@ngocsangairvds/vsaf 3.2.16 → 4.0.1

package/tools/vds-scripts/telegram_bridge/daemon/health_server.py

@@ -1,130 +0,0 @@
-"""Daemon-side health UDS endpoint (TSK-7.8 / FR-9.x).
-
-Listens at `<runner_dir>/health.sock` (mode 0o600). Single-shot protocol —
-client sends a line, the daemon replies with one JSON line and closes:
-
-    >>> echo get | nc -U /run/vds-telegram/health.sock
-    {"healthy": true, "active_sessions": 2, "degraded": false, ...}
-
-The daemon publishes:
-  * pg_ok            — `SELECT 1` succeeded
-  * active_sessions  — count of registry rows in (active, idle)
-  * degraded         — throttler.degraded (latency-p95 sentinel)
-  * event_write_lag_s — now() - max(ts) across all sessions; None if no events
-  * supergroup_id    — the registered supergroup or None
-
-`vds-cli telegram status` connects here first; if the socket is missing
-(daemon down or older build) it falls back to PG-only checks.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import contextlib
-import json
-import os
-from datetime import UTC, datetime
-from pathlib import Path
-from typing import TYPE_CHECKING
-
-import structlog
-
-from telegram_bridge.models.sessions import SessionStatus
-
-if TYPE_CHECKING:
-    from telegram_bridge.daemon.pg import PgPool
-    from telegram_bridge.daemon.session_registry import SessionRegistry
-    from telegram_bridge.daemon.throttler import StreamingThrottler
-
-log = structlog.get_logger(__name__)
-
-
-class HealthServer:
-    """Bind a UDS health endpoint reflecting live daemon state."""
-
-    def __init__(
-        self,
-        *,
-        socket_path: Path,
-        pg: PgPool,
-        registry: SessionRegistry,
-        throttler: StreamingThrottler,
-        supergroup_id: int | None,
-    ) -> None:
-        self._socket_path = socket_path
-        self._pg = pg
-        self._registry = registry
-        self._throttler = throttler
-        self._supergroup_id = supergroup_id
-        self._server: asyncio.AbstractServer | None = None
-
-    async def start(self) -> None:
-        self._socket_path.parent.mkdir(parents=True, exist_ok=True)
-        if self._socket_path.exists():
-            with contextlib.suppress(FileNotFoundError):
-                self._socket_path.unlink()
-        self._server = await asyncio.start_unix_server(self._handle_client, path=str(self._socket_path))
-        try:
-            os.chmod(self._socket_path, 0o600)
-        except OSError:
-            log.warning("health.chmod_failed", path=str(self._socket_path))
-        log.info("health.listening", path=str(self._socket_path))
-
-    async def stop(self) -> None:
-        if self._server is None:
-            return
-        self._server.close()
-        await self._server.wait_closed()
-        self._server = None
-        with contextlib.suppress(FileNotFoundError):
-            self._socket_path.unlink()
-
-    async def _handle_client(self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
-        try:
-            # Drain at most one line; ignore content (any token works).
-            with contextlib.suppress(TimeoutError):
-                await asyncio.wait_for(reader.readline(), timeout=2.0)
-            payload = await self.snapshot()
-            writer.write((json.dumps(payload) + "\n").encode())
-            try:
-                await writer.drain()
-            except (ConnectionResetError, BrokenPipeError):
-                return
-        finally:
-            writer.close()
-            with contextlib.suppress(Exception):
-                await writer.wait_closed()
-
-    async def snapshot(self) -> dict:
-        """Sample state once. All probes are bounded so a hung DB can't block forever."""
-        pg_ok = False
-        event_write_lag_s: float | None = None
-        try:
-            pg_ok = await asyncio.wait_for(self._pg.health_check(), timeout=2.0)
-        except TimeoutError:
-            pg_ok = False
-        if pg_ok:
-            try:
-                event_write_lag_s = await asyncio.wait_for(self._sample_event_lag(), timeout=2.0)
-            except TimeoutError:
-                event_write_lag_s = None
-
-        active = sum(1 for r in self._registry.list_active() if r.status in (SessionStatus.ACTIVE, SessionStatus.IDLE))
-        return {
-            "healthy": pg_ok,
-            "pg_ok": pg_ok,
-            "active_sessions": active,
-            "degraded": self._throttler.degraded,
-            "event_write_lag_s": event_write_lag_s,
-            "supergroup_id": self._supergroup_id,
-        }
-
-    async def _sample_event_lag(self) -> float | None:
-        async with self._pg.pool.acquire() as conn:
-            row = await conn.fetchrow("SELECT MAX(ts) AS last_ts FROM vds_telegram_session_events")
-        if row is None or row["last_ts"] is None:
-            return None
-        last_ts: datetime = row["last_ts"]
-        if last_ts.tzinfo is None:
-            last_ts = last_ts.replace(tzinfo=UTC)
-        return max(0.0, (datetime.now(UTC) - last_ts).total_seconds())

package/tools/vds-scripts/telegram_bridge/daemon/job_scheduler.py

@@ -1,213 +0,0 @@
-"""Nightly in-daemon job scheduler — TSK-7.4 / TSK-7.5.
-
-Fires `archive_old_topics` and `rotate_audit` once per day at a configurable
-UTC hour (default 04:00).  Both jobs are implemented in `telegram_bridge/jobs/`
-but previously had no caller; this module is their only caller in the daemon.
-
-Design:
-  • Single asyncio task: compute next-fire datetime → sleep until then →
-    run both jobs serially → log results → repeat.
-  • Each job is wrapped in its own try/except so a failure in one does not
-    prevent the other from running or kill the scheduler loop.
-  • `_clock` and `_sleep` are injectable for unit tests so we can fake time
-    and avoid 24-hour sleeps.
-  • `_archive_fn` / `_rotate_fn` are injectable for tests that need to inject
-    a failing job without a real database.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import contextlib
-from collections.abc import Awaitable, Callable
-from datetime import UTC, datetime, timedelta
-from pathlib import Path
-from typing import TYPE_CHECKING
-
-import structlog
-
-if TYPE_CHECKING:
-    from telegram_bridge.daemon.pg import PgPool
-
-log = structlog.get_logger(__name__)
-
-
-class NightlyJobScheduler:
-    """Run archive + rotate jobs once per day at `hour_utc:00 UTC`.
-
-    Lifecycle:
-      start()  — creates the background loop task.
-      stop()   — cancels it and awaits clean exit.
-
-    All heavy dependencies (pg, bot) are used lazily inside the loop so the
-    scheduler can be constructed during the early boot phase before Postgres
-    and the Bot are fully initialised.
-    """
-
-    def __init__(
-        self,
-        *,
-        pg: PgPool,
-        get_bot: Callable[[], object],  # () -> aiogram.Bot | None
-        parquet_root: Path,
-        retention_days: int = 90,
-        archive_age_days: int = 14,
-        soft_cap: int | None = None,
-        hour_utc: int = 4,
-        _clock: Callable[[], datetime] | None = None,
-        _sleep: Callable[[float], Awaitable[None]] | None = None,
-        _archive_fn: Callable[[], Awaitable[object]] | None = None,
-        _rotate_fn: Callable[[], Awaitable[object]] | None = None,
-        _softcap_fn: Callable[[], Awaitable[object]] | None = None,
-    ) -> None:
-        self._pg = pg
-        self._get_bot = get_bot
-        self._parquet_root = parquet_root
-        self._retention_days = retention_days
-        self._archive_age_days = archive_age_days
-        self._soft_cap = soft_cap
-        self._hour_utc = hour_utc
-        self._clock: Callable[[], datetime] = _clock or (lambda: datetime.now(tz=UTC))
-        self._sleep: Callable[[float], Awaitable[None]] = _sleep or asyncio.sleep
-        # Test-only overrides for the job callables.
-        self._archive_fn = _archive_fn
-        self._rotate_fn = _rotate_fn
-        self._softcap_fn = _softcap_fn
-        self._task: asyncio.Task[None] | None = None
-
-    # ---- Lifecycle --------------------------------------------------------
-
-    async def start(self) -> None:
-        """Start the background scheduling loop."""
-        self._task = asyncio.create_task(self._loop(), name="nightly-job-scheduler")
-        log.info("job_scheduler.started", hour_utc=self._hour_utc)
-
-    async def stop(self) -> None:
-        """Cancel the scheduling loop and await its exit."""
-        if self._task is not None and not self._task.done():
-            self._task.cancel()
-            with contextlib.suppress(asyncio.CancelledError):
-                await self._task
-        self._task = None
-        log.info("job_scheduler.stopped")
-
-    # ---- Scheduling logic ------------------------------------------------
-
-    def _next_fire(self) -> datetime:
-        """Return the next UTC datetime at which the jobs should fire.
-
-        If we are before today's `hour_utc:00:00 UTC`, return that time today.
-        Otherwise return `hour_utc:00:00 UTC` tomorrow.
-        """
-        now = self._clock()
-        today_fire = now.replace(
-            hour=self._hour_utc,
-            minute=0,
-            second=0,
-            microsecond=0,
-        )
-        if now < today_fire:
-            return today_fire
-        return today_fire + timedelta(days=1)
-
-    # ---- Main loop -------------------------------------------------------
-
-    async def _loop(self) -> None:
-        while True:
-            next_dt = self._next_fire()
-            delay_s = max(0.0, (next_dt - self._clock()).total_seconds())
-            log.info(
-                "job_scheduler.waiting",
-                next_fire=next_dt.isoformat(),
-                delay_s=round(delay_s, 1),
-            )
-            await self._sleep(delay_s)
-            await self._run_jobs()
-
-    async def _run_jobs(self) -> None:
-        """Run archive then rotate, each guarded so one failure doesn't stop the other."""
-        log.info("job_scheduler.firing")
-
-        # --- archive old topics ---
-        try:
-            if self._archive_fn is not None:
-                result = await self._archive_fn()
-            else:
-                result = await self._do_archive()
-            log.info("job_scheduler.archive.done", result=str(result))
-        except Exception:
-            log.exception("job_scheduler.archive.error")
-
-        # --- rotate audit blobs ---
-        try:
-            if self._rotate_fn is not None:
-                result = await self._rotate_fn()
-            else:
-                result = await self._do_rotate()
-            log.info("job_scheduler.rotate.done", result=str(result))
-        except Exception:
-            log.exception("job_scheduler.rotate.error")
-
-        # --- soft-cap LRU eviction (FR-2.14 / AC-1.18) ---
-        if self._softcap_fn is not None or self._soft_cap is not None:
-            try:
-                if self._softcap_fn is not None:
-                    result = await self._softcap_fn()
-                else:
-                    result = await self._do_softcap()
-                log.info("job_scheduler.softcap.done", result=str(result))
-            except Exception:
-                log.exception("job_scheduler.softcap.error")
-
-    # ---- Real job implementations ----------------------------------------
-
-    async def _do_archive(self) -> object:
-        """Wire archive_old_topics to this daemon's bot + pg."""
-        from telegram_bridge.jobs.archive_topics import archive_old_topics
-
-        bot = self._get_bot()
-
-        async def _delete_topic(supergroup_id: int, message_thread_id: int) -> None:
-            if bot is not None:
-                await bot.delete_forum_topic(  # type: ignore[union-attr]
-                    chat_id=supergroup_id,
-                    message_thread_id=message_thread_id,
-                )
-
-        return await archive_old_topics(
-            pg=self._pg,
-            delete_forum_topic=_delete_topic,
-            age_days=self._archive_age_days,
-        )
-
-    async def _do_rotate(self) -> object:
-        """Wire rotate_audit to this daemon's pg + parquet_root."""
-        from telegram_bridge.jobs.rotate_audit import rotate_audit
-
-        return await rotate_audit(
-            pg=self._pg,
-            parquet_root=self._parquet_root,
-            retention_days=self._retention_days,
-        )
-
-    async def _do_softcap(self) -> object:
-        """Wire archive_to_soft_cap to this daemon's bot + pg + cap."""
-        from telegram_bridge.jobs.archive_topics import archive_to_soft_cap
-
-        if self._soft_cap is None:
-            # Should not be reached — _run_jobs guards on this.
-            return None
-        bot = self._get_bot()
-
-        async def _delete_topic(supergroup_id: int, message_thread_id: int) -> None:
-            if bot is not None:
-                await bot.delete_forum_topic(  # type: ignore[union-attr]
-                    chat_id=supergroup_id,
-                    message_thread_id=message_thread_id,
-                )
-
-        return await archive_to_soft_cap(
-            pg=self._pg,
-            delete_forum_topic=_delete_topic,
-            soft_cap=self._soft_cap,
-        )

package/tools/vds-scripts/telegram_bridge/daemon/lifecycle.py

@@ -1,100 +0,0 @@
-"""Session lifecycle ticker — idle-timer + hang-watchdog.
-
-Periodic background task (every 60 s) that:
-    • Idles `active` sessions whose `surfaces_attached` is empty for >5 min.
-    • Ends `idle` sessions with no agent activity for >5 min total
-      (FR-5.5 — idle 5 min ends session).
-    • SIGTERM/SIGKILLs runners on `active` sessions with no event for >10 min
-      (FR-9.5 — hang watchdog).
-"""
-
-from __future__ import annotations
-
-import asyncio
-import contextlib
-from datetime import UTC, datetime, timedelta
-from typing import TYPE_CHECKING
-
-import structlog
-
-from telegram_bridge.models.events import SessionEndReason
-from telegram_bridge.models.sessions import SessionStatus
-
-if TYPE_CHECKING:
-    from telegram_bridge.daemon.audit import AuditWriter
-    from telegram_bridge.daemon.session_registry import SessionRegistry
-
-log = structlog.get_logger(__name__)
-
-IDLE_THRESHOLD = timedelta(minutes=5)
-HANG_THRESHOLD = timedelta(minutes=10)
-TICK_INTERVAL_S = 60
-
-
-class LifecycleTicker:
-    """Background periodic sweep over the SessionRegistry."""
-
-    def __init__(
-        self,
-        *,
-        registry: SessionRegistry,
-        audit: AuditWriter,
-        idle_threshold: timedelta = IDLE_THRESHOLD,
-        hang_threshold: timedelta = HANG_THRESHOLD,
-        tick_interval_s: float = TICK_INTERVAL_S,
-    ) -> None:
-        self._registry = registry
-        self._audit = audit
-        self._idle_threshold = idle_threshold
-        self._hang_threshold = hang_threshold
-        self._tick_interval_s = tick_interval_s
-        self._task: asyncio.Task[None] | None = None
-        # session_id → last activity timestamp (in-memory; updated on every event)
-        self._last_activity: dict = {}
-
-    def note_activity(self, session_id) -> None:
-        """Bus subscribers call this on every agent-emitted event."""
-        self._last_activity[session_id] = datetime.now(tz=UTC)
-
-    async def start(self) -> None:
-        if self._task is not None:
-            return
-        self._task = asyncio.create_task(self._run(), name="lifecycle.ticker")
-
-    async def stop(self) -> None:
-        if self._task is None:
-            return
-        self._task.cancel()
-        with contextlib.suppress(asyncio.CancelledError):
-            await self._task
-        self._task = None
-
-    async def _run(self) -> None:
-        while True:
-            try:
-                await asyncio.sleep(self._tick_interval_s)
-                await self.sweep_once()
-            except asyncio.CancelledError:
-                raise
-            except Exception:
-                log.exception("lifecycle.tick.error")
-
-    async def sweep_once(self, *, now: datetime | None = None) -> None:
-        """Single sweep — exposed for unit tests with frozen time."""
-        now = now or datetime.now(tz=UTC)
-        for rec in self._registry.list_active():
-            last_activity = self._last_activity.get(rec.id, rec.started_at)
-            quiet_for = now - last_activity
-
-            if rec.status == SessionStatus.ACTIVE and quiet_for >= self._hang_threshold:
-                # Hang watchdog (FR-9.5).
-                log.warning("lifecycle.hang_detected", session_id=str(rec.id))
-                await self._registry.transition_to(rec.id, SessionStatus.ENDED)
-                await self._audit.write_session_end(rec.id, reason=SessionEndReason.HANG.value)
-                continue
-
-            if rec.status == SessionStatus.IDLE and quiet_for >= self._idle_threshold:
-                # Idle-timeout end (FR-5.5).
-                log.info("lifecycle.idle_timeout", session_id=str(rec.id))
-                await self._registry.transition_to(rec.id, SessionStatus.ENDED)
-                await self._audit.write_session_end(rec.id, reason=SessionEndReason.IDLE_TIMEOUT.value)

package/tools/vds-scripts/telegram_bridge/daemon/middleware/__init__.py

@@ -1 +0,0 @@
-"""Daemon middleware — registered on Dispatcher.update.outer_middleware (per FR-2.2 / round-5)."""

package/tools/vds-scripts/telegram_bridge/daemon/middleware/allowlist.py

@@ -1,70 +0,0 @@
-"""Allow-list middleware (FR-2.2).
-
-Registered as `dispatcher.update.outer_middleware(AllowListMiddleware(...))` —
-outer-middleware tier runs BEFORE any framework state mutation. This is the
-earliest possible rejection point for non-allow-listed updates and is what
-aiogram itself uses for its own ErrorsMiddleware / UserContextMiddleware.
-
-Round-5 finding: inner middleware (`update.middleware(...)`) runs after framework
-state mutation; too late for security gating.
-
-The middleware:
-  - Resolves `from_user` from the appropriate Update arm (message / callback_query
-    / edited_message / inline_query) — `Update.from_user` does not exist as a flat
-    attribute in aiogram v3.
-  - Rejects: missing user, channel posts (no `from_user`), bot-to-bot messages
-    (`is_bot=True`), and any user-id != VDS_TELEGRAM_USER_ID.
-  - Silently drops rejected updates (no log of rejected user-id; only an in-memory
-    counter incremented for `vds-cli telegram status`).
-"""
-
-from __future__ import annotations
-
-from collections.abc import Awaitable, Callable
-from typing import TYPE_CHECKING, Any
-
-from aiogram import BaseMiddleware
-
-if TYPE_CHECKING:
-    from aiogram.types import Update, User
-
-
-def _resolve_from_user(update: Update) -> User | None:
-    """Find the User who originated this Update across the union of update types."""
-    if update.message is not None:
-        return update.message.from_user
-    if update.edited_message is not None:
-        return update.edited_message.from_user
-    if update.callback_query is not None:
-        return update.callback_query.from_user
-    if update.inline_query is not None:
-        return update.inline_query.from_user
-    if update.my_chat_member is not None:
-        return update.my_chat_member.from_user
-    if update.chat_member is not None:
-        return update.chat_member.from_user
-    if update.message_reaction is not None:
-        return update.message_reaction.user
-    return None
-
-
-class AllowListMiddleware(BaseMiddleware):
-    """Single-user allow-list (FR-2.2). Drop count tracked for status command."""
-
-    def __init__(self, allowed_user_id: int) -> None:
-        self.allowed_user_id = allowed_user_id
-        self.drop_count = 0
-
-    async def __call__(
-        self,
-        handler: Callable[[Update, dict[str, Any]], Awaitable[Any]],
-        event: Update,
-        data: dict[str, Any],
-    ) -> Any:
-        user = _resolve_from_user(event)
-        # Reject channel posts (no from_user), bot-to-bot, and any non-allow-listed id.
-        # Conservative: deny if not certain.
-        if user is None or user.is_bot or user.id != self.allowed_user_id:
-            self.drop_count += 1
-            return  # silent drop; no logging of rejected user-id (NFR-5.1)
-        return await handler(event, data)

package/tools/vds-scripts/telegram_bridge/daemon/middleware/offset_tracker.py

@@ -1,49 +0,0 @@
-"""OffsetTrackerMiddleware — FR-9.10.
-
-Outer middleware that persists `update.update_id` to `vds_telegram_polling_state`
-after each handler returns. Registered BEFORE `AllowListMiddleware` so the
-offset advances across all updates (including dropped non-allow-listed ones)
-— that mirrors what the Bot API has acknowledged from the bot's polling
-perspective and prevents replay of dropped updates after a restart.
-
-If the handler raises, the offset is NOT persisted: the daemon SHALL replay
-that update on next boot so it has another chance to commit the
-audit-write-before-side-effect invariant. This is the same safety contract
-as session events.
-"""
-
-from __future__ import annotations
-
-from collections.abc import Awaitable, Callable
-from typing import TYPE_CHECKING, Any
-
-import structlog
-from aiogram import BaseMiddleware
-
-from telegram_bridge.daemon.polling_state import save_last_offset
-
-if TYPE_CHECKING:
-    from aiogram.types import Update
-
-    from telegram_bridge.daemon.pg import PgPool
-
-log = structlog.get_logger(__name__)
-
-
-class OffsetTrackerMiddleware(BaseMiddleware):
-    """Persist `update.update_id` after each successful handler dispatch."""
-
-    def __init__(self, pg: PgPool) -> None:
-        self._pg = pg
-
-    async def __call__(
-        self,
-        handler: Callable[[Update, dict[str, Any]], Awaitable[Any]],
-        event: Update,
-        data: dict[str, Any],
-    ) -> Any:
-        result = await handler(event, data)
-        # Persist AFTER successful handler return. A handler-raised exception
-        # propagates without persisting so the update is re-fetched on restart.
-        await save_last_offset(self._pg, offset=event.update_id)
-        return result

package/tools/vds-scripts/telegram_bridge/daemon/pg.py

@@ -1,53 +0,0 @@
-"""asyncpg pool helper.
-
-Single connection pool shared by the daemon process. Runners do NOT hold their
-own pool — they call back into the daemon via UDS for any DB-touching operation,
-which keeps the audit-write-before-side-effect invariant (FR-7.5) trivial to
-enforce.
-"""
-
-from __future__ import annotations
-
-import asyncpg
-
-
-class PgPool:
-    """Thin wrapper around asyncpg.create_pool with the project's defaults."""
-
-    def __init__(self, dsn: str, min_size: int = 2, max_size: int = 10) -> None:
-        self.dsn = dsn
-        self.min_size = min_size
-        self.max_size = max_size
-        self._pool: asyncpg.Pool | None = None
-
-    async def open(self) -> None:
-        if self._pool is not None:
-            return
-        self._pool = await asyncpg.create_pool(
-            dsn=self.dsn,
-            min_size=self.min_size,
-            max_size=self.max_size,
-            command_timeout=30,
-        )
-
-    async def close(self) -> None:
-        if self._pool is not None:
-            await self._pool.close()
-            self._pool = None
-
-    @property
-    def pool(self) -> asyncpg.Pool:
-        if self._pool is None:
-            raise RuntimeError("PgPool is closed; call .open() first")
-        return self._pool
-
-    async def health_check(self) -> bool:
-        """SELECT 1 — used by /health and `vds-cli telegram status`."""
-        if self._pool is None:
-            return False
-        try:
-            async with self._pool.acquire() as conn:
-                await conn.execute("SELECT 1")
-            return True
-        except Exception:
-            return False