cms-SiteForge/app/release_api.py

"""Site-level production endpoints: approval+quality gates, signed HTTPS releases."""
import hashlib,json,os,time
from pathlib import Path
from fastapi import APIRouter,HTTPException,Request,Body
from pydantic import BaseModel,Field
from . import db,enterprise,quality,secret_refs,safe_http,jobs
from .deploy_agent import signature
from . import release_targets

router=APIRouter(prefix='/api/production',tags=['Production delivery'])

def setup():
    with db.connect() as c:
        c.executescript('''CREATE TABLE IF NOT EXISTS remote_releases(
        site_id TEXT NOT NULL, build_id TEXT NOT NULL, target TEXT NOT NULL,
        release_id TEXT NOT NULL, actor TEXT NOT NULL, deployed_at TEXT NOT NULL,
        PRIMARY KEY(site_id,target,release_id),
        FOREIGN KEY(site_id) REFERENCES sites(id) ON DELETE CASCADE);''')

class DeployRequest(BaseModel):
    build_id:str=Field(min_length=1,max_length=100)
    target:str=Field(default='staging',pattern='^(staging|production)$')


def approved(site_id,build_id):
    from . import factory_api
    row=db.one('SELECT * FROM builds WHERE site_id=? AND id=?',(site_id,build_id))
    if not row:
        raise HTTPException(404,'Build not found')
    # Only the persisted finished build is deployable. Queued/running/unknown
    # states must fail closed (the legacy check accidentally allowed them).
    if row['status'] != 'complete':
        raise HTTPException(409,'Build has not completed successfully')
    if not row['zip_path']:
        raise HTTPException(409,'Build archive unavailable')
    site=db.one('SELECT mode FROM sites WHERE id=?',(site_id,))
    if site['mode']=='migration':
        diff=enterprise.diff_baseline(site_id)
        if not diff['baseline_count'] or diff['errors']:
            raise HTTPException(409,'Migration audit incomplete')
        from . import cms_pipeline
        if cms_pipeline.open_reviews(site_id):
            raise HTTPException(409,'Unresolved CMS import review findings')
    try:
        q=quality.report(site_id,build_id)
    except (FileNotFoundError, OSError):
        raise HTTPException(409,'Build output missing; rebuild before release')
    if not q['passed']:raise HTTPException(409,'Build quality gate failed')
    request=db.one('SELECT id FROM release_requests WHERE site_id=? AND build_id=? AND state=? LIMIT 1',(site_id,build_id,'approved'))
    if not request:raise HTTPException(409,'Independent release approval required')
    return row


def _target_config(target, *, resolve_secret=True):
    if target not in ('staging','production'):
        raise HTTPException(400,'无效的目标环境')
    prefix='SITEFORGE_DEPLOY_'+target.upper()
    url=os.environ.get(prefix+'_URL','').rstrip('/')
    ref=os.environ.get(prefix+'_SECRET_REF','')
    if not resolve_secret:
        if ref:
            try:secret_refs.validate_reference(ref)
            except secret_refs.SecretReferenceError:raise HTTPException(503,'密钥引用格式无效')
        if not url.startswith('https://') or not (ref or os.environ.get(prefix+'_SECRET')):
            raise HTTPException(503,'请先配置 HTTPS 发布目标和密钥引用')
        return url,''
    try:secret=secret_refs.resolve(ref) if ref else os.environ.get(prefix+'_SECRET','')
    except secret_refs.SecretReferenceError:raise HTTPException(503,'未能读取远程发布密钥')
    if not url.startswith('https://') or len(secret)<32:
        raise HTTPException(503,'请先配置 HTTPS 发布目标和长度不少于32位的密钥')
    return url,secret


def _remote(site,url,secret,method,path,body=b''):
    stamp=str(int(time.time()))
    headers={'X-SiteForge-Timestamp':stamp,'X-SiteForge-Signature':signature(secret,site,stamp,body,method,path)}
    if body:headers['Content-Type']='application/zip'
    try:
        if method=='POST':response=safe_http.post(url+path,body=body,headers=headers,timeout=120)
        else:response=safe_http.fetch(url+path,headers=headers,method='GET',timeout=30)
        # 4xx are validation failures, not retryable network errors.
        if response.status_code in (400,401,403,404,409,413):
            raise HTTPException(409,'远程发布端拒绝操作，请检查签名、存档完整性或版本状态')
        response.raise_for_status()
        return response.json()
    except HTTPException:raise
    except (safe_http.OutboundError,OSError,ValueError) as ex:
        # Never include URL, secret, request headers or upstream response in error message.
        raise HTTPException(502,'远程连接或回应失败，请从任务中心重试') from ex


def _archive_for(site_id,record):
    archive=Path(record['zip_path']).resolve()
    expected_root=(db.DATA/'archives').resolve()
    if not archive.is_relative_to(expected_root) or not archive.name.startswith(site_id+'-') or not archive.is_file():
        raise HTTPException(409,'构建 ZIP 不存在或地址不安全')
    if archive.stat().st_size>120*1024*1024:
        raise HTTPException(409,'构建包超出 Agent 上传限制')
    return archive


def run_delivery(site_id,kind,opts,job_id):
    """Called only by Worker subprocess; re-check approvals before changing live pointer."""
    target=opts['target']
    mode=release_targets.backend(target)
    if mode=='agent':url,secret=_target_config(target)
    if kind=='remote_deploy':
        build_id=opts['build_id']
        record=approved(site_id,build_id)
        archive=_archive_for(site_id,record)
        if mode!='agent':
            value=release_targets.deploy(target,site_id,archive)
            db.insert('INSERT INTO release_history VALUES (?,?,?,?,?,?)',
                      (enterprise.uid(),site_id,build_id,'worker:'+job_id,'remote:'+target,db.now()))
            db.insert('''INSERT INTO remote_releases VALUES (?,?,?,?,?,?)
                ON CONFLICT(site_id,target,release_id) DO UPDATE SET
                deployed_at=excluded.deployed_at,actor=excluded.actor''',
                (site_id,build_id,target,value['release'],'worker:'+job_id,db.now()))
            return {**value,'build_id':build_id}
        body=archive.read_bytes()
        digest=hashlib.sha256(body).hexdigest()
        # Stage only: no traffic change on upload or checksum failure.
        staged=_remote(site_id,url,secret,'POST',f'/staging/{site_id}',body)
        release=staged['release']
        if digest!=staged.get('sha256') or release!=digest[:20]:
            raise HTTPException(409,'远程存档摘要不匹配，未激活')
        verified=_remote(site_id,url,secret,'GET',f'/sites/{site_id}/verify/{release}')
        if not verified.get('verified') or verified.get('sha256')!=digest:
            raise HTTPException(409,'远程文件校验失败，未激活')
        activated=_remote(site_id,url,secret,'POST',f'/sites/{site_id}/activate/{release}')
        if activated.get('current')!=release or not activated.get('active'):
            raise HTTPException(502,'远程版本切换未确认')
        confirmation=_remote(site_id,url,secret,'GET',f'/sites/{site_id}/verify/{release}')
        # Verify public document is actually served, not only that the pointer changed.
        with __import__('zipfile').ZipFile(archive) as package:
            index_hash=hashlib.sha256(package.read('index.html')).hexdigest()
        probe_ok=False
        try:
            response=safe_http.fetch(f'{url}/public/{site_id}/',timeout=20,max_bytes=8_000_000)
            probe_ok=(response.status_code==200 and hashlib.sha256(response.content).hexdigest()==index_hash)
        except (safe_http.OutboundError,OSError,ValueError):
            pass
        if not confirmation.get('active') or confirmation.get('sha256')!=digest or not probe_ok:
            previous=activated.get('previous')
            if previous and previous!=release:
                try:_remote(site_id,url,secret,'POST',f'/sites/{site_id}/rollback/{previous}')
                except Exception:pass
            raise HTTPException(502,'发布后内容验证未通过，已尝试恢复旧版本，请人工复核')
        db.insert('INSERT INTO release_history VALUES (?,?,?,?,?,?)',
            (enterprise.uid(),site_id,build_id,'worker:'+job_id,'remote:'+target,db.now()))
        db.insert('''INSERT INTO remote_releases VALUES (?,?,?,?,?,?)
            ON CONFLICT(site_id,target,release_id) DO UPDATE SET
              deployed_at=excluded.deployed_at,actor=excluded.actor''',
            (site_id,build_id,target,release,'worker:'+job_id,db.now()))
        return {'published':True,'release':release,'build_id':build_id,'target':target,
                'files':confirmation['files'],'sha256':digest,'previous':activated.get('previous')}
    if kind=='remote_rollback':
        release=opts['release_id']
        old=db.one('SELECT * FROM remote_releases WHERE site_id=? AND target=? AND release_id=?',
                   (site_id,target,release))
        if not old:raise HTTPException(404,'只能回滚至本站曾发布的历史版本')
        if mode!='agent':
            value=release_targets.rollback(target,site_id,release)
            db.insert('INSERT INTO release_history VALUES (?,?,?,?,?,?)',
                      (enterprise.uid(),site_id,old['build_id'],'worker:'+job_id,
                       'remote-rollback:'+target,db.now()))
            return {**value,'build_id':old['build_id']}
        verified=_remote(site_id,url,secret,'GET',f'/sites/{site_id}/verify/{release}')
        if not verified.get('verified'):raise HTTPException(409,'旧版本文件校验失败')
        result=_remote(site_id,url,secret,'POST',f'/sites/{site_id}/rollback/{release}')
        confirmation=_remote(site_id,url,secret,'GET',f'/sites/{site_id}/verify/{release}')
        if not confirmation.get('active'):raise HTTPException(502,'回滚后未能确认线上版本')
        db.insert('INSERT INTO release_history VALUES (?,?,?,?,?,?)',
                  (enterprise.uid(),site_id,old['build_id'],'worker:'+job_id,'remote-rollback:'+target,db.now()))
        return {'rolled_back':True,'target':target,'release':release,'build_id':old['build_id']}
    raise ValueError('Unknown delivery job kind')


@router.get('/sites/{site_id}/delivery-status')
def delivery_status(request:Request,site_id:str):
    enterprise.require(request,site_id,'viewer')
    active=db.rows("SELECT id,kind,state,attempts,error,created_at,result_json FROM build_jobs WHERE site_id=? AND kind IN ('remote_deploy','remote_rollback') ORDER BY created_at DESC LIMIT 30",(site_id,))
    history=db.rows('SELECT * FROM remote_releases WHERE site_id=? ORDER BY deployed_at DESC LIMIT 30',(site_id,))
    # Return target readiness without revealing hostnames or credential refs.
    configured={}
    modes={}
    for t in ('staging','production'):
        modes[t]=release_targets.backend(t)
        try:
            if modes[t]=='agent':_target_config(t,resolve_secret=False)
            else:release_targets.config(t)
            configured[t]=True
        except HTTPException:configured[t]=False
    return {'jobs':active,'history':history,'configured':configured,'backends':modes}


@router.get('/sites/{site_id}/preflight/{build_id}')
def preflight(request:Request,site_id:str,build_id:str):
    enterprise.require(request,site_id,'viewer')
    try:
        record=approved(site_id,build_id)
        _archive_for(site_id,record)
        return {'ready':True,'build_id':build_id,'message':'已满足构建、质量、迁移和独立审批条件'}
    except HTTPException as exc:
        return {'ready':False,'build_id':build_id,'message':str(exc.detail)}


@router.post('/sites/{site_id}/deploy',status_code=202)
def push(request:Request,site_id:str,payload:DeployRequest):
    enterprise.require(request,site_id,'owner')
    record=approved(site_id,payload.build_id)
    _archive_for(site_id,record)
    if release_targets.backend(payload.target)=='agent':_target_config(payload.target,resolve_secret=False)
    else:release_targets.config(payload.target)
    key=request.headers.get('idempotency-key')
    try:return jobs.submit_delivery(site_id,'remote_deploy',
        {'target':payload.target,'build_id':payload.build_id},request.state.actor,key)
    except jobs.JobConflict as exc:raise HTTPException(409,str(exc))
    except jobs.JobCapacityError as exc:raise HTTPException(429,str(exc))


class RollbackRequest(BaseModel):
    release_id:str=Field(pattern=r'^[0-9a-f]{20}$')
    target:str=Field(default='staging',pattern='^(staging|production)$')

@router.post('/sites/{site_id}/rollback',status_code=202)
def rollback_remote(request:Request,site_id:str,payload:RollbackRequest):
    enterprise.require(request,site_id,'owner')
    old=db.one('SELECT * FROM remote_releases WHERE site_id=? AND target=? AND release_id=?',
               (site_id,payload.target,payload.release_id))
    if not old:raise HTTPException(404,'仅允许回滚到本站曾部署过的版本')
    if release_targets.backend(payload.target)=='agent':_target_config(payload.target,resolve_secret=False)
    else:release_targets.config(payload.target)
    key=request.headers.get('idempotency-key')
    try:return jobs.submit_delivery(site_id,'remote_rollback',
        {'target':payload.target,'release_id':payload.release_id},request.state.actor,key)
    except jobs.JobConflict as exc:raise HTTPException(409,str(exc))
    except jobs.JobCapacityError as exc:raise HTTPException(429,str(exc))