@mriekki/lean 0.1.0 → 0.2.0

package/assets/generated/deployment/src/lean_poc_deployment/teardown.py

@@ -1,286 +1,286 @@
-"""Scoped destructive tear-down for Kit-managed POC environments and local Docker state."""
-
-from __future__ import annotations
-
-import json
-import re
-import shlex
-import shutil
-import subprocess
-from typing import Any, Iterable
-
-from .errors import DeploymentKitError
-from .profiles import load_profile
-from .route_registry import apply_route_change, plan_route_removal, route_inventory
-from .ssh import ssh_args, verify_access
-from .teardown_remote import REMOTE_SCRIPT
-
-TEAR_DOWN_WRITE_PHRASE = "[POC TEAR DOWN]"
-PRODUCTION_DATA_DELETE_PHRASE = "[PRODUCTION DATA DELETE]"
-SUPPORTED_SCOPES = ("local", "staging", "production", "all")
-
-_SLUG_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
-_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-_TARGET_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$")
-_PACKAGE_RE = re.compile(r"^ghcr\.io/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-
-
-def _slug(value: str, field: str) -> str:
-    if not isinstance(value, str) or _SLUG_RE.fullmatch(value) is None:
-        raise DeploymentKitError(f"{field} must use lowercase letters, digits, and internal hyphens.")
-    return value
-
-
-def _owner_repo(value: str) -> str:
-    if not isinstance(value, str) or _REPO_RE.fullmatch(value) is None:
-        raise DeploymentKitError("ownerRepo must use GitHub owner/repository form without URL syntax.")
-    return value
-
-
-def _package(value: str) -> str:
-    if not isinstance(value, str) or _PACKAGE_RE.fullmatch(value) is None:
-        raise DeploymentKitError("localPackage must use exact ghcr.io/owner/package form.")
-    return value
-
-
-def parse_environment_targets(items: Iterable[str]) -> dict[str, str]:
-    result: dict[str, str] = {}
-    for item in items:
-        if not isinstance(item, str) or "=" not in item:
-            raise DeploymentKitError("environment target bindings must use environment=target form.")
-        environment, target = item.split("=", 1)
-        environment = _slug(environment, "environment")
-        if environment not in {"staging", "production"}:
-            raise DeploymentKitError("tear-down supports only staging and production environment bindings.")
-        if not target or _TARGET_RE.fullmatch(target) is None:
-            raise DeploymentKitError("target profile names contain unsupported characters.")
-        if environment in result:
-            raise DeploymentKitError(f"Duplicate environment target binding: {environment}")
-        result[environment] = target
-    return dict(sorted(result.items()))
-
-
-def _remote_environments(scope: str) -> tuple[str, ...]:
-    if scope == "staging":
-        return ("staging",)
-    if scope == "production":
-        return ("production",)
-    if scope == "all":
-        return ("staging", "production")
-    return ()
-
-
-def normalize_teardown_spec(
-    *,
-    owner_repo: str,
-    app_slug: str,
-    scope: str,
-    environment_targets: dict[str, str] | Iterable[tuple[str, str]],
-    local_package: str | None,
-) -> dict[str, Any]:
-    if scope not in SUPPORTED_SCOPES:
-        raise DeploymentKitError("scope must be one of: local, staging, production, all.")
-
-    pairs = environment_targets.items() if isinstance(environment_targets, dict) else environment_targets
-    normalized_targets: dict[str, str] = {}
-    for environment, target in pairs:
-        environment = _slug(environment, "environment")
-        if environment not in {"staging", "production"}:
-            raise DeploymentKitError("tear-down supports only staging and production environment bindings.")
-        if not isinstance(target, str) or _TARGET_RE.fullmatch(target) is None:
-            raise DeploymentKitError("target profile names contain unsupported characters.")
-        if environment in normalized_targets:
-            raise DeploymentKitError(f"Duplicate environment target binding: {environment}")
-        normalized_targets[environment] = target
-
-    selected_targets: dict[str, str] = {}
-    for environment in _remote_environments(scope):
-        if environment not in normalized_targets:
-            raise DeploymentKitError(f"scope {scope!r} requires an explicit {environment}=target binding.")
-        selected_targets[environment] = normalized_targets[environment]
-
-    package = _package(local_package) if local_package is not None else None
-    if scope in {"local", "all"} and package is None:
-        raise DeploymentKitError(f"scope {scope!r} requires --local-package for exact local Docker ownership.")
-
-    return {
-        "schemaVersion": 1,
-        "ownerRepo": _owner_repo(owner_repo),
-        "appSlug": _slug(app_slug, "appSlug"),
-        "scope": scope,
-        "environmentTargets": selected_targets,
-        "localPackage": package,
-    }
-
-
-def _find_route(inventory: dict[str, Any], app_slug: str, environment: str) -> dict[str, Any] | None:
-    route_id = f"{app_slug}--{environment}"
-    return next((item for item in inventory["managedRoutes"] if item["routeId"] == route_id), None)
-
-
-def _tear_down_route(target: str, owner_repo: str, app_slug: str, environment: str) -> dict[str, Any]:
-    inventory = route_inventory(target)
-    route = _find_route(inventory, app_slug, environment)
-    if route is None:
-        return {"state": "absent", "mutated": False}
-    if route["ownerRepo"] != owner_repo:
-        raise DeploymentKitError(
-            f"Route {app_slug}--{environment} is owned by {route['ownerRepo']}, not {owner_repo}."
-        )
-    plan = plan_route_removal(
-        target,
-        owner_repo=owner_repo,
-        environment=environment,
-        app_slug=app_slug,
-    )
-    apply_route_change(plan)
-    return {"state": "removed", "mutated": True, "hostnames": route["hostnames"]}
-
-
-def _tear_down_remote_environment(
-    target: str,
-    owner_repo: str,
-    app_slug: str,
-    environment: str,
-) -> dict[str, Any]:
-    profile = load_profile(target)
-    evidence = verify_access(profile)
-    command = ssh_args(
-        profile,
-        evidence["address"],
-        command="sudo -n bash -s -- "
-        + " ".join(shlex.quote(value) for value in (owner_repo, app_slug, environment)),
-    )
-    completed = subprocess.run(
-        command,
-        input=REMOTE_SCRIPT.encode("utf-8"),
-        capture_output=True,
-        check=False,
-    )
-    stdout = completed.stdout.decode("utf-8", errors="replace").strip()
-    stderr = completed.stderr.decode("utf-8", errors="replace").strip()
-    if completed.returncode != 0:
-        raise DeploymentKitError(
-            "Remote POC tear-down failed: " + (stderr or stdout or f"exit {completed.returncode}")
-        )
-    parts = stdout.split("\t")
-    if len(parts) not in {4, 5} or parts[0] != "TEAR_DOWN" or parts[1] not in {"absent", "removed"}:
-        raise DeploymentKitError("Remote POC tear-down returned malformed evidence.")
-    if parts[2] != app_slug or parts[3] != environment:
-        raise DeploymentKitError("Remote POC tear-down returned mismatched app/environment evidence.")
-    result: dict[str, Any] = {"state": parts[1], "mutated": parts[1] == "removed"}
-    if len(parts) == 5:
-        result["containerName"] = parts[4]
-    return result
-
-
-def _run_local(args: list[str]) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        args,
-        text=True,
-        encoding="utf-8",
-        errors="replace",
-        capture_output=True,
-        check=False,
-    )
-
-
-def _image_matches_package(image: str, package: str) -> bool:
-    return image == package or image.startswith(package + ":") or image.startswith(package + "@")
-
-
-def tear_down_workstation_package(package: str) -> dict[str, Any]:
-    package = _package(package)
-    docker = shutil.which("docker")
-    if not docker:
-        return {"state": "docker-unavailable", "mutated": False, "containers": [], "images": []}
-
-    listed = _run_local([docker, "ps", "-a", "--format", "{{.ID}}"])
-    if listed.returncode != 0:
-        raise DeploymentKitError("Local Docker container inventory failed: " + (listed.stderr or listed.stdout).strip())
-
-    containers: list[str] = []
-    for container_id in [line.strip() for line in listed.stdout.splitlines() if line.strip()]:
-        inspected = _run_local([docker, "inspect", "--format", "{{.Config.Image}}", container_id])
-        if inspected.returncode != 0:
-            raise DeploymentKitError(f"Local Docker inspect failed for container {container_id}.")
-        image = inspected.stdout.strip()
-        if _image_matches_package(image, package):
-            containers.append(container_id)
-
-    if containers:
-        removed = _run_local([docker, "rm", "-f", "-v", *containers])
-        if removed.returncode != 0:
-            raise DeploymentKitError("Local POC container removal failed: " + (removed.stderr or removed.stdout).strip())
-
-    images_result = _run_local([docker, "images", "--format", "{{.Repository}}:{{.Tag}}"])
-    if images_result.returncode != 0:
-        raise DeploymentKitError("Local Docker image inventory failed: " + (images_result.stderr or images_result.stdout).strip())
-    image_refs = sorted(
-        {
-            line.strip()
-            for line in images_result.stdout.splitlines()
-            if line.strip().startswith(package + ":") and not line.strip().endswith(":<none>")
-        }
-    )
-    if image_refs:
-        removed = _run_local([docker, "image", "rm", "-f", *image_refs])
-        if removed.returncode != 0:
-            raise DeploymentKitError("Local POC image removal failed: " + (removed.stderr or removed.stdout).strip())
-
-    return {
-        "state": "removed" if containers or image_refs else "absent",
-        "mutated": bool(containers or image_refs),
-        "containers": containers,
-        "images": image_refs,
-    }
-
-
-def tear_down_poc(spec: dict[str, Any]) -> dict[str, Any]:
-    normalized = normalize_teardown_spec(
-        owner_repo=spec.get("ownerRepo"),
-        app_slug=spec.get("appSlug"),
-        scope=spec.get("scope"),
-        environment_targets=(spec.get("environmentTargets") or {}).items(),
-        local_package=spec.get("localPackage"),
-    )
-
-    environments: list[dict[str, Any]] = []
-    mutated = False
-    for environment, target in normalized["environmentTargets"].items():
-        route = _tear_down_route(target, normalized["ownerRepo"], normalized["appSlug"], environment)
-        runtime = _tear_down_remote_environment(
-            target,
-            normalized["ownerRepo"],
-            normalized["appSlug"],
-            environment,
-        )
-        mutated = mutated or route["mutated"] or runtime["mutated"]
-        environments.append(
-            {
-                "environment": environment,
-                "targetName": target,
-                "route": route,
-                "runtimeAndPersistentData": runtime,
-            }
-        )
-
-    workstation: dict[str, Any] = {"state": "not-selected", "mutated": False}
-    if normalized["scope"] in {"local", "all"}:
-        workstation = tear_down_workstation_package(normalized["localPackage"])
-        mutated = mutated or workstation["mutated"]
-
-    return {
-        "schemaVersion": 1,
-        "ownerRepo": normalized["ownerRepo"],
-        "appSlug": normalized["appSlug"],
-        "scope": normalized["scope"],
-        "environments": environments,
-        "workstation": workstation,
-        "productionDataIncluded": normalized["scope"] in {"production", "all"},
-        "mutated": mutated,
-    }
-
-
-def render_teardown_summary(result: dict[str, Any]) -> str:
-    return json.dumps(result, indent=2, sort_keys=True)
+"""Scoped destructive tear-down for Kit-managed POC environments and local Docker state."""
+
+from __future__ import annotations
+
+import json
+import re
+import shlex
+import shutil
+import subprocess
+from typing import Any, Iterable
+
+from .errors import DeploymentKitError
+from .profiles import load_profile
+from .route_registry import apply_route_change, plan_route_removal, route_inventory
+from .ssh import ssh_args, verify_access
+from .teardown_remote import REMOTE_SCRIPT
+
+TEAR_DOWN_WRITE_PHRASE = "[POC TEAR DOWN]"
+PRODUCTION_DATA_DELETE_PHRASE = "[PRODUCTION DATA DELETE]"
+SUPPORTED_SCOPES = ("local", "staging", "production", "all")
+
+_SLUG_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
+_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
+_TARGET_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$")
+_PACKAGE_RE = re.compile(r"^ghcr\.io/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
+
+
+def _slug(value: str, field: str) -> str:
+    if not isinstance(value, str) or _SLUG_RE.fullmatch(value) is None:
+        raise DeploymentKitError(f"{field} must use lowercase letters, digits, and internal hyphens.")
+    return value
+
+
+def _owner_repo(value: str) -> str:
+    if not isinstance(value, str) or _REPO_RE.fullmatch(value) is None:
+        raise DeploymentKitError("ownerRepo must use GitHub owner/repository form without URL syntax.")
+    return value
+
+
+def _package(value: str) -> str:
+    if not isinstance(value, str) or _PACKAGE_RE.fullmatch(value) is None:
+        raise DeploymentKitError("localPackage must use exact ghcr.io/owner/package form.")
+    return value
+
+
+def parse_environment_targets(items: Iterable[str]) -> dict[str, str]:
+    result: dict[str, str] = {}
+    for item in items:
+        if not isinstance(item, str) or "=" not in item:
+            raise DeploymentKitError("environment target bindings must use environment=target form.")
+        environment, target = item.split("=", 1)
+        environment = _slug(environment, "environment")
+        if environment not in {"staging", "production"}:
+            raise DeploymentKitError("tear-down supports only staging and production environment bindings.")
+        if not target or _TARGET_RE.fullmatch(target) is None:
+            raise DeploymentKitError("target profile names contain unsupported characters.")
+        if environment in result:
+            raise DeploymentKitError(f"Duplicate environment target binding: {environment}")
+        result[environment] = target
+    return dict(sorted(result.items()))
+
+
+def _remote_environments(scope: str) -> tuple[str, ...]:
+    if scope == "staging":
+        return ("staging",)
+    if scope == "production":
+        return ("production",)
+    if scope == "all":
+        return ("staging", "production")
+    return ()
+
+
+def normalize_teardown_spec(
+    *,
+    owner_repo: str,
+    app_slug: str,
+    scope: str,
+    environment_targets: dict[str, str] | Iterable[tuple[str, str]],
+    local_package: str | None,
+) -> dict[str, Any]:
+    if scope not in SUPPORTED_SCOPES:
+        raise DeploymentKitError("scope must be one of: local, staging, production, all.")
+
+    pairs = environment_targets.items() if isinstance(environment_targets, dict) else environment_targets
+    normalized_targets: dict[str, str] = {}
+    for environment, target in pairs:
+        environment = _slug(environment, "environment")
+        if environment not in {"staging", "production"}:
+            raise DeploymentKitError("tear-down supports only staging and production environment bindings.")
+        if not isinstance(target, str) or _TARGET_RE.fullmatch(target) is None:
+            raise DeploymentKitError("target profile names contain unsupported characters.")
+        if environment in normalized_targets:
+            raise DeploymentKitError(f"Duplicate environment target binding: {environment}")
+        normalized_targets[environment] = target
+
+    selected_targets: dict[str, str] = {}
+    for environment in _remote_environments(scope):
+        if environment not in normalized_targets:
+            raise DeploymentKitError(f"scope {scope!r} requires an explicit {environment}=target binding.")
+        selected_targets[environment] = normalized_targets[environment]
+
+    package = _package(local_package) if local_package is not None else None
+    if scope in {"local", "all"} and package is None:
+        raise DeploymentKitError(f"scope {scope!r} requires --local-package for exact local Docker ownership.")
+
+    return {
+        "schemaVersion": 1,
+        "ownerRepo": _owner_repo(owner_repo),
+        "appSlug": _slug(app_slug, "appSlug"),
+        "scope": scope,
+        "environmentTargets": selected_targets,
+        "localPackage": package,
+    }
+
+
+def _find_route(inventory: dict[str, Any], app_slug: str, environment: str) -> dict[str, Any] | None:
+    route_id = f"{app_slug}--{environment}"
+    return next((item for item in inventory["managedRoutes"] if item["routeId"] == route_id), None)
+
+
+def _tear_down_route(target: str, owner_repo: str, app_slug: str, environment: str) -> dict[str, Any]:
+    inventory = route_inventory(target)
+    route = _find_route(inventory, app_slug, environment)
+    if route is None:
+        return {"state": "absent", "mutated": False}
+    if route["ownerRepo"] != owner_repo:
+        raise DeploymentKitError(
+            f"Route {app_slug}--{environment} is owned by {route['ownerRepo']}, not {owner_repo}."
+        )
+    plan = plan_route_removal(
+        target,
+        owner_repo=owner_repo,
+        environment=environment,
+        app_slug=app_slug,
+    )
+    apply_route_change(plan)
+    return {"state": "removed", "mutated": True, "hostnames": route["hostnames"]}
+
+
+def _tear_down_remote_environment(
+    target: str,
+    owner_repo: str,
+    app_slug: str,
+    environment: str,
+) -> dict[str, Any]:
+    profile = load_profile(target)
+    evidence = verify_access(profile)
+    command = ssh_args(
+        profile,
+        evidence["address"],
+        command="sudo -n bash -s -- "
+        + " ".join(shlex.quote(value) for value in (owner_repo, app_slug, environment)),
+    )
+    completed = subprocess.run(
+        command,
+        input=REMOTE_SCRIPT.encode("utf-8"),
+        capture_output=True,
+        check=False,
+    )
+    stdout = completed.stdout.decode("utf-8", errors="replace").strip()
+    stderr = completed.stderr.decode("utf-8", errors="replace").strip()
+    if completed.returncode != 0:
+        raise DeploymentKitError(
+            "Remote POC tear-down failed: " + (stderr or stdout or f"exit {completed.returncode}")
+        )
+    parts = stdout.split("\t")
+    if len(parts) not in {4, 5} or parts[0] != "TEAR_DOWN" or parts[1] not in {"absent", "removed"}:
+        raise DeploymentKitError("Remote POC tear-down returned malformed evidence.")
+    if parts[2] != app_slug or parts[3] != environment:
+        raise DeploymentKitError("Remote POC tear-down returned mismatched app/environment evidence.")
+    result: dict[str, Any] = {"state": parts[1], "mutated": parts[1] == "removed"}
+    if len(parts) == 5:
+        result["containerName"] = parts[4]
+    return result
+
+
+def _run_local(args: list[str]) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        args,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+        capture_output=True,
+        check=False,
+    )
+
+
+def _image_matches_package(image: str, package: str) -> bool:
+    return image == package or image.startswith(package + ":") or image.startswith(package + "@")
+
+
+def tear_down_workstation_package(package: str) -> dict[str, Any]:
+    package = _package(package)
+    docker = shutil.which("docker")
+    if not docker:
+        return {"state": "docker-unavailable", "mutated": False, "containers": [], "images": []}
+
+    listed = _run_local([docker, "ps", "-a", "--format", "{{.ID}}"])
+    if listed.returncode != 0:
+        raise DeploymentKitError("Local Docker container inventory failed: " + (listed.stderr or listed.stdout).strip())
+
+    containers: list[str] = []
+    for container_id in [line.strip() for line in listed.stdout.splitlines() if line.strip()]:
+        inspected = _run_local([docker, "inspect", "--format", "{{.Config.Image}}", container_id])
+        if inspected.returncode != 0:
+            raise DeploymentKitError(f"Local Docker inspect failed for container {container_id}.")
+        image = inspected.stdout.strip()
+        if _image_matches_package(image, package):
+            containers.append(container_id)
+
+    if containers:
+        removed = _run_local([docker, "rm", "-f", "-v", *containers])
+        if removed.returncode != 0:
+            raise DeploymentKitError("Local POC container removal failed: " + (removed.stderr or removed.stdout).strip())
+
+    images_result = _run_local([docker, "images", "--format", "{{.Repository}}:{{.Tag}}"])
+    if images_result.returncode != 0:
+        raise DeploymentKitError("Local Docker image inventory failed: " + (images_result.stderr or images_result.stdout).strip())
+    image_refs = sorted(
+        {
+            line.strip()
+            for line in images_result.stdout.splitlines()
+            if line.strip().startswith(package + ":") and not line.strip().endswith(":<none>")
+        }
+    )
+    if image_refs:
+        removed = _run_local([docker, "image", "rm", "-f", *image_refs])
+        if removed.returncode != 0:
+            raise DeploymentKitError("Local POC image removal failed: " + (removed.stderr or removed.stdout).strip())
+
+    return {
+        "state": "removed" if containers or image_refs else "absent",
+        "mutated": bool(containers or image_refs),
+        "containers": containers,
+        "images": image_refs,
+    }
+
+
+def tear_down_poc(spec: dict[str, Any]) -> dict[str, Any]:
+    normalized = normalize_teardown_spec(
+        owner_repo=spec.get("ownerRepo"),
+        app_slug=spec.get("appSlug"),
+        scope=spec.get("scope"),
+        environment_targets=(spec.get("environmentTargets") or {}).items(),
+        local_package=spec.get("localPackage"),
+    )
+
+    environments: list[dict[str, Any]] = []
+    mutated = False
+    for environment, target in normalized["environmentTargets"].items():
+        route = _tear_down_route(target, normalized["ownerRepo"], normalized["appSlug"], environment)
+        runtime = _tear_down_remote_environment(
+            target,
+            normalized["ownerRepo"],
+            normalized["appSlug"],
+            environment,
+        )
+        mutated = mutated or route["mutated"] or runtime["mutated"]
+        environments.append(
+            {
+                "environment": environment,
+                "targetName": target,
+                "route": route,
+                "runtimeAndPersistentData": runtime,
+            }
+        )
+
+    workstation: dict[str, Any] = {"state": "not-selected", "mutated": False}
+    if normalized["scope"] in {"local", "all"}:
+        workstation = tear_down_workstation_package(normalized["localPackage"])
+        mutated = mutated or workstation["mutated"]
+
+    return {
+        "schemaVersion": 1,
+        "ownerRepo": normalized["ownerRepo"],
+        "appSlug": normalized["appSlug"],
+        "scope": normalized["scope"],
+        "environments": environments,
+        "workstation": workstation,
+        "productionDataIncluded": normalized["scope"] in {"production", "all"},
+        "mutated": mutated,
+    }
+
+
+def render_teardown_summary(result: dict[str, Any]) -> str:
+    return json.dumps(result, indent=2, sort_keys=True)