fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/azure_retail_prices.py

@@ -0,0 +1,173 @@
+"""Read bounded public Linux VM retail prices without Azure identity or mutation."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import urllib.error
+import urllib.parse
+import urllib.request
+from datetime import UTC, datetime
+from decimal import Decimal, InvalidOperation
+from typing import Any
+
+from fdai_deployment_cli.deployment_deadline import DeploymentDeadline
+
+_ENDPOINT = "https://prices.azure.com/api/retail/prices"
+_MAX_BYTES = 2 * 1024 * 1024
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args: Any, **kwargs: Any) -> None:
+        raise ValueError("Azure retail price redirects are not supported")
+
+
+def read_linux_vm_price(*, sku: str, region: str, timeout_seconds: int = 90) -> dict[str, object]:
+    """Fetch one complete exact-SKU catalog and select a unique primary USD hourly rate.
+
+    At most four pages share one deadline. Redirects, foreign continuation URLs,
+    repeated pages, malformed responses and ambiguous prices fail without retry.
+    """
+    if (
+        re.fullmatch(r"Standard_[A-Za-z0-9_]{1,80}", sku) is None
+        or re.fullmatch(r"[a-z][a-z0-9]{1,40}", region) is None
+    ):
+        raise ValueError("Azure retail price selection is invalid")
+    deadline = DeploymentDeadline(timeout_seconds)
+    query = urllib.parse.urlencode(
+        {
+            "$filter": f"armSkuName eq '{sku}' and armRegionName eq '{region}' and serviceName eq 'Virtual Machines' and priceType eq 'Consumption'",
+            "currencyCode": "USD",
+        }
+    )
+    url = f"{_ENDPOINT}?{query}"
+    seen: set[str] = set()
+    rows: list[object] = []
+    evidence = hashlib.sha256()
+    opener = urllib.request.build_opener(_NoRedirect())
+    for _page in range(4):
+        parsed = urllib.parse.urlsplit(url)
+        if (
+            parsed.scheme != "https"
+            or parsed.netloc != "prices.azure.com"
+            or parsed.path != "/api/retail/prices"
+            or parsed.fragment
+            or url in seen
+        ):
+            raise ValueError("Azure retail price continuation is invalid")
+        seen.add(url)
+        try:
+            with opener.open(url, timeout=deadline.remaining(30)) as response:
+                chunks = bytearray()
+                while len(chunks) <= _MAX_BYTES:
+                    deadline.remaining()
+                    chunk = response.read1(min(65536, _MAX_BYTES + 1 - len(chunks)))
+                    if not chunk:
+                        break
+                    chunks.extend(chunk)
+                payload = bytes(chunks)
+        except (OSError, urllib.error.URLError):
+            raise ValueError(
+                "Azure retail price observation unavailable; no retry performed"
+            ) from None
+        deadline.remaining()
+        if len(payload) > _MAX_BYTES:
+            raise ValueError("Azure retail price observation exceeds its bound")
+        evidence.update(hashlib.sha256(payload).digest())
+        page = json.loads(payload, parse_float=Decimal)
+        if (
+            not isinstance(page, dict)
+            or not isinstance(page.get("Items"), list)
+            or "NextPageLink" not in page
+            or len(page["Items"]) > 1000
+            or type(page.get("Count")) is not int
+            or page["Count"] != len(page["Items"])
+        ):
+            raise ValueError("Azure retail price page is invalid")
+        rows.extend(page["Items"])
+        next_page = page.get("NextPageLink")
+        if next_page in (None, ""):
+            now = datetime.now(UTC)
+            result = select_linux_vm_price(rows, sku=sku, region=region, now=now)
+            deadline.remaining()
+            return {
+                **result,
+                "observed_at": now.isoformat(),
+                "catalog_digest": evidence.hexdigest(),
+            }
+        if not isinstance(next_page, str) or len(next_page) > 8192:
+            raise ValueError("Azure retail price continuation is invalid")
+        url = next_page
+    raise ValueError("Azure retail price catalog exceeds the page limit")
+
+
+def select_linux_vm_price(
+    rows: list[object], *, sku: str, region: str, now: datetime
+) -> dict[str, object]:
+    """Select standard Linux consumption, never Windows, Spot, reservation or a foreign meter."""
+    if now.tzinfo is None or now.utcoffset() is None:
+        raise ValueError("Azure retail price selection requires an aware time")
+    matches = []
+    for row in rows:
+        if not isinstance(row, dict):
+            raise ValueError("Azure retail price row is invalid")
+        product, meter, sku_name = row.get("productName"), row.get("meterName"), row.get("skuName")
+        if (
+            not isinstance(product, str)
+            or not isinstance(meter, str)
+            or not isinstance(sku_name, str)
+        ):
+            raise ValueError("Azure retail price labels are incomplete")
+        if (
+            row.get("armSkuName") != sku
+            or row.get("armRegionName") != region
+            or row.get("serviceName") != "Virtual Machines"
+            or row.get("type") != "Consumption"
+            or row.get("currencyCode") != "USD"
+            or row.get("unitOfMeasure") != "1 Hour"
+            or row.get("isPrimaryMeterRegion") is not True
+            or row.get("tierMinimumUnits") != 0
+            or type(row.get("tierMinimumUnits")) is bool
+            or not product.startswith("Virtual Machines ")
+            or any(
+                token in f"{product} {meter} {sku_name}".casefold()
+                for token in ("windows", "spot", "low priority")
+            )
+        ):
+            continue
+        try:
+            effective = datetime.fromisoformat(
+                str(row.get("effectiveStartDate")).replace("Z", "+00:00")
+            )
+            raw_rate = row.get("retailPrice")
+            if isinstance(raw_rate, bool) or not isinstance(raw_rate, (int, float, Decimal)):
+                raise ValueError("invalid price")
+            rate = Decimal(str(raw_rate))
+            if (
+                not rate.is_finite()
+                or not Decimal(0) < rate <= Decimal(1000000)
+                or not -12 <= rate.adjusted() <= 6
+                or len(rate.as_tuple().digits) > 18
+            ):
+                raise ValueError("invalid price")
+        except (ValueError, InvalidOperation):
+            raise ValueError("Azure retail price or effective time is invalid") from None
+        if effective.tzinfo is None:
+            raise ValueError("Azure retail price effective time is not timezone aware")
+        if effective > now:
+            continue
+        matches.append((rate, effective))
+    if len(matches) != 1:
+        raise ValueError("Azure Linux VM retail price is missing or ambiguous")
+    rate, effective = matches[0]
+    return {
+        "sku": sku,
+        "region": region,
+        "currency": "USD",
+        "unit": "hour",
+        "hourly_rate": format(rate, "f"),
+        "effective_at": effective.isoformat(),
+        "pricing_basis": "public-linux-consumption",
+        "billing_cap_enforced": False,
+    }

fdai_deployment_cli/bootstrap_approval.py

@@ -0,0 +1,99 @@
+"""Scoped approval-source injection; terminal execution remains the default."""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Iterator
+from contextlib import contextmanager
+from contextvars import ContextVar
+from datetime import UTC, datetime
+from typing import Any
+
+ApprovalSource = Callable[[dict[str, object]], dict[str, object]]
+_SOURCE: ContextVar[ApprovalSource | None] = ContextVar("bootstrap_approval_source", default=None)
+
+
+@contextmanager
+def approval_source(source: ApprovalSource) -> Iterator[None]:
+    """Select a human decision adapter for this operation, without changing input()."""
+    token = _SOURCE.set(source)
+    try:
+        yield
+    finally:
+        _SOURCE.reset(token)
+
+
+def selected_source() -> ApprovalSource | None:
+    return _SOURCE.get()
+
+
+def require_decision(review: dict[str, object]) -> None:
+    """Reject missing, denied, expired or differently bound adapter decisions."""
+    source = selected_source()
+    if source is None:
+        raise ValueError("No injected approval source is selected")
+    if datetime.fromisoformat(str(review["expires_at"])) <= datetime.now(UTC):
+        raise ValueError("Exact checkpoint review has expired")
+    decision = source(dict(review))
+    if (
+        not isinstance(decision, dict)
+        or decision.get("approved") is not True
+        or decision.get("digest") != review["digest"]
+        or decision.get("confirmation") != review["confirmation_required"]
+        or datetime.fromisoformat(str(review["expires_at"])) <= datetime.now(UTC)
+    ):
+        raise ValueError("Exact checkpoint approval was denied, expired or mismatched")
+
+
+def approve_application_checkpoint(
+    review: dict[str, Any],
+    stage: str,
+    destructive: int,
+    *,
+    actor_digest: Callable[[], str],
+) -> tuple[str, str | None]:
+    """Return the exact operation and pre-review actor; None keeps terminal approval."""
+    historical_reconciliation = review.get("historical_reconciliation")
+    residual_recovery = review.get("residual_recovery")
+    residual_successor = review.get("residual_successor")
+    operation = (
+        str(residual_successor["operation"])
+        if isinstance(residual_successor, dict)
+        else str(residual_recovery["operation"])
+        if isinstance(residual_recovery, dict)
+        else str(historical_reconciliation["operation"])
+        if isinstance(historical_reconciliation, dict)
+        else stage
+    )
+    if selected_source() is None:
+        return operation, None
+    actor_before = actor_digest()
+    expected = f"{operation}-apply"
+    require_decision(
+        {
+            "digest": str(review["review_digest"]),
+            "title": f"Approve exact {operation} plan",
+            "details": [
+                f"Plan digest: {review['plan_digest']}",
+                f"Source commit: {review['source_commit']}",
+                f"Delete or replacement actions: {destructive}",
+                "Action counts: "
+                + ", ".join(
+                    f"{action}={count}"
+                    for action, count in sorted(review["summary"]["action_counts"].items())
+                ),
+                *(
+                    f"Resource type {name}: {count}"
+                    for name, count in sorted(
+                        review["summary"].get("resource_type_counts", {}).items()
+                    )
+                ),
+                *(
+                    f"{','.join(change['actions'])}: {change['address']}"
+                    for change in review["summary"].get("resource_changes", [])
+                ),
+            ],
+            "confirmation_required": f"{expected}-destructive" if destructive else expected,
+            "expires_at": str(review["expires_at"]),
+        }
+    )
+    return operation, actor_before

fdai_deployment_cli/bootstrap_channel.py

@@ -0,0 +1,321 @@
+"""Private, bounded, atomic IPC for the customer-side first-install worker."""
+
+from __future__ import annotations
+
+import fcntl
+import json
+import os
+import re
+import stat
+import time
+from collections.abc import Iterator
+from contextlib import contextmanager
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+from uuid import UUID, uuid4
+
+from fdai_deployment_cli.contracts import load_json_object
+
+MAX_BYTES = 65536
+STALE_SECONDS = 12
+INSTALL_FIELDS = {
+    "subscription_id",
+    "region",
+    "monthly_cost_ceiling",
+    "artifact_source",
+    "source_root",
+    "hub_public_key",
+}
+
+
+def prepare_directory(root: Path) -> None:
+    """Create an owner-only IPC root; refuse symlinks and unsafe existing paths."""
+    root = root.absolute()
+    for path in (*reversed(root.parents), root):
+        if path.is_symlink():
+            raise ValueError("Bootstrap directory must not contain symlinks")
+    root.mkdir(mode=0o700, parents=True, exist_ok=True)
+    info = root.lstat()
+    if (
+        not stat.S_ISDIR(info.st_mode)
+        or info.st_uid != os.getuid()
+        or stat.S_IMODE(info.st_mode) != 0o700
+    ):
+        raise ValueError("Bootstrap directory must be owned by this user with mode 0700")
+
+
+def _read(root: Path, name: str = "channel.json") -> dict[str, Any]:
+    path = root / name
+    try:
+        fd = os.open(path, os.O_RDONLY | os.O_NONBLOCK | os.O_NOFOLLOW)
+    except FileNotFoundError:
+        return {}
+    except OSError as exc:
+        raise ValueError("Bootstrap private file is unavailable or unsafe") from exc
+    with os.fdopen(fd, "rb") as stream:
+        info = os.fstat(stream.fileno())
+        if (
+            not stat.S_ISREG(info.st_mode)
+            or info.st_uid != os.getuid()
+            or stat.S_IMODE(info.st_mode) != 0o600
+            or info.st_nlink != 1
+        ):
+            raise ValueError("Bootstrap private files require mode 0600 and one owner")
+        raw = stream.read(MAX_BYTES + 1)
+    try:
+        value = load_json_object(raw, label="Bootstrap state", max_bytes=MAX_BYTES, strict=True)
+    except (ValueError, UnicodeError) as exc:
+        raise ValueError("Bootstrap state is malformed; preserve the private directory") from exc
+    if len(raw) > MAX_BYTES or not isinstance(value, dict):
+        raise ValueError("Bootstrap state exceeds its bounded object schema")
+    return value
+
+
+def _write(root: Path, value: dict[str, object], name: str = "channel.json") -> None:
+    raw = json.dumps(value, separators=(",", ":"), allow_nan=False).encode()
+    if len(raw) > MAX_BYTES:
+        raise ValueError("Bootstrap state exceeds its size bound")
+    target = root / name
+    if target.is_symlink():
+        raise ValueError("Bootstrap private files must not be symlinks")
+    staging = root / f".write-{uuid4().hex}"
+    fd = os.open(staging, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
+    try:
+        with os.fdopen(fd, "wb") as stream:
+            stream.write(raw)
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(staging, target)
+        directory = os.open(root, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(directory)
+        finally:
+            os.close(directory)
+    finally:
+        staging.unlink(missing_ok=True)
+
+
+@contextmanager
+def locked(root: Path) -> Iterator[None]:
+    prepare_directory(root)
+    fd = os.open(root / "channel.lock", os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW, 0o600)
+    try:
+        info = os.fstat(fd)
+        if (
+            not stat.S_ISREG(info.st_mode)
+            or stat.S_IMODE(info.st_mode) != 0o600
+            or info.st_uid != os.getuid()
+            or info.st_nlink != 1
+        ):
+            raise ValueError("Bootstrap lock is unsafe")
+        deadline = time.monotonic() + 5
+        while True:
+            try:
+                fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                break
+            except BlockingIOError as exc:
+                if time.monotonic() >= deadline:
+                    raise ValueError(
+                        "Bootstrap state is busy; wait for the current private update."
+                    ) from exc
+                time.sleep(0.01)
+        yield
+    finally:
+        os.close(fd)
+
+
+def initial_status() -> dict[str, object]:
+    return {
+        "phase": "idle",
+        "request_id": None,
+        "action": None,
+        "message": "Sign in to Azure to begin first installation.",
+        "error_code": None,
+        "accounts": [],
+        "review": None,
+        "deployment_ready": False,
+        "console_url": None,
+    }
+
+
+def _status(record: dict[str, object]) -> dict[str, object]:
+    stored = record.get("status")
+    result = initial_status()
+    if isinstance(stored, dict):
+        result.update({key: stored[key] for key in result if key in stored})
+    if record.get("active_request_id") is not None and result["phase"] in {
+        "idle",
+        "ready",
+        "blocked",
+        "failed",
+    }:
+        result.update(
+            phase="working",
+            deployment_ready=False,
+            console_url=None,
+            message="Finalizing local executor cleanup before accepting another request.",
+        )
+    heartbeat = record.get("heartbeat")
+    if result["phase"] in {"working", "review"} and (
+        not isinstance(heartbeat, (int, float)) or time.time() - heartbeat > STALE_SECONDS
+    ):
+        result.update(
+            phase="interrupted",
+            review=None,
+            deployment_ready=False,
+            console_url=None,
+            error_code="worker_interrupted",
+            message="Worker interrupted. Inspect retained state before explicitly resuming.",
+        )
+    if result["phase"] == "ready" and result["deployment_ready"] is not True:
+        result.update(phase="blocked", message="Independent deployment acceptance is unavailable.")
+    return result
+
+
+def read_status(root: Path) -> dict[str, object]:
+    """Read only allowlisted setup metadata, never engine output or Azure credentials."""
+    with locked(root):
+        return _status(_read(root))
+
+
+def validate_request(action: str, payload: dict[str, object]) -> dict[str, object]:
+    if (
+        not isinstance(action, str)
+        or action not in {"login", "accounts", "install", "resume", "inspect"}
+        or not isinstance(payload, dict)
+    ):
+        raise ValueError("Unsupported Bootstrap action or payload")
+    try:
+        encoded = json.dumps(payload, allow_nan=False).encode()
+    except (ValueError, TypeError, RecursionError) as exc:
+        raise ValueError("Bootstrap payload must be a bounded JSON object") from exc
+    if len(encoded) > 16384:
+        raise ValueError("Bootstrap payload exceeds its size bound")
+    if action != "install":
+        if payload:
+            raise ValueError("This action accepts no replacement inputs")
+        return {}
+    if set(payload) - INSTALL_FIELDS:
+        raise ValueError("Unknown installation fields; use only the documented setup inputs")
+    subscription = payload.get("subscription_id")
+    try:
+        if not isinstance(subscription, str) or str(UUID(subscription)) != subscription.lower():
+            raise ValueError
+    except ValueError as exc:
+        raise ValueError("Select one valid Azure subscription UUID") from exc
+    region, ceiling = payload.get("region"), payload.get("monthly_cost_ceiling")
+    if not isinstance(region, str) or re.fullmatch(r"[a-z][a-z0-9]{1,31}", region) is None:
+        raise ValueError("Choose a valid Azure region token")
+    if type(ceiling) is not int or ceiling <= 0 or ceiling > 1_000_000_000:
+        raise ValueError("Monthly cost ceiling must be a positive bounded integer")
+    result = {**payload, "artifact_source": payload.get("artifact_source", "hub")}
+    if not isinstance(result["artifact_source"], str) or result["artifact_source"] not in {
+        "hub",
+        "source",
+    }:
+        raise ValueError("Artifact source must be hub or source")
+    source = payload.get("source_root")
+    if source is not None and (
+        not isinstance(source, str) or not source or len(source) > 4096 or "\0" in source
+    ):
+        raise ValueError("Source root must be a local checkout path")
+    key = payload.get("hub_public_key")
+    if result["artifact_source"] == "source":
+        if not source or key is not None:
+            raise ValueError("Source mode requires source_root and does not accept a Hub key")
+    else:
+        if not isinstance(key, str) or len(key) > 4096:
+            raise ValueError("Hub mode requires an independently supplied Ed25519 public PEM")
+        from fdai_deployment_cli.hub_image_trust import public_key
+
+        try:
+            public_key(key.encode())
+        except (ValueError, TypeError) as exc:
+            raise ValueError(
+                "Hub trust requires an Ed25519 public PEM, never a private key"
+            ) from exc
+    return result
+
+
+def submit_request(root: Path, action: str, payload: dict[str, object]) -> dict[str, object]:
+    payload = validate_request(action, payload)
+    with locked(root):
+        record = _read(root)
+        status = _status(record)
+        stored_status = record.get("status", {})
+        if (
+            record.get("pending") is not None
+            or record.get("active_request_id") is not None
+            or stored_status.get("phase") in {"working", "review"}
+        ):
+            raise ValueError(
+                "A Bootstrap request is already pending or running. "
+                "If its worker is interrupted, restart setup before explicit resume."
+            )
+        if status["phase"] == "interrupted" and action not in {
+            "inspect",
+            "resume",
+            "login",
+            "accounts",
+        }:
+            raise ValueError(
+                "Inspect or resume the interrupted installation before starting other work"
+            )
+        request_id = str(uuid4())
+        status.update(
+            phase="working",
+            request_id=request_id,
+            action=action,
+            review=None,
+            error_code=None,
+            message="Request queued for the local customer executor.",
+            deployment_ready=False,
+            console_url=None,
+        )
+        record.update(
+            status=status,
+            heartbeat=time.time(),
+            decision=None,
+            pending={"id": request_id, "action": action, "payload": payload},
+        )
+        _write(root, record)
+        return dict(status)
+
+
+def submit_decision(root: Path, payload: dict[str, object]) -> dict[str, object]:
+    fields = {"request_id", "review_id", "digest", "approved", "confirmation"}
+    if (
+        not isinstance(payload, dict)
+        or set(payload) != fields
+        or type(payload.get("approved")) is not bool
+        or any(not isinstance(payload.get(key), str) for key in fields - {"approved"})
+    ):
+        raise ValueError(
+            "Decision requires exact request, review, digest, approval and confirmation"
+        )
+    with locked(root):
+        record = _read(root)
+        status = _status(record)
+        review = status.get("review")
+        if (
+            status["phase"] != "review"
+            or not isinstance(review, dict)
+            or record.get("decision") is not None
+            or payload["request_id"] != status["request_id"]
+            or payload["review_id"] != review["id"]
+            or payload["digest"] != review["digest"]
+        ):
+            raise ValueError("Decision does not match the current pending review")
+        expires = datetime.fromisoformat(str(review["expires_at"]))
+        if expires <= datetime.now(UTC):
+            raise ValueError("Review expired; explicitly resume to obtain a fresh exact plan")
+        if payload["approved"] and payload["confirmation"] != review["confirmation_required"]:
+            raise ValueError("Type the exact confirmation shown for this checkpoint")
+        record["decision"] = payload
+        status.update(
+            phase="working", review=None, message="Decision submitted to the exact checkpoint."
+        )
+        record["status"] = status
+        _write(root, record)
+        return dict(status)