Terraform state: list, download and restore kept versions 67523e06ed86

        .route("/repos/{owner}/{name}/terraform/state/{state}/versions", axum::routing::get(crate::terraform::versions))

        .route("/repos/{owner}/{name}/terraform/state/{state}/versions/{id}", axum::routing::get(crate::terraform::version))

        .route(

            "/repos/{owner}/{name}/terraform/state/{state}/versions/{id}/restore",

            axum::routing::post(crate::terraform::restore_version),

        )

/// A kept version of a state (#255), without its body.

#[derive(Clone, Debug, FromRow)]

pub struct TfVersion {

    pub id: i64,

    pub serial: i64,

    pub created_by: String,

    pub created_ms: i64,

}

/// A state's kept versions, newest first.

pub async fn version_list(pool: &Pool, repo_id: i64, name: &str) -> sqlx::Result<Vec<TfVersion>> {

    sqlx::query_as(

        "SELECT id, serial, created_by, created_ms FROM terraform_state_versions WHERE repo_id = $1 AND name = $2 ORDER BY id DESC",

    )

    .bind(repo_id)

    .bind(name)

    .fetch_all(pool)

    .await

}

/// One kept version's sealed body and serial.

pub async fn version_body(pool: &Pool, repo_id: i64, name: &str, id: i64) -> sqlx::Result<Option<(Vec<u8>, i64)>> {

    sqlx::query_as("SELECT body, serial FROM terraform_state_versions WHERE repo_id = $1 AND name = $2 AND id = $3")

        .bind(repo_id)

        .bind(name)

        .bind(id)

        .fetch_optional(pool)

        .await

}

//! kept, so a bad apply can be rolled back: a kept version is restored as a

//! new one (#255), so nothing is lost and going forward again is restoring

//! a newer one.

/// Why a restore did not happen.

pub enum RestoreError {

    /// No such version of that state.

    NotFound,

    /// Someone holds the state's lock: who.

    Locked(String),

    /// The kept body does not open or is not JSON.

    Broken,

    Db(sqlx::Error),

}

impl RestoreError {

    pub fn message(&self) -> String {

        match self {

            RestoreError::NotFound => "no such version of this state".into(),

            RestoreError::Locked(by) => format!("the state is locked by {by}: restore it once the lock is released"),

            RestoreError::Broken => "that version does not open: it cannot be restored".into(),

            RestoreError::Db(e) => e.to_string(),

        }

    }

    fn status(&self) -> StatusCode {

        match self {

            RestoreError::NotFound => StatusCode::NOT_FOUND,

            RestoreError::Locked(_) => StatusCode::LOCKED,

            RestoreError::Broken | RestoreError::Db(_) => StatusCode::INTERNAL_SERVER_ERROR,

        }

    }

}

/// Restore kept version `id` of a state (#255): written as a new version

/// whose serial is above the current one (OpenTofu and Terraform take a

/// state only forward), so the state it replaces is kept as a version too.

/// Refused while the state is locked. The new serial.

pub async fn restore(app: &Shared, repo_id: i64, state: &str, id: i64, by: &str) -> Result<i64, RestoreError> {

    let current = db::terraform::get(&app.db, repo_id, state).await.map_err(RestoreError::Db)?;

    if let Some(l) = current.as_ref().filter(|s| !s.lock_id.is_empty()) {

        return Err(RestoreError::Locked(l.locked_by.clone()));

    }

    let (body, old_serial) =

        db::terraform::version_body(&app.db, repo_id, state, id).await.map_err(RestoreError::Db)?.ok_or(RestoreError::NotFound)?;

    let plain = app.secret_key.open(&body).ok_or(RestoreError::Broken)?;

    let mut json: serde_json::Value = serde_json::from_str(&plain).map_err(|_| RestoreError::Broken)?;

    let serial = current.map_or(0, |c| c.serial).max(old_serial) + 1;

    json["serial"] = serial.into();

    let text = serde_json::to_string_pretty(&json).map_err(|_| RestoreError::Broken)?;

    let label = format!("{by}, restoring serial {old_serial}");

    db::terraform::put(&app.db, repo_id, state, &app.secret_key.seal(&text), serial, &label, VERSIONS_KEPT)

        .await

        .map_err(RestoreError::Db)?;

    Ok(serial)

}

/// `GET /api/v1/repos/{owner}/{name}/terraform/state/{state}/versions`:

/// the state's kept versions, newest first (#255).

pub async fn versions(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, state)): Path<(String, String, String)>,

) -> Result<Response, ApiError> {

    let (row, _who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Write).await?;

    let list =

        db::terraform::version_list(&app.db, row.id, &state).await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    let out: Vec<serde_json::Value> = list

        .iter()

        .map(|v| serde_json::json!({ "id": v.id, "serial": v.serial, "written_by": v.created_by, "written_ms": v.created_ms }))

        .collect();

    Ok(json(StatusCode::OK, serde_json::Value::Array(out).to_string()))

}

/// `GET …/terraform/state/{state}/versions/{id}`: one kept version's state.

pub async fn version(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, state, id)): Path<(String, String, String, i64)>,

) -> Result<Response, ApiError> {

    let (row, _who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Write).await?;

    let (body, _) = db::terraform::version_body(&app.db, row.id, &state, id)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such version of this state"))?;

    let plain = app.secret_key.open(&body).ok_or_else(|| err(StatusCode::INTERNAL_SERVER_ERROR, "the version does not open"))?;

    Ok(json(StatusCode::OK, plain))

}

/// `POST …/terraform/state/{state}/versions/{id}/restore`: restore a kept

/// version, by a person with the maintain role (never a job), audited.

pub async fn restore_version(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, state, id)): Path<(String, String, String, i64)>,

) -> Result<Response, ApiError> {

    let (row, who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Maintain).await?;

    let Who::Person { account, .. } = &who else {

        return Err(err(StatusCode::FORBIDDEN, "a job does not restore a state: a person with the maintain role does"));

    };

    let serial = restore(&app, row.id, &state, id, &account.username).await.map_err(|e| err(e.status(), e.message()))?;

    db::accounts::audit(

        &app.db,

        Some(account),

        "terraform.restored",

        &format!("{}:{state}", row.slug()),

        &format!("version {id}, now serial {serial}"),

    )

    .await

    .ok();

    Ok(json(StatusCode::OK, serde_json::json!({ "serial": serial }).to_string()))

}

/// The repository and the caller of a versions endpoint, allowed `access`.

async fn versions_caller(

    app: &Shared,

    headers: &HeaderMap,

    owner: &str,

    name: &str,

    state: &str,

    access: Access,

) -> Result<(db::repos::RepoRow, Who), ApiError> {

    if !valid_name(state) {

        return Err(err(StatusCode::BAD_REQUEST, "a state's name is letters, digits, '-', '_' and '.', up to 100"));

    }

    let row = db::repos::get(&app.db, owner, name)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such repository"))?;

    let who = who(app, headers, &row).await?;

    if !who.may(access) {

        return Err(err(

            StatusCode::FORBIDDEN,

            if access == Access::Maintain { "restoring a state needs the maintain role" } else { "a Terraform state needs the write role" },

        ));

    }

    Ok((row, who))

}

use super::settings::{csrf, require};

use super::{filters, lookup, lookup_role, Error, Page, RepoShell, Shell};

use crate::auth::{Access, Viewer};

use axum::extract::{Form, Path, Query, State};

use axum::http::header;

use axum::response::{IntoResponse, Response};

use serde::Deserialize;

/// A state with its kept versions, newest first.

pub struct StateView {

    pub s: db::terraform::TfState,

    pub versions: Vec<db::terraform::TfVersion>,

}

    states: Vec<StateView>,

    notice: Option<String>,

    error: Option<String>,

}

async fn terraform_page(

    app: &Shared,

    shell: Shell,

    row: db::repos::RepoRow,

    role: crate::auth::Role,

    notice: Option<String>,

    error: Option<String>,

) -> Result<Page<TerraformPage>, Error> {

    let e = |e| Error::from_db(shell.clone(), e);

    let mut states = Vec::new();

    // States hold secrets (#256): only writers see them listed.

    if crate::auth::roles::allows(Some(role), Access::Write) {

        for s in db::terraform::of_repo(&app.db, row.id).await.map_err(e)? {

            let versions = db::terraform::version_list(&app.db, row.id, &s.name).await.map_err(e)?;

            states.push(StateView { s, versions });

        }

    }

    Ok(Page(TerraformPage { shell, repo: RepoShell::new(app, &row, "terraform").with_role(role), states, notice, error }))

/// repository (oxygenhub#252), their versions, and the backend block.

    terraform_page(&app, shell, row, role, None, None).await

}

#[derive(Deserialize)]

pub struct DownloadQuery {

    version: Option<i64>,

}

/// `GET /{owner}/{name}/terraform/{state}/download[?version=ID]`: the

/// current state, or a kept version, for people with the write role.

pub async fn download(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name, state)): Path<(String, String, String)>,

    Query(q): Query<DownloadQuery>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/terraform"), &viewer);

    let (_repo, row, _role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Write).await?;

    let (body, serial) = match q.version {

        Some(id) => db::terraform::version_body(&app.db, row.id, &state, id).await.map_err(e)?,

        None => db::terraform::get(&app.db, row.id, &state).await.map_err(e)?.filter(|s| !s.body.is_empty()).map(|s| (s.body, s.serial)),

    }

    .ok_or_else(|| Error::not_found(shell.clone()))?;

    let plain = app.secret_key.open(&body).ok_or_else(|| Error::not_found(shell.clone()))?;

    let file = format!("{}-serial-{serial}.tfstate", state.replace(|c: char| !(c.is_ascii_alphanumeric() || "-_.".contains(c)), "_"));

    Ok((

        [

            (header::CONTENT_TYPE, "application/json".to_string()),

            (header::CONTENT_DISPOSITION, format!("attachment; filename=\"{file}\"")),

            (header::CACHE_CONTROL, "no-store".to_string()),

        ],

        plain,

    )

        .into_response())

}

#[derive(Deserialize)]

pub struct RestoreForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    version: i64,

}

/// `POST /{owner}/{name}/terraform/{state}/restore` (#255): restore a kept

/// version, by someone with the maintain role, audited.

pub async fn restore(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name, state)): Path<(String, String, String)>,

    Form(f): Form<RestoreForm>,

) -> Result<Page<TerraformPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/terraform"), &viewer);

    let me = require(&viewer, &shell)?;

    let (_repo, row, role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Maintain).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    match crate::terraform::restore(&app, row.id, &state, f.version, &me.account.username).await {

        Ok(serial) => {

            db::accounts::audit(

                &app.db,

                Some(&me.account),

                "terraform.restored",

                &format!("{owner}/{name}:{state}"),

                &format!("version {}, now serial {serial}", f.version),

            )

            .await

            .ok();

            let msg = format!(

                "Restored {state}: it is now serial {serial}. The state it replaced is kept as a version, so you can go back to it."

            );

            terraform_page(&app, shell, row, role, Some(msg), None).await

        }

        Err(e) => terraform_page(&app, shell, row, role, None, Some(format!("Could not restore {state}: {}.", e.message()))).await,

        .route("/{owner}/{name}/terraform/{state}/download", get(artifacts::download))

        .route("/{owner}/{name}/terraform/{state}/restore", post(artifacts::restore))

        .oneshot(Request::get("/andy/infra/terraform").header(header::COOKIE, cookie.clone()).body(Body::empty()).unwrap())

    assert!(page.contains("1 kept version") && page.contains(">restore</button>"), "its versions, restorable by its owner: {page}");

    // Versions (#255) through the API: listed and read with the write role,

    // restored with the maintain role (never by a job, never under a lock),

    // as a new serial, so nothing is lost and going forward again works.

    let andy = db::accounts::account_by_name(&h.app.db, "andy").await.unwrap().unwrap();

    let (pat, hash) = oxygenhub::auth::new_token();

    db::accounts::create_token(&h.app.db, andy.id, "cli", &hash, "repo:write", "", None).await.unwrap();

    let bearer = format!("Bearer {pat}");

    let (st, list) = send("GET", format!("{path}/versions"), Some(bearer.clone()), "").await;

    assert_eq!(st, StatusCode::OK, "{list}");

    let list: serde_json::Value = serde_json::from_str(&list).unwrap();

    assert_eq!((list.as_array().unwrap().len(), list[0]["serial"].as_i64()), (1, Some(1)), "{list}");

    let first = list[0]["id"].as_i64().unwrap();

    let (st, got) = send("GET", format!("{path}/versions/{first}"), Some(bearer.clone()), "").await;

    assert_eq!((st, got.as_str()), (StatusCode::OK, state1));

    assert_eq!(send("GET", format!("{path}/versions"), Some(format!("Bearer {secret}")), "").await.0, StatusCode::FORBIDDEN, "a stranger");

    let restore = |id: i64, auth: String| send("POST", format!("{path}/versions/{id}/restore"), Some(auth), "");

    assert_eq!(restore(first, basic.clone()).await.0, StatusCode::FORBIDDEN, "a job does not restore");

    assert_eq!(restore(first, format!("Bearer {secret}")).await.0, StatusCode::FORBIDDEN, "nor a stranger");

    assert_eq!(restore(9999, bearer.clone()).await.0, StatusCode::NOT_FOUND);

    assert_eq!(send("LOCK", path.into(), Some(basic.clone()), lock).await.0, StatusCode::OK);

    assert_eq!(restore(first, bearer.clone()).await.0, StatusCode::LOCKED, "not under someone's lock");

    assert_eq!(send("UNLOCK", path.into(), Some(basic.clone()), lock).await.0, StatusCode::OK);

    let (st, got) = restore(first, bearer.clone()).await;

    assert_eq!((st, got.contains("\"serial\":3")), (StatusCode::OK, true), "{got}");

    let (_, now) = send("GET", path.into(), Some(bearer.clone()), "").await;

    let now: serde_json::Value = serde_json::from_str(&now).unwrap();

    assert_eq!(

        (now["serial"].as_i64(), now["lineage"].as_str(), now["resources"][0]["secret"].as_str()),

        (Some(3), Some("l"), Some("hunter2"))

    );

    // Forward again: serial 2 is a kept version now.

    let (_, list) = send("GET", format!("{path}/versions"), Some(bearer.clone()), "").await;

    let list: serde_json::Value = serde_json::from_str(&list).unwrap();

    let serials: Vec<i64> = list.as_array().unwrap().iter().map(|v| v["serial"].as_i64().unwrap()).collect();

    assert_eq!(serials, vec![2, 1], "{list}");

    let (st, got) = restore(list[0]["id"].as_i64().unwrap(), bearer.clone()).await;

    assert_eq!((st, got.contains("\"serial\":4")), (StatusCode::OK, true), "{got}");

    // And from the page: download a version, restore one with the form.

    let page_with = |req: axum::http::request::Builder, body: Body| {

        let (app, cookie) = (h.app.clone(), cookie.clone());

        async move {

            let res = oxygenhub::router(app).oneshot(req.header(header::COOKIE, cookie).body(body).unwrap()).await.unwrap();

            let st = res.status();

            (st, String::from_utf8_lossy(&res.into_body().collect().await.unwrap().to_bytes()).into_owned())

        }

    };

    let (st, file) = page_with(Request::get(format!("/andy/infra/terraform/prod/download?version={first}")), Body::empty()).await;

    assert_eq!((st, file.as_str()), (StatusCode::OK, state1));

    let (_, page) = page_with(Request::get("/andy/infra/terraform"), Body::empty()).await;

    let csrf = page.split("name=\"_csrf\" value=\"").nth(1).unwrap().split('"').next().unwrap().to_string();

    let (st, page) = page_with(

        Request::post("/andy/infra/terraform/prod/restore").header(header::CONTENT_TYPE, "application/x-www-form-urlencoded"),

        Body::from(format!("_csrf={csrf}&version={first}")),

    )

    .await;

    assert_eq!(st, StatusCode::OK, "{page}");

    assert!(page.contains("Restored prod: it is now serial 5."), "{page}");

    let audit = db::accounts::audit_rows(&h.app.db, 50).await.unwrap();

    assert_eq!(audit.iter().filter(|r| r.action == "terraform.restored").count(), 3, "every restore audited");

**Storage:** each state is sealed at rest with the hub's secrets key, and the last 20 versions before it are kept (migration 0079: `terraform_states`, `terraform_state_versions`). Backups carry the sealed bodies, which open only with this hub's key. A repository's Artifacts › Terraform state page (`/{owner}/{name}/terraform`) lists its states, serials, writers, locks and versions, with the backend block to use.

**Versions (oxygenhub#255):** each state's kept versions are listed on that page (serial, writer, when), and the current state and each version download as `.tfstate` files, for people with the write role. A person with the maintain role restores a version: it is written again with a serial above the current one (OpenTofu and Terraform only take a state forward), and the state it replaces is kept as a version, so a restore never loses anything and going forward again is restoring the newer version. A restore is refused while the state is locked, asks for confirmation, and is audited (`terraform.restored`). The API: `GET …/terraform/state/STATE/versions` (newest first: `id`, `serial`, `written_by`, `written_ms`), `GET …/versions/ID` (the state) with the write role, and `POST …/versions/ID/restore` (the new `serial`) with the maintain role, never by a job. Not for the hub's own infrastructure (oxygenhub-gcp), whose state cannot live on the hub it deploys.

<div class="head"><h1>Terraform state <small>{{ states.len() }}</small></h1></div>

{% if let Some(n) = notice %}<p class="note">{{ n }}</p>{% endif %}

{% if let Some(e) = error %}<p class="error">{{ e }}</p>{% endif %}

{% else if states.is_empty() %}<p class="empty">No state yet: the first <code>tofu apply</code> through the backend makes one.</p>{% else %}

<tr><th>State</th><th>Serial</th><th>Last written</th><th>Lock</th><th>Versions kept</th><th></th></tr>

{% for v in states %}<tr><td><strong>{{ v.s.name }}</strong></td><td>{% if v.s.body.is_empty() %}<span class="mute">deleted</span>{% else %}{{ v.s.serial }}{% endif %}</td><td class="small">{% if v.s.updated_by.is_empty() %}<span class="mute">never</span>{% else %}by {{ v.s.updated_by }} <time title="{{ v.s.updated_ms|when_i }}">{{ v.s.updated_ms|ago_i }}</time>{% endif %}</td><td class="small">{% if v.s.lock_id.is_empty() %}<span class="mute">free</span>{% else %}held by {{ v.s.locked_by }}{% if let Some(t) = v.s.locked_ms %} <time title="{{ t|when_i }}">{{ t|ago_i }}</time>{% endif %}{% endif %}</td><td>{{ v.versions.len() }}</td><td class="small">{% if !v.s.body.is_empty() %}<a href="{{ repo.url }}/terraform/{{ v.s.name|urlencode }}/download">download</a>{% endif %}</td></tr>{% endfor %}

</table></div>

{% for v in states %}{% if !v.versions.is_empty() %}

<details class="tf-versions">

  <summary><strong>{{ v.s.name }}</strong>: {{ v.versions.len() }} kept {% if v.versions.len() == 1 %}version{% else %}versions{% endif %}</summary>

  <p class="small mute">Each write keeps the state it replaced (the last {{ crate::terraform::VERSIONS_KEPT }}). Restoring one writes it again with the next serial, so OpenTofu and Terraform take it, and keeps the current state as a version: restoring never loses anything, and a later version can be restored in turn.</p>

  <div class="table"><table>

  <tr><th>Serial</th><th>Written by</th><th>When</th><th></th></tr>

  {% for k in v.versions %}<tr><td>{{ k.serial }}</td><td class="small">{{ k.created_by }}</td><td class="small"><time title="{{ k.created_ms|when_i }}">{{ k.created_ms|ago_i }}</time></td><td class="small"><a href="{{ repo.url }}/terraform/{{ v.s.name|urlencode }}/download?version={{ k.id }}">download</a>{% if repo.can_maintain() %} <form class="tiny" method="post" action="{{ repo.url }}/terraform/{{ v.s.name|urlencode }}/restore" data-confirm="Restore {{ v.s.name }} to serial {{ k.serial }}? It becomes the current state; the current one is kept as a version."><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="version" value="{{ k.id }}"><button>restore</button></form>{% endif %}</td></tr>{% endfor %}

  </table></div>

</details>

{% endif %}{% endfor %}

{% endif %}