mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-09 13:35:12 +09:00
Juan DenisandClaude Opus 5
5f8a3ef204
Plan 70. Domain went through this and TEN read paths were wrong, four with
effects outside the panel. Application has 211 call sites across 68 files and
drives more -- container lifecycles, nginx, backups, registry pulls, the OS
crontab -- so it was audited in full first (docs/plans/70_...md). 180 sites are
now query_active(); the 35 left unfiltered are each commented in place.
**The delete / purge split is what makes the tombstone honest.** delete_app used
to run compose_down(volumes=True) and rmtree(). Keeping a tombstone AND doing
that would put a Restore button next to a row whose data the delete had already
destroyed -- the one promise a recycle bin cannot break. So:
DELETE containers down (VOLUMES KEPT), vhost removed, firewall closed,
cron suspended, row tombstoned. All reversible.
RESTORE vhost rewritten, firewall reopened, cron resumed. Containers left
STOPPED -- "put it back" must not silently start processes or open
ports, the same reasoning that stops domain restore re-issuing certs.
PURGE volumes removed, uploaded source deleted, cron detached.
register() gained on_purge for that, wired into BOTH purge paths. And
purge_expired had NO scheduler -- fine when a tombstone was just a row, not fine
when it holds data volumes and a source tree, so a daily builtin job now runs
it. Without that, "kept until purge" would have meant kept forever and delete
would have quietly stopped reclaiming disk.
A side effect worth naming: the old _remove_data_flag protection for database
engines is now the DEFAULT for every app, and the flag is carried into
?purge=true so an explicit skip-the-bin delete still honours it.
**Cron was the blocker with no mechanical answer.** before_delete never fires on
a soft delete, and clear_application is LOSSY -- it nulls the association
without recording it, so nothing could put it back. suspend_for_application
instead disables only the jobs that were CURRENTLY ENABLED and stamps each
suspended_by_app; resume re-enables exactly those. That flag is the whole point:
without it a restore switches back on jobs the user deliberately turned off.
clear_application survives as purge-only, where lossiness is correct.
**The indirect reach (audit 3.1) is the class that grep cannot find.**
ContainerSleepPolicy, BackupPolicy, DeploymentJob and WafPolicy are enumerated
on a SCHEDULE and resolve application_id afterwards, so they never appear in a
search for Application.query. Left alone, a tombstoned app's sleep policy is
swept forever and wake_app restarts the containers the delete tore down. Those
loops test Application.deleted_ids().
Deliberately NOT scoped: reservation checks (port, name, directory) -- a
tombstone must keep holding those or a new app takes them and the restore is
refused; api/git.py's webhook VISIBILITY gate, which falls through to
"panel-wide visible" so hiding a tombstone would WIDEN access; and cron
attribution, which only labels a row.
Verified: 15 new tests, the migration replayed on a fresh DB (a tombstone frees
its private_slug, two live rows still collide), and a full delete -> restore
round trip. The 20 remaining full-suite failures are the known
serverkit-wordpress-not-installed class and are identical on a clean tree.
Two traps caught by testing, both recorded in the plan: a bad import made the
ENTIRE purge cleanup silently no-op while purge() still reported success
(_run_purge_hook swallows by design, so assert on the warning, not just ok), and
private_slug had to lose unique=True at the MODEL level or a models-built
database burns the slug regardless of the migration.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
77 lines
3.0 KiB
Python
77 lines
3.0 KiB
Python
# Bucket: PER-APP read (plan 29 #9). Per-app history gates via _access →
|
|
# can_access_app. See docs/WORKSPACE_SCOPING.md.
|
|
"""Unified deployment surface (§3 unification).
|
|
|
|
One read namespace over the deploy records that today live in three places:
|
|
versioned build ``Deployment`` rows, webhook-triggered ``GitDeployment`` rows,
|
|
and the canonical ``DeploymentJob`` execution records (mounted here under
|
|
``/jobs``). The per-system blueprints (/builds, /deploy, /git, /deployment-jobs)
|
|
are unchanged; this is an additive, federated view so the frontend can read one
|
|
history instead of merging two sources.
|
|
"""
|
|
from flask import Blueprint, request, jsonify
|
|
from flask_jwt_extended import jwt_required, get_jwt_identity
|
|
|
|
from app.models import Application, User
|
|
from app.models.deployment import Deployment
|
|
from app.models.webhook import GitDeployment
|
|
|
|
deployments_bp = Blueprint('deployments', __name__)
|
|
|
|
|
|
def _access(app_id):
|
|
from app.services.resource_grant_service import ResourceGrantService
|
|
user = User.query.get(get_jwt_identity())
|
|
app = Application.query_active().filter_by(id=app_id).first()
|
|
if not app:
|
|
return None, (jsonify({'error': 'Application not found'}), 404)
|
|
if not ResourceGrantService.can_access_app(user, app):
|
|
return None, (jsonify({'error': 'Access denied'}), 403)
|
|
return app, None
|
|
|
|
|
|
@deployments_bp.route('/apps/<int:app_id>/history', methods=['GET'])
|
|
@jwt_required()
|
|
def app_history(app_id):
|
|
"""Federated deploy history for an app: versioned build Deployments +
|
|
webhook GitDeployments, each tagged with ``source``, newest first.
|
|
Query: ?source=build|webhook|all (default all), ?limit= (<=500)."""
|
|
app, err = _access(app_id)
|
|
if err:
|
|
return err
|
|
source = (request.args.get('source') or 'all').lower()
|
|
try:
|
|
limit = min(int(request.args.get('limit', 100)), 500)
|
|
except (TypeError, ValueError):
|
|
limit = 100
|
|
|
|
items = []
|
|
if source in ('all', 'build'):
|
|
for d in (Deployment.query.filter_by(app_id=app_id)
|
|
.order_by(Deployment.created_at.desc()).limit(limit).all()):
|
|
row = d.to_dict()
|
|
row['source'] = 'build'
|
|
items.append(row)
|
|
if source in ('all', 'webhook'):
|
|
for g in (GitDeployment.query.filter_by(app_id=app_id)
|
|
.order_by(GitDeployment.created_at.desc()).limit(limit).all()):
|
|
row = g.to_dict()
|
|
row['source'] = 'webhook'
|
|
items.append(row)
|
|
items.sort(key=lambda r: r.get('created_at') or '', reverse=True)
|
|
items = items[:limit]
|
|
return jsonify({'deployments': items, 'count': len(items)}), 200
|
|
|
|
|
|
@deployments_bp.route('/<int:deployment_id>', methods=['GET'])
|
|
@jwt_required()
|
|
def get_deployment(deployment_id):
|
|
"""A versioned build Deployment by id (the release ledger detail)."""
|
|
d = Deployment.query.get(deployment_id)
|
|
if not d:
|
|
return jsonify({'error': 'Deployment not found'}), 404
|
|
_, err = _access(d.app_id)
|
|
if err:
|
|
return err
|
|
return jsonify({'deployment': d.to_dict(include_logs=True)}), 200
|