feat(backend): persist multi-container artifacts and route Dockerfile edits by context

Author: Oussama928

src/backend/api/jobs.py

@@ -408,6 +408,10 @@ def _apply_artifact_edits(state: dict, edits: list[ArtifactEditRequest]) -> None
     generated = infracost.setdefault("generated_terraform", {})
     generated_files = generated["files"] if isinstance(generated.get("files"), dict) else generated
 
+    plural_images = artifacts.get("docker_images")
+    if not isinstance(plural_images, list):
+        plural_images = None
+
     for edit in edits:
         file_path = edit.file_path
         content = edit.content
@@ -417,6 +421,11 @@ def _apply_artifact_edits(state: dict, edits: list[ArtifactEditRequest]) -> None
             generated_files[file_path.replace(".", "_")] = content
         elif file_path == "Dockerfile":
             artifacts["dockerfile"] = content
+            if plural_images is not None:
+                _apply_dockerfile_edit(plural_images, ".", content)
+        elif file_path.endswith("/Dockerfile") and plural_images is not None:
+            context = file_path[:-len("/Dockerfile")]
+            _apply_dockerfile_edit(plural_images, context, content)
         elif file_path == "docker-image.json":
             import json as _json
 
@@ -432,6 +441,28 @@ def _apply_artifact_edits(state: dict, edits: list[ArtifactEditRequest]) -> None
                 dop_tf[edit.file_path] = edit.content
             elif edit.file_path == "Dockerfile":
                 dop_artifacts["dockerfile"] = edit.content
+                dop_images = dop_artifacts.get("docker_images")
+                if isinstance(dop_images, list):
+                    _apply_dockerfile_edit(dop_images, ".", edit.content)
+            elif edit.file_path.endswith("/Dockerfile"):
+                dop_images = dop_artifacts.get("docker_images")
+                if isinstance(dop_images, list):
+                    _apply_dockerfile_edit(
+                        dop_images, edit.file_path[:-len("/Dockerfile")], edit.content
+                    )
+
+
+def _apply_dockerfile_edit(images: list[dict], context: str, content: str) -> None:
+    """Route a Dockerfile edit to the plural image whose build context
+    matches. Root-level Dockerfile edits target the image with context "."."""
+    for image in images:
+        img_context = (image.get("context") or ".").rstrip("/")
+        if img_context == context:
+            image["dockerfile"] = content
+            return
+    # No exact context match: apply to the primary (first) image.
+    if images:
+        images[0]["dockerfile"] = content
 
 
 class RollbackRequest(BaseModel):

src/backend/artifact_validation.py

@@ -33,7 +33,14 @@
 
 
 def allowed_file_path(file_path: str) -> bool:
-    return file_path in _ALLOWED_FILE_PATHS
+    if file_path in _ALLOWED_FILE_PATHS:
+        return True
+    # Multi-container: Dockerfiles live under their build context
+    # (e.g. "backend/Dockerfile"), not just at the repo root.
+    if file_path.endswith("/Dockerfile"):
+        parent = file_path[:-len("/Dockerfile")]
+        return bool(parent) and not parent.startswith("/") and ".." not in parent.split("/")
+    return False
 
 
 def _balanced_structure(content: str) -> bool:

src/backend/persistence.py

@@ -65,16 +65,31 @@ def _docker_artifacts(state: dict) -> list[tuple[str, str, str | None]]:
     agent stashes them at ``infracost_result._deploy_inputs.artifacts``, the
     mock/legacy shape at ``deployops_result.artifacts``. Returns
     ``(file_path, artifact_type, content)`` tuples, content None when absent
-    (e.g. a serverless Lambda run)."""
+    (e.g. a serverless Lambda run).
+
+    Multi-container payloads carry the canonical plural ``docker_images``
+    list; each image becomes its own artifact row keyed by its build context
+    (``<context>/Dockerfile`` or ``Dockerfile`` for the repo root). Legacy
+    payloads keep the singular ``dockerfile`` + ``docker_image`` shape.
+    """
     artifacts = {}
     infracost = state.get("infracost_result") or {}
     deploy_inputs = (infracost.get("_deploy_inputs") or {}).get("artifacts") or {}
     deployops = (state.get("deployops_result") or {}).get("artifacts") or {}
     for source in (deploy_inputs, deployops):
-        for key in ("dockerfile", "docker_image"):
+        for key in ("dockerfile", "docker_image", "docker_images"):
             if key in source:
                 artifacts[key] = source[key]
 
+    rows: list[tuple[str, str, str | None]] = []
+    plural = artifacts.get("docker_images")
+    if plural:
+        for image in plural:
+            context = (image.get("context") or ".").rstrip("/")
+            rel = "Dockerfile" if context == "." else f"{context}/Dockerfile"
+            rows.append((rel, "dockerfile", image.get("dockerfile")))
+        return rows
+
     dockerfile = artifacts.get("dockerfile")
     docker_image = artifacts.get("docker_image") or {}
     image = {}

src/backend/tests/test_jobs.py

@@ -287,3 +287,30 @@ def fake_publish(job_id, phase, progress, message=""):
     phases = {phase for phase, _ in published}
     assert "codesec_agent" in phases
     assert "human_gate_1" in phases
+
+
+def test_multi_container_dockerfile_edits_route_by_context():
+    from src.backend.api.jobs import ArtifactEditRequest, _apply_artifact_edits
+    from src.backend.artifact_validation import allowed_file_path
+
+    assert allowed_file_path("backend/Dockerfile") is True
+    assert allowed_file_path("frontend/Dockerfile") is True
+    assert allowed_file_path("Dockerfile") is True
+    assert allowed_file_path("../evil/Dockerfile") is False
+    assert allowed_file_path("nested/path/to/Dockerfile") is True
+
+    state = {
+        "infracost_result": {"_deploy_inputs": {"artifacts": {
+            "docker_images": [
+                {"name": "devguard-app", "dockerfile": "OLD1", "context": "."},
+                {"name": "devguard-app-frontend", "dockerfile": "OLD2", "context": "frontend"},
+            ]
+        }}}
+    }
+    _apply_artifact_edits(state, [
+        ArtifactEditRequest(file_path="Dockerfile", content="NEW1"),
+        ArtifactEditRequest(file_path="frontend/Dockerfile", content="NEW2"),
+    ])
+    images = state["infracost_result"]["_deploy_inputs"]["artifacts"]["docker_images"]
+    assert images[0]["dockerfile"] == "NEW1"
+    assert images[1]["dockerfile"] == "NEW2"

src/backend/tests/test_persistence.py

@@ -72,6 +72,52 @@ def test_persist_dockerfile_from_real_deploy_inputs(db: Session) -> None:
     assert "sha-a1b2c3d" in by_path["docker-image.json"].content
 
 
+def test_persist_multi_container_docker_images(db: Session) -> None:
+    """Multi-container runs carry the canonical plural docker_images list;
+    each image must be persisted under its build-context path."""
+    state = _make_state(
+        {
+            "files": {
+                "main.tf": "resource \"aws_ecs_cluster\" \"this\" {}",
+                "variables.tf": "variable \"region\" {}",
+                "outputs.tf": "output \"url\" {}",
+            },
+            "variables": {"region": "us-east-1"},
+        }
+    )
+    state["infracost_result"]["_deploy_inputs"] = {
+        "compute_type": "ecs",
+        "artifacts": {
+            "terraform": {
+                "files": {"main.tf": "x"},
+                "variables": {"region": "us-east-1"},
+            },
+            "docker_images": [
+                {
+                    "name": "devguard-app",
+                    "tag": "sha-a1b2c3d",
+                    "dockerfile": "FROM python:3.12-slim\nEXPOSE 8000\n",
+                    "context": ".",
+                },
+                {
+                    "name": "devguard-app-frontend",
+                    "tag": "sha-a1b2c3d",
+                    "dockerfile": "FROM nginx:1.27\nEXPOSE 80\n",
+                    "context": "frontend",
+                },
+            ],
+            "source_code": ".",
+        },
+    }
+    persist_results(db, "test-run-docker-multi", state)
+
+    artifacts = db.query(models.TerraformArtifact).filter_by(run_id="test-run-docker-multi").all()
+    by_path = {a.file_path: a for a in artifacts}
+    assert by_path["Dockerfile"].content == "FROM python:3.12-slim\nEXPOSE 8000\n"
+    assert by_path["frontend/Dockerfile"].content == "FROM nginx:1.27\nEXPOSE 80\n"
+    assert "docker-image.json" not in by_path
+
+
 def test_persist_dockerfile_from_mock_deployops_artifacts(db: Session) -> None:
     """Mock/legacy runs carry Docker artifacts on deployops_result.artifacts;
     those must be persisted too."""