laniakea-api-server 0.2.1__tar.gz → 0.2.3__tar.gz

{laniakea_api_server-0.2.1 → laniakea_api_server-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: laniakea-api-server
-Version: 0.2.1
+Version: 0.2.3
 Summary: Laniakea Queue API — OIDC-authenticated gateway for cloud deployment orchestration
 Project-URL: Homepage, https://github.com/laniakea/laniakea-api
 Project-URL: Issues, https://github.com/laniakea/laniakea-api/issues

{laniakea_api_server-0.2.1 → laniakea_api_server-0.2.3}/laniakea_api/__init__.py

@@ -2,4 +2,4 @@
 OIDC-authenticated gateway for enqueuing cloud deployment jobs.
 """
 
-__version__ = "0.1.4"
+__version__ = "0.2.2"

{laniakea_api_server-0.2.1 → laniakea_api_server-0.2.3}/laniakea_api/auth.py

@@ -1,8 +1,8 @@
 """
 Authentication helpers
 
-It is responsible for verifying the identity of those who knock on 
-the server's door distinguishing between two types of users: 
+It is responsible for verifying the identity of those who knock on
+the server's door distinguishing between two types of users:
 human users (who pass through an OIDC Sign-in system) and worker agents
 """
 import time
@@ -20,14 +20,14 @@ _bearer = HTTPBearer()
 
 async def fetch_userinfo(oidc_token: str) -> dict:
     """
-    Takes an authentication token provided by a user and asks an external identity server 
+    Takes an authentication token provided by a user and asks an external identity server
     (the OIDC Provider) who that user actually is, retriving user info
     """
     try:
         # asynchronous HTTP to avoid waste of server resources
         async with httpx.AsyncClient(timeout=10) as client:
             # OIDC discovery
-            discovery = await client.get(OIDC_DISCOVERY_URL)    
+            discovery = await client.get(OIDC_DISCOVERY_URL)
             discovery.raise_for_status()                         # status 200: OK
             userinfo_url = discovery.json()["userinfo_endpoint"] # now final url is known
             # USER info request
@@ -52,10 +52,10 @@ async def fetch_userinfo(oidc_token: str) -> dict:
 
 def create_session_token(user_info: dict) -> tuple:
     """
-    Querying the external OIDC server for every single request would slow down the API. 
-    To avoid this behaviour, once the user has been verified by fetch_userinfo, this function 
+    Querying the external OIDC server for every single request would slow down the API.
+    To avoid this behaviour, once the user has been verified by fetch_userinfo, this function
     generates an internal JWT token:
- 
+
              It takes the user's data (sub, username, email, groups).
              It adds an expiration date based on the minutes configured in SESSION_TTL_MINUTES.
              It cryptographically signs everything with a secret key (SECRET_KEY)
@@ -64,7 +64,7 @@ def create_session_token(user_info: dict) -> tuple:
     #NOTE: act here for expiration
     expires_in = SESSION_TTL_MINUTES * 60
     now = int(time.time())
-    #NOTE: PAYLOAD 
+    #NOTE: PAYLOAD
     payload = {
         "sub":      user_info.get("sub"),
         "username": user_info.get("preferred_username") or user_info.get("sub"),
@@ -79,7 +79,7 @@ def create_session_token(user_info: dict) -> tuple:
 async def verify_session_token(credentials: HTTPAuthorizationCredentials = Depends(_bearer),) -> dict:
     """
     Check that the HTTP request contains an authorization header.
-    Takes the internal JWT token created in the previous step and checks 
+    Takes the internal JWT token created in the previous step and checks
     whether the signature is authentic (using the SECRET_KEY).
     """
     try:
@@ -98,15 +98,15 @@ async def verify_session_token(credentials: HTTPAuthorizationCredentials = Depen
         )
 
 
-async def verify_agent_token(credentials: HTTPAuthorizationCredentials = Depends(_bearer),) -> str:
+def decode_agent_token(token: str) -> str:
     """
-    This function validates the tokens used by workers.
-    It doesn't use the user's key, but a dedicated secret key 
-    called AGENT_MASTER_PASSWORD.
-    If the worker sends a valid token signed with this master password, 
-    the API trusts the worker and allows it to fetch or update the status of deployment jobs.
+    Validate an agent pool JWT (HTCondor pool-password like) and return
+    the agent id. Raises HTTPException(401) if the token is invalid.
 
-    HTCondor pool-password like.
+    Shared by:
+      - verify_agent_token (Bearer header, /internal/* endpoints)
+      - the tfstate router (HTTP Basic, Terraform http backend only
+        supports username/password: the agent JWT travels as password)
     """
     if not AGENT_MASTER_PASSWORD:
         raise HTTPException(
@@ -115,7 +115,7 @@ async def verify_agent_token(credentials: HTTPAuthorizationCredentials = Depends
         )
     try:
         payload = jwt.decode(
-            credentials.credentials,
+            token,
             AGENT_MASTER_PASSWORD,
             algorithms=["HS256"],
         )
@@ -132,3 +132,16 @@ async def verify_agent_token(credentials: HTTPAuthorizationCredentials = Depends
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail=f"Invalid agent token: {exc}",
         )
+
+
+async def verify_agent_token(credentials: HTTPAuthorizationCredentials = Depends(_bearer),) -> str:
+    """
+    This function validates the tokens used by workers.
+    It doesn't use the user's key, but a dedicated secret key
+    called AGENT_MASTER_PASSWORD.
+    If the worker sends a valid token signed with this master password,
+    the API trusts the worker and allows it to fetch or update the status of deployment jobs.
+
+    HTCondor pool-password like.
+    """
+    return decode_agent_token(credentials.credentials)

laniakea_api_server-0.2.3/laniakea_api/database.py

@@ -0,0 +1,290 @@
+"""
+PostgreSQL connection.
+The agent has NO direct DB access:
+                  **all writes go through the API**
+The Dashboard is stateless.
+"""
+
+import json
+import os
+from datetime import datetime
+from typing import Optional
+import psycopg2
+from psycopg2.extras import RealDictCursor
+from laniakea_api.config import PG_HOST, PG_PORT, PG_DATABASE, PG_USER, PG_PASSWORD
+
+
+def get_conn():
+    """
+    Open and return a new PostgreSQL connection.
+    """
+    # act over config.py before changing here
+    return psycopg2.connect(
+        host=PG_HOST,
+        port=PG_PORT,
+        database=PG_DATABASE,
+        user=PG_USER,
+        password=PG_PASSWORD,
+    )
+
+def create_deployment(
+    uuid: str, user_sub: str, username: str, description: str, provider: str, requested_at: datetime,
+    ) -> None:
+    """
+    Insert a new deployment row with status QUEUED.
+    Called by the API the moment a job is accepted,
+    (db before redis)
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            # If the user making the request doesn't yet exist in the local database, it inserts them.
+            #if they already exist (subprimary key conflict), it does nothing.
+            cur.execute(
+                """
+                INSERT INTO users (sub, username, email, role, active)
+                VALUES (%s, %s, %s, 'user', true)
+                ON CONFLICT (sub) DO NOTHING
+                """,
+                (user_sub, username, ""),
+            )
+            #Create a row in the deployments table with the initial state set to "QUEUED."
+            # if, by chance, that UUID already exists, simply update the state and date.
+            cur.execute(
+                """
+                INSERT INTO deployments (
+                    uuid, status, creation_time, update_time,
+                    description, provider_name, sub
+                ) VALUES (%s, %s, %s, %s, %s, %s, %s)
+                ON CONFLICT (uuid) DO UPDATE
+                    SET status      = EXCLUDED.status,
+                        update_time = EXCLUDED.update_time
+                """,
+                (uuid, "QUEUED", requested_at, requested_at, description, provider, user_sub),
+            )
+        conn.commit()
+    finally:
+        conn.close()
+
+def update_status(
+    uuid: str, new_status: str, status_reason: Optional[str] = None, outputs: Optional[str] = None,
+    ) -> bool:
+    """
+    Update the status of an existing deployment.
+    Returns True if a row was updated, False if uuid not found.
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            # COALESCE causes the database to keep old value already present
+            # without overwriting them with an empty value.
+            cur.execute(
+                """
+                UPDATE deployments
+                SET status        = %s,
+                    status_reason = COALESCE(%s, status_reason),
+                    outputs       = COALESCE(%s, outputs),
+                    update_time   = %s
+                WHERE uuid = %s
+                """,
+                (new_status, status_reason, outputs, datetime.utcnow(), uuid),
+            )
+            updated = cur.rowcount > 0
+        conn.commit()
+        return updated
+    finally:
+        conn.close()
+
+def get_deployment(uuid: str) -> Optional[dict]:
+    """
+    Fetch a single deployment row by uuid. Returns None if not found.
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor(cursor_factory=RealDictCursor) as cur:
+            cur.execute("SELECT * FROM deployments WHERE uuid = %s", (uuid,))
+            row = cur.fetchone()
+            return dict(row) if row else None
+    finally:
+        conn.close()
+
+def list_deployments(user_sub: str) -> list:
+    """
+    Fetch all deployments owned by a user, ordered by creation time desc.
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor(cursor_factory=RealDictCursor) as cur:
+            cur.execute(
+                "SELECT * FROM deployments WHERE sub = %s ORDER BY creation_time DESC",
+                (user_sub,),
+            )
+            return [dict(r) for r in cur.fetchall()]
+    finally:
+        conn.close()
+
+def delete_deployment(uuid: str) -> bool:
+    """
+    Remove a deployment record. Returns True if a row was deleted.
+    Only the API decides WHEN this is allowed (terminal states):
+    this helper just executes the removal.
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            cur.execute("DELETE FROM deployments WHERE uuid = %s", (uuid,))
+            deleted = cur.rowcount > 0
+        conn.commit()
+        return deleted
+    finally:
+        conn.close()
+
+# ---------------------------------------------------------------------------
+# Deployment payload (needed to rebuild a destroy job)
+# ---------------------------------------------------------------------------
+
+def save_payload(uuid: str, payload: dict) -> bool:
+    """
+    Persist the job payload (deployment_info WITHOUT the auth block)
+    in the deployments.payload JSONB column. Used later to enqueue
+    a destroy job for this deployment.
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            cur.execute(
+                "UPDATE deployments SET payload = %s WHERE uuid = %s",
+                (json.dumps(payload), uuid),
+            )
+            updated = cur.rowcount > 0
+        conn.commit()
+        return updated
+    finally:
+        conn.close()
+
+def get_payload(uuid: str) -> Optional[dict]:
+    """
+    Fetch the stored job payload for a deployment. Returns None if missing.
+    psycopg2 deserializes JSONB to dict automatically.
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            cur.execute("SELECT payload FROM deployments WHERE uuid = %s", (uuid,))
+            row = cur.fetchone()
+            return row[0] if row and row[0] else None
+    finally:
+        conn.close()
+
+# ---------------------------------------------------------------------------
+# Terraform state (HTTP backend) — table: tf_states
+# ---------------------------------------------------------------------------
+
+def tfstate_get(uuid: str) -> Optional[dict]:
+    """
+    Fetch the Terraform state blob for a deployment.
+    Returns {"state": bytes} or None if no state exists (or state is empty).
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            cur.execute("SELECT state FROM tf_states WHERE uuid = %s", (uuid,))
+            row = cur.fetchone()
+            if row is None or row[0] is None or len(row[0]) == 0:
+                return None
+            return {"state": bytes(row[0])}
+    finally:
+        conn.close()
+
+def tfstate_set(uuid: str, state: bytes) -> None:
+    """
+    Insert or update the Terraform state blob for a deployment.
+    Called by Terraform (via the API) on every state push.
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            cur.execute(
+                """
+                INSERT INTO tf_states (uuid, state, updated_at)
+                VALUES (%s, %s, now())
+                ON CONFLICT (uuid) DO UPDATE
+                    SET state = EXCLUDED.state, updated_at = now()
+                """,
+                (uuid, state),
+            )
+        conn.commit()
+    finally:
+        conn.close()
+
+def tfstate_delete(uuid: str) -> bool:
+    """
+    Remove the Terraform state row (after a successful destroy).
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            cur.execute("DELETE FROM tf_states WHERE uuid = %s", (uuid,))
+            deleted = cur.rowcount > 0
+        conn.commit()
+        return deleted
+    finally:
+        conn.close()
+
+def tfstate_get_lock(uuid: str) -> Optional[str]:
+    """
+    Return the current lock info JSON (str) or None if unlocked/missing.
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            cur.execute("SELECT lock_info FROM tf_states WHERE uuid = %s", (uuid,))
+            row = cur.fetchone()
+            return row[0] if row and row[0] else None
+    finally:
+        conn.close()
+
+def tfstate_set_lock(uuid: str, lock_info: str) -> None:
+    """
+    Store lock info. The row may not exist yet on the very first lock
+    (before any state has been pushed): insert with an empty state.
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            cur.execute(
+                """
+                INSERT INTO tf_states (uuid, state, lock_info)
+                VALUES (%s, ''::bytea, %s)
+                ON CONFLICT (uuid) DO UPDATE
+                    SET lock_info = EXCLUDED.lock_info
+                """,
+                (uuid, lock_info),
+            )
+        conn.commit()
+    finally:
+        conn.close()
+
+def tfstate_clear_lock(uuid: str) -> None:
+    """
+    Release the lock for a deployment state.
+    """
+    conn = get_conn()
+    try:
+        with conn.cursor() as cur:
+            cur.execute("UPDATE tf_states SET lock_info = NULL WHERE uuid = %s", (uuid,))
+        conn.commit()
+    finally:
+        conn.close()
+
+def check_connection() -> str:
+    """
+    Returns 'connected' or an error string.
+    Used by /health.
+    """
+    try:
+        conn = get_conn()
+        conn.close()
+        return "connected"
+    except Exception as exc:
+        return f"error: {exc}"

{laniakea_api_server-0.2.1 → laniakea_api_server-0.2.3}/laniakea_api/main.py

@@ -1,21 +1,21 @@
 """
 Registers all routers and starts uvicorn.
 
-Create the FastAPI application instance and map the various groups of 
+Create the FastAPI application instance and map the various groups of
 endpoints (the "routers") to their respective URL addresses (the "prefixes").
 """
 
 import os
 import uvicorn
 from fastapi import FastAPI
-from laniakea_api.routers import agent, agents,credentials, deployments, health
+from laniakea_api.routers import agent, agents, credentials, deployments, health, tfstate
 
 # FastAPI App
 app = FastAPI(
     title="Laniakea Queue API",
     description="OIDC-authenticated gateway for enqueuing cloud deployment jobs.",
     # FIXME: automatizza versione
-    version="0.1.4",
+    version="0.3.0",
 )
 
 # NOTE: CHANGE HERE for path
@@ -28,6 +28,8 @@ app.include_router(deployments.router, prefix=BASE)
 app.include_router(agent.router, prefix=INTERNAL)
 app.include_router(agents.router, prefix=INTERNAL)   # POST /internal/agents/heartbeat
 app.include_router(agents.router, prefix=BASE)       # GET /api/agents/status
+# NOTE: tfstate route paths already contain "/internal/...", so mount on BASE
+app.include_router(tfstate.router, prefix=BASE)      # Terraform http backend
 app.include_router(health.router)                    # /health:no prefix
 
 ############ Routes registered ############################
@@ -40,16 +42,24 @@ app.include_router(health.router)                    # /health:no prefix
 #   POST   /laniakea_core/v1.0/api/deployments
 #   GET    /laniakea_core/v1.0/api/deployments
 #   GET    /laniakea_core/v1.0/api/deployments/{uuid}
+#   DELETE /laniakea_core/v1.0/api/deployments/{uuid}
 #   GET    /laniakea_core/v1.0/api/deployments/{uuid}/logs
 #
 # Internal (agent only):
 #   PATCH  /laniakea_core/v1.0/internal/deployments/{uuid}/status
 #   POST   /laniakea_core/v1.0/internal/deployments/{uuid}/logs
 #
+# Internal (terraform http backend, Basic auth with agent JWT as password):
+#   GET    /laniakea_core/v1.0/internal/tfstate/{uuid}
+#   POST   /laniakea_core/v1.0/internal/tfstate/{uuid}
+#   DELETE /laniakea_core/v1.0/internal/tfstate/{uuid}
+#   POST   /laniakea_core/v1.0/internal/tfstate/{uuid}/lock
+#   DELETE /laniakea_core/v1.0/internal/tfstate/{uuid}/lock
+#
 # Monitoring:
 #   GET    /health
 
-# Entry point uvicorn 
+# Entry point uvicorn
 # skipped
 if __name__ == "__main__":
     uvicorn.run(
@@ -61,4 +71,3 @@ if __name__ == "__main__":
         log_level="info",
         reload=False,
     )
-

{laniakea_api_server-0.2.1 → laniakea_api_server-0.2.3}/laniakea_api/models.py

@@ -63,6 +63,7 @@ class DeploymentRequest(BaseModel):
     auth:              dict   # { aai_token, sub, group }
     orchestrator:      dict   # target_provider, desired_orchestrator, endpoint
     selected_provider: str    # OpenStack | AWS
+    service_type:      Optional[str] = "galaxy"
     cloud_providers:   dict
 
 

{laniakea_api_server-0.2.1 → laniakea_api_server-0.2.3}/laniakea_api/routers/deployments.py

@@ -1,10 +1,11 @@
 """
 user deployment endpoints:
 
-GET  /api/deployments
-GET  /api/deployments/{uuid}
-POST /api/deployments
-GET  /api/deployments/{uuid}/logs
+GET    /api/deployments
+GET    /api/deployments/{uuid}
+POST   /api/deployments
+DELETE /api/deployments/{uuid}
+GET    /api/deployments/{uuid}/logs
 """
 
 import copy
@@ -20,6 +21,13 @@ from laniakea_api.queue import get_queue
 
 router = APIRouter()
 
+# States whose resources are already gone (emergency destroy) or were never
+# created: the record can be removed directly.
+DELETABLE_STATES   = {"CREATE_FAILED", "DELETE_COMPLETE", "QUEUED"}
+# States with live resources: a destroy job must run first.
+DESTROYABLE_STATES = {"CREATE_COMPLETE"}
+
+
 def _strip_secrets(deployment: DeploymentRequest) -> dict:
     """
     Return deployment dict without sensitive credential fields.
@@ -102,13 +110,23 @@ async def enqueue_deployment(
             description=f"Deployment {deployment.deployment_uuid} by {caller['username']}",
         )
     except Exception as exc:
-        db.update_status(deployment.deployment_uuid, "CREATE_FAILED", 
+        db.update_status(deployment.deployment_uuid, "CREATE_FAILED",
                          status_reason=f"Redis enqueue error: {exc}")
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail=f"Failed to enqueue job: {exc}",
         )
 
+    # Persist the job payload WITHOUT the auth block: it will be reused to
+    # rebuild a destroy job later (a fresh aai_token is injected at that time).
+    # Not fatal on failure: the deployment proceeds, only remote destroy
+    # becomes unavailable for this record.
+    try:
+        payload_to_store = {k: v for k, v in job_data.items() if k != "auth"}
+        db.save_payload(deployment.deployment_uuid, payload_to_store)
+    except Exception:
+        pass
+
     return JobResponse(
         job_id=job.id,
         queue_name=queue_name,
@@ -117,6 +135,82 @@ async def enqueue_deployment(
         message=f"Job enqueued on '{queue_name}' queue.",)
 
 
+@router.delete("/api/deployments/{uuid}", status_code=200)
+async def delete_deployment(
+    uuid: str, body: Optional[dict] = None, caller: dict = Depends(verify_session_token),):
+    """
+    Remove or destroy a deployment.
+
+      - Terminal states (CREATE_FAILED, DELETE_COMPLETE, QUEUED): resources
+        are already gone -> remove the record (and any leftover tf state).
+      - CREATE_COMPLETE: enqueue a Terraform destroy job. Requires a fresh
+        'aai_token' in the request body (injected into the stored payload).
+        Status becomes DELETE_IN_PROGRESS; once the agent completes, the
+        record turns DELETE_COMPLETE and can be removed with a second call.
+      - Any other state (e.g. CREATE_IN_PROGRESS): 409, wait first.
+    """
+    row = db.get_deployment(uuid)
+    if row is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND,
+                            detail=f"Deployment {uuid} not found.")
+    if row.get("sub") != caller["sub"]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied.")
+
+    status_now = row.get("status")
+
+    # dead record: just clean up
+    if status_now in DELETABLE_STATES:
+        db.delete_deployment(uuid)
+        db.tfstate_delete(uuid)   # leftover state, if any
+        return {"uuid": uuid, "deleted": True}
+
+    # live resources: enqueue a destroy job
+    if status_now in DESTROYABLE_STATES:
+        payload = db.get_payload(uuid)
+        if not payload:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail="No stored payload for this deployment: remote destroy unavailable. "
+                       "Remove resources manually, then delete the record.",
+            )
+        aai_token = (body or {}).get("aai_token")
+        if not aai_token:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="aai_token required in request body to destroy resources.",
+            )
+
+        payload["auth"] = {
+            "aai_token": aai_token,
+            "sub":       caller["sub"],
+            "group":     (body or {}).get("group", "default"),
+        }
+
+        queue_name, q = get_queue(payload.get("selected_provider", "Openstack"))
+        try:
+            job = q.enqueue(
+                "laniakea_agent.worker_wrapper.destroy_from_dict",
+                payload,
+                job_timeout="1h",
+                description=f"Destroy {uuid} by {caller['username']}",
+            )
+        except Exception as exc:
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail=f"Failed to enqueue destroy job: {exc}",
+            )
+
+        db.update_status(uuid, "DELETE_IN_PROGRESS",
+                         status_reason=f"Destroy requested by {caller['username']}")
+        return {"uuid": uuid, "destroy_enqueued": True, "job_id": job.id,
+                "queue_name": queue_name}
+
+    raise HTTPException(
+        status_code=status.HTTP_409_CONFLICT,
+        detail=f"Deployment is in state {status_now}: wait for the current operation to finish.",
+    )
+
+
 @router.get("/api/deployments/{uuid}/logs")
 async def get_deployment_logs(
     uuid: str, tail: Optional[int] = None, caller: dict = Depends(verify_session_token),):
@@ -126,7 +220,7 @@ async def get_deployment_logs(
     """
     row = db.get_deployment(uuid)
     if row is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, 
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND,
                             detail=f"Deployment {uuid} not found.")
     if row.get("sub") != caller["sub"]:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied")
@@ -142,4 +236,3 @@ async def get_deployment_logs(
         lines = lines[-tail:]
 
     return {"uuid": uuid, "lines": lines, "total": len(lines)}
-

laniakea_api_server-0.2.3/laniakea_api/routers/tfstate.py

@@ -0,0 +1,111 @@
+"""
+Terraform HTTP backend endpoints.
+
+Terraform (backend "http") calls these endpoints on every operation:
+
+  GET    /internal/tfstate/{uuid}        -> fetch current state (404 if none)
+  POST   /internal/tfstate/{uuid}        -> push updated state
+  DELETE /internal/tfstate/{uuid}        -> remove state (after destroy)
+  POST   /internal/tfstate/{uuid}/lock   -> acquire lock (423 if already locked)
+  DELETE /internal/tfstate/{uuid}/lock   -> release lock
+
+Auth: the Terraform http backend only supports HTTP Basic auth
+(username/password). The agent passes username="agent" and
+password=<agent JWT>; _verify_basic_agent() extracts the password and
+validates it with the same logic used for the Bearer-based internal
+endpoints.
+"""
+
+import base64
+import json
+from fastapi import APIRouter, HTTPException, Request, Response, status
+
+from laniakea_api import database as db
+from laniakea_api.auth import decode_agent_token  # see note in PR: thin wrapper around the JWT check used by verify_agent_token
+
+router = APIRouter()
+
+
+def _verify_basic_agent(request: Request) -> str:
+    """
+    Validate HTTP Basic credentials where the password is the agent JWT.
+    Also accepts a standard Bearer token for convenience.
+    Returns the agent id.
+    """
+    auth_header = request.headers.get("Authorization", "")
+
+    if auth_header.startswith("Basic "):
+        try:
+            decoded = base64.b64decode(auth_header[6:]).decode("utf-8")
+            _username, _, password = decoded.partition(":")
+        except Exception:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED,
+                                detail="Malformed Basic credentials.")
+        token = password
+    elif auth_header.startswith("Bearer "):
+        token = auth_header[7:]
+    else:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED,
+                            detail="Missing credentials.")
+
+    agent_id = decode_agent_token(token)   # raises HTTPException(401) if invalid
+    return agent_id
+
+
+@router.get("/internal/tfstate/{uuid}")
+async def get_state(uuid: str, request: Request):
+    _verify_basic_agent(request)
+    row = db.tfstate_get(uuid)
+    if row is None:
+        # Terraform expects 404 (or an empty body) when no state exists yet
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND,
+                            detail="No state for this deployment.")
+    return Response(content=row["state"], media_type="application/json")
+
+
+@router.post("/internal/tfstate/{uuid}")
+async def push_state(uuid: str, request: Request):
+    _verify_basic_agent(request)
+    # Terraform may append ?ID=<lock-id> — verify it matches the current lock
+    lock_id = request.query_params.get("ID")
+    current_lock = db.tfstate_get_lock(uuid)
+    if current_lock and lock_id:
+        try:
+            if json.loads(current_lock).get("ID") != lock_id:
+                raise HTTPException(status_code=status.HTTP_423_LOCKED,
+                                    detail="State is locked by another operation.")
+        except json.JSONDecodeError:
+            pass
+    body = await request.body()
+    if not body:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST,
+                            detail="Empty state payload.")
+    db.tfstate_set(uuid, body)
+    return {"uuid": uuid, "saved": True}
+
+
+@router.delete("/internal/tfstate/{uuid}")
+async def delete_state(uuid: str, request: Request):
+    _verify_basic_agent(request)
+    db.tfstate_delete(uuid)
+    return {"uuid": uuid, "deleted": True}
+
+
+@router.post("/internal/tfstate/{uuid}/lock")
+async def lock_state(uuid: str, request: Request):
+    _verify_basic_agent(request)
+    body = await request.body()          # Terraform sends lock info JSON
+    current = db.tfstate_get_lock(uuid)
+    if current:
+        # already locked: return 423 with the existing lock info
+        return Response(content=current, media_type="application/json",
+                        status_code=status.HTTP_423_LOCKED)
+    db.tfstate_set_lock(uuid, body.decode("utf-8") if body else "{}")
+    return {"uuid": uuid, "locked": True}
+
+
+@router.delete("/internal/tfstate/{uuid}/lock")
+async def unlock_state(uuid: str, request: Request):
+    _verify_basic_agent(request)
+    db.tfstate_clear_lock(uuid)
+    return {"uuid": uuid, "unlocked": True}

{laniakea_api_server-0.2.1 → laniakea_api_server-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "laniakea-api-server"
-version = "0.2.1"
+version = "0.2.3"
 description = "Laniakea Queue API — OIDC-authenticated gateway for cloud deployment orchestration"
 readme = "README.md"
 license = { text = "MIT" }

laniakea_api_server-0.2.1/laniakea_api/database.py

@@ -1,136 +0,0 @@
-"""
-PostgreSQL connection.
-The agent has NO direct DB access:
-                  **all writes go through the API**
-The Dashboard is stateless.
-"""
-
-import os
-from datetime import datetime
-from typing import Optional
-import psycopg2
-from psycopg2.extras import RealDictCursor
-from laniakea_api.config import PG_HOST, PG_PORT, PG_DATABASE, PG_USER, PG_PASSWORD
-
-
-def get_conn():
-    """
-    Open and return a new PostgreSQL connection.
-    """
-    # act over config.py before changing here
-    return psycopg2.connect(
-        host=PG_HOST,
-        port=PG_PORT,
-        database=PG_DATABASE,
-        user=PG_USER,
-        password=PG_PASSWORD,
-    )
-
-def create_deployment(
-    uuid: str, user_sub: str, username: str, description: str, provider: str, requested_at: datetime,
-    ) -> None:
-    """
-    Insert a new deployment row with status QUEUED.
-    Called by the API the moment a job is accepted, 
-    (db before redis)
-    """
-    conn = get_conn()
-    try:
-        with conn.cursor() as cur:
-            # If the user making the request doesn't yet exist in the local database, it inserts them. 
-            #if they already exist (subprimary key conflict), it does nothing.
-            cur.execute(
-                """
-                INSERT INTO users (sub, username, email, role, active)
-                VALUES (%s, %s, %s, 'user', true)
-                ON CONFLICT (sub) DO NOTHING
-                """,
-                (user_sub, username, ""),
-            )
-            #Create a row in the deployments table with the initial state set to "QUEUED." 
-            # if, by chance, that UUID already exists, simply update the state and date.
-            cur.execute(
-                """
-                INSERT INTO deployments (
-                    uuid, status, creation_time, update_time,
-                    description, provider_name, sub
-                ) VALUES (%s, %s, %s, %s, %s, %s, %s)
-                ON CONFLICT (uuid) DO UPDATE
-                    SET status      = EXCLUDED.status,
-                        update_time = EXCLUDED.update_time
-                """,
-                (uuid, "QUEUED", requested_at, requested_at, description, provider, user_sub),
-            )
-        conn.commit()
-    finally:
-        conn.close()
-
-def update_status(
-    uuid: str, new_status: str, status_reason: Optional[str] = None, outputs: Optional[str] = None,
-    ) -> bool:
-    """
-    Update the status of an existing deployment.
-    Returns True if a row was updated, False if uuid not found.
-    """
-    conn = get_conn()
-    try:
-        with conn.cursor() as cur:
-            # COALESCE causes the database to keep old value already present 
-            # without overwriting them with an empty value.
-            cur.execute(
-                """
-                UPDATE deployments
-                SET status        = %s,
-                    status_reason = COALESCE(%s, status_reason),
-                    outputs       = COALESCE(%s, outputs),
-                    update_time   = %s
-                WHERE uuid = %s
-                """,
-                (new_status, status_reason, outputs, datetime.utcnow(), uuid),
-            )
-            updated = cur.rowcount > 0
-        conn.commit()
-        return updated
-    finally:
-        conn.close()
-
-def get_deployment(uuid: str) -> Optional[dict]:
-    """
-    Fetch a single deployment row by uuid. Returns None if not found.
-    """
-    conn = get_conn()
-    try:
-        with conn.cursor(cursor_factory=RealDictCursor) as cur:
-            cur.execute("SELECT * FROM deployments WHERE uuid = %s", (uuid,))
-            row = cur.fetchone()
-            return dict(row) if row else None
-    finally:
-        conn.close()
-
-def list_deployments(user_sub: str) -> list:
-    """
-    Fetch all deployments owned by a user, ordered by creation time desc.
-    """
-    conn = get_conn()
-    try:
-        with conn.cursor(cursor_factory=RealDictCursor) as cur:
-            cur.execute(
-                "SELECT * FROM deployments WHERE sub = %s ORDER BY creation_time DESC",
-                (user_sub,),
-            )
-            return [dict(r) for r in cur.fetchall()]
-    finally:
-        conn.close()
-
-def check_connection() -> str:
-    """
-    Returns 'connected' or an error string. 
-    Used by /health.
-    """
-    try:
-        conn = get_conn()
-        conn.close()
-        return "connected"
-    except Exception as exc:
-        return f"error: {exc}"
-