runtime.go

package main

import (
	"context"
	"crypto/ed25519"
	"crypto/rand"
	"encoding/base64"
	"fmt"
	"io"
	"net/http"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"time"

	"github.com/codefly-dev/core/agents/services"
	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
	runtimev0 "github.com/codefly-dev/core/generated/go/codefly/services/runtime/v0"
	"github.com/codefly-dev/core/resources"
	dockerrun "github.com/codefly-dev/core/runners/dockerrun"
	"github.com/codefly-dev/core/wool"
)

type Runtime struct {
	services.RuntimeServer
	*Service

	runnerEnvironment *dockerrun.DockerEnvironment
	vaultPort         uint16
	vaultAddress      string
	vaultToken        string

	// nixRuntime is set instead of runnerEnvironment when the caller requests
	// RuntimeContextNix — vault runs natively from a nix-provisioned binary.
	nixRuntime *nixVault
	localState *localVaultState
}

func NewRuntime() *Runtime {
	return &Runtime{
		Service: NewService(),
	}
}

func (s *Runtime) Load(ctx context.Context, req *runtimev0.LoadRequest) (*runtimev0.LoadResponse, error) {
	defer s.Wool.Catch()

	return s.Runtime.LoadService(ctx, req, services.RuntimeLoad{
		Settings:     s.Settings,
		Requirements: requirements,
		ResolveEndpoints: func(ctx context.Context, endpoints []*basev0.Endpoint) error {
			s.Wool.Debug("endpoints", wool.Field("endpoints", resources.MakeManyEndpointSummary(endpoints)))
			endpoint, err := resources.FindHTTPEndpoint(ctx, endpoints)
			if err != nil {
				return s.Wool.Wrapf(err, "cannot find HTTP endpoint")
			}
			s.HttpEndpoint = endpoint
			return nil
		},
	})
}

func callingContext() *basev0.NetworkAccess {
	if _, err := os.Stat("/.dockerenv"); err == nil {
		return resources.NewContainerNetworkAccess()
	}
	return resources.NewNativeNetworkAccess()
}

func (s *Runtime) Init(ctx context.Context, req *runtimev0.InitRequest) (*runtimev0.InitResponse, error) {
	defer s.Wool.Catch()
	ctx = s.Wool.Inject(ctx)

	s.Runtime.LogInitRequest(req)

	w := s.Wool.In("runtime::init")

	s.NetworkMappings = req.ProposedNetworkMappings

	net, err := resources.FindNetworkMapping(ctx, s.NetworkMappings, s.HttpEndpoint)
	if err != nil {
		return s.Runtime.InitError(err)
	}
	if net == nil {
		return s.Runtime.InitError(w.NewError("network mapping is nil"))
	}

	instance, err := resources.FindNetworkInstanceInNetworkMappings(ctx, s.NetworkMappings, s.HttpEndpoint, callingContext())
	if err != nil {
		return s.Runtime.InitError(err)
	}
	if instance == nil {
		return s.Runtime.InitError(w.NewError("network instance is nil"))
	}

	w.Debug("http network instance", wool.Field("instance", instance))

	s.vaultPort = 8200

	var vaultToken string
	if req.Configuration != nil {
		vaultToken, err = s.VaultTokenFromConfiguration(ctx, req.Configuration)
		if err != nil {
			return s.Runtime.InitError(err)
		}
	}
	state, err := openLocalVaultState(filepath.Join(resources.CodeflyHomeDir(), "runtime-cache", s.UniqueWithWorkspace(), "vault-state"))
	if err != nil {
		return s.Runtime.InitError(err)
	}
	s.localState = state
	ready := false
	defer func() {
		if !ready {
			if s.nixRuntime != nil || s.runnerEnvironment != nil {
				_ = s.teardown(ctx)
			} else {
				state.close()
			}
		}
	}()
	// Store the address for health checks
	hostInstance, err := resources.FindNetworkInstanceInNetworkMappings(ctx, s.NetworkMappings, s.HttpEndpoint, callingContext())
	if err != nil {
		return s.Runtime.InitError(err)
	}
	vaultAddress := hostInstance.Address

	// Nix runtime: run a persistent file-backed Vault from a nix-provisioned binary
	// instead of a Docker container — selected when the caller requests
	// RuntimeContextNix (e.g. a host without Docker). vault binds the assigned
	// port directly, so vaultAddress (used by the transit/JWT seeding below) is
	// unchanged.
	if rc := req.GetRuntimeContext(); rc != nil && rc.Kind == resources.RuntimeContextNix {
		s.Infof("using nix runtime for vault on port %d", instance.Port)
		nixv, errNix := newNixVault(ctx, s.Location, uint16(instance.Port), vaultToken, newVaultLogWriter(s.Wool, vaultToken))
		if errNix != nil {
			return s.Runtime.InitError(errNix)
		}
		nixv.configPath = filepath.Join(state.dir, "server.json")
		if errNix = state.config(nixv.configPath, filepath.Join(state.dir, "vault-data"), fmt.Sprintf("127.0.0.1:%d", instance.Port)); errNix != nil {
			return s.Runtime.InitError(errNix)
		}
		if errNix = nixv.Init(ctx); errNix != nil {
			return s.Runtime.InitError(errNix)
		}
		s.nixRuntime = nixv
	} else {
		// Docker
		runner, errDocker := dockerrun.NewDockerHeadlessEnvironment(ctx, image, s.UniqueWithWorkspace())
		if errDocker != nil {
			return s.Runtime.InitError(errDocker)
		}
		// Containers remain replaceable; their file backend and local custody persist.
		runner.WithEphemeral()
		runner.WithOutput(newVaultLogWriter(s.Wool, vaultToken))
		runner.WithPortMapping(ctx, uint16(instance.Port), s.vaultPort)
		runner.WithUser(strconv.Itoa(os.Getuid()) + ":" + strconv.Itoa(os.Getgid()))
		runner.WithMount(state.dir, "/vault/file")
		if err = state.config(filepath.Join(state.dir, "server.json"), "/vault/file/vault-data", "0.0.0.0:8200"); err != nil {
			return s.Runtime.InitError(err)
		}
		runner.WithCommand("vault", "server", "-config=/vault/file/server.json")
		runner.WithEnvironmentVariables(ctx, resources.Env("SKIP_SETCAP", "true"))
		s.runnerEnvironment = runner
		w.Debug("init for runner environment: will start container")
		if errDocker = s.runnerEnvironment.Init(ctx); errDocker != nil {
			return s.Runtime.InitError(errDocker)
		}
	}

	vaultToken, err = state.bootstrap(ctx, vaultAddress, vaultToken)
	if err != nil {
		_ = s.teardown(ctx)
		return s.Runtime.InitError(err)
	}
	runtimeConfigurations := make([]*basev0.Configuration, 0, len(net.Instances))
	for _, inst := range net.Instances {
		runtimeConfigurations = append(runtimeConfigurations, s.CreateConnectionConfiguration(inst, vaultToken))
	}
	ready = true
	s.vaultToken = vaultToken
	s.vaultAddress = vaultAddress
	s.Runtime.Lock()
	s.Runtime.RuntimeConfigurations = runtimeConfigurations
	s.Runtime.Unlock()

	w.Debug("init successful")
	return s.Runtime.InitResponse()
}

func (s *Runtime) WaitForReady(ctx context.Context) error {
	defer s.Wool.Catch()
	ctx = s.Wool.Inject(ctx)

	s.Wool.Debug("waiting for ready", wool.Field("address", s.vaultAddress))

	maxRetry := 10
	for retry := 0; retry < maxRetry; retry++ {
		req, err := http.NewRequestWithContext(ctx, http.MethodGet, s.vaultAddress+"/v1/sys/health", nil)
		if err != nil {
			return s.Wool.Wrapf(err, "cannot create health request")
		}

		resp, err := http.DefaultClient.Do(req)
		if err == nil {
			_, _ = io.Copy(io.Discard, resp.Body)
			_ = resp.Body.Close()
			// Vault returns 200 when initialized, unsealed, and active
			if resp.StatusCode == 200 {
				s.Wool.Debug("vault is ready!")
				return nil
			}
		}
		s.Wool.Debug("waiting for vault to be ready", wool.ErrField(err))
		time.Sleep(2 * time.Second)
	}
	return s.Wool.NewError("vault is not ready")
}

func (s *Runtime) enableTransit(ctx context.Context) error {
	defer s.Wool.Catch()

	// Enable transit secrets engine
	err := s.vaultRequest(ctx, http.MethodPost, "/v1/sys/mounts/transit",
		`{"type":"transit"}`)
	if err != nil {
		// Ignore "already enabled" errors
		if !strings.Contains(err.Error(), "existing mount") && !strings.Contains(err.Error(), "already in use") {
			return s.Wool.Wrapf(err, "cannot enable transit engine")
		}
	}
	s.Wool.Debug("transit engine enabled")

	// Create the transit key for API keys
	keyName := s.TransitKey
	if keyName == "" {
		keyName = "api-keys"
	}
	err = s.vaultRequest(ctx, http.MethodPost,
		fmt.Sprintf("/v1/transit/keys/%s", keyName),
		`{"type":"aes256-gcm96"}`)
	if err != nil {
		if !strings.Contains(err.Error(), "already exists") {
			return s.Wool.Wrapf(err, "cannot create transit key")
		}
	}
	s.Wool.Debug("transit key created", wool.Field("key", keyName))

	return nil
}

func (s *Runtime) seedJWTSigningKey(ctx context.Context) error {
	defer s.Wool.Catch()

	// Check if key already exists
	err := s.vaultRequest(ctx, http.MethodGet, "/v1/secret/data/jwt-signing-key", "")
	if err == nil {
		s.Wool.Debug("JWT signing key already exists")
		return nil
	}

	// Generate Ed25519 key pair
	pub, priv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		return s.Wool.Wrapf(err, "cannot generate Ed25519 key pair")
	}

	// Store seed (first 32 bytes of private key) and public key
	privSeed := base64.StdEncoding.EncodeToString(priv.Seed())
	pubEncoded := base64.StdEncoding.EncodeToString(pub)

	body := fmt.Sprintf(`{"data":{"private_key":"%s","public_key":"%s","algorithm":"EdDSA"}}`,
		privSeed, pubEncoded)

	err = s.vaultRequest(ctx, http.MethodPost, "/v1/secret/data/jwt-signing-key", body)
	if err != nil {
		return s.Wool.Wrapf(err, "cannot store JWT signing key")
	}

	s.Wool.Debug("JWT signing key generated and stored")
	return nil
}

func (s *Runtime) vaultRequest(ctx context.Context, method, path, body string) error {
	var bodyReader io.Reader
	if body != "" {
		bodyReader = strings.NewReader(body)
	}

	req, err := http.NewRequestWithContext(ctx, method, s.vaultAddress+path, bodyReader)
	if err != nil {
		return err
	}
	req.Header.Set("X-Vault-Token", s.vaultToken)
	req.Header.Set("Content-Type", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return err
	}
	defer func() { _ = resp.Body.Close() }()

	respBody, _ := io.ReadAll(resp.Body)

	if resp.StatusCode >= 400 {
		return fmt.Errorf("vault %s %s returned %d: %s", method, path, resp.StatusCode, string(respBody))
	}
	return nil
}

func (s *Runtime) Start(ctx context.Context, req *runtimev0.StartRequest) (*runtimev0.StartResponse, error) {
	defer s.Wool.Catch()
	ctx = s.Wool.Inject(ctx)

	s.Wool.Debug("starting")

	err := s.WaitForReady(ctx)
	if err != nil {
		return s.Runtime.StartError(err)
	}

	err = s.enableTransit(ctx)
	if err != nil {
		return s.Runtime.StartError(err)
	}

	err = s.seedJWTSigningKey(ctx)
	if err != nil {
		return s.Runtime.StartError(err)
	}

	s.Wool.Debug("start done")
	return s.Runtime.StartResponse()
}

func (s *Runtime) Information(ctx context.Context, req *runtimev0.InformationRequest) (*runtimev0.InformationResponse, error) {
	return s.Runtime.InformationResponse(ctx, req)
}

// dockerShutdownAttempts bounds how many times teardown re-runs a container
// Shutdown. Docker's ContainerRemove sometimes overruns its internal 10s
// cleanup deadline under CI load ("context deadline exceeded") even though the
// daemon finishes the removal out of band; a re-attempt then observes the
// container already gone and returns cleanly, so a slow daemon no longer fails
// Stop or Destroy (and, in turn, a release). Shutdown is idempotent — it probes
// for the container first — so retrying is safe.
const dockerShutdownAttempts = 3

// teardown fully stops vault's runtime — the native nix process or the docker
// container. Unlike most infra agents, vault does NOT keep its environment
// alive for reuse. Its state and custody survive separately in runtime-cache;
// container/process teardown must not delete them.
// Shared by Stop and Destroy.
func (s *Runtime) teardown(ctx context.Context) (resultErr error) {
	defer func() {
		if resultErr == nil {
			s.localState.close()
		}
	}()
	if s.nixRuntime != nil {
		s.Wool.Debug("stopping nix vault process")
		return s.nixRuntime.Stop(ctx)
	}
	env := s.runnerEnvironment
	if env == nil {
		// No live handle (e.g. Destroy on a freshly loaded agent that never ran
		// Init): reconstruct the docker env by name and shut it down.
		var err error
		env, err = dockerrun.NewDockerHeadlessEnvironment(ctx, image, s.UniqueWithWorkspace())
		if err != nil {
			return err
		}
	}
	s.Wool.Debug("shutting down vault container")
	return s.retryShutdown(ctx, env.Shutdown)
}

func (s *Runtime) retryShutdown(ctx context.Context, shutdown func(context.Context) error) error {
	var err error
	for attempt := 1; attempt <= dockerShutdownAttempts; attempt++ {
		if err = shutdown(ctx); err == nil {
			return nil
		}
		s.Wool.Warn("vault container shutdown attempt failed",
			wool.Field("attempt", attempt), wool.ErrField(err))
	}
	return err
}

func (s *Runtime) Stop(ctx context.Context, req *runtimev0.StopRequest) (*runtimev0.StopResponse, error) {
	defer s.Wool.Catch()
	ctx = s.Wool.Inject(ctx)

	if err := s.teardown(ctx); err != nil {
		return s.Runtime.StopError(err)
	}
	return s.Runtime.StopResponse()
}

func (s *Runtime) Destroy(ctx context.Context, req *runtimev0.DestroyRequest) (*runtimev0.DestroyResponse, error) {
	defer s.Wool.Catch()
	ctx = s.Wool.Inject(ctx)

	s.Wool.Debug("destroying")

	if err := s.teardown(ctx); err != nil {
		return s.Runtime.DestroyError(err)
	}
	return s.Runtime.DestroyResponse()
}

func (s *Runtime) Test(ctx context.Context, req *runtimev0.TestRequest) (*runtimev0.TestResponse, error) {
	// A RUN-LEVEL verdict, stated. This agent ships no tests of its own -- it
	// runs a datastore -- so the honest run is zero tests and zero failures,
	// which is what the status-only answer always meant. It has to be said:
	// core's helpers fill the counts but leave Result nil, and the CLI promotes
	// nothing to a pass -- only an explicit TestRunResult_PASSED is one
	// (cli pkg/testrun/verdict.go); UNKNOWN is refused by name.
	response, err := s.Runtime.TestResponseWithResults(0, 0, 0, 0, 0, nil, nil)
	if err != nil {
		return nil, err
	}
	response.Result = &runtimev0.TestRunResult{
		State:   runtimev0.TestRunResult_PASSED,
		Message: "this agent ships no tests of its own: zero run, zero failed",
	}
	return response, nil
}