devlift-cli 0.1.0__py3-none-any.whl

devlift_cli/ops/kong.py

@@ -0,0 +1,343 @@
+"""`devlift kong …`: read a service's gateway and park a route change as a draft.
+
+A gateway change is one *route group* (a tag for one HTTP method) with its
+desired end state plus a `delta` naming what moved. That is what the web's
+Gateway tab sends on Save and what the MCP's edit path builds; this module
+does the same arithmetic against the current state, then:
+
+    GET  /kong-route-configs/gateway/by-config/{config}   the groups as they stand
+    POST /transaction/kong-gateway/{config}               one GatewayGroupSave → DRAFT queue row
+
+Nothing is submitted, approved or deployed here. The draft shares the
+service's change set with any settings draft, and the review lane takes it
+from there.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+
+from devlift_cli.api import kong as kong_api
+from devlift_cli.context import Invocation
+from devlift_cli.errors import EXIT_CONFLICT, EXIT_NOT_FOUND, CliError, InputError
+from devlift_cli.render import output
+from devlift_cli.render.output import kv_table, rows_table
+from devlift_cli.resolve.names import Resolver
+
+METHODS = ("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+JWT_PLUGIN = "JWT"
+PLUGINS = ("User ID Injection",)                      # the Gateway tab's extra-plugin choices
+AUTH = {"jwt": True, "auth": True, "secured": True, "public": False, "none": False, "open": False}
+
+# The platform form's own rules (kong_route_form.json).
+_PATH_RE = re.compile(r"^~/(?!.*(?:/:[A-Za-z_]|\{[A-Za-z_][A-Za-z0-9_]*\}|/\*))\S*\$$")
+_TAG_RE = re.compile(r"^[A-Za-z0-9_]+(-[A-Za-z0-9_]+)*$")
+_PRIORITY_RANGE = (0, 10000)
+
+
+def validate_path(path: str) -> str:
+    p = path.strip()
+    if not _PATH_RE.match(p):
+        raise InputError(
+            f"'{path}' is not a Kong regex path.",
+            hint="A path starts with '~/' and ends with '$', no spaces, e.g. '~/api/v1/orders$'. "
+                 "Parameters are regex groups — '~/api/v1/users/(?<id>[^/]+)$', not '/:id' or '{id}'.",
+        )
+    return p
+
+
+def validate_tag(tag: str) -> str:
+    t = tag.strip()
+    if not _TAG_RE.match(t):
+        raise InputError(f"Tag '{tag}' is invalid.", hint="Letters, numbers, underscores and single hyphens, e.g. orders-open.")
+    return t
+
+
+def normalise_plugin(name: str) -> str:
+    wanted = name.strip().lower().replace("-", " ").replace("_", " ")
+    for p in PLUGINS:
+        if p.lower() == wanted:
+            return p
+    raise InputError(f"Unknown plugin '{name}'.", hint="One of: " + ", ".join(PLUGINS) + ". JWT is set by --auth, not --plugin.")
+
+
+def default_route_group_key(service_name: str, secured: bool, existing_keys: list[str]) -> str:
+    """The Gateway tab's rule: the plain service name for the service's first
+    group, then the plain name for secured cards and '<service>-open' for
+    public ones."""
+    if service_name not in existing_keys:
+        return service_name
+    return service_name if secured else f"{service_name}-open"
+
+
+# ── where the gateway lives ──────────────────────────────────────────────────
+
+@dataclass
+class GatewayTarget:
+    service_code: str
+    service_name: str
+    config_code: str
+    environment: str
+    region_name: str
+    geo_loc_mst_code: str
+
+
+def resolve_target(inv: Invocation, res: Resolver, service: str, env: str | None, region: str | None) -> GatewayTarget:
+    """The service configuration (one environment + region) whose gateway is meant."""
+    row = res.service(service)
+    options = kong_api.env_geo_options(inv.api, row["service_code"])
+    if not options:
+        raise CliError(f"Service '{row['service_name']}' has no configuration in any environment yet.", EXIT_NOT_FOUND,
+                       hint="Create one with `devlift eks create` or from the dashboard.")
+    if env is None:
+        envs = sorted({o["environment"] for o in options})
+        env = envs[0] if len(envs) == 1 else inv.ask("Environment", choices=envs, flag="--env")
+    environment = res.environment(env)
+    in_env = [o for o in options if o["environment"] == environment]
+    if not in_env:
+        raise CliError(f"'{row['service_name']}' is not configured in {environment}. Environments: "
+                       + ", ".join(sorted({o['environment'] for o in options})) + ".", EXIT_NOT_FOUND)
+    if region:
+        w = region.strip().lower()
+        in_env = [o for o in in_env if w in (str(o.get("geo_loc_name", "")).lower(), str(o.get("geo_loc_code", "")).lower())]
+        if not in_env:
+            raise CliError(f"'{row['service_name']}' has no {environment} configuration in region '{region}'.", EXIT_NOT_FOUND)
+    if len(in_env) > 1:
+        names = [o.get("geo_loc_name") or o["geo_loc_code"] for o in in_env]
+        pick = inv.ask("Region", choices=names, flag="--region")
+        in_env = [in_env[names.index(pick)]]
+    opt = in_env[0]
+    return GatewayTarget(
+        service_code=row["service_code"], service_name=row["service_name"], config_code=opt["config_code"],
+        environment=environment, region_name=opt.get("geo_loc_name") or opt["geo_loc_code"], geo_loc_mst_code=opt["geo_loc_code"],
+    )
+
+
+# ── reading ──────────────────────────────────────────────────────────────────
+
+def route_cards(state: dict) -> list[dict]:
+    """The gateway as the tab shows it: one row per group, ordered by method."""
+    order = {m: i for i, m in enumerate(METHODS)}
+    cards = []
+    for g in state.get("groups") or []:
+        plugins = list(g.get("plugins") or [])
+        pending = []
+        for p in g.get("pending") or []:
+            delta = p.get("delta") or {}
+            pending.append({
+                "queue_code": p.get("queue_code"), "status": p.get("status"), "mine": bool(p.get("is_mine")),
+                "added": [a.get("route_path") for a in (delta.get("paths") or []) if a.get("action") == "add"],
+                "removed": [a.get("route_path") for a in (delta.get("paths") or []) if a.get("action") == "delete"],
+                "renamed": [(a.get("old_path"), a.get("route_path")) for a in (delta.get("paths") or []) if a.get("action") == "edit"],
+            })
+        cards.append({
+            "method": (g.get("http_method") or "").upper(),
+            "auth": "jwt" if JWT_PLUGIN in plugins else "public",
+            "tag": g.get("route_group_key"),
+            "plugins": [p for p in plugins if p != JWT_PLUGIN],
+            "priority": g.get("regex_priority") or 0,
+            "paths": [{"path": p.get("route_path"), "deployed": bool(p.get("code"))} for p in g.get("paths") or []],
+            "pending": pending,
+        })
+    cards.sort(key=lambda c: (order.get(c["method"], 9), c["auth"] != "jwt", c["tag"] or ""))
+    return cards
+
+
+# ── the change ───────────────────────────────────────────────────────────────
+
+@dataclass
+class RouteChange:
+    """What the user asked for on one route group."""
+    method: str
+    secured: bool | None = None                  # None = keep the group's auth (remove / rename / plugin)
+    tag: str | None = None
+    add: list[str] = field(default_factory=list)
+    remove: list[str] = field(default_factory=list)
+    rename: list[tuple[str, str]] = field(default_factory=list)
+    plugins: list[str] = field(default_factory=list)
+    priority: int | None = None
+
+
+def _find_group(state: dict, tag: str, method: str) -> dict | None:
+    for g in state.get("groups") or []:
+        if (g.get("route_group_key") or "") == tag and (g.get("http_method") or "").upper() == method:
+            return g
+    return None
+
+
+def build_group_save(change: RouteChange, state: dict) -> tuple[dict | None, dict]:
+    """One GatewayGroupSave for the transaction route, plus a summary.
+    (None, summary) when nothing would move. Same arithmetic as the web's
+    buildPayload and the MCP's build_gateway_group_save."""
+    method = change.method
+    service_name = state.get("service_name") or ""
+    existing_keys = [g.get("route_group_key") or "" for g in state.get("groups") or []]
+
+    if change.tag:
+        tag = change.tag
+        existing = _find_group(state, tag, method)
+    else:
+        if change.secured is None:
+            raise InputError("--tag is required for this change.", hint="`devlift kong routes list` shows the tags.")
+        tag = default_route_group_key(service_name, change.secured, existing_keys)
+        existing = _find_group(state, tag, method)
+    existing_plugins = list((existing or {}).get("plugins") or [])
+    existing_secured = JWT_PLUGIN in existing_plugins
+
+    if existing is None and change.secured is None:
+        raise CliError(f"There is no route group '{tag}' for {method} on {service_name}.", EXIT_NOT_FOUND,
+                       hint=f"`devlift kong routes list {service_name}` shows the groups.")
+    if existing is not None and change.secured is not None and existing_secured != change.secured:
+        kind = "an Auth (JWT)" if existing_secured else "a No Auth (public)"
+        raise CliError(
+            f"Tag '{tag}' is already {kind} group for {method} on {service_name}. A tag is one group per method: "
+            f"pick another --tag or the matching --auth.", EXIT_CONFLICT,
+        )
+    secured = change.secured if change.secured is not None else existing_secured
+
+    plugins_after = [p for p in existing_plugins if p != JWT_PLUGIN]
+    for p in change.plugins:
+        if p not in plugins_after:
+            plugins_after.append(p)
+    if secured:
+        plugins_after.insert(0, JWT_PLUGIN)
+    priority_before = int((existing or {}).get("regex_priority") or 0)
+    priority_after = change.priority if change.priority is not None else priority_before
+
+    paths = [{"code": p.get("code"), "route_path": p.get("route_path")} for p in (existing or {}).get("paths") or [] if p.get("route_path")]
+    by_path = {p["route_path"]: p for p in paths}
+
+    edited, missing = [], []
+    for old, new in change.rename:
+        row = by_path.get(old)
+        if row is None:
+            missing.append(old)
+            continue
+        row["route_path"] = new                    # same code — the row keeps its identity
+        by_path.pop(old); by_path[new] = row
+        edited.append({"code": row.get("code"), "old_path": old, "route_path": new})
+    removed = []
+    for path in change.remove:
+        row = by_path.get(path)
+        if row is None:
+            missing.append(path)
+            continue
+        paths = [p for p in paths if p is not row]
+        by_path.pop(path)
+        removed.append({"code": row.get("code"), "route_path": path})
+    if missing:
+        raise CliError(
+            f"Not on route group '{tag} · {method}': {', '.join(missing)}. Its paths are: "
+            + (", ".join(sorted(by_path)) or "(none)") + ".", EXIT_NOT_FOUND,
+        )
+    added, already = [], []
+    for path in change.add:
+        if path in by_path or path in added:
+            already.append(path)
+        else:
+            added.append(path)
+
+    summary = {
+        "tag": tag, "method": method, "auth": "jwt" if secured else "public", "new_group": existing is None,
+        "added": added, "removed": [r["route_path"] for r in removed],
+        "renamed": [(e["old_path"], e["route_path"]) for e in edited], "already_present": already,
+        "plugins": {"from": existing_plugins, "to": plugins_after},
+        "priority": {"from": priority_before, "to": priority_after},
+    }
+    nothing_moved = (
+        not added and not removed and not edited and existing is not None
+        and sorted(existing_plugins) == sorted(plugins_after) and priority_before == priority_after
+    )
+    if nothing_moved:
+        return None, summary
+
+    save = {
+        "code": (existing or {}).get("code"),
+        "route_group_key": tag,
+        "http_method": method,
+        "updated_at": (existing or {}).get("updated_at"),        # the concurrency token the server locks on
+        "plugins": plugins_after,
+        "regex_priority": priority_after,
+        "paths": paths + [{"code": None, "route_path": p} for p in added],
+        "delta": {
+            "paths": [
+                *({"action": "edit", "code": e["code"], "route_path": e["route_path"], "old_path": e["old_path"]} for e in edited),
+                *({"action": "delete", "code": r["code"], "route_path": r["route_path"]} for r in removed),
+                *({"action": "add", "code": None, "route_path": p} for p in added),
+            ],
+            "plugins_before": existing_plugins,
+            "plugins_after": plugins_after,
+            "regex_priority_before": priority_before,
+            "regex_priority_after": priority_after,
+        },
+    }
+    return save, summary
+
+
+@dataclass
+class GatewayResult:
+    service_name: str
+    config_code: str
+    environment: str
+    region: str
+    changed: bool
+    summary: dict
+    queue_code: str | None = None
+    queue_status: str | None = None
+
+    def to_dict(self) -> dict:
+        return {
+            "service": self.service_name, "service_config_code": self.config_code,
+            "environment": self.environment, "region": self.region, "changed": self.changed,
+            "change": self.summary, "queue_code": self.queue_code, "queue_status": self.queue_status,
+        }
+
+
+def apply_change(inv: Invocation, target: GatewayTarget, change: RouteChange) -> GatewayResult:
+    """Read the gateway, compute the group save, show it, confirm, park it as a draft."""
+    state = kong_api.gateway_state(inv.api, target.config_code)
+    save, summary = build_group_save(change, state)
+    if save is None:
+        note = f" ({', '.join(summary['already_present'])} already on it)" if summary["already_present"] else ""
+        output.info(f"Nothing to change on '{summary['tag']} · {summary['method']}'{note}.")
+        return GatewayResult(target.service_name, target.config_code, target.environment, target.region_name, False, summary)
+
+    if inv.show_summary:
+        rows = [
+            ("Service", f"{target.service_name} ({target.environment} / {target.region_name})"),
+            ("Route group", f"{summary['tag']} · {summary['method']}" + ("  (new group)" if summary["new_group"] else "")),
+            ("Auth", "JWT required" if summary["auth"] == "jwt" else "public"),
+        ]
+        rows += [("Add path", p) for p in summary["added"]]
+        rows += [("Remove path", p) for p in summary["removed"]]
+        rows += [("Rename path", f"{a}  →  {b}") for a, b in summary["renamed"]]
+        if summary["already_present"]:
+            rows.append(("Already present", ", ".join(summary["already_present"])))
+        if sorted(summary["plugins"]["from"]) != sorted(summary["plugins"]["to"]):
+            rows.append(("Plugins", f"{', '.join(summary['plugins']['from']) or '–'}  →  {', '.join(summary['plugins']['to']) or '–'}"))
+        if summary["priority"]["from"] != summary["priority"]["to"]:
+            rows.append(("Priority", f"{summary['priority']['from']}  →  {summary['priority']['to']}"))
+        output.err_console.print(kv_table(rows, title="Gateway change"))
+    inv.confirm("Save this route change as a draft for review?")
+
+    draft = kong_api.save_gateway_draft(inv.api, target.config_code, [save])
+    approval = draft.get("approval") or {}
+    queue_code, queue_status = approval.get("code"), approval.get("status")
+    output.info(f"Route change saved as draft {queue_code or ''} ({queue_status or 'draft'}). "
+                f"Nothing reaches Kong until it is submitted, approved and deployed.")
+    return GatewayResult(target.service_name, target.config_code, target.environment, target.region_name, True, summary,
+                         queue_code=queue_code, queue_status=queue_status)
+
+
+def routes_table(cards: list[dict], title: str):
+    rows = []
+    for c in cards:
+        pend = "; ".join(
+            f"{p['status']}: " + ", ".join([f"+{a}" for a in p["added"]] + [f"-{r}" for r in p["removed"]] + [f"{a}→{b}" for a, b in p["renamed"]])
+            for p in c["pending"]
+        )
+        rows.append((c["method"], "JWT" if c["auth"] == "jwt" else "public", c["tag"],
+                     "\n".join(p["path"] + ("" if p["deployed"] else "  (not deployed)") for p in c["paths"]) or "–",
+                     c["priority"], ", ".join(c["plugins"]) or "–", pend or "–"))
+    return rows_table(["Method", "Auth", "Tag", "Paths", "Priority", "Plugins", "Pending"], rows, title=title)

devlift_cli/ops/placement.py

@@ -0,0 +1,128 @@
+"""Turn --app / --env / --region flags (any of them missing) into a Placement,
+prompting on a terminal and failing cleanly under --no-input.
+
+Plus the second half of placement, the one the dashboard cares about: which
+AWS account and cloud region the resource sits in on the canvas.
+"""
+
+from __future__ import annotations
+
+from devlift_cli.api import vpc
+from devlift_cli.context import Invocation
+from devlift_cli.errors import CliError, InputError
+from devlift_cli.render import output
+from devlift_cli.resolve import allowlist
+from devlift_cli.resolve.names import ENVIRONMENTS, Placement, Resolver
+
+# Only a tiebreaker: used when one account owns several cloud regions, which
+# the per-geo account layout normally prevents. Mirrors the backend's
+# `_GEO_TO_AWS_REGION` (devlift_mcp/dispatcher.py) and the web's
+# `resolveRegionFromGeoCode`.
+_GEO_TO_AWS_REGION = {
+    "mumbai": "ap-south-1", "london": "eu-west-2", "uk": "eu-west-2", "us": "us-east-1",
+}
+
+
+def _region_for_geo(geo_loc_mst_code: str) -> str | None:
+    """`region-<tenant>-mumbai` → `ap-south-1`, by the shared naming convention."""
+    parts = geo_loc_mst_code.lower().split("-")
+    suffix = "-".join(parts[2:]) if len(parts) >= 3 and parts[0] == "region" else parts[-1]
+    return _GEO_TO_AWS_REGION.get(suffix) or _GEO_TO_AWS_REGION.get(parts[-1])
+
+
+def canvas_placement(inv: Invocation, placement: Placement, vendor: str = "aws") -> dict:
+    """{accountId, cloudRegion, cloudRegionId} for this placement, or {}.
+
+    Stored in the resource's `type_specific_config` so the dashboard canvas
+    can place the node. A resource without it deploys perfectly well and is
+    invisible on the canvas, which is the confusing part, so a miss is
+    reported to the caller rather than swallowed.
+    """
+    try:
+        context = vpc.placement_context(inv.api, placement.application_code, placement.environment)
+    except CliError as exc:
+        output.warn(f"Could not read the canvas placement context: {exc}")
+        return {}
+
+    want = placement.geo_loc_mst_code.lower()
+    geo = next((g for g in context.get("geoLocations") or [] if (g.get("geoLocCode") or "").lower() == want), None)
+    if geo is None:
+        return {}
+    account = next(
+        (a for a in context.get("accounts") or []
+         if a.get("geoLocationId") == geo.get("id") and (a.get("vendor") or "").lower() == vendor.lower()),
+        None,
+    )
+    if account is None:
+        return {}
+
+    regions = [c for c in context.get("cloudRegions") or [] if c.get("accountId") == account.get("id")]
+    if len(regions) == 1:
+        region = regions[0]
+    else:
+        wanted = _region_for_geo(placement.geo_loc_mst_code)
+        region = next((c for c in regions if c.get("name") == wanted), None)
+    if region is None:
+        return {}
+
+    return {
+        "accountId": account.get("accountId"),
+        "cloudRegion": region.get("name"),
+        "cloudRegionId": region.get("id"),
+    }
+
+
+def resolve_placement(
+    inv: Invocation, res: Resolver, app: str | None, env: str | None, region: str | None,
+    service: str | None = None,
+) -> Placement:
+    """The product, environment and region to place a resource in.
+
+    `service` is the placement-allowlist key for what is being created (`s3`,
+    `sqs`, `dynamo`, `eks`, `gateway`). When given, only the combinations the
+    tenant's allowlist really offers are proposed or accepted — the backend
+    lists every region for every product, which is wider than what exists.
+    """
+    rows_all = allowlist.filter_placements(res.placements(), res.tenant_code(), service)
+    offered = allowlist.describe(res.tenant_code(), service)
+    if not rows_all:
+        raise InputError(
+            f"Nothing in this tenant offers {service}." if service else "No placements are configured.",
+            hint="Check the placement allowlist shipped with this CLI.",
+        )
+
+    if app is None:
+        names = sorted({r["product"] for r in rows_all})
+        app = names[0] if len(names) == 1 else inv.ask("Application", choices=names, flag="--app")
+    application = res.application(app)
+    rows = [r for r in rows_all if r["application_code"] == application["application_code"]]
+    if not rows:
+        raise InputError(
+            f"'{application['application_name']}' does not offer {service}." if service
+            else f"Application '{application['application_name']}' has no placements configured.",
+            hint=f"Available: {offered}." if offered else None,
+        )
+
+    if env is None:
+        envs = sorted({r["environment"] for r in rows}, key=lambda e: ENVIRONMENTS.index(e) if e in ENVIRONMENTS else 99)
+        env = envs[0] if len(envs) == 1 else inv.ask("Environment", choices=envs, flag="--env")
+    environment = res.environment(env)
+    in_env = [r for r in rows if r["environment"] == environment]
+    if not in_env:
+        raise InputError(
+            f"'{application['application_name']}' does not offer {service} in {environment}." if service
+            else f"'{application['application_name']}' is not set up for {environment}.",
+            hint=f"Available: {offered}." if offered else "Environments: " + ", ".join(sorted({r['environment'] for r in rows})),
+        )
+
+    if region is None:
+        regions = sorted({r["region"] for r in in_env})
+        region = regions[0] if len(regions) == 1 else inv.ask("Region", choices=regions, flag="--region")
+    wanted = region.strip().casefold()
+    if not any(wanted in (r["region"].casefold(), str(r["geo_loc_mst_code"]).casefold()) for r in in_env):
+        raise InputError(
+            f"{service or 'That resource'} is not offered in '{region}' for "
+            f"{application['application_name']}/{environment}.",
+            hint="Available there: " + ", ".join(sorted({r["region"] for r in in_env})) + ".",
+        )
+    return res.placement(application["application_name"], environment, region)