builder.go

package main

import (
	"context"
	"embed"
	"fmt"

	"github.com/codefly-dev/core/agents/communicate"
	"github.com/codefly-dev/core/agents/services"
	v0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
	builderv0 "github.com/codefly-dev/core/generated/go/codefly/services/builder/v0"
	"github.com/codefly-dev/core/resources"
	"github.com/codefly-dev/core/standards"
	"github.com/codefly-dev/core/wool"

	"github.com/codefly-dev/service-object-storage/internal/backend"
	"github.com/codefly-dev/service-object-storage/internal/imageevidence"
)

type Builder struct {
	*services.DefaultBuilder
	*Service
}

// deploymentTemplateParameters carries the values the Kubernetes templates need
// beyond the resolved configuration.
type deploymentTemplateParameters struct {
	Backend string
	Bucket  string
	Region  string
	// Prefix confines the gateway to one key prefix inside Bucket. Empty
	// renders no SOS_PREFIX: the gateway then serves the whole bucket.
	Prefix string
	// Endpoint is the store's address for minio (required) and S3-compatible
	// stores (optional). It is an address, not a credential.
	Endpoint string
	// ServicePort is the port the Kubernetes Service publishes: the in-cluster
	// port core allocated to the gRPC endpoint, the one every consumer is told
	// to dial. It forwards to the container's gatewayContainerPort.
	ServicePort uint32
	// AzureAccount is the Azure Blob storage account name. It is non-sensitive
	// (it forms the public blob endpoint host); the shared key that pairs with
	// it is sensitive and travels via the Secret, not the manifest.
	AzureAccount string
}

// supportedDeployBackends is the set of backend kinds Deploy knows how to
// template. It mirrors the gateway's registered backends (minio is honored for
// deployments that point it at an external endpoint); an out-of-set value is a
// misconfiguration the builder rejects rather than passes through.
var supportedDeployBackends = map[string]bool{
	"s3":    true,
	"gcs":   true,
	"azure": true,
	"minio": true,
}

// BuildCapabilities answers the CLI's check before a build that names a Buildx
// builder: this agent executes no docker build of its own — its Build hands
// the CLI a recipe or no image at all — so a selected builder is always
// honoured, by the CLI, which runs every recipe on the builder it selected.
// Without this answer core refuses the whole render of any environment that
// mirrors a registry, because such an environment builds on a dedicated
// builder and core verifies every agent before dispatching to it.
func (s *Builder) BuildCapabilities(context.Context, *builderv0.BuildCapabilitiesRequest) (*builderv0.BuildCapabilitiesResponse, error) {
	return &builderv0.BuildCapabilitiesResponse{BuildxSelection: true}, nil
}

func NewBuilder() *Builder {
	service := NewService()
	return &Builder{
		DefaultBuilder: services.NewDefaultBuilder(service.Builder),
		Service:        service,
	}
}

func (s *Builder) Load(ctx context.Context, req *builderv0.LoadRequest) (*builderv0.LoadResponse, error) {
	defer s.Wool.Catch()
	return s.Builder.LoadService(ctx, req, services.BuilderLoad{
		Settings:         s.Settings,
		Requirements:     requirements,
		FactoryTemplates: factoryFS,
		ResolveEndpoints: func(ctx context.Context, endpoints []*v0.Endpoint) error {
			endpoint, err := resolveServingGRPCEndpoint(ctx, endpoints)
			if err != nil {
				return err
			}
			s.GrpcEndpoint = endpoint
			s.TenantStoreEndpoint = resolveTenantStoreEndpoint(ctx, endpoints)
			return nil
		},
	})
}

func (s *Builder) Audit(ctx context.Context, req *builderv0.AuditRequest) (*builderv0.AuditResponse, error) {
	defer s.Wool.Catch()
	ctx = s.Wool.Inject(ctx)
	return s.Builder.AuditContainer(ctx, req, gatewayImage.FullName())
}

// SBOM answers a source-scope request with the package inventory this agent has
// always produced, and an image-scope request with evidence bound to the digest
// and platform of every image the service ships. A caller that resolved the
// images itself passes them as subjects; an empty subject list asks the agent to
// enumerate its own.
func (s *Builder) SBOM(ctx context.Context, req *builderv0.SBOMRequest) (*builderv0.SBOMResponse, error) {
	defer s.Wool.Catch()
	ctx = s.Wool.Inject(ctx)
	if req.GetScope() != builderv0.SBOMScope_SBOM_SCOPE_IMAGE {
		return s.Builder.SBOMContainer(ctx, gatewayImage.FullName())
	}
	if subjects := req.GetSubjects(); len(subjects) > 0 {
		return s.Builder.SBOMImages(ctx, subjects)
	}
	subjects, err := s.imageSubjects(ctx)
	if err != nil {
		return s.Builder.SBOMImageError(err)
	}
	return s.Builder.SBOMImages(ctx, subjects)
}

// imageSubjects enumerates the images this service ships, and the way to reach
// them. The gateway is the only one: MinIO backs local runs and never reaches a
// deployment manifest, so inventorying it would report coverage of something the
// deployed service does not run.
//
// The subjects themselves come from imageevidence, which the release command
// reads too, so the evidence a release publishes describes the same images the
// agent reports.
func (s *Builder) imageSubjects(ctx context.Context) ([]*builderv0.ImageSubject, error) {
	image, overridden := effectiveGatewayImage()
	return imageevidence.Subjects(ctx, s.Base.Unique(), image.FullName(), overridden)
}

func (s *Builder) Deploy(ctx context.Context, req *builderv0.DeploymentRequest) (*builderv0.DeploymentResponse, error) {
	defer s.Wool.Catch()
	ctx = s.Wool.Inject(ctx)
	s.Base.SetDockerImage(gatewayImage)
	// The tenant-store endpoint is the local MinIO, and a deployment starts
	// none: rendering it would publish an address nothing serves.
	if s.TenantStoreEndpoint != nil {
		return s.Builder.DeployError(fmt.Errorf("endpoint %q serves the MinIO a local run starts; a deployment runs none, so a service declaring it cannot be deployed", tenantStoreEndpointName))
	}

	// Resolve the effective backend and credentials from the deployment
	// configuration; without this the template only ever sees the zero-value
	// config and can never name gcs/azure.
	if err := s.LoadConfiguration(ctx, req.GetConfiguration()); err != nil {
		return s.Builder.DeployError(err)
	}

	parameters := &deploymentTemplateParameters{
		Backend:      s.conf.backend,
		Bucket:       s.conf.bucket, // LoadConfiguration already defaults bucket/region.
		Region:       s.conf.region,
		Prefix:       s.conf.prefix,
		Endpoint:     s.conf.endpoint,
		AzureAccount: s.conf.azureAccount,
	}
	servicePort, err := s.servicePort(ctx, req.GetNetworkMappings())
	if err != nil {
		return s.Builder.DeployError(err)
	}
	parameters.ServicePort = servicePort
	// Local runs default to MinIO; a deployment that names no backend targets
	// S3. An explicit backend (including minio-against-an-endpoint) is honored.
	if parameters.Backend == "" {
		parameters.Backend = "s3"
	}
	// Validate the resolved backend before templating. The builder reports the
	// deploy as a success once the manifest is written, so an unknown backend
	// kind or an azure deployment missing its (non-secret) account name would
	// otherwise ship a manifest that passes every probe and then fails on the
	// gateway's first storage call. Reject it here, at the layer that owns the
	// manifest, with an actionable error instead of a silently broken deploy.
	if !supportedDeployBackends[parameters.Backend] {
		return s.Builder.DeployError(fmt.Errorf("unsupported deploy backend %q (want one of s3, gcs, azure, minio)", parameters.Backend))
	}
	if parameters.Backend == "azure" && parameters.AzureAccount == "" {
		return s.Builder.DeployError(fmt.Errorf("backend azure requires SOS_AZURE_ACCOUNT (the storage account name)"))
	}
	// A deployment never starts MinIO — only the local Runtime does — so minio
	// here means "a MinIO someone else runs", and the gateway needs its address.
	// This is NOT rejected at render time: the environment's service
	// configuration is bound onto the rendered container after this render (the
	// CLI replaces SOS_* literals by name on the container that declares
	// CODEFLY__SERVICE), so a spec still on the local default (backend: minio) is
	// the normal input for a cell that selects its store that way. What this
	// render cannot see, the gateway refuses at startup with the remedy (see
	// internal/config checkBackendIsComplete) instead of the MinIO SDK's
	// "Endpoint:  does not follow ip address or domain name standards".
	if parameters.Backend == "minio" && parameters.Endpoint == "" {
		s.Wool.Warn("rendering backend minio with no SOS_ENDPOINT: the gateway will refuse to start unless the environment's service configuration selects a store (e.g. SOS_BACKEND=gcs, SOS_BUCKET)")
	}
	if _, err := backend.NormalizePrefix(parameters.Prefix); err != nil {
		return s.Builder.DeployError(err)
	}
	// A key-file path cannot be honored by this deployment: nothing projects the
	// key into the pod. The configuration channel carries the path, never the
	// service-account JSON, and the only file seam the manifest has is
	// ConfigMap-backed — the wrong home for a private key. Emitting the env var
	// anyway names a path that does not exist, and the gateway then fails on its
	// first storage call after passing every probe. Keyless auth is the remedy
	// on GKE; off GKE (EKS, AKS, on-prem) there is no Workload Identity and no
	// metadata server, so the key has to be mounted by an overlay this agent
	// does not own and the env var patched on there. Either way, reject the
	// path rather than render a manifest that lies about it.
	if parameters.Backend == "gcs" && s.conf.gcsCredentialsFile != "" {
		return s.Builder.DeployError(fmt.Errorf("SOS_GCS_CREDENTIALS_FILE cannot be delivered by this deployment: "+
			"nothing here mounts %s into the pod, so the gateway would name a path that does not exist; "+
			"on GKE, unset it and bind the workload's Kubernetes ServiceAccount to a GCP service account "+
			"(Workload Identity); elsewhere, mount the key from an overlay of your own and patch "+
			"SOS_GCS_CREDENTIALS_FILE onto the container there "+
			"(see README \"Running as a codefly service\")", s.conf.gcsCredentialsFile))
	}
	// A configured gateway token cannot be honored by this deployment: the
	// manifest carries no secret values (DeployKustomize is not wired for
	// configuration inputs here, the same gap SOS_SECRET_KEY / SOS_AZURE_KEY sit
	// behind), and CreateConnectionConfiguration only emits a token the Runtime
	// generated, so consumers would receive none. Accepting it would render a
	// manifest that either crash-loops the gateway or, worse, starts a gateway
	// enforcing a credential every consumer lacks. Reject it where the manifest
	// is owned, as with an unsupported backend.
	if s.conf.authToken != "" {
		return s.Builder.DeployError(fmt.Errorf("SOS_AUTH_TOKEN cannot be delivered by this deployment: " +
			"the emitted Secret carries no configuration values and consumers would receive no credential; " +
			"caller identity in the deployed profile is enforced by the cluster (see README \"Authentication\")"))
	}
	return s.Builder.DeployKustomize(ctx, req, services.KustomizeDeployment{
		EnvironmentVariables: s.EnvironmentVariables,
		Templates:            deploymentFS,
		Parameters:           parameters,
		PodOverlay:           workloadPodOverlay(),
	})
}

// servicePort is the port the rendered Service publishes for the gRPC endpoint:
// the in-cluster port core allocated to it, which is what every consumer is
// given to dial. With no container mapping for this endpoint in the request (a
// render with no network input) it keeps the container port, so that render is
// unchanged.
func (s *Builder) servicePort(ctx context.Context, mappings []*v0.NetworkMapping) (uint32, error) {
	if s.GrpcEndpoint != nil {
		for _, mapping := range mappings {
			endpoint := mapping.GetEndpoint()
			if endpoint.GetApi() != standards.GRPC ||
				endpoint.GetModule() != s.GrpcEndpoint.GetModule() ||
				endpoint.GetService() != s.GrpcEndpoint.GetService() ||
				endpoint.GetName() != s.GrpcEndpoint.GetName() {
				continue
			}
			// An external endpoint is reached through its DNS entry, never this
			// Service, and core gives it no container view.
			if resources.IsExternalEndpoint(endpoint) {
				continue
			}
			instance, err := resources.FindNetworkInstanceInNetworkMappings(ctx, mappings, endpoint, resources.NewContainerNetworkAccess())
			if err != nil {
				return 0, err
			}
			return instance.GetPort(), nil
		}
	}
	return gatewayContainerPort, nil
}

// workloadPodOverlay gives the gateway its own Kubernetes ServiceAccount, named
// after the service (core defaults an unnamed account to the service's DNS
// name) and rendered in the namespace the deployment targets. Running under the
// namespace default would make the gateway's cloud identity the one every other
// workload in that namespace shares: keyless stores (GKE Workload Identity, and
// the AKS/EKS equivalents) grant on the Kubernetes principal, so a grant to
// `default` is a grant to all of them. With a dedicated account the store's IAM
// can name exactly this workload — on GKE the member
// serviceAccount:<project>.svc.id.goog[<namespace>/<service name>].
//
// The account carries no annotations: a direct Workload Identity grant needs
// none. An environment that declares a runtime identity for this service has
// the CLI project it onto this same account (same name), merging annotations.
func workloadPodOverlay() *services.PodTemplateOverlay {
	return &services.PodTemplateOverlay{ServiceAccount: &services.WorkloadServiceAccount{}}
}

func (s *Builder) Create(ctx context.Context, req *builderv0.CreateRequest) (*builderv0.CreateResponse, error) {
	defer s.Wool.Catch()
	if err := s.Templates(ctx, s.Information, services.WithFactory(factoryFS)); err != nil {
		return s.Builder.CreateError(err)
	}
	if err := s.CreateEndpoints(ctx); err != nil {
		return s.Builder.CreateErrorf(err, "cannot create endpoints")
	}
	return s.Builder.CreateResponse(ctx, s.Settings)
}

func (s *Builder) CreateEndpoints(ctx context.Context) error {
	grpc, err := resources.LoadGrpcAPI(ctx, nil)
	if err != nil {
		return s.Wool.Wrapf(err, "cannot load grpc api")
	}
	endpoint := s.Base.BaseEndpoint(standards.GRPC)
	endpoint.Visibility = resources.VisibilityPrivate
	s.GrpcEndpoint, err = resources.NewAPI(ctx, endpoint, resources.ToGrpcAPI(grpc))
	if err != nil {
		return s.Wool.Wrapf(err, "cannot create grpc endpoint")
	}
	s.Endpoints = []*v0.Endpoint{s.GrpcEndpoint}
	s.Wool.Debug("created endpoints", wool.Field("endpoints", resources.MakeManyEndpointSummary(s.Endpoints)))
	return nil
}

func (s *Builder) Communicate(stream builderv0.Builder_CommunicateServer) error {
	asker := communicate.NewQuestionAsker(stream)
	_, err := asker.RunSequence(nil)
	return err
}

//go:embed templates/factory
var factoryFS embed.FS

//go:embed templates/deployment
var deploymentFS embed.FS