@mriekki/project-forge 0.0.0-stage → 2.0.0

package/assets/generated/deployment/src/project_forge_deployment/teardown.py

@@ -0,0 +1,300 @@
+"""Scoped destructive tear-down for Kit-managed named environments and local Docker state."""
+
+from __future__ import annotations
+
+import json
+import re
+import shlex
+import shutil
+import subprocess
+from typing import Any, Iterable
+
+from .errors import DeploymentKitError
+from .profiles import load_profile
+from .route_registry import apply_route_change, plan_route_removal, route_inventory
+from .ssh import ssh_args, verify_access
+from .teardown_remote import REMOTE_SCRIPT
+
+TEAR_DOWN_WRITE_PHRASE = "[POC TEAR DOWN]"
+PRODUCTION_DATA_DELETE_PHRASE = "[PRODUCTION DATA DELETE]"
+RESERVED_SCOPES = ("local", "all")
+
+_SLUG_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
+_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
+_TARGET_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$")
+_PACKAGE_RE = re.compile(r"^ghcr\.io/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
+
+
+def _slug(value: str, field: str) -> str:
+    if not isinstance(value, str) or _SLUG_RE.fullmatch(value) is None:
+        raise DeploymentKitError(f"{field} must use lowercase letters, digits, and internal hyphens.")
+    return value
+
+
+def _owner_repo(value: str) -> str:
+    if not isinstance(value, str) or _REPO_RE.fullmatch(value) is None:
+        raise DeploymentKitError("ownerRepo must use GitHub owner/repository form without URL syntax.")
+    return value
+
+
+def _package(value: str) -> str:
+    if not isinstance(value, str) or _PACKAGE_RE.fullmatch(value) is None:
+        raise DeploymentKitError("localPackage must use exact ghcr.io/owner/package form.")
+    return value
+
+
+def parse_environment_targets(items: Iterable[str]) -> dict[str, str]:
+    result: dict[str, str] = {}
+    for item in items:
+        if not isinstance(item, str) or "=" not in item:
+            raise DeploymentKitError("environment target bindings must use environment=target form.")
+        environment, target = item.split("=", 1)
+        environment = _slug(environment, "environment")
+        if environment in RESERVED_SCOPES:
+            raise DeploymentKitError(f"{environment!r} is reserved and cannot be a remote environment name.")
+        if not target or _TARGET_RE.fullmatch(target) is None:
+            raise DeploymentKitError("target profile names contain unsupported characters.")
+        if environment in result:
+            raise DeploymentKitError(f"Duplicate environment target binding: {environment}")
+        result[environment] = target
+    return dict(sorted(result.items()))
+
+
+def _normalize_production_environments(items: Iterable[str]) -> set[str]:
+    result = {"production"}
+    for item in items:
+        environment = _slug(item, "productionEnvironment")
+        if environment in RESERVED_SCOPES:
+            raise DeploymentKitError("local/all cannot be classified as Production environments.")
+        result.add(environment)
+    return result
+
+
+def normalize_teardown_spec(
+    *,
+    owner_repo: str,
+    app_slug: str,
+    scope: str,
+    environment_targets: dict[str, str] | Iterable[tuple[str, str]],
+    local_package: str | None,
+    production_environments: Iterable[str] = (),
+) -> dict[str, Any]:
+    scope = _slug(scope, "scope")
+    pairs = environment_targets.items() if isinstance(environment_targets, dict) else environment_targets
+    normalized_targets: dict[str, str] = {}
+    for environment, target in pairs:
+        environment = _slug(environment, "environment")
+        if environment in RESERVED_SCOPES:
+            raise DeploymentKitError(f"{environment!r} is reserved and cannot be a remote environment name.")
+        if not isinstance(target, str) or _TARGET_RE.fullmatch(target) is None:
+            raise DeploymentKitError("target profile names contain unsupported characters.")
+        if environment in normalized_targets:
+            raise DeploymentKitError(f"Duplicate environment target binding: {environment}")
+        normalized_targets[environment] = target
+
+    if scope == "local":
+        selected_targets: dict[str, str] = {}
+    elif scope == "all":
+        selected_targets = dict(sorted(normalized_targets.items()))
+    else:
+        if scope not in normalized_targets:
+            raise DeploymentKitError(f"scope {scope!r} requires an explicit {scope}=target binding.")
+        selected_targets = {scope: normalized_targets[scope]}
+
+    package = _package(local_package) if local_package is not None else None
+    if scope == "local" and package is None:
+        raise DeploymentKitError("scope 'local' requires --local-package for exact local Docker ownership.")
+
+    production_set = _normalize_production_environments(production_environments)
+    selected_production = sorted(set(selected_targets).intersection(production_set))
+
+    return {
+        "schemaVersion": 2,
+        "ownerRepo": _owner_repo(owner_repo),
+        "appSlug": _slug(app_slug, "appSlug"),
+        "scope": scope,
+        "environmentTargets": selected_targets,
+        "localPackage": package,
+        "productionEnvironments": selected_production,
+    }
+
+
+def _find_route(inventory: dict[str, Any], app_slug: str, environment: str) -> dict[str, Any] | None:
+    route_id = f"{app_slug}--{environment}"
+    return next((item for item in inventory["managedRoutes"] if item["routeId"] == route_id), None)
+
+
+def _tear_down_route(target: str, owner_repo: str, app_slug: str, environment: str) -> dict[str, Any]:
+    inventory = route_inventory(target)
+    route = _find_route(inventory, app_slug, environment)
+    if route is None:
+        return {"state": "absent", "mutated": False}
+    if route["ownerRepo"] != owner_repo:
+        raise DeploymentKitError(
+            f"Route {app_slug}--{environment} is owned by {route['ownerRepo']}, not {owner_repo}."
+        )
+    plan = plan_route_removal(
+        target,
+        owner_repo=owner_repo,
+        environment=environment,
+        app_slug=app_slug,
+    )
+    apply_route_change(plan)
+    return {"state": "removed", "mutated": True, "hostnames": route["hostnames"]}
+
+
+def _tear_down_remote_environment(
+    target: str,
+    owner_repo: str,
+    app_slug: str,
+    environment: str,
+) -> dict[str, Any]:
+    profile = load_profile(target)
+    evidence = verify_access(profile)
+    command = ssh_args(
+        profile,
+        evidence["address"],
+        command="sudo -n bash -s -- "
+        + " ".join(shlex.quote(value) for value in (owner_repo, app_slug, environment)),
+    )
+    completed = subprocess.run(
+        command,
+        input=REMOTE_SCRIPT.encode("utf-8"),
+        capture_output=True,
+        check=False,
+    )
+    stdout = completed.stdout.decode("utf-8", errors="replace").strip()
+    stderr = completed.stderr.decode("utf-8", errors="replace").strip()
+    if completed.returncode != 0:
+        raise DeploymentKitError(
+            "Remote POC tear-down failed: " + (stderr or stdout or f"exit {completed.returncode}")
+        )
+    parts = stdout.split("\t")
+    if len(parts) not in {4, 5} or parts[0] != "TEAR_DOWN" or parts[1] not in {"absent", "removed"}:
+        raise DeploymentKitError("Remote POC tear-down returned malformed evidence.")
+    if parts[2] != app_slug or parts[3] != environment:
+        raise DeploymentKitError("Remote POC tear-down returned mismatched app/environment evidence.")
+    result: dict[str, Any] = {"state": parts[1], "mutated": parts[1] == "removed"}
+    if len(parts) == 5:
+        result["containerName"] = parts[4]
+    return result
+
+
+def _run_local(args: list[str]) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        args,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+        capture_output=True,
+        check=False,
+    )
+
+
+def _image_matches_package(image: str, package: str) -> bool:
+    return image == package or image.startswith(package + ":") or image.startswith(package + "@")
+
+
+def tear_down_workstation_package(package: str) -> dict[str, Any]:
+    package = _package(package)
+    docker = shutil.which("docker")
+    if not docker:
+        return {"state": "docker-unavailable", "mutated": False, "containers": [], "images": []}
+
+    listed = _run_local([docker, "ps", "-a", "--format", "{{.ID}}"])
+    if listed.returncode != 0:
+        raise DeploymentKitError(
+            "Local Docker container inventory failed: " + (listed.stderr or listed.stdout).strip()
+        )
+
+    containers: list[str] = []
+    for container_id in [line.strip() for line in listed.stdout.splitlines() if line.strip()]:
+        inspected = _run_local([docker, "inspect", "--format", "{{.Config.Image}}", container_id])
+        if inspected.returncode != 0:
+            raise DeploymentKitError(f"Local Docker inspect failed for container {container_id}.")
+        if _image_matches_package(inspected.stdout.strip(), package):
+            containers.append(container_id)
+
+    if containers:
+        removed = _run_local([docker, "rm", "-f", "-v", *containers])
+        if removed.returncode != 0:
+            raise DeploymentKitError(
+                "Local POC container removal failed: " + (removed.stderr or removed.stdout).strip()
+            )
+
+    images_result = _run_local([docker, "images", "--format", "{{.Repository}}:{{.Tag}}"])
+    if images_result.returncode != 0:
+        raise DeploymentKitError(
+            "Local Docker image inventory failed: " + (images_result.stderr or images_result.stdout).strip()
+        )
+    image_refs = sorted(
+        {
+            line.strip()
+            for line in images_result.stdout.splitlines()
+            if line.strip().startswith(package + ":") and not line.strip().endswith(":<none>")
+        }
+    )
+    if image_refs:
+        removed = _run_local([docker, "image", "rm", "-f", *image_refs])
+        if removed.returncode != 0:
+            raise DeploymentKitError(
+                "Local POC image removal failed: " + (removed.stderr or removed.stdout).strip()
+            )
+    return {
+        "state": "removed" if containers or image_refs else "absent",
+        "mutated": bool(containers or image_refs),
+        "containers": containers,
+        "images": image_refs,
+    }
+
+
+def tear_down_poc(spec: dict[str, Any]) -> dict[str, Any]:
+    normalized = normalize_teardown_spec(
+        owner_repo=spec.get("ownerRepo"),
+        app_slug=spec.get("appSlug"),
+        scope=spec.get("scope"),
+        environment_targets=(spec.get("environmentTargets") or {}).items(),
+        local_package=spec.get("localPackage"),
+        production_environments=spec.get("productionEnvironments") or (),
+    )
+
+    environments: list[dict[str, Any]] = []
+    mutated = False
+    for environment, target in normalized["environmentTargets"].items():
+        route = _tear_down_route(target, normalized["ownerRepo"], normalized["appSlug"], environment)
+        runtime = _tear_down_remote_environment(
+            target,
+            normalized["ownerRepo"],
+            normalized["appSlug"],
+            environment,
+        )
+        mutated = mutated or route["mutated"] or runtime["mutated"]
+        environments.append(
+            {
+                "environment": environment,
+                "targetName": target,
+                "route": route,
+                "runtimeAndPersistentData": runtime,
+            }
+        )
+
+    workstation: dict[str, Any] = {"state": "not-selected", "mutated": False}
+    if normalized["scope"] in {"local", "all"} and normalized["localPackage"] is not None:
+        workstation = tear_down_workstation_package(normalized["localPackage"])
+        mutated = mutated or workstation["mutated"]
+
+    return {
+        "schemaVersion": 2,
+        "ownerRepo": normalized["ownerRepo"],
+        "appSlug": normalized["appSlug"],
+        "scope": normalized["scope"],
+        "environments": environments,
+        "workstation": workstation,
+        "productionEnvironments": normalized["productionEnvironments"],
+        "productionDataIncluded": bool(normalized["productionEnvironments"]),
+        "mutated": mutated,
+    }
+
+
+def render_teardown_summary(result: dict[str, Any]) -> str:
+    return json.dumps(result, indent=2, sort_keys=True)

package/assets/generated/deployment/src/project_forge_deployment/teardown_cli.py

@@ -0,0 +1,139 @@
+"""CLI for scoped destructive POC tear-down."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+from .errors import DeploymentKitError
+from .teardown import (
+    PRODUCTION_DATA_DELETE_PHRASE,
+    TEAR_DOWN_WRITE_PHRASE,
+    normalize_teardown_spec,
+    parse_environment_targets,
+    render_teardown_summary,
+    tear_down_poc,
+)
+
+
+def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        prog="project-forge-deploy tear-down",
+        description=(
+            "Remove one named Kit-managed environment, all explicitly bound environments, "
+            "and/or exact-package local Docker state. Remote tear-down deletes persistent "
+            "application data for selected environments."
+        ),
+    )
+    parser.add_argument(
+        "scope",
+        help="local, all, or one exact named environment such as demo, staging, qa, or production",
+    )
+    parser.add_argument("--owner-repo", required=True)
+    parser.add_argument("--app-slug", required=True)
+    parser.add_argument(
+        "--environment-target",
+        action="append",
+        default=[],
+        metavar="ENV=TARGET",
+        help="Explicit named environment-to-target binding; repeat as needed.",
+    )
+    parser.add_argument(
+        "--production-environment",
+        action="append",
+        default=[],
+        metavar="ENV",
+        help=(
+            "Classify an additional named environment as Production for the stronger data-deletion gate. "
+            "The literal 'production' environment is always Production."
+        ),
+    )
+    parser.add_argument(
+        "--local-package",
+        help=(
+            "Exact local Docker package identity, e.g. ghcr.io/owner/package. "
+            "Required for local; optional for all."
+        ),
+    )
+    parser.add_argument(
+        "--authorization",
+        help=f"Required destructive phrase: {TEAR_DOWN_WRITE_PHRASE}",
+    )
+    parser.add_argument(
+        "--production-data-authorization",
+        help=(
+            "Additional phrase required whenever selected environments include Production data: "
+            f"{PRODUCTION_DATA_DELETE_PHRASE}"
+        ),
+    )
+    return parser.parse_args(argv)
+
+
+def _preview(spec: dict[str, object]) -> dict[str, object]:
+    production = bool(spec["productionEnvironments"])
+    return {
+        "schemaVersion": 2,
+        "ownerRepo": spec["ownerRepo"],
+        "appSlug": spec["appSlug"],
+        "scope": spec["scope"],
+        "environmentTargets": spec["environmentTargets"],
+        "localPackage": spec["localPackage"],
+        "productionEnvironments": spec["productionEnvironments"],
+        "destructive": True,
+        "deletesPersistentData": bool(spec["environmentTargets"]),
+        "deletesProductionData": production,
+        "preservesSharedPlatform": True,
+        "preservesUnrelatedPocs": True,
+        "deletesGhcrPackage": False,
+        "requiredAuthorization": TEAR_DOWN_WRITE_PHRASE,
+        "requiredProductionDataAuthorization": PRODUCTION_DATA_DELETE_PHRASE if production else None,
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    try:
+        args = parse_args(argv)
+        bindings = parse_environment_targets(args.environment_target)
+        spec = normalize_teardown_spec(
+            owner_repo=args.owner_repo,
+            app_slug=args.app_slug,
+            scope=args.scope,
+            environment_targets=bindings,
+            local_package=args.local_package,
+            production_environments=args.production_environment,
+        )
+        preview = _preview(spec)
+
+        missing_general = args.authorization != TEAR_DOWN_WRITE_PHRASE
+        needs_production = bool(spec["productionEnvironments"])
+        missing_production = (
+            needs_production
+            and args.production_data_authorization != PRODUCTION_DATA_DELETE_PHRASE
+        )
+        if missing_general or missing_production:
+            print("POC TEAR-DOWN PREVIEW")
+            print(render_teardown_summary(preview))
+            if missing_general:
+                print(
+                    f"ERROR: destructive tear-down requires --authorization {TEAR_DOWN_WRITE_PHRASE!r}",
+                    file=sys.stderr,
+                )
+            if missing_production:
+                print(
+                    "ERROR: Production persistent-data deletion requires "
+                    f"--production-data-authorization {PRODUCTION_DATA_DELETE_PHRASE!r}",
+                    file=sys.stderr,
+                )
+            return 2
+
+        result = tear_down_poc(spec)
+        print("POC TEAR-DOWN COMPLETE")
+        print(render_teardown_summary(result))
+        return 0
+    except DeploymentKitError as exc:
+        print(f"ERROR: {exc}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/assets/generated/deployment/src/project_forge_deployment/teardown_remote.py

@@ -0,0 +1,100 @@
+"""Remote destructive tear-down for one Kit-managed POC environment."""
+
+REMOTE_SCRIPT = r'''#!/usr/bin/env bash
+set -Eeuo pipefail
+
+APP_ROOT="/srv/project-forge-apps"
+OWNER="$1"
+APP="$2"
+ENVIRONMENT="$3"
+
+valid_slug() { [[ "$1" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]]; }
+valid_repo() { [[ "$1" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; }
+meta_value() {
+    local path="$1" key="$2"
+    [[ -f "$path" && ! -L "$path" ]] || return 1
+    sed -n "s/^${key}=//p" "$path" | head -n1
+}
+assert_owned_marker() {
+    local path="$1"
+    [[ -f "$path" && ! -L "$path" ]] || return 1
+    [[ "$(meta_value "$path" OWNER_REPO || true)" == "$OWNER" && \
+       "$(meta_value "$path" APP_SLUG || true)" == "$APP" && \
+       "$(meta_value "$path" ENVIRONMENT || true)" == "$ENVIRONMENT" ]]
+}
+
+valid_repo "$OWNER" || { echo "Invalid owner repository." >&2; exit 20; }
+valid_slug "$APP" || { echo "Invalid application slug." >&2; exit 20; }
+valid_slug "$ENVIRONMENT" || { echo "Invalid environment slug." >&2; exit 20; }
+
+ROOT="$APP_ROOT/$APP/$ENVIRONMENT"
+STATE="$ROOT/deployment.env"
+PERSISTENCE="$ROOT/persistence.env"
+
+if [[ ! -e "$ROOT" ]]; then
+    printf 'TEAR_DOWN\tabsent\t%s\t%s\n' "$APP" "$ENVIRONMENT"
+    exit 0
+fi
+
+[[ -d "$ROOT" && ! -L "$ROOT" ]] || {
+    echo "POC environment root is not a safe managed directory: $ROOT" >&2
+    exit 21
+}
+
+HAS_STATE=false
+HAS_PERSISTENCE=false
+[[ -f "$STATE" && ! -L "$STATE" ]] && HAS_STATE=true
+[[ -f "$PERSISTENCE" && ! -L "$PERSISTENCE" ]] && HAS_PERSISTENCE=true
+[[ "$HAS_STATE" == true || "$HAS_PERSISTENCE" == true ]] || {
+    echo "POC environment root has no managed ownership marker: $ROOT" >&2
+    exit 21
+}
+
+if [[ "$HAS_STATE" == true ]] && ! assert_owned_marker "$STATE"; then
+    echo "POC deployment ownership mismatch for $ROOT" >&2
+    exit 22
+fi
+if [[ "$HAS_PERSISTENCE" == true ]] && ! assert_owned_marker "$PERSISTENCE"; then
+    echo "POC persistence ownership mismatch for $ROOT" >&2
+    exit 22
+fi
+
+CONTAINER=""
+if [[ "$HAS_STATE" == true ]]; then
+    CURRENT_RELEASE="$(meta_value "$STATE" CURRENT_RELEASE || true)"
+    [[ -n "$CURRENT_RELEASE" && "$CURRENT_RELEASE" != */* && "$CURRENT_RELEASE" != *..* ]] || {
+        echo "Managed deployment state has an invalid current release." >&2
+        exit 23
+    }
+
+    RELEASE_FILE="$ROOT/releases/$CURRENT_RELEASE/release.env"
+    [[ -f "$RELEASE_FILE" && ! -L "$RELEASE_FILE" ]] || {
+        echo "Managed current release metadata is missing: $RELEASE_FILE" >&2
+        exit 23
+    }
+    assert_owned_marker "$RELEASE_FILE" || {
+        echo "Managed release ownership does not match deployment state." >&2
+        exit 23
+    }
+    CONTAINER="$(meta_value "$RELEASE_FILE" CONTAINER_NAME || true)"
+    [[ "$CONTAINER" =~ ^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$ ]] || {
+        echo "Managed release contains an invalid container name." >&2
+        exit 23
+    }
+
+    if docker inspect "$CONTAINER" >/dev/null 2>&1; then
+        docker rm -f "$CONTAINER" >/dev/null
+    fi
+fi
+
+# The verified environment root is owned by this POC/environment. Tear-down
+# removes releases, evidence, persistent data, and backups together.
+rm -rf --one-file-system -- "$ROOT"
+
+APP_DIR="$APP_ROOT/$APP"
+if [[ -d "$APP_DIR" ]] && ! find "$APP_DIR" -mindepth 1 -print -quit | grep -q .; then
+    rmdir "$APP_DIR"
+fi
+
+printf 'TEAR_DOWN\tremoved\t%s\t%s\t%s\n' "$APP" "$ENVIRONMENT" "$CONTAINER"
+'''