kitsune-kit 0.4.1 → 0.6.0

data/lib/kitsune/kit/secret_filter.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module Kitsune
+  module Kit
+    class SecretFilter
+      REDACTED = "[REDACTED]"
+      SENSITIVE_KEY = /(token|secret|password|private_key|authorization)/i
+      PRIVATE_KEY_BLOCK = /-----BEGIN [^-\r\n]*PRIVATE KEY-----.*?-----END [^-\r\n]*PRIVATE KEY-----/m
+
+      def initialize(values = [])
+        @values = []
+        values.each { |value| register(value) }
+      end
+
+      def register(value)
+        string = value.to_s
+        @values << string unless string.empty? || @values.include?(string)
+        self
+      end
+
+      def filter(value)
+        case value
+        when Hash
+          value.each_with_object({}) do |(key, item), result|
+            result[key] = key.to_s.match?(SENSITIVE_KEY) ? REDACTED : filter(item)
+          end
+        when Array
+          value.map { |item| filter(item) }
+        when String
+          filter_string(value)
+        else
+          value
+        end
+      end
+
+      private
+
+      def filter_string(value)
+        filtered = @values.sort_by { |secret| -secret.length }.reduce(value.dup) do |text, secret|
+          text.gsub(secret, REDACTED)
+        end
+        redact_private_key(redact_uri_password(filtered))
+      end
+
+      def redact_uri_password(value)
+        value.gsub(%r{([a-z][a-z0-9+.-]*://[^:/@\s]+):[^@\s/]*@}i, "\\1:#{REDACTED}@")
+      end
+
+      def redact_private_key(value) = value.gsub(PRIVATE_KEY_BLOCK, REDACTED)
+    end
+  end
+end

data/lib/kitsune/kit/secret_store.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "errors"
+require_relative "secret_stores/store"
+
+module Kitsune
+  module Kit
+    module SecretStores
+      class Environment < Store
+        def initialize(env: ENV, filter: nil)
+          super()
+          @env = env
+          @filter = filter
+        end
+
+        def fetch(name, required: true)
+          value = @env.fetch(name.to_s, "")
+          if required && value.empty?
+            raise Errors::ConfigurationError.new(
+              "required secret #{name} is not set",
+              hint: "Export #{name} before running this command."
+            )
+          end
+          @filter&.register(value)
+          value
+        end
+
+        def configured?(name) = !@env.fetch(name.to_s, "").empty?
+      end
+    end
+  end
+end

data/lib/kitsune/kit/secret_stores/store.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Kitsune
+  module Kit
+    module SecretStores
+      class Store
+        def fetch(name, required: true) = raise NotImplementedError
+        def configured?(name) = raise NotImplementedError
+      end
+    end
+  end
+end

data/lib/kitsune/kit/service_compose.rb

@@ -0,0 +1,272 @@
+# frozen_string_literal: true
+
+require "json"
+require "digest"
+require "pathname"
+require "yaml"
+require_relative "errors"
+
+module Kitsune
+  module Kit
+    class ServiceCompose
+      Document = Data.define(:filename, :content, :source)
+      MAX_FILE_SIZE = 262_144
+      MODES = %w[generated overlay custom].freeze
+      SENSITIVE_KEY = /(?:password|passwd|secret|token|api[_-]?key)/i
+      ENV_REFERENCE = /\A\$\{[A-Z][A-Z0-9_]*\}\z/
+
+      attr_reader :mode, :security_findings
+
+      def initialize(config:, type:, service:)
+        @config = config
+        @type = type.to_s
+        @service = service
+        @mode = service.compose.mode
+        @security_findings = []
+        validate!
+      end
+
+      def content = documents.first.content
+      def generated_content = YAML.dump(generated_document)
+      def env_content(password) = "#{@service.password_env}=#{JSON.generate(password)}\n"
+      def filenames = documents.map(&:filename)
+
+      def fingerprint
+        Digest::SHA256.hexdigest([mode, *documents.flat_map { |item| [item.filename, item.content] }].join("\0"))
+      end
+
+      def documents
+        @documents ||= case mode
+                       when "generated"
+                         [Document.new(filename: "compose.yml", content: generated_content, source: "generated")]
+                       when "overlay"
+                         [
+                           Document.new(filename: "compose.yml", content: generated_content, source: "generated"),
+                           Document.new(filename: "compose.override.yml", content: user_content,
+                                        source: @service.compose.file)
+                         ]
+                       when "custom"
+                         [Document.new(filename: "compose.yml", content: user_content, source: @service.compose.file)]
+                       else
+                         raise Errors::ConfigurationError, "unsupported Compose mode: #{mode}"
+                       end
+      end
+
+      def display
+        documents.map do |document|
+          "# --- #{document.filename} (#{document.source}) ---\n#{document.content}"
+        end.join("\n")
+      end
+
+      def metadata
+        {
+          mode: mode,
+          files: documents.map { |document| { filename: document.filename, source: document.source } },
+          allow_unsafe: @service.compose.allow_unsafe,
+          security_findings: security_findings
+        }
+      end
+
+      private
+
+      def validate!
+        raise Errors::ConfigurationError, "unsupported Compose mode: #{mode}" unless MODES.include?(mode)
+        return if mode == "generated"
+
+        document = user_document
+        if mode == "custom"
+          services = document["services"]
+          unless services.is_a?(Hash) && services[@type].is_a?(Hash)
+            raise Errors::ConfigurationError.new(
+              "custom Compose file must define services.#{@type}",
+              hint: "Run `kit service #{@type} compose eject` to create a valid starting point."
+            )
+          end
+        end
+        detect_inline_secrets(document)
+        inspect_unsafe_options(document)
+        return if security_findings.empty? || @service.compose.allow_unsafe
+
+        raise Errors::UnsafeOperationError.new(
+          "Compose customization contains unsafe options",
+          hint: "Remove the options or set services.#{@type}.compose.allow_unsafe to true after review.",
+          context: { service: @type, findings: security_findings }
+        )
+      end
+
+      def user_content
+        @user_content ||= Pathname(@service.compose.file).binread
+      rescue SystemCallError => e
+        raise Errors::ConfigurationError, "unable to read Compose customization: #{e.class}"
+      end
+
+      def user_document
+        @user_document ||= begin
+          if user_content.bytesize > MAX_FILE_SIZE
+            raise Errors::ConfigurationError, "Compose customization exceeds 256 KiB"
+          end
+
+          parsed = YAML.safe_load(user_content, permitted_classes: [], permitted_symbols: [], aliases: false)
+          unless parsed.is_a?(Hash)
+            raise Errors::ConfigurationError, "Compose customization must contain a YAML mapping"
+          end
+
+          stringify_keys(parsed)
+        rescue Psych::Exception => e
+          raise Errors::ConfigurationError, "invalid Compose customization YAML: #{e.message}"
+        end
+      end
+
+      def detect_inline_secrets(value, path = [])
+        case value
+        when Hash
+          value.each do |key, child|
+            if key.match?(SENSITIVE_KEY) && child.is_a?(String) && !child.match?(ENV_REFERENCE)
+              raise Errors::ConfigurationError.new(
+                "Compose customization contains an inline secret at #{(path + [key]).join('.')}",
+                hint: "Reference an environment variable such as ${#{@service.password_env}} instead."
+              )
+            end
+            detect_inline_secrets(child, path + [key])
+          end
+        when Array
+          value.each_with_index { |child, index| detect_inline_secrets(child, path + [index.to_s]) }
+        when String
+          detect_inline_environment_secret(value, path)
+        end
+      end
+
+      def detect_inline_environment_secret(value, path)
+        key, content = value.split("=", 2)
+        return unless content && key.match?(SENSITIVE_KEY) && !content.match?(ENV_REFERENCE)
+
+        raise Errors::ConfigurationError.new(
+          "Compose customization contains an inline secret at #{path.join('.')}",
+          hint: "Use mapping syntax and reference ${#{@service.password_env}} instead."
+        )
+      end
+
+      def inspect_unsafe_options(document)
+        services = document["services"]
+        return unless services.is_a?(Hash)
+
+        services.each do |name, definition|
+          next unless definition.is_a?(Hash)
+
+          inspect_service(name, definition)
+        end
+      end
+
+      def inspect_service(name, definition)
+        prefix = "services.#{name}"
+        finding("#{prefix}.privileged", "privileged containers") if definition["privileged"] == true
+        inspect_namespaces(prefix, definition)
+        inspect_capabilities(prefix, definition)
+        inspect_ports(prefix, name, definition)
+        finding("#{prefix}.devices", "host device access") if definition.key?("devices")
+        finding("#{prefix}.build", "remote image builds") if definition.key?("build")
+        finding("#{prefix}.env_file", "unmanaged environment files") if definition.key?("env_file")
+        Array(definition["volumes"]).each do |volume|
+          finding("#{prefix}.volumes", "host or Docker socket mount") if unsafe_volume?(volume)
+        end
+      end
+
+      def inspect_namespaces(prefix, definition)
+        %w[network_mode pid ipc].each do |key|
+          finding("#{prefix}.#{key}", "host namespace access") if definition[key].to_s == "host"
+        end
+      end
+
+      def inspect_capabilities(prefix, definition)
+        capabilities = Array(definition["cap_add"]).map { |item| item.to_s.upcase }
+        return unless capabilities.intersect?(%w[ALL SYS_ADMIN SYS_PTRACE NET_ADMIN])
+
+        finding("#{prefix}.cap_add", "elevated Linux capabilities")
+      end
+
+      def inspect_ports(prefix, name, definition)
+        return unless definition.key?("ports")
+        return if name == @type && Array(definition["ports"]) == managed_ports
+
+        finding("#{prefix}.ports", "ports outside the managed firewall model")
+      end
+
+      def managed_ports
+        return [] unless @service.publish
+
+        ["#{@service.bind}:#{@service.port}:#{container_port}"]
+      end
+
+      def unsafe_volume?(volume)
+        source = case volume
+                 when String then volume.split(":", 2).first
+                 when Hash then volume["source"] || volume["src"]
+                 end
+        source.to_s.start_with?("/") || source.to_s.include?("docker.sock")
+      end
+
+      def finding(path, message)
+        security_findings << { path: path, message: message }
+      end
+
+      def generated_document
+        {
+          "name" => project_name,
+          "services" => { @type => generated_service_definition },
+          "volumes" => { "data" => nil },
+          "networks" => { "private" => { "external" => true, "name" => "kitsune-private" } }
+        }
+      end
+
+      def generated_service_definition
+        definition = @type == "postgres" ? postgres : redis
+        definition["ports"] = ["#{@service.bind}:#{@service.port}:#{container_port}"] if @service.publish
+        definition
+      end
+
+      def postgres
+        {
+          "image" => @service.image,
+          "restart" => "unless-stopped",
+          "environment" => {
+            "POSTGRES_DB" => database,
+            "POSTGRES_USER" => "postgres",
+            "POSTGRES_PASSWORD" => interpolation
+          },
+          "volumes" => ["data:/var/lib/postgresql/data"],
+          "networks" => ["private"],
+          "healthcheck" => healthcheck("pg_isready -U postgres -d #{database}")
+        }
+      end
+
+      def redis
+        {
+          "image" => @service.image,
+          "restart" => "unless-stopped",
+          "environment" => { "REDIS_PASSWORD" => interpolation },
+          "command" => ["sh", "-ec", 'exec redis-server --appendonly yes --requirepass "$$REDIS_PASSWORD"'],
+          "volumes" => ["data:/data"],
+          "networks" => ["private"],
+          "healthcheck" => healthcheck('REDISCLI_AUTH="$${REDIS_PASSWORD}" redis-cli ping | grep -Fxq PONG')
+        }
+      end
+
+      def healthcheck(command)
+        { "test" => ["CMD-SHELL", command], "interval" => "10s", "timeout" => "5s", "retries" => 12 }
+      end
+
+      def stringify_keys(value)
+        case value
+        when Hash then value.to_h { |key, item| [key.to_s, stringify_keys(item)] }
+        when Array then value.map { |item| stringify_keys(item) }
+        else value
+        end
+      end
+
+      def project_name = "kitsune-#{@config.environment}-#{@type}"
+      def database = "app_#{@config.environment.tr('-', '_')}"
+      def container_port = @type == "postgres" ? 5432 : 6379
+      def interpolation = "${#{@service.password_env}}"
+    end
+  end
+end

data/lib/kitsune/kit/state_store.rb

@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "pathname"
+require "tempfile"
+require "time"
+require_relative "errors"
+require_relative "state_stores/store"
+
+module Kitsune
+  module Kit
+    class StateStore < StateStores::Store
+      SCHEMA_VERSION = 1
+
+      def initialize(root: Dir.pwd)
+        super()
+        @directory = Pathname(root).expand_path.join(".kitsune/state")
+      end
+
+      def read(environment)
+        path = state_path(environment)
+        return empty_state(environment) unless path.file?
+
+        with_lock(environment, shared: true) do
+          parsed = JSON.parse(path.read)
+          validate!(parsed, environment)
+          parsed
+        end
+      rescue JSON::ParserError => e
+        raise Errors::ConfigurationError.new(
+          "state file is invalid JSON: #{path}",
+          hint: "Restore the state backup or import the environment again.",
+          context: { cause: e.message }
+        )
+      end
+
+      def update(environment)
+        with_lock(environment) do
+          current = read_without_lock(environment)
+          updated = yield(deep_copy(current))
+          updated["updated_at"] = Time.now.utc.iso8601(6)
+          validate!(updated, environment)
+          write_atomically(state_path(environment), JSON.pretty_generate(updated) << "\n")
+          deep_copy(updated)
+        end
+      end
+
+      def write(environment, state)
+        update(environment) { state }
+      end
+
+      def delete(environment)
+        with_lock(environment) do
+          next unless state_path(environment).file?
+
+          state_path(environment).delete
+          true
+        end
+      end
+
+      def with_execution_lock(environment)
+        FileUtils.mkdir_p(@directory, mode: 0o700)
+        path = @directory.join("#{safe_environment(environment)}.operation.lock")
+        File.open(path, File::RDWR | File::CREAT, 0o600) do |file|
+          locked = file.flock(File::LOCK_EX | File::LOCK_NB)
+          unless locked
+            raise Errors::UnsafeOperationError.new(
+              "another mutating operation is active for #{environment}",
+              hint: "Wait for it to finish or stop it safely before retrying."
+            )
+          end
+          yield
+        ensure
+          file.flock(File::LOCK_UN) if locked
+        end
+      end
+
+      private
+
+      def empty_state(environment)
+        {
+          "version" => SCHEMA_VERSION,
+          "environment" => environment.to_s,
+          "updated_at" => nil,
+          "resources" => {},
+          "operations" => [],
+          "runs" => {}
+        }
+      end
+
+      def state_path(environment) = @directory.join("#{safe_environment(environment)}.json")
+      def lock_path(environment) = @directory.join("#{safe_environment(environment)}.lock")
+
+      def safe_environment(environment)
+        value = environment.to_s
+        return value if value.match?(/\A[a-zA-Z0-9_-]+\z/)
+
+        raise Errors::ConfigurationError, "environment name has an invalid format"
+      end
+
+      def with_lock(environment, shared: false)
+        FileUtils.mkdir_p(@directory, mode: 0o700)
+        File.open(lock_path(environment), File::RDWR | File::CREAT, 0o600) do |file|
+          file.flock(shared ? File::LOCK_SH : File::LOCK_EX)
+          yield
+        ensure
+          file.flock(File::LOCK_UN)
+        end
+      end
+
+      def read_without_lock(environment)
+        path = state_path(environment)
+        return empty_state(environment) unless path.file?
+
+        parsed = JSON.parse(path.read)
+        validate!(parsed, environment)
+        parsed
+      rescue JSON::ParserError => e
+        raise Errors::ConfigurationError.new("state file is invalid JSON: #{path}", context: { cause: e.message })
+      end
+
+      def validate!(state, environment)
+        raise Errors::ConfigurationError, "state must be an object" unless state.is_a?(Hash)
+        unless state["version"] == SCHEMA_VERSION
+          raise Errors::ConfigurationError.new(
+            "unsupported state schema version #{state['version'].inspect}; expected #{SCHEMA_VERSION}",
+            hint: "Use a compatible Kitsune Kit version; do not edit IDs manually. Preserve this file and its backup."
+          )
+        end
+        raise Errors::ConfigurationError, "state environment mismatch" unless state["environment"] == environment.to_s
+        raise Errors::ConfigurationError, "state resources must be an object" unless state["resources"].is_a?(Hash)
+        raise Errors::ConfigurationError, "state operations must be an array" unless state["operations"].is_a?(Array)
+        raise Errors::ConfigurationError, "state runs must be an object" unless state["runs"].is_a?(Hash)
+
+        state
+      end
+
+      def write_atomically(path, content)
+        FileUtils.mkdir_p(path.dirname, mode: 0o700)
+        backup = Pathname("#{path}.backup")
+        if path.file?
+          FileUtils.cp(path, backup)
+          File.chmod(0o600, backup)
+        end
+        Tempfile.create([path.basename.to_s, ".tmp"], path.dirname.to_s, mode: 0o600) do |temp|
+          temp.write(content)
+          temp.flush
+          temp.fsync
+          File.rename(temp.path, path)
+          File.chmod(0o600, path)
+        end
+      end
+
+      def deep_copy(value) = Marshal.load(Marshal.dump(value))
+    end
+  end
+end

data/lib/kitsune/kit/state_stores/store.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Kitsune
+  module Kit
+    module StateStores
+      class Store
+        def read(environment) = raise NotImplementedError
+        def update(environment) = raise NotImplementedError
+        def write(environment, state) = raise NotImplementedError
+        def delete(environment) = raise NotImplementedError
+        def with_execution_lock(environment) = raise NotImplementedError
+      end
+    end
+  end
+end

data/lib/kitsune/kit/tui/actions.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module Kitsune
+  module Kit
+    module Tui
+      class Actions
+        def initialize(application:, cancellation: Cancellation.new)
+          @application = application
+          @cancellation = cancellation
+          @last_plan = nil
+        end
+
+        def status
+          Workflows::InspectEnvironment.new(
+            config: app.config, provider: app.provider, state_store: app.state_store, event_bus: app.event_bus
+          ).call
+        end
+
+        def plan
+          workflow = Workflows::BuildPlan.new(config: app.config, operations: app.operations,
+                                              event_bus: app.event_bus)
+          workflow.call.tap do |result|
+            @last_plan = result.value
+          end
+        end
+
+        def doctor
+          Workflows::Doctor.new(
+            config: app.config,
+            provider: app.provider,
+            state_store: app.state_store,
+            transport_factory: app.transport_factory,
+            operations: app.operations,
+            event_bus: app.event_bus
+          ).call
+        end
+
+        def apply
+          @last_plan ||= plan.value
+          raise Errors::UnsafeOperationError, "the plan contains destructive changes" if @last_plan.destructive?
+          return Result.success([], metadata: { unchanged: true }) unless @last_plan.changed?
+
+          Workflows::ApplyPlan.new(
+            config: app.config, operations: app.operations, state_store: app.state_store, event_bus: app.event_bus,
+            cancellation: @cancellation
+          ).call(plan: @last_plan)
+        ensure
+          @last_plan = nil
+          reset_cancellation
+        end
+
+        def resume
+          Workflows::ApplyPlan.new(
+            config: app.config, operations: app.operations, state_store: app.state_store, event_bus: app.event_bus,
+            cancellation: @cancellation
+          ).call(resume_from: true)
+        ensure
+          reset_cancellation
+        end
+
+        def cancel = @cancellation.cancel!
+
+        private
+
+        attr_reader :application
+        alias app application
+
+        def reset_cancellation = @cancellation = Cancellation.new
+      end
+    end
+  end
+end

data/lib/kitsune/kit/tui/application.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Kitsune
+  module Kit
+    module Tui
+      class Application
+        def initialize(store:, controller:, renderer: Renderer.new, terminal: Terminal.new)
+          @store = store
+          @controller = controller
+          @renderer = renderer
+          @terminal = terminal
+        end
+
+        def call
+          terminal.run do
+            controller.start
+            until controller.exit_requested
+              width, height = terminal.size
+              store.resize(width, height)
+              terminal.draw(renderer.render(store.snapshot))
+              controller.handle(terminal.read_key)
+            end
+          end
+          0
+        ensure
+          controller.wait
+        end
+
+        private
+
+        attr_reader :store, :controller, :renderer, :terminal
+      end
+    end
+  end
+end