assignment\n left: (identifier) @VARNAME\n right: [\n (list) @VALUE\n (dictionary) @VALUE\n (set) @VALUE\n ]))))",
|
||||
"metavars": [
|
||||
"VARNAME",
|
||||
"VALUE"
|
||||
],
|
||||
"post_filter": "not_in_function",
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-mutable-class-attr.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-path-traversal",
|
||||
"name": "Path Traversal Risk",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Potential path traversal sink — sanitize and constrain file paths",
|
||||
"query": " [\n (call\n function: (identifier) @FN\n arguments: (argument_list\n [(identifier) (binary_operator) (call)] @PATH))\n (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FN)\n arguments: (argument_list\n [(identifier) (binary_operator) (call)] @PATH))\n ]\n (#match? @FN \"^(open|read_text|read_bytes|write_text|write_bytes|remove|unlink|rmdir)$\")",
|
||||
"metavars": [
|
||||
"MOD",
|
||||
"FN",
|
||||
"PATH"
|
||||
],
|
||||
"post_filter": "py_path_traversal_sink",
|
||||
"defect_class": "injection",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-path-traversal.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-print-statement",
|
||||
"name": "Print Statement in Production",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "print() — remove debug output before committing",
|
||||
"query": " (call\n function: (identifier) @FUNC\n (#eq? @FUNC \"print\")\n arguments: (argument_list) @ARGS)",
|
||||
"metavars": [
|
||||
"FUNC",
|
||||
"ARGS"
|
||||
],
|
||||
"post_filter": "not_in_test_block",
|
||||
"defect_class": "safety",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-print-statement.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-raise-string",
|
||||
"name": "Raise String Instead of Exception",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "raise with string literal — Python 3 requires exception instances",
|
||||
"query": " (raise_statement\n (string) @VALUE)",
|
||||
"metavars": [
|
||||
"VALUE"
|
||||
],
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-raise-string.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-sleep-in-test",
|
||||
"name": "time.sleep in Test",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "time.sleep() in test — use synchronisation primitives or polling helpers instead of fixed sleeps",
|
||||
"query": " (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FN)\n (#eq? @MOD \"time\")\n (#eq? @FN \"sleep\")) @CALL",
|
||||
"metavars": [
|
||||
"MOD",
|
||||
"FN",
|
||||
"CALL"
|
||||
],
|
||||
"defect_class": "async-misuse",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-sleep-in-test.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-sql-injection",
|
||||
"name": "SQL Injection Risk",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "Potential SQL injection sink — use parameterized queries",
|
||||
"query": " (call\n function: (attribute\n object: (_) @OBJ\n attribute: (identifier) @FN)\n arguments: (argument_list\n [(binary_operator) (identifier) (call)] @SQL\n (_)*))",
|
||||
"metavars": [
|
||||
"OBJ",
|
||||
"FN",
|
||||
"SQL"
|
||||
],
|
||||
"post_filter": "py_sql_injection_sink",
|
||||
"defect_class": "injection",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-sql-injection.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-ssrf",
|
||||
"name": "SSRF Risk",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Potential SSRF sink — validate/allowlist outbound URLs",
|
||||
"query": " (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FN)\n arguments: (argument_list\n [(identifier) (subscript) (call)] @URL)\n (#eq? @MOD \"requests\")\n (#match? @FN \"^(get|post|put|patch|delete|request|head|options)$\"))",
|
||||
"metavars": [
|
||||
"MOD",
|
||||
"FN",
|
||||
"URL"
|
||||
],
|
||||
"post_filter": "py_ssrf_sink",
|
||||
"defect_class": "injection",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-ssrf.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-subprocess-shell",
|
||||
"name": "subprocess with shell=True",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "subprocess called with shell=True — command injection risk if any argument is user-controlled",
|
||||
"query": " (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FN)\n arguments: (argument_list\n (keyword_argument\n name: (identifier) @KW\n value: (true) @VAL))\n (#eq? @MOD \"subprocess\")\n (#match? @FN \"^(run|Popen|call|check_output|check_call)$\")\n (#eq? @KW \"shell\"))",
|
||||
"metavars": [
|
||||
"MOD",
|
||||
"FN",
|
||||
"KW"
|
||||
],
|
||||
"defect_class": "injection",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-subprocess-shell.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-thread-global-write",
|
||||
"name": "Threaded Shared State Risk",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Thread creation detected — ensure shared state mutations are synchronized",
|
||||
"query": " (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FN)\n arguments: (argument_list) @ARGS)\n (#eq? @MOD \"threading\")\n (#eq? @FN \"Thread\")",
|
||||
"metavars": [
|
||||
"MOD",
|
||||
"FN",
|
||||
"ARGS"
|
||||
],
|
||||
"defect_class": "async-misuse",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-thread-global-write.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-unsafe-regex",
|
||||
"name": "Unsafe Dynamic Regex",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "re.{{FUNC}}() with variable pattern — ReDoS risk if pattern is user-controlled",
|
||||
"query": " (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FUNC)\n arguments: (argument_list\n (identifier) @PATTERN)\n (#eq? @MOD \"re\")\n (#match? @FUNC \"^(compile|match|search|fullmatch|findall|finditer|sub|subn|split)$\"))",
|
||||
"metavars": [
|
||||
"MOD",
|
||||
"FUNC",
|
||||
"PATTERN"
|
||||
],
|
||||
"defect_class": "injection",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-unsafe-regex.yml"
|
||||
},
|
||||
{
|
||||
"id": "python-weak-hash",
|
||||
"name": "Weak Hash Primitive",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "Weak hash primitive detected (MD5/SHA1) — use SHA-256+ for security-sensitive contexts",
|
||||
"query": " (call\n function: (attribute\n object: (identifier) @MOD\n attribute: (identifier) @FN)\n arguments: (argument_list) @ARGS\n (#eq? @MOD \"hashlib\")\n (#match? @FN \"^(md5|sha1)$\"))",
|
||||
"metavars": [
|
||||
"MOD",
|
||||
"FN",
|
||||
"ARGS"
|
||||
],
|
||||
"defect_class": "injection",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/python-weak-hash.yml"
|
||||
},
|
||||
{
|
||||
"id": "return-in-generator",
|
||||
"name": "Return with Value in Generator",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "'return' with a value should not be used in a generator function",
|
||||
"query": " (function_definition\n body: (block\n (return_statement\n (_) @RETURN_VAL) @RETURN)) @FUNCTION",
|
||||
"metavars": [
|
||||
"FUNCTION",
|
||||
"RETURN",
|
||||
"RETURN_VAL"
|
||||
],
|
||||
"post_filter": "is_generator_with_valued_return",
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/return-in-generator.yml"
|
||||
},
|
||||
{
|
||||
"id": "return-in-init",
|
||||
"name": "Return Value in __init__",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "__init__ should not return a value — it must always return None",
|
||||
"query": " (function_definition\n name: (identifier) @NAME (#eq? @NAME \"__init__\")\n body: (block\n (return_statement\n (_) @RETURN_VAL) @RETURN))",
|
||||
"metavars": [
|
||||
"NAME",
|
||||
"RETURN",
|
||||
"RETURN_VAL"
|
||||
],
|
||||
"post_filter": "has_return_value",
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/return-in-init.yml"
|
||||
},
|
||||
{
|
||||
"id": "send-file-mimetype",
|
||||
"name": "send_file Should Specify Mimetype or Download Name",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "send_file should specify 'mimetype' or 'download_name' when used with file-like objects",
|
||||
"query": " (call\n function: (identifier) @FUNC (#eq? @FUNC \"send_file\")\n arguments: (argument_list\n (_) @FIRST_ARG\n (keyword_argument)? @KW))",
|
||||
"metavars": [
|
||||
"FUNC",
|
||||
"FIRST_ARG",
|
||||
"KW"
|
||||
],
|
||||
"post_filter": "missing_mimetype_and_download_name",
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/send-file-mimetype.yml"
|
||||
},
|
||||
{
|
||||
"id": "unreachable-except",
|
||||
"name": "Unreachable Except Clause",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Unreachable except clause — earlier except catches all",
|
||||
"query": " (try_statement\n (except_clause\n \"except\") @GENERAL\n (except_clause\n \"except\"\n (identifier) @SPECIFIC))",
|
||||
"metavars": [
|
||||
"GENERAL",
|
||||
"SPECIFIC"
|
||||
],
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/unreachable-except.yml"
|
||||
},
|
||||
{
|
||||
"id": "wildcard-import",
|
||||
"name": "Wildcard Import",
|
||||
"severity": "warning",
|
||||
"language": "python",
|
||||
"message": "Wildcard import — pollutes namespace, hard to track origin",
|
||||
"query": " (import_from_statement\n module_name: (dotted_name) @MODULE\n (wildcard_import) @WILDCARD)",
|
||||
"metavars": [
|
||||
"MODULE",
|
||||
"WILDCARD"
|
||||
],
|
||||
"defect_class": "safety",
|
||||
"inline_tier": "warning",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/wildcard-import.yml"
|
||||
},
|
||||
{
|
||||
"id": "yield-return-outside-function",
|
||||
"name": "Yield/Return Outside Function",
|
||||
"severity": "error",
|
||||
"language": "python",
|
||||
"message": "{{STATEMENT}} used outside function — syntax error",
|
||||
"query": " (module\n (expression_statement\n (yield) @STATEMENT))\n (module\n (expression_statement\n (yield_expression) @STATEMENT))\n (module\n (return_statement) @STATEMENT)",
|
||||
"metavars": [
|
||||
"STATEMENT"
|
||||
],
|
||||
"defect_class": "correctness",
|
||||
"inline_tier": "blocking",
|
||||
"filePath": "/home/alex/.npm-global/lib/node_modules/pi-lens/rules/tree-sitter-queries/python/yield-return-outside-function.yml"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -27,7 +27,6 @@ WORKDIR /app
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
libpq5 \
|
||||
git \
|
||||
openssh-client \
|
||||
netcat-openbsd \
|
||||
ca-certificates \
|
||||
curl \
|
||||
|
||||
@@ -0,0 +1,104 @@
|
||||
"""add config profiles, includes, mounts, and tool instance profile selection
|
||||
|
||||
Revision ID: 0013_add_config_profiles
|
||||
Revises: 0012_default_port_req
|
||||
Create Date: 2026-05-24 12:00:00.000000
|
||||
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "0013_add_config_profiles"
|
||||
down_revision: Union[str, None] = "0012_default_port_req"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
# Create config_profiles table
|
||||
op.create_table(
|
||||
"config_profiles",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("user_id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("name", sa.String(length=255), nullable=False),
|
||||
sa.Column("description", sa.Text(), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
||||
sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
sa.UniqueConstraint("user_id", "name", name="uq_config_profiles_user_name"),
|
||||
)
|
||||
op.create_index("idx_config_profiles_user", "config_profiles", ["user_id"])
|
||||
|
||||
# Create config_includes table
|
||||
op.create_table(
|
||||
"config_includes",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("profile_id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("included_profile_id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("order_index", sa.Integer(), nullable=False, server_default="0"),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
||||
sa.ForeignKeyConstraint(["profile_id"], ["config_profiles.id"], ondelete="CASCADE"),
|
||||
sa.ForeignKeyConstraint(["included_profile_id"], ["config_profiles.id"], ondelete="CASCADE"),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
sa.UniqueConstraint("profile_id", "included_profile_id", name="uq_config_includes_pair"),
|
||||
)
|
||||
op.create_index("idx_config_includes_profile", "config_includes", ["profile_id"])
|
||||
op.create_index("idx_config_includes_included", "config_includes", ["included_profile_id"])
|
||||
|
||||
# Create config_mounts table
|
||||
op.create_table(
|
||||
"config_mounts",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("profile_id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("mount_path", sa.String(length=1024), nullable=False),
|
||||
sa.Column("content", sa.Text(), nullable=True),
|
||||
sa.Column("source_profile_id", postgresql.UUID(as_uuid=True), nullable=True),
|
||||
sa.Column("order_index", sa.Integer(), nullable=False, server_default="0"),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
||||
sa.ForeignKeyConstraint(["profile_id"], ["config_profiles.id"], ondelete="CASCADE"),
|
||||
sa.ForeignKeyConstraint(["source_profile_id"], ["config_profiles.id"], ondelete="SET NULL"),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
)
|
||||
op.create_index("idx_config_mounts_profile", "config_mounts", ["profile_id"])
|
||||
|
||||
# Add selected_profile_id to tool_instances
|
||||
op.add_column(
|
||||
"tool_instances",
|
||||
sa.Column("selected_profile_id", postgresql.UUID(as_uuid=True), nullable=True),
|
||||
)
|
||||
op.create_foreign_key(
|
||||
"fk_tool_instances_selected_profile",
|
||||
"tool_instances",
|
||||
"config_profiles",
|
||||
["selected_profile_id"],
|
||||
["id"],
|
||||
ondelete="SET NULL",
|
||||
)
|
||||
op.create_index("idx_tool_instances_selected_profile", "tool_instances", ["selected_profile_id"])
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
# Remove selected_profile_id from tool_instances
|
||||
op.drop_index("idx_tool_instances_selected_profile", table_name="tool_instances")
|
||||
op.drop_constraint("fk_tool_instances_selected_profile", "tool_instances", type_="foreignkey")
|
||||
op.drop_column("tool_instances", "selected_profile_id")
|
||||
|
||||
# Drop config_mounts
|
||||
op.drop_index("idx_config_mounts_profile", table_name="config_mounts")
|
||||
op.drop_table("config_mounts")
|
||||
|
||||
# Drop config_includes
|
||||
op.drop_index("idx_config_includes_included", table_name="config_includes")
|
||||
op.drop_index("idx_config_includes_profile", table_name="config_includes")
|
||||
op.drop_table("config_includes")
|
||||
|
||||
# Drop config_profiles
|
||||
op.drop_index("idx_config_profiles_user", table_name="config_profiles")
|
||||
op.drop_table("config_profiles")
|
||||
@@ -1,29 +0,0 @@
|
||||
"""add probe_result to tool_instances
|
||||
|
||||
Revision ID: 0013_add_probe_result
|
||||
Revises: 0012_default_port_req
|
||||
Create Date: 2026-05-22 21:45:00.000000
|
||||
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "0013_add_probe_result"
|
||||
down_revision: Union[str, None] = "0012_default_port_req"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.add_column(
|
||||
"tool_instances",
|
||||
sa.Column("probe_result", postgresql.JSON, nullable=True)
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_column("tool_instances", "probe_result")
|
||||
@@ -1,23 +0,0 @@
|
||||
"""merge migration heads
|
||||
|
||||
Revision ID: 0014_merge_heads
|
||||
Revises: 0013_add_probe_result, 8ed7dd80973d
|
||||
Create Date: 2026-05-22 21:50:00.000000
|
||||
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "0014_merge_heads"
|
||||
down_revision: Union[str, Sequence[str], None] = ("0013_add_probe_result", "8ed7dd80973d")
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
pass
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
pass
|
||||
@@ -1,109 +0,0 @@
|
||||
"""replace interfaces with interface_type and add requires_port
|
||||
|
||||
Revision ID: 0015_single_interface
|
||||
Revises: 0014_merge_heads
|
||||
Create Date: 2026-05-22 22:00:00.000000
|
||||
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "0015_single_interface"
|
||||
down_revision: Union[str, Sequence[str], None] = "0014_merge_heads"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def _get_dialect() -> str:
|
||||
"""Get the current database dialect name."""
|
||||
conn = op.get_bind()
|
||||
return conn.dialect.name
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
dialect = _get_dialect()
|
||||
|
||||
# Add new columns
|
||||
op.add_column('tool_types', sa.Column('interface_type', sa.String(20), nullable=True))
|
||||
op.add_column('tool_types', sa.Column('requires_port', sa.Boolean(), nullable=False, server_default='true'))
|
||||
|
||||
# Migrate data: take first element from interfaces JSON array
|
||||
if dialect == 'postgresql':
|
||||
op.execute("""
|
||||
UPDATE tool_types
|
||||
SET interface_type = COALESCE(
|
||||
(SELECT elem FROM jsonb_array_elements_text(interfaces::jsonb) AS elem LIMIT 1),
|
||||
'web'
|
||||
),
|
||||
requires_port = CASE
|
||||
WHEN COALESCE(
|
||||
(SELECT elem FROM jsonb_array_elements_text(interfaces::jsonb) AS elem LIMIT 1),
|
||||
'web'
|
||||
) = 'web' THEN true
|
||||
ELSE false
|
||||
END
|
||||
""")
|
||||
else:
|
||||
# SQLite: interfaces is stored as JSON text, extract first array element
|
||||
op.execute("""
|
||||
UPDATE tool_types
|
||||
SET interface_type = COALESCE(
|
||||
(SELECT json_extract(value, '$[0]')
|
||||
FROM json_each(interfaces) AS value
|
||||
WHERE json_valid(interfaces)
|
||||
LIMIT 1),
|
||||
'web'
|
||||
),
|
||||
requires_port = CASE
|
||||
WHEN COALESCE(
|
||||
(SELECT json_extract(value, '$[0]')
|
||||
FROM json_each(interfaces) AS value
|
||||
WHERE json_valid(interfaces)
|
||||
LIMIT 1),
|
||||
'web'
|
||||
) = 'web' THEN true
|
||||
ELSE false
|
||||
END
|
||||
""")
|
||||
|
||||
# Make interface_type non-nullable after data migration
|
||||
op.alter_column('tool_types', 'interface_type', nullable=False)
|
||||
|
||||
# Drop old interfaces column
|
||||
op.drop_column('tool_types', 'interfaces')
|
||||
|
||||
# Add CHECK constraint for interface_type (only on PostgreSQL; SQLite supports it too)
|
||||
op.create_check_constraint('chk_interface_type', 'tool_types', sa.text("interface_type IN ('web', 'terminal')"))
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
dialect = _get_dialect()
|
||||
|
||||
# Drop CHECK constraint
|
||||
op.drop_constraint('chk_interface_type', 'tool_types', type_='check')
|
||||
|
||||
# Add back interfaces column
|
||||
if dialect == 'postgresql':
|
||||
op.add_column('tool_types', sa.Column('interfaces', postgresql.JSONB(astext_type=sa.Text()), nullable=False, server_default='["web"]'))
|
||||
|
||||
# Migrate data back: wrap interface_type in array
|
||||
op.execute("""
|
||||
UPDATE tool_types
|
||||
SET interfaces = jsonb_build_array(interface_type)
|
||||
""")
|
||||
else:
|
||||
op.add_column('tool_types', sa.Column('interfaces', sa.JSON(), nullable=False, server_default='["web"]'))
|
||||
|
||||
# Migrate data back: wrap interface_type in array for SQLite
|
||||
op.execute("""
|
||||
UPDATE tool_types
|
||||
SET interfaces = json_array(interface_type)
|
||||
""")
|
||||
|
||||
# Drop new columns
|
||||
op.drop_column('tool_types', 'requires_port')
|
||||
op.drop_column('tool_types', 'interface_type')
|
||||
@@ -1,32 +0,0 @@
|
||||
"""add_ssh_key_id_to_config_profiles
|
||||
|
||||
Revision ID: 069d3da4dc9b
|
||||
Revises: 2026_05_29_add_notifications_table
|
||||
Create Date: 2026-05-29 12:30:16.580532
|
||||
"""
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision = "069d3da4dc9b"
|
||||
down_revision = "2026_05_29_add_notifications_table"
|
||||
branch_labels = None
|
||||
depends_on = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.add_column(
|
||||
"config_profiles",
|
||||
sa.Column(
|
||||
"ssh_key_id",
|
||||
sa.Uuid(),
|
||||
sa.ForeignKey("ssh_keys.id", ondelete="SET NULL"),
|
||||
nullable=True,
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_column("config_profiles", "ssh_key_id")
|
||||
@@ -1,129 +0,0 @@
|
||||
"""add pi agent tool type
|
||||
|
||||
Revision ID: 20260527_160017_add_pi_agent
|
||||
Revises: f3d2dc90ba3a
|
||||
Create Date: 2026-05-27T16:00:17
|
||||
|
||||
"""
|
||||
|
||||
import json
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
import uuid
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "20260527_160017_add_pi_agent"
|
||||
down_revision: Union[str, None] = "2026_05_27_external_repos"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
PI_AGENT_ID = uuid.UUID("d07b8376-2151-4119-8c1d-27f792aae9a3")
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
# Check if pi-agent already exists
|
||||
conn = op.get_bind()
|
||||
result = conn.execute(
|
||||
sa.text("SELECT id FROM tool_types WHERE name = 'pi-agent'")
|
||||
).fetchone()
|
||||
|
||||
if result is None:
|
||||
conn.execute(
|
||||
sa.text("""
|
||||
INSERT INTO tool_types (
|
||||
id, name, display_name, description, category,
|
||||
interface_type, requires_port, default_port,
|
||||
definition_type, compose_template, dockerfile_template, required_variables,
|
||||
created_at, updated_at
|
||||
) VALUES (
|
||||
:id, :name, :display_name, :description, :category,
|
||||
:interface_type, :requires_port, :default_port,
|
||||
:definition_type, :compose_template, :dockerfile_template, :required_variables,
|
||||
now(), now()
|
||||
)
|
||||
"""),
|
||||
{
|
||||
"id": PI_AGENT_ID,
|
||||
"name": "pi-agent",
|
||||
"display_name": "Pi Agent",
|
||||
"description": "Pi coding agent terminal environment with nvim, ranger, and tmux",
|
||||
"category": "development",
|
||||
"interface_type": "terminal",
|
||||
"requires_port": False,
|
||||
"default_port": 0,
|
||||
"definition_type": "dockerfile",
|
||||
"compose_template": """services:
|
||||
app:
|
||||
build: .
|
||||
stdin_open: true
|
||||
tty: true
|
||||
volumes:
|
||||
- ${REPO_PATH}:/workspace
|
||||
working_dir: /workspace
|
||||
command: /bin/bash""",
|
||||
"dockerfile_template": """# Pi Coding Agent - Terminal-based coding harness
|
||||
FROM ubuntu:24.04
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
# Install base dependencies
|
||||
RUN apt-get update && apt-get install -y \\
|
||||
curl \\
|
||||
wget \\
|
||||
git \\
|
||||
neovim \\
|
||||
ranger \\
|
||||
tmux \\
|
||||
htop \\
|
||||
tree \\
|
||||
jq \\
|
||||
ca-certificates \\
|
||||
python3 \\
|
||||
python3-pip \\
|
||||
build-essential \\
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Install Node.js (required for Pi)
|
||||
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \\
|
||||
&& apt-get install -y nodejs \\
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Install Pi Coding Agent globally
|
||||
RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent
|
||||
|
||||
# Create non-root user
|
||||
RUN useradd -m -s /bin/bash user
|
||||
WORKDIR /home/user
|
||||
|
||||
# Set up git
|
||||
RUN git config --global init.defaultBranch main \\
|
||||
&& git config --global user.email "dev@headquarter.local" \\
|
||||
&& git config --global user.name "Developer"
|
||||
|
||||
# Create default tmux config
|
||||
RUN echo 'set -g mouse on\\nset -g default-terminal "screen-256color"' > /home/user/.tmux.conf
|
||||
|
||||
# Create default ranger config
|
||||
RUN mkdir -p /home/user/.config/ranger \\
|
||||
&& echo 'set preview_files true\\nset use_preview_script true' > /home/user/.config/ranger/rc.conf
|
||||
|
||||
# Set up Pi config directory
|
||||
RUN mkdir -p /home/user/.pi/agent
|
||||
|
||||
USER user
|
||||
|
||||
# Default to bash (Pi is invoked manually via `pi` command)
|
||||
CMD ["/bin/bash"]""",
|
||||
"required_variables": json.dumps(["REPO_PATH"]),
|
||||
}
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
conn = op.get_bind()
|
||||
conn.execute(
|
||||
sa.text("DELETE FROM tool_types WHERE name = 'pi-agent'")
|
||||
)
|
||||
@@ -1,36 +0,0 @@
|
||||
"""add_clone_mode_and_ssh_key_id
|
||||
|
||||
Revision ID: 2026_05_22_add_clone_mode
|
||||
Revises: 0014_merge_heads
|
||||
Create Date: 2026-05-22 20:30:00.000000
|
||||
"""
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision = '2026_05_22_add_clone_mode'
|
||||
down_revision = '0015_single_interface'
|
||||
branch_labels = None
|
||||
depends_on = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
# Add ssh_key_id to git_repositories
|
||||
op.add_column('git_repositories', sa.Column('ssh_key_id', postgresql.UUID(), nullable=True))
|
||||
op.create_foreign_key('fk_git_repositories_ssh_key', 'git_repositories', 'ssh_keys', ['ssh_key_id'], ['id'])
|
||||
|
||||
# Add clone_mode and branch to tool_instances
|
||||
op.add_column('tool_instances', sa.Column('clone_mode', sa.String(20), nullable=False, server_default='mount'))
|
||||
op.add_column('tool_instances', sa.Column('branch', sa.String(255), nullable=True, server_default='main'))
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
# Drop columns from tool_instances
|
||||
op.drop_column('tool_instances', 'branch')
|
||||
op.drop_column('tool_instances', 'clone_mode')
|
||||
|
||||
# Drop ssh_key_id from git_repositories
|
||||
op.drop_constraint('fk_git_repositories_ssh_key', 'git_repositories', type_='foreignkey')
|
||||
op.drop_column('git_repositories', 'ssh_key_id')
|
||||
@@ -1,25 +0,0 @@
|
||||
"""remove_is_builtin_from_tool_types
|
||||
|
||||
Revision ID: 2026_05_23_remove_is_builtin
|
||||
Revises: 2026_05_22_add_clone_mode
|
||||
Create Date: 2026-05-23 14:30:00.000000
|
||||
"""
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision = '2026_05_23_remove_is_builtin'
|
||||
down_revision = 'f3d2dc90ba3a'
|
||||
branch_labels = None
|
||||
depends_on = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
# Drop the is_builtin column from tool_types
|
||||
op.execute("ALTER TABLE tool_types DROP COLUMN IF EXISTS is_builtin")
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
# Add the is_builtin column back to tool_types
|
||||
op.add_column('tool_types', sa.Column('is_builtin', sa.Boolean(), nullable=False, server_default='false'))
|
||||
@@ -1,30 +0,0 @@
|
||||
"""add startup_command to tool_types
|
||||
|
||||
Revision ID: 2026_05_24_220141
|
||||
Revises: 6fc7bfcf199f
|
||||
Create Date: 2026-05-24 22:01:41.000000
|
||||
|
||||
"""
|
||||
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_24_220141"
|
||||
down_revision: Union[str, Sequence[str], None] = "6fc7bfcf199f"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.add_column(
|
||||
"tool_types",
|
||||
sa.Column("startup_command", sa.Text(), nullable=True),
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_column("tool_types", "startup_command")
|
||||
@@ -1,86 +0,0 @@
|
||||
"""add_config_profiles
|
||||
|
||||
Revision ID: 2026_05_24_add_config_profiles
|
||||
Revises: f3d2dc90ba3a
|
||||
Create Date: 2026-05-24 14:00:00.000000
|
||||
"""
|
||||
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_24_add_config_profiles"
|
||||
down_revision: Union[str, Sequence[str], None] = "f3d2dc90ba3a"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
# Create config_profiles table
|
||||
op.create_table(
|
||||
"config_profiles",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), server_default=sa.text("gen_random_uuid()"), nullable=False),
|
||||
sa.Column("user_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
|
||||
sa.Column("name", sa.String(255), nullable=False),
|
||||
sa.Column("description", sa.Text(), nullable=True),
|
||||
sa.Column("project_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("projects.id", ondelete="CASCADE"), nullable=True),
|
||||
sa.Column("tool_type_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("tool_types.id", ondelete="CASCADE"), nullable=True),
|
||||
sa.Column("env_vars", postgresql.JSONB(astext_type=sa.Text()), nullable=False, server_default="{}"),
|
||||
sa.Column("runtime_hints", postgresql.JSONB(astext_type=sa.Text()), nullable=False, server_default="{}"),
|
||||
sa.Column("mounts", postgresql.JSONB(astext_type=sa.Text()), nullable=False, server_default="[]"),
|
||||
sa.Column("files", postgresql.JSONB(astext_type=sa.Text()), nullable=False, server_default="{}"),
|
||||
sa.Column("is_default", sa.Boolean(), nullable=False, server_default="false"),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
sa.UniqueConstraint("user_id", "name", name="uq_config_profiles_user_name"),
|
||||
)
|
||||
|
||||
# Create indexes for config_profiles
|
||||
op.create_index("idx_config_profiles_user", "config_profiles", ["user_id"])
|
||||
op.create_index("idx_config_profiles_project", "config_profiles", ["project_id"])
|
||||
op.create_index("idx_config_profiles_tool_type", "config_profiles", ["tool_type_id"])
|
||||
|
||||
# Create config_profile_includes table
|
||||
op.create_table(
|
||||
"config_profile_includes",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), server_default=sa.text("gen_random_uuid()"), nullable=False),
|
||||
sa.Column("profile_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False),
|
||||
sa.Column("included_profile_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False),
|
||||
sa.Column("order_index", sa.Integer(), nullable=False, server_default="0"),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
sa.UniqueConstraint("profile_id", "included_profile_id", name="uq_config_profile_includes"),
|
||||
)
|
||||
|
||||
# Create indexes for config_profile_includes
|
||||
op.create_index("idx_config_profile_includes_profile", "config_profile_includes", ["profile_id"])
|
||||
op.create_index("idx_config_profile_includes_included", "config_profile_includes", ["included_profile_id"])
|
||||
|
||||
# Add selected_config_profile_id to tool_instances
|
||||
op.add_column(
|
||||
"tool_instances",
|
||||
sa.Column("selected_config_profile_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("config_profiles.id", ondelete="SET NULL"), nullable=True),
|
||||
)
|
||||
op.create_index("idx_tool_instances_config_profile", "tool_instances", ["selected_config_profile_id"])
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
# Remove selected_config_profile_id from tool_instances
|
||||
op.drop_index("idx_tool_instances_config_profile", table_name="tool_instances")
|
||||
op.drop_column("tool_instances", "selected_config_profile_id")
|
||||
|
||||
# Drop config_profile_includes table
|
||||
op.drop_index("idx_config_profile_includes_included", table_name="config_profile_includes")
|
||||
op.drop_index("idx_config_profile_includes_profile", table_name="config_profile_includes")
|
||||
op.drop_table("config_profile_includes")
|
||||
|
||||
# Drop config_profiles table
|
||||
op.drop_index("idx_config_profiles_tool_type", table_name="config_profiles")
|
||||
op.drop_index("idx_config_profiles_project", table_name="config_profiles")
|
||||
op.drop_index("idx_config_profiles_user", table_name="config_profiles")
|
||||
op.drop_table("config_profiles")
|
||||
@@ -1,28 +0,0 @@
|
||||
"""add_git_mounts_to_config_profiles
|
||||
|
||||
Revision ID: 2026_05_26_add_git_mounts
|
||||
Revises: f3d2dc90ba3a
|
||||
Create Date: 2026-05-26 12:00:00.000000
|
||||
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_26_add_git_mounts"
|
||||
down_revision: Union[str, Sequence[str], None] = "2026_05_24_220141"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.add_column(
|
||||
"config_profiles",
|
||||
sa.Column("git_mounts", sa.JSON(), nullable=True, default=list),
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_column("config_profiles", "git_mounts")
|
||||
@@ -1,41 +0,0 @@
|
||||
"""make_project_id_nullable_in_git_repositories
|
||||
|
||||
Revision ID: 2026_05_27_external_repos
|
||||
Revises: 2026_05_26_add_git_mounts
|
||||
Create Date: 2026-05-27 08:30:00.000000
|
||||
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_27_external_repos"
|
||||
down_revision: Union[str, Sequence[str], None] = "2026_05_26_add_git_mounts"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
# Expand alembic_version version_num to avoid truncation errors
|
||||
op.execute("ALTER TABLE alembic_version ALTER COLUMN version_num TYPE VARCHAR(64)")
|
||||
|
||||
# Make project_id nullable to allow external repositories
|
||||
op.alter_column(
|
||||
"git_repositories",
|
||||
"project_id",
|
||||
existing_type=sa.UUID(),
|
||||
nullable=True,
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.alter_column(
|
||||
"git_repositories",
|
||||
"project_id",
|
||||
existing_type=sa.UUID(),
|
||||
nullable=False,
|
||||
)
|
||||
op.execute("ALTER TABLE alembic_version ALTER COLUMN version_num TYPE VARCHAR(32)")
|
||||
@@ -1,122 +0,0 @@
|
||||
"""add monitoring tables
|
||||
|
||||
Revision ID: 2026_05_28_add_monitoring_tables
|
||||
Revises: 2026_05_28_drop_tool_configs_and_config_folders
|
||||
Create Date: 2026-05-28
|
||||
|
||||
"""
|
||||
|
||||
from collections.abc import Sequence
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_28_add_monitoring_tables"
|
||||
down_revision: str | None = "2026_05_28_drop_tool_configs_and_config_folders"
|
||||
branch_labels: str | Sequence[str] | None = None
|
||||
depends_on: str | Sequence[str] | None = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.create_table(
|
||||
"instance_events",
|
||||
sa.Column("id", sa.Uuid(), nullable=False),
|
||||
sa.Column(
|
||||
"instance_id",
|
||||
sa.Uuid(),
|
||||
nullable=False,
|
||||
),
|
||||
sa.Column("event_type", sa.String(length=50), nullable=False),
|
||||
sa.Column("status", sa.String(length=50), nullable=True),
|
||||
sa.Column("message", sa.Text(), nullable=True),
|
||||
sa.Column("created_by", sa.Uuid(), nullable=True),
|
||||
sa.Column(
|
||||
"metadata",
|
||||
sa.JSON(),
|
||||
nullable=False,
|
||||
server_default="{}",
|
||||
),
|
||||
sa.Column(
|
||||
"created_at",
|
||||
sa.DateTime(timezone=True),
|
||||
server_default=sa.func.now(),
|
||||
nullable=False,
|
||||
),
|
||||
sa.ForeignKeyConstraint(
|
||||
["instance_id"],
|
||||
["tool_instances.id"],
|
||||
ondelete="CASCADE",
|
||||
),
|
||||
sa.ForeignKeyConstraint(
|
||||
["created_by"],
|
||||
["users.id"],
|
||||
ondelete="SET NULL",
|
||||
),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
)
|
||||
op.create_index(
|
||||
"idx_instance_events_instance_id",
|
||||
"instance_events",
|
||||
["instance_id"],
|
||||
)
|
||||
op.create_index(
|
||||
"idx_instance_events_created_at",
|
||||
"instance_events",
|
||||
["created_at"],
|
||||
postgresql_using="btree",
|
||||
)
|
||||
op.create_index(
|
||||
"idx_instance_events_event_type",
|
||||
"instance_events",
|
||||
["event_type"],
|
||||
)
|
||||
|
||||
op.create_table(
|
||||
"health_checks",
|
||||
sa.Column("id", sa.Uuid(), nullable=False),
|
||||
sa.Column(
|
||||
"instance_id",
|
||||
sa.Uuid(),
|
||||
nullable=False,
|
||||
),
|
||||
sa.Column("container_status", sa.String(length=50), nullable=True),
|
||||
sa.Column("container_healthy", sa.Boolean(), nullable=True),
|
||||
sa.Column("tunnel_healthy", sa.Boolean(), nullable=True),
|
||||
sa.Column("exit_code", sa.Integer(), nullable=True),
|
||||
sa.Column("probe_status", sa.String(length=50), nullable=True),
|
||||
sa.Column("probe_output", sa.Text(), nullable=True),
|
||||
sa.Column(
|
||||
"checked_at",
|
||||
sa.DateTime(timezone=True),
|
||||
server_default=sa.func.now(),
|
||||
nullable=False,
|
||||
),
|
||||
sa.ForeignKeyConstraint(
|
||||
["instance_id"],
|
||||
["tool_instances.id"],
|
||||
ondelete="CASCADE",
|
||||
),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
)
|
||||
op.create_index(
|
||||
"idx_health_checks_instance_id",
|
||||
"health_checks",
|
||||
["instance_id"],
|
||||
)
|
||||
op.create_index(
|
||||
"idx_health_checks_checked_at",
|
||||
"health_checks",
|
||||
["checked_at"],
|
||||
postgresql_using="btree",
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_index("idx_health_checks_checked_at", table_name="health_checks")
|
||||
op.drop_index("idx_health_checks_instance_id", table_name="health_checks")
|
||||
op.drop_table("health_checks")
|
||||
op.drop_index("idx_instance_events_event_type", table_name="instance_events")
|
||||
op.drop_index("idx_instance_events_created_at", table_name="instance_events")
|
||||
op.drop_index("idx_instance_events_instance_id", table_name="instance_events")
|
||||
op.drop_table("instance_events")
|
||||
@@ -1,61 +0,0 @@
|
||||
"""add terminal_sessions table
|
||||
|
||||
Revision ID: 2026_05_28_add_terminal_sessions
|
||||
Revises: 20260527_160017_add_pi_agent
|
||||
Create Date: 2026-05-28
|
||||
|
||||
"""
|
||||
|
||||
from collections.abc import Sequence
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_28_add_terminal_sessions"
|
||||
down_revision: str | None = "2026_05_28_add_tool_definition_manifests"
|
||||
branch_labels: str | Sequence[str] | None = None
|
||||
depends_on: str | Sequence[str] | None = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.create_table(
|
||||
"terminal_sessions",
|
||||
sa.Column("id", sa.UUID(), nullable=False),
|
||||
sa.Column("instance_id", sa.UUID(), nullable=False),
|
||||
sa.Column("name", sa.String(length=255), nullable=True),
|
||||
sa.Column("status", sa.String(length=50), nullable=False),
|
||||
sa.Column("last_activity_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("closed_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column(
|
||||
"created_at",
|
||||
sa.DateTime(timezone=True),
|
||||
server_default=sa.text("now()"),
|
||||
nullable=False,
|
||||
),
|
||||
sa.Column(
|
||||
"updated_at",
|
||||
sa.DateTime(timezone=True),
|
||||
server_default=sa.text("now()"),
|
||||
onupdate=sa.text("now()"),
|
||||
nullable=False,
|
||||
),
|
||||
sa.ForeignKeyConstraint(
|
||||
["instance_id"], ["tool_instances.id"], ondelete="CASCADE"
|
||||
),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
)
|
||||
op.create_index(
|
||||
op.f("ix_terminal_sessions_instance_id"),
|
||||
"terminal_sessions",
|
||||
["instance_id"],
|
||||
unique=False,
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_index(
|
||||
op.f("ix_terminal_sessions_instance_id"),
|
||||
table_name="terminal_sessions",
|
||||
)
|
||||
op.drop_table("terminal_sessions")
|
||||
@@ -1,373 +0,0 @@
|
||||
"""add tool definition manifests
|
||||
|
||||
Revision ID: 2026_05_28_add_tool_definition_manifests
|
||||
Revises: 20260527_160017_add_pi_agent
|
||||
Create Date: 2026-05-28T11:00:00
|
||||
|
||||
"""
|
||||
|
||||
import json
|
||||
import uuid
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_28_add_tool_definition_manifests"
|
||||
down_revision: Union[str, None] = "20260527_160017_add_pi_agent"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
BASE_UBUNTU_ID = uuid.UUID("a1b2c3d4-e5f6-7890-abcd-ef1234567890")
|
||||
PI_AGENT_MANIFEST_ID = uuid.UUID("d07b8376-2151-4119-8c1d-27f792aae9a3")
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
conn = op.get_bind()
|
||||
|
||||
# ── Create tool_definition_manifests table ───────────────────────
|
||||
op.create_table(
|
||||
"tool_definition_manifests",
|
||||
sa.Column("id", sa.UUID(), nullable=False),
|
||||
sa.Column("name", sa.String(64), nullable=False),
|
||||
sa.Column("display_name", sa.String(128), nullable=False),
|
||||
sa.Column("description", sa.Text(), nullable=True),
|
||||
sa.Column("category", sa.String(64), nullable=True),
|
||||
sa.Column("interface_type", sa.String(16), nullable=False),
|
||||
sa.Column("base_image", sa.String(256), nullable=True),
|
||||
sa.Column("base_definition_id", sa.UUID(), nullable=True),
|
||||
sa.Column(
|
||||
"base_version", sa.String(32), nullable=False, server_default="latest"
|
||||
),
|
||||
sa.Column("manifest", sa.JSON(), nullable=False),
|
||||
sa.Column("dockerfile_cache", sa.Text(), nullable=True),
|
||||
sa.Column("compose_cache", sa.Text(), nullable=True),
|
||||
sa.Column("version", sa.String(32), nullable=False, server_default="v1"),
|
||||
sa.Column("is_base", sa.Boolean(), nullable=False, server_default="false"),
|
||||
sa.Column("created_by_id", sa.UUID(), nullable=True),
|
||||
sa.Column(
|
||||
"created_at", sa.TIMESTAMP(timezone=True), server_default=sa.func.now()
|
||||
),
|
||||
sa.Column(
|
||||
"updated_at", sa.TIMESTAMP(timezone=True), server_default=sa.func.now()
|
||||
),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
sa.UniqueConstraint("name"),
|
||||
sa.ForeignKeyConstraint(
|
||||
["base_definition_id"], ["tool_definition_manifests.id"]
|
||||
),
|
||||
sa.ForeignKeyConstraint(["created_by_id"], ["users.id"]),
|
||||
sa.CheckConstraint(
|
||||
"(base_image IS NOT NULL) OR (base_definition_id IS NOT NULL)",
|
||||
name="ck_tool_definition_manifests_base_required",
|
||||
),
|
||||
)
|
||||
|
||||
# ── Add columns to tool_types ────────────────────────────────────
|
||||
# Check if manifest_id exists before adding
|
||||
conn = op.get_bind()
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT column_name FROM information_schema.columns
|
||||
WHERE table_name = 'tool_types' AND column_name = 'manifest_id'
|
||||
""")
|
||||
)
|
||||
if not result.fetchone():
|
||||
op.add_column("tool_types", sa.Column("manifest_id", sa.UUID(), nullable=True))
|
||||
op.create_foreign_key(
|
||||
"fk_tool_types_manifest_id",
|
||||
"tool_types",
|
||||
"tool_definition_manifests",
|
||||
["manifest_id"],
|
||||
["id"],
|
||||
)
|
||||
|
||||
# Update definition_type to allow 'legacy' and 'manifest'
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT constraint_name FROM information_schema.check_constraints
|
||||
WHERE constraint_name = 'chk_definition_type'
|
||||
""")
|
||||
)
|
||||
if result.fetchone():
|
||||
op.drop_constraint("chk_definition_type", "tool_types", type_="check")
|
||||
|
||||
op.execute("ALTER TABLE tool_types ALTER COLUMN definition_type TYPE VARCHAR(16)")
|
||||
op.execute(
|
||||
"ALTER TABLE tool_types ALTER COLUMN definition_type SET DEFAULT 'legacy'"
|
||||
)
|
||||
|
||||
# ── Add columns to tool_instances ────────────────────────────────
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT column_name FROM information_schema.columns
|
||||
WHERE table_name = 'tool_instances' AND column_name = 'manifest_compiled_at'
|
||||
""")
|
||||
)
|
||||
if not result.fetchone():
|
||||
op.add_column(
|
||||
"tool_instances",
|
||||
sa.Column(
|
||||
"manifest_compiled_at", sa.TIMESTAMP(timezone=True), nullable=True
|
||||
),
|
||||
)
|
||||
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT column_name FROM information_schema.columns
|
||||
WHERE table_name = 'tool_instances' AND column_name = 'image_tag'
|
||||
""")
|
||||
)
|
||||
if not result.fetchone():
|
||||
op.add_column(
|
||||
"tool_instances",
|
||||
sa.Column("image_tag", sa.String(256), nullable=True),
|
||||
)
|
||||
|
||||
# ── Data migration: create base definition + pi-agent manifest ───
|
||||
conn.execute(
|
||||
sa.text(
|
||||
"""
|
||||
INSERT INTO tool_definition_manifests
|
||||
(id, name, display_name, description, interface_type, base_image,
|
||||
manifest, is_base, version, created_at, updated_at)
|
||||
VALUES
|
||||
(:base_id, 'ubuntu-24.04-dev', 'Ubuntu 24.04 Dev Base',
|
||||
'Base development environment with build tools', 'terminal',
|
||||
'ubuntu:24.04', :base_manifest, true, 'v1', now(), now())
|
||||
"""
|
||||
),
|
||||
{
|
||||
"base_id": BASE_UBUNTU_ID,
|
||||
"base_manifest": json.dumps(
|
||||
{
|
||||
"name": "ubuntu-24.04-dev",
|
||||
"display_name": "Ubuntu 24.04 Dev Base",
|
||||
"interface_type": "terminal",
|
||||
"base_image": "ubuntu:24.04",
|
||||
"packages": {
|
||||
"apt": [
|
||||
"curl",
|
||||
"wget",
|
||||
"git",
|
||||
"build-essential",
|
||||
"ca-certificates",
|
||||
"python3",
|
||||
"python3-pip",
|
||||
]
|
||||
},
|
||||
"user": {
|
||||
"name": "user",
|
||||
"uid": 1000,
|
||||
"gid": 1000,
|
||||
"create_home": True,
|
||||
"shell": "/bin/bash",
|
||||
},
|
||||
"env": {"DEBIAN_FRONTEND": "noninteractive"},
|
||||
}
|
||||
),
|
||||
},
|
||||
)
|
||||
|
||||
conn.execute(
|
||||
sa.text(
|
||||
"""
|
||||
INSERT INTO tool_definition_manifests
|
||||
(id, name, display_name, description, category, interface_type,
|
||||
base_definition_id, base_version, manifest, version, created_at, updated_at)
|
||||
VALUES
|
||||
(:manifest_id, 'pi-agent', 'Pi Agent',
|
||||
'Terminal-based coding harness with nvim, ranger, tmux',
|
||||
'development', 'terminal', :base_id, 'v1', :manifest, 'v1',
|
||||
now(), now())
|
||||
"""
|
||||
),
|
||||
{
|
||||
"manifest_id": PI_AGENT_MANIFEST_ID,
|
||||
"base_id": BASE_UBUNTU_ID,
|
||||
"manifest": json.dumps(
|
||||
{
|
||||
"name": "pi-agent",
|
||||
"display_name": "Pi Agent",
|
||||
"description": "Terminal-based coding harness",
|
||||
"category": "development",
|
||||
"interface_type": "terminal",
|
||||
"base_definition_id": str(BASE_UBUNTU_ID),
|
||||
"base_version": "v1",
|
||||
"packages": {
|
||||
"apt": [
|
||||
"neovim",
|
||||
"ranger",
|
||||
"tmux",
|
||||
"htop",
|
||||
"tree",
|
||||
"jq",
|
||||
],
|
||||
"node": {"version": "20"},
|
||||
"npm_global": ["@earendil-works/pi-coding-agent"],
|
||||
},
|
||||
"user": {
|
||||
"name": "user",
|
||||
"uid": 1001,
|
||||
"gid": 1001,
|
||||
"create_home": True,
|
||||
"shell": "/bin/bash",
|
||||
},
|
||||
"env": {"DEBIAN_FRONTEND": "noninteractive"},
|
||||
"scripts": {
|
||||
"build": [
|
||||
"git config --global init.defaultBranch main && git config --global user.email 'dev@headquarter.local' && git config --global user.name 'Developer'",
|
||||
"mkdir -p /home/user/.config/ranger && echo 'set preview_files true' > /home/user/.config/ranger/rc.conf",
|
||||
],
|
||||
"startup": [
|
||||
"if [ -d /workspace ]; then sudo chown -R user:user /workspace 2>/dev/null || true; fi",
|
||||
],
|
||||
},
|
||||
"mounts": [
|
||||
{
|
||||
"name": "workspace",
|
||||
"target": "/workspace",
|
||||
"source_type": "repo",
|
||||
"writable": True,
|
||||
"owner": "user",
|
||||
},
|
||||
{
|
||||
"name": "pi_state",
|
||||
"target": "/tmp/.pi/agents",
|
||||
"source_type": "instance",
|
||||
"writable": True,
|
||||
},
|
||||
{
|
||||
"name": "pi_config",
|
||||
"target": "/home/user/.pi",
|
||||
"source_type": "git_mount",
|
||||
"git_mount_ref": "dotfiles",
|
||||
"writable": True,
|
||||
"owner": "user",
|
||||
},
|
||||
],
|
||||
"runtime": {
|
||||
"command": ["/bin/bash"],
|
||||
"stdin_open": True,
|
||||
"tty": True,
|
||||
"working_dir": "/workspace",
|
||||
},
|
||||
}
|
||||
),
|
||||
},
|
||||
)
|
||||
|
||||
# ── Update existing pi-agent tool_type ───────────────────────────
|
||||
conn.execute(
|
||||
sa.text(
|
||||
"""
|
||||
UPDATE tool_types
|
||||
SET manifest_id = :manifest_id,
|
||||
definition_type = 'manifest',
|
||||
dockerfile_template = NULL,
|
||||
compose_template = NULL
|
||||
WHERE name = 'pi-agent'
|
||||
"""
|
||||
),
|
||||
{"manifest_id": PI_AGENT_MANIFEST_ID},
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
conn = op.get_bind()
|
||||
|
||||
# Restore pi-agent templates if manifest_id column exists
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT column_name FROM information_schema.columns
|
||||
WHERE table_name = 'tool_types' AND column_name = 'manifest_id'
|
||||
""")
|
||||
)
|
||||
has_manifest_id = result.fetchone() is not None
|
||||
|
||||
if has_manifest_id:
|
||||
conn.execute(
|
||||
sa.text(
|
||||
"""
|
||||
UPDATE tool_types
|
||||
SET manifest_id = NULL,
|
||||
definition_type = 'dockerfile',
|
||||
dockerfile_template = :dockerfile,
|
||||
compose_template = :compose
|
||||
WHERE name = 'pi-agent'
|
||||
"""
|
||||
),
|
||||
{
|
||||
"dockerfile": """# Pi Coding Agent - Terminal-based coding harness
|
||||
FROM ubuntu:24.04
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
RUN apt-get update && apt-get install -y \\
|
||||
curl wget git neovim ranger tmux htop tree jq \\
|
||||
ca-certificates python3 python3-pip build-essential \\
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \\
|
||||
&& apt-get install -y nodejs \\
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent
|
||||
|
||||
RUN useradd -m -s /bin/bash user
|
||||
WORKDIR /home/user
|
||||
|
||||
RUN git config --global init.defaultBranch main \\
|
||||
&& git config --global user.email "dev@headquarter.local" \\
|
||||
&& git config --global user.name "Developer"
|
||||
|
||||
RUN echo 'set -g mouse on\\nset -g default-terminal "screen-256color"' > /home/user/.tmux.conf
|
||||
|
||||
RUN mkdir -p /home/user/.config/ranger \\
|
||||
&& echo 'set preview_files true\\nset use_preview_script true' > /home/user/.config/ranger/rc.conf
|
||||
|
||||
RUN mkdir -p /home/user/.pi/agent
|
||||
|
||||
USER user
|
||||
|
||||
CMD ["/bin/bash"]
|
||||
""",
|
||||
"compose": """services:
|
||||
app:
|
||||
build: .
|
||||
stdin_open: true
|
||||
tty: true
|
||||
volumes:
|
||||
- ${REPO_PATH}:/workspace
|
||||
working_dir: /workspace
|
||||
command: /bin/bash""",
|
||||
},
|
||||
)
|
||||
|
||||
# Drop columns conditionally
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT column_name FROM information_schema.columns
|
||||
WHERE table_name = 'tool_instances' AND column_name = 'image_tag'
|
||||
""")
|
||||
)
|
||||
if result.fetchone():
|
||||
op.drop_column("tool_instances", "image_tag")
|
||||
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT column_name FROM information_schema.columns
|
||||
WHERE table_name = 'tool_instances' AND column_name = 'manifest_compiled_at'
|
||||
""")
|
||||
)
|
||||
if result.fetchone():
|
||||
op.drop_column("tool_instances", "manifest_compiled_at")
|
||||
|
||||
if has_manifest_id:
|
||||
op.drop_constraint(
|
||||
"fk_tool_types_manifest_id", "tool_types", type_="foreignkey"
|
||||
)
|
||||
op.drop_column("tool_types", "manifest_id")
|
||||
|
||||
op.drop_table("tool_definition_manifests")
|
||||
@@ -1,89 +0,0 @@
|
||||
"""drop tool_configs and config_folders tables
|
||||
|
||||
Revision ID: 2026_05_28_drop_tool_configs_and_config_folders
|
||||
Revises: 2026_05_28_add_tool_definition_manifests
|
||||
Create Date: 2026-05-28
|
||||
|
||||
"""
|
||||
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_28_drop_tool_configs_and_config_folders"
|
||||
down_revision: Union[str, None] = "2026_05_28_add_terminal_sessions"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
conn = op.get_bind()
|
||||
|
||||
# Drop tool_configs table if it exists
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT table_name FROM information_schema.tables
|
||||
WHERE table_name = 'tool_configs'
|
||||
""")
|
||||
)
|
||||
if result.fetchone():
|
||||
op.drop_table("tool_configs")
|
||||
|
||||
# Drop config_folders table if it exists
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT table_name FROM information_schema.tables
|
||||
WHERE table_name = 'config_folders'
|
||||
""")
|
||||
)
|
||||
if result.fetchone():
|
||||
op.drop_table("config_folders")
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
# Recreate config_folders table
|
||||
op.create_table(
|
||||
"config_folders",
|
||||
sa.Column("id", sa.UUID(), nullable=False),
|
||||
sa.Column("user_id", sa.UUID(), nullable=False),
|
||||
sa.Column("name", sa.String(255), nullable=False),
|
||||
sa.Column("description", sa.Text(), nullable=True),
|
||||
sa.Column("mount_path", sa.String(1024), nullable=False),
|
||||
sa.Column("files", sa.JSON(), default=dict, nullable=False),
|
||||
sa.Column("project_overrides", sa.JSON(), default=dict, nullable=True),
|
||||
sa.Column("is_active", sa.Boolean(), default=True, nullable=False),
|
||||
sa.Column(
|
||||
"created_at", sa.TIMESTAMP(timezone=True), server_default=sa.func.now()
|
||||
),
|
||||
sa.Column(
|
||||
"updated_at", sa.TIMESTAMP(timezone=True), server_default=sa.func.now()
|
||||
),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
)
|
||||
|
||||
# Recreate tool_configs table
|
||||
op.create_table(
|
||||
"tool_configs",
|
||||
sa.Column("id", sa.UUID(), nullable=False),
|
||||
sa.Column("user_id", sa.UUID(), nullable=False),
|
||||
sa.Column("tool_type_id", sa.UUID(), nullable=False),
|
||||
sa.Column("project_id", sa.UUID(), nullable=True),
|
||||
sa.Column("key", sa.String(255), nullable=False),
|
||||
sa.Column("value", sa.Text(), nullable=False),
|
||||
sa.Column("config_type", sa.String(20), default="env", nullable=False),
|
||||
sa.Column("file_path", sa.String(1024), nullable=True),
|
||||
sa.Column("port_override", sa.Integer(), nullable=True),
|
||||
sa.Column("start_command", sa.Text(), nullable=True),
|
||||
sa.Column("working_directory", sa.Text(), nullable=True),
|
||||
sa.Column("environment_variables", sa.JSON(), default=dict, nullable=True),
|
||||
sa.Column("volumes", sa.JSON(), default=list, nullable=True),
|
||||
sa.Column(
|
||||
"created_at", sa.TIMESTAMP(timezone=True), server_default=sa.func.now()
|
||||
),
|
||||
sa.Column(
|
||||
"updated_at", sa.TIMESTAMP(timezone=True), server_default=sa.func.now()
|
||||
),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
)
|
||||
@@ -1,69 +0,0 @@
|
||||
"""add notifications table
|
||||
|
||||
Revision ID: 2026_05_29_add_notifications_table
|
||||
Revises: 2026_05_28_add_monitoring_tables
|
||||
Create Date: 2026-05-29
|
||||
|
||||
"""
|
||||
|
||||
from collections.abc import Sequence
|
||||
|
||||
import sqlalchemy as sa
|
||||
from alembic import op
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_29_add_notifications_table"
|
||||
down_revision: str | None = "2026_05_28_add_monitoring_tables"
|
||||
branch_labels: str | Sequence[str] | None = None
|
||||
depends_on: str | Sequence[str] | None = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.create_table(
|
||||
"notifications",
|
||||
sa.Column("id", sa.Uuid(), nullable=False),
|
||||
sa.Column("user_id", sa.Uuid(), nullable=False),
|
||||
sa.Column("category", sa.String(length=32), nullable=False),
|
||||
sa.Column("severity", sa.String(length=16), nullable=False),
|
||||
sa.Column("title", sa.String(length=255), nullable=False),
|
||||
sa.Column("message", sa.Text(), nullable=True),
|
||||
sa.Column("source_type", sa.String(length=64), nullable=True),
|
||||
sa.Column("source_id", sa.Uuid(), nullable=True),
|
||||
sa.Column(
|
||||
"metadata",
|
||||
sa.JSON(),
|
||||
nullable=False,
|
||||
server_default="{}",
|
||||
),
|
||||
sa.Column("read_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("dismissed_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column(
|
||||
"created_at",
|
||||
sa.DateTime(timezone=True),
|
||||
server_default=sa.func.now(),
|
||||
nullable=False,
|
||||
),
|
||||
sa.ForeignKeyConstraint(
|
||||
["user_id"],
|
||||
["users.id"],
|
||||
ondelete="CASCADE",
|
||||
),
|
||||
sa.PrimaryKeyConstraint("id"),
|
||||
)
|
||||
op.create_index(
|
||||
"idx_notifications_user_created_at",
|
||||
"notifications",
|
||||
["user_id", sa.text("created_at DESC")],
|
||||
)
|
||||
op.create_index(
|
||||
"idx_notifications_user_unread",
|
||||
"notifications",
|
||||
["user_id", "read_at"],
|
||||
postgresql_where=sa.text("read_at IS NULL"),
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_index("idx_notifications_user_unread", table_name="notifications")
|
||||
op.drop_index("idx_notifications_user_created_at", table_name="notifications")
|
||||
op.drop_table("notifications")
|
||||
@@ -1,27 +0,0 @@
|
||||
"""add_ssh_key_ids_to_tool_instances
|
||||
|
||||
Revision ID: 2026_05_29_add_ssh_key_ids_to_tool_instances
|
||||
Revises: 2026_05_29_drop_ssh_key_id_from_config_profiles
|
||||
Create Date: 2026-05-29 12:46:00.000000
|
||||
"""
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision = "2026_05_29_add_ssh_key_ids_to_tool_instances"
|
||||
down_revision = "2026_05_29_drop_ssh_key_id_from_config_profiles"
|
||||
branch_labels = None
|
||||
depends_on = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.add_column(
|
||||
"tool_instances",
|
||||
sa.Column("ssh_key_ids", sa.JSON(), nullable=True),
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_column("tool_instances", "ssh_key_ids")
|
||||
@@ -1,32 +0,0 @@
|
||||
"""drop_ssh_key_id_from_config_profiles
|
||||
|
||||
Revision ID: 2026_05_29_drop_ssh_key_id_from_config_profiles
|
||||
Revises: 069d3da4dc9b
|
||||
Create Date: 2026-05-29 12:45:00.000000
|
||||
"""
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision = "2026_05_29_drop_ssh_key_id_from_config_profiles"
|
||||
down_revision = "069d3da4dc9b"
|
||||
branch_labels = None
|
||||
depends_on = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.drop_column("config_profiles", "ssh_key_id")
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.add_column(
|
||||
"config_profiles",
|
||||
sa.Column(
|
||||
"ssh_key_id",
|
||||
sa.Uuid(),
|
||||
sa.ForeignKey("ssh_keys.id", ondelete="SET NULL"),
|
||||
nullable=True,
|
||||
),
|
||||
)
|
||||
@@ -1,54 +0,0 @@
|
||||
"""fix code-server bind-addr to host in DB template
|
||||
|
||||
Revision ID: 2026_05_29_fix_code_server_bind_addr
|
||||
Revises: 2026_05_29_fix_web_tool_bind_address
|
||||
Create Date: 2026-05-29 15:00:00.000000
|
||||
|
||||
"""
|
||||
|
||||
from typing import Sequence
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_29_fix_code_server_bind_addr"
|
||||
down_revision: str | None = "2026_05_29_fix_web_tool_bind_address"
|
||||
branch_labels: Sequence[str] | None = None
|
||||
depends_on: Sequence[str] | None = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
conn = op.get_bind()
|
||||
|
||||
# Find code-server tool types with broken --bind-addr in compose template
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT id, compose_template
|
||||
FROM tool_types
|
||||
WHERE name = 'code-server'
|
||||
AND compose_template LIKE '%--bind-addr%'
|
||||
""")
|
||||
).fetchall()
|
||||
|
||||
for tool_id, compose_template in result:
|
||||
updated = compose_template.replace(
|
||||
"--bind-addr 0.0.0.0:8443", "--host 0.0.0.0"
|
||||
).replace("--bind-addr", "--host 0.0.0.0")
|
||||
|
||||
conn.execute(
|
||||
sa.text("""
|
||||
UPDATE tool_types
|
||||
SET compose_template = :compose_template
|
||||
WHERE id = :id
|
||||
"""),
|
||||
{"compose_template": updated, "id": tool_id},
|
||||
)
|
||||
|
||||
print(
|
||||
f"Fixed code-server template ({tool_id}): replaced --bind-addr with --host"
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
pass
|
||||
@@ -1,148 +0,0 @@
|
||||
"""Fix code-server bind address to include port
|
||||
|
||||
Revision ID: 2026_05_29_fix_code_server_bind_addr_port
|
||||
Revises: 2026_05_29_remove_lsio_command_override
|
||||
Create Date: 2026-05-29 18:00:00.000000
|
||||
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
import yaml
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_29_fix_code_server_bind_addr_port"
|
||||
down_revision: Union[str, None] = "2026_05_29_remove_lsio_command_override"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def _fix_tool_type_templates(conn) -> None:
|
||||
"""Fix code-server tool type templates with broken --host override."""
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT id, compose_template, default_port
|
||||
FROM tool_types
|
||||
WHERE name = 'code-server'
|
||||
AND compose_template LIKE '%--host%'
|
||||
""")
|
||||
).fetchall()
|
||||
|
||||
for tool_id, compose_template, default_port in result:
|
||||
port = default_port or 8443
|
||||
expected = f"--bind-addr 0.0.0.0:{port}"
|
||||
|
||||
# Replace any line containing --host with the correct bind-addr
|
||||
lines = compose_template.split("\n")
|
||||
new_lines = []
|
||||
modified = False
|
||||
for line in lines:
|
||||
if "command:" in line and "--host" in line:
|
||||
indent = line[: len(line) - len(line.lstrip())]
|
||||
new_lines.append(f"{indent}command: {expected}")
|
||||
modified = True
|
||||
else:
|
||||
new_lines.append(line)
|
||||
|
||||
if not modified:
|
||||
continue
|
||||
|
||||
updated = "\n".join(new_lines)
|
||||
conn.execute(
|
||||
sa.text("""
|
||||
UPDATE tool_types
|
||||
SET compose_template = :compose_template
|
||||
WHERE id = :id
|
||||
"""),
|
||||
{"compose_template": updated, "id": tool_id},
|
||||
)
|
||||
print(f"Fixed code-server template ({tool_id}): replaced --host with {expected}")
|
||||
|
||||
|
||||
def _fix_instance_compose_files(conn) -> None:
|
||||
"""Fix existing instance compose files on disk with broken --host override."""
|
||||
from pathlib import Path
|
||||
|
||||
# Use information_schema to check if compose_path column exists
|
||||
col_result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT column_name
|
||||
FROM information_schema.columns
|
||||
WHERE table_name = 'tool_instances'
|
||||
AND column_name = 'compose_path'
|
||||
""")
|
||||
).fetchone()
|
||||
|
||||
if not col_result:
|
||||
print("compose_path column not found, skipping instance file fixes")
|
||||
return
|
||||
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT id, compose_path, tool_type_id
|
||||
FROM tool_instances
|
||||
WHERE compose_path IS NOT NULL
|
||||
""")
|
||||
).fetchall()
|
||||
|
||||
for instance_id, compose_path, tool_type_id in result:
|
||||
path = Path(compose_path)
|
||||
if not path.exists():
|
||||
continue
|
||||
|
||||
try:
|
||||
content = path.read_text()
|
||||
except Exception:
|
||||
continue
|
||||
|
||||
if "--host" not in content:
|
||||
continue
|
||||
|
||||
# Get default_port from tool_type
|
||||
port_result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT default_port FROM tool_types WHERE id = :id
|
||||
"""),
|
||||
{"id": tool_type_id},
|
||||
).fetchone()
|
||||
port = port_result[0] if port_result and port_result[0] else 8443
|
||||
expected = f"--bind-addr 0.0.0.0:{port}"
|
||||
|
||||
try:
|
||||
data = yaml.safe_load(content)
|
||||
except Exception:
|
||||
continue
|
||||
|
||||
if not data or "services" not in data:
|
||||
continue
|
||||
|
||||
modified = False
|
||||
for svc in data["services"].values():
|
||||
if "command" in svc:
|
||||
cmd = svc["command"]
|
||||
if "--host" in cmd:
|
||||
svc["command"] = expected
|
||||
modified = True
|
||||
|
||||
if not modified:
|
||||
continue
|
||||
|
||||
try:
|
||||
path.write_text(yaml.dump(data, default_flow_style=False))
|
||||
print(
|
||||
f"Fixed code-server instance compose ({instance_id}): "
|
||||
f"replaced --host with {expected}"
|
||||
)
|
||||
except Exception as exc:
|
||||
print(f"Failed to fix instance {instance_id}: {exc}")
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
conn = op.get_bind()
|
||||
_fix_tool_type_templates(conn)
|
||||
_fix_instance_compose_files(conn)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
pass
|
||||
@@ -1,140 +0,0 @@
|
||||
"""fix web tool bind address to 0.0.0.0
|
||||
|
||||
Revision ID: 2026_05_29_fix_web_tool_bind_address
|
||||
Revises: 2026_05_29_remove_ssh_keys_mount_from_manifest
|
||||
Create Date: 2026-05-29 14:00:00.000000
|
||||
|
||||
"""
|
||||
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_29_fix_web_tool_bind_address"
|
||||
down_revision: Union[str, None] = "2026_05_29_remove_ssh_keys_mount_from_manifest"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def _fix_code_server_compose(conn) -> None:
|
||||
"""Update code-server compose template to bind to 0.0.0.0."""
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT id, compose_template, definition_type
|
||||
FROM tool_types
|
||||
WHERE name = 'code-server'
|
||||
""")
|
||||
).fetchone()
|
||||
|
||||
if result is None:
|
||||
return
|
||||
|
||||
tool_id, compose_template, definition_type = result
|
||||
|
||||
if definition_type != "compose" or not compose_template:
|
||||
return
|
||||
|
||||
# Fix or add command to bind to 0.0.0.0
|
||||
lines = compose_template.split("\n")
|
||||
new_lines = []
|
||||
image_line_idx = -1
|
||||
command_fixed = False
|
||||
for i, line in enumerate(lines):
|
||||
# Replace broken --bind-addr with correct --host
|
||||
if "command:" in line and "--bind-addr" in line:
|
||||
indent = line[: len(line) - len(line.lstrip())]
|
||||
new_lines.append(f"{indent}command: --host 0.0.0.0")
|
||||
command_fixed = True
|
||||
continue
|
||||
new_lines.append(line)
|
||||
if "image:" in line and image_line_idx == -1:
|
||||
image_line_idx = i
|
||||
|
||||
# If no command line exists, insert one after image
|
||||
if not command_fixed and image_line_idx != -1:
|
||||
image_line = lines[image_line_idx]
|
||||
indent = image_line[: len(image_line) - len(image_line.lstrip())]
|
||||
# Insert after the image line in new_lines
|
||||
insert_idx = new_lines.index(image_line) + 1
|
||||
new_lines.insert(insert_idx, f"{indent}command: --host 0.0.0.0")
|
||||
command_fixed = True
|
||||
|
||||
if not command_fixed:
|
||||
return
|
||||
|
||||
updated_compose = "\n".join(new_lines)
|
||||
|
||||
conn.execute(
|
||||
sa.text("""
|
||||
UPDATE tool_types
|
||||
SET compose_template = :compose_template
|
||||
WHERE id = :id
|
||||
"""),
|
||||
{"compose_template": updated_compose, "id": tool_id},
|
||||
)
|
||||
|
||||
print(f"Updated code-server tool type ({tool_id}) to bind to 0.0.0.0")
|
||||
|
||||
|
||||
def _fix_jupyter_compose(conn) -> None:
|
||||
"""Update jupyter-notebook compose template to bind to 0.0.0.0."""
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT id, compose_template, definition_type
|
||||
FROM tool_types
|
||||
WHERE name = 'jupyter-notebook'
|
||||
""")
|
||||
).fetchone()
|
||||
|
||||
if result is None:
|
||||
return
|
||||
|
||||
tool_id, compose_template, definition_type = result
|
||||
|
||||
if definition_type != "compose" or not compose_template:
|
||||
return
|
||||
|
||||
if "command:" in compose_template:
|
||||
return
|
||||
|
||||
lines = compose_template.split("\n")
|
||||
new_lines = []
|
||||
image_line_idx = -1
|
||||
for i, line in enumerate(lines):
|
||||
new_lines.append(line)
|
||||
if "image:" in line and image_line_idx == -1:
|
||||
image_line_idx = i
|
||||
indent = line[: len(line) - len(line.lstrip())]
|
||||
# Jupyter needs --ip=0.0.0.0 to bind to all interfaces
|
||||
new_lines.append(
|
||||
f"{indent}command: start-notebook.sh --ip=0.0.0.0 --port=8888 --no-browser"
|
||||
)
|
||||
|
||||
if image_line_idx == -1:
|
||||
return
|
||||
|
||||
updated_compose = "\n".join(new_lines)
|
||||
|
||||
conn.execute(
|
||||
sa.text("""
|
||||
UPDATE tool_types
|
||||
SET compose_template = :compose_template
|
||||
WHERE id = :id
|
||||
"""),
|
||||
{"compose_template": updated_compose, "id": tool_id},
|
||||
)
|
||||
|
||||
print(f"Updated jupyter-notebook tool type ({tool_id}) to bind to 0.0.0.0:8888")
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
conn = op.get_bind()
|
||||
_fix_code_server_compose(conn)
|
||||
_fix_jupyter_compose(conn)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
# Cannot safely downgrade without knowing the original compose_template
|
||||
pass
|
||||
@@ -1,121 +0,0 @@
|
||||
"""Remove broken command override from LSIO code-server templates
|
||||
|
||||
Revision ID: 2026_05_29_remove_lsio_command_override
|
||||
Revises: 2026_05_29_fix_code_server_bind_addr
|
||||
Create Date: 2026-05-29 15:05:00.000000
|
||||
|
||||
"""
|
||||
|
||||
from collections.abc import Sequence
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_29_remove_lsio_command_override"
|
||||
down_revision: str | None = "2026_05_29_fix_code_server_bind_addr"
|
||||
branch_labels: Sequence[str] | None = None
|
||||
depends_on: Sequence[str] | None = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
conn = op.get_bind()
|
||||
|
||||
# Fix tool_types templates in DB
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT id, compose_template
|
||||
FROM tool_types
|
||||
WHERE name = 'code-server'
|
||||
""")
|
||||
).fetchall()
|
||||
|
||||
import yaml
|
||||
from pathlib import Path
|
||||
|
||||
for tool_id, compose_template in result:
|
||||
try:
|
||||
data = yaml.safe_load(compose_template)
|
||||
except Exception:
|
||||
continue
|
||||
|
||||
if not data or "services" not in data:
|
||||
continue
|
||||
|
||||
modified = False
|
||||
for svc in data["services"].values():
|
||||
image = svc.get("image", "")
|
||||
if not image or "linuxserver" not in image:
|
||||
continue
|
||||
if "command" in svc:
|
||||
cmd = svc["command"]
|
||||
if "--bind-addr" in cmd or "--host" in cmd:
|
||||
del svc["command"]
|
||||
modified = True
|
||||
|
||||
if modified:
|
||||
updated = yaml.dump(data, default_flow_style=False)
|
||||
conn.execute(
|
||||
sa.text("""
|
||||
UPDATE tool_types
|
||||
SET compose_template = :compose_template
|
||||
WHERE id = :id
|
||||
"""),
|
||||
{"compose_template": updated, "id": tool_id},
|
||||
)
|
||||
print(f"Removed broken command override from LSIO template ({tool_id})")
|
||||
|
||||
# Fix existing instance compose files on disk
|
||||
# Use information_schema to check if compose_path column exists
|
||||
col_result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT column_name
|
||||
FROM information_schema.columns
|
||||
WHERE table_name = 'tool_instances'
|
||||
AND column_name = 'compose_path'
|
||||
""")
|
||||
).fetchone()
|
||||
|
||||
if col_result:
|
||||
result = conn.execute(
|
||||
sa.text("""
|
||||
SELECT id, compose_path
|
||||
FROM tool_instances
|
||||
WHERE compose_path IS NOT NULL
|
||||
""")
|
||||
).fetchall()
|
||||
|
||||
for instance_id, compose_path in result:
|
||||
path = Path(compose_path)
|
||||
if not path.exists():
|
||||
continue
|
||||
try:
|
||||
content = path.read_text()
|
||||
data = yaml.safe_load(content)
|
||||
except Exception:
|
||||
continue
|
||||
|
||||
if not data or "services" not in data:
|
||||
continue
|
||||
|
||||
modified = False
|
||||
for svc in data["services"].values():
|
||||
image = svc.get("image", "")
|
||||
if not image or "linuxserver" not in image:
|
||||
continue
|
||||
if "command" in svc:
|
||||
cmd = svc["command"]
|
||||
if "--bind-addr" in cmd or "--host" in cmd:
|
||||
del svc["command"]
|
||||
modified = True
|
||||
|
||||
if modified:
|
||||
path.write_text(yaml.dump(data, default_flow_style=False))
|
||||
print(
|
||||
f"Removed broken command override from instance compose "
|
||||
f"({instance_id})"
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
pass
|
||||
@@ -1,105 +0,0 @@
|
||||
"""remove ssh_keys mount from pi-agent manifest
|
||||
|
||||
Revision ID: 2026_05_29_remove_ssh_keys_mount_from_manifest
|
||||
Revises: 2026_05_29_add_ssh_key_ids_to_tool_instances
|
||||
Create Date: 2026-05-29 14:00:00.000000
|
||||
|
||||
"""
|
||||
|
||||
import json
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "2026_05_29_remove_ssh_keys_mount_from_manifest"
|
||||
down_revision: Union[str, None] = "2026_05_29_add_ssh_key_ids_to_tool_instances"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
"""Remove the ssh_keys mount from the pi-agent manifest."""
|
||||
conn = op.get_bind()
|
||||
|
||||
# Get the pi-agent manifest
|
||||
result = conn.execute(
|
||||
sa.text(
|
||||
"SELECT id, manifest FROM tool_definition_manifests WHERE name = 'pi-agent'"
|
||||
)
|
||||
)
|
||||
row = result.fetchone()
|
||||
if not row:
|
||||
return
|
||||
|
||||
manifest_id, manifest_json = row
|
||||
manifest = (
|
||||
manifest_json if isinstance(manifest_json, dict) else json.loads(manifest_json)
|
||||
)
|
||||
|
||||
mounts = manifest.get("mounts", [])
|
||||
original_count = len(mounts)
|
||||
|
||||
# Remove any mount named "ssh_keys"
|
||||
filtered_mounts = [m for m in mounts if m.get("name") != "ssh_keys"]
|
||||
|
||||
if len(filtered_mounts) < original_count:
|
||||
manifest["mounts"] = filtered_mounts
|
||||
conn.execute(
|
||||
sa.text(
|
||||
"UPDATE tool_definition_manifests SET manifest = :manifest WHERE id = :id"
|
||||
),
|
||||
{
|
||||
"manifest": json.dumps(manifest),
|
||||
"id": manifest_id,
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
"""Restore the ssh_keys mount to the pi-agent manifest."""
|
||||
conn = op.get_bind()
|
||||
|
||||
result = conn.execute(
|
||||
sa.text(
|
||||
"SELECT id, manifest FROM tool_definition_manifests WHERE name = 'pi-agent'"
|
||||
)
|
||||
)
|
||||
row = result.fetchone()
|
||||
if not row:
|
||||
return
|
||||
|
||||
manifest_id, manifest_json = row
|
||||
manifest = (
|
||||
manifest_json if isinstance(manifest_json, dict) else json.loads(manifest_json)
|
||||
)
|
||||
|
||||
mounts = manifest.get("mounts", [])
|
||||
|
||||
# Check if ssh_keys mount already exists
|
||||
if any(m.get("name") == "ssh_keys" for m in mounts):
|
||||
return
|
||||
|
||||
# Add the ssh_keys mount back
|
||||
mounts.append(
|
||||
{
|
||||
"name": "ssh_keys",
|
||||
"target": "/home/user/.ssh",
|
||||
"source_type": "ssh_key",
|
||||
"mode": "0700",
|
||||
"file_mode": "0600",
|
||||
"readonly": True,
|
||||
}
|
||||
)
|
||||
manifest["mounts"] = mounts
|
||||
|
||||
conn.execute(
|
||||
sa.text(
|
||||
"UPDATE tool_definition_manifests SET manifest = :manifest WHERE id = :id"
|
||||
),
|
||||
{
|
||||
"manifest": json.dumps(manifest),
|
||||
"id": manifest_id,
|
||||
},
|
||||
)
|
||||
@@ -1,23 +0,0 @@
|
||||
"""merge_remove_is_builtin_and_add_config_profiles
|
||||
|
||||
Revision ID: 6fc7bfcf199f
|
||||
Revises: 2026_05_23_remove_is_builtin, 2026_05_24_add_config_profiles
|
||||
Create Date: 2026-05-24 18:00:43.990361
|
||||
"""
|
||||
|
||||
|
||||
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision = '6fc7bfcf199f'
|
||||
down_revision = ('2026_05_23_remove_is_builtin', '2026_05_24_add_config_profiles')
|
||||
branch_labels = None
|
||||
depends_on = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
pass
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
pass
|
||||
@@ -1,23 +0,0 @@
|
||||
"""merge_single_interface_and_clone_mode
|
||||
|
||||
Revision ID: f3d2dc90ba3a
|
||||
Revises: 0015_single_interface, 2026_05_22_add_clone_mode
|
||||
Create Date: 2026-05-24 10:43:14.000000
|
||||
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "f3d2dc90ba3a"
|
||||
down_revision: Union[str, Sequence[str], None] = ("0015_single_interface", "2026_05_22_add_clone_mode")
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
pass
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
pass
|
||||
@@ -1,6 +1,4 @@
|
||||
from src.api.auth import router as auth_router
|
||||
from src.api.events import router as events_router
|
||||
from src.api.notifications import router as notifications_router
|
||||
from src.api.users import router as users_router
|
||||
|
||||
__all__ = ["auth_router", "events_router", "notifications_router", "users_router"]
|
||||
__all__ = ["auth_router", "users_router"]
|
||||
|
||||
+10
-10
@@ -48,7 +48,7 @@ async def login(next: str = "/") -> RedirectResponse:
|
||||
redirect_uri=redirect_uri,
|
||||
state=state,
|
||||
)
|
||||
logger.debug("Auth login initiated: redirect_uri=%s, next=%s", redirect_uri, next)
|
||||
logger.info("Auth login initiated: redirect_uri=%s, next=%s", redirect_uri, next)
|
||||
response = RedirectResponse(location)
|
||||
response.set_cookie("auth_state", state, httponly=True, samesite="lax")
|
||||
response.set_cookie("auth_next", next, httponly=True, samesite="lax")
|
||||
@@ -63,7 +63,7 @@ async def callback(
|
||||
auth_next: str | None = Cookie(default="/"),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> RedirectResponse:
|
||||
logger.debug("Auth callback received: code=%s... state=%s", code[:10] if code else "None", state[:10] if state else "None")
|
||||
logger.info("Auth callback received: code=%s... state=%s", code[:10] if code else "None", state[:10] if state else "None")
|
||||
|
||||
if auth_state is None or auth_state != state:
|
||||
logger.warning("State mismatch: cookie=%s, param=%s", auth_state, state)
|
||||
@@ -71,7 +71,7 @@ async def callback(
|
||||
|
||||
settings = Settings()
|
||||
redirect_uri = f"{settings.api_base_url}/auth/callback"
|
||||
logger.debug("Exchanging code for tokens (redirect_uri=%s)", redirect_uri)
|
||||
logger.info("Exchanging code for tokens (redirect_uri=%s)", redirect_uri)
|
||||
|
||||
async with httpx.AsyncClient() as client:
|
||||
try:
|
||||
@@ -92,7 +92,7 @@ async def callback(
|
||||
access_token=token_payload["access_token"],
|
||||
client=client,
|
||||
)
|
||||
logger.debug("User info fetched successfully")
|
||||
logger.info("User info fetched successfully")
|
||||
except Exception as exc:
|
||||
logger.error("User info fetch failed: %s", exc)
|
||||
raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="failed to fetch user info")
|
||||
@@ -100,19 +100,19 @@ async def callback(
|
||||
authentik_id = str(user_info.get("sub", ""))
|
||||
email = str(user_info.get("email", f"{authentik_id}@authentik.local"))
|
||||
name = str(user_info.get("name", email))
|
||||
logger.debug("User info: authentik_id=%s, email=%s, name=%s", authentik_id, email, name)
|
||||
logger.info("User info: authentik_id=%s, email=%s, name=%s", authentik_id, email, name)
|
||||
|
||||
try:
|
||||
user = await session.scalar(select(User).where(User.authentik_id == authentik_id))
|
||||
if user is None:
|
||||
logger.debug("Creating new user: authentik_id=%s", authentik_id)
|
||||
logger.info("Creating new user: authentik_id=%s", authentik_id)
|
||||
user = User(email=email, name=name, authentik_id=authentik_id, avatar_url=None)
|
||||
session.add(user)
|
||||
await session.commit()
|
||||
await session.refresh(user)
|
||||
logger.info("New user created: id=%s", user.id)
|
||||
else:
|
||||
logger.debug("Existing user found: id=%s, updating info", user.id)
|
||||
logger.info("Existing user found: id=%s, updating info", user.id)
|
||||
user.email = email
|
||||
user.name = name
|
||||
await session.commit()
|
||||
@@ -165,20 +165,20 @@ async def me(
|
||||
session_cookie: str | None = Cookie(default=None, alias="session"),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict[str, Any]:
|
||||
logger.debug("Auth /me called, cookie present: %s", bool(session_cookie))
|
||||
logger.info("Auth /me called, cookie present: %s", bool(session_cookie))
|
||||
|
||||
if not session_cookie:
|
||||
logger.warning("Auth /me: missing session cookie")
|
||||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="missing session")
|
||||
|
||||
settings = Settings()
|
||||
logger.debug("Auth /me: cookie_domain=%s, cookie_secure=%s, cookie_samesite=%s",
|
||||
logger.info("Auth /me: cookie_domain=%s, cookie_secure=%s, cookie_samesite=%s",
|
||||
settings.cookie_domain, settings.cookie_secure, settings.cookie_samesite)
|
||||
|
||||
try:
|
||||
payload = decode_session_cookie(settings=settings, cookie_value=session_cookie)
|
||||
user_id = payload["user_id"]
|
||||
logger.debug("Auth /me: decoded session for user_id=%s", user_id)
|
||||
logger.info("Auth /me: decoded session for user_id=%s", user_id)
|
||||
except ValueError as exc:
|
||||
logger.warning("Auth /me: invalid session: %s", exc)
|
||||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=str(exc))
|
||||
|
||||
@@ -0,0 +1,372 @@
|
||||
"""Config folder API endpoints."""
|
||||
|
||||
import logging
|
||||
import uuid
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, status
|
||||
from pydantic import BaseModel, Field, field_validator
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.auth.dependencies import get_current_user_id, get_db_session
|
||||
from src.models.config_folder import ConfigFolder
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
router = APIRouter(prefix="/config-folders", tags=["config-folders"])
|
||||
|
||||
MAX_FOLDER_SIZE_MB = 10
|
||||
MAX_FOLDER_SIZE_BYTES = MAX_FOLDER_SIZE_MB * 1024 * 1024
|
||||
|
||||
|
||||
class ConfigFolderCreate(BaseModel):
|
||||
name: str = Field(description="Folder name (unique per user)")
|
||||
description: str | None = Field(default=None, description="Optional description")
|
||||
mount_path: str = Field(description="Default mount path in container")
|
||||
files: dict = Field(default_factory=dict, description="Files as {path: content}")
|
||||
|
||||
@field_validator("mount_path")
|
||||
@classmethod
|
||||
def validate_mount_path(cls, v: str) -> str:
|
||||
if not v.startswith("/"):
|
||||
raise ValueError("Mount path must be absolute (start with /)")
|
||||
return v
|
||||
|
||||
@field_validator("files")
|
||||
@classmethod
|
||||
def validate_files(cls, v: dict) -> dict:
|
||||
total_size = 0
|
||||
for path, content in v.items():
|
||||
# Check for path traversal
|
||||
if ".." in path or path.startswith("/"):
|
||||
raise ValueError(f"Invalid file path: {path}")
|
||||
total_size += len(content.encode("utf-8"))
|
||||
|
||||
if total_size > MAX_FOLDER_SIZE_BYTES:
|
||||
raise ValueError(f"Total folder size exceeds {MAX_FOLDER_SIZE_MB}MB limit")
|
||||
|
||||
return v
|
||||
|
||||
|
||||
class ConfigFolderUpdate(BaseModel):
|
||||
name: str | None = Field(default=None, description="Folder name")
|
||||
description: str | None = Field(default=None, description="Optional description")
|
||||
mount_path: str | None = Field(default=None, description="Default mount path")
|
||||
files: dict | None = Field(default=None, description="Files as {path: content}")
|
||||
is_active: bool | None = Field(default=None, description="Active/inactive toggle")
|
||||
|
||||
@field_validator("mount_path")
|
||||
@classmethod
|
||||
def validate_mount_path(cls, v: str | None) -> str | None:
|
||||
if v is None:
|
||||
return v
|
||||
if not v.startswith("/"):
|
||||
raise ValueError("Mount path must be absolute (start with /)")
|
||||
return v
|
||||
|
||||
@field_validator("files")
|
||||
@classmethod
|
||||
def validate_files(cls, v: dict | None) -> dict | None:
|
||||
if v is None:
|
||||
return v
|
||||
|
||||
total_size = 0
|
||||
for path, content in v.items():
|
||||
# Check for path traversal
|
||||
if ".." in path or path.startswith("/"):
|
||||
raise ValueError(f"Invalid file path: {path}")
|
||||
total_size += len(content.encode("utf-8"))
|
||||
|
||||
if total_size > MAX_FOLDER_SIZE_BYTES:
|
||||
raise ValueError(f"Total folder size exceeds {MAX_FOLDER_SIZE_MB}MB limit")
|
||||
|
||||
return v
|
||||
|
||||
|
||||
class ProjectOverrideCreate(BaseModel):
|
||||
mount_path: str | None = Field(default=None, description="Override mount path")
|
||||
files: dict = Field(default_factory=dict, description="Override files")
|
||||
|
||||
@field_validator("mount_path")
|
||||
@classmethod
|
||||
def validate_mount_path(cls, v: str | None) -> str | None:
|
||||
if v is None:
|
||||
return v
|
||||
if not v.startswith("/"):
|
||||
raise ValueError("Mount path must be absolute (start with /)")
|
||||
return v
|
||||
|
||||
|
||||
class ConfigFolderResponse(BaseModel):
|
||||
id: str
|
||||
user_id: str
|
||||
name: str
|
||||
description: str | None
|
||||
mount_path: str
|
||||
files: dict
|
||||
project_overrides: dict | None
|
||||
is_active: bool
|
||||
created_at: str
|
||||
updated_at: str
|
||||
|
||||
|
||||
@router.get("", summary="List config folders", description="Get all config folders for the current user.")
|
||||
async def list_config_folders(
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""List config folders for the current user."""
|
||||
query = select(ConfigFolder).where(ConfigFolder.user_id == user_id)
|
||||
result = await session.execute(query)
|
||||
folders = result.scalars().all()
|
||||
|
||||
return {
|
||||
"folders": [
|
||||
{
|
||||
"id": str(f.id),
|
||||
"user_id": str(f.user_id),
|
||||
"name": f.name,
|
||||
"description": f.description,
|
||||
"mount_path": f.mount_path,
|
||||
"files": f.files,
|
||||
"project_overrides": f.project_overrides,
|
||||
"is_active": f.is_active,
|
||||
"created_at": f.created_at.isoformat() if f.created_at else None,
|
||||
"updated_at": f.updated_at.isoformat() if f.updated_at else None,
|
||||
}
|
||||
for f in folders
|
||||
]
|
||||
}
|
||||
|
||||
|
||||
@router.post("", summary="Create config folder", description="Create a new config folder.", status_code=status.HTTP_201_CREATED)
|
||||
async def create_config_folder(
|
||||
data: ConfigFolderCreate,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Create a config folder."""
|
||||
# Check for duplicate name
|
||||
existing = await session.scalar(
|
||||
select(ConfigFolder).where(
|
||||
ConfigFolder.user_id == user_id,
|
||||
ConfigFolder.name == data.name,
|
||||
)
|
||||
)
|
||||
if existing:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_409_CONFLICT,
|
||||
detail=f"config folder with name '{data.name}' already exists"
|
||||
)
|
||||
|
||||
folder = ConfigFolder(
|
||||
user_id=user_id,
|
||||
name=data.name,
|
||||
description=data.description,
|
||||
mount_path=data.mount_path,
|
||||
files=data.files,
|
||||
)
|
||||
session.add(folder)
|
||||
await session.commit()
|
||||
await session.refresh(folder)
|
||||
|
||||
return {
|
||||
"id": str(folder.id),
|
||||
"user_id": str(folder.user_id),
|
||||
"name": folder.name,
|
||||
"description": folder.description,
|
||||
"mount_path": folder.mount_path,
|
||||
"files": folder.files,
|
||||
"project_overrides": folder.project_overrides,
|
||||
"is_active": folder.is_active,
|
||||
"created_at": folder.created_at.isoformat() if folder.created_at else None,
|
||||
"updated_at": folder.updated_at.isoformat() if folder.updated_at else None,
|
||||
}
|
||||
|
||||
|
||||
@router.put("/{folder_id}", summary="Update config folder", description="Update an existing config folder.")
|
||||
async def update_config_folder(
|
||||
folder_id: uuid.UUID,
|
||||
data: ConfigFolderUpdate,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Update a config folder."""
|
||||
folder = await session.get(ConfigFolder, folder_id)
|
||||
if folder is None or folder.user_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="config folder not found")
|
||||
|
||||
if data.name is not None:
|
||||
folder.name = data.name
|
||||
if data.description is not None:
|
||||
folder.description = data.description
|
||||
if data.mount_path is not None:
|
||||
folder.mount_path = data.mount_path
|
||||
if data.files is not None:
|
||||
folder.files = data.files
|
||||
if data.is_active is not None:
|
||||
folder.is_active = data.is_active
|
||||
|
||||
await session.commit()
|
||||
await session.refresh(folder)
|
||||
|
||||
return {
|
||||
"id": str(folder.id),
|
||||
"user_id": str(folder.user_id),
|
||||
"name": folder.name,
|
||||
"description": folder.description,
|
||||
"mount_path": folder.mount_path,
|
||||
"files": folder.files,
|
||||
"project_overrides": folder.project_overrides,
|
||||
"is_active": folder.is_active,
|
||||
"created_at": folder.created_at.isoformat() if folder.created_at else None,
|
||||
"updated_at": folder.updated_at.isoformat() if folder.updated_at else None,
|
||||
}
|
||||
|
||||
|
||||
@router.delete("/{folder_id}", summary="Delete config folder", description="Delete a config folder.", status_code=status.HTTP_204_NO_CONTENT)
|
||||
async def delete_config_folder(
|
||||
folder_id: uuid.UUID,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> None:
|
||||
"""Delete a config folder."""
|
||||
folder = await session.get(ConfigFolder, folder_id)
|
||||
if folder is None or folder.user_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="config folder not found")
|
||||
|
||||
await session.delete(folder)
|
||||
await session.commit()
|
||||
|
||||
|
||||
class ProjectOverrideWithId(ProjectOverrideCreate):
|
||||
project_id: uuid.UUID = Field(description="Project ID for the override")
|
||||
|
||||
|
||||
@router.get("/{folder_id}", summary="Get config folder by ID", description="Get a single config folder by its ID.")
|
||||
async def get_config_folder(
|
||||
folder_id: uuid.UUID,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Get a config folder by ID."""
|
||||
folder = await session.get(ConfigFolder, folder_id)
|
||||
if folder is None or folder.user_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="config folder not found")
|
||||
|
||||
return {
|
||||
"id": str(folder.id),
|
||||
"user_id": str(folder.user_id),
|
||||
"name": folder.name,
|
||||
"description": folder.description,
|
||||
"mount_path": folder.mount_path,
|
||||
"files": folder.files,
|
||||
"project_overrides": folder.project_overrides,
|
||||
"is_active": folder.is_active,
|
||||
"created_at": folder.created_at.isoformat() if folder.created_at else None,
|
||||
"updated_at": folder.updated_at.isoformat() if folder.updated_at else None,
|
||||
}
|
||||
|
||||
|
||||
@router.post("/{folder_id}/overrides", summary="Add project override", description="Add a project override to a config folder.")
|
||||
async def add_project_override(
|
||||
folder_id: uuid.UUID,
|
||||
data: ProjectOverrideWithId,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Add a project override to a config folder."""
|
||||
folder = await session.get(ConfigFolder, folder_id)
|
||||
if folder is None or folder.user_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="config folder not found")
|
||||
|
||||
# Initialize project_overrides if None
|
||||
if folder.project_overrides is None:
|
||||
folder.project_overrides = {}
|
||||
|
||||
# Add/update override
|
||||
override_data = {}
|
||||
if data.mount_path is not None:
|
||||
override_data["mount_path"] = data.mount_path
|
||||
if data.files is not None:
|
||||
override_data["files"] = data.files
|
||||
|
||||
# Use a copy to trigger SQLAlchemy change detection on JSONB
|
||||
current_overrides = dict(folder.project_overrides or {})
|
||||
current_overrides[str(data.project_id)] = override_data
|
||||
folder.project_overrides = current_overrides
|
||||
|
||||
await session.commit()
|
||||
await session.refresh(folder)
|
||||
|
||||
return {
|
||||
"id": str(folder.id),
|
||||
"project_overrides": folder.project_overrides,
|
||||
}
|
||||
|
||||
|
||||
@router.put("/{folder_id}/overrides/{project_id}", summary="Update project override", description="Update a project override.")
|
||||
async def update_project_override(
|
||||
folder_id: uuid.UUID,
|
||||
project_id: uuid.UUID,
|
||||
data: ProjectOverrideCreate,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Update a project override."""
|
||||
folder = await session.get(ConfigFolder, folder_id)
|
||||
if folder is None or folder.user_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="config folder not found")
|
||||
|
||||
# Initialize project_overrides if None
|
||||
if folder.project_overrides is None:
|
||||
folder.project_overrides = {}
|
||||
|
||||
# Update override
|
||||
current_overrides = dict(folder.project_overrides or {})
|
||||
override_data = current_overrides.get(str(project_id), {})
|
||||
if data.mount_path is not None:
|
||||
override_data["mount_path"] = data.mount_path
|
||||
if data.files is not None:
|
||||
override_data["files"] = data.files
|
||||
|
||||
current_overrides[str(project_id)] = override_data
|
||||
folder.project_overrides = current_overrides
|
||||
|
||||
# Mark the field as modified to ensure SQLAlchemy detects the change
|
||||
from sqlalchemy.orm.attributes import flag_modified
|
||||
flag_modified(folder, "project_overrides")
|
||||
|
||||
await session.commit()
|
||||
await session.refresh(folder)
|
||||
|
||||
return {
|
||||
"id": str(folder.id),
|
||||
"project_overrides": folder.project_overrides,
|
||||
}
|
||||
|
||||
|
||||
@router.delete("/{folder_id}/overrides/{project_id}", summary="Remove project override", description="Remove a project override.")
|
||||
async def remove_project_override(
|
||||
folder_id: uuid.UUID,
|
||||
project_id: uuid.UUID,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> None:
|
||||
"""Remove a project override."""
|
||||
folder = await session.get(ConfigFolder, folder_id)
|
||||
if folder is None or folder.user_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="config folder not found")
|
||||
|
||||
# Remove override if exists
|
||||
current_overrides = dict(folder.project_overrides or {})
|
||||
if str(project_id) in current_overrides:
|
||||
del current_overrides[str(project_id)]
|
||||
folder.project_overrides = current_overrides
|
||||
await session.commit()
|
||||
await session.refresh(folder)
|
||||
|
||||
return {
|
||||
"id": str(folder.id),
|
||||
"project_overrides": folder.project_overrides or {},
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,80 +0,0 @@
|
||||
"""SSE streaming endpoint for instance events."""
|
||||
|
||||
import asyncio
|
||||
import contextlib
|
||||
import json
|
||||
import uuid
|
||||
from collections.abc import AsyncGenerator
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Request, status
|
||||
from fastapi.responses import StreamingResponse
|
||||
|
||||
from src.auth.dependencies import get_current_user_id
|
||||
from src.services.event_bus import InstanceEventBus, InstanceEventPayload
|
||||
|
||||
router = APIRouter(prefix="/events", tags=["events"])
|
||||
|
||||
# In-memory connection counter per user (single-process assumption)
|
||||
_connection_counts: dict[uuid.UUID, int] = {}
|
||||
MAX_CONNECTIONS_PER_USER = 5
|
||||
|
||||
|
||||
@router.get("/stream")
|
||||
async def events_stream(
|
||||
request: Request,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
) -> StreamingResponse:
|
||||
"""Stream instance events via Server-Sent Events.
|
||||
|
||||
Enforces a maximum of 5 concurrent connections per user.
|
||||
"""
|
||||
current = _connection_counts.get(user_id, 0)
|
||||
if current >= MAX_CONNECTIONS_PER_USER:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_429_TOO_MANY_REQUESTS,
|
||||
detail="Too many SSE connections",
|
||||
)
|
||||
|
||||
_connection_counts[user_id] = current + 1
|
||||
|
||||
async def event_generator() -> AsyncGenerator[str, None]:
|
||||
event_bus = InstanceEventBus()
|
||||
queue: asyncio.Queue[InstanceEventPayload] = asyncio.Queue(maxsize=100)
|
||||
|
||||
async def on_event(payload: InstanceEventPayload) -> None:
|
||||
try:
|
||||
queue.put_nowait(payload)
|
||||
except asyncio.QueueFull:
|
||||
# Drop oldest event to make room
|
||||
with contextlib.suppress(asyncio.QueueEmpty):
|
||||
queue.get_nowait()
|
||||
with contextlib.suppress(asyncio.QueueFull):
|
||||
queue.put_nowait(payload)
|
||||
|
||||
unsubscribe = event_bus.subscribe("*", on_event)
|
||||
|
||||
try:
|
||||
while True:
|
||||
try:
|
||||
payload = await asyncio.wait_for(queue.get(), timeout=30.0)
|
||||
yield f"event: {payload['event']}\ndata: {json.dumps(payload)}\n\n"
|
||||
except asyncio.TimeoutError:
|
||||
yield ":ping\n\n"
|
||||
except asyncio.CancelledError:
|
||||
# Client disconnected
|
||||
raise
|
||||
finally:
|
||||
unsubscribe()
|
||||
_connection_counts[user_id] = max(0, _connection_counts.get(user_id, 1) - 1)
|
||||
if _connection_counts[user_id] == 0:
|
||||
_connection_counts.pop(user_id, None)
|
||||
|
||||
return StreamingResponse(
|
||||
event_generator(),
|
||||
media_type="text/event-stream",
|
||||
headers={
|
||||
"Cache-Control": "no-cache",
|
||||
"Connection": "keep-alive",
|
||||
"X-Accel-Buffering": "no",
|
||||
},
|
||||
)
|
||||
@@ -10,10 +10,11 @@ from pydantic import BaseModel, ConfigDict
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.auth.dependencies import _get_owned_project, _get_user, get_current_user_id, get_db_session
|
||||
from src.auth.dependencies import get_current_user_id, get_db_session
|
||||
from src.config import Settings
|
||||
from src.models.git_repository import GitRepository
|
||||
from src.models.ssh_key import SSHKey
|
||||
from src.models.project import Project
|
||||
from src.models.user import User
|
||||
from src.utils.git_files import (
|
||||
commit_file,
|
||||
get_file_content,
|
||||
@@ -33,13 +34,46 @@ from src.utils.git_control import (
|
||||
)
|
||||
from src.utils.git_history import get_commit_detail, get_commit_history
|
||||
from src.utils.git_url_parser import parse_git_url
|
||||
from src.services.ssh_keys import _get_fernet
|
||||
|
||||
router = APIRouter(prefix="/projects", tags=["git-repositories"])
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
|
||||
"""Fetch a user by ID or raise 401 if not found."""
|
||||
user = await session.get(User, user_id)
|
||||
if user is None:
|
||||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
|
||||
return user
|
||||
|
||||
|
||||
async def _get_owned_project(
|
||||
project_id: uuid.UUID,
|
||||
user_id: uuid.UUID,
|
||||
session: AsyncSession,
|
||||
) -> Project:
|
||||
"""Fetch a project and verify ownership.
|
||||
|
||||
Args:
|
||||
project_id: UUID of the project.
|
||||
user_id: ID of the authenticated user.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
The project if found and owned by the user.
|
||||
|
||||
Raises:
|
||||
HTTPException: If project not found or user is not the owner.
|
||||
"""
|
||||
project = await session.get(Project, project_id)
|
||||
if project is None:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="project not found")
|
||||
if project.owner_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="not project owner")
|
||||
return project
|
||||
|
||||
|
||||
def _get_repo_path(user_id: uuid.UUID, project_id: uuid.UUID, name: str) -> str:
|
||||
"""Generate the filesystem path for a repository.
|
||||
|
||||
@@ -60,97 +94,41 @@ def _build_provider_clone_url(owner: str, repo: str) -> str:
|
||||
return f"git@git.commumedia.org:{owner}/{repo}.git"
|
||||
|
||||
|
||||
def _prepare_ssh_env(ssh_key: SSHKey | None) -> dict | None:
|
||||
"""Prepare environment variables for git commands with SSH authentication.
|
||||
|
||||
Returns a dict of extra env vars, or None if no SSH key provided.
|
||||
The caller is responsible for cleaning up the temporary key file.
|
||||
"""
|
||||
if ssh_key is None:
|
||||
return None
|
||||
|
||||
import tempfile
|
||||
|
||||
# Decrypt private key
|
||||
fernet = _get_fernet()
|
||||
private_key = fernet.decrypt(ssh_key.private_key_encrypted.encode()).decode()
|
||||
|
||||
# Write to temp file with restricted permissions
|
||||
fd, key_path = tempfile.mkstemp(prefix="ssh_key_")
|
||||
try:
|
||||
os.write(fd, private_key.encode())
|
||||
finally:
|
||||
os.close(fd)
|
||||
os.chmod(key_path, 0o600)
|
||||
|
||||
# Return env vars and the key path for cleanup
|
||||
env = {
|
||||
"GIT_SSH_COMMAND": f"ssh -i {key_path} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
|
||||
}
|
||||
return env, key_path
|
||||
|
||||
|
||||
def _preflight_remote_repository(remote_url: str, ssh_key: SSHKey | None = None) -> None:
|
||||
def _preflight_remote_repository(remote_url: str) -> None:
|
||||
"""Verify a remote repository is reachable before cloning."""
|
||||
env = None
|
||||
key_path = None
|
||||
|
||||
if ssh_key is not None:
|
||||
ssh_result = _prepare_ssh_env(ssh_key)
|
||||
if ssh_result:
|
||||
env, key_path = ssh_result
|
||||
|
||||
try:
|
||||
result = subprocess.run(
|
||||
["git", "ls-remote", remote_url],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=60,
|
||||
env={**os.environ, **env} if env else None,
|
||||
)
|
||||
except subprocess.TimeoutExpired:
|
||||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="remote repository check timed out")
|
||||
except FileNotFoundError:
|
||||
raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="git command not found")
|
||||
finally:
|
||||
if key_path and os.path.exists(key_path):
|
||||
os.unlink(key_path)
|
||||
|
||||
if result.returncode != 0:
|
||||
logger.error("Preflight check failed for %s: stderr=%s", remote_url, result.stderr)
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"repository not found or inaccessible: {result.stderr}",
|
||||
detail="repository not found or inaccessible",
|
||||
)
|
||||
|
||||
|
||||
def _clone_working_repository(remote_url: str, repo_path: str, ssh_key: SSHKey | None = None) -> None:
|
||||
env = None
|
||||
key_path = None
|
||||
|
||||
if ssh_key is not None:
|
||||
ssh_result = _prepare_ssh_env(ssh_key)
|
||||
if ssh_result:
|
||||
env, key_path = ssh_result
|
||||
|
||||
def _clone_working_repository(remote_url: str, repo_path: str) -> None:
|
||||
try:
|
||||
result = subprocess.run(
|
||||
["git", "clone", remote_url, repo_path],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=300,
|
||||
env={**os.environ, **env} if env else None,
|
||||
)
|
||||
except subprocess.TimeoutExpired:
|
||||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="clone operation timed out")
|
||||
except FileNotFoundError:
|
||||
raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="git command not found")
|
||||
finally:
|
||||
if key_path and os.path.exists(key_path):
|
||||
os.unlink(key_path)
|
||||
|
||||
if result.returncode != 0:
|
||||
logger.error("Clone failed for %s: stderr=%s", remote_url, result.stderr)
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"failed to clone repository: {result.stderr}",
|
||||
@@ -197,7 +175,6 @@ class GitRepositoryCreate(BaseModel):
|
||||
name: str
|
||||
remote_url: str | None = None
|
||||
force_original_url: bool = False
|
||||
ssh_key_id: str | None = None
|
||||
|
||||
|
||||
class URLParseRequest(BaseModel):
|
||||
@@ -220,166 +197,15 @@ class GitRepositoryResponse(BaseModel):
|
||||
id: uuid.UUID
|
||||
name: str
|
||||
path: str
|
||||
project_id: uuid.UUID | None
|
||||
project_id: uuid.UUID
|
||||
owner_id: uuid.UUID
|
||||
is_mirror: bool
|
||||
remote_url: str | None
|
||||
last_push: datetime | None
|
||||
ssh_key_id: uuid.UUID | None
|
||||
created_at: datetime
|
||||
updated_at: datetime
|
||||
|
||||
|
||||
@router.get(
|
||||
"/repositories",
|
||||
response_model=list[GitRepositoryResponse],
|
||||
summary="List all user repositories",
|
||||
description="List all git repositories owned by the user, including external repositories not tied to any project.",
|
||||
)
|
||||
async def list_user_repositories(
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> list[GitRepository]:
|
||||
"""List all repositories owned by the user.
|
||||
|
||||
Args:
|
||||
user_id: ID of the authenticated user.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
List of all repositories owned by the user.
|
||||
"""
|
||||
result = await session.execute(
|
||||
select(GitRepository).where(GitRepository.owner_id == user_id)
|
||||
)
|
||||
return list(result.scalars().all())
|
||||
|
||||
|
||||
@router.post(
|
||||
"/repositories/parse-url",
|
||||
response_model=URLParseResponse,
|
||||
summary="Parse a git URL",
|
||||
description="Parse a git URL and detect if it's a browser URL that needs correction.",
|
||||
)
|
||||
async def parse_repository_url(data: URLParseRequest) -> URLParseResponse:
|
||||
"""Parse a git URL and detect if it's a browser URL that needs correction.
|
||||
|
||||
Args:
|
||||
data: Request containing the URL to parse.
|
||||
|
||||
Returns:
|
||||
Parsed URL information including whether it needs parsing and suggested corrections.
|
||||
"""
|
||||
result = parse_git_url(data.url)
|
||||
return URLParseResponse(**result)
|
||||
|
||||
|
||||
@router.post(
|
||||
"/repositories",
|
||||
response_model=GitRepositoryResponse,
|
||||
status_code=status.HTTP_201_CREATED,
|
||||
summary="Create an external repository",
|
||||
description="Create a new external git repository (not tied to any project). Can clone from remote URL.",
|
||||
)
|
||||
async def create_external_repository(
|
||||
data: GitRepositoryCreate,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> GitRepository:
|
||||
"""Create a new external git repository.
|
||||
|
||||
External repositories are not tied to any project and can be used
|
||||
across all projects for config profile git mounts.
|
||||
|
||||
Args:
|
||||
data: Repository creation data including name and optional remote URL.
|
||||
user_id: ID of the authenticated user.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
The newly created external repository.
|
||||
"""
|
||||
_user = await _get_user(session, user_id)
|
||||
|
||||
# Check for duplicate name (external repos only)
|
||||
existing = await session.execute(
|
||||
select(GitRepository).where(
|
||||
GitRepository.project_id.is_(None),
|
||||
GitRepository.owner_id == user_id,
|
||||
GitRepository.name == data.name,
|
||||
)
|
||||
)
|
||||
if existing.scalar_one_or_none():
|
||||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="repository name already exists")
|
||||
|
||||
# Validate and potentially correct the URL
|
||||
remote_url = data.remote_url
|
||||
if remote_url and not data.force_original_url:
|
||||
parse_result = parse_git_url(remote_url)
|
||||
if parse_result["needs_parsing"] and parse_result["base_url"]:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
|
||||
detail={
|
||||
"message": "The provided URL appears to be a browser URL, not a git clone URL",
|
||||
"suggested_url": parse_result["base_url"],
|
||||
"original_url": remote_url,
|
||||
"error_code": "URL_NEEDS_PARSING",
|
||||
},
|
||||
)
|
||||
if parse_result["base_url"]:
|
||||
remote_url = parse_result["base_url"]
|
||||
|
||||
# Validate SSH key if provided
|
||||
ssh_key_id = None
|
||||
ssh_key = None
|
||||
if data.ssh_key_id:
|
||||
try:
|
||||
ssh_key_id = uuid.UUID(data.ssh_key_id)
|
||||
except ValueError:
|
||||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="invalid ssh_key_id format")
|
||||
|
||||
ssh_key = await session.get(SSHKey, ssh_key_id)
|
||||
if ssh_key is None:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ssh key not found")
|
||||
if ssh_key.user_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="ssh key does not belong to user")
|
||||
|
||||
if remote_url:
|
||||
_preflight_remote_repository(remote_url, ssh_key)
|
||||
|
||||
# Create external repo with no project
|
||||
repo = GitRepository(
|
||||
name=data.name,
|
||||
path="", # Will be set after clone
|
||||
project_id=None,
|
||||
owner_id=user_id,
|
||||
remote_url=remote_url,
|
||||
ssh_key_id=ssh_key_id,
|
||||
)
|
||||
session.add(repo)
|
||||
await session.flush()
|
||||
|
||||
# Set path and optionally clone
|
||||
repo_path = f"/data/repos/external/{user_id}/{repo.id}"
|
||||
repo.path = repo_path
|
||||
|
||||
if remote_url:
|
||||
try:
|
||||
_clone_working_repository(remote_url, repo_path, ssh_key)
|
||||
repo.is_mirror = False
|
||||
except Exception as exc:
|
||||
await session.rollback()
|
||||
raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail=f"Failed to clone repository: {exc}")
|
||||
else:
|
||||
# Initialize empty repo
|
||||
os.makedirs(repo_path, exist_ok=True)
|
||||
subprocess.run(["git", "init", repo_path], check=True, capture_output=True)
|
||||
repo.is_mirror = False
|
||||
|
||||
await session.commit()
|
||||
return repo
|
||||
|
||||
|
||||
@router.get(
|
||||
"/{project_id}/repositories",
|
||||
response_model=list[GitRepositoryResponse],
|
||||
@@ -449,6 +275,25 @@ async def delete_repository(
|
||||
return Response(status_code=status.HTTP_204_NO_CONTENT)
|
||||
|
||||
|
||||
@router.post(
|
||||
"/repositories/parse-url",
|
||||
response_model=URLParseResponse,
|
||||
summary="Parse a git URL",
|
||||
description="Parse a git URL and detect if it's a browser URL that needs correction.",
|
||||
)
|
||||
async def parse_repository_url(data: URLParseRequest) -> URLParseResponse:
|
||||
"""Parse a git URL and detect if it's a browser URL that needs correction.
|
||||
|
||||
Args:
|
||||
data: Request containing the URL to parse.
|
||||
|
||||
Returns:
|
||||
Parsed URL information including whether it needs parsing and suggested corrections.
|
||||
"""
|
||||
result = parse_git_url(data.url)
|
||||
return URLParseResponse(**result)
|
||||
|
||||
|
||||
@router.post(
|
||||
"/{project_id}/repositories",
|
||||
response_model=GitRepositoryResponse,
|
||||
@@ -504,23 +349,8 @@ async def create_repository(
|
||||
if parse_result["base_url"]:
|
||||
remote_url = parse_result["base_url"]
|
||||
|
||||
# Validate SSH key if provided
|
||||
ssh_key_id = None
|
||||
ssh_key = None
|
||||
if data.ssh_key_id:
|
||||
try:
|
||||
ssh_key_id = uuid.UUID(data.ssh_key_id)
|
||||
except ValueError:
|
||||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="invalid ssh_key_id format")
|
||||
|
||||
ssh_key = await session.get(SSHKey, ssh_key_id)
|
||||
if ssh_key is None:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ssh key not found")
|
||||
if ssh_key.user_id != user_id and ssh_key.project_id != project_id:
|
||||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="ssh key does not belong to user or project")
|
||||
|
||||
if remote_url:
|
||||
_preflight_remote_repository(remote_url, ssh_key)
|
||||
_preflight_remote_repository(remote_url)
|
||||
|
||||
repo_path = _get_repo_path(user_id, project_id, data.name)
|
||||
|
||||
@@ -528,7 +358,7 @@ async def create_repository(
|
||||
os.makedirs(os.path.dirname(repo_path), exist_ok=True)
|
||||
|
||||
if remote_url:
|
||||
_clone_working_repository(remote_url, repo_path, ssh_key)
|
||||
_clone_working_repository(remote_url, repo_path)
|
||||
else:
|
||||
_init_working_repository(repo_path)
|
||||
|
||||
@@ -539,7 +369,6 @@ async def create_repository(
|
||||
owner_id=user_id,
|
||||
is_mirror=False,
|
||||
remote_url=remote_url,
|
||||
ssh_key_id=ssh_key_id,
|
||||
)
|
||||
session.add(repo)
|
||||
await session.commit()
|
||||
@@ -547,64 +376,6 @@ async def create_repository(
|
||||
return repo
|
||||
|
||||
|
||||
class UpdateSSHKeyRequest(BaseModel):
|
||||
ssh_key_id: str | None = None
|
||||
|
||||
|
||||
@router.patch(
|
||||
"/{project_id}/repositories/{repo_id}/ssh-key",
|
||||
response_model=GitRepositoryResponse,
|
||||
summary="Update repository SSH key",
|
||||
description="Update the SSH key associated with a repository.",
|
||||
)
|
||||
async def update_repository_ssh_key(
|
||||
project_id: uuid.UUID,
|
||||
repo_id: uuid.UUID,
|
||||
data: UpdateSSHKeyRequest,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> GitRepository:
|
||||
"""Update the SSH key for a repository.
|
||||
|
||||
Args:
|
||||
project_id: UUID of the project.
|
||||
repo_id: UUID of the repository.
|
||||
data: Update data containing the new SSH key ID.
|
||||
user_id: ID of the authenticated user.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
The updated repository.
|
||||
"""
|
||||
_user = await _get_user(session, user_id)
|
||||
_project = await _get_owned_project(project_id, user_id, session)
|
||||
|
||||
repo = await session.get(GitRepository, repo_id)
|
||||
if repo is None or repo.project_id != project_id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="repository not found")
|
||||
|
||||
# Validate SSH key if provided
|
||||
if data.ssh_key_id:
|
||||
try:
|
||||
ssh_key_id = uuid.UUID(data.ssh_key_id)
|
||||
except ValueError:
|
||||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="invalid ssh_key_id format")
|
||||
|
||||
ssh_key = await session.get(SSHKey, ssh_key_id)
|
||||
if ssh_key is None:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ssh key not found")
|
||||
if ssh_key.user_id != user_id and ssh_key.project_id != project_id:
|
||||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="ssh key does not belong to user or project")
|
||||
|
||||
repo.ssh_key_id = ssh_key_id
|
||||
else:
|
||||
repo.ssh_key_id = None
|
||||
|
||||
await session.commit()
|
||||
await session.refresh(repo)
|
||||
return repo
|
||||
|
||||
|
||||
@router.get(
|
||||
"/{project_id}/repositories/{repo_id}/history",
|
||||
summary="Get repository history",
|
||||
|
||||
@@ -4,10 +4,11 @@ import time
|
||||
from datetime import datetime, timezone
|
||||
from typing import Any
|
||||
|
||||
from fastapi import APIRouter
|
||||
from fastapi import APIRouter, status
|
||||
from pydantic import BaseModel, Field
|
||||
from sqlalchemy import text
|
||||
|
||||
from src.config import Settings
|
||||
from src.database import SessionLocal
|
||||
|
||||
router = APIRouter()
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
|
||||
import logging
|
||||
import uuid
|
||||
from typing import Any
|
||||
|
||||
import httpx
|
||||
from fastapi import APIRouter, Depends, HTTPException, Request, Response, status
|
||||
|
||||
@@ -1,161 +0,0 @@
|
||||
"""Notification API endpoints."""
|
||||
|
||||
import uuid
|
||||
from datetime import datetime
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Query, status
|
||||
from pydantic import BaseModel, ConfigDict, Field
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.auth.dependencies import get_current_user, get_db_session
|
||||
from src.models.user import User
|
||||
from src.models.user_config import UserConfig
|
||||
from src.services.notification_service import notification_service
|
||||
|
||||
router = APIRouter(prefix="/notifications", tags=["notifications"])
|
||||
|
||||
|
||||
class NotificationItem(BaseModel):
|
||||
model_config = ConfigDict(from_attributes=True)
|
||||
|
||||
id: uuid.UUID
|
||||
user_id: uuid.UUID
|
||||
category: str
|
||||
severity: str
|
||||
title: str
|
||||
message: str | None
|
||||
source_type: str | None
|
||||
source_id: uuid.UUID | None
|
||||
notification_metadata: dict = Field(serialization_alias="metadata")
|
||||
read_at: datetime | None
|
||||
dismissed_at: datetime | None
|
||||
created_at: datetime
|
||||
|
||||
|
||||
class NotificationListResponse(BaseModel):
|
||||
items: list[NotificationItem]
|
||||
total: int
|
||||
limit: int
|
||||
offset: int
|
||||
|
||||
|
||||
class UnreadCountResponse(BaseModel):
|
||||
count: int
|
||||
|
||||
|
||||
class MarkAllReadResponse(BaseModel):
|
||||
marked_count: int
|
||||
|
||||
|
||||
class ClearAllResponse(BaseModel):
|
||||
cleared_count: int
|
||||
|
||||
|
||||
async def _get_mute_categories(
|
||||
session: AsyncSession,
|
||||
user_id: uuid.UUID,
|
||||
) -> list[str]:
|
||||
"""Read notification mute categories from user config."""
|
||||
from sqlalchemy import select
|
||||
|
||||
result = await session.execute(
|
||||
select(UserConfig).where(UserConfig.user_id == user_id)
|
||||
)
|
||||
config = result.scalar_one_or_none()
|
||||
if config is None:
|
||||
return []
|
||||
mute_categories = config.config.get("notification_mute_categories", [])
|
||||
if isinstance(mute_categories, list):
|
||||
return mute_categories
|
||||
return []
|
||||
|
||||
|
||||
@router.get("", response_model=NotificationListResponse)
|
||||
async def list_notifications(
|
||||
limit: int = Query(20, ge=1, le=100),
|
||||
offset: int = Query(0, ge=0),
|
||||
unread_only: bool = Query(False),
|
||||
user: User = Depends(get_current_user),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> NotificationListResponse:
|
||||
"""List notifications for the authenticated user."""
|
||||
mute_categories = await _get_mute_categories(session, user.id)
|
||||
items, total = await notification_service.list_notifications(
|
||||
session,
|
||||
user.id,
|
||||
limit=limit,
|
||||
offset=offset,
|
||||
unread_only=unread_only,
|
||||
mute_categories=mute_categories,
|
||||
)
|
||||
return NotificationListResponse(
|
||||
items=[NotificationItem.model_validate(item) for item in items],
|
||||
total=total,
|
||||
limit=limit,
|
||||
offset=offset,
|
||||
)
|
||||
|
||||
|
||||
@router.get("/unread", response_model=UnreadCountResponse)
|
||||
async def get_unread_count(
|
||||
user: User = Depends(get_current_user),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> UnreadCountResponse:
|
||||
"""Get unread notification count for the authenticated user."""
|
||||
count = await notification_service.get_unread_count(session, user.id)
|
||||
return UnreadCountResponse(count=count)
|
||||
|
||||
|
||||
@router.patch("/{notification_id}/read", response_model=NotificationItem)
|
||||
async def mark_notification_read(
|
||||
notification_id: uuid.UUID,
|
||||
user: User = Depends(get_current_user),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> NotificationItem:
|
||||
"""Mark a single notification as read."""
|
||||
try:
|
||||
notification = await notification_service.mark_read(
|
||||
session, notification_id, user.id
|
||||
)
|
||||
except ValueError as exc:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND,
|
||||
detail="Notification not found",
|
||||
) from exc
|
||||
return NotificationItem.model_validate(notification)
|
||||
|
||||
|
||||
@router.post("/mark-all-read", response_model=MarkAllReadResponse)
|
||||
async def mark_all_read(
|
||||
user: User = Depends(get_current_user),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> MarkAllReadResponse:
|
||||
"""Mark all unread notifications as read."""
|
||||
marked = await notification_service.mark_all_read(session, user.id)
|
||||
return MarkAllReadResponse(marked_count=marked)
|
||||
|
||||
|
||||
@router.delete("", status_code=status.HTTP_200_OK)
|
||||
async def clear_all_notifications(
|
||||
user: User = Depends(get_current_user),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> ClearAllResponse:
|
||||
"""Dismiss all notifications for the authenticated user."""
|
||||
cleared = await notification_service.dismiss_all(session, user.id)
|
||||
return ClearAllResponse(cleared_count=cleared)
|
||||
|
||||
|
||||
@router.delete("/{notification_id}", status_code=status.HTTP_204_NO_CONTENT)
|
||||
async def dismiss_notification(
|
||||
notification_id: uuid.UUID,
|
||||
user: User = Depends(get_current_user),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> None:
|
||||
"""Soft-delete (dismiss) a single notification."""
|
||||
try:
|
||||
await notification_service.dismiss(session, notification_id, user.id)
|
||||
except ValueError as exc:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND,
|
||||
detail="Notification not found",
|
||||
) from exc
|
||||
@@ -7,14 +7,23 @@ from pydantic import BaseModel, ConfigDict
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.auth.dependencies import _get_owned_project, _get_user, get_current_user_id, get_db_session
|
||||
from src.auth.dependencies import get_current_user_id, get_db_session
|
||||
from src.models.git_repository import GitRepository
|
||||
from src.models.project import Project
|
||||
from src.models.ssh_key import SSHKey
|
||||
from src.models.user import User
|
||||
|
||||
router = APIRouter(prefix="/projects", tags=["projects"])
|
||||
|
||||
|
||||
async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
|
||||
"""Fetch a user by ID or raise 401 if not found."""
|
||||
user = await session.get(User, user_id)
|
||||
if user is None:
|
||||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
|
||||
return user
|
||||
|
||||
|
||||
class ProjectCreate(BaseModel):
|
||||
name: str
|
||||
description: str | None = None
|
||||
@@ -123,6 +132,32 @@ async def get_project(
|
||||
return await _get_owned_project(project_id, user_id, session)
|
||||
|
||||
|
||||
async def _get_owned_project(
|
||||
project_id: uuid.UUID,
|
||||
user_id: uuid.UUID,
|
||||
session: AsyncSession,
|
||||
) -> Project:
|
||||
"""Fetch a project and verify ownership.
|
||||
|
||||
Args:
|
||||
project_id: UUID of the project.
|
||||
user_id: ID of the authenticated user.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
The project if found and owned by the user.
|
||||
|
||||
Raises:
|
||||
HTTPException: If project not found or user is not the owner.
|
||||
"""
|
||||
project = await session.get(Project, project_id)
|
||||
if project is None:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="project not found")
|
||||
if project.owner_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="not project owner")
|
||||
return project
|
||||
|
||||
|
||||
@router.patch(
|
||||
"/{project_id}",
|
||||
response_model=ProjectResponse,
|
||||
|
||||
@@ -1,98 +0,0 @@
|
||||
"""Shared Pydantic validators for API schemas."""
|
||||
|
||||
|
||||
MAX_FOLDER_SIZE_MB = 10
|
||||
MAX_FOLDER_SIZE_BYTES = MAX_FOLDER_SIZE_MB * 1024 * 1024
|
||||
|
||||
|
||||
def validate_mount_path(v: str | None) -> str | None:
|
||||
"""Validate that a mount path is absolute (starts with /).
|
||||
|
||||
Args:
|
||||
v: Mount path string or None.
|
||||
|
||||
Returns:
|
||||
The validated path, or None if input was None.
|
||||
|
||||
Raises:
|
||||
ValueError: If path is not absolute.
|
||||
"""
|
||||
if v is None:
|
||||
return v
|
||||
if not v.startswith("/"):
|
||||
raise ValueError("Mount path must be absolute (start with /)")
|
||||
return v
|
||||
|
||||
|
||||
def validate_files(v: dict | None, max_size_bytes: int = MAX_FOLDER_SIZE_BYTES) -> dict | None:
|
||||
"""Validate file dict for path traversal and size limits.
|
||||
|
||||
Args:
|
||||
v: Dict of {path: content} or None.
|
||||
max_size_bytes: Maximum total size in bytes.
|
||||
|
||||
Returns:
|
||||
The validated dict, or None if input was None.
|
||||
|
||||
Raises:
|
||||
ValueError: If path traversal detected or size limit exceeded.
|
||||
"""
|
||||
if v is None:
|
||||
return v
|
||||
|
||||
total_size = 0
|
||||
for path, content in v.items():
|
||||
# Check for path traversal
|
||||
if ".." in path or path.startswith("/"):
|
||||
raise ValueError(f"Invalid file path: {path}")
|
||||
total_size += len(content.encode("utf-8"))
|
||||
|
||||
if total_size > max_size_bytes:
|
||||
raise ValueError(f"Total folder size exceeds {max_size_bytes // (1024 * 1024)}MB limit")
|
||||
|
||||
return v
|
||||
|
||||
|
||||
def validate_env_vars(v: dict | None) -> dict | None:
|
||||
"""Validate that environment variables is a JSON object.
|
||||
|
||||
Args:
|
||||
v: Dict of env vars or None.
|
||||
|
||||
Returns:
|
||||
The validated dict, or None if input was None.
|
||||
|
||||
Raises:
|
||||
ValueError: If not a dict.
|
||||
"""
|
||||
if v is None:
|
||||
return v
|
||||
if not isinstance(v, dict):
|
||||
raise ValueError("environment_variables must be a JSON object")
|
||||
return v
|
||||
|
||||
|
||||
def validate_volumes(v: list | None) -> list | None:
|
||||
"""Validate volume mounts list.
|
||||
|
||||
Args:
|
||||
v: List of volume dicts or None.
|
||||
|
||||
Returns:
|
||||
The validated list, or None if input was None.
|
||||
|
||||
Raises:
|
||||
ValueError: If not a list or missing required fields.
|
||||
"""
|
||||
if v is None:
|
||||
return v
|
||||
if not isinstance(v, list):
|
||||
raise ValueError("volumes must be a JSON array")
|
||||
for i, vol in enumerate(v):
|
||||
if not isinstance(vol, dict):
|
||||
raise ValueError(f"Volume at index {i} must be an object")
|
||||
if "source" not in vol:
|
||||
raise ValueError(f"Volume at index {i} must have 'source' field")
|
||||
if "target" not in vol:
|
||||
raise ValueError(f"Volume at index {i} must have 'target' field")
|
||||
return v
|
||||
@@ -1,4 +1,3 @@
|
||||
import base64
|
||||
import uuid
|
||||
from datetime import datetime
|
||||
|
||||
@@ -10,13 +9,22 @@ from pydantic import BaseModel, ConfigDict
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.auth.dependencies import _get_user, get_current_user_id, get_db_session
|
||||
from src.auth.dependencies import get_current_user_id, get_db_session
|
||||
from src.config import Settings
|
||||
from src.models.ssh_key import SSHKey
|
||||
from src.models.user import User
|
||||
|
||||
router = APIRouter(prefix="/ssh-keys", tags=["ssh-keys"])
|
||||
|
||||
|
||||
async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
|
||||
"""Fetch a user by ID or raise 401 if not found."""
|
||||
user = await session.get(User, user_id)
|
||||
if user is None:
|
||||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
|
||||
return user
|
||||
|
||||
|
||||
def _get_fernet() -> Fernet:
|
||||
"""Generate a valid Fernet key from the session secret."""
|
||||
import base64
|
||||
@@ -66,23 +74,6 @@ class SSHKeyResponse(BaseModel):
|
||||
created_at: datetime
|
||||
|
||||
|
||||
class SignPayloadRequest(BaseModel):
|
||||
payload: str
|
||||
|
||||
|
||||
class SignatureResponse(BaseModel):
|
||||
signature: str
|
||||
|
||||
|
||||
class VerifySignatureRequest(BaseModel):
|
||||
payload: str
|
||||
signature: str
|
||||
|
||||
|
||||
class VerifySignatureResponse(BaseModel):
|
||||
valid: bool
|
||||
|
||||
|
||||
@router.post(
|
||||
"",
|
||||
response_model=SSHKeyResponse,
|
||||
@@ -175,80 +166,3 @@ async def delete_ssh_key(
|
||||
|
||||
await session.delete(ssh_key)
|
||||
await session.commit()
|
||||
|
||||
|
||||
@router.post(
|
||||
"/{key_id}/sign",
|
||||
response_model=SignatureResponse,
|
||||
summary="Sign payload",
|
||||
description="Sign a payload using the SSH private key.",
|
||||
)
|
||||
async def sign_payload(
|
||||
key_id: uuid.UUID,
|
||||
data: SignPayloadRequest,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> SignatureResponse:
|
||||
"""Sign a payload with an SSH key.
|
||||
|
||||
Args:
|
||||
key_id: UUID of the SSH key to use for signing.
|
||||
data: Sign request containing the payload string.
|
||||
user_id: ID of the authenticated user.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
Base64-encoded Ed25519 signature.
|
||||
"""
|
||||
user = await _get_user(session, user_id)
|
||||
ssh_key = await session.get(SSHKey, key_id)
|
||||
if ssh_key is None or ssh_key.user_id != user.id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ssh key not found")
|
||||
|
||||
fernet = _get_fernet()
|
||||
private_key_pem = fernet.decrypt(ssh_key.private_key_encrypted.encode()).decode()
|
||||
|
||||
private_key = serialization.load_ssh_private_key(
|
||||
private_key_pem.encode(), password=None
|
||||
)
|
||||
|
||||
signature = private_key.sign(data.payload.encode())
|
||||
return SignatureResponse(signature=base64.b64encode(signature).decode())
|
||||
|
||||
|
||||
@router.post(
|
||||
"/{key_id}/verify",
|
||||
response_model=VerifySignatureResponse,
|
||||
summary="Verify signature",
|
||||
description="Verify a signature against a payload using the SSH public key.",
|
||||
)
|
||||
async def verify_signature(
|
||||
key_id: uuid.UUID,
|
||||
data: VerifySignatureRequest,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> VerifySignatureResponse:
|
||||
"""Verify a signature with an SSH key's public key.
|
||||
|
||||
Args:
|
||||
key_id: UUID of the SSH key to use for verification.
|
||||
data: Verify request containing payload and base64-encoded signature.
|
||||
user_id: ID of the authenticated user.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
Whether the signature is valid.
|
||||
"""
|
||||
user = await _get_user(session, user_id)
|
||||
ssh_key = await session.get(SSHKey, key_id)
|
||||
if ssh_key is None or ssh_key.user_id != user.id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ssh key not found")
|
||||
|
||||
public_key = serialization.load_ssh_public_key(ssh_key.public_key.encode())
|
||||
|
||||
try:
|
||||
signature = base64.b64decode(data.signature)
|
||||
public_key.verify(signature, data.payload.encode())
|
||||
return VerifySignatureResponse(valid=True)
|
||||
except Exception:
|
||||
return VerifySignatureResponse(valid=False)
|
||||
|
||||
+27
-671
@@ -1,83 +1,42 @@
|
||||
"""WebSocket terminal endpoint for tool instances."""
|
||||
|
||||
import asyncio
|
||||
import json
|
||||
import logging
|
||||
import uuid
|
||||
from contextlib import suppress
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, WebSocket, status
|
||||
from sqlalchemy import select
|
||||
from fastapi import APIRouter, Depends, HTTPException, WebSocket, WebSocketDisconnect, status
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
from starlette.websockets import WebSocketDisconnect
|
||||
|
||||
from src.auth.dependencies import get_current_user_id, get_db_session
|
||||
from src.models.terminal_session import TerminalSessionModel
|
||||
from src.auth.dependencies import get_db_session
|
||||
from src.models.tool_instance import ToolInstance
|
||||
from src.models.tool_type import ToolType
|
||||
from src.services.terminal_manager import MaxSessionsExceededError, terminal_manager
|
||||
from src.services.terminal_manager import terminal_manager
|
||||
|
||||
router = APIRouter()
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class SessionRef:
|
||||
"""Mutable reference to a terminal session, allowing updates during reset."""
|
||||
|
||||
def __init__(self, session, slot_session_id: str | None = None):
|
||||
self.session = session
|
||||
self.slot_session_id = slot_session_id or session.session_id
|
||||
|
||||
|
||||
@router.websocket(
|
||||
"/ws/tool-instances/{instance_id}/terminal",
|
||||
)
|
||||
async def terminal_websocket_default(
|
||||
async def terminal_websocket(
|
||||
websocket: WebSocket,
|
||||
instance_id: str,
|
||||
db_session: AsyncSession = Depends(get_db_session),
|
||||
) -> None:
|
||||
"""WebSocket endpoint for terminal access (default session alias).
|
||||
"""WebSocket endpoint for terminal access to a tool instance.
|
||||
|
||||
Backward-compatible route that maps to the default session.
|
||||
"""
|
||||
await _handle_terminal_websocket(websocket, instance_id, None, db_session)
|
||||
|
||||
|
||||
@router.websocket(
|
||||
"/ws/tool-instances/{instance_id}/terminal/{session_id}",
|
||||
)
|
||||
async def terminal_websocket_specific(
|
||||
websocket: WebSocket,
|
||||
instance_id: str,
|
||||
session_id: str,
|
||||
db_session: AsyncSession = Depends(get_db_session),
|
||||
) -> None:
|
||||
"""WebSocket endpoint for a specific terminal session."""
|
||||
await _handle_terminal_websocket(websocket, instance_id, session_id, db_session)
|
||||
|
||||
|
||||
async def _handle_terminal_websocket(
|
||||
websocket: WebSocket,
|
||||
instance_id: str,
|
||||
target_session_id: str | None,
|
||||
db_session: AsyncSession,
|
||||
) -> None:
|
||||
"""Shared WebSocket handler for terminal sessions.
|
||||
Provides an interactive terminal session inside a running tool instance container.
|
||||
|
||||
Args:
|
||||
websocket: The WebSocket connection.
|
||||
instance_id: UUID string of the tool instance.
|
||||
target_session_id: Specific session ID (slot key). None means default session.
|
||||
db_session: Database session.
|
||||
|
||||
Returns:
|
||||
None. Communicates via WebSocket messages.
|
||||
"""
|
||||
logger.debug(
|
||||
"Terminal WebSocket connection attempt for instance %s (session=%s)",
|
||||
instance_id,
|
||||
target_session_id or "default",
|
||||
)
|
||||
logger.info("Terminal WebSocket connection attempt for instance %s", instance_id)
|
||||
await websocket.accept()
|
||||
logger.debug("Terminal WebSocket accepted for instance %s", instance_id)
|
||||
|
||||
try:
|
||||
# Parse instance_id
|
||||
@@ -90,9 +49,7 @@ async def _handle_terminal_websocket(
|
||||
# Authenticate user from session cookie
|
||||
user_id = await _get_user_from_websocket(websocket, db_session)
|
||||
if user_id is None:
|
||||
logger.warning(
|
||||
"Unauthorized terminal access attempt for instance %s", instance_id
|
||||
)
|
||||
logger.warning("Unauthorized terminal access attempt for instance %s", instance_id)
|
||||
await websocket.close(code=4003, reason="Unauthorized")
|
||||
return
|
||||
|
||||
@@ -104,642 +61,41 @@ async def _handle_terminal_websocket(
|
||||
return
|
||||
|
||||
if instance.owner_id != user_id:
|
||||
logger.warning(
|
||||
"Forbidden terminal access for instance %s by user %s",
|
||||
instance_id,
|
||||
user_id,
|
||||
)
|
||||
logger.warning("Forbidden terminal access for instance %s by user %s", instance_id, user_id)
|
||||
await websocket.close(code=4003, reason="Forbidden")
|
||||
return
|
||||
|
||||
if instance.status != "running" or not instance.container_id:
|
||||
logger.warning(
|
||||
"Instance %s not running (status=%s, container_id=%s)",
|
||||
instance_id,
|
||||
instance.status,
|
||||
instance.container_id,
|
||||
)
|
||||
logger.warning("Instance %s not running (status=%s, container_id=%s)", instance_id, instance.status, instance.container_id)
|
||||
await websocket.close(code=4004, reason="Instance not running")
|
||||
return
|
||||
|
||||
logger.debug("Terminal auth passed for instance %s, user %s", instance_id, user_id)
|
||||
|
||||
# Verify the container actually exists (may have been removed/recreated)
|
||||
from src.services.docker import get_container_status
|
||||
|
||||
container_status = get_container_status(instance.container_id)
|
||||
if container_status["status"] == "not_found":
|
||||
logger.error(
|
||||
"Container %s for instance %s not found (may have been removed)",
|
||||
instance.container_id,
|
||||
instance_id,
|
||||
)
|
||||
await websocket.close(
|
||||
code=4004, reason="Container not found — restart the tool instance"
|
||||
)
|
||||
return
|
||||
|
||||
# Fetch tool type to get startup_command
|
||||
tool_type = await db_session.get(ToolType, instance.tool_type_id)
|
||||
startup_command = tool_type.startup_command if tool_type else None
|
||||
if startup_command:
|
||||
logger.debug(
|
||||
"Using startup command for instance %s: %s",
|
||||
instance_id,
|
||||
startup_command,
|
||||
)
|
||||
|
||||
session = None
|
||||
|
||||
# Get or create terminal session
|
||||
logger.info("Creating terminal session for instance %s (container_id=%s)", instance_id, instance.container_id)
|
||||
# Create terminal session
|
||||
try:
|
||||
if target_session_id is None:
|
||||
# Default session alias
|
||||
session = await terminal_manager.get_or_create_session(
|
||||
instance_uuid,
|
||||
instance.container_id,
|
||||
startup_command=startup_command,
|
||||
)
|
||||
slot_session_id = "default"
|
||||
else:
|
||||
# Specific session
|
||||
session = terminal_manager.get_session(
|
||||
instance_id,
|
||||
target_session_id,
|
||||
)
|
||||
if session is None:
|
||||
# Session not in memory — may have been lost on server restart.
|
||||
# Try to restore from the DB row.
|
||||
db_row = await db_session.get(
|
||||
TerminalSessionModel, uuid.UUID(target_session_id)
|
||||
)
|
||||
if (
|
||||
db_row is not None
|
||||
and db_row.instance_id == instance_uuid
|
||||
and db_row.status != "closed"
|
||||
):
|
||||
logger.info(
|
||||
"Restoring terminal session %s for instance %s from DB",
|
||||
target_session_id,
|
||||
instance_id,
|
||||
)
|
||||
session = await terminal_manager.create_session(
|
||||
instance_uuid,
|
||||
instance.container_id,
|
||||
startup_command=startup_command,
|
||||
name=db_row.name,
|
||||
session_id=target_session_id,
|
||||
)
|
||||
else:
|
||||
logger.warning(
|
||||
"Session %s not found for instance %s",
|
||||
target_session_id,
|
||||
instance_id,
|
||||
)
|
||||
await websocket.close(code=4004, reason="Session not found")
|
||||
return
|
||||
# Determine slot key for reset scoping
|
||||
key = terminal_manager._find_key_by_internal_id(
|
||||
instance_id, session.session_id
|
||||
)
|
||||
slot_session_id = key[1] if key else target_session_id
|
||||
|
||||
logger.debug(
|
||||
"Terminal session ready for instance %s (session_id=%s, slot=%s)",
|
||||
instance_id,
|
||||
session.session_id,
|
||||
slot_session_id,
|
||||
session = await terminal_manager.create_session(
|
||||
instance_uuid,
|
||||
instance.container_id,
|
||||
websocket,
|
||||
)
|
||||
|
||||
# Attach WebSocket to session
|
||||
await terminal_manager.attach_websocket(session, websocket)
|
||||
logger.debug("WebSocket attached to session for instance %s", instance_id)
|
||||
logger.info("Terminal session created successfully for instance %s", instance_id)
|
||||
|
||||
# Send connected status
|
||||
await websocket.send_json({"type": "status", "status": "connected"})
|
||||
logger.debug("Sent connected status for instance %s", instance_id)
|
||||
|
||||
# Use mutable session reference so loops can survive reset
|
||||
session_ref = SessionRef(session, slot_session_id)
|
||||
# Keep connection alive until session ends
|
||||
# The terminal_manager handles I/O loops, we just wait here
|
||||
while session.is_alive() and not session._closed:
|
||||
await asyncio.sleep(0.5)
|
||||
|
||||
# Start I/O loops and heartbeat
|
||||
read_task = asyncio.create_task(_read_loop(session_ref, websocket))
|
||||
write_task = asyncio.create_task(
|
||||
_write_loop(session_ref, websocket, instance_id)
|
||||
)
|
||||
heartbeat_task = asyncio.create_task(_heartbeat_loop(websocket))
|
||||
logger.debug("Started terminal loops for instance %s", instance_id)
|
||||
|
||||
# Wait for either task to complete (indicating disconnect or error)
|
||||
done, pending = await asyncio.wait(
|
||||
[read_task, write_task, heartbeat_task],
|
||||
return_when=asyncio.FIRST_COMPLETED,
|
||||
)
|
||||
|
||||
logger.debug(
|
||||
"Terminal loop completed for instance %s, done=%s",
|
||||
instance_id,
|
||||
len(done),
|
||||
)
|
||||
|
||||
# Cancel remaining tasks
|
||||
for task in pending:
|
||||
task.cancel()
|
||||
|
||||
except WebSocketDisconnect:
|
||||
logger.debug("WebSocket disconnected for instance %s", instance_id)
|
||||
except Exception as exc:
|
||||
logger.error(
|
||||
"Terminal session error for instance %s: %s",
|
||||
instance_id,
|
||||
str(exc),
|
||||
exc_info=True,
|
||||
)
|
||||
with suppress(Exception):
|
||||
await websocket.close(code=4000, reason=f"Error: {exc}")
|
||||
logger.error("Terminal session error for instance %s: %s", instance_id, str(exc), exc_info=True)
|
||||
await websocket.close(code=4000, reason=f"Error: {exc}")
|
||||
finally:
|
||||
# Detach WebSocket, don't kill session
|
||||
with suppress(Exception):
|
||||
if session is not None:
|
||||
await terminal_manager.detach_websocket(session, websocket)
|
||||
logger.debug(
|
||||
"WebSocket detached from session for instance %s", instance_id
|
||||
)
|
||||
|
||||
|
||||
async def _read_loop(session_ref: SessionRef, websocket) -> None:
|
||||
"""Read output from the container and send to WebSocket."""
|
||||
try:
|
||||
while True:
|
||||
session = session_ref.session
|
||||
if not session.is_alive() or session._closed:
|
||||
await asyncio.sleep(0.1)
|
||||
continue
|
||||
data = await session.read_output()
|
||||
if data:
|
||||
try:
|
||||
await websocket.send_bytes(data)
|
||||
except WebSocketDisconnect:
|
||||
break
|
||||
except Exception:
|
||||
break
|
||||
else:
|
||||
await asyncio.sleep(0.01)
|
||||
except Exception:
|
||||
# Cleanup will be handled by the session manager
|
||||
pass
|
||||
|
||||
|
||||
async def _write_loop(session_ref: SessionRef, websocket, instance_id: str) -> None:
|
||||
"""Read input from WebSocket and send to container."""
|
||||
try:
|
||||
while True:
|
||||
session = session_ref.session
|
||||
if not session.is_alive() or session._closed:
|
||||
await asyncio.sleep(0.1)
|
||||
continue
|
||||
message = await websocket.receive()
|
||||
if message["type"] == "websocket.receive":
|
||||
if "bytes" in message:
|
||||
await session.write_input(message["bytes"])
|
||||
elif "text" in message:
|
||||
text = message["text"]
|
||||
if text.startswith("{"):
|
||||
# Control message (JSON)
|
||||
try:
|
||||
ctrl = json.loads(text)
|
||||
msg_type = ctrl.get("type")
|
||||
|
||||
if msg_type == "resize":
|
||||
cols = ctrl.get("cols", 80)
|
||||
rows = ctrl.get("rows", 24)
|
||||
logger.debug(
|
||||
"Received resize message for instance %s: %sx%s",
|
||||
instance_id,
|
||||
cols,
|
||||
rows,
|
||||
)
|
||||
await session.resize(cols, rows)
|
||||
elif msg_type == "reset":
|
||||
# Reset terminal session (scoped to current slot)
|
||||
logger.debug(
|
||||
"Resetting terminal session for instance %s (slot=%s)",
|
||||
session.instance_id,
|
||||
session_ref.slot_session_id,
|
||||
)
|
||||
await websocket.send_json(
|
||||
{"type": "status", "status": "resetting"}
|
||||
)
|
||||
|
||||
# Reset the session scoped to its slot
|
||||
new_session = await terminal_manager.reset_session(
|
||||
session.instance_id,
|
||||
session.container_id,
|
||||
startup_command=session.startup_command,
|
||||
session_id=session_ref.slot_session_id,
|
||||
name=session.name,
|
||||
)
|
||||
|
||||
# Update the mutable session reference
|
||||
session_ref.session = new_session
|
||||
|
||||
# Attach to new session
|
||||
await terminal_manager.attach_websocket(
|
||||
new_session, websocket
|
||||
)
|
||||
await websocket.send_json(
|
||||
{"type": "status", "status": "connected"}
|
||||
)
|
||||
|
||||
# Continue the loop with the new session
|
||||
continue
|
||||
|
||||
except json.JSONDecodeError:
|
||||
# Not a valid JSON control message, treat as regular input
|
||||
await session.write_input(text.encode("utf-8"))
|
||||
else:
|
||||
await session.write_input(text.encode("utf-8"))
|
||||
elif message["type"] == "websocket.disconnect":
|
||||
break
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
|
||||
async def _heartbeat_loop(websocket: WebSocket) -> None:
|
||||
"""Send periodic ping messages to detect disconnections."""
|
||||
try:
|
||||
while True:
|
||||
await asyncio.sleep(30) # Ping every 30 seconds
|
||||
try:
|
||||
await websocket.send_json({"type": "ping"})
|
||||
except Exception:
|
||||
# WebSocket is closed or broken
|
||||
break
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
|
||||
async def _get_terminal_instance(
|
||||
instance_id: uuid.UUID,
|
||||
user_id: uuid.UUID,
|
||||
db_session: AsyncSession,
|
||||
) -> ToolInstance:
|
||||
"""Fetch instance and validate auth, ownership, and running status.
|
||||
|
||||
Args:
|
||||
instance_id: UUID of the tool instance.
|
||||
user_id: ID of the authenticated user.
|
||||
db_session: Database session.
|
||||
|
||||
Returns:
|
||||
The validated ToolInstance.
|
||||
|
||||
Raises:
|
||||
HTTPException: If instance not found, not owned, or not running.
|
||||
"""
|
||||
instance = await db_session.get(ToolInstance, instance_id)
|
||||
if instance is None:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND, detail="Instance not found"
|
||||
)
|
||||
|
||||
if instance.owner_id != user_id:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_403_FORBIDDEN,
|
||||
detail="Not authorized to access this instance",
|
||||
)
|
||||
|
||||
if instance.status != "running" or not instance.container_id:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST, detail="Instance is not running"
|
||||
)
|
||||
|
||||
return instance
|
||||
|
||||
|
||||
@router.get(
|
||||
"/instances/{instance_id}/terminal/sessions",
|
||||
summary="List terminal sessions",
|
||||
description="List terminal sessions for a tool instance with live WebSocket state.",
|
||||
)
|
||||
async def list_terminal_sessions(
|
||||
instance_id: uuid.UUID,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
db_session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""List terminal sessions for an instance.
|
||||
|
||||
Args:
|
||||
instance_id: UUID of the tool instance.
|
||||
user_id: ID of the authenticated user.
|
||||
db_session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with sessions list.
|
||||
"""
|
||||
await _get_terminal_instance(instance_id, user_id, db_session)
|
||||
|
||||
# Query active DB rows for this instance
|
||||
result = await db_session.execute(
|
||||
select(TerminalSessionModel)
|
||||
.where(TerminalSessionModel.instance_id == instance_id)
|
||||
.where(TerminalSessionModel.status != "closed")
|
||||
.order_by(TerminalSessionModel.created_at.asc())
|
||||
)
|
||||
db_rows = result.scalars().all()
|
||||
|
||||
# Build response with live has_websockets flag.
|
||||
# Include DB rows even without in-memory counterparts (e.g. after
|
||||
# server restart) so the frontend can display tabs and reconnect.
|
||||
sessions = []
|
||||
for row in db_rows:
|
||||
live_session = terminal_manager.get_session(str(instance_id), str(row.id))
|
||||
sessions.append(
|
||||
{
|
||||
"id": str(row.id),
|
||||
"name": row.name,
|
||||
"status": row.status,
|
||||
"has_websockets": live_session.has_websockets()
|
||||
if live_session
|
||||
else False,
|
||||
"created_at": row.created_at.isoformat() if row.created_at else None,
|
||||
"last_activity_at": row.last_activity_at.isoformat()
|
||||
if row.last_activity_at
|
||||
else None,
|
||||
}
|
||||
)
|
||||
|
||||
return {"sessions": sessions}
|
||||
|
||||
|
||||
@router.post(
|
||||
"/instances/{instance_id}/terminal/sessions",
|
||||
summary="Create terminal session",
|
||||
description="Create a new terminal session for a running tool instance.",
|
||||
status_code=status.HTTP_201_CREATED,
|
||||
)
|
||||
async def create_terminal_session(
|
||||
instance_id: uuid.UUID,
|
||||
data: dict,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
db_session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Create a new terminal session.
|
||||
|
||||
Args:
|
||||
instance_id: UUID of the tool instance.
|
||||
data: Request body with optional name.
|
||||
user_id: ID of the authenticated user.
|
||||
db_session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with new session details.
|
||||
|
||||
Raises:
|
||||
HTTPException: 409 if max sessions reached.
|
||||
"""
|
||||
instance = await _get_terminal_instance(instance_id, user_id, db_session)
|
||||
assert instance.container_id is not None
|
||||
|
||||
# Fetch tool type to get startup_command
|
||||
tool_type = await db_session.get(ToolType, instance.tool_type_id)
|
||||
startup_command = tool_type.startup_command if tool_type else None
|
||||
|
||||
name = data.get("name")
|
||||
|
||||
try:
|
||||
session = await terminal_manager.create_session(
|
||||
instance_id,
|
||||
instance.container_id,
|
||||
startup_command=startup_command,
|
||||
name=name,
|
||||
)
|
||||
except MaxSessionsExceededError:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_409_CONFLICT,
|
||||
detail="Maximum of 5 terminal sessions reached for this instance",
|
||||
) from None
|
||||
|
||||
return {
|
||||
"id": session.session_id,
|
||||
"name": session.name,
|
||||
"status": session.status,
|
||||
"created_at": session.last_activity,
|
||||
}
|
||||
|
||||
|
||||
@router.delete(
|
||||
"/instances/{instance_id}/terminal/sessions/{session_id}",
|
||||
summary="Close terminal session",
|
||||
description="Close a specific terminal session.",
|
||||
)
|
||||
async def close_terminal_session(
|
||||
instance_id: uuid.UUID,
|
||||
session_id: str,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
db_session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Close a terminal session.
|
||||
|
||||
Args:
|
||||
instance_id: UUID of the tool instance.
|
||||
session_id: ID of the session to close.
|
||||
user_id: ID of the authenticated user.
|
||||
db_session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with closure status.
|
||||
"""
|
||||
await _get_terminal_instance(instance_id, user_id, db_session)
|
||||
|
||||
# Find the session by internal ID to determine its slot key
|
||||
key = terminal_manager._find_key_by_internal_id(str(instance_id), session_id)
|
||||
if (
|
||||
key is None
|
||||
and terminal_manager.get_session(str(instance_id), session_id) is not None
|
||||
):
|
||||
key = (str(instance_id), session_id)
|
||||
|
||||
if key is None:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND, detail="Session not found"
|
||||
)
|
||||
|
||||
await terminal_manager.close_session(key[0], key[1])
|
||||
|
||||
return {"status": "closed", "session_id": session_id}
|
||||
|
||||
|
||||
@router.post(
|
||||
"/instances/{instance_id}/terminal/sessions/{session_id}/reset",
|
||||
summary="Reset terminal session",
|
||||
description="Reset a specific terminal session, killing the current shell and starting fresh.",
|
||||
)
|
||||
async def reset_specific_terminal_session(
|
||||
instance_id: uuid.UUID,
|
||||
session_id: str,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
db_session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Reset a specific terminal session.
|
||||
|
||||
Args:
|
||||
instance_id: UUID of the tool instance.
|
||||
session_id: ID of the session to reset.
|
||||
user_id: ID of the authenticated user.
|
||||
db_session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with reset session details.
|
||||
"""
|
||||
instance = await _get_terminal_instance(instance_id, user_id, db_session)
|
||||
assert instance.container_id is not None
|
||||
|
||||
# Determine slot key for reset
|
||||
key = terminal_manager._find_key_by_internal_id(str(instance_id), session_id)
|
||||
if (
|
||||
key is None
|
||||
and terminal_manager.get_session(str(instance_id), session_id) is not None
|
||||
):
|
||||
key = (str(instance_id), session_id)
|
||||
|
||||
if key is None:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND, detail="Session not found"
|
||||
)
|
||||
|
||||
# Fetch tool type to get startup_command
|
||||
tool_type = await db_session.get(ToolType, instance.tool_type_id)
|
||||
startup_command = tool_type.startup_command if tool_type else None
|
||||
|
||||
# Preserve name if possible
|
||||
live_session = terminal_manager.get_session(str(instance_id), session_id)
|
||||
name = live_session.name if live_session else None
|
||||
|
||||
new_session = await terminal_manager.reset_session(
|
||||
instance_id,
|
||||
instance.container_id,
|
||||
startup_command=startup_command,
|
||||
session_id=key[1],
|
||||
name=name,
|
||||
)
|
||||
|
||||
return {
|
||||
"id": new_session.session_id,
|
||||
"name": new_session.name,
|
||||
"status": new_session.status,
|
||||
}
|
||||
|
||||
|
||||
@router.post(
|
||||
"/instances/{instance_id}/terminal/sessions/{session_id}/rename",
|
||||
summary="Rename terminal session",
|
||||
description="Rename a specific terminal session.",
|
||||
)
|
||||
async def rename_terminal_session(
|
||||
instance_id: uuid.UUID,
|
||||
session_id: str,
|
||||
data: dict,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
db_session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Rename a terminal session.
|
||||
|
||||
Args:
|
||||
instance_id: UUID of the tool instance.
|
||||
session_id: ID of the session to rename.
|
||||
data: Request body with new name.
|
||||
user_id: ID of the authenticated user.
|
||||
db_session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with updated session details.
|
||||
"""
|
||||
await _get_terminal_instance(instance_id, user_id, db_session)
|
||||
|
||||
new_name = data.get("name")
|
||||
if not new_name or not isinstance(new_name, str):
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST, detail="Name is required"
|
||||
)
|
||||
|
||||
# Update in-memory session name if live
|
||||
live_session = terminal_manager.get_session(str(instance_id), session_id)
|
||||
if live_session:
|
||||
live_session.name = new_name
|
||||
|
||||
# Update DB row
|
||||
db_row = await db_session.get(TerminalSessionModel, uuid.UUID(session_id))
|
||||
if db_row is None:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND, detail="Session not found"
|
||||
)
|
||||
|
||||
db_row.name = new_name
|
||||
await db_session.commit()
|
||||
|
||||
return {"id": str(db_row.id), "name": new_name}
|
||||
|
||||
|
||||
@router.post(
|
||||
"/instances/{instance_id}/terminal/reset",
|
||||
summary="Reset terminal session (legacy alias)",
|
||||
description="Reset the default terminal session for a tool instance. Preserved for backward compatibility.",
|
||||
)
|
||||
async def reset_terminal_session(
|
||||
instance_id: uuid.UUID,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
db_session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Reset the default terminal session for an instance (legacy alias).
|
||||
|
||||
Args:
|
||||
instance_id: UUID of the tool instance.
|
||||
user_id: ID of the authenticated user.
|
||||
db_session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with status message.
|
||||
"""
|
||||
instance = await _get_terminal_instance(instance_id, user_id, db_session)
|
||||
assert instance.container_id is not None
|
||||
|
||||
# Fetch tool type to get startup_command
|
||||
tool_type = await db_session.get(ToolType, instance.tool_type_id)
|
||||
startup_command = tool_type.startup_command if tool_type else None
|
||||
|
||||
try:
|
||||
# Reset the default session
|
||||
new_session = await terminal_manager.reset_session(
|
||||
instance_id,
|
||||
instance.container_id,
|
||||
startup_command=startup_command,
|
||||
)
|
||||
|
||||
logger.info(
|
||||
"Terminal session reset for instance %s (new session_id=%s)",
|
||||
instance_id,
|
||||
new_session.session_id,
|
||||
)
|
||||
|
||||
return {
|
||||
"status": "success",
|
||||
"message": "Terminal session reset successfully",
|
||||
"instance_id": str(instance_id),
|
||||
"session_id": new_session.session_id,
|
||||
}
|
||||
except Exception as exc:
|
||||
logger.error(
|
||||
"Failed to reset terminal session for instance %s: %s",
|
||||
instance_id,
|
||||
str(exc),
|
||||
exc_info=True,
|
||||
)
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
|
||||
detail=f"Failed to reset terminal session: {exc}",
|
||||
) from exc
|
||||
|
||||
|
||||
async def _get_user_from_websocket(
|
||||
websocket: WebSocket,
|
||||
db_session: AsyncSession,
|
||||
|
||||
@@ -0,0 +1,322 @@
|
||||
"""Tool configuration API endpoints."""
|
||||
|
||||
import logging
|
||||
import uuid
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, status
|
||||
from pydantic import BaseModel, Field, field_validator
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.auth.dependencies import get_current_user_id, get_db_session
|
||||
from src.models.tool_config import ToolConfig
|
||||
from src.models.tool_type import ToolType
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
router = APIRouter(prefix="/tool-configs", tags=["tool-configs"])
|
||||
|
||||
|
||||
class ToolConfigCreate(BaseModel):
|
||||
tool_type_id: str = Field(description="UUID of the tool type")
|
||||
project_id: str | None = Field(default=None, description="Optional project ID for project-scoped config")
|
||||
key: str = Field(description="Config key name")
|
||||
value: str = Field(description="Config value")
|
||||
config_type: str = Field(default="env", description="Type: env or file")
|
||||
file_path: str | None = Field(default=None, description="File path for file-type configs")
|
||||
port_override: int | None = Field(default=None, description="Port override (1-65535)")
|
||||
start_command: str | None = Field(default=None, description="Override container start command")
|
||||
working_directory: str | None = Field(default=None, description="Working directory inside container")
|
||||
environment_variables: dict | None = Field(default=None, description="Environment variables as JSON object")
|
||||
volumes: list[dict] | None = Field(default=None, description="Volume mounts as JSON array")
|
||||
|
||||
@field_validator("port_override")
|
||||
@classmethod
|
||||
def validate_port(cls, v: int | None) -> int | None:
|
||||
if v is None:
|
||||
return v
|
||||
if v < 1 or v > 65535:
|
||||
raise ValueError("Port must be between 1 and 65535")
|
||||
return v
|
||||
|
||||
@field_validator("environment_variables")
|
||||
@classmethod
|
||||
def validate_env_vars(cls, v: dict | None) -> dict | None:
|
||||
if v is None:
|
||||
return v
|
||||
if not isinstance(v, dict):
|
||||
raise ValueError("environment_variables must be a JSON object")
|
||||
return v
|
||||
|
||||
@field_validator("volumes")
|
||||
@classmethod
|
||||
def validate_volumes(cls, v: list | None) -> list | None:
|
||||
if v is None:
|
||||
return v
|
||||
if not isinstance(v, list):
|
||||
raise ValueError("volumes must be a JSON array")
|
||||
for i, vol in enumerate(v):
|
||||
if not isinstance(vol, dict):
|
||||
raise ValueError(f"Volume at index {i} must be an object")
|
||||
if "source" not in vol:
|
||||
raise ValueError(f"Volume at index {i} must have 'source' field")
|
||||
if "target" not in vol:
|
||||
raise ValueError(f"Volume at index {i} must have 'target' field")
|
||||
return v
|
||||
|
||||
|
||||
class ToolConfigUpdate(BaseModel):
|
||||
key: str | None = Field(default=None, description="Config key name")
|
||||
value: str | None = Field(default=None, description="Config value")
|
||||
config_type: str | None = Field(default=None, description="Type: env or file")
|
||||
file_path: str | None = Field(default=None, description="File path for file-type configs")
|
||||
port_override: int | None = Field(default=None, description="Port override (1-65535)")
|
||||
start_command: str | None = Field(default=None, description="Override container start command")
|
||||
working_directory: str | None = Field(default=None, description="Working directory inside container")
|
||||
environment_variables: dict | None = Field(default=None, description="Environment variables as JSON object")
|
||||
volumes: list[dict] | None = Field(default=None, description="Volume mounts as JSON array")
|
||||
|
||||
@field_validator("port_override")
|
||||
@classmethod
|
||||
def validate_port(cls, v: int | None) -> int | None:
|
||||
if v is None:
|
||||
return v
|
||||
if v < 1 or v > 65535:
|
||||
raise ValueError("Port must be between 1 and 65535")
|
||||
return v
|
||||
|
||||
@field_validator("environment_variables")
|
||||
@classmethod
|
||||
def validate_env_vars(cls, v: dict | None) -> dict | None:
|
||||
if v is None:
|
||||
return v
|
||||
if not isinstance(v, dict):
|
||||
raise ValueError("environment_variables must be a JSON object")
|
||||
return v
|
||||
|
||||
@field_validator("volumes")
|
||||
@classmethod
|
||||
def validate_volumes(cls, v: list | None) -> list | None:
|
||||
if v is None:
|
||||
return v
|
||||
if not isinstance(v, list):
|
||||
raise ValueError("volumes must be a JSON array")
|
||||
for i, vol in enumerate(v):
|
||||
if not isinstance(vol, dict):
|
||||
raise ValueError(f"Volume at index {i} must be an object")
|
||||
if "source" not in vol:
|
||||
raise ValueError(f"Volume at index {i} must have 'source' field")
|
||||
if "target" not in vol:
|
||||
raise ValueError(f"Volume at index {i} must have 'target' field")
|
||||
return v
|
||||
|
||||
|
||||
class ToolConfigResponse(BaseModel):
|
||||
id: str
|
||||
tool_type_id: str
|
||||
project_id: str | None
|
||||
key: str
|
||||
value: str
|
||||
config_type: str
|
||||
file_path: str | None
|
||||
port_override: int | None
|
||||
start_command: str | None
|
||||
working_directory: str | None
|
||||
environment_variables: dict | None
|
||||
volumes: list[dict] | None
|
||||
|
||||
|
||||
@router.get("", summary="List tool configs", description="Get all tool configs for the current user.")
|
||||
async def list_configs(
|
||||
tool_type_id: str | None = None,
|
||||
project_id: str | None = None,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> list:
|
||||
"""List tool configs for the current user."""
|
||||
query = select(ToolConfig).where(ToolConfig.user_id == user_id)
|
||||
|
||||
if tool_type_id:
|
||||
query = query.where(ToolConfig.tool_type_id == uuid.UUID(tool_type_id))
|
||||
if project_id:
|
||||
query = query.where(ToolConfig.project_id == uuid.UUID(project_id))
|
||||
else:
|
||||
# If no project specified, get only global configs (project_id is None)
|
||||
query = query.where(ToolConfig.project_id.is_(None))
|
||||
|
||||
result = await session.execute(query)
|
||||
configs = result.scalars().all()
|
||||
|
||||
return [
|
||||
{
|
||||
"id": str(c.id),
|
||||
"tool_type_id": str(c.tool_type_id),
|
||||
"project_id": str(c.project_id) if c.project_id else None,
|
||||
"key": c.key,
|
||||
"value": c.value,
|
||||
"config_type": c.config_type,
|
||||
"file_path": c.file_path,
|
||||
"port_override": c.port_override,
|
||||
"start_command": c.start_command,
|
||||
"working_directory": c.working_directory,
|
||||
"environment_variables": c.environment_variables,
|
||||
"volumes": c.volumes,
|
||||
}
|
||||
for c in configs
|
||||
]
|
||||
|
||||
|
||||
@router.post("", summary="Create tool config", description="Create a new tool config.", status_code=status.HTTP_201_CREATED)
|
||||
async def create_config(
|
||||
data: ToolConfigCreate,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Create a tool config."""
|
||||
# Verify tool type exists
|
||||
tool_type = await session.get(ToolType, uuid.UUID(data.tool_type_id))
|
||||
if tool_type is None:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found")
|
||||
|
||||
# Check for existing config with same key
|
||||
query = select(ToolConfig).where(
|
||||
ToolConfig.user_id == user_id,
|
||||
ToolConfig.tool_type_id == uuid.UUID(data.tool_type_id),
|
||||
ToolConfig.key == data.key,
|
||||
)
|
||||
if data.project_id:
|
||||
query = query.where(ToolConfig.project_id == uuid.UUID(data.project_id))
|
||||
else:
|
||||
query = query.where(ToolConfig.project_id.is_(None))
|
||||
|
||||
existing = await session.scalar(query)
|
||||
if existing:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_409_CONFLICT,
|
||||
detail=f"config with key '{data.key}' already exists"
|
||||
)
|
||||
|
||||
config = ToolConfig(
|
||||
user_id=user_id,
|
||||
tool_type_id=uuid.UUID(data.tool_type_id),
|
||||
project_id=uuid.UUID(data.project_id) if data.project_id else None,
|
||||
key=data.key,
|
||||
value=data.value,
|
||||
config_type=data.config_type,
|
||||
file_path=data.file_path,
|
||||
port_override=data.port_override,
|
||||
start_command=data.start_command,
|
||||
working_directory=data.working_directory,
|
||||
environment_variables=data.environment_variables,
|
||||
volumes=data.volumes,
|
||||
)
|
||||
session.add(config)
|
||||
await session.commit()
|
||||
await session.refresh(config)
|
||||
|
||||
return {
|
||||
"id": str(config.id),
|
||||
"tool_type_id": str(config.tool_type_id),
|
||||
"project_id": str(config.project_id) if config.project_id else None,
|
||||
"key": config.key,
|
||||
"value": config.value,
|
||||
"config_type": config.config_type,
|
||||
"file_path": config.file_path,
|
||||
"port_override": config.port_override,
|
||||
"start_command": config.start_command,
|
||||
"working_directory": config.working_directory,
|
||||
"environment_variables": config.environment_variables,
|
||||
"volumes": config.volumes,
|
||||
}
|
||||
|
||||
|
||||
@router.put("/{config_id}", summary="Update tool config", description="Update an existing tool config.")
|
||||
async def update_config(
|
||||
config_id: uuid.UUID,
|
||||
data: ToolConfigUpdate,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Update a tool config."""
|
||||
config = await session.get(ToolConfig, config_id)
|
||||
if config is None or config.user_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="config not found")
|
||||
|
||||
if data.key is not None:
|
||||
config.key = data.key
|
||||
if data.value is not None:
|
||||
config.value = data.value
|
||||
if data.config_type is not None:
|
||||
config.config_type = data.config_type
|
||||
if data.file_path is not None:
|
||||
config.file_path = data.file_path
|
||||
if data.port_override is not None:
|
||||
config.port_override = data.port_override
|
||||
if data.start_command is not None:
|
||||
config.start_command = data.start_command
|
||||
if data.working_directory is not None:
|
||||
config.working_directory = data.working_directory
|
||||
if data.environment_variables is not None:
|
||||
config.environment_variables = data.environment_variables
|
||||
if data.volumes is not None:
|
||||
config.volumes = data.volumes
|
||||
|
||||
await session.commit()
|
||||
await session.refresh(config)
|
||||
|
||||
return {
|
||||
"id": str(config.id),
|
||||
"tool_type_id": str(config.tool_type_id),
|
||||
"project_id": str(config.project_id) if config.project_id else None,
|
||||
"key": config.key,
|
||||
"value": config.value,
|
||||
"config_type": config.config_type,
|
||||
"file_path": config.file_path,
|
||||
"port_override": config.port_override,
|
||||
"start_command": config.start_command,
|
||||
"working_directory": config.working_directory,
|
||||
"environment_variables": config.environment_variables,
|
||||
"volumes": config.volumes,
|
||||
}
|
||||
|
||||
|
||||
@router.get("/defaults/{tool_type_id}", summary="Get default configs", description="Get suggested default configs for a tool type.")
|
||||
async def get_default_configs(
|
||||
tool_type_id: str,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Get suggested default configs for a tool type."""
|
||||
tool_type = await session.get(ToolType, uuid.UUID(tool_type_id))
|
||||
if tool_type is None:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found")
|
||||
|
||||
# Return suggested defaults based on required_variables
|
||||
defaults = []
|
||||
for var in tool_type.required_variables:
|
||||
defaults.append({
|
||||
"key": var,
|
||||
"value": "",
|
||||
"config_type": "env",
|
||||
"description": f"Required variable: {var}",
|
||||
})
|
||||
|
||||
return {
|
||||
"tool_type_id": tool_type_id,
|
||||
"suggested_configs": defaults,
|
||||
}
|
||||
|
||||
|
||||
@router.delete("/{config_id}", summary="Delete tool config", description="Delete a tool config.")
|
||||
async def delete_config(
|
||||
config_id: uuid.UUID,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> None:
|
||||
"""Delete a tool config."""
|
||||
config = await session.get(ToolConfig, config_id)
|
||||
if config is None or config.user_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="config not found")
|
||||
|
||||
await session.delete(config)
|
||||
await session.commit()
|
||||
@@ -1,424 +0,0 @@
|
||||
"""Tool definition API endpoints."""
|
||||
|
||||
import logging
|
||||
import uuid
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, status
|
||||
from pydantic import BaseModel, Field
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.auth.dependencies import get_current_user_id, get_db_session
|
||||
from src.models.tool_definition_manifest import ToolDefinitionManifest
|
||||
from src.models.tool_type import ToolType
|
||||
from src.services.manifest_compiler import (
|
||||
compile_compose,
|
||||
compile_dockerfile,
|
||||
compile_entrypoint,
|
||||
compute_image_tag,
|
||||
deep_merge,
|
||||
resolve_base,
|
||||
)
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
router = APIRouter(prefix="/tool-definitions", tags=["tool-definitions"])
|
||||
|
||||
|
||||
class CreateToolDefinitionRequest(BaseModel):
|
||||
"""Request body for creating a tool definition manifest."""
|
||||
|
||||
model_config = {"extra": "ignore"}
|
||||
|
||||
name: str = Field(description="Unique identifier (kebab-case)")
|
||||
display_name: str = Field(description="Human-readable name")
|
||||
description: str | None = Field(default=None)
|
||||
category: str = Field(default="development")
|
||||
interface_type: str = Field(default="terminal", description="web or terminal")
|
||||
base_image: str | None = Field(default=None, description="Direct base image")
|
||||
base_definition_id: str | None = Field(
|
||||
default=None, description="Reference to a base definition"
|
||||
)
|
||||
base_version: str = Field(default="latest")
|
||||
manifest: dict = Field(description="The full manifest JSON")
|
||||
|
||||
|
||||
class UpdateToolDefinitionRequest(BaseModel):
|
||||
"""Request body for updating a tool definition manifest."""
|
||||
|
||||
model_config = {"extra": "ignore"}
|
||||
|
||||
display_name: str | None = Field(default=None)
|
||||
description: str | None = Field(default=None)
|
||||
category: str | None = Field(default=None)
|
||||
manifest: dict | None = Field(default=None)
|
||||
base_version: str | None = Field(default=None)
|
||||
|
||||
|
||||
@router.post(
|
||||
"",
|
||||
summary="Create tool definition",
|
||||
description="Create a new tool definition manifest.",
|
||||
)
|
||||
async def create_tool_definition(
|
||||
data: CreateToolDefinitionRequest,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Create a new tool definition manifest.
|
||||
|
||||
Args:
|
||||
data: Manifest data.
|
||||
user_id: Authenticated user ID.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with created definition details.
|
||||
"""
|
||||
# Validate base reference
|
||||
if not data.base_image and not data.base_definition_id:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail="Either base_image or base_definition_id is required",
|
||||
)
|
||||
|
||||
base_def_id = None
|
||||
if data.base_definition_id:
|
||||
try:
|
||||
base_def_id = uuid.UUID(data.base_definition_id)
|
||||
except ValueError:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"Invalid base_definition_id: {data.base_definition_id}",
|
||||
)
|
||||
|
||||
base_def = await session.get(ToolDefinitionManifest, base_def_id)
|
||||
if not base_def:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND,
|
||||
detail=f"Base definition not found: {data.base_definition_id}",
|
||||
)
|
||||
if not base_def.is_base:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail="Referenced definition is not a base definition",
|
||||
)
|
||||
|
||||
# Check name uniqueness
|
||||
existing = await session.execute(
|
||||
select(ToolDefinitionManifest).where(ToolDefinitionManifest.name == data.name)
|
||||
)
|
||||
if existing.scalar_one_or_none():
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_409_CONFLICT,
|
||||
detail=f"Tool definition '{data.name}' already exists",
|
||||
)
|
||||
|
||||
definition = ToolDefinitionManifest(
|
||||
name=data.name,
|
||||
display_name=data.display_name,
|
||||
description=data.description,
|
||||
category=data.category,
|
||||
interface_type=data.interface_type,
|
||||
base_image=data.base_image,
|
||||
base_definition_id=base_def_id,
|
||||
base_version=data.base_version,
|
||||
manifest=data.manifest,
|
||||
created_by_id=user_id,
|
||||
)
|
||||
|
||||
session.add(definition)
|
||||
await session.commit()
|
||||
await session.refresh(definition)
|
||||
|
||||
logger.info("Created tool definition %s (%s)", definition.id, definition.name)
|
||||
|
||||
return {
|
||||
"id": str(definition.id),
|
||||
"name": definition.name,
|
||||
"display_name": definition.display_name,
|
||||
"description": definition.description,
|
||||
"category": definition.category,
|
||||
"interface_type": definition.interface_type,
|
||||
"base_image": definition.base_image,
|
||||
"base_definition_id": str(definition.base_definition_id)
|
||||
if definition.base_definition_id
|
||||
else None,
|
||||
"base_version": definition.base_version,
|
||||
"manifest": definition.manifest,
|
||||
"is_base": definition.is_base,
|
||||
"created_at": definition.created_at.isoformat(),
|
||||
}
|
||||
|
||||
|
||||
@router.get(
|
||||
"",
|
||||
summary="List tool definitions",
|
||||
description="List all tool definition manifests.",
|
||||
)
|
||||
async def list_tool_definitions(
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
include_bases: bool = True,
|
||||
) -> dict:
|
||||
"""List all tool definition manifests.
|
||||
|
||||
Args:
|
||||
user_id: Authenticated user ID.
|
||||
session: Database session.
|
||||
include_bases: Whether to include base definitions.
|
||||
|
||||
Returns:
|
||||
Dictionary containing list of definitions.
|
||||
"""
|
||||
query = select(ToolDefinitionManifest)
|
||||
if not include_bases:
|
||||
query = query.where(ToolDefinitionManifest.is_base == False)
|
||||
|
||||
result = await session.execute(
|
||||
query.order_by(ToolDefinitionManifest.created_at.desc())
|
||||
)
|
||||
definitions = result.scalars().all()
|
||||
|
||||
return {
|
||||
"definitions": [
|
||||
{
|
||||
"id": str(d.id),
|
||||
"name": d.name,
|
||||
"display_name": d.display_name,
|
||||
"description": d.description,
|
||||
"category": d.category,
|
||||
"interface_type": d.interface_type,
|
||||
"is_base": d.is_base,
|
||||
"base_image": d.base_image,
|
||||
"base_definition_id": str(d.base_definition_id)
|
||||
if d.base_definition_id
|
||||
else None,
|
||||
"base_version": d.base_version,
|
||||
"version": d.version,
|
||||
"created_at": d.created_at.isoformat(),
|
||||
}
|
||||
for d in definitions
|
||||
]
|
||||
}
|
||||
|
||||
|
||||
@router.get(
|
||||
"/{definition_id}",
|
||||
summary="Get tool definition",
|
||||
description="Get a specific tool definition manifest.",
|
||||
)
|
||||
async def get_tool_definition(
|
||||
definition_id: uuid.UUID,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Get a specific tool definition manifest.
|
||||
|
||||
Args:
|
||||
definition_id: UUID of the definition.
|
||||
user_id: Authenticated user ID.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with definition details.
|
||||
"""
|
||||
definition = await session.get(ToolDefinitionManifest, definition_id)
|
||||
if not definition:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND,
|
||||
detail=f"Tool definition not found: {definition_id}",
|
||||
)
|
||||
|
||||
return {
|
||||
"id": str(definition.id),
|
||||
"name": definition.name,
|
||||
"display_name": definition.display_name,
|
||||
"description": definition.description,
|
||||
"category": definition.category,
|
||||
"interface_type": definition.interface_type,
|
||||
"base_image": definition.base_image,
|
||||
"base_definition_id": str(definition.base_definition_id)
|
||||
if definition.base_definition_id
|
||||
else None,
|
||||
"base_version": definition.base_version,
|
||||
"manifest": definition.manifest,
|
||||
"dockerfile_cache": definition.dockerfile_cache,
|
||||
"compose_cache": definition.compose_cache,
|
||||
"version": definition.version,
|
||||
"is_base": definition.is_base,
|
||||
"created_at": definition.created_at.isoformat(),
|
||||
"updated_at": definition.updated_at.isoformat(),
|
||||
}
|
||||
|
||||
|
||||
@router.put(
|
||||
"/{definition_id}",
|
||||
summary="Update tool definition",
|
||||
description="Update a tool definition manifest.",
|
||||
)
|
||||
async def update_tool_definition(
|
||||
definition_id: uuid.UUID,
|
||||
data: UpdateToolDefinitionRequest,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Update a tool definition manifest.
|
||||
|
||||
Args:
|
||||
definition_id: UUID of the definition.
|
||||
data: Update data.
|
||||
user_id: Authenticated user ID.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with updated definition details.
|
||||
"""
|
||||
definition = await session.get(ToolDefinitionManifest, definition_id)
|
||||
if not definition:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND,
|
||||
detail=f"Tool definition not found: {definition_id}",
|
||||
)
|
||||
|
||||
if data.display_name is not None:
|
||||
definition.display_name = data.display_name
|
||||
if data.description is not None:
|
||||
definition.description = data.description
|
||||
if data.category is not None:
|
||||
definition.category = data.category
|
||||
if data.manifest is not None:
|
||||
definition.manifest = data.manifest
|
||||
if data.base_version is not None:
|
||||
definition.base_version = data.base_version
|
||||
|
||||
await session.commit()
|
||||
await session.refresh(definition)
|
||||
|
||||
logger.info("Updated tool definition %s (%s)", definition.id, definition.name)
|
||||
|
||||
return {
|
||||
"id": str(definition.id),
|
||||
"name": definition.name,
|
||||
"display_name": definition.display_name,
|
||||
"manifest": definition.manifest,
|
||||
"updated_at": definition.updated_at.isoformat(),
|
||||
}
|
||||
|
||||
|
||||
@router.delete(
|
||||
"/{definition_id}",
|
||||
summary="Delete tool definition",
|
||||
description="Delete a tool definition manifest.",
|
||||
)
|
||||
async def delete_tool_definition(
|
||||
definition_id: uuid.UUID,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Delete a tool definition manifest.
|
||||
|
||||
Args:
|
||||
definition_id: UUID of the definition.
|
||||
user_id: Authenticated user ID.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with deletion status.
|
||||
"""
|
||||
definition = await session.get(ToolDefinitionManifest, definition_id)
|
||||
if not definition:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND,
|
||||
detail=f"Tool definition not found: {definition_id}",
|
||||
)
|
||||
|
||||
# Check if any tool types reference this manifest
|
||||
result = await session.execute(
|
||||
select(ToolType).where(ToolType.manifest_id == definition_id)
|
||||
)
|
||||
referencing = result.scalars().all()
|
||||
if referencing:
|
||||
tool_names = ", ".join(t.name for t in referencing)
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_409_CONFLICT,
|
||||
detail=f"Cannot delete: referenced by tool types: {tool_names}",
|
||||
)
|
||||
|
||||
await session.delete(definition)
|
||||
await session.commit()
|
||||
|
||||
logger.info("Deleted tool definition %s (%s)", definition.id, definition.name)
|
||||
|
||||
return {"status": "deleted", "id": str(definition_id)}
|
||||
|
||||
|
||||
@router.post(
|
||||
"/{definition_id}/compile",
|
||||
summary="Compile tool definition",
|
||||
description="Compile a manifest to Dockerfile + Compose preview without building.",
|
||||
)
|
||||
async def compile_tool_definition(
|
||||
definition_id: uuid.UUID,
|
||||
user_id: uuid.UUID = Depends(get_current_user_id),
|
||||
session: AsyncSession = Depends(get_db_session),
|
||||
) -> dict:
|
||||
"""Compile a manifest to Dockerfile + Compose preview.
|
||||
|
||||
Args:
|
||||
definition_id: UUID of the definition.
|
||||
user_id: Authenticated user ID.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
Dictionary with compiled Dockerfile, Compose, and image tag.
|
||||
"""
|
||||
definition = await session.get(ToolDefinitionManifest, definition_id)
|
||||
if not definition:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND,
|
||||
detail=f"Tool definition not found: {definition_id}",
|
||||
)
|
||||
|
||||
manifest = dict(definition.manifest)
|
||||
|
||||
# Resolve base if referenced
|
||||
if definition.base_definition_id:
|
||||
base_def = await session.get(
|
||||
ToolDefinitionManifest, definition.base_definition_id
|
||||
)
|
||||
if base_def:
|
||||
base_manifest = dict(base_def.manifest)
|
||||
manifest = resolve_base(deep_merge(base_manifest, manifest))
|
||||
|
||||
# Compile
|
||||
dockerfile = compile_dockerfile(manifest)
|
||||
entrypoint = compile_entrypoint(manifest)
|
||||
image_tag = compute_image_tag(definition.name, manifest)
|
||||
|
||||
# Dummy compose with placeholder variables
|
||||
dummy_vars = {
|
||||
"IMAGE_TAG": image_tag,
|
||||
"INSTANCE_NAME": f"{definition.name}-preview",
|
||||
"INSTANCE_DIR": "/data/instances/preview",
|
||||
"REPO_PATH": "/data/repos/preview",
|
||||
"SSH_PATH": "/data/instances/preview/.ssh",
|
||||
"TOOL_PORT": "8080",
|
||||
"EXTRA_ENV": {},
|
||||
"EXTRA_VOLUMES": [],
|
||||
}
|
||||
compose = compile_compose(manifest, dummy_vars)
|
||||
|
||||
# Update cache
|
||||
definition.dockerfile_cache = dockerfile
|
||||
definition.compose_cache = compose
|
||||
await session.commit()
|
||||
|
||||
return {
|
||||
"id": str(definition.id),
|
||||
"name": definition.name,
|
||||
"dockerfile": dockerfile,
|
||||
"entrypoint": entrypoint,
|
||||
"compose": compose,
|
||||
"image_tag": image_tag,
|
||||
}
|
||||
+231
-1824
File diff suppressed because it is too large
Load Diff
+192
-184
@@ -1,23 +1,27 @@
|
||||
import uuid
|
||||
from datetime import datetime
|
||||
|
||||
import yaml
|
||||
from fastapi import APIRouter, Depends, HTTPException, status
|
||||
from pydantic import BaseModel, ConfigDict, field_validator, model_validator
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.api.tool_types_validation import (
|
||||
check_port_exposed,
|
||||
validate_compose_yaml,
|
||||
validate_required_variables,
|
||||
)
|
||||
from src.auth.dependencies import _get_user, get_current_user_id, get_db_session
|
||||
from src.auth.dependencies import get_current_user_id, get_db_session
|
||||
from src.models.tool_type import ToolType
|
||||
from src.models.user import User
|
||||
|
||||
router = APIRouter(prefix="/tool-types", tags=["tool-types"])
|
||||
|
||||
|
||||
async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
|
||||
"""Fetch a user by ID or raise 401 if not found."""
|
||||
user = await session.get(User, user_id)
|
||||
if user is None:
|
||||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
|
||||
return user
|
||||
|
||||
|
||||
async def _require_admin(user: User) -> None:
|
||||
"""Check if user has admin privileges.
|
||||
|
||||
@@ -33,26 +37,21 @@ class ToolTypeCreate(BaseModel):
|
||||
name: str
|
||||
display_name: str
|
||||
description: str | None = None
|
||||
default_port: int = 0
|
||||
default_port: int
|
||||
definition_type: str = "compose"
|
||||
manifest_id: uuid.UUID | None = None
|
||||
compose_template: str | None = None
|
||||
dockerfile_template: str | None = None
|
||||
build_context: dict | None = None
|
||||
readiness_probe: dict | None = None
|
||||
startup_command: str | None = None
|
||||
required_variables: list[str] = []
|
||||
category: str = "other"
|
||||
interface_type: str = "web"
|
||||
requires_port: bool = True
|
||||
interfaces: list[str] = ["web"]
|
||||
|
||||
@field_validator("definition_type")
|
||||
@classmethod
|
||||
def validate_definition_type(cls, v: str) -> str:
|
||||
if v not in ("compose", "dockerfile", "manifest"):
|
||||
raise ValueError(
|
||||
"definition_type must be 'compose', 'dockerfile', or 'manifest'"
|
||||
)
|
||||
if v not in ("compose", "dockerfile"):
|
||||
raise ValueError("definition_type must be 'compose' or 'dockerfile'")
|
||||
return v
|
||||
|
||||
@field_validator("compose_template")
|
||||
@@ -61,13 +60,24 @@ class ToolTypeCreate(BaseModel):
|
||||
data = info.data
|
||||
if data.get("definition_type") != "compose":
|
||||
return v
|
||||
|
||||
if v is None or not v.strip():
|
||||
raise ValueError(
|
||||
"compose_template is required when definition_type is 'compose'"
|
||||
)
|
||||
|
||||
validate_compose_yaml(v)
|
||||
|
||||
if v is None:
|
||||
raise ValueError("compose_template is required when definition_type is 'compose'")
|
||||
|
||||
try:
|
||||
parsed = yaml.safe_load(v)
|
||||
except yaml.YAMLError as e:
|
||||
raise ValueError(f"Invalid YAML: {e}")
|
||||
|
||||
if not isinstance(parsed, dict):
|
||||
raise ValueError("Compose template must be a YAML mapping")
|
||||
|
||||
if "services" not in parsed:
|
||||
raise ValueError("Compose template must contain 'services' key")
|
||||
|
||||
if not parsed["services"]:
|
||||
raise ValueError("Compose template must define at least one service")
|
||||
|
||||
return v
|
||||
|
||||
@field_validator("dockerfile_template")
|
||||
@@ -76,33 +86,57 @@ class ToolTypeCreate(BaseModel):
|
||||
data = info.data
|
||||
if data.get("definition_type") != "dockerfile":
|
||||
return v
|
||||
|
||||
if v is None or not v.strip():
|
||||
raise ValueError(
|
||||
"dockerfile_template is required when definition_type is 'dockerfile'"
|
||||
)
|
||||
|
||||
|
||||
if v is None:
|
||||
raise ValueError("dockerfile_template is required when definition_type is 'dockerfile'")
|
||||
|
||||
if not v.strip().startswith("FROM"):
|
||||
raise ValueError("Dockerfile must start with a FROM instruction")
|
||||
|
||||
return v
|
||||
|
||||
@field_validator("interface_type")
|
||||
@classmethod
|
||||
def validate_interface_type(cls, v: str) -> str:
|
||||
if v not in ("web", "terminal"):
|
||||
raise ValueError("interface_type must be 'web' or 'terminal'")
|
||||
|
||||
return v
|
||||
|
||||
@field_validator("default_port")
|
||||
@classmethod
|
||||
def validate_default_port(cls, v: int, info) -> int:
|
||||
data = info.data
|
||||
requires_port = data.get("requires_port", True)
|
||||
if not requires_port:
|
||||
return v
|
||||
if v <= 0 or v > 65535:
|
||||
raise ValueError("Port must be between 1 and 65535")
|
||||
|
||||
# Get compose_template from the model data
|
||||
data = info.data
|
||||
if data.get("definition_type") != "compose":
|
||||
return v
|
||||
|
||||
template = data.get("compose_template")
|
||||
if not template:
|
||||
return v
|
||||
|
||||
try:
|
||||
parsed = yaml.safe_load(template)
|
||||
except yaml.YAMLError:
|
||||
return v
|
||||
|
||||
# Check if the port is exposed in any service
|
||||
port_str = str(v)
|
||||
port_exposed = False
|
||||
|
||||
if isinstance(parsed, dict) and "services" in parsed:
|
||||
for service_name, service_config in parsed["services"].items():
|
||||
if isinstance(service_config, dict) and "ports" in service_config:
|
||||
for port_mapping in service_config["ports"]:
|
||||
if isinstance(port_mapping, str):
|
||||
# Format: "8443:8443" or "8443"
|
||||
if port_str in port_mapping:
|
||||
port_exposed = True
|
||||
break
|
||||
elif isinstance(port_mapping, int) and port_mapping == v:
|
||||
port_exposed = True
|
||||
break
|
||||
if port_exposed:
|
||||
break
|
||||
|
||||
if not port_exposed:
|
||||
raise ValueError(f"Port {v} is not exposed in the compose template. Add it to the 'ports' section.")
|
||||
|
||||
return v
|
||||
|
||||
@field_validator("required_variables")
|
||||
@@ -110,62 +144,28 @@ class ToolTypeCreate(BaseModel):
|
||||
def validate_required_variables(cls, v: list[str], info) -> list[str]:
|
||||
if not v:
|
||||
return v
|
||||
|
||||
|
||||
data = info.data
|
||||
if data.get("definition_type") != "compose":
|
||||
return v
|
||||
|
||||
|
||||
template = data.get("compose_template")
|
||||
if not template:
|
||||
return v
|
||||
|
||||
|
||||
for var in v:
|
||||
placeholder = f"{{{{{var}}}}}"
|
||||
if placeholder not in template:
|
||||
raise ValueError(
|
||||
f"Required variable '{var}' not found in compose template"
|
||||
)
|
||||
|
||||
raise ValueError(f"Required variable '{var}' not found in compose template")
|
||||
|
||||
return v
|
||||
|
||||
@model_validator(mode="after")
|
||||
def validate_templates(self) -> "ToolTypeCreate":
|
||||
if self.definition_type == "manifest":
|
||||
if self.manifest_id is None:
|
||||
raise ValueError(
|
||||
"manifest_id is required when definition_type is 'manifest'"
|
||||
)
|
||||
return self
|
||||
|
||||
if self.definition_type == "dockerfile" and (
|
||||
self.dockerfile_template is None or not self.dockerfile_template.strip()
|
||||
):
|
||||
raise ValueError(
|
||||
"dockerfile_template is required when definition_type is 'dockerfile'"
|
||||
)
|
||||
if self.definition_type == "compose" and (
|
||||
self.compose_template is None or not self.compose_template.strip()
|
||||
):
|
||||
raise ValueError(
|
||||
"compose_template is required when definition_type is 'compose'"
|
||||
)
|
||||
|
||||
# Validate that default_port is exposed in compose template (only if requires_port)
|
||||
if (
|
||||
self.requires_port
|
||||
and self.definition_type == "compose"
|
||||
and self.compose_template
|
||||
):
|
||||
try:
|
||||
parsed = validate_compose_yaml(self.compose_template)
|
||||
except ValueError:
|
||||
return self
|
||||
|
||||
if not check_port_exposed(parsed, self.default_port):
|
||||
raise ValueError(
|
||||
f"Port {self.default_port} is not exposed in the compose template. Add it to the 'ports' section."
|
||||
)
|
||||
|
||||
if self.definition_type == "dockerfile" and self.dockerfile_template is None:
|
||||
raise ValueError("dockerfile_template is required when definition_type is 'dockerfile'")
|
||||
if self.definition_type == "compose" and self.compose_template is None:
|
||||
raise ValueError("compose_template is required when definition_type is 'compose'")
|
||||
return self
|
||||
|
||||
|
||||
@@ -174,35 +174,21 @@ class ToolTypeUpdate(BaseModel):
|
||||
description: str | None = None
|
||||
default_port: int | None = None
|
||||
definition_type: str | None = None
|
||||
manifest_id: uuid.UUID | None = None
|
||||
compose_template: str | None = None
|
||||
dockerfile_template: str | None = None
|
||||
build_context: dict | None = None
|
||||
readiness_probe: dict | None = None
|
||||
startup_command: str | None = None
|
||||
required_variables: list[str] | None = None
|
||||
category: str | None = None
|
||||
interface_type: str | None = None
|
||||
requires_port: bool | None = None
|
||||
interfaces: list[str] | None = None
|
||||
|
||||
@field_validator("definition_type")
|
||||
@classmethod
|
||||
def validate_definition_type(cls, v: str | None) -> str | None:
|
||||
if v is None:
|
||||
return v
|
||||
if v not in ("compose", "dockerfile", "manifest"):
|
||||
raise ValueError(
|
||||
"definition_type must be 'compose', 'dockerfile', or 'manifest'"
|
||||
)
|
||||
return v
|
||||
|
||||
@field_validator("interface_type")
|
||||
@classmethod
|
||||
def validate_interface_type(cls, v: str | None) -> str | None:
|
||||
if v is None:
|
||||
return v
|
||||
if v not in ("web", "terminal"):
|
||||
raise ValueError("interface_type must be 'web' or 'terminal'")
|
||||
if v not in ("compose", "dockerfile"):
|
||||
raise ValueError("definition_type must be 'compose' or 'dockerfile'")
|
||||
return v
|
||||
|
||||
@field_validator("compose_template")
|
||||
@@ -210,13 +196,26 @@ class ToolTypeUpdate(BaseModel):
|
||||
def validate_compose_template(cls, v: str | None, info) -> str | None:
|
||||
if v is None:
|
||||
return v
|
||||
|
||||
|
||||
data = info.data
|
||||
definition_type = data.get("definition_type")
|
||||
if definition_type and definition_type != "compose":
|
||||
return v
|
||||
|
||||
validate_compose_yaml(v)
|
||||
|
||||
try:
|
||||
parsed = yaml.safe_load(v)
|
||||
except yaml.YAMLError as e:
|
||||
raise ValueError(f"Invalid YAML: {e}")
|
||||
|
||||
if not isinstance(parsed, dict):
|
||||
raise ValueError("Compose template must be a YAML mapping")
|
||||
|
||||
if "services" not in parsed:
|
||||
raise ValueError("Compose template must contain 'services' key")
|
||||
|
||||
if not parsed["services"]:
|
||||
raise ValueError("Compose template must define at least one service")
|
||||
|
||||
return v
|
||||
|
||||
@field_validator("dockerfile_template")
|
||||
@@ -224,15 +223,15 @@ class ToolTypeUpdate(BaseModel):
|
||||
def validate_dockerfile_template(cls, v: str | None, info) -> str | None:
|
||||
if v is None:
|
||||
return v
|
||||
|
||||
|
||||
data = info.data
|
||||
definition_type = data.get("definition_type")
|
||||
if definition_type and definition_type != "dockerfile":
|
||||
return v
|
||||
|
||||
|
||||
if not v.strip().startswith("FROM"):
|
||||
raise ValueError("Dockerfile must start with a FROM instruction")
|
||||
|
||||
|
||||
return v
|
||||
|
||||
|
||||
@@ -244,17 +243,15 @@ class ToolTypeResponse(BaseModel):
|
||||
display_name: str
|
||||
description: str | None
|
||||
category: str
|
||||
interface_type: str
|
||||
requires_port: bool
|
||||
interfaces: list[str]
|
||||
default_port: int
|
||||
definition_type: str
|
||||
manifest_id: uuid.UUID | None
|
||||
compose_template: str | None
|
||||
dockerfile_template: str | None
|
||||
build_context: dict | None
|
||||
readiness_probe: dict | None
|
||||
startup_command: str | None
|
||||
required_variables: list[str]
|
||||
is_builtin: bool
|
||||
created_by_id: uuid.UUID | None
|
||||
created_at: datetime
|
||||
updated_at: datetime
|
||||
@@ -284,31 +281,26 @@ async def create_tool_type(
|
||||
"""
|
||||
user = await _get_user(session, user_id)
|
||||
await _require_admin(user)
|
||||
|
||||
|
||||
# Check for duplicate name
|
||||
existing = await session.scalar(select(ToolType).where(ToolType.name == data.name))
|
||||
if existing:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_409_CONFLICT,
|
||||
detail="tool type with this name already exists",
|
||||
)
|
||||
|
||||
raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="tool type with this name already exists")
|
||||
|
||||
tool_type = ToolType(
|
||||
name=data.name,
|
||||
display_name=data.display_name,
|
||||
description=data.description,
|
||||
default_port=data.default_port,
|
||||
definition_type=data.definition_type,
|
||||
manifest_id=data.manifest_id,
|
||||
compose_template=data.compose_template,
|
||||
dockerfile_template=data.dockerfile_template,
|
||||
build_context=data.build_context,
|
||||
readiness_probe=data.readiness_probe,
|
||||
startup_command=data.startup_command,
|
||||
required_variables=data.required_variables,
|
||||
category=data.category,
|
||||
interface_type=data.interface_type,
|
||||
requires_port=data.requires_port,
|
||||
interfaces=data.interfaces,
|
||||
is_builtin=False,
|
||||
created_by_id=user.id,
|
||||
)
|
||||
session.add(tool_type)
|
||||
@@ -365,9 +357,7 @@ async def get_tool_type(
|
||||
await _get_user(session, user_id)
|
||||
tool_type = await session.get(ToolType, tool_type_id)
|
||||
if tool_type is None:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found"
|
||||
)
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found")
|
||||
return tool_type
|
||||
|
||||
|
||||
@@ -396,66 +386,82 @@ async def update_tool_type(
|
||||
"""
|
||||
user = await _get_user(session, user_id)
|
||||
await _require_admin(user)
|
||||
|
||||
|
||||
tool_type = await session.get(ToolType, tool_type_id)
|
||||
if tool_type is None:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found"
|
||||
)
|
||||
|
||||
# Built-in tool types can now be modified
|
||||
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found")
|
||||
|
||||
if tool_type.is_builtin:
|
||||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="cannot modify built-in tool types")
|
||||
|
||||
update_data = data.model_dump(exclude_unset=True)
|
||||
|
||||
|
||||
# Validate port if being updated
|
||||
requires_port = update_data.get("requires_port", tool_type.requires_port)
|
||||
if "default_port" in update_data and requires_port:
|
||||
if "default_port" in update_data:
|
||||
new_port = update_data["default_port"]
|
||||
if new_port <= 0 or new_port > 65535:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail="Port must be between 1 and 65535",
|
||||
detail="Port must be between 1 and 65535"
|
||||
)
|
||||
|
||||
|
||||
# Only validate port exposure for compose definitions
|
||||
definition_type = update_data.get("definition_type", tool_type.definition_type)
|
||||
if definition_type == "compose":
|
||||
template = update_data.get("compose_template", tool_type.compose_template)
|
||||
if template:
|
||||
try:
|
||||
parsed = validate_compose_yaml(template)
|
||||
if not check_port_exposed(parsed, new_port):
|
||||
parsed = yaml.safe_load(template)
|
||||
except yaml.YAMLError:
|
||||
parsed = None
|
||||
|
||||
if parsed and isinstance(parsed, dict) and "services" in parsed:
|
||||
port_str = str(new_port)
|
||||
port_exposed = False
|
||||
for service_config in parsed["services"].values():
|
||||
if isinstance(service_config, dict) and "ports" in service_config:
|
||||
for port_mapping in service_config["ports"]:
|
||||
if isinstance(port_mapping, str) and port_str in port_mapping:
|
||||
port_exposed = True
|
||||
break
|
||||
elif isinstance(port_mapping, int) and port_mapping == new_port:
|
||||
port_exposed = True
|
||||
break
|
||||
if port_exposed:
|
||||
break
|
||||
|
||||
if not port_exposed:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"Port {new_port} is not exposed in the compose template",
|
||||
detail=f"Port {new_port} is not exposed in the compose template"
|
||||
)
|
||||
except ValueError as e:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)
|
||||
)
|
||||
|
||||
|
||||
# Validate required variables for compose definitions
|
||||
definition_type = update_data.get("definition_type", tool_type.definition_type)
|
||||
if definition_type == "compose":
|
||||
if "required_variables" in update_data and "compose_template" in update_data:
|
||||
validate_required_variables(
|
||||
update_data["compose_template"], update_data["required_variables"]
|
||||
)
|
||||
template = update_data["compose_template"]
|
||||
for var in update_data["required_variables"]:
|
||||
placeholder = f"{{{{{var}}}}}"
|
||||
if placeholder not in template:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"Required variable '{var}' not found in compose template"
|
||||
)
|
||||
elif "required_variables" in update_data:
|
||||
template = tool_type.compose_template
|
||||
if template:
|
||||
validate_required_variables(template, update_data["required_variables"])
|
||||
|
||||
# When switching to manifest, clear legacy templates
|
||||
if definition_type == "manifest":
|
||||
if "manifest_id" in update_data:
|
||||
tool_type.manifest_id = update_data["manifest_id"]
|
||||
tool_type.compose_template = None
|
||||
tool_type.dockerfile_template = None
|
||||
|
||||
for var in update_data["required_variables"]:
|
||||
placeholder = f"{{{{{var}}}}}"
|
||||
if placeholder not in template:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"Required variable '{var}' not found in compose template"
|
||||
)
|
||||
|
||||
for field, value in update_data.items():
|
||||
setattr(tool_type, field, value)
|
||||
|
||||
|
||||
await session.commit()
|
||||
await session.refresh(tool_type)
|
||||
return tool_type
|
||||
@@ -496,9 +502,15 @@ async def validate_tool_type_template(
|
||||
errors.append("Compose template is required")
|
||||
else:
|
||||
try:
|
||||
validate_compose_yaml(data.compose_template)
|
||||
except ValueError as e:
|
||||
errors.append(str(e))
|
||||
parsed = yaml.safe_load(data.compose_template)
|
||||
if not isinstance(parsed, dict):
|
||||
errors.append("Compose template must be a YAML mapping")
|
||||
elif "services" not in parsed:
|
||||
errors.append("Compose template must contain 'services' key")
|
||||
elif not parsed["services"]:
|
||||
errors.append("Compose template must define at least one service")
|
||||
except yaml.YAMLError as e:
|
||||
errors.append(f"Invalid YAML: {e}")
|
||||
|
||||
elif data.definition_type == "dockerfile":
|
||||
if not data.dockerfile_template:
|
||||
@@ -506,11 +518,8 @@ async def validate_tool_type_template(
|
||||
elif not data.dockerfile_template.strip().startswith("FROM"):
|
||||
errors.append("Dockerfile must start with a FROM instruction")
|
||||
|
||||
elif data.definition_type == "manifest":
|
||||
pass # Manifest validation is handled separately
|
||||
|
||||
else:
|
||||
errors.append("definition_type must be 'compose', 'dockerfile', or 'manifest'")
|
||||
errors.append("definition_type must be 'compose' or 'dockerfile'")
|
||||
|
||||
return {
|
||||
"valid": len(errors) == 0,
|
||||
@@ -541,31 +550,31 @@ async def validate_tool_type(
|
||||
await _get_user(session, user_id)
|
||||
tool_type = await session.get(ToolType, tool_type_id)
|
||||
if tool_type is None:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found"
|
||||
)
|
||||
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found")
|
||||
|
||||
errors = []
|
||||
|
||||
|
||||
if tool_type.definition_type == "compose":
|
||||
if not tool_type.compose_template:
|
||||
errors.append("Compose template is empty")
|
||||
else:
|
||||
try:
|
||||
validate_compose_yaml(tool_type.compose_template)
|
||||
except ValueError as e:
|
||||
errors.append(str(e))
|
||||
|
||||
parsed = yaml.safe_load(tool_type.compose_template)
|
||||
if not isinstance(parsed, dict):
|
||||
errors.append("Compose template must be a YAML mapping")
|
||||
elif "services" not in parsed:
|
||||
errors.append("Compose template must contain 'services' key")
|
||||
elif not parsed["services"]:
|
||||
errors.append("Compose template must define at least one service")
|
||||
except yaml.YAMLError as e:
|
||||
errors.append(f"Invalid YAML: {e}")
|
||||
|
||||
elif tool_type.definition_type == "dockerfile":
|
||||
if not tool_type.dockerfile_template:
|
||||
errors.append("Dockerfile template is empty")
|
||||
elif not tool_type.dockerfile_template.strip().startswith("FROM"):
|
||||
errors.append("Dockerfile must start with a FROM instruction")
|
||||
|
||||
elif tool_type.definition_type == "manifest":
|
||||
if not tool_type.manifest_id:
|
||||
errors.append("Manifest reference is missing")
|
||||
|
||||
|
||||
return {
|
||||
"valid": len(errors) == 0,
|
||||
"errors": errors,
|
||||
@@ -595,14 +604,13 @@ async def delete_tool_type(
|
||||
"""
|
||||
user = await _get_user(session, user_id)
|
||||
await _require_admin(user)
|
||||
|
||||
|
||||
tool_type = await session.get(ToolType, tool_type_id)
|
||||
if tool_type is None:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found"
|
||||
)
|
||||
|
||||
# Built-in tool types can now be deleted
|
||||
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found")
|
||||
|
||||
if tool_type.is_builtin:
|
||||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="cannot delete built-in tool types")
|
||||
|
||||
await session.delete(tool_type)
|
||||
await session.commit()
|
||||
|
||||
@@ -1,87 +0,0 @@
|
||||
"""Shared validation utilities for tool types."""
|
||||
|
||||
import re
|
||||
|
||||
import yaml
|
||||
from fastapi import HTTPException, status
|
||||
|
||||
|
||||
def sanitize_template_vars(template: str) -> str:
|
||||
"""Replace template variables like {{VAR}} with placeholders to avoid YAML parsing errors."""
|
||||
return re.sub(r"\{\{[A-Za-z_][A-Za-z0-9_]*\}\}", "__PLACEHOLDER__", template)
|
||||
|
||||
|
||||
def validate_compose_yaml(template: str) -> dict:
|
||||
"""Validate and parse a compose template.
|
||||
|
||||
Args:
|
||||
template: Raw compose template string.
|
||||
|
||||
Returns:
|
||||
Parsed YAML dict.
|
||||
|
||||
Raises:
|
||||
ValueError: If YAML is invalid or missing required keys.
|
||||
"""
|
||||
sanitized = sanitize_template_vars(template)
|
||||
|
||||
try:
|
||||
parsed = yaml.safe_load(sanitized)
|
||||
except yaml.YAMLError as e:
|
||||
raise ValueError(f"Invalid YAML: {e}")
|
||||
|
||||
if not isinstance(parsed, dict):
|
||||
raise ValueError("Compose template must be a YAML mapping")
|
||||
|
||||
if "services" not in parsed:
|
||||
raise ValueError("Compose template must contain 'services' key")
|
||||
|
||||
if not parsed["services"]:
|
||||
raise ValueError("Compose template must define at least one service")
|
||||
|
||||
return parsed
|
||||
|
||||
|
||||
def check_port_exposed(parsed: dict, port: int) -> bool:
|
||||
"""Check if a port is exposed in a parsed compose template.
|
||||
|
||||
Args:
|
||||
parsed: Parsed compose YAML dict.
|
||||
port: Port number to check.
|
||||
|
||||
Returns:
|
||||
True if port is exposed in any service.
|
||||
"""
|
||||
port_str = str(port)
|
||||
|
||||
if not isinstance(parsed, dict) or "services" not in parsed:
|
||||
return False
|
||||
|
||||
for service_config in parsed["services"].values():
|
||||
if isinstance(service_config, dict) and "ports" in service_config:
|
||||
for port_mapping in service_config["ports"]:
|
||||
if isinstance(port_mapping, str) and port_str in port_mapping:
|
||||
return True
|
||||
elif isinstance(port_mapping, int) and port_mapping == port:
|
||||
return True
|
||||
|
||||
return False
|
||||
|
||||
|
||||
def validate_required_variables(template: str, variables: list[str]) -> None:
|
||||
"""Validate that all required variables exist in the template.
|
||||
|
||||
Args:
|
||||
template: Compose template string.
|
||||
variables: List of required variable names.
|
||||
|
||||
Raises:
|
||||
HTTPException: If any variable is not found in the template.
|
||||
"""
|
||||
for var in variables:
|
||||
placeholder = f"{{{{{var}}}}}"
|
||||
if placeholder not in template:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"Required variable '{var}' not found in compose template",
|
||||
)
|
||||
@@ -1,22 +1,29 @@
|
||||
import logging
|
||||
import uuid
|
||||
|
||||
from fastapi import APIRouter, Depends
|
||||
from fastapi import APIRouter, Depends, HTTPException, status
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
from pydantic import BaseModel, ConfigDict
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.auth.dependencies import _get_user, get_current_user_id, get_db_session
|
||||
from src.auth.dependencies import get_current_user_id, get_db_session
|
||||
from src.models.user import User
|
||||
from src.models.user_config import UserConfig
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
router = APIRouter(prefix="/users/me", tags=["user-config"])
|
||||
|
||||
|
||||
async def _get_or_create_config(
|
||||
session: AsyncSession, user_id: uuid.UUID
|
||||
) -> UserConfig:
|
||||
async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
|
||||
"""Fetch a user by ID or raise 401 if not found."""
|
||||
user = await session.get(User, user_id)
|
||||
if user is None:
|
||||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
|
||||
return user
|
||||
|
||||
|
||||
async def _get_or_create_config(session: AsyncSession, user_id: uuid.UUID) -> UserConfig:
|
||||
"""Get or create user config record.
|
||||
|
||||
Args:
|
||||
@@ -26,9 +33,7 @@ async def _get_or_create_config(
|
||||
Returns:
|
||||
The user's config, creating a new one if it doesn't exist.
|
||||
"""
|
||||
result = await session.execute(
|
||||
select(UserConfig).where(UserConfig.user_id == user_id)
|
||||
)
|
||||
result = await session.execute(select(UserConfig).where(UserConfig.user_id == user_id))
|
||||
config = result.scalar_one_or_none()
|
||||
if config is None:
|
||||
config = UserConfig(user_id=user_id, config={})
|
||||
@@ -46,8 +51,6 @@ class UserConfigResponse(BaseModel):
|
||||
git_user_name: str | None = None
|
||||
git_user_email: str | None = None
|
||||
last_session_id: str | None = None
|
||||
notification_mute_categories: list[str] | None = None
|
||||
notification_toast_level: str | None = None
|
||||
|
||||
|
||||
class UserConfigUpdate(BaseModel):
|
||||
@@ -56,8 +59,6 @@ class UserConfigUpdate(BaseModel):
|
||||
git_user_name: str | None = None
|
||||
git_user_email: str | None = None
|
||||
last_session_id: str | None = None
|
||||
notification_mute_categories: list[str] | None = None
|
||||
notification_toast_level: str | None = None
|
||||
|
||||
|
||||
@router.get(
|
||||
@@ -110,11 +111,11 @@ async def update_user_config(
|
||||
|
||||
# Merge updates
|
||||
update_data = data.model_dump(exclude_unset=True)
|
||||
logger.debug("Updating user config for user %s: %s", user_id, update_data)
|
||||
logger.info("Updating user config for user %s: %s", user_id, update_data)
|
||||
# SQLAlchemy JSON doesn't track dict mutations, so we replace the whole dict
|
||||
config.config = {**config.config, **update_data}
|
||||
|
||||
await session.commit()
|
||||
await session.refresh(config)
|
||||
logger.debug("Updated config: %s", config.config)
|
||||
logger.info("Updated config: %s", config.config)
|
||||
return UserConfigResponse.model_validate(config.config)
|
||||
|
||||
@@ -5,7 +5,7 @@ from fastapi import APIRouter, Depends, HTTPException, UploadFile, status
|
||||
from pydantic import BaseModel, ConfigDict
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.auth.dependencies import _get_user, get_current_user_id, get_db_session
|
||||
from src.auth.dependencies import get_current_user_id, get_db_session
|
||||
from src.models.user import User
|
||||
|
||||
router = APIRouter(prefix="/users", tags=["users"])
|
||||
@@ -16,6 +16,14 @@ ALLOWED_CONTENT_TYPES = {"image/png", "image/jpeg", "image/jpg"}
|
||||
MAX_AVATAR_SIZE = 2 * 1024 * 1024 # 2MB
|
||||
|
||||
|
||||
async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
|
||||
"""Fetch a user by ID or raise 401 if not found."""
|
||||
user = await session.get(User, user_id)
|
||||
if user is None:
|
||||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
|
||||
return user
|
||||
|
||||
|
||||
class UserProfileResponse(BaseModel):
|
||||
model_config = ConfigDict(from_attributes=True)
|
||||
|
||||
|
||||
@@ -7,7 +7,6 @@ from sqlalchemy.ext.asyncio import AsyncSession
|
||||
from src.auth.session import decode_session_cookie
|
||||
from src.config import Settings
|
||||
from src.database import SessionLocal
|
||||
from src.models.project import Project
|
||||
from src.models.user import User
|
||||
|
||||
|
||||
@@ -48,39 +47,3 @@ async def get_current_user(
|
||||
if user is None:
|
||||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
|
||||
return user
|
||||
|
||||
|
||||
async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
|
||||
"""Fetch a user by ID or raise 401 if not found."""
|
||||
user = await session.get(User, user_id)
|
||||
if user is None:
|
||||
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
|
||||
return user
|
||||
|
||||
|
||||
async def _get_owned_project(
|
||||
project_id: uuid.UUID,
|
||||
user_id: uuid.UUID,
|
||||
session: AsyncSession,
|
||||
) -> "Project":
|
||||
"""Fetch a project and verify ownership.
|
||||
|
||||
Args:
|
||||
project_id: UUID of the project.
|
||||
user_id: ID of the authenticated user.
|
||||
session: Database session.
|
||||
|
||||
Returns:
|
||||
The project if found and owned by the user.
|
||||
|
||||
Raises:
|
||||
HTTPException: 404 if project not found, 403 if user is not the owner.
|
||||
"""
|
||||
from src.models.project import Project
|
||||
|
||||
project = await session.get(Project, project_id)
|
||||
if project is None:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="project not found")
|
||||
if project.owner_id != user_id:
|
||||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="not project owner")
|
||||
return project
|
||||
|
||||
@@ -2,7 +2,7 @@ import hmac
|
||||
import hashlib
|
||||
import json
|
||||
import base64
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from datetime import UTC, datetime, timedelta
|
||||
from typing import Any
|
||||
|
||||
from src.config import Settings
|
||||
@@ -23,7 +23,7 @@ def create_session_cookie(*, settings: Settings, user_id: str) -> str:
|
||||
"""Create a signed session cookie value."""
|
||||
payload = {
|
||||
"user_id": user_id,
|
||||
"exp": int((datetime.now(timezone.utc) + timedelta(hours=settings.session_ttl_hours)).timestamp()),
|
||||
"exp": int((datetime.now(UTC) + timedelta(hours=settings.session_ttl_hours)).timestamp()),
|
||||
}
|
||||
|
||||
header = _base64url_encode(json.dumps({"alg": "HS256", "typ": "session"}).encode())
|
||||
@@ -65,7 +65,7 @@ def decode_session_cookie(*, settings: Settings, cookie_value: str) -> dict[str,
|
||||
payload = json.loads(payload_bytes)
|
||||
|
||||
# Check expiry
|
||||
if payload.get("exp", 0) < int(datetime.now(timezone.utc).timestamp()):
|
||||
if payload.get("exp", 0) < int(datetime.now(UTC).timestamp()):
|
||||
raise ValueError("session expired")
|
||||
|
||||
return payload
|
||||
|
||||
@@ -1,52 +1,15 @@
|
||||
"""Structured JSON logging configuration."""
|
||||
|
||||
import json
|
||||
import logging
|
||||
import sys
|
||||
import time
|
||||
import traceback
|
||||
from collections.abc import Callable
|
||||
from typing import Callable
|
||||
|
||||
from fastapi import Request, Response
|
||||
from starlette.middleware.base import BaseHTTPMiddleware
|
||||
|
||||
from src.services.correlation import get_correlation_id
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class CorrelationIdFilter(logging.Filter):
|
||||
"""Inject correlation_id into every log record from context var."""
|
||||
|
||||
def filter(self, record: logging.LogRecord) -> bool:
|
||||
record.correlation_id = get_correlation_id() # type: ignore[attr-defined]
|
||||
return True
|
||||
|
||||
|
||||
class JSONFormatter(logging.Formatter):
|
||||
"""Emit log records as single-line JSON."""
|
||||
|
||||
def format(self, record: logging.LogRecord) -> str:
|
||||
log_obj: dict = {
|
||||
"timestamp": self.formatTime(record),
|
||||
"level": record.levelname,
|
||||
"logger": record.name,
|
||||
"message": record.getMessage(),
|
||||
"correlation_id": getattr(record, "correlation_id", None),
|
||||
}
|
||||
# Optional extra fields
|
||||
for key in ("instance_id", "event_type"):
|
||||
value = getattr(record, key, None)
|
||||
if value is not None:
|
||||
log_obj[key] = value
|
||||
if record.exc_info:
|
||||
log_obj["exception"] = self.formatException(record.exc_info)
|
||||
return json.dumps(log_obj, default=str)
|
||||
|
||||
def formatTime(self, record: logging.LogRecord, datefmt: str | None = None) -> str:
|
||||
return time.strftime("%Y-%m-%dT%H:%M:%S", time.gmtime(record.created))
|
||||
|
||||
|
||||
class RequestLoggingMiddleware(BaseHTTPMiddleware):
|
||||
"""Log all HTTP requests with timing and status codes."""
|
||||
|
||||
@@ -54,6 +17,7 @@ class RequestLoggingMiddleware(BaseHTTPMiddleware):
|
||||
start_time = time.time()
|
||||
client_host = request.client.host if request.client else "unknown"
|
||||
|
||||
# Log the incoming request
|
||||
logger.info(
|
||||
"→ Request: %s %s (client: %s)",
|
||||
request.method,
|
||||
@@ -65,6 +29,7 @@ class RequestLoggingMiddleware(BaseHTTPMiddleware):
|
||||
response = await call_next(request)
|
||||
duration = time.time() - start_time
|
||||
|
||||
# Log the response
|
||||
logger.info(
|
||||
"← Response: %s %s → %d (%dms)",
|
||||
request.method,
|
||||
@@ -104,13 +69,15 @@ class ExceptionLoggingMiddleware(BaseHTTPMiddleware):
|
||||
|
||||
|
||||
def configure_logging(level: int = logging.INFO) -> None:
|
||||
"""Configure structured JSON logging for the application."""
|
||||
formatter = JSONFormatter()
|
||||
"""Configure structured logging for the application."""
|
||||
formatter = logging.Formatter(
|
||||
fmt="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
|
||||
datefmt="%Y-%m-%d %H:%M:%S",
|
||||
)
|
||||
|
||||
# Console handler
|
||||
console_handler = logging.StreamHandler(sys.stdout)
|
||||
console_handler.setFormatter(formatter)
|
||||
console_handler.addFilter(CorrelationIdFilter())
|
||||
|
||||
# Configure root logger
|
||||
root_logger = logging.getLogger()
|
||||
|
||||
+158
-35
@@ -1,3 +1,4 @@
|
||||
import json
|
||||
import logging
|
||||
import os
|
||||
|
||||
@@ -6,36 +7,31 @@ from fastapi.exceptions import RequestValidationError
|
||||
from fastapi.middleware.cors import CORSMiddleware
|
||||
from fastapi.responses import JSONResponse
|
||||
from fastapi.staticfiles import StaticFiles
|
||||
from sqlalchemy import select, text
|
||||
|
||||
from src.api.auth import router as auth_router
|
||||
from src.api.dashboard import router as dashboard_router
|
||||
from src.api.events import router as events_router
|
||||
from src.api.git_repositories import router as git_repositories_router
|
||||
from src.api.health import router as health_router
|
||||
from src.api.projects import router as projects_router
|
||||
from src.api.ssh_keys import router as ssh_keys_router
|
||||
from src.api.terminal import router as terminal_router
|
||||
from src.api.instance_proxy import router as instance_proxy_router
|
||||
from src.api.config_profiles import router as config_profiles_router
|
||||
from src.api.tool_definitions import router as tool_definitions_router
|
||||
from src.api.config_folders import router as config_folders_router
|
||||
from src.api.tool_configs import router as tool_configs_router
|
||||
from src.api.tool_instances import router as tool_instances_router
|
||||
from src.api.tool_instances import sessions_router
|
||||
from src.api.tool_types import router as tool_types_router
|
||||
from src.api.notifications import router as notifications_router
|
||||
from src.api.user_config import router as user_config_router
|
||||
from src.api.users import router as users_router
|
||||
from src.config import Settings
|
||||
from src.models.notification import Notification # noqa: F401 – Alembic model discovery
|
||||
from src.models.terminal_session import TerminalSessionModel # noqa: F401 – Alembic model discovery
|
||||
from src.database import init_database
|
||||
from src.database import SessionLocal, init_database
|
||||
from src.logging_config import (
|
||||
ExceptionLoggingMiddleware,
|
||||
RequestLoggingMiddleware,
|
||||
configure_logging,
|
||||
)
|
||||
from src.services.correlation import CorrelationIdMiddleware
|
||||
from src.services.event_bus import InstanceEventBus
|
||||
from src.services.health_monitor import HealthMonitor
|
||||
from src.models.tool_type import ToolType
|
||||
|
||||
# Configure logging early
|
||||
log_level = os.getenv("LOG_LEVEL", "INFO").upper()
|
||||
@@ -60,7 +56,6 @@ app.add_middleware(
|
||||
allow_headers=["*"],
|
||||
)
|
||||
|
||||
app.add_middleware(CorrelationIdMiddleware)
|
||||
app.add_middleware(RequestLoggingMiddleware)
|
||||
app.add_middleware(ExceptionLoggingMiddleware)
|
||||
|
||||
@@ -73,9 +68,7 @@ def _sanitize_validation_errors(errors):
|
||||
"type": error.get("type"),
|
||||
"loc": error.get("loc"),
|
||||
"msg": error.get("msg"),
|
||||
"input": str(error.get("input"))
|
||||
if error.get("input") is not None
|
||||
else None,
|
||||
"input": str(error.get("input")) if error.get("input") is not None else None,
|
||||
}
|
||||
# Convert ctx to safe format
|
||||
ctx = error.get("ctx")
|
||||
@@ -110,9 +103,153 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
|
||||
)
|
||||
|
||||
|
||||
# Global services
|
||||
_event_bus = InstanceEventBus()
|
||||
_health_monitor = HealthMonitor(_event_bus)
|
||||
async def _table_exists(session, table_name: str) -> bool:
|
||||
"""Check if a table exists in the database."""
|
||||
try:
|
||||
result = await session.execute(
|
||||
text("""
|
||||
SELECT EXISTS (
|
||||
SELECT FROM information_schema.tables
|
||||
WHERE table_schema = 'public'
|
||||
AND table_name = :table_name
|
||||
)
|
||||
"""),
|
||||
{"table_name": table_name},
|
||||
)
|
||||
return result.scalar() or False
|
||||
except Exception:
|
||||
return False
|
||||
|
||||
|
||||
async def seed_builtin_tool_types():
|
||||
async with SessionLocal() as session:
|
||||
# Check if tool_types table exists before attempting to seed
|
||||
if not await _table_exists(session, "tool_types"):
|
||||
logger.warning(
|
||||
"tool_types table does not exist. Skipping seeding. "
|
||||
"Migrations may not have run yet."
|
||||
)
|
||||
return
|
||||
|
||||
builtin_types = [
|
||||
{
|
||||
"name": "code-server",
|
||||
"display_name": "VS Code Server",
|
||||
"description": "VS Code running in the browser via code-server",
|
||||
"category": "editor",
|
||||
"interfaces": ["web"],
|
||||
"compose_template": """version: "3.8"
|
||||
services:
|
||||
code-server:
|
||||
image: lscr.io/linuxserver/code-server:latest
|
||||
container_name: {{TOOL_NAME}}
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
- TZ=Europe/London
|
||||
volumes:
|
||||
- {{REPO_PATH}}:/config/workspace
|
||||
ports:
|
||||
- "8443:8443"
|
||||
restart: unless-stopped""",
|
||||
"default_port": 8443,
|
||||
"required_variables": ["REPO_PATH", "TOOL_NAME"],
|
||||
},
|
||||
{
|
||||
"name": "jupyter-notebook",
|
||||
"display_name": "Jupyter Notebook",
|
||||
"description": "Jupyter Lab for interactive development",
|
||||
"category": "notebook",
|
||||
"interfaces": ["web"],
|
||||
"default_port": 8888,
|
||||
"compose_template": """version: "3.8"
|
||||
services:
|
||||
jupyter:
|
||||
image: jupyter/scipy-notebook:latest
|
||||
container_name: {{TOOL_NAME}}
|
||||
environment:
|
||||
- JUPYTER_ENABLE_LAB=yes
|
||||
volumes:
|
||||
- {{REPO_PATH}}:/home/jovyan/work
|
||||
ports:
|
||||
- "8888:8888"
|
||||
restart: unless-stopped""",
|
||||
"required_variables": ["REPO_PATH", "TOOL_NAME"],
|
||||
},
|
||||
{
|
||||
"name": "opencode",
|
||||
"display_name": "OpenCode",
|
||||
"description": "AI coding assistant - run opencode in terminal",
|
||||
"category": "ai-assistant",
|
||||
"interfaces": ["terminal"],
|
||||
"default_port": 3000,
|
||||
"compose_template": """version: "3.8"
|
||||
services:
|
||||
opencode:
|
||||
image: node:20-slim
|
||||
container_name: {{TOOL_NAME}}
|
||||
working_dir: /workspace
|
||||
environment:
|
||||
- HOME=/tmp
|
||||
volumes:
|
||||
- {{REPO_PATH}}:/workspace
|
||||
- opencode_home:/tmp
|
||||
ports:
|
||||
- "3000:3000"
|
||||
command: >
|
||||
sh -c "set -x &&
|
||||
apt-get update && apt-get install -y git ca-certificates &&
|
||||
echo 'Installing opencode...' &&
|
||||
npm install -g opencode-ai 2>&1 || echo 'ERROR: npm install failed' &&
|
||||
which opencode || echo 'ERROR: opencode not in PATH' &&
|
||||
npm bin -g &&
|
||||
ls -la $(npm bin -g) || echo 'ERROR: global bin dir not found' &&
|
||||
echo 'export PATH=\"$(npm bin -g):\$PATH\"' >> /root/.bashrc &&
|
||||
echo 'cd /workspace' >> /root/.bashrc &&
|
||||
echo 'OpenCode installation complete' &&
|
||||
cd /workspace &&
|
||||
exec tail -f /dev/null"
|
||||
stdin_open: true
|
||||
tty: true
|
||||
restart: unless-stopped
|
||||
|
||||
volumes:
|
||||
opencode_home:""",
|
||||
"required_variables": ["REPO_PATH", "TOOL_NAME"],
|
||||
},
|
||||
]
|
||||
|
||||
for tool_data in builtin_types:
|
||||
existing = await session.scalar(select(ToolType).where(ToolType.name == tool_data["name"]))
|
||||
if not existing:
|
||||
tool_type = ToolType(
|
||||
name=tool_data["name"],
|
||||
display_name=tool_data["display_name"],
|
||||
description=tool_data["description"],
|
||||
category=tool_data["category"],
|
||||
interfaces=tool_data["interfaces"],
|
||||
definition_type="compose",
|
||||
compose_template=tool_data["compose_template"],
|
||||
required_variables=tool_data["required_variables"],
|
||||
default_port=tool_data.get("default_port"),
|
||||
is_builtin=True,
|
||||
)
|
||||
session.add(tool_type)
|
||||
logger.info("Created built-in tool type: %s", tool_data["name"])
|
||||
else:
|
||||
# Update existing built-in tool types to reflect code changes
|
||||
existing.display_name = tool_data["display_name"]
|
||||
existing.description = tool_data["description"]
|
||||
existing.category = tool_data["category"]
|
||||
existing.interfaces = tool_data["interfaces"]
|
||||
existing.definition_type = "compose"
|
||||
existing.compose_template = tool_data["compose_template"]
|
||||
existing.required_variables = tool_data["required_variables"]
|
||||
existing.default_port = tool_data.get("default_port")
|
||||
logger.info("Updated built-in tool type: %s", tool_data["name"])
|
||||
|
||||
await session.commit()
|
||||
logger.info("Built-in tool types seeded successfully.")
|
||||
|
||||
|
||||
@app.on_event("startup")
|
||||
@@ -124,24 +261,12 @@ async def on_startup():
|
||||
if not db_ready:
|
||||
logger.error("Database initialization failed. Shutting down.")
|
||||
import sys
|
||||
|
||||
sys.exit(1)
|
||||
|
||||
# Start background health monitor
|
||||
_health_monitor.start()
|
||||
logger.info("Health monitor started")
|
||||
|
||||
# Seed built-in data
|
||||
await seed_builtin_tool_types()
|
||||
logger.info("Startup complete.")
|
||||
|
||||
|
||||
@app.on_event("shutdown")
|
||||
async def on_shutdown():
|
||||
logger.info("Shutting down Headquarter API...")
|
||||
_health_monitor.stop()
|
||||
logger.info("Health monitor stopped")
|
||||
logger.info("Shutdown complete.")
|
||||
|
||||
|
||||
app.include_router(health_router)
|
||||
app.include_router(auth_router)
|
||||
app.include_router(dashboard_router)
|
||||
@@ -151,12 +276,10 @@ app.include_router(ssh_keys_router)
|
||||
app.include_router(git_repositories_router)
|
||||
app.include_router(user_config_router)
|
||||
app.include_router(tool_types_router)
|
||||
app.include_router(tool_definitions_router)
|
||||
app.include_router(config_profiles_router)
|
||||
app.include_router(config_folders_router)
|
||||
app.include_router(tool_instances_router)
|
||||
app.include_router(tool_configs_router)
|
||||
app.include_router(sessions_router)
|
||||
app.include_router(instance_proxy_router)
|
||||
app.include_router(terminal_router)
|
||||
app.include_router(events_router)
|
||||
app.include_router(notifications_router)
|
||||
app.mount("/uploads", StaticFiles(directory="uploads"), name="uploads")
|
||||
|
||||
@@ -1,13 +1,11 @@
|
||||
from src.models.base import Base
|
||||
from src.models.config_profile import ConfigProfile, ConfigProfileInclude
|
||||
from src.models.config_folder import ConfigFolder
|
||||
from src.models.config_include import ConfigInclude
|
||||
from src.models.config_mount import ConfigMount
|
||||
from src.models.config_profile import ConfigProfile
|
||||
from src.models.git_repository import GitRepository
|
||||
from src.models.health_check import HealthCheck
|
||||
from src.models.instance_event import InstanceEvent
|
||||
from src.models.notification import Notification
|
||||
from src.models.project import Project
|
||||
from src.models.ssh_key import SSHKey
|
||||
from src.models.terminal_session import TerminalSessionModel
|
||||
from src.models.tool_definition_manifest import ToolDefinitionManifest
|
||||
from src.models.tool_instance import ToolInstance
|
||||
from src.models.tool_type import ToolType
|
||||
from src.models.user import User
|
||||
@@ -15,16 +13,13 @@ from src.models.user_config import UserConfig
|
||||
|
||||
__all__ = [
|
||||
"Base",
|
||||
"ConfigFolder",
|
||||
"ConfigInclude",
|
||||
"ConfigMount",
|
||||
"ConfigProfile",
|
||||
"ConfigProfileInclude",
|
||||
"GitRepository",
|
||||
"HealthCheck",
|
||||
"InstanceEvent",
|
||||
"Notification",
|
||||
"Project",
|
||||
"SSHKey",
|
||||
"TerminalSessionModel",
|
||||
"ToolDefinitionManifest",
|
||||
"ToolInstance",
|
||||
"ToolType",
|
||||
"User",
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
import uuid
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
from sqlalchemy import Boolean, ForeignKey, JSON, String, Text
|
||||
from sqlalchemy import Uuid as UUID
|
||||
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||||
|
||||
from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from src.models.user import User
|
||||
|
||||
|
||||
class ConfigFolder(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
__tablename__ = "config_folders"
|
||||
|
||||
user_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(), ForeignKey("users.id", ondelete="CASCADE"), nullable=False
|
||||
)
|
||||
name: Mapped[str] = mapped_column(String(255), nullable=False)
|
||||
description: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
mount_path: Mapped[str] = mapped_column(String(1024), nullable=False)
|
||||
files: Mapped[dict] = mapped_column(
|
||||
JSON, default=dict, nullable=False
|
||||
) # {"relative/path": "content", ...}
|
||||
project_overrides: Mapped[dict | None] = mapped_column(
|
||||
JSON, default=dict, nullable=True
|
||||
) # {"project_id": {"mount_path": "...", "files": {...}}}
|
||||
# DEPRECATED: Legacy auto-mounting flag. No longer used for launch-time
|
||||
# auto-mounting. Use ConfigProfile and ToolInstance.selected_profile_id instead.
|
||||
is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
|
||||
|
||||
user: Mapped["User"] = relationship()
|
||||
@@ -0,0 +1,36 @@
|
||||
import uuid
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
from sqlalchemy import ForeignKey, Integer, UniqueConstraint
|
||||
from sqlalchemy import Uuid as UUID
|
||||
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||||
|
||||
from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from src.models.config_profile import ConfigProfile
|
||||
|
||||
|
||||
class ConfigInclude(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
__tablename__ = "config_includes"
|
||||
__table_args__ = (
|
||||
UniqueConstraint("profile_id", "included_profile_id", name="uq_config_includes_pair"),
|
||||
)
|
||||
|
||||
profile_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
|
||||
)
|
||||
included_profile_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
|
||||
)
|
||||
order_index: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
|
||||
|
||||
profile: Mapped["ConfigProfile"] = relationship(
|
||||
"ConfigProfile",
|
||||
foreign_keys=[profile_id],
|
||||
back_populates="includes",
|
||||
)
|
||||
included_profile: Mapped["ConfigProfile"] = relationship(
|
||||
"ConfigProfile",
|
||||
foreign_keys=[included_profile_id],
|
||||
)
|
||||
@@ -0,0 +1,35 @@
|
||||
import uuid
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
from sqlalchemy import ForeignKey, Integer, String, Text
|
||||
from sqlalchemy import Uuid as UUID
|
||||
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||||
|
||||
from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from src.models.config_profile import ConfigProfile
|
||||
|
||||
|
||||
class ConfigMount(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
__tablename__ = "config_mounts"
|
||||
|
||||
profile_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
|
||||
)
|
||||
mount_path: Mapped[str] = mapped_column(String(1024), nullable=False)
|
||||
content: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
source_profile_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(), ForeignKey("config_profiles.id", ondelete="SET NULL"), nullable=True
|
||||
)
|
||||
order_index: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
|
||||
|
||||
profile: Mapped["ConfigProfile"] = relationship(
|
||||
"ConfigProfile",
|
||||
foreign_keys=[profile_id],
|
||||
back_populates="mounts",
|
||||
)
|
||||
source_profile: Mapped["ConfigProfile | None"] = relationship(
|
||||
"ConfigProfile",
|
||||
foreign_keys=[source_profile_id],
|
||||
)
|
||||
@@ -1,77 +1,39 @@
|
||||
import uuid
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
from sqlalchemy import ForeignKey, JSON, Integer, String, Text, Boolean
|
||||
from sqlalchemy import ForeignKey, String, Text, UniqueConstraint
|
||||
from sqlalchemy import Uuid as UUID
|
||||
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||||
|
||||
from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from src.models.project import Project
|
||||
from src.models.tool_type import ToolType
|
||||
from src.models.user import User
|
||||
|
||||
|
||||
class ConfigProfile(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
__tablename__ = "config_profiles"
|
||||
__table_args__ = (
|
||||
UniqueConstraint("user_id", "name", name="uq_config_profiles_user_name"),
|
||||
)
|
||||
|
||||
user_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(), ForeignKey("users.id", ondelete="CASCADE"), nullable=False
|
||||
)
|
||||
name: Mapped[str] = mapped_column(String(255), nullable=False)
|
||||
description: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
project_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(), ForeignKey("projects.id", ondelete="CASCADE"), nullable=True
|
||||
)
|
||||
tool_type_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(), ForeignKey("tool_types.id", ondelete="CASCADE"), nullable=True
|
||||
)
|
||||
env_vars: Mapped[dict] = mapped_column(
|
||||
JSON, default=dict, nullable=False
|
||||
) # {"VAR_NAME": "value", ...}
|
||||
runtime_hints: Mapped[dict] = mapped_column(
|
||||
JSON, default=dict, nullable=False
|
||||
) # {"start_command": "...", "working_dir": "...", ...}
|
||||
mounts: Mapped[list] = mapped_column(
|
||||
JSON, default=list, nullable=False
|
||||
) # [{"target": "/path", "mode": "rw", "files": {"rel/path": "content"}}, ...]
|
||||
files: Mapped[dict] = mapped_column(
|
||||
JSON, default=dict, nullable=False
|
||||
) # {"rel/path": "content", ...}
|
||||
git_mounts: Mapped[list] = mapped_column(
|
||||
JSON, default=list, nullable=False
|
||||
) # [{"remote_url": "https://github.com/user/repo.git", "source_path": ".", "target_path": "/path", "branch": "main"}, ...]
|
||||
is_default: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
|
||||
|
||||
user: Mapped["User"] = relationship()
|
||||
project: Mapped["Project | None"] = relationship()
|
||||
tool_type: Mapped["ToolType | None"] = relationship()
|
||||
includes: Mapped[list["ConfigProfileInclude"]] = relationship(
|
||||
"ConfigProfileInclude",
|
||||
foreign_keys="ConfigProfileInclude.profile_id",
|
||||
order_by="ConfigProfileInclude.order_index",
|
||||
includes: Mapped[list["ConfigInclude"]] = relationship(
|
||||
"ConfigInclude",
|
||||
foreign_keys="ConfigInclude.profile_id",
|
||||
back_populates="profile",
|
||||
cascade="all, delete-orphan",
|
||||
order_by="ConfigInclude.order_index",
|
||||
)
|
||||
|
||||
|
||||
class ConfigProfileInclude(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
__tablename__ = "config_profile_includes"
|
||||
|
||||
profile_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
|
||||
)
|
||||
included_profile_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
|
||||
)
|
||||
order_index: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
|
||||
|
||||
profile: Mapped["ConfigProfile"] = relationship(
|
||||
"ConfigProfile",
|
||||
foreign_keys=[profile_id],
|
||||
back_populates="includes",
|
||||
)
|
||||
included_profile: Mapped["ConfigProfile"] = relationship(
|
||||
"ConfigProfile",
|
||||
foreign_keys=[included_profile_id],
|
||||
mounts: Mapped[list["ConfigMount"]] = relationship(
|
||||
"ConfigMount",
|
||||
back_populates="profile",
|
||||
cascade="all, delete-orphan",
|
||||
order_by="ConfigMount.order_index",
|
||||
)
|
||||
|
||||
@@ -10,7 +10,6 @@ from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from src.models.project import Project
|
||||
from src.models.ssh_key import SSHKey
|
||||
from src.models.user import User
|
||||
|
||||
|
||||
@@ -19,15 +18,11 @@ class GitRepository(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
|
||||
name: Mapped[str] = mapped_column(String(255))
|
||||
path: Mapped[str] = mapped_column(String(1024))
|
||||
project_id: Mapped[uuid.UUID | None] = mapped_column(UUID(), ForeignKey("projects.id"), nullable=True)
|
||||
project_id: Mapped[uuid.UUID] = mapped_column(UUID(), ForeignKey("projects.id"), nullable=False)
|
||||
owner_id: Mapped[uuid.UUID] = mapped_column(UUID(), ForeignKey("users.id"), nullable=False)
|
||||
is_mirror: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
|
||||
remote_url: Mapped[str | None] = mapped_column(String(1024), nullable=True)
|
||||
last_push: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
|
||||
ssh_key_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(), ForeignKey("ssh_keys.id"), nullable=True
|
||||
)
|
||||
|
||||
project: Mapped["Project"] = relationship(back_populates="repositories")
|
||||
owner: Mapped["User"] = relationship()
|
||||
ssh_key: Mapped["SSHKey | None"] = relationship()
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
"""SQLAlchemy model for health check snapshots."""
|
||||
|
||||
import uuid
|
||||
from datetime import datetime
|
||||
|
||||
from sqlalchemy import Boolean, DateTime, ForeignKey, Integer, String, Text, Uuid, func
|
||||
from sqlalchemy.orm import Mapped, mapped_column
|
||||
|
||||
from src.models.base import Base, UUIDPrimaryKeyMixin
|
||||
|
||||
|
||||
class HealthCheck(UUIDPrimaryKeyMixin, Base):
|
||||
__tablename__ = "health_checks"
|
||||
|
||||
instance_id: Mapped[uuid.UUID] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("tool_instances.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
)
|
||||
container_status: Mapped[str | None] = mapped_column(String(50), nullable=True)
|
||||
container_healthy: Mapped[bool | None] = mapped_column(Boolean, nullable=True)
|
||||
tunnel_healthy: Mapped[bool | None] = mapped_column(Boolean, nullable=True)
|
||||
exit_code: Mapped[int | None] = mapped_column(Integer, nullable=True)
|
||||
probe_status: Mapped[str | None] = mapped_column(String(50), nullable=True)
|
||||
probe_output: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
checked_at: Mapped[datetime] = mapped_column(
|
||||
DateTime(timezone=True),
|
||||
server_default=func.now(),
|
||||
nullable=False,
|
||||
)
|
||||
@@ -1,39 +0,0 @@
|
||||
"""SQLAlchemy model for instance lifecycle event audit rows."""
|
||||
|
||||
import uuid
|
||||
from datetime import datetime
|
||||
from typing import Any
|
||||
|
||||
from sqlalchemy import DateTime, ForeignKey, JSON, String, Text, Uuid, func
|
||||
from sqlalchemy.orm import Mapped, mapped_column
|
||||
|
||||
from src.models.base import Base, UUIDPrimaryKeyMixin
|
||||
|
||||
|
||||
class InstanceEvent(UUIDPrimaryKeyMixin, Base):
|
||||
__tablename__ = "instance_events"
|
||||
|
||||
instance_id: Mapped[uuid.UUID] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("tool_instances.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
)
|
||||
event_type: Mapped[str] = mapped_column(String(50), nullable=False)
|
||||
status: Mapped[str | None] = mapped_column(String(50), nullable=True)
|
||||
message: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
created_by: Mapped[uuid.UUID | None] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("users.id", ondelete="SET NULL"),
|
||||
nullable=True,
|
||||
)
|
||||
event_metadata: Mapped[dict[str, Any]] = mapped_column(
|
||||
"metadata",
|
||||
JSON,
|
||||
nullable=False,
|
||||
default=dict,
|
||||
)
|
||||
created_at: Mapped[datetime] = mapped_column(
|
||||
DateTime(timezone=True),
|
||||
server_default=func.now(),
|
||||
nullable=False,
|
||||
)
|
||||
@@ -1,43 +0,0 @@
|
||||
"""Notification SQLAlchemy model."""
|
||||
|
||||
from datetime import datetime
|
||||
from typing import Any
|
||||
import uuid
|
||||
|
||||
from sqlalchemy import DateTime, ForeignKey, JSON, String, Text
|
||||
from sqlalchemy import Uuid as UUID
|
||||
from sqlalchemy.orm import Mapped, mapped_column
|
||||
from sqlalchemy.sql import func
|
||||
|
||||
from src.models.base import Base, UUIDPrimaryKeyMixin
|
||||
|
||||
|
||||
class Notification(UUIDPrimaryKeyMixin, Base):
|
||||
__tablename__ = "notifications"
|
||||
|
||||
user_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(as_uuid=True),
|
||||
ForeignKey("users.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
index=True,
|
||||
)
|
||||
category: Mapped[str] = mapped_column(String(32), nullable=False)
|
||||
severity: Mapped[str] = mapped_column(String(16), nullable=False)
|
||||
title: Mapped[str] = mapped_column(String(255), nullable=False)
|
||||
message: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
source_type: Mapped[str | None] = mapped_column(String(64), nullable=True)
|
||||
source_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(as_uuid=True), nullable=True
|
||||
)
|
||||
notification_metadata: Mapped[dict[str, Any]] = mapped_column(
|
||||
"metadata", JSON, nullable=False, default=dict
|
||||
)
|
||||
read_at: Mapped[datetime | None] = mapped_column(
|
||||
DateTime(timezone=True), nullable=True, index=True
|
||||
)
|
||||
dismissed_at: Mapped[datetime | None] = mapped_column(
|
||||
DateTime(timezone=True), nullable=True
|
||||
)
|
||||
created_at: Mapped[datetime] = mapped_column(
|
||||
DateTime(timezone=True), server_default=func.now(), nullable=False, index=True
|
||||
)
|
||||
@@ -1,37 +0,0 @@
|
||||
"""Terminal session database model."""
|
||||
|
||||
import uuid
|
||||
from datetime import datetime
|
||||
|
||||
from sqlalchemy import DateTime, ForeignKey, String
|
||||
from sqlalchemy import Uuid as UUID
|
||||
from sqlalchemy.orm import Mapped, mapped_column
|
||||
|
||||
from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
|
||||
|
||||
|
||||
class TerminalSessionModel(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
"""Database model for terminal session metadata."""
|
||||
|
||||
__tablename__ = "terminal_sessions"
|
||||
|
||||
instance_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(),
|
||||
ForeignKey("tool_instances.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
index=True,
|
||||
)
|
||||
name: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
||||
status: Mapped[str] = mapped_column(
|
||||
String(50),
|
||||
nullable=False,
|
||||
default="active",
|
||||
)
|
||||
last_activity_at: Mapped[datetime | None] = mapped_column(
|
||||
DateTime(timezone=True),
|
||||
nullable=True,
|
||||
)
|
||||
closed_at: Mapped[datetime | None] = mapped_column(
|
||||
DateTime(timezone=True),
|
||||
nullable=True,
|
||||
)
|
||||
@@ -0,0 +1,48 @@
|
||||
import uuid
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
from sqlalchemy import ForeignKey, JSON, String, Text
|
||||
from sqlalchemy import Uuid as UUID
|
||||
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||||
|
||||
from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from src.models.project import Project
|
||||
from src.models.tool_type import ToolType
|
||||
from src.models.user import User
|
||||
|
||||
|
||||
class ToolConfig(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
__tablename__ = "tool_configs"
|
||||
|
||||
user_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(), ForeignKey("users.id"), nullable=False
|
||||
)
|
||||
tool_type_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(), ForeignKey("tool_types.id"), nullable=False
|
||||
)
|
||||
project_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(), ForeignKey("projects.id"), nullable=True
|
||||
)
|
||||
key: Mapped[str] = mapped_column(String(255), nullable=False)
|
||||
value: Mapped[str] = mapped_column(Text, nullable=False)
|
||||
config_type: Mapped[str] = mapped_column(
|
||||
String(20), nullable=False, default="env"
|
||||
) # "env" or "file"
|
||||
file_path: Mapped[str | None] = mapped_column(
|
||||
String(1024), nullable=True
|
||||
) # Only for file type
|
||||
port_override: Mapped[int | None] = mapped_column(nullable=True)
|
||||
start_command: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
working_directory: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
environment_variables: Mapped[dict | None] = mapped_column(
|
||||
JSON, default=dict, nullable=True
|
||||
)
|
||||
volumes: Mapped[list[dict] | None] = mapped_column(
|
||||
JSON, default=list, nullable=True
|
||||
)
|
||||
|
||||
user: Mapped["User"] = relationship()
|
||||
tool_type: Mapped["ToolType"] = relationship()
|
||||
project: Mapped["Project | None"] = relationship()
|
||||
@@ -1,67 +0,0 @@
|
||||
"""Tool Definition Manifest model."""
|
||||
|
||||
import uuid
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
from sqlalchemy import Boolean, ForeignKey, JSON, String, Text
|
||||
from sqlalchemy import Uuid as UUID
|
||||
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||||
|
||||
from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from src.models.user import User
|
||||
|
||||
|
||||
class ToolDefinitionManifest(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
"""A declarative manifest that compiles to Dockerfile + Compose.
|
||||
|
||||
Can be either:
|
||||
- A base definition (is_base=True) with a FROM image and common packages
|
||||
- A tool definition (is_base=False) that references a base + adds specifics
|
||||
"""
|
||||
|
||||
__tablename__ = "tool_definition_manifests"
|
||||
|
||||
name: Mapped[str] = mapped_column(String(64), unique=True, nullable=False)
|
||||
display_name: Mapped[str] = mapped_column(String(128), nullable=False)
|
||||
description: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
category: Mapped[str | None] = mapped_column(String(64), nullable=True)
|
||||
interface_type: Mapped[str] = mapped_column(String(16), nullable=False)
|
||||
|
||||
# Base: either a direct image or a reference to another manifest
|
||||
base_image: Mapped[str | None] = mapped_column(String(256), nullable=True)
|
||||
base_definition_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(),
|
||||
ForeignKey("tool_definition_manifests.id"),
|
||||
nullable=True,
|
||||
)
|
||||
base_version: Mapped[str] = mapped_column(
|
||||
String(32), nullable=False, default="latest"
|
||||
)
|
||||
|
||||
# The full manifest JSON
|
||||
manifest: Mapped[dict] = mapped_column(JSON, nullable=False)
|
||||
|
||||
# Caches for quick inspection
|
||||
dockerfile_cache: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
compose_cache: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
|
||||
# Versioning
|
||||
version: Mapped[str] = mapped_column(String(32), nullable=False, default="v1")
|
||||
is_base: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
|
||||
|
||||
created_by_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(),
|
||||
ForeignKey("users.id"),
|
||||
nullable=True,
|
||||
)
|
||||
|
||||
# Relationships
|
||||
created_by: Mapped["User | None"] = relationship(
|
||||
foreign_keys=[created_by_id],
|
||||
)
|
||||
base_definition: Mapped["ToolDefinitionManifest | None"] = relationship(
|
||||
remote_side="ToolDefinitionManifest.id",
|
||||
foreign_keys=[base_definition_id],
|
||||
)
|
||||
@@ -2,7 +2,7 @@ import uuid
|
||||
from datetime import datetime
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
from sqlalchemy import DateTime, ForeignKey, Integer, JSON, String
|
||||
from sqlalchemy import DateTime, ForeignKey, Integer, String
|
||||
from sqlalchemy import Uuid as UUID
|
||||
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||||
|
||||
@@ -33,36 +33,42 @@ class ToolInstance(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
owner_id: Mapped[uuid.UUID] = mapped_column(
|
||||
UUID(), ForeignKey("users.id"), nullable=False
|
||||
)
|
||||
status: Mapped[str] = mapped_column(String(50), nullable=False, default="pending")
|
||||
container_id: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
||||
container_name: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
||||
compose_path: Mapped[str | None] = mapped_column(String(1024), nullable=True)
|
||||
url: Mapped[str | None] = mapped_column(String(1024), nullable=True)
|
||||
public_url: Mapped[str | None] = mapped_column(String(1024), nullable=True)
|
||||
tunnel_id: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
||||
port: Mapped[int | None] = mapped_column(Integer, nullable=True)
|
||||
status: Mapped[str] = mapped_column(
|
||||
String(50), nullable=False, default="pending"
|
||||
)
|
||||
container_id: Mapped[str | None] = mapped_column(
|
||||
String(255), nullable=True
|
||||
)
|
||||
container_name: Mapped[str | None] = mapped_column(
|
||||
String(255), nullable=True
|
||||
)
|
||||
compose_path: Mapped[str | None] = mapped_column(
|
||||
String(1024), nullable=True
|
||||
)
|
||||
url: Mapped[str | None] = mapped_column(
|
||||
String(1024), nullable=True
|
||||
)
|
||||
public_url: Mapped[str | None] = mapped_column(
|
||||
String(1024), nullable=True
|
||||
)
|
||||
tunnel_id: Mapped[str | None] = mapped_column(
|
||||
String(255), nullable=True
|
||||
)
|
||||
port: Mapped[int | None] = mapped_column(
|
||||
Integer, nullable=True
|
||||
)
|
||||
last_started_at: Mapped[datetime | None] = mapped_column(
|
||||
DateTime(timezone=True), nullable=True
|
||||
)
|
||||
last_stopped_at: Mapped[datetime | None] = mapped_column(
|
||||
DateTime(timezone=True), nullable=True
|
||||
)
|
||||
manifest_compiled_at: Mapped[datetime | None] = mapped_column(
|
||||
DateTime(timezone=True), nullable=True
|
||||
)
|
||||
image_tag: Mapped[str | None] = mapped_column(String(256), nullable=True)
|
||||
probe_result: Mapped[dict | None] = mapped_column(JSON, nullable=True)
|
||||
clone_mode: Mapped[str] = mapped_column(String(20), nullable=False, default="mount")
|
||||
branch: Mapped[str | None] = mapped_column(
|
||||
String(255), nullable=True, default="main"
|
||||
)
|
||||
selected_config_profile_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
selected_profile_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(), ForeignKey("config_profiles.id", ondelete="SET NULL"), nullable=True
|
||||
)
|
||||
ssh_key_ids: Mapped[list[str] | None] = mapped_column(JSON, nullable=True)
|
||||
|
||||
tool_type: Mapped["ToolType"] = relationship()
|
||||
repository: Mapped["GitRepository"] = relationship()
|
||||
project: Mapped["Project"] = relationship()
|
||||
owner: Mapped["User"] = relationship()
|
||||
selected_config_profile: Mapped["ConfigProfile | None"] = relationship()
|
||||
selected_profile: Mapped["ConfigProfile | None"] = relationship()
|
||||
|
||||
@@ -8,7 +8,6 @@ from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||||
from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from src.models.tool_definition_manifest import ToolDefinitionManifest
|
||||
from src.models.user import User
|
||||
|
||||
|
||||
@@ -19,36 +18,23 @@ class ToolType(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
display_name: Mapped[str] = mapped_column(String(255), nullable=False)
|
||||
description: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
category: Mapped[str] = mapped_column(String(50), nullable=False, default="other")
|
||||
interface_type: Mapped[str] = mapped_column(
|
||||
String(20), nullable=False, default="web"
|
||||
)
|
||||
requires_port: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
|
||||
interfaces: Mapped[list[str]] = mapped_column(JSON, default=list, nullable=False)
|
||||
default_port: Mapped[int] = mapped_column(nullable=False)
|
||||
definition_type: Mapped[str] = mapped_column(
|
||||
String(16), nullable=False, default="legacy"
|
||||
) # "legacy" | "manifest"
|
||||
manifest_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(),
|
||||
ForeignKey("tool_definition_manifests.id"),
|
||||
nullable=True,
|
||||
)
|
||||
String(20), nullable=False, default="compose"
|
||||
) # "compose" or "dockerfile"
|
||||
compose_template: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
dockerfile_template: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
build_context: Mapped[dict | None] = mapped_column(
|
||||
JSON, default=dict, nullable=True
|
||||
)
|
||||
readiness_probe: Mapped[dict | None] = mapped_column(JSON, nullable=True)
|
||||
startup_command: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
required_variables: Mapped[list[str]] = mapped_column(
|
||||
JSON, default=list, nullable=False
|
||||
)
|
||||
required_variables: Mapped[list[str]] = mapped_column(JSON, default=list, nullable=False)
|
||||
is_builtin: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
|
||||
created_by_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
UUID(),
|
||||
ForeignKey("users.id"),
|
||||
nullable=True,
|
||||
)
|
||||
|
||||
manifest: Mapped["ToolDefinitionManifest | None"] = relationship(
|
||||
foreign_keys=[manifest_id],
|
||||
)
|
||||
created_by: Mapped["User | None"] = relationship()
|
||||
|
||||
@@ -18,3 +18,23 @@ class UserConfig(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
||||
config: Mapped[dict[str, object]] = mapped_column(JSON, default=dict, nullable=False)
|
||||
|
||||
user: Mapped["User"] = relationship(back_populates="user_config")
|
||||
|
||||
@property
|
||||
def default_profile_id(self) -> uuid.UUID | None:
|
||||
profile_id = self.config.get("default_profile_id")
|
||||
return uuid.UUID(profile_id) if profile_id else None
|
||||
|
||||
@default_profile_id.setter
|
||||
def default_profile_id(self, value: uuid.UUID | None) -> None:
|
||||
if value is not None:
|
||||
self.config["default_profile_id"] = str(value)
|
||||
elif "default_profile_id" in self.config:
|
||||
del self.config["default_profile_id"]
|
||||
|
||||
@property
|
||||
def default_profiles(self) -> dict[str, str]:
|
||||
return self.config.get("default_profiles", {})
|
||||
|
||||
@default_profiles.setter
|
||||
def default_profiles(self, value: dict[str, str]) -> None:
|
||||
self.config["default_profiles"] = value
|
||||
|
||||
@@ -1,97 +0,0 @@
|
||||
"""Clone service for repository cloning and dirty state checking."""
|
||||
|
||||
import logging
|
||||
import os
|
||||
import subprocess
|
||||
from pathlib import Path
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def clone_repository(
|
||||
remote_url: str,
|
||||
ssh_key_path: str | None,
|
||||
instance_dir: str,
|
||||
branch: str = "main",
|
||||
) -> str:
|
||||
"""Clone a git repository into the instance directory.
|
||||
|
||||
Args:
|
||||
remote_url: Git remote URL (SSH or HTTPS)
|
||||
ssh_key_path: Path to SSH private key for authentication (optional)
|
||||
instance_dir: Path to instance directory
|
||||
branch: Branch to clone (default: main)
|
||||
|
||||
Returns:
|
||||
Path to the cloned repository
|
||||
"""
|
||||
clone_path = Path(instance_dir) / "repo-clone"
|
||||
clone_path.mkdir(parents=True, exist_ok=True)
|
||||
|
||||
env = os.environ.copy()
|
||||
if ssh_key_path:
|
||||
# Use SSH key for cloning
|
||||
env["GIT_SSH_COMMAND"] = f"ssh -i {ssh_key_path} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
|
||||
|
||||
cmd = [
|
||||
"git",
|
||||
"clone",
|
||||
"--branch", branch,
|
||||
"--single-branch",
|
||||
remote_url,
|
||||
str(clone_path),
|
||||
]
|
||||
|
||||
logger.debug("Cloning repository %s (branch: %s) into %s", remote_url, branch, clone_path)
|
||||
result = subprocess.run(
|
||||
cmd,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
env=env,
|
||||
timeout=300,
|
||||
)
|
||||
|
||||
if result.returncode != 0:
|
||||
logger.error("Git clone failed: %s", result.stderr)
|
||||
raise RuntimeError(f"Failed to clone repository: {result.stderr}")
|
||||
|
||||
logger.debug("Successfully cloned repository into %s", clone_path)
|
||||
return str(clone_path)
|
||||
|
||||
|
||||
def check_dirty_state(clone_path: str) -> tuple[bool, list[str]]:
|
||||
"""Check for uncommitted changes in a cloned repository.
|
||||
|
||||
Args:
|
||||
clone_path: Path to the cloned repository
|
||||
|
||||
Returns:
|
||||
Tuple of (is_dirty, list_of_changed_files)
|
||||
"""
|
||||
result = subprocess.run(
|
||||
["git", "-C", clone_path, "status", "--short"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
)
|
||||
|
||||
if result.returncode != 0:
|
||||
logger.warning("Failed to check git status: %s", result.stderr)
|
||||
return False, []
|
||||
|
||||
changed_files = [line.strip() for line in result.stdout.split("\n") if line.strip()]
|
||||
is_dirty = len(changed_files) > 0
|
||||
|
||||
return is_dirty, changed_files
|
||||
|
||||
|
||||
def remove_clone_directory(instance_dir: str) -> None:
|
||||
"""Remove the cloned repository from the instance directory.
|
||||
|
||||
Args:
|
||||
instance_dir: Path to instance directory
|
||||
"""
|
||||
clone_path = Path(instance_dir) / "repo-clone"
|
||||
if clone_path.exists():
|
||||
import shutil
|
||||
shutil.rmtree(clone_path)
|
||||
logger.debug("Removed clone directory: %s", clone_path)
|
||||
@@ -1,567 +0,0 @@
|
||||
"""Config profile resolver service.
|
||||
|
||||
Provides recursive ordered include resolution with deterministic merge rules
|
||||
and cycle protection.
|
||||
"""
|
||||
|
||||
import logging
|
||||
import os
|
||||
import uuid
|
||||
from dataclasses import dataclass, field
|
||||
from typing import Any
|
||||
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.models.config_profile import ConfigProfile, ConfigProfileInclude
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class ConfigProfileCycleError(Exception):
|
||||
"""Raised when a cycle is detected in profile includes."""
|
||||
|
||||
pass
|
||||
|
||||
|
||||
class ConfigProfileNotFoundError(Exception):
|
||||
"""Raised when a referenced profile is not found."""
|
||||
|
||||
pass
|
||||
|
||||
|
||||
@dataclass
|
||||
class ResolvedMount:
|
||||
"""A resolved mount with merged files and final mode."""
|
||||
|
||||
target: str
|
||||
mode: str
|
||||
files: dict[str, str] = field(default_factory=dict)
|
||||
overridden_files: dict[str, str] = field(default_factory=dict)
|
||||
|
||||
|
||||
@dataclass
|
||||
class ResolvedProfile:
|
||||
"""The fully resolved output of a config profile."""
|
||||
|
||||
profile_id: uuid.UUID
|
||||
profile_name: str
|
||||
env_vars: dict[str, str] = field(default_factory=dict)
|
||||
runtime_hints: dict[str, Any] = field(default_factory=dict)
|
||||
mounts: dict[str, ResolvedMount] = field(default_factory=dict)
|
||||
git_mounts: list[dict[str, Any]] = field(default_factory=list)
|
||||
files: dict[str, str] = field(default_factory=dict)
|
||||
env_overrides: dict[str, str] = field(default_factory=dict)
|
||||
hint_overrides: dict[str, str] = field(default_factory=dict)
|
||||
file_overrides: dict[str, str] = field(default_factory=dict)
|
||||
mount_overrides: dict[str, str] = field(default_factory=dict)
|
||||
included_profiles: list[dict[str, Any]] = field(default_factory=list)
|
||||
|
||||
|
||||
def _detect_cycle(
|
||||
profile_id: uuid.UUID, visited: set[uuid.UUID], path: list[uuid.UUID]
|
||||
) -> bool:
|
||||
"""Detect if adding profile_id to path would create a cycle.
|
||||
|
||||
Args:
|
||||
profile_id: The profile ID to check.
|
||||
visited: Set of already-visited profile IDs in current resolution.
|
||||
path: Current resolution path for error reporting.
|
||||
|
||||
Returns:
|
||||
True if a cycle would be created.
|
||||
"""
|
||||
if profile_id in visited:
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def _merge_env_vars(
|
||||
base: dict[str, str],
|
||||
overlay: dict[str, str],
|
||||
overrides: dict[str, str],
|
||||
source_name: str,
|
||||
) -> dict[str, str]:
|
||||
"""Merge env vars, tracking overrides.
|
||||
|
||||
Later values replace earlier values.
|
||||
"""
|
||||
result = dict(base)
|
||||
for key, value in overlay.items():
|
||||
if key in result and result[key] != value:
|
||||
overrides[key] = source_name
|
||||
result[key] = value
|
||||
return result
|
||||
|
||||
|
||||
def _merge_runtime_hints(
|
||||
base: dict[str, Any],
|
||||
overlay: dict[str, Any],
|
||||
overrides: dict[str, str],
|
||||
source_name: str,
|
||||
) -> dict[str, Any]:
|
||||
"""Merge runtime hints, tracking overrides.
|
||||
|
||||
Later values replace earlier values.
|
||||
"""
|
||||
result = dict(base)
|
||||
for key, value in overlay.items():
|
||||
if key in result and result[key] != value:
|
||||
overrides[key] = source_name
|
||||
result[key] = value
|
||||
return result
|
||||
|
||||
|
||||
def _merge_files(
|
||||
base: dict[str, str],
|
||||
overlay: dict[str, str],
|
||||
overrides: dict[str, str],
|
||||
source_name: str,
|
||||
) -> dict[str, str]:
|
||||
"""Merge file maps, tracking overrides.
|
||||
|
||||
Later relative file paths win.
|
||||
"""
|
||||
result = dict(base)
|
||||
for path, content in overlay.items():
|
||||
if path in result and result[path] != content:
|
||||
overrides[path] = source_name
|
||||
result[path] = content
|
||||
return result
|
||||
|
||||
|
||||
def _merge_mounts(
|
||||
base: dict[str, ResolvedMount],
|
||||
overlay: list[dict[str, Any]],
|
||||
overrides: dict[str, str],
|
||||
source_name: str,
|
||||
) -> dict[str, ResolvedMount]:
|
||||
"""Merge mounts, tracking overrides.
|
||||
|
||||
Mounts with the same target path have their file maps merged and later
|
||||
relative file paths win. Mode conflicts: later layer wins.
|
||||
"""
|
||||
result = dict(base)
|
||||
for mount_data in overlay:
|
||||
target = mount_data["target"]
|
||||
mode = mount_data.get("mode", "rw")
|
||||
files = mount_data.get("files", {})
|
||||
|
||||
if target in result:
|
||||
existing = result[target]
|
||||
merged_files = dict(existing.files)
|
||||
file_overrides = dict(existing.overridden_files)
|
||||
for rel_path, content in files.items():
|
||||
if rel_path in merged_files and merged_files[rel_path] != content:
|
||||
file_overrides[rel_path] = source_name
|
||||
merged_files[rel_path] = content
|
||||
if existing.mode != mode:
|
||||
overrides[target] = source_name
|
||||
result[target] = ResolvedMount(
|
||||
target=target,
|
||||
mode=mode,
|
||||
files=merged_files,
|
||||
overridden_files=file_overrides,
|
||||
)
|
||||
else:
|
||||
result[target] = ResolvedMount(
|
||||
target=target,
|
||||
mode=mode,
|
||||
files=dict(files),
|
||||
)
|
||||
return result
|
||||
|
||||
|
||||
def _merge_git_mounts(
|
||||
base: list[dict[str, Any]],
|
||||
overlay: list[dict[str, Any]],
|
||||
source_name: str,
|
||||
) -> list[dict[str, Any]]:
|
||||
"""Merge git mounts from included profiles.
|
||||
|
||||
Entries with the same remote_url + branch have their mappings concatenated.
|
||||
Different repos are kept as separate entries.
|
||||
All entries are normalized to the mappings format.
|
||||
"""
|
||||
result = list(base)
|
||||
# Normalize existing entries to mappings format
|
||||
for i, m in enumerate(result):
|
||||
result[i] = _normalize_git_mount_entry(dict(m))
|
||||
|
||||
# Build lookup by (remote_url, branch)
|
||||
seen = {}
|
||||
for i, m in enumerate(result):
|
||||
key = (m["remote_url"], m.get("branch"))
|
||||
seen[key] = i
|
||||
|
||||
for mount in overlay:
|
||||
mount = _normalize_git_mount_entry(dict(mount))
|
||||
key = (mount["remote_url"], mount.get("branch"))
|
||||
if key in seen:
|
||||
# Same repo+branch: concatenate mappings, dedup by (source_path, target_path)
|
||||
existing = result[seen[key]]
|
||||
existing_sources = {
|
||||
(m["source_path"], m["target_path"])
|
||||
for m in existing.get("mappings", [])
|
||||
}
|
||||
for mapping in mount.get("mappings", []):
|
||||
map_key = (mapping["source_path"], mapping["target_path"])
|
||||
if map_key not in existing_sources:
|
||||
existing["mappings"].append(dict(mapping))
|
||||
existing_sources.add(map_key)
|
||||
else:
|
||||
seen[key] = len(result)
|
||||
result.append(mount)
|
||||
return result
|
||||
|
||||
|
||||
def _normalize_git_mount_entry(entry: dict[str, Any]) -> dict[str, Any]:
|
||||
"""Normalize a git mount entry to the unified mappings format.
|
||||
|
||||
Converts legacy source_path + target_path into a single-entry mappings array.
|
||||
"""
|
||||
entry = dict(entry)
|
||||
if "mappings" not in entry or not entry.get("mappings"):
|
||||
source = entry.get("source_path", ".")
|
||||
target = entry.get("target_path")
|
||||
if target is not None:
|
||||
entry["mappings"] = [{"source_path": source, "target_path": target}]
|
||||
# Remove legacy fields once normalized
|
||||
entry.pop("source_path", None)
|
||||
entry.pop("target_path", None)
|
||||
return entry
|
||||
|
||||
|
||||
async def _resolve_profile_recursive(
|
||||
session: AsyncSession,
|
||||
profile_id: uuid.UUID,
|
||||
visited: set[uuid.UUID],
|
||||
path: list[uuid.UUID],
|
||||
) -> ResolvedProfile:
|
||||
"""Recursively resolve a profile and its includes.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
profile_id: Profile ID to resolve.
|
||||
visited: Set of already-visited profile IDs in current resolution chain.
|
||||
path: Current resolution path for error reporting.
|
||||
|
||||
Returns:
|
||||
ResolvedProfile with all includes merged.
|
||||
|
||||
Raises:
|
||||
ConfigProfileCycleError: If a cycle is detected.
|
||||
ConfigProfileNotFoundError: If the profile is not found.
|
||||
"""
|
||||
if _detect_cycle(profile_id, visited, path):
|
||||
cycle_path = " -> ".join(str(p) for p in path + [profile_id])
|
||||
raise ConfigProfileCycleError(
|
||||
f"Cycle detected in profile includes: {cycle_path}"
|
||||
)
|
||||
|
||||
profile = await session.get(ConfigProfile, profile_id)
|
||||
if profile is None:
|
||||
raise ConfigProfileNotFoundError(f"Config profile not found: {profile_id}")
|
||||
|
||||
new_visited = visited | {profile_id}
|
||||
new_path = path + [profile_id]
|
||||
|
||||
result = ResolvedProfile(
|
||||
profile_id=profile.id,
|
||||
profile_name=profile.name,
|
||||
)
|
||||
|
||||
# Resolve includes in order
|
||||
include_query = (
|
||||
select(ConfigProfileInclude)
|
||||
.where(ConfigProfileInclude.profile_id == profile_id)
|
||||
.order_by(ConfigProfileInclude.order_index)
|
||||
)
|
||||
include_result = await session.execute(include_query)
|
||||
includes = include_result.scalars().all()
|
||||
|
||||
for include in includes:
|
||||
included = await _resolve_profile_recursive(
|
||||
session, include.included_profile_id, new_visited, new_path
|
||||
)
|
||||
result.included_profiles.append(
|
||||
{
|
||||
"id": str(included.profile_id),
|
||||
"name": included.profile_name,
|
||||
}
|
||||
)
|
||||
|
||||
result.env_vars = _merge_env_vars(
|
||||
result.env_vars,
|
||||
included.env_vars,
|
||||
result.env_overrides,
|
||||
included.profile_name,
|
||||
)
|
||||
result.runtime_hints = _merge_runtime_hints(
|
||||
result.runtime_hints,
|
||||
included.runtime_hints,
|
||||
result.hint_overrides,
|
||||
included.profile_name,
|
||||
)
|
||||
result.files = _merge_files(
|
||||
result.files, included.files, result.file_overrides, included.profile_name
|
||||
)
|
||||
result.mounts = _merge_mounts(
|
||||
result.mounts,
|
||||
[
|
||||
{"target": m.target, "mode": m.mode, "files": m.files}
|
||||
for m in included.mounts.values()
|
||||
],
|
||||
result.mount_overrides,
|
||||
included.profile_name,
|
||||
)
|
||||
result.git_mounts = _merge_git_mounts(
|
||||
result.git_mounts, included.git_mounts, included.profile_name
|
||||
)
|
||||
|
||||
# Apply the profile's own settings (selected profile overrides includes)
|
||||
result.env_vars = _merge_env_vars(
|
||||
result.env_vars,
|
||||
profile.env_vars or {},
|
||||
result.env_overrides,
|
||||
profile.name,
|
||||
)
|
||||
result.runtime_hints = _merge_runtime_hints(
|
||||
result.runtime_hints,
|
||||
profile.runtime_hints or {},
|
||||
result.hint_overrides,
|
||||
profile.name,
|
||||
)
|
||||
result.files = _merge_files(
|
||||
result.files,
|
||||
profile.files or {},
|
||||
result.file_overrides,
|
||||
profile.name,
|
||||
)
|
||||
result.mounts = _merge_mounts(
|
||||
result.mounts,
|
||||
profile.mounts or [],
|
||||
result.mount_overrides,
|
||||
profile.name,
|
||||
)
|
||||
result.git_mounts = _merge_git_mounts(
|
||||
result.git_mounts,
|
||||
profile.git_mounts or [],
|
||||
profile.name,
|
||||
)
|
||||
return result
|
||||
|
||||
|
||||
async def resolve_profile(
|
||||
session: AsyncSession,
|
||||
profile_id: uuid.UUID,
|
||||
) -> ResolvedProfile:
|
||||
"""Resolve a config profile with all includes.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
profile_id: Profile ID to resolve.
|
||||
|
||||
Returns:
|
||||
ResolvedProfile with merged env vars, runtime hints, mounts, and files.
|
||||
|
||||
Raises:
|
||||
ConfigProfileCycleError: If a cycle is detected in includes.
|
||||
ConfigProfileNotFoundError: If the profile is not found.
|
||||
"""
|
||||
return await _resolve_profile_recursive(session, profile_id, set(), [])
|
||||
|
||||
|
||||
async def check_include_cycle(
|
||||
session: AsyncSession,
|
||||
profile_id: uuid.UUID,
|
||||
new_include_id: uuid.UUID | None = None,
|
||||
) -> list[uuid.UUID] | None:
|
||||
"""Check if adding an include would create a cycle.
|
||||
|
||||
Used at save time to validate include relationships before persisting.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
profile_id: The profile that would receive the new include.
|
||||
new_include_id: Optional new profile to include. If None, checks existing includes.
|
||||
|
||||
Returns:
|
||||
The cycle path as a list of UUIDs if a cycle exists, otherwise None.
|
||||
"""
|
||||
|
||||
async def _check_from(
|
||||
current_id: uuid.UUID,
|
||||
target_id: uuid.UUID,
|
||||
visited: set[uuid.UUID],
|
||||
path: list[uuid.UUID],
|
||||
) -> list[uuid.UUID] | None:
|
||||
if current_id in visited:
|
||||
if current_id == target_id:
|
||||
return path + [current_id]
|
||||
return None
|
||||
if current_id == target_id and path:
|
||||
return path + [current_id]
|
||||
|
||||
new_visited = visited | {current_id}
|
||||
new_path = path + [current_id]
|
||||
|
||||
include_query = (
|
||||
select(ConfigProfileInclude)
|
||||
.where(ConfigProfileInclude.profile_id == current_id)
|
||||
.order_by(ConfigProfileInclude.order_index)
|
||||
)
|
||||
include_result = await session.execute(include_query)
|
||||
includes = include_result.scalars().all()
|
||||
|
||||
for include in includes:
|
||||
cycle = await _check_from(
|
||||
include.included_profile_id, target_id, new_visited, new_path
|
||||
)
|
||||
if cycle is not None:
|
||||
return cycle
|
||||
return None
|
||||
|
||||
# Check if new_include_id can reach profile_id (would create cycle)
|
||||
if new_include_id is not None:
|
||||
cycle = await _check_from(new_include_id, profile_id, set(), [])
|
||||
if cycle is not None:
|
||||
return cycle
|
||||
|
||||
# Also check existing includes for cycles
|
||||
cycle = await _check_from(profile_id, profile_id, set(), [])
|
||||
if cycle is not None and len(cycle) > 1:
|
||||
return cycle
|
||||
|
||||
return None
|
||||
|
||||
|
||||
def apply_resolved_profile(
|
||||
instance_dir: str,
|
||||
resolved: ResolvedProfile,
|
||||
home_dir: str = "/root",
|
||||
) -> tuple[dict[str, str], dict[str, str], list[dict], dict[str, Any]]:
|
||||
"""Apply a resolved profile to an instance directory.
|
||||
|
||||
Stages files, writes env vars, and prepares mount volumes.
|
||||
|
||||
Args:
|
||||
instance_dir: Path to the instance directory.
|
||||
resolved: The resolved profile.
|
||||
|
||||
Returns:
|
||||
Tuple of (env_vars, files, volume_mounts, runtime_hints).
|
||||
env_vars: Merged environment variables.
|
||||
files: Relative file paths to content for the instance.
|
||||
volume_mounts: List of Docker volume mount dicts.
|
||||
runtime_hints: Extracted runtime hints.
|
||||
"""
|
||||
from pathlib import Path
|
||||
|
||||
instance_path = Path(instance_dir)
|
||||
env_vars = dict(resolved.env_vars)
|
||||
files = dict(resolved.files)
|
||||
volume_mounts = []
|
||||
|
||||
# Write profile files to instance directory
|
||||
for file_path, content in files.items():
|
||||
full_path = instance_path / file_path
|
||||
try:
|
||||
full_path.resolve().relative_to(instance_path.resolve())
|
||||
except ValueError:
|
||||
logger.warning(
|
||||
"Profile file path escapes instance directory: %s", file_path
|
||||
)
|
||||
continue
|
||||
full_path.parent.mkdir(parents=True, exist_ok=True)
|
||||
full_path.write_text(content)
|
||||
|
||||
# Stage mount files and prepare volume mounts
|
||||
for mount in resolved.mounts.values():
|
||||
expanded_target = expand_container_path(mount.target, home_dir)
|
||||
mount_dir = (
|
||||
instance_path / "mounts" / expanded_target.lstrip("/").replace("/", "_")
|
||||
)
|
||||
mount_dir.mkdir(parents=True, exist_ok=True)
|
||||
|
||||
for file_path, content in mount.files.items():
|
||||
full_path = mount_dir / file_path
|
||||
try:
|
||||
full_path.resolve().relative_to(mount_dir.resolve())
|
||||
except ValueError:
|
||||
logger.warning("Mount file path escapes mount directory: %s", file_path)
|
||||
continue
|
||||
full_path.parent.mkdir(parents=True, exist_ok=True)
|
||||
full_path.write_text(content)
|
||||
|
||||
# Mount each file individually so sibling files from other mounts
|
||||
# (e.g. git repo directories) are preserved.
|
||||
file_target = os.path.join(expanded_target, file_path)
|
||||
volume_mounts.append(
|
||||
{
|
||||
"source": str(full_path),
|
||||
"target": file_target,
|
||||
"type": "bind",
|
||||
}
|
||||
)
|
||||
|
||||
return env_vars, files, volume_mounts, resolved.runtime_hints
|
||||
|
||||
|
||||
def expand_container_path(path: str, home_dir: str) -> str:
|
||||
"""Expand ~ and $HOME in a container path to the actual home directory.
|
||||
|
||||
Only expands at the start of the path (e.g., ~/foo, $HOME/foo, $HOME).
|
||||
Leaves mid-string occurrences unchanged.
|
||||
|
||||
Args:
|
||||
path: Container path that may contain ~ or $HOME.
|
||||
home_dir: The container's home directory (e.g., /home/user or /root).
|
||||
|
||||
Returns:
|
||||
Path with ~ and $HOME expanded.
|
||||
"""
|
||||
if path.startswith("~/"):
|
||||
return os.path.join(home_dir, path[2:])
|
||||
if path == "~":
|
||||
return home_dir
|
||||
if path.startswith("$HOME/"):
|
||||
return home_dir + "/" + path[6:]
|
||||
if path == "$HOME":
|
||||
return home_dir
|
||||
return path
|
||||
|
||||
|
||||
def resolved_profile_to_dict(resolved: ResolvedProfile) -> dict[str, Any]:
|
||||
"""Convert a ResolvedProfile to a plain dict for serialization.
|
||||
|
||||
Args:
|
||||
resolved: The resolved profile.
|
||||
|
||||
Returns:
|
||||
Dict with env_vars, runtime_hints, mounts, files, and metadata.
|
||||
"""
|
||||
return {
|
||||
"profile_id": str(resolved.profile_id),
|
||||
"profile_name": resolved.profile_name,
|
||||
"env_vars": resolved.env_vars,
|
||||
"runtime_hints": resolved.runtime_hints,
|
||||
"mounts": [
|
||||
{
|
||||
"target": m.target,
|
||||
"mode": m.mode,
|
||||
"files": m.files,
|
||||
"overridden_files": m.overridden_files,
|
||||
}
|
||||
for m in resolved.mounts.values()
|
||||
],
|
||||
"files": resolved.files,
|
||||
"overrides": {
|
||||
"env_vars": resolved.env_overrides,
|
||||
"runtime_hints": resolved.hint_overrides,
|
||||
"files": resolved.file_overrides,
|
||||
"mounts": resolved.mount_overrides,
|
||||
},
|
||||
"git_mounts": resolved.git_mounts,
|
||||
"included_profiles": resolved.included_profiles,
|
||||
}
|
||||
@@ -1,32 +0,0 @@
|
||||
"""Async correlation ID context variable and helpers."""
|
||||
|
||||
import contextvars
|
||||
import uuid
|
||||
|
||||
from fastapi import Request
|
||||
from starlette.middleware.base import BaseHTTPMiddleware
|
||||
|
||||
CORRELATION_ID: contextvars.ContextVar[str] = contextvars.ContextVar("correlation_id")
|
||||
|
||||
|
||||
def get_correlation_id() -> str:
|
||||
"""Return the current correlation ID or generate a new UUID."""
|
||||
try:
|
||||
return CORRELATION_ID.get()
|
||||
except LookupError:
|
||||
return str(uuid.uuid4())
|
||||
|
||||
|
||||
class CorrelationIdMiddleware(BaseHTTPMiddleware):
|
||||
"""Set correlation ID from X-Request-ID header or generate a new UUID."""
|
||||
|
||||
async def dispatch(self, request: Request, call_next):
|
||||
request_id = request.headers.get("X-Request-ID")
|
||||
correlation_id = request_id or str(uuid.uuid4())
|
||||
token = CORRELATION_ID.set(correlation_id)
|
||||
try:
|
||||
response = await call_next(request)
|
||||
response.headers["X-Request-ID"] = correlation_id
|
||||
return response
|
||||
finally:
|
||||
CORRELATION_ID.reset(token)
|
||||
+88
-349
@@ -1,54 +1,10 @@
|
||||
"""Docker service for managing tool instances."""
|
||||
|
||||
import logging
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
import time
|
||||
from collections import Counter
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def sort_volumes_by_specificity(volumes: list[str]) -> list[str]:
|
||||
"""Sort volume strings so parent paths come before child paths.
|
||||
|
||||
Docker Compose mounts volumes in array order. A later mount at a parent
|
||||
path hides earlier mounts at child paths. By sorting shallow paths first
|
||||
and deep paths last, deeper (more specific) mounts overlay correctly.
|
||||
|
||||
Volume format: source:target or source:target:type
|
||||
|
||||
Args:
|
||||
volumes: List of Docker volume mount strings.
|
||||
|
||||
Returns:
|
||||
Sorted list with parent paths before child paths.
|
||||
"""
|
||||
|
||||
def _target_depth(vol: str) -> int:
|
||||
parts = vol.split(":")
|
||||
if len(parts) < 2:
|
||||
return 0
|
||||
target = parts[1].rstrip("/")
|
||||
if not target or target == "/":
|
||||
return 0
|
||||
return target.count("/")
|
||||
|
||||
# Detect duplicate targets and warn
|
||||
targets = []
|
||||
for vol in volumes:
|
||||
parts = vol.split(":")
|
||||
targets.append(parts[1] if len(parts) > 1 else "")
|
||||
dupes = [t for t, c in Counter(targets).items() if c > 1]
|
||||
if dupes:
|
||||
logger.warning("Duplicate mount targets detected: %s", dupes)
|
||||
|
||||
# Stable sort: parent paths first, child paths last
|
||||
return sorted(volumes, key=_target_depth)
|
||||
|
||||
|
||||
def render_compose_template(template: str, variables: dict[str, Any]) -> str:
|
||||
"""Render a Docker Compose template with variable substitution.
|
||||
@@ -79,7 +35,6 @@ def ensure_instance_directory(instance_id: str, base_path: str | None = None) ->
|
||||
"""
|
||||
if base_path is None:
|
||||
from src.config import Settings
|
||||
|
||||
base_path = Settings().instance_base_path
|
||||
instance_dir = Path(base_path) / instance_id
|
||||
instance_dir.mkdir(parents=True, exist_ok=True)
|
||||
@@ -132,11 +87,64 @@ def write_config_files(instance_dir: str, files: dict[str, str]) -> None:
|
||||
full_path.resolve().relative_to(instance_path.resolve())
|
||||
except ValueError:
|
||||
raise ValueError(f"File path '{file_path}' escapes instance directory")
|
||||
|
||||
|
||||
full_path.parent.mkdir(parents=True, exist_ok=True)
|
||||
full_path.write_text(content)
|
||||
|
||||
|
||||
def write_config_folder_files(instance_dir: str, folders: list, project_id: str | None = None) -> list[dict]:
|
||||
"""Write config folder files to the instance directory and return volume mounts.
|
||||
|
||||
Args:
|
||||
instance_dir: Path to instance directory
|
||||
folders: List of ConfigFolder objects
|
||||
project_id: Optional project ID for applying overrides
|
||||
|
||||
Returns:
|
||||
List of volume mount dicts [{"source": "...", "target": "...", "type": "..."}]
|
||||
"""
|
||||
instance_path = Path(instance_dir)
|
||||
volume_mounts = []
|
||||
|
||||
for folder in folders:
|
||||
# Determine mount path (with project override if applicable)
|
||||
mount_path = folder.mount_path
|
||||
files = folder.files.copy()
|
||||
|
||||
if project_id and folder.project_overrides:
|
||||
override = folder.project_overrides.get(str(project_id))
|
||||
if override:
|
||||
if override.get("mount_path"):
|
||||
mount_path = override["mount_path"]
|
||||
if override.get("files"):
|
||||
files.update(override["files"])
|
||||
|
||||
# Write files to instance directory
|
||||
folder_dir = instance_path / "volumes" / folder.name
|
||||
folder_dir.mkdir(parents=True, exist_ok=True)
|
||||
|
||||
for file_path, content in files.items():
|
||||
# Security: ensure path doesn't escape folder_dir
|
||||
full_path = folder_dir / file_path
|
||||
try:
|
||||
full_path.resolve().relative_to(folder_dir.resolve())
|
||||
except ValueError:
|
||||
logger.warning("Config folder file path escapes directory: %s", file_path)
|
||||
continue
|
||||
|
||||
full_path.parent.mkdir(parents=True, exist_ok=True)
|
||||
full_path.write_text(content)
|
||||
|
||||
# Add volume mount
|
||||
volume_mounts.append({
|
||||
"source": str(folder_dir),
|
||||
"target": mount_path,
|
||||
"type": "bind",
|
||||
})
|
||||
|
||||
return volume_mounts
|
||||
|
||||
|
||||
def execute_compose_command(
|
||||
compose_path: str, action: str, timeout: int = 60, env_file: str | None = None
|
||||
) -> tuple[int, str, str]:
|
||||
@@ -154,12 +162,12 @@ def execute_compose_command(
|
||||
instance_dir = Path(compose_path).parent
|
||||
|
||||
cmd = ["docker", "compose", "-f", compose_path]
|
||||
|
||||
|
||||
if env_file:
|
||||
cmd.extend(["--env-file", env_file])
|
||||
|
||||
if action == "up":
|
||||
cmd.extend(["up", "-d", "--force-recreate"])
|
||||
cmd.extend(["up", "-d"])
|
||||
elif action == "down":
|
||||
cmd.extend(["down", "-v"])
|
||||
elif action in ("start", "stop", "restart"):
|
||||
@@ -181,17 +189,14 @@ def execute_compose_command(
|
||||
def get_container_id(instance_name: str) -> str | None:
|
||||
"""Get the container ID for a compose service.
|
||||
|
||||
Searches all containers including stopped/exited ones.
|
||||
|
||||
Args:
|
||||
instance_name: The service name in compose
|
||||
|
||||
Returns:
|
||||
Container ID or None if not found
|
||||
"""
|
||||
# Docker container names are lowercase internally; normalize to ensure match
|
||||
result = subprocess.run(
|
||||
["docker", "ps", "-a", "-q", "--filter", f"name={instance_name.lower()}"],
|
||||
["docker", "ps", "-q", "--filter", f"name={instance_name}"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
)
|
||||
@@ -204,25 +209,14 @@ def get_container_id(instance_name: str) -> str | None:
|
||||
def get_container_name(instance_name: str) -> str | None:
|
||||
"""Get the full container name for a compose service.
|
||||
|
||||
Searches all containers including stopped/exited ones.
|
||||
|
||||
Args:
|
||||
instance_name: The service name in compose
|
||||
|
||||
Returns:
|
||||
Container name or None if not found
|
||||
"""
|
||||
# Docker container names are lowercase internally; normalize to ensure match
|
||||
result = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"ps",
|
||||
"-a",
|
||||
"--format",
|
||||
"{{.Names}}",
|
||||
"--filter",
|
||||
f"name={instance_name.lower()}",
|
||||
],
|
||||
["docker", "ps", "--format", "{{.Names}}", "--filter", f"name={instance_name}"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
)
|
||||
@@ -232,9 +226,7 @@ def get_container_name(instance_name: str) -> str | None:
|
||||
return None
|
||||
|
||||
|
||||
def connect_container_to_network(
|
||||
container_name: str, network_name: str = "backend"
|
||||
) -> bool:
|
||||
def connect_container_to_network(container_name: str, network_name: str = "backend") -> bool:
|
||||
"""Connect a Docker container to an existing network.
|
||||
|
||||
Args:
|
||||
@@ -252,95 +244,24 @@ def connect_container_to_network(
|
||||
return result.returncode == 0
|
||||
|
||||
|
||||
def get_container_status(container_id: str) -> dict[str, Any]:
|
||||
def get_container_status(container_id: str) -> str:
|
||||
"""Get the status of a Docker container.
|
||||
|
||||
Args:
|
||||
container_id: Docker container ID
|
||||
|
||||
Returns:
|
||||
Dict with 'status' (running, exited, restarting, not_found),
|
||||
'exit_code' (int or None), and 'health' (health status or None)
|
||||
Container status string (running, exited, etc.)
|
||||
"""
|
||||
result = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"inspect",
|
||||
"-f",
|
||||
"{{.State.Status}}|{{.State.ExitCode}}|{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}",
|
||||
container_id,
|
||||
],
|
||||
["docker", "inspect", "-f", "{{.State.Status}}", container_id],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
)
|
||||
|
||||
if result.returncode != 0:
|
||||
return {"status": "not_found", "exit_code": None, "health": None}
|
||||
|
||||
parts = result.stdout.strip().split("|")
|
||||
status = parts[0] if parts else "unknown"
|
||||
exit_code = int(parts[1]) if len(parts) > 1 and parts[1].isdigit() else None
|
||||
health = parts[2] if len(parts) > 2 and parts[2] != "none" else None
|
||||
|
||||
return {"status": status, "exit_code": exit_code, "health": health}
|
||||
|
||||
|
||||
def wait_for_container_running(
|
||||
container_id: str, timeout: int = 30, interval: float = 2.0
|
||||
) -> dict[str, Any]:
|
||||
"""Wait for a container to reach the running state.
|
||||
|
||||
Polls docker inspect until the container status is "running" or timeout.
|
||||
|
||||
Args:
|
||||
container_id: Docker container ID
|
||||
timeout: Maximum seconds to wait
|
||||
interval: Seconds between polls
|
||||
|
||||
Returns:
|
||||
Dict with 'success' (bool), 'status' (str), 'exit_code' (int or None),
|
||||
and 'waited_seconds' (float)
|
||||
"""
|
||||
|
||||
start_time = time.time()
|
||||
|
||||
while time.time() - start_time < timeout:
|
||||
info = get_container_status(container_id)
|
||||
|
||||
if info["status"] == "running":
|
||||
return {
|
||||
"success": True,
|
||||
"status": "running",
|
||||
"exit_code": None,
|
||||
"waited_seconds": time.time() - start_time,
|
||||
}
|
||||
|
||||
if info["status"] == "exited":
|
||||
return {
|
||||
"success": False,
|
||||
"status": "exited",
|
||||
"exit_code": info["exit_code"],
|
||||
"waited_seconds": time.time() - start_time,
|
||||
}
|
||||
|
||||
if info["status"] == "not_found":
|
||||
return {
|
||||
"success": False,
|
||||
"status": "not_found",
|
||||
"exit_code": None,
|
||||
"waited_seconds": time.time() - start_time,
|
||||
}
|
||||
|
||||
time.sleep(interval)
|
||||
|
||||
# Timeout reached
|
||||
info = get_container_status(container_id)
|
||||
return {
|
||||
"success": False,
|
||||
"status": info["status"],
|
||||
"exit_code": info["exit_code"],
|
||||
"waited_seconds": time.time() - start_time,
|
||||
}
|
||||
if result.returncode == 0:
|
||||
return result.stdout.strip()
|
||||
return "unknown"
|
||||
|
||||
|
||||
def get_container_logs(container_id: str, tail: int = 100) -> str:
|
||||
@@ -384,83 +305,9 @@ def find_free_port(start: int = 10000, end: int = 20000) -> int:
|
||||
raise RuntimeError(f"No free port found in range {start}-{end}")
|
||||
|
||||
|
||||
def _check_app_binding(container_name: str, port: int) -> dict[str, str | bool]:
|
||||
"""Diagnose whether the app is bound to 127.0.0.1 or 0.0.0.0.
|
||||
|
||||
Checks from both inside the container (localhost) and outside
|
||||
(via Docker network) to detect binding issues.
|
||||
|
||||
Returns:
|
||||
Dict with 'internal_ok', 'external_ok', 'internal_status',
|
||||
'external_status', and 'diagnosis'.
|
||||
"""
|
||||
import subprocess
|
||||
|
||||
result: dict[str, Any] = {
|
||||
"internal_ok": False,
|
||||
"external_ok": False,
|
||||
"internal_status": None,
|
||||
"external_status": None,
|
||||
"diagnosis": "unknown",
|
||||
}
|
||||
|
||||
# Check from inside the container (loopback)
|
||||
internal = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"exec",
|
||||
container_name,
|
||||
"sh",
|
||||
"-c",
|
||||
f"curl -s -o /dev/null -w '%{{http_code}}' http://localhost:{port}",
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=5,
|
||||
)
|
||||
if internal.returncode == 0:
|
||||
try:
|
||||
result["internal_status"] = int(internal.stdout.strip())
|
||||
result["internal_ok"] = result["internal_status"] > 0
|
||||
except ValueError:
|
||||
pass
|
||||
|
||||
# Check from outside the container (Docker network)
|
||||
external = subprocess.run(
|
||||
[
|
||||
"curl",
|
||||
"-s",
|
||||
"-o",
|
||||
"/dev/null",
|
||||
"-w",
|
||||
"%{http_code}",
|
||||
f"http://{container_name}:{port}",
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=5,
|
||||
)
|
||||
if external.returncode == 0:
|
||||
try:
|
||||
result["external_status"] = int(external.stdout.strip())
|
||||
result["external_ok"] = result["external_status"] > 0
|
||||
except ValueError:
|
||||
pass
|
||||
|
||||
# Diagnose binding issue
|
||||
if result["internal_ok"] and not result["external_ok"]:
|
||||
result["diagnosis"] = (
|
||||
f"App appears to be bound to 127.0.0.1:{port} inside the container. "
|
||||
f"It must bind to 0.0.0.0:{port} to be accessible from the tunnel."
|
||||
)
|
||||
elif result["internal_ok"] and result["external_ok"]:
|
||||
result["diagnosis"] = "App is accessible on both interfaces."
|
||||
elif not result["internal_ok"] and not result["external_ok"]:
|
||||
result["diagnosis"] = f"App is not responding on port {port} at all."
|
||||
else:
|
||||
result["diagnosis"] = "Unexpected binding state."
|
||||
|
||||
return result
|
||||
import subprocess
|
||||
import time
|
||||
import re
|
||||
|
||||
|
||||
def start_cloudflared_tunnel(
|
||||
@@ -480,77 +327,28 @@ def start_cloudflared_tunnel(
|
||||
Dict with 'url' (the public tunnel URL) and 'pid' (process ID)
|
||||
"""
|
||||
import subprocess
|
||||
import time
|
||||
import re
|
||||
import logging
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
# First verify the container is accessible from the Docker network
|
||||
# First verify the container is accessible
|
||||
logger.info("Checking connectivity to %s:%d...", container_name, port)
|
||||
accessible = False
|
||||
last_status = None
|
||||
for attempt in range(30): # 30 attempts × 1s = 30s max wait for app startup
|
||||
for attempt in range(10):
|
||||
check = subprocess.run(
|
||||
[
|
||||
"curl",
|
||||
"-s",
|
||||
"-o",
|
||||
"/dev/null",
|
||||
"-w",
|
||||
"%{http_code}",
|
||||
"--max-time",
|
||||
"3",
|
||||
f"http://{container_name}:{port}",
|
||||
],
|
||||
["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
|
||||
f"http://{container_name}:{port}"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=5,
|
||||
)
|
||||
status_str = check.stdout.strip()
|
||||
logger.info(
|
||||
"Connectivity check %d/%d: http_code=%s (rc=%d)",
|
||||
attempt + 1,
|
||||
30,
|
||||
status_str,
|
||||
check.returncode,
|
||||
)
|
||||
try:
|
||||
last_status = int(status_str)
|
||||
# Accept 2xx, 3xx, 401, 403 as "app is listening"
|
||||
if last_status in (401, 403) or 200 <= last_status < 400:
|
||||
accessible = True
|
||||
logger.info(
|
||||
"App on %s:%d is ready (HTTP %d)",
|
||||
container_name,
|
||||
port,
|
||||
last_status,
|
||||
)
|
||||
break
|
||||
except ValueError:
|
||||
pass
|
||||
|
||||
if check.returncode != 0:
|
||||
logger.debug(
|
||||
"curl failed: stderr=%s", check.stderr.strip() if check.stderr else ""
|
||||
)
|
||||
logger.info("Connectivity check %d: http_code=%s", attempt + 1, check.stdout.strip())
|
||||
if check.returncode == 0:
|
||||
break
|
||||
time.sleep(1)
|
||||
|
||||
if not accessible:
|
||||
logger.warning(
|
||||
"Container %s:%d not responding after 30s (last status: %s). "
|
||||
"Running binding diagnostics...",
|
||||
container_name,
|
||||
port,
|
||||
last_status,
|
||||
)
|
||||
diagnosis = _check_app_binding(container_name, port)
|
||||
logger.warning(
|
||||
"Binding diagnosis: internal=%s (HTTP %s), external=%s (HTTP %s). %s",
|
||||
diagnosis["internal_ok"],
|
||||
diagnosis["internal_status"],
|
||||
diagnosis["external_ok"],
|
||||
diagnosis["external_status"],
|
||||
diagnosis["diagnosis"],
|
||||
)
|
||||
else:
|
||||
logger.warning("Container %s:%d not responding to curl checks", container_name, port)
|
||||
|
||||
# Run cloudflared in background, capture output
|
||||
logger.info("Starting cloudflared tunnel to http://%s:%d", container_name, port)
|
||||
@@ -566,15 +364,9 @@ def start_cloudflared_tunnel(
|
||||
start_time = time.time()
|
||||
url = None
|
||||
|
||||
if proc.stdout is None:
|
||||
proc.terminate()
|
||||
proc.wait(timeout=5)
|
||||
raise RuntimeError("Failed to capture cloudflared output")
|
||||
|
||||
while time.time() - start_time < timeout:
|
||||
# Read available output
|
||||
import select
|
||||
|
||||
readable, _, _ = select.select([proc.stdout], [], [], 1.0)
|
||||
if readable:
|
||||
line = proc.stdout.readline()
|
||||
@@ -601,6 +393,7 @@ def stop_cloudflared_tunnel(pid: str) -> None:
|
||||
Args:
|
||||
pid: Process ID of the cloudflared tunnel
|
||||
"""
|
||||
import os
|
||||
import signal
|
||||
|
||||
try:
|
||||
@@ -631,87 +424,33 @@ def recreate_tunnel(
|
||||
|
||||
|
||||
def check_tunnel_health(url: str, timeout: int = 10) -> dict[str, Any]:
|
||||
"""Check if a tunnel URL is healthy with smart error classification.
|
||||
"""Check if a tunnel URL is healthy.
|
||||
|
||||
Args:
|
||||
url: The tunnel URL to check
|
||||
timeout: Request timeout in seconds
|
||||
|
||||
Returns:
|
||||
Dict with 'tunnel_status' (healthy, unreachable, error_response, not_applicable),
|
||||
'status_code' (int or None), 'healthy' (bool), and 'error' (str or None)
|
||||
Dict with 'healthy' (bool) and 'status_code' (int or None)
|
||||
"""
|
||||
import subprocess
|
||||
|
||||
try:
|
||||
result = subprocess.run(
|
||||
[
|
||||
"curl",
|
||||
"-s",
|
||||
"-o",
|
||||
"/dev/null",
|
||||
"-w",
|
||||
"%{http_code}",
|
||||
"--max-time",
|
||||
str(timeout),
|
||||
url,
|
||||
],
|
||||
["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
|
||||
"--max-time", str(timeout), url],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=timeout + 5,
|
||||
)
|
||||
status_code = int(result.stdout.strip())
|
||||
|
||||
if 200 <= status_code < 400:
|
||||
return {
|
||||
"tunnel_status": "healthy",
|
||||
"status_code": status_code,
|
||||
"healthy": True,
|
||||
"error": None,
|
||||
}
|
||||
elif status_code in (502, 503, 504):
|
||||
# Application error, not tunnel error
|
||||
return {
|
||||
"tunnel_status": "error_response",
|
||||
"status_code": status_code,
|
||||
"healthy": False,
|
||||
"error": f"Application returned HTTP {status_code}",
|
||||
}
|
||||
else:
|
||||
return {
|
||||
"tunnel_status": "error_response",
|
||||
"status_code": status_code,
|
||||
"healthy": False,
|
||||
"error": f"HTTP {status_code}",
|
||||
}
|
||||
except subprocess.TimeoutExpired:
|
||||
return {
|
||||
"tunnel_status": "unreachable",
|
||||
"status_code": None,
|
||||
"healthy": False,
|
||||
"error": "Tunnel request timed out",
|
||||
"healthy": 200 <= status_code < 400,
|
||||
"status_code": status_code,
|
||||
}
|
||||
except (ValueError, Exception) as e:
|
||||
error_str = str(e).lower()
|
||||
# Classify connection errors
|
||||
if any(
|
||||
err in error_str
|
||||
for err in [
|
||||
"connection refused",
|
||||
"econnrefused",
|
||||
"could not resolve",
|
||||
"nodename",
|
||||
]
|
||||
):
|
||||
return {
|
||||
"tunnel_status": "unreachable",
|
||||
"status_code": None,
|
||||
"healthy": False,
|
||||
"error": f"Tunnel unreachable: {e}",
|
||||
}
|
||||
except (ValueError, subprocess.TimeoutExpired, Exception) as e:
|
||||
return {
|
||||
"tunnel_status": "unreachable",
|
||||
"status_code": None,
|
||||
"healthy": False,
|
||||
"status_code": None,
|
||||
"error": str(e),
|
||||
}
|
||||
|
||||
@@ -6,9 +6,7 @@ import subprocess
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def build_image(
|
||||
instance_dir: str, dockerfile: str, tag: str, build_context: dict | None = None
|
||||
) -> tuple[int, str, str]:
|
||||
def build_image(instance_dir: str, dockerfile: str, tag: str, build_context: dict | None = None) -> tuple[int, str, str]:
|
||||
"""Build a Docker image from a Dockerfile.
|
||||
|
||||
Args:
|
||||
@@ -20,18 +18,13 @@ def build_image(
|
||||
Returns:
|
||||
Tuple of (returncode, stdout, stderr)
|
||||
"""
|
||||
import os
|
||||
from pathlib import Path
|
||||
|
||||
# Defensive: normalise any CRLF that may have crept in from manifest DB
|
||||
# strings — Docker's legacy builder treats \r as a character after the
|
||||
# backslash, breaking RUN continuations and producing
|
||||
# "unknown instruction" errors.
|
||||
dockerfile = dockerfile.replace("\r\n", "\n").replace("\r", "\n")
|
||||
|
||||
# Write Dockerfile
|
||||
dockerfile_path = Path(instance_dir) / "Dockerfile"
|
||||
dockerfile_path.write_text(dockerfile, newline="\n")
|
||||
logger.debug("Wrote Dockerfile to %s (%d bytes)", dockerfile_path, len(dockerfile))
|
||||
dockerfile_path.write_text(dockerfile)
|
||||
logger.info("Wrote Dockerfile to %s", dockerfile_path)
|
||||
|
||||
# Write build context files
|
||||
if build_context:
|
||||
@@ -41,27 +34,19 @@ def build_image(
|
||||
try:
|
||||
full_path.resolve().relative_to(Path(instance_dir).resolve())
|
||||
except ValueError:
|
||||
logger.error(
|
||||
"Build context file path escapes instance directory: %s", file_path
|
||||
)
|
||||
raise ValueError(
|
||||
f"Build context file path '{file_path}' escapes instance directory"
|
||||
)
|
||||
|
||||
logger.error("Build context file path escapes instance directory: %s", file_path)
|
||||
raise ValueError(f"Build context file path '{file_path}' escapes instance directory")
|
||||
|
||||
full_path.parent.mkdir(parents=True, exist_ok=True)
|
||||
normalized = content.replace("\r\n", "\n").replace("\r", "\n")
|
||||
full_path.write_text(normalized, newline="\n")
|
||||
logger.debug("Wrote build context file: %s", full_path)
|
||||
full_path.write_text(content)
|
||||
logger.info("Wrote build context file: %s", full_path)
|
||||
|
||||
# Build image
|
||||
logger.debug("Building Docker image with tag: %s", tag)
|
||||
logger.info("Building Docker image with tag: %s", tag)
|
||||
cmd = [
|
||||
"docker",
|
||||
"build",
|
||||
"-t",
|
||||
tag,
|
||||
"-f",
|
||||
str(dockerfile_path),
|
||||
"docker", "build",
|
||||
"-t", tag,
|
||||
"-f", str(dockerfile_path),
|
||||
instance_dir,
|
||||
]
|
||||
|
||||
@@ -72,7 +57,7 @@ def build_image(
|
||||
text=True,
|
||||
timeout=300, # 5 minute timeout for builds
|
||||
)
|
||||
logger.debug("Docker build completed: returncode=%d", result.returncode)
|
||||
logger.info("Docker build completed: returncode=%d", result.returncode)
|
||||
if result.returncode != 0:
|
||||
logger.error("Docker build failed: %s", result.stderr[:1000])
|
||||
return result.returncode, result.stdout, result.stderr
|
||||
|
||||
@@ -1,97 +0,0 @@
|
||||
"""In-memory typed event bus for instance lifecycle and health events."""
|
||||
|
||||
import asyncio
|
||||
import inspect
|
||||
import logging
|
||||
import uuid
|
||||
from collections.abc import Awaitable, Callable
|
||||
from typing import Any
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
InstanceEventPayload = dict[str, Any]
|
||||
EventCallback = Callable[[InstanceEventPayload], Awaitable[None] | None] # noqa: UP044
|
||||
|
||||
|
||||
class InstanceEventBus:
|
||||
"""Singleton in-memory event bus with typed pub/sub and exception isolation."""
|
||||
|
||||
_instance: "InstanceEventBus | None" = None
|
||||
_lock: asyncio.Lock = asyncio.Lock()
|
||||
|
||||
def __init__(self) -> None:
|
||||
self._subscribers: dict[str, list[tuple[str, EventCallback]]] = {}
|
||||
|
||||
def __new__(cls) -> "InstanceEventBus":
|
||||
if cls._instance is None:
|
||||
cls._instance = super().__new__(cls)
|
||||
cls._instance._subscribers = {}
|
||||
return cls._instance
|
||||
|
||||
def _reset_for_testing(self) -> None:
|
||||
"""Clear all subscribers. For test use only."""
|
||||
self._subscribers.clear()
|
||||
|
||||
def subscribe(
|
||||
self,
|
||||
event_type: str,
|
||||
callback: EventCallback,
|
||||
) -> Callable[[], None]:
|
||||
"""Register a callback for an event type.
|
||||
|
||||
Args:
|
||||
event_type: The event type to subscribe to.
|
||||
callback: A sync or async callable that receives the payload.
|
||||
|
||||
Returns:
|
||||
An unsubscribe function.
|
||||
"""
|
||||
if event_type not in self._subscribers:
|
||||
self._subscribers[event_type] = []
|
||||
callback_id = str(uuid.uuid4())
|
||||
self._subscribers[event_type].append((callback_id, callback))
|
||||
|
||||
def unsubscribe() -> None:
|
||||
self.unsubscribe(event_type, callback_id)
|
||||
|
||||
return unsubscribe
|
||||
|
||||
def unsubscribe(self, event_type: str, callback_id: str) -> None:
|
||||
"""Remove a specific callback by ID."""
|
||||
if event_type in self._subscribers:
|
||||
self._subscribers[event_type] = [
|
||||
(cid, cb)
|
||||
for cid, cb in self._subscribers[event_type]
|
||||
if cid != callback_id
|
||||
]
|
||||
if not self._subscribers[event_type]:
|
||||
del self._subscribers[event_type]
|
||||
|
||||
def unsubscribe_all(self, event_type: str) -> None:
|
||||
"""Remove all subscribers for an event type."""
|
||||
self._subscribers.pop(event_type, None)
|
||||
|
||||
async def publish(self, event_type: str, payload: InstanceEventPayload) -> None:
|
||||
"""Deliver payload to all subscribers of event_type.
|
||||
|
||||
Also delivers to subscribers registered under the wildcard "*".
|
||||
Exceptions from individual subscribers are caught and logged;
|
||||
delivery continues to remaining subscribers.
|
||||
"""
|
||||
callbacks: list[tuple[str, EventCallback]] = []
|
||||
callbacks.extend(self._subscribers.get(event_type, []))
|
||||
callbacks.extend(self._subscribers.get("*", []))
|
||||
|
||||
for _callback_id, callback in callbacks:
|
||||
try:
|
||||
if inspect.iscoroutinefunction(callback):
|
||||
await callback(payload)
|
||||
else:
|
||||
callback(payload)
|
||||
except Exception:
|
||||
correlation_id = payload.get("correlation_id", "unknown")
|
||||
logger.exception(
|
||||
"Event subscriber failed for %s",
|
||||
event_type,
|
||||
extra={"correlation_id": correlation_id},
|
||||
)
|
||||
@@ -1,253 +0,0 @@
|
||||
"""Background health monitor that polls container and tunnel health."""
|
||||
|
||||
import asyncio
|
||||
import logging
|
||||
import uuid
|
||||
from dataclasses import dataclass
|
||||
from datetime import datetime, timezone
|
||||
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.database import SessionLocal
|
||||
from src.models.health_check import HealthCheck
|
||||
from src.models.tool_instance import ToolInstance
|
||||
from src.services.correlation import get_correlation_id
|
||||
from src.services.docker import check_tunnel_health, get_container_status
|
||||
from src.services.event_bus import InstanceEventBus, InstanceEventPayload
|
||||
from src.services.notification_service import notification_service
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
@dataclass
|
||||
class HealthSnapshot:
|
||||
"""In-memory snapshot of an instance's health state."""
|
||||
|
||||
container_status: str | None = None
|
||||
container_healthy: bool | None = None
|
||||
tunnel_healthy: bool | None = None
|
||||
exit_code: int | None = None
|
||||
|
||||
|
||||
class HealthMonitor:
|
||||
"""Polls container and tunnel health, publishing events on state changes."""
|
||||
|
||||
POLL_INTERVAL_SECONDS: float = 15.0
|
||||
_MONITORED_STATUSES: set[str] = {"starting", "running", "unhealthy"}
|
||||
|
||||
def __init__(self, event_bus: InstanceEventBus) -> None:
|
||||
self._event_bus = event_bus
|
||||
self._task: asyncio.Task | None = None
|
||||
self._last_known_state: dict[uuid.UUID, HealthSnapshot] = {}
|
||||
|
||||
def start(self) -> None:
|
||||
"""Idempotent start of the background polling task."""
|
||||
if self._task is not None and not self._task.done():
|
||||
return
|
||||
try:
|
||||
loop = asyncio.get_running_loop()
|
||||
self._task = loop.create_task(self._poll_loop())
|
||||
except RuntimeError:
|
||||
pass
|
||||
|
||||
def stop(self) -> None:
|
||||
"""Cancel the background task and clear state."""
|
||||
if self._task is not None and not self._task.done():
|
||||
self._task.cancel()
|
||||
self._last_known_state.clear()
|
||||
self._task = None
|
||||
|
||||
async def _poll_loop(self) -> None:
|
||||
"""Main polling loop."""
|
||||
while True:
|
||||
try:
|
||||
await asyncio.sleep(self.POLL_INTERVAL_SECONDS)
|
||||
await self._run_check_cycle()
|
||||
except asyncio.CancelledError:
|
||||
break
|
||||
except Exception:
|
||||
logger.exception("Health monitor poll loop error")
|
||||
|
||||
async def _run_check_cycle(self) -> None:
|
||||
"""Check all monitored instances in one cycle."""
|
||||
async with SessionLocal() as session:
|
||||
result = await session.execute(
|
||||
select(ToolInstance).where(
|
||||
ToolInstance.status.in_(self._MONITORED_STATUSES)
|
||||
)
|
||||
)
|
||||
instances = result.scalars().all()
|
||||
|
||||
for instance in instances:
|
||||
async with SessionLocal() as session:
|
||||
await self._check_instance(session, instance)
|
||||
|
||||
async def _check_instance(
|
||||
self,
|
||||
session: AsyncSession,
|
||||
instance: ToolInstance,
|
||||
) -> None:
|
||||
"""Check a single instance and handle state transitions."""
|
||||
try:
|
||||
container_info = get_container_status(instance.container_id or "")
|
||||
except Exception:
|
||||
logger.exception(
|
||||
"Health check failed for instance %s",
|
||||
instance.id,
|
||||
extra={
|
||||
"instance_id": str(instance.id),
|
||||
"correlation_id": get_correlation_id(),
|
||||
},
|
||||
)
|
||||
return
|
||||
|
||||
container_status = container_info["status"]
|
||||
exit_code = container_info["exit_code"]
|
||||
container_healthy = (
|
||||
container_info["health"] == "healthy" if container_info["health"] else None
|
||||
)
|
||||
|
||||
tunnel_healthy: bool | None = None
|
||||
if instance.public_url and container_status == "running":
|
||||
try:
|
||||
tunnel_result = check_tunnel_health(instance.public_url)
|
||||
tunnel_healthy = tunnel_result.get("healthy", False)
|
||||
except Exception:
|
||||
logger.exception(
|
||||
"Tunnel health check failed for instance %s",
|
||||
instance.id,
|
||||
extra={
|
||||
"instance_id": str(instance.id),
|
||||
"correlation_id": get_correlation_id(),
|
||||
},
|
||||
)
|
||||
tunnel_healthy = False
|
||||
|
||||
snapshot = HealthSnapshot(
|
||||
container_status=container_status,
|
||||
container_healthy=container_healthy,
|
||||
tunnel_healthy=tunnel_healthy,
|
||||
exit_code=exit_code,
|
||||
)
|
||||
|
||||
previous = self._last_known_state.get(instance.id)
|
||||
|
||||
# Determine new status
|
||||
new_status = self._derive_status(snapshot)
|
||||
|
||||
# If first check or state changed
|
||||
if previous is None or not self._snapshots_equal(previous, snapshot):
|
||||
await self._handle_state_change(
|
||||
session, instance, previous, snapshot, new_status
|
||||
)
|
||||
self._last_known_state[instance.id] = snapshot
|
||||
|
||||
def _derive_status(self, snapshot: HealthSnapshot) -> str:
|
||||
"""Derive instance status from health snapshot."""
|
||||
if snapshot.container_status != "running":
|
||||
return "error"
|
||||
if snapshot.tunnel_healthy is False:
|
||||
return "unhealthy"
|
||||
return "running"
|
||||
|
||||
def _snapshots_equal(self, a: HealthSnapshot, b: HealthSnapshot) -> bool:
|
||||
"""Compare two snapshots for equality."""
|
||||
return (
|
||||
a.container_status == b.container_status
|
||||
and a.container_healthy == b.container_healthy
|
||||
and a.tunnel_healthy == b.tunnel_healthy
|
||||
and a.exit_code == b.exit_code
|
||||
)
|
||||
|
||||
async def _handle_state_change(
|
||||
self,
|
||||
session: AsyncSession,
|
||||
instance: ToolInstance,
|
||||
previous: HealthSnapshot | None,
|
||||
snapshot: HealthSnapshot,
|
||||
new_status: str,
|
||||
) -> None:
|
||||
"""Update DB, insert health check, and publish event."""
|
||||
previous_status = instance.status
|
||||
|
||||
# Update instance status
|
||||
instance.status = new_status
|
||||
if new_status == "error":
|
||||
instance.last_stopped_at = datetime.now(timezone.utc)
|
||||
|
||||
# Insert health check row
|
||||
health_check = HealthCheck(
|
||||
instance_id=instance.id,
|
||||
container_status=snapshot.container_status,
|
||||
container_healthy=snapshot.container_healthy,
|
||||
tunnel_healthy=snapshot.tunnel_healthy,
|
||||
exit_code=snapshot.exit_code,
|
||||
probe_status=None,
|
||||
probe_output=None,
|
||||
)
|
||||
session.add(health_check)
|
||||
await session.commit()
|
||||
|
||||
# Build event payload
|
||||
correlation_id = get_correlation_id()
|
||||
metadata: dict = {"previous_status": previous_status}
|
||||
if snapshot.exit_code is not None:
|
||||
metadata["exit_code"] = snapshot.exit_code
|
||||
metadata["error_type"] = "container"
|
||||
if instance.public_url:
|
||||
metadata["tunnel_url"] = instance.public_url
|
||||
|
||||
if new_status == "error":
|
||||
event_type = "instance.error"
|
||||
message = f"Container failed with status {snapshot.container_status}"
|
||||
if snapshot.exit_code is not None:
|
||||
message += f" (exit code: {snapshot.exit_code})"
|
||||
else:
|
||||
event_type = "instance.health_changed"
|
||||
message = f"Container is now {new_status}"
|
||||
|
||||
payload: InstanceEventPayload = {
|
||||
"event": event_type,
|
||||
"instance_id": str(instance.id),
|
||||
"status": new_status,
|
||||
"message": message,
|
||||
"metadata": metadata,
|
||||
"timestamp": datetime.now(timezone.utc).isoformat(),
|
||||
"correlation_id": correlation_id,
|
||||
}
|
||||
|
||||
await self._event_bus.publish(event_type, payload)
|
||||
|
||||
# Create notification for instance owner (fire-and-forget)
|
||||
# Only send warnings and errors; skip "recovered" info notifications.
|
||||
if new_status == "error":
|
||||
category = "instance"
|
||||
severity = "error"
|
||||
title = "Container failed"
|
||||
elif new_status == "unhealthy":
|
||||
category = "health"
|
||||
severity = "warning"
|
||||
title = "Container unhealthy"
|
||||
else:
|
||||
# Running/recovered — do not notify
|
||||
return
|
||||
|
||||
try:
|
||||
await notification_service.create_notification(
|
||||
session=session,
|
||||
user_id=instance.owner_id,
|
||||
category=category,
|
||||
severity=severity,
|
||||
title=title,
|
||||
message=message,
|
||||
source_type="tool_instances",
|
||||
source_id=instance.id,
|
||||
metadata=metadata,
|
||||
)
|
||||
except Exception:
|
||||
logger.exception(
|
||||
"Failed to create notification for health event %s",
|
||||
event_type,
|
||||
extra={"correlation_id": correlation_id},
|
||||
)
|
||||
@@ -1,162 +0,0 @@
|
||||
"""Lifecycle hook helpers for instrumenting tool instance transitions."""
|
||||
|
||||
import logging
|
||||
import uuid
|
||||
from datetime import datetime, timezone
|
||||
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.models.instance_event import InstanceEvent
|
||||
from src.models.tool_instance import ToolInstance
|
||||
from src.services.correlation import get_correlation_id
|
||||
from src.services.event_bus import InstanceEventBus, InstanceEventPayload
|
||||
from src.services.notification_service import notification_service
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def _derive_title(event_type: str) -> str:
|
||||
"""Map lifecycle event type to a human-readable notification title."""
|
||||
mapping = {
|
||||
"instance.created": "Container created",
|
||||
"instance.started": "Container started",
|
||||
"instance.stopped": "Container stopped",
|
||||
"instance.restarted": "Container restarted",
|
||||
"instance.deleted": "Container deleted",
|
||||
"instance.error": "Container error",
|
||||
"instance.health_changed": "Container ready",
|
||||
}
|
||||
return mapping.get(
|
||||
event_type,
|
||||
event_type.replace("instance.", "").replace("_", " ").title(),
|
||||
)
|
||||
|
||||
|
||||
def _should_notify(event_type: str, status: str | None) -> bool:
|
||||
"""Determine whether a lifecycle event should generate a notification.
|
||||
|
||||
Only warnings, errors, and "container is ready" (health_changed running)
|
||||
are sent to users.
|
||||
"""
|
||||
if event_type == "instance.error":
|
||||
return True
|
||||
if event_type == "instance.health_changed" and status == "running":
|
||||
return True
|
||||
# Filter out: created, started, stopped, restarted, deleted, and any
|
||||
# health_changed that is not "running" (unhealthy is handled by health_monitor)
|
||||
return False
|
||||
|
||||
|
||||
def _build_payload(
|
||||
event_type: str,
|
||||
instance: ToolInstance,
|
||||
status: str | None = None,
|
||||
message: str | None = None,
|
||||
metadata: dict | None = None,
|
||||
) -> InstanceEventPayload:
|
||||
"""Construct a standard event payload."""
|
||||
return {
|
||||
"event": event_type,
|
||||
"instance_id": str(instance.id),
|
||||
"status": status or instance.status,
|
||||
"message": message,
|
||||
"metadata": metadata or {},
|
||||
"timestamp": datetime.now(timezone.utc).isoformat(),
|
||||
"correlation_id": get_correlation_id(),
|
||||
}
|
||||
|
||||
|
||||
async def _write_audit_row(
|
||||
session: AsyncSession,
|
||||
instance: ToolInstance,
|
||||
event_type: str,
|
||||
created_by: uuid.UUID | None = None,
|
||||
status: str | None = None,
|
||||
message: str | None = None,
|
||||
metadata: dict | None = None,
|
||||
) -> InstanceEvent:
|
||||
"""Persist an instance_events audit row."""
|
||||
row = InstanceEvent(
|
||||
instance_id=instance.id,
|
||||
event_type=event_type.replace("instance.", ""),
|
||||
status=status or instance.status,
|
||||
message=message,
|
||||
created_by=created_by,
|
||||
event_metadata=metadata or {},
|
||||
)
|
||||
session.add(row)
|
||||
await session.commit()
|
||||
return row
|
||||
|
||||
|
||||
async def publish_lifecycle_event(
|
||||
event_bus: InstanceEventBus,
|
||||
session: AsyncSession,
|
||||
instance: ToolInstance,
|
||||
event_type: str,
|
||||
created_by: uuid.UUID | None = None,
|
||||
status: str | None = None,
|
||||
message: str | None = None,
|
||||
metadata: dict | None = None,
|
||||
) -> None:
|
||||
"""Publish a lifecycle event and write an audit row after DB commit.
|
||||
|
||||
Args:
|
||||
event_bus: The global event bus.
|
||||
session: Active async DB session.
|
||||
instance: The affected tool instance.
|
||||
event_type: One of instance.created, instance.started, etc.
|
||||
created_by: User ID for user-initiated actions; None for system.
|
||||
status: Optional status override.
|
||||
message: Optional human-readable message.
|
||||
metadata: Optional extra metadata.
|
||||
"""
|
||||
payload = _build_payload(
|
||||
event_type=event_type,
|
||||
instance=instance,
|
||||
status=status,
|
||||
message=message,
|
||||
metadata=metadata,
|
||||
)
|
||||
|
||||
# Write audit row
|
||||
await _write_audit_row(
|
||||
session=session,
|
||||
instance=instance,
|
||||
event_type=event_type,
|
||||
created_by=created_by,
|
||||
status=status or instance.status,
|
||||
message=message,
|
||||
metadata=metadata,
|
||||
)
|
||||
|
||||
# Publish to bus
|
||||
await event_bus.publish(event_type, payload)
|
||||
|
||||
# Create notification for instance owner (fire-and-forget)
|
||||
# Only send warnings, errors, and "container is ready" notifications.
|
||||
effective_status = status or instance.status
|
||||
if not _should_notify(event_type, effective_status):
|
||||
return
|
||||
|
||||
severity = "error" if event_type == "instance.error" else "success"
|
||||
title = _derive_title(event_type)
|
||||
|
||||
try:
|
||||
await notification_service.create_notification(
|
||||
session=session,
|
||||
user_id=instance.owner_id,
|
||||
category="instance",
|
||||
severity=severity,
|
||||
title=title,
|
||||
message=message,
|
||||
source_type="tool_instances",
|
||||
source_id=instance.id,
|
||||
metadata=metadata,
|
||||
)
|
||||
except Exception:
|
||||
logger.exception(
|
||||
"Failed to create notification for lifecycle event %s",
|
||||
event_type,
|
||||
extra={"correlation_id": payload.get("correlation_id", "unknown")},
|
||||
)
|
||||
@@ -1,411 +0,0 @@
|
||||
"""Manifest compiler: transforms ToolDefinitionManifest into Dockerfile + Compose."""
|
||||
|
||||
import hashlib
|
||||
import json
|
||||
import shlex
|
||||
from copy import deepcopy
|
||||
from typing import Any
|
||||
|
||||
import yaml
|
||||
|
||||
from src.services.docker import sort_volumes_by_specificity
|
||||
|
||||
|
||||
def resolve_base(manifest: dict) -> dict:
|
||||
"""Merge a base definition into a tool manifest.
|
||||
|
||||
If the manifest has base_definition_id, the base manifest is loaded
|
||||
and merged. Tool-specific values override base values.
|
||||
|
||||
Args:
|
||||
manifest: The tool manifest JSON (may reference a base)
|
||||
|
||||
Returns:
|
||||
A fully resolved manifest with base values merged in.
|
||||
"""
|
||||
result = deepcopy(manifest)
|
||||
|
||||
base_definition_id = result.pop("base_definition_id", None)
|
||||
base_version = result.pop("base_version", "latest")
|
||||
|
||||
if base_definition_id:
|
||||
# This will be provided by the caller (they have the DB session)
|
||||
# For now, we assume the manifest has been pre-resolved
|
||||
# or the caller provides the base manifest separately.
|
||||
pass
|
||||
|
||||
return result
|
||||
|
||||
|
||||
def deep_merge(base: dict, override: dict) -> dict:
|
||||
"""Deep merge two manifests. Arrays are concatenated; dicts are merged.
|
||||
|
||||
Args:
|
||||
base: The base manifest.
|
||||
override: The tool-specific overrides.
|
||||
|
||||
Returns:
|
||||
Merged manifest.
|
||||
"""
|
||||
merged = deepcopy(base)
|
||||
|
||||
for key, value in override.items():
|
||||
if key == "mounts" and isinstance(value, list):
|
||||
# Concatenate mount arrays
|
||||
existing = merged.get("mounts", [])
|
||||
merged["mounts"] = existing + deepcopy(value)
|
||||
elif key == "scripts" and isinstance(value, dict):
|
||||
# Merge script categories
|
||||
if "scripts" not in merged:
|
||||
merged["scripts"] = {}
|
||||
for script_key, script_value in value.items():
|
||||
existing = merged["scripts"].get(script_key, [])
|
||||
merged["scripts"][script_key] = existing + deepcopy(script_value)
|
||||
elif key == "packages" and isinstance(value, dict):
|
||||
# Union package arrays
|
||||
if "packages" not in merged:
|
||||
merged["packages"] = {}
|
||||
for pkg_key, pkg_value in value.items():
|
||||
if (
|
||||
pkg_key in merged["packages"]
|
||||
and isinstance(merged["packages"][pkg_key], list)
|
||||
and isinstance(pkg_value, list)
|
||||
):
|
||||
merged["packages"][pkg_key] = merged["packages"][
|
||||
pkg_key
|
||||
] + deepcopy(pkg_value)
|
||||
else:
|
||||
merged["packages"][pkg_key] = deepcopy(pkg_value)
|
||||
elif key == "env" and isinstance(value, dict):
|
||||
# Dict merge: override wins on key conflict
|
||||
if "env" not in merged:
|
||||
merged["env"] = {}
|
||||
merged["env"].update(deepcopy(value))
|
||||
elif (
|
||||
isinstance(value, dict) and key in merged and isinstance(merged[key], dict)
|
||||
):
|
||||
# Generic dict merge
|
||||
merged[key] = {**merged[key], **deepcopy(value)}
|
||||
else:
|
||||
# Override entirely
|
||||
merged[key] = deepcopy(value)
|
||||
|
||||
return merged
|
||||
|
||||
|
||||
def compile_dockerfile(manifest: dict) -> str:
|
||||
"""Compile a resolved manifest into a Dockerfile string.
|
||||
|
||||
Args:
|
||||
manifest: Fully resolved manifest JSON.
|
||||
|
||||
Returns:
|
||||
Dockerfile content.
|
||||
"""
|
||||
lines: list[str] = []
|
||||
|
||||
# FROM
|
||||
base_image = manifest.get("base_image", "ubuntu:24.04")
|
||||
lines.append(f"FROM {base_image}")
|
||||
lines.append("")
|
||||
|
||||
# Build-time environment
|
||||
env = manifest.get("env", {})
|
||||
for key, value in env.items():
|
||||
lines.append(f"ENV {key}={shlex.quote(value)}")
|
||||
if env:
|
||||
lines.append("")
|
||||
|
||||
# System packages (apt)
|
||||
apt_packages = manifest.get("packages", {}).get("apt", [])
|
||||
if apt_packages:
|
||||
lines.append("RUN apt-get update && apt-get install -y \\")
|
||||
for pkg in apt_packages[:-1]:
|
||||
lines.append(f" {pkg} \\")
|
||||
lines.append(f" {apt_packages[-1]} \\")
|
||||
lines.append(" && rm -rf /var/lib/apt/lists/*")
|
||||
lines.append("")
|
||||
|
||||
# Node.js
|
||||
node = manifest.get("packages", {}).get("node")
|
||||
if node:
|
||||
version = node.get("version", "20")
|
||||
lines.append(
|
||||
f"RUN curl -fsSL https://deb.nodesource.com/setup_{version}.x | bash - && \\"
|
||||
)
|
||||
lines.append(" apt-get install -y nodejs && \\")
|
||||
lines.append(" rm -rf /var/lib/apt/lists/*")
|
||||
lines.append("")
|
||||
|
||||
# NPM global packages
|
||||
npm_packages = manifest.get("packages", {}).get("npm_global", [])
|
||||
if npm_packages:
|
||||
pkg_list = " ".join(shlex.quote(p) for p in npm_packages)
|
||||
lines.append(f"RUN npm install -g {pkg_list}")
|
||||
lines.append("")
|
||||
|
||||
# Pip packages
|
||||
pip_packages = manifest.get("packages", {}).get("pip", [])
|
||||
if pip_packages:
|
||||
pkg_list = " ".join(shlex.quote(p) for p in pip_packages)
|
||||
lines.append(f"RUN pip install {pkg_list}")
|
||||
lines.append("")
|
||||
|
||||
# User creation
|
||||
user = manifest.get("user")
|
||||
if user:
|
||||
name = user["name"]
|
||||
uid = user["uid"]
|
||||
gid = user["gid"]
|
||||
create_home = "-m " if user.get("create_home", True) else ""
|
||||
shell = user.get("shell", "/bin/bash")
|
||||
lines.append(f"RUN groupadd -g {gid} {name} && \\")
|
||||
lines.append(f" useradd -u {uid} -g {gid} {create_home}-s {shell} {name}")
|
||||
lines.append("")
|
||||
# Set HOME and USER for runtime compatibility
|
||||
home = f"/home/{name}"
|
||||
lines.append(f"ENV HOME={home}")
|
||||
lines.append(f"ENV USER={name}")
|
||||
lines.append("")
|
||||
|
||||
# Build scripts
|
||||
build_scripts = manifest.get("scripts", {}).get("build", [])
|
||||
for script in build_scripts:
|
||||
# Normalize multi-line scripts into single RUN command
|
||||
stripped_lines = [
|
||||
line.strip() for line in script.strip().split("\n") if line.strip()
|
||||
]
|
||||
if stripped_lines:
|
||||
normalized = " && ".join(stripped_lines)
|
||||
lines.append(f"RUN {normalized}")
|
||||
if build_scripts:
|
||||
lines.append("")
|
||||
|
||||
# Create mount target directories
|
||||
mounts = manifest.get("mounts", [])
|
||||
if mounts:
|
||||
dirs = [mount["target"] for mount in mounts]
|
||||
dir_str = " ".join(dirs)
|
||||
lines.append(f"RUN mkdir -p {dir_str}")
|
||||
if user:
|
||||
lines.append(f"RUN chown -R {user['name']}:{user['name']} {dir_str}")
|
||||
lines.append("")
|
||||
|
||||
# Entrypoint for startup scripts
|
||||
startup_scripts = manifest.get("scripts", {}).get("startup", [])
|
||||
if startup_scripts:
|
||||
lines.append(
|
||||
"COPY .headquarter/entrypoint.sh /usr/local/bin/headquarter-entrypoint"
|
||||
)
|
||||
lines.append("RUN chmod +x /usr/local/bin/headquarter-entrypoint")
|
||||
lines.append("")
|
||||
|
||||
# Switch to runtime user
|
||||
if user:
|
||||
lines.append(f"USER {user['name']}")
|
||||
lines.append(f"WORKDIR /home/{user['name']}")
|
||||
lines.append("")
|
||||
|
||||
# Entrypoint and CMD
|
||||
runtime = manifest.get("runtime", {})
|
||||
if startup_scripts:
|
||||
lines.append('ENTRYPOINT ["/usr/local/bin/headquarter-entrypoint"]')
|
||||
|
||||
command = runtime.get("command", ["/bin/bash"])
|
||||
cmd_json = json.dumps(command)
|
||||
lines.append(f"CMD {cmd_json}")
|
||||
|
||||
return "\n".join(lines)
|
||||
|
||||
|
||||
def compile_entrypoint(manifest: dict) -> str:
|
||||
"""Generate the startup entrypoint script from startup scripts.
|
||||
|
||||
Args:
|
||||
manifest: Fully resolved manifest JSON.
|
||||
|
||||
Returns:
|
||||
Shell script content.
|
||||
"""
|
||||
lines = ["#!/bin/bash", "set -e", ""]
|
||||
|
||||
startup_scripts = manifest.get("scripts", {}).get("startup", [])
|
||||
for script in startup_scripts:
|
||||
lines.append(script)
|
||||
lines.append("")
|
||||
|
||||
lines.append('exec "$@"')
|
||||
return "\n".join(lines)
|
||||
|
||||
|
||||
def compile_compose(manifest: dict, variables: dict[str, Any]) -> str:
|
||||
"""Compile a resolved manifest into a Docker Compose string.
|
||||
|
||||
Args:
|
||||
manifest: Fully resolved manifest JSON.
|
||||
variables: Resolved values: IMAGE_TAG, INSTANCE_NAME, REPO_PATH, etc.
|
||||
|
||||
Returns:
|
||||
Docker Compose YAML content.
|
||||
"""
|
||||
runtime = manifest.get("runtime", {})
|
||||
user = manifest.get("user")
|
||||
interface_type = manifest["interface_type"]
|
||||
|
||||
service: dict[str, Any] = {
|
||||
"image": variables["IMAGE_TAG"],
|
||||
"container_name": variables["INSTANCE_NAME"],
|
||||
"restart": "unless-stopped",
|
||||
}
|
||||
|
||||
# Terminal-specific fields
|
||||
if runtime.get("stdin_open", False):
|
||||
service["stdin_open"] = True
|
||||
if runtime.get("tty", False):
|
||||
service["tty"] = True
|
||||
if runtime.get("working_dir"):
|
||||
service["working_dir"] = runtime["working_dir"]
|
||||
|
||||
# User override
|
||||
if user:
|
||||
service["user"] = f"{user['uid']}:{user['gid']}"
|
||||
|
||||
# Ports for web tools
|
||||
default_port = manifest.get("default_port")
|
||||
if interface_type == "web" and default_port:
|
||||
service["ports"] = [f"{variables['TOOL_PORT']}:{default_port}"]
|
||||
|
||||
# Environment
|
||||
env = manifest.get("env", {})
|
||||
if env:
|
||||
service["environment"] = dict(env)
|
||||
|
||||
# Merge extra env from config
|
||||
extra_env = variables.get("EXTRA_ENV", {})
|
||||
if extra_env:
|
||||
if "environment" not in service:
|
||||
service["environment"] = {}
|
||||
service["environment"].update(extra_env)
|
||||
|
||||
# Volumes from mount schema
|
||||
volumes = []
|
||||
for mount in manifest.get("mounts", []):
|
||||
source = resolve_mount_source(mount, variables)
|
||||
if not source:
|
||||
continue
|
||||
target = mount["target"]
|
||||
readonly = ":ro" if mount.get("readonly", False) else ""
|
||||
volumes.append(f"{source}:{target}{readonly}")
|
||||
|
||||
# Append extra volumes from tool config / config profile
|
||||
for vol in variables.get("EXTRA_VOLUMES", []):
|
||||
vol_str = f"{vol['source']}:{vol['target']}"
|
||||
if vol.get("readonly"):
|
||||
vol_str += ":ro"
|
||||
volumes.append(vol_str)
|
||||
|
||||
if volumes:
|
||||
service["volumes"] = sort_volumes_by_specificity(volumes)
|
||||
|
||||
compose = {"services": {"app": service}}
|
||||
return yaml.dump(compose, default_flow_style=False)
|
||||
|
||||
|
||||
def resolve_mount_source(mount: dict, variables: dict[str, Any]) -> str:
|
||||
"""Resolve a mount's source_type to an actual host path.
|
||||
|
||||
Args:
|
||||
mount: Mount definition from manifest.
|
||||
variables: Resolved variables dict.
|
||||
|
||||
Returns:
|
||||
Host path string, or empty string if unresolved.
|
||||
"""
|
||||
source_type = mount.get("source_type", "host_path")
|
||||
|
||||
if source_type == "repo":
|
||||
return variables.get("REPO_PATH", "")
|
||||
elif source_type == "ssh_key":
|
||||
return variables.get("SSH_PATH", "")
|
||||
elif source_type == "instance":
|
||||
instance_dir = variables.get("INSTANCE_DIR", "")
|
||||
mount_name = mount.get("name", "unknown")
|
||||
return f"{instance_dir}/mounts/{mount_name}"
|
||||
elif source_type == "git_mount":
|
||||
ref = mount.get("git_mount_ref", "default")
|
||||
return variables.get(f"GIT_MOUNT_{ref}", "")
|
||||
elif source_type == "host_path":
|
||||
return mount.get("source", "")
|
||||
|
||||
return ""
|
||||
|
||||
|
||||
def get_manifest_home_dir(manifest: dict) -> str:
|
||||
"""Get the home directory for a container based on manifest user config.
|
||||
|
||||
Args:
|
||||
manifest: Fully resolved manifest JSON.
|
||||
|
||||
Returns:
|
||||
Home directory path (e.g., /home/user or /root).
|
||||
"""
|
||||
user = manifest.get("user")
|
||||
if user and user.get("name"):
|
||||
return f"/home/{user['name']}"
|
||||
return "/root"
|
||||
|
||||
|
||||
def compute_image_tag(tool_name: str, manifest: dict) -> str:
|
||||
"""Compute a deterministic image tag from manifest content.
|
||||
|
||||
Args:
|
||||
tool_name: Human-readable tool name.
|
||||
manifest: Fully resolved manifest JSON.
|
||||
|
||||
Returns:
|
||||
Docker image tag string.
|
||||
"""
|
||||
# Canonicalize: sort keys, stable JSON
|
||||
canonical = json.dumps(manifest, sort_keys=True, separators=(",", ":"))
|
||||
hash_suffix = hashlib.sha256(canonical.encode()).hexdigest()[:8]
|
||||
safe_name = tool_name.lower().replace(" ", "-").replace("_", "-")
|
||||
return f"headquarter/{safe_name}-{hash_suffix}:latest"
|
||||
|
||||
|
||||
def merge_with_config(manifest: dict, profile: dict | None = None) -> dict:
|
||||
"""Merge ConfigProfile overrides into a manifest.
|
||||
|
||||
Args:
|
||||
manifest: Base manifest from tool definition.
|
||||
profile: Resolved ConfigProfile (optional).
|
||||
|
||||
Returns:
|
||||
Manifest with overrides applied.
|
||||
"""
|
||||
result = deepcopy(manifest)
|
||||
|
||||
extra_env: dict[str, str] = {}
|
||||
extra_volumes: list[dict] = []
|
||||
|
||||
# Apply ConfigProfile
|
||||
if profile:
|
||||
if profile.get("environment_variables"):
|
||||
extra_env.update(profile["environment_variables"])
|
||||
if profile.get("mounts"):
|
||||
extra_volumes.extend(profile["mounts"])
|
||||
# Profile hints override everything
|
||||
hints = profile.get("hints", {})
|
||||
if hints.get("start_command"):
|
||||
result["runtime"] = result.get("runtime", {})
|
||||
result["runtime"]["command"] = hints["start_command"].split()
|
||||
if hints.get("working_directory"):
|
||||
result["runtime"] = result.get("runtime", {})
|
||||
result["runtime"]["working_dir"] = hints["working_directory"]
|
||||
if hints.get("port_override"):
|
||||
result["default_port"] = hints["port_override"]
|
||||
|
||||
# Store merged extras for the compose compiler
|
||||
result["_extra_env"] = extra_env
|
||||
result["_extra_volumes"] = extra_volumes
|
||||
|
||||
return result
|
||||
@@ -1,272 +0,0 @@
|
||||
"""Notification persistence service."""
|
||||
|
||||
import uuid
|
||||
from datetime import datetime, timezone
|
||||
from typing import Any
|
||||
|
||||
from sqlalchemy import func, select, update
|
||||
from sqlalchemy.engine import CursorResult
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.models.notification import Notification
|
||||
|
||||
|
||||
class NotificationService:
|
||||
"""Singleton notification persistence service.
|
||||
|
||||
All methods filter by user_id to enforce strict ownership isolation.
|
||||
"""
|
||||
|
||||
async def create_notification(
|
||||
self,
|
||||
session: AsyncSession,
|
||||
user_id: uuid.UUID,
|
||||
*,
|
||||
category: str,
|
||||
severity: str,
|
||||
title: str,
|
||||
message: str | None = None,
|
||||
source_type: str | None = None,
|
||||
source_id: uuid.UUID | None = None,
|
||||
metadata: dict[str, Any] | None = None,
|
||||
) -> Notification:
|
||||
"""Insert a new notification row.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
user_id: Owner of the notification.
|
||||
category: Notification category (e.g., instance, system, health).
|
||||
severity: Severity level (e.g., info, warning, error, success).
|
||||
title: Short notification title.
|
||||
message: Optional longer message body.
|
||||
source_type: Optional source entity type.
|
||||
source_id: Optional source entity UUID.
|
||||
metadata: Optional JSON metadata dictionary.
|
||||
|
||||
Returns:
|
||||
The newly created Notification instance.
|
||||
"""
|
||||
notification = Notification(
|
||||
user_id=user_id,
|
||||
category=category,
|
||||
severity=severity,
|
||||
title=title,
|
||||
message=message,
|
||||
source_type=source_type,
|
||||
source_id=source_id,
|
||||
notification_metadata=metadata or {},
|
||||
)
|
||||
session.add(notification)
|
||||
await session.commit()
|
||||
await session.refresh(notification)
|
||||
return notification
|
||||
|
||||
async def list_notifications(
|
||||
self,
|
||||
session: AsyncSession,
|
||||
user_id: uuid.UUID,
|
||||
*,
|
||||
limit: int = 20,
|
||||
offset: int = 0,
|
||||
unread_only: bool = False,
|
||||
mute_categories: list[str] | None = None,
|
||||
) -> tuple[list[Notification], int]:
|
||||
"""Return paginated notifications for a user.
|
||||
|
||||
Excludes dismissed notifications and applies optional filtering.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
user_id: Owner of the notifications.
|
||||
limit: Maximum number of items to return.
|
||||
offset: Number of items to skip.
|
||||
unread_only: If True, only return unread notifications.
|
||||
mute_categories: Categories to exclude from results.
|
||||
|
||||
Returns:
|
||||
A tuple of (items, total_count).
|
||||
"""
|
||||
where_clauses = [
|
||||
Notification.user_id == user_id,
|
||||
Notification.dismissed_at.is_(None),
|
||||
]
|
||||
|
||||
if unread_only:
|
||||
where_clauses.append(Notification.read_at.is_(None))
|
||||
|
||||
if mute_categories:
|
||||
where_clauses.append(Notification.category.not_in(mute_categories))
|
||||
|
||||
total_stmt = (
|
||||
select(func.count()).select_from(Notification).where(*where_clauses)
|
||||
)
|
||||
total_result = await session.execute(total_stmt)
|
||||
total = total_result.scalar_one()
|
||||
|
||||
items_stmt = (
|
||||
select(Notification)
|
||||
.where(*where_clauses)
|
||||
.order_by(Notification.created_at.desc())
|
||||
.limit(limit)
|
||||
.offset(offset)
|
||||
)
|
||||
items_result = await session.execute(items_stmt)
|
||||
items = list(items_result.scalars().all())
|
||||
|
||||
return items, total
|
||||
|
||||
async def get_unread_count(
|
||||
self,
|
||||
session: AsyncSession,
|
||||
user_id: uuid.UUID,
|
||||
) -> int:
|
||||
"""Count unread, non-dismissed notifications for a user.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
user_id: Owner of the notifications.
|
||||
|
||||
Returns:
|
||||
Number of unread notifications.
|
||||
"""
|
||||
stmt = (
|
||||
select(func.count())
|
||||
.select_from(Notification)
|
||||
.where(
|
||||
Notification.user_id == user_id,
|
||||
Notification.read_at.is_(None),
|
||||
Notification.dismissed_at.is_(None),
|
||||
)
|
||||
)
|
||||
result = await session.execute(stmt)
|
||||
return result.scalar_one()
|
||||
|
||||
async def mark_read(
|
||||
self,
|
||||
session: AsyncSession,
|
||||
notification_id: uuid.UUID,
|
||||
user_id: uuid.UUID,
|
||||
) -> Notification:
|
||||
"""Mark a single notification as read.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
notification_id: UUID of the notification to mark.
|
||||
user_id: Owner of the notification.
|
||||
|
||||
Returns:
|
||||
The updated Notification instance.
|
||||
|
||||
Raises:
|
||||
ValueError: If the notification does not exist or is not owned by the user.
|
||||
"""
|
||||
notification = await self._get_owned_notification(
|
||||
session, notification_id, user_id
|
||||
)
|
||||
notification.read_at = datetime.now(timezone.utc)
|
||||
await session.commit()
|
||||
await session.refresh(notification)
|
||||
return notification
|
||||
|
||||
async def mark_all_read(
|
||||
self,
|
||||
session: AsyncSession,
|
||||
user_id: uuid.UUID,
|
||||
) -> int:
|
||||
"""Mark all unread notifications as read for a user.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
user_id: Owner of the notifications.
|
||||
|
||||
Returns:
|
||||
Number of rows updated.
|
||||
"""
|
||||
stmt = (
|
||||
update(Notification)
|
||||
.where(
|
||||
Notification.user_id == user_id,
|
||||
Notification.read_at.is_(None),
|
||||
Notification.dismissed_at.is_(None),
|
||||
)
|
||||
.values(read_at=datetime.now(timezone.utc))
|
||||
)
|
||||
result: CursorResult[Any] = await session.execute(stmt) # type: ignore[assignment]
|
||||
await session.commit()
|
||||
return result.rowcount or 0
|
||||
|
||||
async def dismiss_all(
|
||||
self,
|
||||
session: AsyncSession,
|
||||
user_id: uuid.UUID,
|
||||
) -> int:
|
||||
"""Soft-delete all non-dismissed notifications for a user.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
user_id: Owner of the notifications.
|
||||
|
||||
Returns:
|
||||
Number of rows updated.
|
||||
"""
|
||||
stmt = (
|
||||
update(Notification)
|
||||
.where(
|
||||
Notification.user_id == user_id,
|
||||
Notification.dismissed_at.is_(None),
|
||||
)
|
||||
.values(dismissed_at=datetime.now(timezone.utc))
|
||||
)
|
||||
result: CursorResult[Any] = await session.execute(stmt) # type: ignore[assignment]
|
||||
await session.commit()
|
||||
return result.rowcount or 0
|
||||
|
||||
async def dismiss(
|
||||
self,
|
||||
session: AsyncSession,
|
||||
notification_id: uuid.UUID,
|
||||
user_id: uuid.UUID,
|
||||
) -> None:
|
||||
"""Soft-delete a notification by setting dismissed_at.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
notification_id: UUID of the notification to dismiss.
|
||||
user_id: Owner of the notification.
|
||||
|
||||
Raises:
|
||||
ValueError: If the notification does not exist or is not owned by the user.
|
||||
"""
|
||||
notification = await self._get_owned_notification(
|
||||
session, notification_id, user_id
|
||||
)
|
||||
notification.dismissed_at = datetime.now(timezone.utc)
|
||||
await session.commit()
|
||||
|
||||
async def _get_owned_notification(
|
||||
self,
|
||||
session: AsyncSession,
|
||||
notification_id: uuid.UUID,
|
||||
user_id: uuid.UUID,
|
||||
) -> Notification:
|
||||
"""Fetch a notification and verify ownership.
|
||||
|
||||
Args:
|
||||
session: Database session.
|
||||
notification_id: UUID of the notification.
|
||||
user_id: Expected owner.
|
||||
|
||||
Returns:
|
||||
The Notification instance.
|
||||
|
||||
Raises:
|
||||
ValueError: If the notification does not exist or is not owned.
|
||||
"""
|
||||
notification = await session.get(Notification, notification_id)
|
||||
if notification is None or notification.user_id != user_id:
|
||||
raise ValueError("Notification not found")
|
||||
return notification
|
||||
|
||||
|
||||
# Module-level singleton instance
|
||||
notification_service = NotificationService()
|
||||
@@ -1,310 +0,0 @@
|
||||
"""Permission fixer: applies mount permission policies post-start."""
|
||||
|
||||
import logging
|
||||
import subprocess
|
||||
from typing import Any
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def apply_mount_permissions(
|
||||
container_id: str,
|
||||
mounts: list[dict],
|
||||
timeout: int = 10,
|
||||
) -> list[dict[str, Any]]:
|
||||
"""Apply permission policies to mounted directories in a running container.
|
||||
|
||||
Runs `chown`, `chmod`, and file-mode fixes for each mount that declares
|
||||
an owner, mode, or file_mode. Requires the container to have a root user.
|
||||
|
||||
Args:
|
||||
container_id: Docker container ID or name.
|
||||
mounts: List of mount definitions from the manifest.
|
||||
timeout: Max seconds per docker exec command.
|
||||
|
||||
Returns:
|
||||
List of result dicts: [{mount_name, success, error}]
|
||||
"""
|
||||
results = []
|
||||
|
||||
for mount in mounts:
|
||||
name = mount.get("name", "unknown")
|
||||
target = mount["target"]
|
||||
owner = mount.get("owner")
|
||||
mode = mount.get("mode")
|
||||
file_mode = mount.get("file_mode")
|
||||
|
||||
result: dict[str, Any] = {
|
||||
"mount_name": name,
|
||||
"success": True,
|
||||
"error": None,
|
||||
}
|
||||
|
||||
# Skip read-only mounts — their permissions cannot be changed
|
||||
# post-start because the bind mount is locked.
|
||||
if mount.get("readonly", False):
|
||||
logger.debug(
|
||||
"Skipping permission fix for read-only mount %s (target=%s)",
|
||||
name,
|
||||
target,
|
||||
)
|
||||
results.append(result)
|
||||
continue
|
||||
|
||||
# Skip if no permission policy defined
|
||||
if not owner and not mode and not file_mode:
|
||||
results.append(result)
|
||||
continue
|
||||
|
||||
try:
|
||||
if owner:
|
||||
_run_in_container(
|
||||
container_id,
|
||||
["chown", "-R", f"{owner}:{owner}", target],
|
||||
timeout,
|
||||
)
|
||||
logger.debug(
|
||||
"Applied owner %s to %s in container %s",
|
||||
owner,
|
||||
target,
|
||||
container_id,
|
||||
)
|
||||
|
||||
if mode and result["success"]:
|
||||
_run_in_container(
|
||||
container_id,
|
||||
["chmod", mode, target],
|
||||
timeout,
|
||||
)
|
||||
logger.debug(
|
||||
"Applied mode %s to %s in container %s",
|
||||
mode,
|
||||
target,
|
||||
container_id,
|
||||
)
|
||||
|
||||
if file_mode and result["success"]:
|
||||
_run_in_container(
|
||||
container_id,
|
||||
[
|
||||
"sh",
|
||||
"-c",
|
||||
f"find {target} -type f -exec chmod {file_mode} {{}} +",
|
||||
],
|
||||
timeout,
|
||||
)
|
||||
logger.debug(
|
||||
"Applied file_mode %s to files in %s in container %s",
|
||||
file_mode,
|
||||
target,
|
||||
container_id,
|
||||
)
|
||||
|
||||
except PermissionFixError as exc:
|
||||
result["success"] = False
|
||||
result["error"] = str(exc)
|
||||
logger.warning(
|
||||
"Permission fix failed for mount %s (target=%s): %s",
|
||||
name,
|
||||
target,
|
||||
exc,
|
||||
)
|
||||
|
||||
results.append(result)
|
||||
|
||||
return results
|
||||
|
||||
|
||||
def _exec_and_log(
|
||||
container_id: str,
|
||||
command: list[str],
|
||||
timeout: int,
|
||||
description: str,
|
||||
) -> str:
|
||||
"""Run a docker exec command and log stdout/stderr for debugging."""
|
||||
cmd = ["docker", "exec", "--user", "root", container_id] + command
|
||||
logger.debug("[SSH-fix] %s: %s", description, " ".join(cmd))
|
||||
|
||||
try:
|
||||
result = subprocess.run(
|
||||
cmd,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=timeout,
|
||||
)
|
||||
except subprocess.TimeoutExpired:
|
||||
raise PermissionFixError(
|
||||
f"Command timed out after {timeout}s: {' '.join(command)}"
|
||||
)
|
||||
except FileNotFoundError:
|
||||
raise PermissionFixError(f"Docker command not found: {' '.join(command)}")
|
||||
|
||||
stdout = result.stdout.strip()
|
||||
stderr = result.stderr.strip()
|
||||
if stdout:
|
||||
logger.debug("[SSH-fix] %s stdout: %s", description, stdout)
|
||||
if stderr:
|
||||
logger.debug("[SSH-fix] %s stderr: %s", description, stderr)
|
||||
|
||||
if result.returncode != 0:
|
||||
raise PermissionFixError(
|
||||
f"Command failed (rc={result.returncode}): {stderr or '(no stderr)'}"
|
||||
)
|
||||
return stdout
|
||||
|
||||
|
||||
def apply_ssh_permissions(
|
||||
container_id: str,
|
||||
ssh_target: str,
|
||||
container_user: str,
|
||||
timeout: int = 10,
|
||||
) -> dict[str, Any]:
|
||||
"""Fix SSH directory ownership and permissions in a running container.
|
||||
|
||||
Runs chown and chmod on the ~/.ssh directory so the container user
|
||||
can use the keys (SSH requires the private key to be owned by the
|
||||
user with mode 600).
|
||||
|
||||
Args:
|
||||
container_id: Docker container ID or name.
|
||||
ssh_target: Absolute path to the .ssh directory inside the container.
|
||||
container_user: The container user that should own the keys.
|
||||
timeout: Max seconds per docker exec command.
|
||||
|
||||
Returns:
|
||||
Result dict with keys: success, error.
|
||||
"""
|
||||
result: dict[str, Any] = {"success": True, "error": None}
|
||||
try:
|
||||
# 1. Ensure directory is owned by the container user
|
||||
_exec_and_log(
|
||||
container_id,
|
||||
["chown", "-R", f"{container_user}:{container_user}", ssh_target],
|
||||
timeout,
|
||||
"chown",
|
||||
)
|
||||
|
||||
# 2. Set directory permissions
|
||||
_exec_and_log(
|
||||
container_id,
|
||||
["chmod", "700", ssh_target],
|
||||
timeout,
|
||||
"chmod-dir",
|
||||
)
|
||||
|
||||
# 3. Set private key permissions (id_ed25519, id_rsa, etc.)
|
||||
_exec_and_log(
|
||||
container_id,
|
||||
[
|
||||
"sh",
|
||||
"-c",
|
||||
f"find {ssh_target} -name 'id_*' -type f -exec chmod 600 {{}} +",
|
||||
],
|
||||
timeout,
|
||||
"chmod-keys",
|
||||
)
|
||||
|
||||
# 4. Verify final state
|
||||
ls_output = _exec_and_log(
|
||||
container_id,
|
||||
["ls", "-la", ssh_target],
|
||||
timeout,
|
||||
"verify-ls",
|
||||
)
|
||||
stat_output = _exec_and_log(
|
||||
container_id,
|
||||
["stat", "-c", "%U:%G %a %n", ssh_target],
|
||||
timeout,
|
||||
"verify-stat-dir",
|
||||
)
|
||||
key_stat = _exec_and_log(
|
||||
container_id,
|
||||
[
|
||||
"sh",
|
||||
"-c",
|
||||
f"stat -c '%U:%G %a %n' {ssh_target}/id_* 2>/dev/null || echo 'no id_* files found'",
|
||||
],
|
||||
timeout,
|
||||
"verify-stat-keys",
|
||||
)
|
||||
|
||||
logger.info(
|
||||
"SSH permissions fixed for container %s (user=%s, target=%s). "
|
||||
"ls:\n%s\nstat-dir: %s\nstat-keys: %s",
|
||||
container_id,
|
||||
container_user,
|
||||
ssh_target,
|
||||
ls_output,
|
||||
stat_output,
|
||||
key_stat,
|
||||
)
|
||||
except PermissionFixError as exc:
|
||||
result["success"] = False
|
||||
result["error"] = str(exc)
|
||||
logger.warning(
|
||||
"SSH permission fix failed for container %s (target=%s): %s",
|
||||
container_id,
|
||||
ssh_target,
|
||||
exc,
|
||||
)
|
||||
return result
|
||||
|
||||
|
||||
class PermissionFixError(Exception):
|
||||
"""Raised when a permission fix command fails."""
|
||||
|
||||
pass
|
||||
|
||||
|
||||
def _run_in_container(
|
||||
container_id: str,
|
||||
command: list[str],
|
||||
timeout: int,
|
||||
) -> None:
|
||||
"""Run a command inside a container as root.
|
||||
|
||||
Args:
|
||||
container_id: Docker container ID or name.
|
||||
command: Command + args to execute.
|
||||
timeout: Max seconds to wait.
|
||||
|
||||
Raises:
|
||||
PermissionFixError: If the command fails or times out.
|
||||
"""
|
||||
cmd = ["docker", "exec", "--user", "root", container_id] + command
|
||||
|
||||
try:
|
||||
result = subprocess.run(
|
||||
cmd,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=timeout,
|
||||
)
|
||||
except subprocess.TimeoutExpired:
|
||||
raise PermissionFixError(
|
||||
f"Command timed out after {timeout}s: {' '.join(command)}"
|
||||
)
|
||||
except FileNotFoundError:
|
||||
raise PermissionFixError(f"Docker command not found: {' '.join(command)}")
|
||||
|
||||
if result.returncode != 0:
|
||||
raise PermissionFixError(
|
||||
f"Command failed (rc={result.returncode}): {result.stderr.strip()}"
|
||||
)
|
||||
|
||||
|
||||
def check_root_user_available(container_id: str, timeout: int = 5) -> bool:
|
||||
"""Check if the container has a root user we can exec as.
|
||||
|
||||
Args:
|
||||
container_id: Docker container ID or name.
|
||||
timeout: Max seconds to wait.
|
||||
|
||||
Returns:
|
||||
True if root user exists and is usable.
|
||||
"""
|
||||
try:
|
||||
_run_in_container(container_id, ["id", "root"], timeout)
|
||||
return True
|
||||
except PermissionFixError:
|
||||
return False
|
||||
@@ -1,109 +0,0 @@
|
||||
"""SSH key service utilities for preparing keys for container use."""
|
||||
|
||||
import logging
|
||||
import os
|
||||
from pathlib import Path
|
||||
|
||||
from cryptography.fernet import Fernet
|
||||
|
||||
from src.config import Settings
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def _get_fernet() -> Fernet:
|
||||
"""Generate a valid Fernet key from the session secret."""
|
||||
import base64
|
||||
import hashlib
|
||||
|
||||
settings = Settings()
|
||||
key_bytes = hashlib.sha256(settings.session_secret.encode()).digest()
|
||||
key = base64.urlsafe_b64encode(key_bytes)
|
||||
return Fernet(key)
|
||||
|
||||
|
||||
def prepare_ssh_key_files(
|
||||
instance_dir: str,
|
||||
ssh_key,
|
||||
subdir: str = ".ssh",
|
||||
uid: int | None = None,
|
||||
gid: int | None = None,
|
||||
) -> str:
|
||||
"""Decrypt and write SSH key files to instance directory for container mounting.
|
||||
|
||||
Args:
|
||||
instance_dir: Path to instance directory
|
||||
ssh_key: SSHKey model instance with encrypted private key
|
||||
subdir: Subdirectory within instance_dir to write to (default: ".ssh")
|
||||
uid: Optional UID to own the files (for bind-mount into non-root container)
|
||||
gid: Optional GID to own the files
|
||||
|
||||
Returns:
|
||||
Path to the .ssh directory
|
||||
"""
|
||||
ssh_dir = Path(instance_dir) / subdir
|
||||
ssh_dir.mkdir(parents=True, exist_ok=True)
|
||||
|
||||
# Decrypt private key
|
||||
fernet = _get_fernet()
|
||||
private_key = fernet.decrypt(ssh_key.private_key_encrypted.encode()).decode()
|
||||
|
||||
# Write private key with restricted permissions
|
||||
private_key_path = ssh_dir / "id_ed25519"
|
||||
private_key_path.write_text(private_key)
|
||||
os.chmod(private_key_path, 0o600)
|
||||
|
||||
# Write public key
|
||||
public_key_path = ssh_dir / "id_ed25519.pub"
|
||||
public_key_path.write_text(ssh_key.public_key)
|
||||
os.chmod(public_key_path, 0o644)
|
||||
|
||||
# Write SSH config
|
||||
config_path = ssh_dir / "config"
|
||||
config_content = """Host *
|
||||
StrictHostKeyChecking no
|
||||
UserKnownHostsFile /dev/null
|
||||
IdentityFile ~/.ssh/id_ed25519
|
||||
IdentitiesOnly yes
|
||||
"""
|
||||
config_path.write_text(config_content)
|
||||
os.chmod(config_path, 0o644)
|
||||
|
||||
# Set ownership to target container user if requested
|
||||
if uid is not None or gid is not None:
|
||||
effective_uid = uid if uid is not None else -1
|
||||
effective_gid = gid if gid is not None else -1
|
||||
try:
|
||||
os.chown(ssh_dir, effective_uid, effective_gid)
|
||||
os.chown(private_key_path, effective_uid, effective_gid)
|
||||
os.chown(public_key_path, effective_uid, effective_gid)
|
||||
os.chown(config_path, effective_uid, effective_gid)
|
||||
logger.debug(
|
||||
"Set SSH key ownership to uid=%s gid=%s for %s",
|
||||
effective_uid,
|
||||
effective_gid,
|
||||
ssh_dir,
|
||||
)
|
||||
except PermissionError as exc:
|
||||
logger.warning(
|
||||
"Cannot chown SSH keys to uid=%s gid=%s (running as uid=%s): %s",
|
||||
effective_uid,
|
||||
effective_gid,
|
||||
os.getuid(),
|
||||
exc,
|
||||
)
|
||||
|
||||
return str(ssh_dir)
|
||||
|
||||
|
||||
def cleanup_ssh_key_files(instance_dir: str) -> None:
|
||||
"""Remove temporary SSH key files from instance directory.
|
||||
|
||||
Args:
|
||||
instance_dir: Path to instance directory
|
||||
"""
|
||||
ssh_dir = Path(instance_dir) / ".ssh"
|
||||
if ssh_dir.exists():
|
||||
for file_path in ssh_dir.iterdir():
|
||||
file_path.unlink()
|
||||
ssh_dir.rmdir()
|
||||
@@ -1,406 +1,88 @@
|
||||
"""Terminal session manager for WebSocket connections."""
|
||||
|
||||
import asyncio
|
||||
import logging
|
||||
import uuid
|
||||
from datetime import datetime, timezone
|
||||
from typing import Any
|
||||
|
||||
from fastapi import WebSocket
|
||||
|
||||
from src.database import SessionLocal
|
||||
from src.models.terminal_session import TerminalSessionModel
|
||||
from src.services.terminal_session import TerminalSession
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class MaxSessionsExceededError(Exception):
|
||||
"""Raised when the maximum number of terminal sessions per instance is reached."""
|
||||
|
||||
def __init__(self, instance_id: str, max_sessions: int = 5) -> None:
|
||||
self.instance_id = instance_id
|
||||
self.max_sessions = max_sessions
|
||||
super().__init__(
|
||||
f"Maximum of {max_sessions} terminal sessions reached for instance {instance_id}"
|
||||
)
|
||||
|
||||
|
||||
class TerminalManager:
|
||||
"""Manages active terminal sessions with persistence support."""
|
||||
|
||||
# Maximum sessions per tool instance
|
||||
MAX_SESSIONS_PER_INSTANCE = 5
|
||||
"""Manages active terminal sessions."""
|
||||
|
||||
def __init__(self) -> None:
|
||||
# Track sessions by (instance_id, session_id) for multi-session support
|
||||
self._sessions: dict[tuple[str, str], TerminalSession] = {}
|
||||
self._idle_check_task: asyncio.Task | None = None
|
||||
self._start_idle_check()
|
||||
|
||||
def _start_idle_check(self) -> None:
|
||||
"""Start the idle timeout background task."""
|
||||
if self._idle_check_task is not None and not self._idle_check_task.done():
|
||||
return
|
||||
try:
|
||||
loop = asyncio.get_running_loop()
|
||||
self._idle_check_task = loop.create_task(self._idle_check_loop())
|
||||
except RuntimeError:
|
||||
# No event loop running yet, will be started lazily
|
||||
pass
|
||||
|
||||
async def _idle_check_loop(self) -> None:
|
||||
"""Periodically check for idle sessions and clean them up."""
|
||||
while True:
|
||||
try:
|
||||
await asyncio.sleep(60) # Check every minute
|
||||
await self._cleanup_idle_sessions()
|
||||
except Exception as exc:
|
||||
logger.error("Error in idle check loop: %s", exc)
|
||||
|
||||
async def _cleanup_idle_sessions(self) -> None:
|
||||
"""Clean up sessions that have been idle for too long."""
|
||||
idle_keys = []
|
||||
for (instance_id, session_id), session in list(self._sessions.items()):
|
||||
if session.is_idle():
|
||||
idle_keys.append((instance_id, session_id))
|
||||
|
||||
for key in idle_keys:
|
||||
instance_id, session_id = key
|
||||
logger.info(
|
||||
"Cleaning up idle terminal session %s for instance %s",
|
||||
session_id,
|
||||
instance_id,
|
||||
)
|
||||
session = self._sessions.pop(key, None)
|
||||
if session:
|
||||
await session.close()
|
||||
# Update DB status fire-and-forget
|
||||
asyncio.create_task(self._mark_closed_in_db(session_id))
|
||||
|
||||
async def _insert_db_session_row(
|
||||
self,
|
||||
session_id: str,
|
||||
instance_id: uuid.UUID,
|
||||
name: str,
|
||||
) -> None:
|
||||
"""Insert a TerminalSessionModel row into the database."""
|
||||
try:
|
||||
async with SessionLocal() as db_session:
|
||||
db_row = TerminalSessionModel(
|
||||
id=uuid.UUID(session_id),
|
||||
instance_id=instance_id,
|
||||
name=name,
|
||||
status="active",
|
||||
created_at=datetime.now(timezone.utc),
|
||||
last_activity_at=datetime.now(timezone.utc),
|
||||
)
|
||||
db_session.add(db_row)
|
||||
await db_session.commit()
|
||||
logger.debug(
|
||||
"Inserted terminal session row %s for instance %s",
|
||||
session_id,
|
||||
instance_id,
|
||||
)
|
||||
except Exception as exc:
|
||||
logger.error("Failed to insert terminal session row: %s", exc)
|
||||
|
||||
async def _mark_closed_in_db(self, session_id: str) -> None:
|
||||
"""Mark a terminal session as closed in the database."""
|
||||
try:
|
||||
async with SessionLocal() as db_session:
|
||||
db_row = await db_session.get(
|
||||
TerminalSessionModel, uuid.UUID(session_id)
|
||||
)
|
||||
if db_row:
|
||||
db_row.status = "closed"
|
||||
db_row.closed_at = datetime.now(timezone.utc)
|
||||
await db_session.commit()
|
||||
logger.debug(
|
||||
"Marked terminal session %s as closed in DB", session_id
|
||||
)
|
||||
except Exception as exc:
|
||||
logger.error("Failed to mark terminal session as closed in DB: %s", exc)
|
||||
|
||||
def _count_sessions_for_instance(self, instance_id_str: str) -> int:
|
||||
"""Count active in-memory sessions for a given instance."""
|
||||
return sum(1 for (iid, _sid) in self._sessions if iid == instance_id_str)
|
||||
self._sessions: dict[str, TerminalSession] = {}
|
||||
|
||||
async def create_session(
|
||||
self,
|
||||
instance_id: uuid.UUID,
|
||||
container_id: str,
|
||||
startup_command: str | None = None,
|
||||
name: str | None = None,
|
||||
session_id: str | None = None,
|
||||
websocket: WebSocket,
|
||||
) -> TerminalSession:
|
||||
"""Create a new terminal session for an instance.
|
||||
|
||||
Enforces a maximum of MAX_SESSIONS_PER_INSTANCE sessions per instance.
|
||||
Inserts a DB row fire-and-forget.
|
||||
|
||||
Args:
|
||||
instance_id: UUID of the tool instance.
|
||||
container_id: Docker container ID.
|
||||
startup_command: Optional startup command to run.
|
||||
name: Optional session name (auto-generated if omitted).
|
||||
|
||||
Returns:
|
||||
The newly created TerminalSession.
|
||||
|
||||
Raises:
|
||||
MaxSessionsExceededError: If the instance already has max sessions.
|
||||
"""
|
||||
instance_id_str = str(instance_id)
|
||||
|
||||
if (
|
||||
self._count_sessions_for_instance(instance_id_str)
|
||||
>= self.MAX_SESSIONS_PER_INSTANCE
|
||||
):
|
||||
raise MaxSessionsExceededError(
|
||||
instance_id_str, self.MAX_SESSIONS_PER_INSTANCE
|
||||
)
|
||||
|
||||
if session_id is None:
|
||||
session_id = str(uuid.uuid4())
|
||||
session = TerminalSession(
|
||||
session_id=session_id,
|
||||
instance_id=instance_id,
|
||||
container_id=container_id,
|
||||
startup_command=startup_command,
|
||||
name=name,
|
||||
)
|
||||
await session.start(startup_command=startup_command)
|
||||
|
||||
key = (instance_id_str, session_id)
|
||||
self._sessions[key] = session
|
||||
|
||||
# Fire-and-forget DB insert (skip if row already exists)
|
||||
asyncio.create_task(
|
||||
self._insert_db_session_row(session_id, instance_id, session.name)
|
||||
)
|
||||
|
||||
logger.info(
|
||||
"Created terminal session %s for instance %s (name=%s)",
|
||||
session_id,
|
||||
instance_id,
|
||||
session.name,
|
||||
)
|
||||
return session
|
||||
|
||||
async def get_or_create_session(
|
||||
self,
|
||||
instance_id: uuid.UUID,
|
||||
container_id: str,
|
||||
startup_command: str | None = None,
|
||||
) -> TerminalSession:
|
||||
"""Get existing session or create a new one.
|
||||
|
||||
Backward-compatible alias that uses 'default' as the session_id.
|
||||
"""
|
||||
# Ensure idle check is running (lazy start)
|
||||
self._start_idle_check()
|
||||
|
||||
instance_id_str = str(instance_id)
|
||||
key = (instance_id_str, "default")
|
||||
|
||||
# Check for existing default session
|
||||
if key in self._sessions:
|
||||
session = self._sessions[key]
|
||||
|
||||
# Check if session is still alive
|
||||
if session.is_alive():
|
||||
logger.debug(
|
||||
"Reattaching to existing terminal session for instance %s",
|
||||
instance_id,
|
||||
)
|
||||
return session
|
||||
else:
|
||||
# Session died, clean it up
|
||||
logger.debug(
|
||||
"Existing session for instance %s is dead, cleaning up",
|
||||
instance_id,
|
||||
)
|
||||
await session.close()
|
||||
del self._sessions[key]
|
||||
|
||||
# Create new default session
|
||||
logger.info(
|
||||
"Creating new default terminal session for instance %s", instance_id
|
||||
)
|
||||
"""Create a new terminal session."""
|
||||
session_id = str(uuid.uuid4())
|
||||
session = TerminalSession(
|
||||
session_id=session_id,
|
||||
instance_id=instance_id,
|
||||
container_id=container_id,
|
||||
startup_command=startup_command,
|
||||
name="Session 1",
|
||||
)
|
||||
await session.start(startup_command=startup_command)
|
||||
self._sessions[key] = session
|
||||
session = TerminalSession(session_id, instance_id, container_id)
|
||||
await session.start()
|
||||
self._sessions[session_id] = session
|
||||
|
||||
# Fire-and-forget DB insert
|
||||
asyncio.create_task(
|
||||
self._insert_db_session_row(session_id, instance_id, session.name)
|
||||
)
|
||||
# Start background tasks for I/O streaming
|
||||
asyncio.create_task(self._read_loop(session, websocket))
|
||||
asyncio.create_task(self._write_loop(session, websocket))
|
||||
|
||||
return session
|
||||
|
||||
def get_session(
|
||||
self,
|
||||
instance_id: str,
|
||||
session_id: str,
|
||||
) -> TerminalSession | None:
|
||||
"""Lookup a session by composite key, or by internal session_id."""
|
||||
session = self._sessions.get((instance_id, session_id))
|
||||
if session is not None:
|
||||
return session
|
||||
# Fallback: search by internal TerminalSession.session_id
|
||||
for (iid, _sid), sess in self._sessions.items():
|
||||
if iid == instance_id and sess.session_id == session_id:
|
||||
return sess
|
||||
return None
|
||||
async def _read_loop(self, session: TerminalSession, websocket: WebSocket) -> None:
|
||||
"""Read output from the container and send to WebSocket."""
|
||||
try:
|
||||
while session.is_alive() and not session._closed:
|
||||
data = await session.read_output()
|
||||
if data:
|
||||
await websocket.send_bytes(data)
|
||||
else:
|
||||
await asyncio.sleep(0.01)
|
||||
except Exception:
|
||||
pass
|
||||
finally:
|
||||
await self._cleanup_session(session)
|
||||
|
||||
def _find_key_by_internal_id(
|
||||
self,
|
||||
instance_id: str,
|
||||
internal_session_id: str,
|
||||
) -> tuple[str, str] | None:
|
||||
"""Find the manager dict key for a session by its internal session_id."""
|
||||
for (iid, sid), session in self._sessions.items():
|
||||
if iid == instance_id and session.session_id == internal_session_id:
|
||||
return (iid, sid)
|
||||
return None
|
||||
async def _write_loop(self, session: TerminalSession, websocket: WebSocket) -> None:
|
||||
"""Read input from WebSocket and send to container."""
|
||||
try:
|
||||
while session.is_alive() and not session._closed:
|
||||
message = await websocket.receive()
|
||||
if message["type"] == "websocket.receive":
|
||||
if "bytes" in message:
|
||||
await session.write_input(message["bytes"])
|
||||
elif "text" in message:
|
||||
text = message["text"]
|
||||
if text.startswith("{"):
|
||||
# Control message (JSON)
|
||||
import json
|
||||
try:
|
||||
ctrl = json.loads(text)
|
||||
if ctrl.get("type") == "resize":
|
||||
await session.resize(
|
||||
ctrl.get("cols", 80),
|
||||
ctrl.get("rows", 24),
|
||||
)
|
||||
except json.JSONDecodeError:
|
||||
pass
|
||||
else:
|
||||
await session.write_input(text.encode("utf-8"))
|
||||
elif message["type"] == "websocket.disconnect":
|
||||
break
|
||||
except Exception:
|
||||
pass
|
||||
finally:
|
||||
await self._cleanup_session(session)
|
||||
|
||||
def get_sessions_for_instance(
|
||||
self,
|
||||
instance_id: str,
|
||||
) -> list[TerminalSession]:
|
||||
"""Return all in-memory sessions for a given instance."""
|
||||
return [
|
||||
session
|
||||
for (iid, _sid), session in self._sessions.items()
|
||||
if iid == instance_id
|
||||
]
|
||||
|
||||
async def close_session(
|
||||
self,
|
||||
instance_id: str,
|
||||
session_id: str,
|
||||
) -> None:
|
||||
"""Close a specific session and update its DB status."""
|
||||
key = (instance_id, session_id)
|
||||
session = self._sessions.pop(key, None)
|
||||
if session:
|
||||
await session.close()
|
||||
# Fire-and-forget DB update
|
||||
asyncio.create_task(self._mark_closed_in_db(session_id))
|
||||
logger.info(
|
||||
"Closed terminal session %s for instance %s",
|
||||
session_id,
|
||||
instance_id,
|
||||
)
|
||||
|
||||
async def attach_websocket(
|
||||
self,
|
||||
session: TerminalSession,
|
||||
websocket: WebSocket,
|
||||
) -> None:
|
||||
"""Attach a WebSocket to an existing session.
|
||||
|
||||
Closes existing WebSocket connections only for this specific session.
|
||||
"""
|
||||
# Handle concurrent connections - close existing ones within the same session
|
||||
if session.has_websockets():
|
||||
logger.debug(
|
||||
"Closing existing WebSocket connections for session %s (instance %s)",
|
||||
session.session_id,
|
||||
session.instance_id,
|
||||
)
|
||||
for ws in list(session._websockets):
|
||||
try:
|
||||
await ws.close(code=4000, reason="New connection established")
|
||||
except Exception:
|
||||
pass # noqa: S110
|
||||
session._websockets.clear()
|
||||
|
||||
# Attach new WebSocket
|
||||
session.attach_websocket(websocket)
|
||||
|
||||
# Replay buffer
|
||||
buffer = session.get_buffer()
|
||||
if buffer:
|
||||
try:
|
||||
await websocket.send_bytes(buffer)
|
||||
except Exception:
|
||||
pass # noqa: S110
|
||||
|
||||
async def detach_websocket(
|
||||
self,
|
||||
session: TerminalSession,
|
||||
websocket: WebSocket,
|
||||
) -> None:
|
||||
"""Detach a WebSocket from a session."""
|
||||
session.detach_websocket(websocket)
|
||||
|
||||
async def reset_session(
|
||||
self,
|
||||
instance_id: uuid.UUID,
|
||||
container_id: str,
|
||||
startup_command: str | None = None,
|
||||
session_id: str | None = None,
|
||||
name: str | None = None,
|
||||
) -> TerminalSession:
|
||||
"""Reset a session by killing it and creating a new one.
|
||||
|
||||
Args:
|
||||
instance_id: UUID of the tool instance.
|
||||
container_id: Docker container ID.
|
||||
startup_command: Optional startup command.
|
||||
session_id: Specific session to reset. If None, resets the default session.
|
||||
name: Optional name to preserve for the new session.
|
||||
|
||||
Returns:
|
||||
The newly created TerminalSession.
|
||||
"""
|
||||
instance_id_str = str(instance_id)
|
||||
target_session_id = session_id or "default"
|
||||
key = (instance_id_str, target_session_id)
|
||||
|
||||
# Preserve old name if not provided
|
||||
old_name = name
|
||||
if old_name is None and key in self._sessions:
|
||||
old_name = self._sessions[key].name
|
||||
|
||||
# Close existing session if any
|
||||
if key in self._sessions:
|
||||
logger.debug(
|
||||
"Resetting terminal session %s for instance %s",
|
||||
target_session_id,
|
||||
instance_id,
|
||||
)
|
||||
old_session = self._sessions.pop(key)
|
||||
await old_session.close()
|
||||
# Fire-and-forget DB update for old session
|
||||
asyncio.create_task(self._mark_closed_in_db(old_session.session_id))
|
||||
|
||||
# Create new session preserving the same session_id slot
|
||||
new_session_id = str(uuid.uuid4())
|
||||
new_session = TerminalSession(
|
||||
session_id=new_session_id,
|
||||
instance_id=instance_id,
|
||||
container_id=container_id,
|
||||
startup_command=startup_command,
|
||||
name=old_name or ("Session 1" if target_session_id == "default" else None),
|
||||
)
|
||||
await new_session.start(startup_command=startup_command)
|
||||
self._sessions[key] = new_session
|
||||
|
||||
# Fire-and-forget DB insert
|
||||
asyncio.create_task(
|
||||
self._insert_db_session_row(new_session_id, instance_id, new_session.name)
|
||||
)
|
||||
|
||||
return new_session
|
||||
async def _cleanup_session(self, session: TerminalSession) -> None:
|
||||
"""Clean up a session."""
|
||||
if session.session_id in self._sessions:
|
||||
del self._sessions[session.session_id]
|
||||
await session.close()
|
||||
|
||||
async def close_all(self) -> None:
|
||||
"""Close all active sessions."""
|
||||
@@ -409,9 +91,6 @@ class TerminalManager:
|
||||
for session in sessions:
|
||||
await session.close()
|
||||
|
||||
if self._idle_check_task and not self._idle_check_task.done():
|
||||
self._idle_check_task.cancel()
|
||||
|
||||
|
||||
# Global terminal manager instance
|
||||
terminal_manager = TerminalManager()
|
||||
|
||||
@@ -1,99 +1,35 @@
|
||||
"""Terminal session management for tool instances."""
|
||||
|
||||
import asyncio
|
||||
import logging
|
||||
import os
|
||||
import pty
|
||||
import select
|
||||
import signal
|
||||
import struct
|
||||
import fcntl
|
||||
import time
|
||||
import uuid
|
||||
from collections import deque
|
||||
from typing import Any
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class TerminalSession:
|
||||
"""Manages a single terminal session connected to a docker container.
|
||||
"""Manages a single terminal session connected to a docker container."""
|
||||
|
||||
Supports persistent sessions that survive WebSocket disconnections.
|
||||
Multiple WebSocket connections can attach/detach from the same session.
|
||||
"""
|
||||
|
||||
# Circular buffer size (10KB)
|
||||
BUFFER_SIZE = 10 * 1024
|
||||
|
||||
# Idle timeout in seconds (30 minutes)
|
||||
IDLE_TIMEOUT = 30 * 60
|
||||
|
||||
# Session number counter per instance_id for auto-naming
|
||||
_instance_counters: dict[str, int] = {}
|
||||
|
||||
def __init__(
|
||||
self,
|
||||
session_id: str,
|
||||
instance_id: uuid.UUID,
|
||||
container_id: str,
|
||||
startup_command: str | None = None,
|
||||
name: str | None = None,
|
||||
) -> None:
|
||||
def __init__(self, session_id: str, instance_id: uuid.UUID, container_id: str) -> None:
|
||||
self.session_id = session_id
|
||||
self.instance_id = instance_id
|
||||
self.container_id = container_id
|
||||
self.startup_command = startup_command
|
||||
self.process: asyncio.subprocess.Process | None = None
|
||||
self._closed = False
|
||||
self._master_fd: int | None = None
|
||||
self._slave_fd: int | None = None
|
||||
|
||||
# Circular buffer for output replay
|
||||
self._output_buffer: deque[bytes] = deque(maxlen=self.BUFFER_SIZE)
|
||||
self._buffer_size = 0
|
||||
|
||||
# WebSocket connections
|
||||
self._websockets: set[Any] = set()
|
||||
|
||||
# Activity tracking
|
||||
self.last_activity = time.time()
|
||||
|
||||
# Terminal size
|
||||
self._cols = 80
|
||||
self._rows = 24
|
||||
|
||||
# Session metadata
|
||||
self.name = name or self._generate_name(str(instance_id))
|
||||
self.status: str = "active"
|
||||
|
||||
@classmethod
|
||||
def _generate_name(cls, instance_id: str) -> str:
|
||||
"""Generate an auto-incremented session name for the instance."""
|
||||
count = cls._instance_counters.get(instance_id, 0) + 1
|
||||
cls._instance_counters[instance_id] = count
|
||||
return f"Session {count}"
|
||||
|
||||
async def start(self, startup_command: str | None = None) -> None:
|
||||
async def start(self) -> None:
|
||||
"""Start the docker exec process with a shell using a PTY."""
|
||||
# Create a pseudo-terminal on the host
|
||||
self._master_fd, self._slave_fd = pty.openpty()
|
||||
|
||||
|
||||
# Set the terminal size initially
|
||||
self._set_terminal_size(self._cols, self._rows)
|
||||
logger.debug(
|
||||
f"Starting terminal session {self.session_id} for container {self.container_id} with initial size {self._cols}x{self._rows}"
|
||||
)
|
||||
|
||||
# Build the shell command
|
||||
if startup_command:
|
||||
shell_cmd = f'bash -c "{startup_command}" || true; exec bash -il'
|
||||
logger.debug(
|
||||
f"Using startup command for session {self.session_id}: {startup_command}"
|
||||
)
|
||||
else:
|
||||
shell_cmd = "bash -il"
|
||||
|
||||
self._set_terminal_size(80, 24)
|
||||
|
||||
# Start docker exec with the slave fd as stdin/stdout/stderr
|
||||
# Using -it because the slave fd IS a TTY
|
||||
self.process = await asyncio.create_subprocess_exec(
|
||||
@@ -104,132 +40,67 @@ class TerminalSession:
|
||||
"TERM=xterm",
|
||||
self.container_id,
|
||||
"bash",
|
||||
"-c",
|
||||
shell_cmd,
|
||||
"-il",
|
||||
stdin=self._slave_fd,
|
||||
stdout=self._slave_fd,
|
||||
stderr=self._slave_fd,
|
||||
)
|
||||
|
||||
|
||||
# Close slave fd in parent process
|
||||
os.close(self._slave_fd)
|
||||
self._slave_fd = None
|
||||
|
||||
self.last_activity = time.time()
|
||||
|
||||
def _set_terminal_size(self, cols: int, rows: int) -> None:
|
||||
"""Set the terminal size using TIOCSWINSZ."""
|
||||
if self._master_fd is None:
|
||||
logger.warning("Cannot resize: master_fd is None (session not started)")
|
||||
return
|
||||
# TIOCSWINSZ = 0x5414 on Linux
|
||||
TIOCSWINSZ = 0x5414
|
||||
size = struct.pack("HHHH", rows, cols, 0, 0)
|
||||
size = struct.pack('HHHH', rows, cols, 0, 0)
|
||||
try:
|
||||
fcntl.ioctl(self._master_fd, TIOCSWINSZ, size)
|
||||
logger.debug(f"Resized PTY to {cols}x{rows} (fd={self._master_fd})")
|
||||
except (OSError, IOError) as e:
|
||||
logger.error(f"Failed to resize PTY: {e}")
|
||||
except (OSError, IOError):
|
||||
pass
|
||||
|
||||
async def read_output(self) -> bytes:
|
||||
"""Read output from the PTY master and store in buffer."""
|
||||
"""Read output from the PTY master."""
|
||||
if self._master_fd is None or self._closed:
|
||||
return b""
|
||||
try:
|
||||
# Use select to check if data is available
|
||||
readable, _, _ = select.select([self._master_fd], [], [], 0.1)
|
||||
if readable:
|
||||
data = os.read(self._master_fd, 4096)
|
||||
if data:
|
||||
self._add_to_buffer(data)
|
||||
self.last_activity = time.time()
|
||||
return data
|
||||
return os.read(self._master_fd, 4096)
|
||||
return b""
|
||||
except (OSError, IOError, ValueError):
|
||||
return b""
|
||||
|
||||
def _add_to_buffer(self, data: bytes) -> None:
|
||||
"""Add data to circular buffer, maintaining size limit."""
|
||||
self._output_buffer.append(data)
|
||||
self._buffer_size += len(data)
|
||||
|
||||
# Trim if exceeds max size
|
||||
while self._buffer_size > self.BUFFER_SIZE and self._output_buffer:
|
||||
removed = self._output_buffer.popleft()
|
||||
self._buffer_size -= len(removed)
|
||||
|
||||
def get_buffer(self) -> bytes:
|
||||
"""Get buffered output for replay."""
|
||||
return b"".join(self._output_buffer)
|
||||
|
||||
async def write_input(self, data: bytes) -> None:
|
||||
"""Write input to the PTY master."""
|
||||
if self._master_fd is None or self._closed:
|
||||
return
|
||||
try:
|
||||
os.write(self._master_fd, data)
|
||||
self.last_activity = time.time()
|
||||
except (OSError, IOError):
|
||||
pass
|
||||
|
||||
async def resize(self, cols: int, rows: int) -> None:
|
||||
"""Resize the terminal."""
|
||||
if self._closed:
|
||||
logger.warning("Cannot resize: session is closed")
|
||||
return
|
||||
|
||||
# Only resize if dimensions actually changed
|
||||
if cols == self._cols and rows == self._rows:
|
||||
return
|
||||
|
||||
self._cols = cols
|
||||
self._rows = rows
|
||||
logger.debug(f"resize() called for session {self.session_id}: {cols}x{rows}")
|
||||
self._set_terminal_size(cols, rows)
|
||||
|
||||
# Docker exec -it creates its own PTY inside the container,
|
||||
# so host PTY resize doesn't propagate to the container shell.
|
||||
# Send SIGWINCH to the docker exec process on the host.
|
||||
# Docker exec forwards signals to the container process, which should
|
||||
# cause the container's shell to re-read its terminal size.
|
||||
if self.process and self.process.pid:
|
||||
try:
|
||||
os.kill(self.process.pid, signal.SIGWINCH)
|
||||
logger.debug(
|
||||
f"Sent SIGWINCH to docker exec process {self.process.pid} for session {self.session_id}"
|
||||
)
|
||||
except ProcessLookupError:
|
||||
logger.warning(
|
||||
f"docker exec process {self.process.pid} not found for session {self.session_id}"
|
||||
)
|
||||
except Exception as e:
|
||||
logger.warning(f"Failed to send SIGWINCH: {e}")
|
||||
|
||||
async def reset(self) -> None:
|
||||
"""Reset the session by killing the process and clearing state."""
|
||||
self.status = "resetting"
|
||||
await self.close()
|
||||
self._closed = False
|
||||
self._output_buffer.clear()
|
||||
self._buffer_size = 0
|
||||
self._websockets.clear()
|
||||
self.process = None
|
||||
self._master_fd = None
|
||||
self._slave_fd = None
|
||||
self.status = "active"
|
||||
|
||||
async def close(self) -> None:
|
||||
"""Close the session and cleanup."""
|
||||
if self._closed:
|
||||
return
|
||||
self._closed = True
|
||||
self.status = "closed"
|
||||
|
||||
if self._master_fd is not None:
|
||||
try:
|
||||
os.close(self._master_fd)
|
||||
except OSError:
|
||||
pass # noqa: S110
|
||||
pass
|
||||
self._master_fd = None
|
||||
|
||||
if self.process is not None:
|
||||
@@ -244,35 +115,3 @@ class TerminalSession:
|
||||
if self.process is None:
|
||||
return False
|
||||
return self.process.returncode is None
|
||||
|
||||
def is_idle(self) -> bool:
|
||||
"""Check if the session has been idle for too long."""
|
||||
if self._websockets:
|
||||
return False
|
||||
return time.time() - self.last_activity > self.IDLE_TIMEOUT
|
||||
|
||||
def attach_websocket(self, websocket: Any) -> None:
|
||||
"""Attach a WebSocket to this session."""
|
||||
self._websockets.add(websocket)
|
||||
self.last_activity = time.time()
|
||||
|
||||
def detach_websocket(self, websocket: Any) -> None:
|
||||
"""Detach a WebSocket from this session."""
|
||||
self._websockets.discard(websocket)
|
||||
|
||||
def has_websockets(self) -> bool:
|
||||
"""Check if any WebSockets are attached."""
|
||||
return len(self._websockets) > 0
|
||||
|
||||
async def send_to_all(self, data: bytes) -> None:
|
||||
"""Send data to all attached WebSockets."""
|
||||
dead_sockets = set()
|
||||
for ws in self._websockets:
|
||||
try:
|
||||
await ws.send_bytes(data)
|
||||
except Exception:
|
||||
dead_sockets.add(ws)
|
||||
|
||||
# Clean up dead sockets
|
||||
for ws in dead_sockets:
|
||||
self._websockets.discard(ws)
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
|
||||
import subprocess
|
||||
from dataclasses import dataclass, field
|
||||
from typing import Any
|
||||
|
||||
|
||||
def _run_git_command(repo_path: str, *args: str) -> str:
|
||||
@@ -123,15 +124,7 @@ def create_branch(repo_path: str, name: str, base_branch: str = "HEAD") -> None:
|
||||
try:
|
||||
_run_git_command(repo_path, "rev-parse", "--verify", "HEAD^{commit}")
|
||||
except RuntimeError:
|
||||
# No commits yet - empty repository
|
||||
try:
|
||||
_run_git_command(repo_path, "checkout", "--orphan", name)
|
||||
except RuntimeError as e:
|
||||
if "work tree" in str(e).lower():
|
||||
# Bare repository - use symbolic-ref instead
|
||||
_run_git_command(repo_path, "symbolic-ref", "HEAD", f"refs/heads/{name}")
|
||||
return
|
||||
raise
|
||||
_run_git_command(repo_path, "checkout", "--orphan", name)
|
||||
return
|
||||
|
||||
_run_git_command(repo_path, "branch", name, base_branch)
|
||||
@@ -162,14 +155,7 @@ def checkout_branch(repo_path: str, name: str) -> None:
|
||||
Raises:
|
||||
RuntimeError: If checkout fails
|
||||
"""
|
||||
try:
|
||||
_run_git_command(repo_path, "checkout", name)
|
||||
except RuntimeError as e:
|
||||
if "work tree" in str(e).lower():
|
||||
# Bare repository - use symbolic-ref instead
|
||||
_run_git_command(repo_path, "symbolic-ref", "HEAD", f"refs/heads/{name}")
|
||||
return
|
||||
raise
|
||||
_run_git_command(repo_path, "checkout", name)
|
||||
|
||||
|
||||
def commit_changes(
|
||||
@@ -304,10 +290,6 @@ def get_current_branch(repo_path: str) -> str:
|
||||
Current branch name
|
||||
"""
|
||||
try:
|
||||
branch = _run_git_command(repo_path, "rev-parse", "--abbrev-ref", "HEAD").strip()
|
||||
if branch != "HEAD":
|
||||
return branch
|
||||
return _run_git_command(repo_path, "rev-parse", "--abbrev-ref", "HEAD").strip()
|
||||
except RuntimeError:
|
||||
pass
|
||||
|
||||
return _run_git_command(repo_path, "symbolic-ref", "--short", "HEAD").strip()
|
||||
return _run_git_command(repo_path, "symbolic-ref", "--short", "HEAD").strip()
|
||||
|
||||
@@ -289,37 +289,19 @@ def list_branches(repo_path: str) -> tuple[list[BranchInfo], str]:
|
||||
branches: list[BranchInfo] = []
|
||||
default_branch = "main"
|
||||
|
||||
# Get list of remote names to properly filter remote tracking branches
|
||||
try:
|
||||
remote_output = _run_git_command(repo_path, "remote")
|
||||
remote_names = {r.strip() for r in remote_output.strip().split("\n") if r.strip()}
|
||||
except RuntimeError:
|
||||
remote_names = set()
|
||||
|
||||
for line in output.strip().split("\n"):
|
||||
if not line:
|
||||
continue
|
||||
|
||||
branch_name = line.strip()
|
||||
|
||||
# Skip detached HEAD pointer
|
||||
if branch_name == "HEAD":
|
||||
continue
|
||||
|
||||
# Skip remote tracking branches - they appear as "origin/branch-name"
|
||||
# Check if first part is a remote name
|
||||
if "/" in branch_name:
|
||||
first_part = branch_name.split("/", 1)[0]
|
||||
if first_part in remote_names:
|
||||
# Extract just the branch name part (after "origin/")
|
||||
branch_name = branch_name.split("/", 1)[1]
|
||||
elif branch_name.startswith("remotes/"):
|
||||
# Handle "remotes/origin/branch-name" format
|
||||
parts = branch_name.split("/", 2)
|
||||
if len(parts) >= 3:
|
||||
branch_name = parts[2]
|
||||
else:
|
||||
continue
|
||||
# Skip remote tracking branches (they start with remotes/)
|
||||
if branch_name.startswith("remotes/"):
|
||||
# Extract just the branch name part
|
||||
parts = branch_name.split("/", 2)
|
||||
if len(parts) >= 3:
|
||||
branch_name = parts[2]
|
||||
else:
|
||||
continue
|
||||
|
||||
# Skip duplicates
|
||||
if any(b.name == branch_name for b in branches):
|
||||
|
||||
@@ -1,67 +0,0 @@
|
||||
"""Integration tests for multi-session terminal WebSocket and REST API."""
|
||||
|
||||
import pytest
|
||||
from fastapi.testclient import TestClient
|
||||
from src.main import app
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def client():
|
||||
return TestClient(app)
|
||||
|
||||
|
||||
class TestTerminalWebSocketMultiSession:
|
||||
"""Tests for multi-session WebSocket routing."""
|
||||
|
||||
def test_specific_session_websocket_route_exists(self, client):
|
||||
"""The specific session WebSocket route should be registered."""
|
||||
# We can't easily test WebSocket without auth, but we can verify
|
||||
# the route exists by checking for a 403 (no auth cookie)
|
||||
response = client.get("/ws/tool-instances/test-instance/terminal/test-session")
|
||||
# WebSocket endpoint returns 403 when accessed via HTTP GET
|
||||
assert response.status_code in (403, 404)
|
||||
|
||||
def test_default_session_alias_route_exists(self, client):
|
||||
"""The default session alias route should still exist."""
|
||||
response = client.get("/ws/tool-instances/test-instance/terminal")
|
||||
assert response.status_code in (403, 404)
|
||||
|
||||
|
||||
class TestTerminalRestApi:
|
||||
"""Tests for REST API endpoints."""
|
||||
|
||||
def test_list_sessions_requires_auth(self, client):
|
||||
"""List sessions endpoint requires authentication."""
|
||||
response = client.get("/instances/test/terminal/sessions")
|
||||
assert response.status_code == 401
|
||||
|
||||
def test_create_session_requires_auth(self, client):
|
||||
"""Create session endpoint requires authentication."""
|
||||
response = client.post(
|
||||
"/instances/test/terminal/sessions",
|
||||
json={},
|
||||
)
|
||||
assert response.status_code == 401
|
||||
|
||||
def test_close_session_requires_auth(self, client):
|
||||
"""Close session endpoint requires authentication."""
|
||||
response = client.delete("/instances/test/terminal/sessions/test-session")
|
||||
assert response.status_code == 401
|
||||
|
||||
def test_reset_session_requires_auth(self, client):
|
||||
"""Reset session endpoint requires authentication."""
|
||||
response = client.post("/instances/test/terminal/sessions/test-session/reset")
|
||||
assert response.status_code == 401
|
||||
|
||||
def test_rename_session_requires_auth(self, client):
|
||||
"""Rename session endpoint requires authentication."""
|
||||
response = client.post(
|
||||
"/instances/test/terminal/sessions/test-session/rename",
|
||||
json={"name": "New Name"},
|
||||
)
|
||||
assert response.status_code == 401
|
||||
|
||||
def test_legacy_reset_alias_requires_auth(self, client):
|
||||
"""Legacy reset endpoint still requires auth."""
|
||||
response = client.post("/instances/test/terminal/reset")
|
||||
assert response.status_code == 401
|
||||
@@ -8,14 +8,16 @@ from unittest.mock import patch
|
||||
import pytest
|
||||
import pytest_asyncio
|
||||
from fastapi.testclient import TestClient
|
||||
from sqlalchemy import create_engine, text
|
||||
from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
|
||||
from sqlalchemy.orm import sessionmaker
|
||||
|
||||
# Set test environment BEFORE importing app modules
|
||||
os.environ["APP_ENV"] = "testing"
|
||||
os.environ["SECRET_KEY"] = "test-secret-key-for-testing-only-do-not-use-in-production"
|
||||
os.environ["DATABASE_URL"] = "sqlite+aiosqlite:///:memory:"
|
||||
|
||||
from src.config import Settings
|
||||
from src.config import Settings, build_database_url
|
||||
from src.models.base import Base
|
||||
from src.main import app
|
||||
from src.auth.dependencies import get_db_session
|
||||
@@ -45,8 +47,10 @@ def test_client() -> Generator[TestClient, None, None]:
|
||||
app.dependency_overrides[get_db_session] = override_get_db_session
|
||||
|
||||
# Patch startup events to prevent PostgreSQL connection attempts
|
||||
with patch("src.main.init_database") as mock_init:
|
||||
with patch("src.main.init_database") as mock_init, \
|
||||
patch("src.main.seed_builtin_tool_types") as mock_seed:
|
||||
mock_init.return_value = True
|
||||
mock_seed.return_value = None
|
||||
|
||||
try:
|
||||
with TestClient(app) as client:
|
||||
@@ -57,31 +61,6 @@ def test_client() -> Generator[TestClient, None, None]:
|
||||
asyncio.run(engine.dispose())
|
||||
|
||||
|
||||
@pytest_asyncio.fixture
|
||||
async def db_session(test_client) -> AsyncGenerator[AsyncSession, None]:
|
||||
"""Provide an async database session for unit tests."""
|
||||
# Get the override function from the test_client fixture
|
||||
override_fn = app.dependency_overrides.get(get_db_session)
|
||||
if override_fn:
|
||||
gen = override_fn()
|
||||
session = await gen.asend(None)
|
||||
try:
|
||||
yield session
|
||||
finally:
|
||||
await gen.aclose()
|
||||
else:
|
||||
# Fallback: create a new engine and session
|
||||
engine = create_async_engine(
|
||||
"sqlite+aiosqlite:///:memory:",
|
||||
connect_args={"check_same_thread": False},
|
||||
)
|
||||
async with engine.begin() as conn:
|
||||
await conn.run_sync(Base.metadata.create_all)
|
||||
async with async_sessionmaker(engine, expire_on_commit=False)() as session:
|
||||
yield session
|
||||
await engine.dispose()
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def authenticated_client(test_client) -> Generator[TestClient, None, None]:
|
||||
"""Provide an authenticated test client with a test user."""
|
||||
@@ -131,65 +110,6 @@ def authenticated_client(test_client) -> Generator[TestClient, None, None]:
|
||||
yield test_client
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def test_project_and_repo(authenticated_client) -> tuple[str, str]:
|
||||
"""Create a project and repository directly in the database."""
|
||||
import uuid
|
||||
from src.models.project import Project
|
||||
from src.models.git_repository import GitRepository
|
||||
|
||||
project_id = uuid.uuid4()
|
||||
repo_id = uuid.uuid4()
|
||||
user_id = None
|
||||
|
||||
# Get user ID from session
|
||||
async def get_user_id():
|
||||
nonlocal user_id
|
||||
from src.auth.session import decode_session_cookie
|
||||
settings = Settings()
|
||||
session_cookie = authenticated_client.cookies.get("session")
|
||||
if session_cookie:
|
||||
session = decode_session_cookie(settings=settings, cookie_value=session_cookie)
|
||||
if session:
|
||||
user_id = uuid.UUID(session["user_id"])
|
||||
|
||||
asyncio.run(get_user_id())
|
||||
|
||||
if not user_id:
|
||||
raise RuntimeError("Could not get user ID from authenticated client")
|
||||
|
||||
async def create_project_and_repo():
|
||||
override_fn = app.dependency_overrides.get(get_db_session)
|
||||
if override_fn:
|
||||
gen = override_fn()
|
||||
session = await gen.asend(None)
|
||||
try:
|
||||
project = Project(
|
||||
id=project_id,
|
||||
name="test-project",
|
||||
description="Test project",
|
||||
owner_id=user_id,
|
||||
)
|
||||
session.add(project)
|
||||
|
||||
repo = GitRepository(
|
||||
id=repo_id,
|
||||
name="test-repo",
|
||||
path="/tmp/test-repo",
|
||||
project_id=project_id,
|
||||
owner_id=user_id,
|
||||
remote_url="https://github.com/test/repo.git",
|
||||
)
|
||||
session.add(repo)
|
||||
await session.commit()
|
||||
finally:
|
||||
await gen.aclose()
|
||||
|
||||
asyncio.run(create_project_and_repo())
|
||||
|
||||
return str(project_id), str(repo_id)
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def admin_client(test_client) -> Generator[TestClient, None, None]:
|
||||
"""Provide an authenticated test client with an admin user."""
|
||||
|
||||
@@ -0,0 +1,255 @@
|
||||
import uuid
|
||||
import pytest
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
class TestConfigFoldersAPI:
|
||||
"""Integration tests for config folders API."""
|
||||
|
||||
def test_list_config_folders_requires_authentication(self, test_client: TestClient) -> None:
|
||||
"""Test that listing config folders requires authentication."""
|
||||
response = test_client.get("/config-folders")
|
||||
assert response.status_code == 401
|
||||
|
||||
def test_list_config_folders_returns_user_folders(self, authenticated_client: TestClient) -> None:
|
||||
"""Test that authenticated users can list their folders."""
|
||||
response = authenticated_client.get("/config-folders")
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert isinstance(data, dict)
|
||||
assert "folders" in data
|
||||
assert isinstance(data["folders"], list)
|
||||
|
||||
def test_create_config_folder_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test creating a config folder."""
|
||||
response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "test-folder",
|
||||
"description": "Test folder",
|
||||
"mount_path": "/home/user",
|
||||
"files": {"test.txt": "hello world"},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 201
|
||||
data = response.json()
|
||||
assert data["name"] == "test-folder"
|
||||
assert data["mount_path"] == "/home/user"
|
||||
assert data["files"] == {"test.txt": "hello world"}
|
||||
|
||||
def test_create_config_folder_duplicate_name(self, authenticated_client: TestClient) -> None:
|
||||
"""Test that duplicate folder names are rejected."""
|
||||
# Create first folder
|
||||
response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "duplicate-folder",
|
||||
"mount_path": "/home/user",
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 201
|
||||
|
||||
# Try to create second with same name
|
||||
response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "duplicate-folder",
|
||||
"mount_path": "/home/user",
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 409
|
||||
|
||||
def test_create_config_folder_exceeds_size_limit(self, authenticated_client: TestClient) -> None:
|
||||
"""Test that folders exceeding 10MB are rejected."""
|
||||
large_content = "x" * (11 * 1024 * 1024) # 11MB
|
||||
response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "large-folder",
|
||||
"mount_path": "/home/user",
|
||||
"files": {"large.txt": large_content},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 422
|
||||
|
||||
def test_create_config_folder_path_traversal_attack(self, authenticated_client: TestClient) -> None:
|
||||
"""Test that path traversal in file paths is prevented."""
|
||||
response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "bad-folder",
|
||||
"mount_path": "/home/user",
|
||||
"files": {"../../../etc/passwd": "malicious"},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 422
|
||||
|
||||
def test_get_config_folder_by_id(self, authenticated_client: TestClient) -> None:
|
||||
"""Test getting a config folder by ID."""
|
||||
# Create folder first
|
||||
create_response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "get-test",
|
||||
"mount_path": "/home/user",
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
folder_id = create_response.json()["id"]
|
||||
|
||||
# Get it back
|
||||
response = authenticated_client.get(f"/config-folders/{folder_id}")
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["name"] == "get-test"
|
||||
|
||||
def test_get_config_folder_not_found(self, authenticated_client: TestClient) -> None:
|
||||
"""Test getting a non-existent folder."""
|
||||
response = authenticated_client.get(f"/config-folders/{uuid.uuid4()}")
|
||||
assert response.status_code == 404
|
||||
|
||||
def test_update_config_folder_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test updating a config folder."""
|
||||
# Create folder first
|
||||
create_response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "update-test",
|
||||
"mount_path": "/home/user",
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
folder_id = create_response.json()["id"]
|
||||
|
||||
# Update it
|
||||
response = authenticated_client.put(
|
||||
f"/config-folders/{folder_id}",
|
||||
json={
|
||||
"name": "updated-name",
|
||||
"mount_path": "/workspace",
|
||||
"files": {"new.txt": "content"},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["name"] == "updated-name"
|
||||
assert data["mount_path"] == "/workspace"
|
||||
|
||||
def test_delete_config_folder_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test deleting a config folder."""
|
||||
# Create folder first
|
||||
create_response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "delete-test",
|
||||
"mount_path": "/home/user",
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
folder_id = create_response.json()["id"]
|
||||
|
||||
# Delete it
|
||||
response = authenticated_client.delete(f"/config-folders/{folder_id}")
|
||||
assert response.status_code == 204
|
||||
|
||||
# Verify it's gone
|
||||
get_response = authenticated_client.get(f"/config-folders/{folder_id}")
|
||||
assert get_response.status_code == 404
|
||||
|
||||
def test_add_project_override_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test adding a project override."""
|
||||
# Create folder first
|
||||
create_response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "override-test",
|
||||
"mount_path": "/home/user",
|
||||
"files": {"global.txt": "global"},
|
||||
},
|
||||
)
|
||||
folder_id = create_response.json()["id"]
|
||||
project_id = str(uuid.uuid4())
|
||||
|
||||
# Add override
|
||||
response = authenticated_client.post(
|
||||
f"/config-folders/{folder_id}/overrides",
|
||||
json={
|
||||
"project_id": project_id,
|
||||
"mount_path": "/workspace",
|
||||
"files": {"project.txt": "project"},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert project_id in data["project_overrides"]
|
||||
|
||||
def test_update_project_override_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test updating a project override."""
|
||||
# Create folder with override
|
||||
create_response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "update-override-test",
|
||||
"mount_path": "/home/user",
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
folder_id = create_response.json()["id"]
|
||||
project_id = str(uuid.uuid4())
|
||||
|
||||
# Add override
|
||||
authenticated_client.post(
|
||||
f"/config-folders/{folder_id}/overrides",
|
||||
json={
|
||||
"project_id": project_id,
|
||||
"mount_path": "/workspace",
|
||||
"files": {"old.txt": "old"},
|
||||
},
|
||||
)
|
||||
|
||||
# Update override
|
||||
response = authenticated_client.put(
|
||||
f"/config-folders/{folder_id}/overrides/{project_id}",
|
||||
json={
|
||||
"mount_path": "/app",
|
||||
"files": {"new.txt": "new"},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["project_overrides"][project_id]["mount_path"] == "/app"
|
||||
|
||||
def test_delete_project_override_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test deleting a project override."""
|
||||
# Create folder with override
|
||||
create_response = authenticated_client.post(
|
||||
"/config-folders",
|
||||
json={
|
||||
"name": "delete-override-test",
|
||||
"mount_path": "/home/user",
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
folder_id = create_response.json()["id"]
|
||||
project_id = str(uuid.uuid4())
|
||||
|
||||
# Add override
|
||||
authenticated_client.post(
|
||||
f"/config-folders/{folder_id}/overrides",
|
||||
json={
|
||||
"project_id": project_id,
|
||||
"mount_path": "/workspace",
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
|
||||
# Delete override
|
||||
response = authenticated_client.delete(
|
||||
f"/config-folders/{folder_id}/overrides/{project_id}"
|
||||
)
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert project_id not in data["project_overrides"]
|
||||
@@ -1,453 +0,0 @@
|
||||
import uuid
|
||||
import pytest
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
class TestConfigProfilesAPI:
|
||||
"""Integration tests for config profiles API."""
|
||||
|
||||
def test_list_config_profiles_requires_authentication(self, test_client: TestClient) -> None:
|
||||
"""Test that listing config profiles requires authentication."""
|
||||
response = test_client.get("/config-profiles")
|
||||
assert response.status_code == 401
|
||||
|
||||
def test_list_config_profiles_returns_user_profiles(self, authenticated_client: TestClient) -> None:
|
||||
"""Test that authenticated users can list their profiles."""
|
||||
response = authenticated_client.get("/config-profiles")
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert isinstance(data, list)
|
||||
|
||||
def test_create_config_profile_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test creating a config profile."""
|
||||
response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "test-profile",
|
||||
"description": "Test profile",
|
||||
"env_vars": {"VAR": "value"},
|
||||
"runtime_hints": {"start_command": "npm start"},
|
||||
"mounts": [{"target": "/app", "mode": "rw", "files": {}}],
|
||||
"files": {"test.txt": "hello"},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 201
|
||||
data = response.json()
|
||||
assert data["name"] == "test-profile"
|
||||
assert data["env_vars"] == {"VAR": "value"}
|
||||
assert data["files"] == {"test.txt": "hello"}
|
||||
assert data["mounts"][0]["target"] == "/app"
|
||||
|
||||
def test_create_config_profile_duplicate_name(self, authenticated_client: TestClient) -> None:
|
||||
"""Test that duplicate profile names are rejected."""
|
||||
# Create first profile
|
||||
response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "duplicate-profile",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 201
|
||||
|
||||
# Try to create second with same name
|
||||
response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "duplicate-profile",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 409
|
||||
|
||||
def test_create_config_profile_exceeds_size_limit(self, authenticated_client: TestClient) -> None:
|
||||
"""Test that profiles exceeding 10MB are rejected."""
|
||||
large_content = "x" * (11 * 1024 * 1024) # 11MB
|
||||
response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "large-profile",
|
||||
"env_vars": {},
|
||||
"files": {"large.txt": large_content},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 413
|
||||
|
||||
def test_create_config_profile_invalid_file_path(self, authenticated_client: TestClient) -> None:
|
||||
"""Test that invalid file paths are rejected."""
|
||||
response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "bad-profile",
|
||||
"env_vars": {},
|
||||
"files": {"../../../etc/passwd": "malicious"},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 422
|
||||
|
||||
def test_create_config_profile_invalid_mount_target(self, authenticated_client: TestClient) -> None:
|
||||
"""Test that invalid mount targets are rejected."""
|
||||
response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "bad-mount-profile",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
"mounts": [{"target": "relative/path", "mode": "rw", "files": {}}],
|
||||
},
|
||||
)
|
||||
assert response.status_code == 422
|
||||
|
||||
def test_get_config_profile_by_id(self, authenticated_client: TestClient) -> None:
|
||||
"""Test getting a config profile by ID."""
|
||||
# Create profile first
|
||||
create_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "get-test",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
profile_id = create_response.json()["id"]
|
||||
|
||||
# Get it back
|
||||
response = authenticated_client.get(f"/config-profiles/{profile_id}")
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["name"] == "get-test"
|
||||
|
||||
def test_get_config_profile_not_found(self, authenticated_client: TestClient) -> None:
|
||||
"""Test getting a non-existent profile."""
|
||||
response = authenticated_client.get(f"/config-profiles/{uuid.uuid4()}")
|
||||
assert response.status_code == 404
|
||||
|
||||
def test_update_config_profile_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test updating a config profile."""
|
||||
# Create profile first
|
||||
create_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "update-test",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
profile_id = create_response.json()["id"]
|
||||
|
||||
# Update it
|
||||
response = authenticated_client.put(
|
||||
f"/config-profiles/{profile_id}",
|
||||
json={
|
||||
"name": "updated-name",
|
||||
"env_vars": {"NEW_VAR": "new_value"},
|
||||
},
|
||||
)
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["name"] == "updated-name"
|
||||
assert data["env_vars"] == {"NEW_VAR": "new_value"}
|
||||
|
||||
def test_delete_config_profile_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test deleting a config profile."""
|
||||
# Create profile first
|
||||
create_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "delete-test",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
profile_id = create_response.json()["id"]
|
||||
|
||||
# Delete it
|
||||
response = authenticated_client.delete(f"/config-profiles/{profile_id}")
|
||||
assert response.status_code == 204
|
||||
|
||||
# Verify it's gone
|
||||
get_response = authenticated_client.get(f"/config-profiles/{profile_id}")
|
||||
assert get_response.status_code == 404
|
||||
|
||||
def test_update_profile_includes_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test updating profile includes."""
|
||||
# Create base profile
|
||||
base_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "base-profile",
|
||||
"env_vars": {"BASE_VAR": "base_value"},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
base_id = base_response.json()["id"]
|
||||
|
||||
# Create child profile
|
||||
child_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "child-profile",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
child_id = child_response.json()["id"]
|
||||
|
||||
# Update includes
|
||||
response = authenticated_client.put(
|
||||
f"/config-profiles/{child_id}/includes",
|
||||
json={"includes": [base_id]},
|
||||
)
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
print(f"Response data: {data}")
|
||||
print(f"Includes: {data.get('includes', 'NO INCLUDES KEY')}")
|
||||
assert len(data["includes"]) == 1, f"Expected 1 include, got {len(data.get('includes', []))}: {data.get('includes', [])}"
|
||||
assert data["includes"][0]["included_profile_id"] == base_id
|
||||
|
||||
def test_update_profile_includes_cycle_detection(self, authenticated_client: TestClient) -> None:
|
||||
"""Test that include cycles are detected."""
|
||||
# Create profile A
|
||||
a_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "profile-a",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
a_id = a_response.json()["id"]
|
||||
|
||||
# Create profile B
|
||||
b_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "profile-b",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
b_id = b_response.json()["id"]
|
||||
|
||||
# Make B include A
|
||||
authenticated_client.put(
|
||||
f"/config-profiles/{b_id}/includes",
|
||||
json={"includes": [a_id]},
|
||||
)
|
||||
|
||||
# Try to make A include B (would create cycle)
|
||||
response = authenticated_client.put(
|
||||
f"/config-profiles/{a_id}/includes",
|
||||
json={"includes": [b_id]},
|
||||
)
|
||||
assert response.status_code == 400
|
||||
|
||||
def test_preview_config_profile_successfully(self, authenticated_client: TestClient) -> None:
|
||||
"""Test previewing a resolved config profile."""
|
||||
# Create base profile
|
||||
base_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "preview-base",
|
||||
"env_vars": {"BASE_VAR": "base"},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
base_id = base_response.json()["id"]
|
||||
|
||||
# Create child profile
|
||||
child_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "preview-child",
|
||||
"env_vars": {"CHILD_VAR": "child"},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
child_id = child_response.json()["id"]
|
||||
|
||||
# Make child include base
|
||||
authenticated_client.put(
|
||||
f"/config-profiles/{child_id}/includes",
|
||||
json={"includes": [base_id]},
|
||||
)
|
||||
|
||||
# Preview child
|
||||
response = authenticated_client.get(f"/config-profiles/{child_id}/preview")
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["profile_name"] == "preview-child"
|
||||
assert data["env_vars"]["BASE_VAR"] == "base"
|
||||
assert data["env_vars"]["CHILD_VAR"] == "child"
|
||||
assert len(data["included_profiles"]) == 1
|
||||
|
||||
def test_resolve_default_profile(self, authenticated_client: TestClient) -> None:
|
||||
"""Test resolving default profile for project/tool."""
|
||||
# Create a global default profile (no project/tool scoping)
|
||||
authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "default-profile",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
"is_default": True,
|
||||
},
|
||||
)
|
||||
|
||||
# Resolve default with random project/tool (should fall back to global)
|
||||
project_id = str(uuid.uuid4())
|
||||
tool_type_id = str(uuid.uuid4())
|
||||
response = authenticated_client.get(
|
||||
"/config-profiles/defaults/resolve",
|
||||
params={"project_id": project_id, "tool_type_id": tool_type_id},
|
||||
)
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["profile_name"] == "default-profile"
|
||||
|
||||
def test_resolve_default_profile_no_match(self, authenticated_client: TestClient) -> None:
|
||||
"""Test resolving default profile when no profiles exist."""
|
||||
project_id = str(uuid.uuid4())
|
||||
tool_type_id = str(uuid.uuid4())
|
||||
|
||||
response = authenticated_client.get(
|
||||
"/config-profiles/defaults/resolve",
|
||||
params={"project_id": project_id, "tool_type_id": tool_type_id},
|
||||
)
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["profile_id"] is None
|
||||
|
||||
def test_create_config_profile_with_git_mounts(self, authenticated_client: TestClient, test_project_and_repo) -> None:
|
||||
"""Test creating a config profile with git mounts."""
|
||||
_project_id, repo_id = test_project_and_repo
|
||||
|
||||
response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "git-mount-profile",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
"git_mounts": [
|
||||
{
|
||||
"remote_url": "https://github.com/user/repo.git",
|
||||
"source_path": ".",
|
||||
"target_path": "/app",
|
||||
"branch": "main",
|
||||
}
|
||||
],
|
||||
},
|
||||
)
|
||||
assert response.status_code == 201
|
||||
data = response.json()
|
||||
assert data["name"] == "git-mount-profile"
|
||||
assert len(data["git_mounts"]) == 1
|
||||
assert data["git_mounts"][0]["target_path"] == "/app"
|
||||
assert data["git_mounts"][0]["branch"] == "main"
|
||||
|
||||
def test_update_config_profile_git_mounts(self, authenticated_client: TestClient, test_project_and_repo) -> None:
|
||||
"""Test updating git mounts on a config profile."""
|
||||
_project_id, repo_id = test_project_and_repo
|
||||
|
||||
# Create profile first
|
||||
create_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "update-git-mounts",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
},
|
||||
)
|
||||
profile_id = create_response.json()["id"]
|
||||
|
||||
# Update with git mounts
|
||||
response = authenticated_client.put(
|
||||
f"/config-profiles/{profile_id}",
|
||||
json={
|
||||
"git_mounts": [
|
||||
{
|
||||
"remote_url": "https://github.com/user/repo.git",
|
||||
"source_path": "config",
|
||||
"target_path": "/config",
|
||||
}
|
||||
],
|
||||
},
|
||||
)
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert len(data["git_mounts"]) == 1
|
||||
assert data["git_mounts"][0]["source_path"] == "config"
|
||||
|
||||
def test_create_config_profile_invalid_git_mount_source_path(self, authenticated_client: TestClient, test_project_and_repo) -> None:
|
||||
"""Test that invalid git mount source paths are rejected."""
|
||||
_project_id, repo_id = test_project_and_repo
|
||||
|
||||
response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "bad-git-mount",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
"git_mounts": [
|
||||
{
|
||||
"remote_url": "https://github.com/user/repo.git",
|
||||
"source_path": "/absolute/path",
|
||||
"target_path": "/app",
|
||||
}
|
||||
],
|
||||
},
|
||||
)
|
||||
assert response.status_code == 422
|
||||
|
||||
def test_create_config_profile_invalid_git_mount_target_path_traversal(self, authenticated_client: TestClient, test_project_and_repo) -> None:
|
||||
"""Test that git mount target paths with traversal are rejected."""
|
||||
_project_id, repo_id = test_project_and_repo
|
||||
|
||||
response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "bad-git-mount-target",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
"git_mounts": [
|
||||
{
|
||||
"remote_url": "https://github.com/user/repo.git",
|
||||
"source_path": ".",
|
||||
"target_path": "../../../etc/passwd",
|
||||
}
|
||||
],
|
||||
},
|
||||
)
|
||||
assert response.status_code == 422
|
||||
|
||||
def test_preview_config_profile_with_git_mounts(self, authenticated_client: TestClient, test_project_and_repo) -> None:
|
||||
"""Test previewing a profile with git mounts."""
|
||||
_project_id, repo_id = test_project_and_repo
|
||||
|
||||
# Create profile with git mounts
|
||||
create_response = authenticated_client.post(
|
||||
"/config-profiles",
|
||||
json={
|
||||
"name": "preview-git-mounts",
|
||||
"env_vars": {},
|
||||
"files": {},
|
||||
"git_mounts": [
|
||||
{
|
||||
"remote_url": "https://github.com/user/repo.git",
|
||||
"source_path": ".",
|
||||
"target_path": "/app",
|
||||
}
|
||||
],
|
||||
},
|
||||
)
|
||||
profile_id = create_response.json()["id"]
|
||||
|
||||
# Preview
|
||||
response = authenticated_client.get(f"/config-profiles/{profile_id}/preview")
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert len(data["git_mounts"]) == 1
|
||||
assert data["git_mounts"][0]["remote_url"] == "https://github.com/user/repo.git"
|
||||
@@ -1,268 +0,0 @@
|
||||
"""Integration tests for SSE endpoint and lifecycle event flow."""
|
||||
|
||||
import asyncio
|
||||
import uuid
|
||||
from collections.abc import Generator
|
||||
from typing import Any
|
||||
|
||||
import pytest
|
||||
from fastapi.testclient import TestClient
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.api import events as events_module
|
||||
from src.auth.session import decode_session_cookie
|
||||
from src.config import Settings
|
||||
from src.models.git_repository import GitRepository
|
||||
from src.models.instance_event import InstanceEvent
|
||||
from src.models.project import Project
|
||||
from src.models.tool_instance import ToolInstance
|
||||
from src.models.tool_type import ToolType
|
||||
from src.services.event_bus import InstanceEventBus, InstanceEventPayload
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def event_bus() -> Generator[InstanceEventBus, None, None]:
|
||||
bus = InstanceEventBus()
|
||||
bus._reset_for_testing()
|
||||
yield bus
|
||||
bus._reset_for_testing()
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def sample_payload() -> InstanceEventPayload:
|
||||
return {
|
||||
"event": "instance.started",
|
||||
"instance_id": str(uuid.uuid4()),
|
||||
"status": "starting",
|
||||
"message": "Container starting...",
|
||||
"metadata": {},
|
||||
"timestamp": "2026-05-28T12:00:00Z",
|
||||
"correlation_id": str(uuid.uuid4()),
|
||||
}
|
||||
|
||||
|
||||
def _get_user_id_from_client(client: TestClient) -> uuid.UUID | None:
|
||||
settings = Settings()
|
||||
cookie = client.cookies.get("session")
|
||||
if not cookie:
|
||||
return None
|
||||
session = decode_session_cookie(settings=settings, cookie_value=cookie)
|
||||
if session and "user_id" in session:
|
||||
return uuid.UUID(session["user_id"])
|
||||
return None
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
def test_sse_requires_auth(test_client: TestClient) -> None:
|
||||
response = test_client.get("/events/stream")
|
||||
assert response.status_code == 401
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
def test_sse_enforces_connection_limit(authenticated_client: TestClient) -> None:
|
||||
user_id = _get_user_id_from_client(authenticated_client)
|
||||
assert user_id is not None
|
||||
|
||||
events_module._connection_counts[user_id] = events_module.MAX_CONNECTIONS_PER_USER
|
||||
try:
|
||||
response = authenticated_client.get("/events/stream")
|
||||
assert response.status_code == 429
|
||||
finally:
|
||||
events_module._connection_counts.pop(user_id, None)
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
def test_sse_event_generator_format() -> None:
|
||||
"""Test the SSE endpoint is registered."""
|
||||
from src.api.events import router
|
||||
|
||||
route_paths = [getattr(r, "path", "") for r in router.routes]
|
||||
assert any("/stream" in str(p) for p in route_paths)
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_lifecycle_hook_publishes_event_and_persists(
|
||||
authenticated_client: TestClient,
|
||||
db_session: AsyncSession,
|
||||
event_bus: InstanceEventBus,
|
||||
) -> None:
|
||||
"""Test that the lifecycle hook publishes an event and persists an audit row."""
|
||||
user_id = _get_user_id_from_client(authenticated_client)
|
||||
assert user_id is not None
|
||||
|
||||
project = Project(
|
||||
id=uuid.uuid4(),
|
||||
name="test-project",
|
||||
description="Test",
|
||||
owner_id=user_id,
|
||||
)
|
||||
repo = GitRepository(
|
||||
id=uuid.uuid4(),
|
||||
name="test-repo",
|
||||
path="/tmp/test-repo",
|
||||
project_id=project.id,
|
||||
owner_id=user_id,
|
||||
remote_url="https://github.com/test/repo.git",
|
||||
)
|
||||
tool_type = ToolType(
|
||||
id=uuid.uuid4(),
|
||||
name="test-tool",
|
||||
display_name="Test Tool",
|
||||
category="other",
|
||||
interface_type="web",
|
||||
requires_port=True,
|
||||
default_port=8080,
|
||||
definition_type="legacy",
|
||||
compose_template="version: '3.8'\nservices:\n app:\n image: alpine\n command: sleep 3600\n",
|
||||
)
|
||||
db_session.add_all([project, repo, tool_type])
|
||||
await db_session.commit()
|
||||
|
||||
instance = ToolInstance(
|
||||
id=uuid.uuid4(),
|
||||
name="test-instance",
|
||||
display_name="Test Instance",
|
||||
tool_type_id=tool_type.id,
|
||||
repository_id=repo.id,
|
||||
project_id=project.id,
|
||||
owner_id=user_id,
|
||||
status="pending",
|
||||
compose_path="/tmp/test-compose.yml",
|
||||
port=8080,
|
||||
)
|
||||
db_session.add(instance)
|
||||
await db_session.commit()
|
||||
|
||||
received: list[Any] = []
|
||||
|
||||
def subscriber(payload: InstanceEventPayload) -> None:
|
||||
received.append(payload)
|
||||
|
||||
event_bus.subscribe("instance.created", subscriber)
|
||||
|
||||
from src.services.lifecycle_hooks import publish_lifecycle_event
|
||||
|
||||
await publish_lifecycle_event(
|
||||
event_bus=event_bus,
|
||||
session=db_session,
|
||||
instance=instance,
|
||||
event_type="instance.created",
|
||||
created_by=user_id,
|
||||
status="pending",
|
||||
message="Instance created",
|
||||
)
|
||||
|
||||
assert len(received) == 1
|
||||
assert received[0]["event"] == "instance.created"
|
||||
|
||||
result = await db_session.execute(
|
||||
select(InstanceEvent).where(InstanceEvent.instance_id == instance.id)
|
||||
)
|
||||
rows = result.scalars().all()
|
||||
assert len(rows) == 1
|
||||
assert rows[0].event_type == "created"
|
||||
assert rows[0].created_by == user_id
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_lifecycle_event_persists_audit_row(
|
||||
authenticated_client: TestClient,
|
||||
db_session: AsyncSession,
|
||||
event_bus: InstanceEventBus,
|
||||
) -> None:
|
||||
"""Test that publishing a lifecycle event persists an audit row."""
|
||||
user_id = _get_user_id_from_client(authenticated_client)
|
||||
assert user_id is not None
|
||||
|
||||
project = Project(
|
||||
id=uuid.uuid4(),
|
||||
name="test-project",
|
||||
description="Test",
|
||||
owner_id=user_id,
|
||||
)
|
||||
repo = GitRepository(
|
||||
id=uuid.uuid4(),
|
||||
name="test-repo",
|
||||
path="/tmp/test-repo",
|
||||
project_id=project.id,
|
||||
owner_id=user_id,
|
||||
remote_url="https://github.com/test/repo.git",
|
||||
)
|
||||
tool_type = ToolType(
|
||||
id=uuid.uuid4(),
|
||||
name="test-tool-2",
|
||||
display_name="Test Tool 2",
|
||||
category="other",
|
||||
interface_type="web",
|
||||
requires_port=True,
|
||||
default_port=8080,
|
||||
definition_type="legacy",
|
||||
compose_template="version: '3.8'\nservices:\n app:\n image: alpine\n command: sleep 3600\n",
|
||||
)
|
||||
db_session.add_all([project, repo, tool_type])
|
||||
await db_session.commit()
|
||||
|
||||
instance = ToolInstance(
|
||||
id=uuid.uuid4(),
|
||||
name="test-instance",
|
||||
display_name="Test Instance",
|
||||
tool_type_id=tool_type.id,
|
||||
repository_id=repo.id,
|
||||
project_id=project.id,
|
||||
owner_id=user_id,
|
||||
status="running",
|
||||
compose_path="/tmp/test-compose.yml",
|
||||
port=8080,
|
||||
)
|
||||
db_session.add(instance)
|
||||
await db_session.commit()
|
||||
|
||||
from src.services.lifecycle_hooks import publish_lifecycle_event
|
||||
|
||||
await publish_lifecycle_event(
|
||||
event_bus=event_bus,
|
||||
session=db_session,
|
||||
instance=instance,
|
||||
event_type="instance.stopped",
|
||||
created_by=user_id,
|
||||
status="stopped",
|
||||
message="Instance stopped",
|
||||
)
|
||||
|
||||
result = await db_session.execute(
|
||||
select(InstanceEvent).where(InstanceEvent.instance_id == instance.id)
|
||||
)
|
||||
rows = result.scalars().all()
|
||||
assert len(rows) == 1
|
||||
assert rows[0].event_type == "stopped"
|
||||
assert rows[0].status == "stopped"
|
||||
assert rows[0].created_by == user_id
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
def test_event_bus_pubsub(event_bus: InstanceEventBus) -> None:
|
||||
"""Test that the event bus delivers events to subscribers."""
|
||||
received: list[InstanceEventPayload] = []
|
||||
|
||||
def handler(payload: InstanceEventPayload) -> None:
|
||||
received.append(payload)
|
||||
|
||||
event_bus.subscribe("test.event", handler)
|
||||
|
||||
payload: InstanceEventPayload = {
|
||||
"event": "test.event",
|
||||
"instance_id": str(uuid.uuid4()),
|
||||
"status": "running",
|
||||
"message": "Test",
|
||||
"metadata": {},
|
||||
"timestamp": "2026-05-28T12:00:00Z",
|
||||
"correlation_id": str(uuid.uuid4()),
|
||||
}
|
||||
|
||||
asyncio.run(event_bus.publish("test.event", payload))
|
||||
|
||||
assert len(received) == 1
|
||||
assert received[0]["event"] == "test.event"
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user