felhom.eu/hub/internal/store/appliance.go

package store

import (
	"database/sql"
	"fmt"
	"time"
)

// Appliance registration (v0.62.0, R-21 slice C). A box booted from the GENERIC secret-free ISO
// registers itself here as an unclaimed appliance and polls for its credentials; the operator binds
// it to a customer; ONE poll then delivers (customer-id + retrieval passphrase) and the record is
// consumed. Keyed by (uuid, mac_set) — serials are unusable (N100 DMI "Default string") and cheap
// boards duplicate SMBIOS UUIDs, so the MAC set is the tiebreaker. The appliance token is the box's
// only pre-day-0 credential; only its sha256 is stored here, never the token itself.

// Appliance statuses.
const (
	ApplianceRegistered = "registered" // seen, awaiting an operator bind
	ApplianceBound      = "bound"      // bound to a customer; delivery staged, not yet consumed
	ApplianceDelivered  = "delivered"  // credentials delivered once; every later poll → 410
	ApplianceDiscarded  = "discarded"  // operator ignored it; token invalidated, polls → 404
)

// ApplianceRegistration is one unclaimed/bound appliance record.
type ApplianceRegistration struct {
	ID             int64
	UUID           string
	MACSet         string // sorted, comma-joined physical MACs
	SSHHostPubkeys string // newline-joined authorized_keys-format lines
	HWSummary      string // JSON blob (product, cpu, mem, mode hint)
	Status         string
	CustomerID     string // set at bind
	InstallMode    string // staged at bind (appliance|byo)
	ExtraArgs      string // staged at bind
	FirstSeen      time.Time
	LastSeen       time.Time
	BoundAt        *time.Time
	DeliveredAt    *time.Time
	DiscardedAt    *time.Time
}

// RegisterAppliance upserts by (uuid, mac_set) and stores the fresh token's hash. Re-registration
// updates last_seen and never duplicates. A DISCARDED record stays discarded (sticky — the operator
// said ignore; its poll keeps returning 404, no oracle). Any other existing record is RESET to
// `registered` with the fresh token and its staged bind cleared — a box that is re-registering has no
// token yet, so it is genuinely starting over; the operator re-binds. isNew is true only on first
// insert (so the caller can log the first sighting). The token itself is never passed in — only its
// hash.
func (s *Store) RegisterAppliance(uuid, macSet, sshKeys, hwSummary, tokenHash string) (isNew bool, err error) {
	tx, err := s.db.Begin()
	if err != nil {
		return false, err
	}
	defer tx.Rollback()

	var id int64
	var status string
	row := tx.QueryRow(`SELECT id, status FROM appliance_registrations WHERE uuid = ? AND mac_set = ?`, uuid, macSet)
	switch err := row.Scan(&id, &status); err {
	case sql.ErrNoRows:
		if _, err := tx.Exec(`
			INSERT INTO appliance_registrations (uuid, mac_set, ssh_host_pubkeys, hw_summary, token_hash, status)
			VALUES (?, ?, ?, ?, ?, 'registered')`, uuid, macSet, sshKeys, hwSummary, tokenHash); err != nil {
			return false, fmt.Errorf("register appliance insert: %w", err)
		}
		if err := tx.Commit(); err != nil {
			return false, err
		}
		return true, nil
	case nil:
		// Existing record: refresh last_seen + identity + the token. Sticky-discard keeps its status;
		// everything else resets to registered (a re-registering box is starting over).
		if status == ApplianceDiscarded {
			if _, err := tx.Exec(`UPDATE appliance_registrations
				SET token_hash = ?, ssh_host_pubkeys = ?, hw_summary = ?, last_seen = datetime('now')
				WHERE id = ?`, tokenHash, sshKeys, hwSummary, id); err != nil {
				return false, fmt.Errorf("register appliance (discarded) update: %w", err)
			}
		} else {
			if _, err := tx.Exec(`UPDATE appliance_registrations
				SET token_hash = ?, ssh_host_pubkeys = ?, hw_summary = ?, status = 'registered',
				    customer_id = NULL, install_mode = NULL, extra_args = NULL,
				    bound_at = NULL, delivered_at = NULL, last_seen = datetime('now')
				WHERE id = ?`, tokenHash, sshKeys, hwSummary, id); err != nil {
				return false, fmt.Errorf("register appliance update: %w", err)
			}
		}
		if err := tx.Commit(); err != nil {
			return false, err
		}
		return false, nil
	default:
		return false, fmt.Errorf("register appliance lookup: %w", err)
	}
}

// scanAppliance scans a full appliance row (column order fixed by applianceCols).
const applianceCols = `id, uuid, mac_set, ssh_host_pubkeys, hw_summary, status,
	COALESCE(customer_id,''), COALESCE(install_mode,''), COALESCE(extra_args,''),
	first_seen, last_seen, bound_at, delivered_at, discarded_at`

func scanAppliance(sc interface{ Scan(...any) error }) (*ApplianceRegistration, error) {
	var a ApplianceRegistration
	var firstSeen, lastSeen string
	var boundAt, deliveredAt, discardedAt sql.NullString
	if err := sc.Scan(&a.ID, &a.UUID, &a.MACSet, &a.SSHHostPubkeys, &a.HWSummary, &a.Status,
		&a.CustomerID, &a.InstallMode, &a.ExtraArgs,
		&firstSeen, &lastSeen, &boundAt, &deliveredAt, &discardedAt); err != nil {
		return nil, err
	}
	a.FirstSeen = parseSQLiteTime(firstSeen)
	a.LastSeen = parseSQLiteTime(lastSeen)
	if boundAt.Valid && boundAt.String != "" {
		t := parseSQLiteTime(boundAt.String)
		a.BoundAt = &t
	}
	if deliveredAt.Valid && deliveredAt.String != "" {
		t := parseSQLiteTime(deliveredAt.String)
		a.DeliveredAt = &t
	}
	if discardedAt.Valid && discardedAt.String != "" {
		t := parseSQLiteTime(discardedAt.String)
		a.DiscardedAt = &t
	}
	return &a, nil
}

// ApplianceByToken resolves a token hash to its record (nil, nil when unknown — the poll maps that to
// 404, indistinguishable from a discarded/never-registered token: no enumeration oracle).
func (s *Store) ApplianceByToken(tokenHash string) (*ApplianceRegistration, error) {
	if tokenHash == "" {
		return nil, nil
	}
	a, err := scanAppliance(s.db.QueryRow(`SELECT `+applianceCols+` FROM appliance_registrations WHERE token_hash = ?`, tokenHash))
	if err == sql.ErrNoRows {
		return nil, nil
	}
	return a, err
}

// GetAppliance fetches by row id (operator UI actions).
func (s *Store) GetAppliance(id int64) (*ApplianceRegistration, error) {
	a, err := scanAppliance(s.db.QueryRow(`SELECT `+applianceCols+` FROM appliance_registrations WHERE id = ?`, id))
	if err == sql.ErrNoRows {
		return nil, nil
	}
	return a, err
}

// ListUnclaimedAppliances returns the registered + bound (not-yet-delivered/discarded) records for the
// operator's "Unclaimed appliances" section, newest activity first.
func (s *Store) ListUnclaimedAppliances() ([]ApplianceRegistration, error) {
	rows, err := s.db.Query(`SELECT ` + applianceCols + ` FROM appliance_registrations
		WHERE status IN ('registered','bound') ORDER BY last_seen DESC`)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	var out []ApplianceRegistration
	for rows.Next() {
		a, err := scanAppliance(rows)
		if err != nil {
			return nil, err
		}
		out = append(out, *a)
	}
	return out, rows.Err()
}

// BindAppliance stages the delivery: bind an appliance to a customer + record what the box consumes
// on its next poll (customer-id comes from the record; mode/extra ride here). Allowed from registered
// or an already-bound-not-delivered state (operator re-bind / changed mind). Refuses once delivered or
// discarded.
func (s *Store) BindAppliance(id int64, customerID, mode, extraArgs string) error {
	res, err := s.db.Exec(`UPDATE appliance_registrations
		SET status = 'bound', customer_id = ?, install_mode = ?, extra_args = ?, bound_at = datetime('now')
		WHERE id = ? AND status IN ('registered','bound')`, customerID, mode, extraArgs, id)
	if err != nil {
		return err
	}
	n, _ := res.RowsAffected()
	if n == 0 {
		return fmt.Errorf("appliance %d not bindable (missing, delivered, or discarded)", id)
	}
	return nil
}

// MarkApplianceDelivered atomically flips bound→delivered EXACTLY ONCE. ok=true for the single winning
// poll; ok=false for every later poll (already delivered) or a lost race — the handler maps ok=false
// on a bound-looking record to 410. This is the one-shot delivery gate.
func (s *Store) MarkApplianceDelivered(tokenHash string) (ok bool, err error) {
	res, err := s.db.Exec(`UPDATE appliance_registrations
		SET status = 'delivered', delivered_at = datetime('now')
		WHERE token_hash = ? AND status = 'bound'`, tokenHash)
	if err != nil {
		return false, err
	}
	n, _ := res.RowsAffected()
	return n == 1, nil
}

// DiscardAppliance marks a registration ignored and INVALIDATES its token (blanks the hash so no poll
// can ever match it, belt-and-suspenders atop the status check). Sticky: a later re-registration of
// the same (uuid, mac_set) keeps it discarded.
func (s *Store) DiscardAppliance(id int64) error {
	res, err := s.db.Exec(`UPDATE appliance_registrations
		SET status = 'discarded', discarded_at = datetime('now'), token_hash = ''
		WHERE id = ?`, id)
	if err != nil {
		return err
	}
	n, _ := res.RowsAffected()
	if n == 0 {
		return fmt.Errorf("appliance %d not found", id)
	}
	return nil
}