felhom-controller/controller/internal/web/agent_disk_handlers.go

package web

import (
	"context"
	"encoding/json"
	"errors"
	"net/http"
	"sort"

	"gitea.dooplex.hu/admin/felhom-controller/internal/agentapi"
)

// Agent-backed disk management (slice 8C, Phase B.2).
//
// Disk EXECUTION (scan/format/mount/migrate) lives in the host agent now; the
// controller is Docker-only and holds no Proxmox/disk credentials. These handlers
// are THIN proxies: they build an agentapi.Client from cfg.LocalAPI and forward
// list/assign/eject/format to the agent's GET/POST /disks endpoints, returning the
// agent's view as JSON. A data-bearing format is refused by the agent (operator
// authorization required) and surfaced here as HTTP 409.

// ServeDiskAPI dispatches /api/disks and /api/disks/* routes.
// Wired in main.go behind RequireAuth + CsrfProtect.
func (s *Server) ServeDiskAPI(w http.ResponseWriter, r *http.Request) {
	if s.isDebug() {
		s.logger.Printf("[DEBUG] [web] ServeDiskAPI: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
	}
	switch {
	case r.URL.Path == "/api/disks" && r.Method == http.MethodGet:
		s.agentDisksListHandler(w, r)
	case r.URL.Path == "/api/disks/candidates" && r.Method == http.MethodGet:
		s.agentDiskCandidatesHandler(w, r)
	case r.URL.Path == "/api/disks/assign" && r.Method == http.MethodPost:
		s.agentDiskAssignHandler(w, r)
	case r.URL.Path == "/api/disks/eject" && r.Method == http.MethodPost:
		s.agentDiskEjectHandler(w, r)
	case r.URL.Path == "/api/disks/format" && r.Method == http.MethodPost:
		s.agentDiskFormatHandler(w, r)
	default:
		http.NotFound(w, r)
	}
}

// agentClient returns the shared pinned client for the host agent's per-guest local API.
// Returns a clear error if the local API is not configured (unprovisioned guest).
//
// The client is built ONCE and reused (cfg.LocalAPI is static per process — a config-apply triggers a
// graceful self-restart). Reusing one *agentapi.Client (one pooled http.Transport) eliminates the
// per-call Transport leak that accumulated idle ESTABLISHED sockets to the agent's :8443 and exhausted
// the ephemeral source-port range after ~5 days of uptime. *agentapi.Client/*http.Client are safe for
// concurrent use, so the (19) callers need no extra locking. The empty-endpoint guard stays OUTSIDE the
// Once so it is re-checked each call (defensive; the endpoint is static); only a real build result
// (client, or a construction error like a bad fingerprint — neither changes without a restart) is memoized.
func (s *Server) agentClient() (*agentapi.Client, error) {
	if s.cfg.LocalAPI.Endpoint == "" {
		return nil, errors.New("agent not configured")
	}
	s.agentCliOnce.Do(func() {
		s.agentCli, s.agentCliErr = agentapi.New(
			s.cfg.LocalAPI.Endpoint, s.cfg.LocalAPI.Token, s.cfg.LocalAPI.Fingerprint)
		if s.agentCliErr == nil {
			// v0.116.0: per-call DEBUG traces into the capture ring (method/path/status/duration).
			s.agentCli.SetLogger(s.logger)
		}
	})
	return s.agentCli, s.agentCliErr
}

// ProbeAgentChannel runs one controller→agent channel health probe using the PRODUCTION memoized
// client (NOT a fresh one — spike SPIKE-controller-agent-channel-health-2026-06-29: it self-heals,
// reflects exactly what the disk UI sees, and avoids the per-call transport leak the singleton fixed).
// It returns whether the failure was a CONSTRUCTION error (agentClient() couldn't build — a latching
// config fault, distinct from a runtime channel failure) and the error (nil = channel up). The probe
// is GET /storage (cheap, read-only — the same call probeLocalAPI uses at startup). This is the
// channelhealth.Probe seam.
func (s *Server) ProbeAgentChannel(ctx context.Context) (constructionErr bool, err error) {
	client, cerr := s.agentClient()
	if cerr != nil {
		return true, cerr
	}
	_, serr := client.Storage(ctx)
	return false, serr
}

// writeDiskJSON writes the standard {ok,data,error} envelope used by the disk API.
func writeDiskJSON(w http.ResponseWriter, status int, ok bool, errMsg string, data interface{}) {
	// Cloudflare replaces origin 502/504 bodies with its OWN HTML error page (no passthru on
	// this plan) — the page JS then fails to parse JSON and the customer sees a SyntaxError
	// alert instead of the Hungarian message (live-hit 2026-07-13: the M1 decommission refusal
	// surfaced as "<!DOCTYPE ... is not valid JSON"). App-level JSON errors must never leave
	// the origin as 502/504; 500 carries the body through the edge intact.
	if status == http.StatusBadGateway || status == http.StatusGatewayTimeout {
		status = http.StatusInternalServerError
	}
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	resp := map[string]interface{}{"ok": ok}
	if errMsg != "" {
		resp["error"] = errMsg
	}
	if data != nil {
		resp["data"] = data
	}
	_ = json.NewEncoder(w).Encode(resp)
}

// agentDisksListHandler proxies GET /api/disks → agent GET /disks.
func (s *Server) agentDisksListHandler(w http.ResponseWriter, r *http.Request) {
	client, err := s.agentClient()
	if err != nil {
		writeDiskJSON(w, http.StatusServiceUnavailable, false, s.errText(r, err), nil)
		return
	}
	resp, err := client.Disks(r.Context())
	if err != nil {
		s.logger.Printf("[ERROR] [web] disk list via agent failed: %v", err)
		writeDiskJSON(w, http.StatusBadGateway, false, s.errText(r, err), nil)
		return
	}
	// Deterministic order: the agent's storage view iterates a Go map (unordered), so the list would
	// otherwise reorder on every reload (CLAUDE.md lesson #3). The customer's manageable drives go on
	// top, in a stable order: user-data first, then system, then backup, alpha by name within a tier.
	sortDisksForView(resp.Disks)
	writeDiskJSON(w, http.StatusOK, true, "", resp)
}

// agentDiskCandidatesHandler proxies GET /api/disks/candidates → agent GET /disks/candidates (Impl-2b):
// the raw-device scan (Impl-2a) that feeds the enrollment wizards. The agent's unclaimed-disk filter
// already excludes claimed/OS/enrolled disks (fail-safe), so `initialize` passes through UNTOUCHED —
// no controller-side filtering, and the system/backup drives it hides from the format wizard stay
// hidden.
//
// R-280: `attach` additionally carries the controller's own mounted-but-unregistered filesystems.
// The agent's scan alone left a rebuilt box with an empty picker under a sentence promising „két
// kattintás", because the drive that must be re-registered is an in-guest filesystem no host-disk
// scan can see. Attaching is non-destructive, so this list is additive by nature — it can only ever
// offer MORE places to put data back, never a new way to erase any. Why the union rather than a
// replacement: the agent's entries serve the case this endpoint was built for — a fresh external
// drive that already carries a filesystem and is not yet mounted — which the mount table cannot
// report precisely because it is not mounted. Dropping them would fix the reinstall and break the USB.
func (s *Server) agentDiskCandidatesHandler(w http.ResponseWriter, r *http.Request) {
	client, err := s.agentClient()
	if err != nil {
		writeDiskJSON(w, http.StatusServiceUnavailable, false, s.errText(r, err), nil)
		return
	}
	resp, err := client.ListCandidates(r.Context())
	if err != nil {
		s.logger.Printf("[ERROR] [web] disk candidates via agent failed: %v", err)
		writeDiskJSON(w, http.StatusBadGateway, false, s.errText(r, err), nil)
		return
	}
	writeDiskJSON(w, http.StatusOK, true, "", mergeAttachCandidates(resp, s.attachableStores()))
}

// mergeAttachCandidates adds the mounted-but-unregistered stores to `attach` and returns the result.
// `initialize` is passed through untouched — the ONE line that keeps the format wizard's protection
// intact, and the reason this is a separate function rather than two appends at the call site: it can
// be tested, and a change to it fails a test instead of shipping.
func mergeAttachCandidates(resp agentapi.CandidatesResult, stores []mountedStore) agentapi.CandidatesResult {
	resp.Attach = append(resp.Attach, mountedStoreCandidates(stores)...)
	return resp
}

// mountedStoreCandidates renders mounted-but-unregistered stores in the picker's shape. MountSource
// carries the mountpoint (the thing the register action needs); Device is display only.
func mountedStoreCandidates(stores []mountedStore) []agentapi.DiskCandidate {
	out := make([]agentapi.DiskCandidate, 0, len(stores))
	for _, m := range stores {
		out = append(out, agentapi.DiskCandidate{
			Device:      m.Device,
			FSType:      m.FSType,
			MountSource: m.Path,
			DataBearing: true,
			Mountable:   true,
			// Size is deliberately absent: measuring it means statfs on a possibly-wedged device
			// inside a request handler, and a picker entry is actionable without it.
			AlreadyMounted: true,
		})
	}
	return out
}

// sortDisksForView orders the agent's disk list deterministically (user-data → system → backup →
// unrecognized; alphabetical by storage name within each tier). A stable Go-side contract beats
// relying on map iteration order or template JS alone.
func sortDisksForView(disks []agentapi.DiskInfo) {
	sort.SliceStable(disks, func(i, j int) bool {
		if ri, rj := diskRoleRank(disks[i].Role), diskRoleRank(disks[j].Role); ri != rj {
			return ri < rj
		}
		return disks[i].Name < disks[j].Name
	})
}

// diskRoleRank ranks a role for the overview ordering (lower sorts first).
func diskRoleRank(role string) int {
	switch role {
	case "user-data":
		return 0
	case "system":
		return 1
	case "backup":
		return 2
	default:
		return 3
	}
}

// agentDiskAssignHandler proxies POST /api/disks/assign → agent POST /disks/assign.
func (s *Server) agentDiskAssignHandler(w http.ResponseWriter, r *http.Request) {
	var req struct {
		UUID    string `json:"uuid"`
		Where   string `json:"where"`
		FSType  string `json:"fstype"`
		Options string `json:"options"`
	}
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeDiskJSON(w, http.StatusBadRequest, false, "invalid request body", nil)
		return
	}
	if req.UUID == "" || req.Where == "" {
		writeDiskJSON(w, http.StatusBadRequest, false, "uuid and where are required", nil)
		return
	}
	client, err := s.agentClient()
	if err != nil {
		writeDiskJSON(w, http.StatusServiceUnavailable, false, s.errText(r, err), nil)
		return
	}
	if err := client.AssignDisk(r.Context(), req.UUID, req.Where, req.FSType, req.Options); err != nil {
		s.logger.Printf("[ERROR] [web] disk assign via agent failed: %v", err)
		writeDiskJSON(w, http.StatusBadGateway, false, s.errText(r, err), nil)
		return
	}
	writeDiskJSON(w, http.StatusOK, true, "", map[string]interface{}{
		"uuid": req.UUID, "where": req.Where,
	})
}

// agentDiskEjectHandler proxies POST /api/disks/eject → agent POST /disks/eject.
func (s *Server) agentDiskEjectHandler(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Where string `json:"where"`
	}
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeDiskJSON(w, http.StatusBadRequest, false, "invalid request body", nil)
		return
	}
	if req.Where == "" {
		writeDiskJSON(w, http.StatusBadRequest, false, "where is required", nil)
		return
	}
	client, err := s.agentClient()
	if err != nil {
		writeDiskJSON(w, http.StatusServiceUnavailable, false, s.errText(r, err), nil)
		return
	}
	resp, err := client.EjectDisk(r.Context(), req.Where)
	if err != nil {
		s.logger.Printf("[ERROR] [web] disk eject via agent failed: %v", err)
		writeDiskJSON(w, http.StatusBadGateway, false, s.errText(r, err), nil)
		return
	}
	writeDiskJSON(w, http.StatusOK, true, "", resp)
}

// agentDiskFormatHandler proxies POST /api/disks/format → agent POST /disks/format.
// A data-bearing format refusal (ErrFormatRefused) is surfaced as HTTP 409 so the UI
// can show "operator authorization required".
func (s *Server) agentDiskFormatHandler(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Device    string `json:"device"`
		FSType    string `json:"fstype"`
		Confirmed bool   `json:"confirmed"`
		DurableID string `json:"durable_id"`
	}
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeDiskJSON(w, http.StatusBadRequest, false, "invalid request body", nil)
		return
	}
	if req.Device == "" {
		writeDiskJSON(w, http.StatusBadRequest, false, "device is required", nil)
		return
	}
	client, err := s.agentClient()
	if err != nil {
		writeDiskJSON(w, http.StatusServiceUnavailable, false, s.errText(r, err), nil)
		return
	}
	resp, err := client.FormatDisk(r.Context(), req.Device, req.FSType, req.Confirmed, req.DurableID)
	if errors.Is(err, agentapi.ErrNeedsConfirmation) {
		s.logger.Printf("[INFO] [web] disk format needs customer confirmation (user-data): %s", req.Device)
		writeDiskJSON(w, http.StatusConflict, false, "customer confirmation required", resp)
		return
	}
	if errors.Is(err, agentapi.ErrFormatRefused) {
		s.logger.Printf("[WARN] [web] disk format refused by agent (system/backup-protected): %s", req.Device)
		writeDiskJSON(w, http.StatusConflict, false, "operator authorization required", resp)
		return
	}
	if err != nil {
		s.logger.Printf("[ERROR] [web] disk format via agent failed: %v", err)
		writeDiskJSON(w, http.StatusBadGateway, false, s.errText(r, err), nil)
		return
	}
	writeDiskJSON(w, http.StatusOK, true, "", resp)
}