fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/standalone_transfer_cleanup.py

@@ -0,0 +1,237 @@
+"""Remove managed-host transfer residue after a converged standalone application run."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import shutil
+import stat
+import sys
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+
+from fdai_deployment_cli.deployment_progress import begin_stage, progress_detail
+from fdai_deployment_cli.standalone_host_state import (
+    absolute,
+    acquire_checkpoint_lock,
+    private_directory,
+)
+
+PRUNE_SCHEMA = "fdai.standalone-transfer-prune.v1"
+_MODULE = "fdai_deployment_cli.standalone_transfer_cleanup"
+_TRANSFER = re.compile(r"\.fdai-transfer-[0-9a-f]{24}")
+_CLAIM_SUFFIX = "-claim.json"
+# Re-derivable copies and credential caches; claims, receipts, reviews, plans, and migration
+# evidence stay with any directory whose claim has no receipt.
+_DISPOSABLE_ROOT = ("kit", "kit.tar.gz", "venv")
+_DISPOSABLE_APPLICATION = ("kit-work", "oci", "runtime-venv", "azure", "aks.kubeconfig")
+_PROVIDER_DATA_PREFIX = "terraform-data"
+
+
+def cleanup_remote_transfers(
+    tunnel: Any,
+    *,
+    transient_paths: tuple[str, ...],
+    remote_approval: str,
+    prune: Callable[[], dict[str, Any]],
+) -> None:
+    """Remove this run's transient files, then prune transfers that earlier kits left."""
+
+    if not transient_paths:
+        raise ValueError("standalone remote transient cleanup has no transfer paths")
+    begin_stage("cleanup")
+    progress_detail("Removing transient transfers and verifying their absence")
+    cleanup = tunnel.ssh(("rm", "-f", "--", *transient_paths, remote_approval), timeout=300)
+    absent = [
+        tunnel.ssh(("test", "!", "-e", path), timeout=60)
+        for path in (*transient_paths, remote_approval)
+    ]
+    if any(result.returncode != 0 for result in (cleanup, *absent)):
+        raise ValueError("standalone remote transient cleanup is incomplete")
+    try:
+        report = validate_prune_report(prune())
+    except ValueError as exc:
+        progress_detail(f"Superseded managed-host transfers were not pruned: {exc}")
+        return
+    freed = max(0, report["free_bytes_after"] - report["free_bytes_before"])
+    progress_detail(
+        f"Pruned {len(report['removed'])} superseded transfer(s), kept the evidence of "
+        f"{len(report['preserved'])}, skipped {len(report['skipped'])}; "
+        f"{freed / 1_000_000_000:.1f} GB freed"
+    )
+
+
+def validate_prune_report(value: object) -> dict[str, Any]:
+    """Accept only the bounded host prune report this package produces."""
+
+    if not isinstance(value, dict) or value.get("schema_version") != PRUNE_SCHEMA:
+        raise ValueError("managed-host prune report is invalid")
+    removed, preserved, skipped = value.get("removed"), value.get("preserved"), value.get("skipped")
+    if (
+        not isinstance(removed, list)
+        or not isinstance(preserved, list)
+        or not isinstance(skipped, list)
+        or any(not isinstance(name, str) or _TRANSFER.fullmatch(name) is None for name in removed)
+        or any(
+            not isinstance(item, dict)
+            or _TRANSFER.fullmatch(str(item.get("name"))) is None
+            or not isinstance(item.get("unmatched_claims"), list)
+            or not item["unmatched_claims"]
+            for item in preserved
+        )
+        or any(
+            not isinstance(item, dict) or _TRANSFER.fullmatch(str(item.get("name"))) is None
+            for item in skipped
+        )
+        or any(type(value.get(key)) is not int for key in ("free_bytes_before", "free_bytes_after"))
+    ):
+        raise ValueError("managed-host prune report is invalid")
+    return value
+
+
+def prune_superseded_transfers(work_dir: Path) -> dict[str, object]:
+    """Prune transfer directories from earlier kits once the current application converged."""
+
+    current = work_dir.parent
+    home = current.parent
+    if work_dir.name != "application" or _TRANSFER.fullmatch(current.name) is None:
+        raise ValueError("managed-host transfer layout is invalid")
+    if not (work_dir / "application-receipt.json").is_file():
+        raise ValueError("superseded transfers are pruned only after the application converges")
+    free_before = shutil.disk_usage(home).free
+    removed: list[str] = []
+    preserved: list[dict[str, object]] = []
+    skipped: list[dict[str, str]] = []
+    for entry in sorted(home.iterdir(), key=lambda path: path.name):
+        if entry.name == current.name or _TRANSFER.fullmatch(entry.name) is None:
+            continue
+        reason = _prune_one(entry, removed, preserved)
+        if reason is not None:
+            skipped.append({"name": entry.name, "reason": reason})
+    return {
+        "schema_version": PRUNE_SCHEMA,
+        "removed": removed,
+        "preserved": preserved,
+        "skipped": skipped,
+        "free_bytes_before": free_before,
+        "free_bytes_after": shutil.disk_usage(home).free,
+        "mutation_performed": bool(removed or preserved),
+        "subscription_ready": False,
+    }
+
+
+def _prune_one(entry: Path, removed: list[str], preserved: list[dict[str, object]]) -> str | None:
+    details = entry.lstat()
+    if not stat.S_ISDIR(details.st_mode) or details.st_uid != os.geteuid():
+        return "not-an-owned-directory"
+    application = entry / "application"
+    if os.path.lexists(application) and (application.is_symlink() or not application.is_dir()):
+        return "unexpected-layout"
+    lock: int | None = None
+    try:
+        if application.is_dir():
+            lock = acquire_checkpoint_lock(application)
+        unmatched = _unmatched_claims(application)
+        if unmatched:
+            for path in _disposable_paths(entry, application):
+                _remove(path)
+            preserved.append({"name": entry.name, "unmatched_claims": unmatched})
+            return None
+        _remove(entry)
+        removed.append(entry.name)
+        return None
+    except (OSError, ValueError):
+        return "in-use-or-not-removable"
+    finally:
+        if lock is not None:
+            os.close(lock)
+
+
+def _unmatched_claims(application: Path) -> list[str]:
+    if not application.is_dir():
+        return []
+    return sorted(
+        claim.name
+        for claim in application.glob(f"*{_CLAIM_SUFFIX}")
+        if not os.path.lexists(
+            application / f"{claim.name.removesuffix(_CLAIM_SUFFIX)}-receipt.json"
+        )
+    )
+
+
+def _disposable_paths(entry: Path, application: Path) -> list[Path]:
+    paths = [entry / name for name in _DISPOSABLE_ROOT]
+    if application.is_dir():
+        paths.extend(application / name for name in _DISPOSABLE_APPLICATION)
+        paths.extend(
+            child for child in application.iterdir() if child.name.startswith(_PROVIDER_DATA_PREFIX)
+        )
+    return [path for path in paths if os.path.lexists(path)]
+
+
+def _remove(path: Path) -> None:
+    if path.is_symlink() or not path.is_dir():
+        path.unlink()
+    else:
+        shutil.rmtree(path)
+    if os.path.lexists(path):
+        raise OSError("managed-host transfer residue remains after removal")
+
+
+def remote_prune(
+    tunnel: Any, *, remote_root: str, work_dir: str, timeout: int = 1800
+) -> dict[str, Any]:
+    """Run the managed-host prune from the current transfer's environment and validate it."""
+
+    result = tunnel.ssh(
+        (f"{remote_root}/venv/bin/python", "-m", _MODULE, "--work-dir", work_dir),
+        timeout=timeout,
+    )
+    if result.returncode != 0:
+        raise ValueError("managed-host prune failed")
+    try:
+        value = json.loads(result.stdout)
+    except (TypeError, json.JSONDecodeError) as exc:
+        raise ValueError("managed-host prune report is invalid") from exc
+    return validate_prune_report(value)
+
+
+def main(argv: list[str] | None = None) -> int:
+    """Prune superseded transfers under the current application's checkpoint lock."""
+
+    parser = argparse.ArgumentParser(prog=f"python -m {_MODULE}")
+    parser.add_argument("--work-dir", type=Path, required=True)
+    args = parser.parse_args(argv)
+    work_dir = absolute(args.work_dir)
+    lock: int | None = None
+    try:
+        if not work_dir.is_dir():
+            raise ValueError("managed-host transfer layout is invalid")
+        private_directory(work_dir)
+        lock = acquire_checkpoint_lock(work_dir)
+        report = prune_superseded_transfers(work_dir)
+    except (OSError, ValueError):
+        print(json.dumps({"schema_version": PRUNE_SCHEMA, "state": "refused"}), file=sys.stderr)
+        return 3
+    finally:
+        if lock is not None:
+            os.close(lock)
+    print(json.dumps(report, sort_keys=True, separators=(",", ":")))
+    return 0
+
+
+__all__ = [
+    "PRUNE_SCHEMA",
+    "cleanup_remote_transfers",
+    "main",
+    "prune_superseded_transfers",
+    "remote_prune",
+    "validate_prune_report",
+]
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

fdai_deployment_cli/standalone_trial_activation.py

@@ -0,0 +1,193 @@
+"""Open the installation's Trial window during deployment, at its anchored creation time.
+
+The window is anchored to the Terraform-recorded first-apply time of the installation,
+never to the time of this run, so a rerun, an upgrade, or a recreated record cannot
+renew it. The Core writer keeps a retained record unchanged and refuses one bound to
+another installation; this step only supplies the bindings and records the outcome.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import subprocess
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+
+from fdai_deployment_cli import standalone_planned_outputs
+from fdai_deployment_cli.contracts import canonical_digest
+from fdai_deployment_cli.standalone_host_state import private_json, replace_private_json
+from fdai_deployment_cli.standalone_host_values import vault_name
+
+_SCHEMA = "fdai.standalone-trial-activation-receipt.v1"
+_WRITER_SCHEMA = "fdai.trial-activation.v1"
+_DIGEST = re.compile(r"[0-9a-f]{64}")
+_RUNTIME_NAME = re.compile(r"[a-z][a-z0-9-]{1,62}")
+
+
+def deployment_binding_digest(context: dict[str, Any], runtime_name: str) -> str:
+    """Bind one deployment to its tenant, subscription, and runtime without naming them."""
+
+    if _RUNTIME_NAME.fullmatch(runtime_name) is None:
+        raise ValueError("Terraform runtime name is invalid")
+    material = f"{context['tenant_id']}\0{context['subscription_id']}\0{runtime_name}"
+    return hashlib.sha256(material.encode()).hexdigest()
+
+
+def activate_trial(
+    context: dict[str, Any],
+    work_dir: Path,
+    *,
+    login: Callable[[dict[str, object], Path], None],
+) -> dict[str, object]:
+    """Run the Core writer once and persist a sanitized, digest-bound receipt."""
+
+    receipt_path = work_dir / "trial-activation-receipt.json"
+    if receipt_path.exists():
+        return require_trial_activation_receipt(
+            private_json(receipt_path, "standalone Trial activation receipt")
+        )
+    if not all(
+        (work_dir / name).is_file()
+        for name in ("migration-receipt.json", "application-receipt.json")
+    ):
+        raise ValueError("Trial activation requires the migrated and applied application")
+    deployment_binding = str(context.get("deployment_binding", ""))
+    if _DIGEST.fullmatch(deployment_binding) is None:
+        raise ValueError("Trial activation requires the prepared deployment binding")
+    login(context, work_dir)
+    infra = Path(str(context["infra"]))
+    installation_binding = _output(infra, "installation_binding")
+    if _DIGEST.fullmatch(installation_binding) is None:
+        raise ValueError("Terraform installation binding is invalid")
+    activated_at = _output(infra, "installation_created_at")
+    bundle = infra.parent
+    result = subprocess.run(
+        (
+            str(work_dir / "runtime-venv/bin/python"),
+            "-m",
+            "fdai.runtime.licensing_trial_activation",
+            "--installation-binding",
+            installation_binding,
+            "--deployment-binding",
+            deployment_binding,
+            "--activated-at",
+            activated_at,
+        ),
+        cwd=bundle,
+        env={
+            **os.environ,
+            "FDAI_STATE_STORE_DSN": _state_store_dsn(infra, work_dir),
+            "PYTHONPATH": os.pathsep.join(
+                (
+                    str(bundle / "services/core-control-plane/src"),
+                    str(bundle / "packages/service-contracts/src"),
+                )
+            ),
+        },
+        check=False,
+        capture_output=True,
+        text=True,
+        timeout=300,
+    )
+    if result.returncode != 0:
+        raise ValueError("Trial activation failed")
+    window = _writer_result(result.stdout)
+    receipt: dict[str, object] = {
+        "schema_version": _SCHEMA,
+        "state": "activated",
+        "activated_at": window["activated_at"],
+        "expires_at": window["expires_at"],
+        "window_ended": window["window_ended"],
+        "clock_blocked": window["clock_blocked"],
+        "effect_verified": True,
+        "mutation_performed": True,
+        "subscription_ready": False,
+    }
+    receipt["receipt_digest"] = canonical_digest(receipt)
+    replace_private_json(receipt_path, receipt)
+    return receipt
+
+
+def require_trial_activation_receipt(value: dict[str, Any]) -> dict[str, Any]:
+    """Accept only a digest-bound receipt for a committed, read-back Trial window."""
+
+    material = {key: item for key, item in value.items() if key != "receipt_digest"}
+    if (
+        value.get("receipt_digest") != canonical_digest(material)
+        or value.get("schema_version") != _SCHEMA
+        or value.get("state") != "activated"
+        or not isinstance(value.get("activated_at"), str)
+        or not isinstance(value.get("expires_at"), str)
+        or type(value.get("window_ended")) is not bool
+        or type(value.get("clock_blocked")) is not bool
+        or value.get("effect_verified") is not True
+        or value.get("mutation_performed") is not True
+        or value.get("subscription_ready") is not False
+    ):
+        raise ValueError("standalone Trial activation receipt is invalid")
+    return value
+
+
+def _writer_result(stdout: str) -> dict[str, Any]:
+    try:
+        value = json.loads(stdout)
+    except json.JSONDecodeError as error:
+        raise ValueError("Trial activation result is invalid") from error
+    if (
+        not isinstance(value, dict)
+        or value.get("schema_version") != _WRITER_SCHEMA
+        or value.get("outcome") != "retained"
+        or not isinstance(value.get("activated_at"), str)
+        or not isinstance(value.get("expires_at"), str)
+        or type(value.get("window_ended")) is not bool
+        or type(value.get("clock_blocked")) is not bool
+    ):
+        raise ValueError("Trial activation result is invalid")
+    return value
+
+
+def _state_store_dsn(infra: Path, work_dir: Path) -> str:
+    result = subprocess.run(
+        (
+            "az",
+            "keyvault",
+            "secret",
+            "show",
+            "--vault-name",
+            vault_name(_output(infra, "key_vault_uri")),
+            "--name",
+            "fdai-state-store-dsn",
+            "--query",
+            "value",
+            "--output",
+            "tsv",
+            "--only-show-errors",
+        ),
+        cwd=work_dir,
+        check=False,
+        capture_output=True,
+        text=True,
+        timeout=120,
+    )
+    dsn = result.stdout.strip() if result.returncode == 0 else ""
+    if not dsn or any(character in dsn for character in "\r\n"):
+        raise ValueError("Trial activation database reference is unavailable")
+    return dsn
+
+
+def _output(infra: Path, name: str) -> str:
+    value = standalone_planned_outputs.read_output(
+        infra, name, raw=True, reason="Terraform output readback failed"
+    )
+    return str(value)
+
+
+__all__ = [
+    "activate_trial",
+    "deployment_binding_digest",
+    "require_trial_activation_receipt",
+]