boatramp 0.42.0

//! The `config` subcommand: read and change the **dynamic daemon config** over the
//! control-plane API (`/api/daemon/config`). Operational knobs set here converge
//! fleet-wide without a restart; trust anchors and posture stay in `boatramp.cfg`
//! (restart to change) — this command refuses those with a clear pointer, so the
//! old "edit the file + SIGHUP is a silent no-op" trap can't happen.

use std::path::PathBuf;

use boatramp_core::daemon_config::{DaemonConfig, KernelRef};
use clap::Subcommand;
use serde::Deserialize;

use crate::client;
use crate::config::ProjectConfig;

/// A failure running a `boatramp config` subcommand.
#[derive(Debug, thiserror::Error)]
pub enum Error {
    /// Resolving the server target failed.
    #[error(transparent)]
    Client(#[from] crate::client::ClientError),
    /// A control-plane HTTP request failed.
    #[error("control-plane request: {0}")]
    Http(#[from] reqwest::Error),
    /// (De)serializing the config failed.
    #[error(transparent)]
    Json(#[from] serde_json::Error),
    /// Reading the `apply` file failed.
    #[error(transparent)]
    Io(#[from] std::io::Error),
    /// An unknown / non-dynamic key.
    #[error("unknown dynamic config key {0:?}; run `boatramp config list`")]
    UnknownKey(String),
    /// A restart-class (file-only) key was addressed.
    #[error(
        "{0} is a restart-class setting: edit `[{1}]` in boatramp.cfg on each node and restart \
         (it is not runtime-changeable — that is deliberate)"
    )]
    RestartClass(String, &'static str),
    /// A bad value for a key.
    #[error("invalid value for {key}: {msg}")]
    BadValue { key: String, msg: String },
    /// The server rejected the config (validate-before-commit).
    #[error("server rejected the config: {0}")]
    Rejected(String),
    /// Migrating an `apply` manifest to the current schema failed.
    #[error(transparent)]
    Migrate(#[from] crate::apply::Error),
    /// Resolving the STATIC daemon config (`boatramp.cfg` + env) for `config dump` failed.
    #[error(transparent)]
    DaemonConfig(#[from] crate::config::ConfigError),
}

/// `config` module result; `Err` is [`Error`].
type Result<T> = std::result::Result<T, Error>;

/// Arguments for `boatramp config`.
#[derive(Debug, clap::Args)]
pub struct ConfigArgs {
    /// boatramp server base URL (overrides [deploy].server).
    #[arg(long, env = "BOATRAMP_SERVER", global = true)]
    server: Option<String>,
    #[command(subcommand)]
    command: ConfigCommand,
}

#[derive(Debug, Subcommand)]
enum ConfigCommand {
    /// Print the active dynamic config and its generation, or one key's value.
    Get {
        /// Optional dotted key (e.g. `default_site`, `compute.vcpus`).
        key: Option<String>,
    },
    /// Set one dynamic key and converge it fleet-wide (read-modify-write).
    Set {
        /// Dotted key (see `config list`).
        key: String,
        /// New value (`null`/`unset` clears it).
        value: String,
    },
    /// Roll the dynamic config back to the previous generation.
    Rollback,
    /// Replace the whole dynamic config from a JSON file (validated server-side).
    Apply {
        /// JSON file holding a full `DaemonConfig`.
        #[arg(short, long)]
        file: PathBuf,
    },
    /// List the dynamic (runtime-settable) keys.
    List,
    /// Describe a key: what it is and its change class (dynamic vs restart).
    Describe {
        /// Dotted key.
        key: String,
    },
    /// Upgrade an `apply` manifest to the current schema (v0.6.0). Runs the manifest
    /// migration pipeline on `<file>` (which must declare an older `version: N`) and
    /// prints the upgraded manifest, or rewrites it in place with `--write`. The
    /// upgraded output omits `version:` (current = absent). Purely client-side — no
    /// server is contacted.
    Migrate {
        /// The manifest file to upgrade.
        file: PathBuf,
        /// Rewrite the file in place instead of printing to stdout.
        #[arg(long)]
        write: bool,
    },
    /// Resolve the STATIC daemon config (`boatramp.cfg` + `BOATRAMP_*` env, via the layered
    /// config pipeline) and print it as JSON with secret-bearing fields REDACTED. Purely
    /// client-side — no server is contacted; this is the resolved config `serve` would load.
    /// (Distinct from `get`/`set`, which read/write the live DYNAMIC config.)
    Dump {
        /// The daemon config file to resolve (default `boatramp.cfg`). Env overlays it.
        #[arg(long, default_value = "boatramp.cfg")]
        file: PathBuf,
        /// Also print the resolution-order legend to stderr.
        #[arg(long)]
        explain: bool,
    },
}

/// The `GET /api/daemon/config` response.
#[derive(Deserialize)]
struct ConfigResponse {
    generation: Option<String>,
    config: DaemonConfig,
}

/// One dynamic config key and its one-line note (the `config list` rows).
#[derive(Debug, serde::Serialize)]
pub struct DynKey {
    pub key: String,
    pub note: String,
}

/// The result of a `boatramp config` subcommand, rendered by [`crate::output`].
#[derive(Debug, serde::Serialize)]
#[serde(tag = "result", rename_all = "snake_case")]
pub enum ConfigOutput {
    /// `config get` (no key) — the active dynamic config and its generation.
    Get {
        generation: Option<String>,
        // Boxed to keep this large payload from dwarfing the other variants.
        config: Box<DaemonConfig>,
    },
    /// `config get <key>` — one key's rendered value.
    GetKey { key: String, value: String },
    /// `config set` — the key was set and converged fleet-wide.
    Set {
        key: String,
        value: String,
        generation: String,
    },
    /// `config rollback` — rolled back to the prior generation (`None` = nothing to roll back to).
    RolledBack { generation: Option<String> },
    /// `config apply` — the whole dynamic config was replaced.
    Applied { file: String, generation: String },
    /// `config list` — the dynamic (runtime-settable) keys.
    List { keys: Vec<DynKey> },
    /// `config describe <key>` — the key's change class and note.
    Describe {
        key: String,
        /// `"restart"`, `"dynamic"`, or `"unknown"`.
        class: &'static str,
        /// For a restart-class key: the `boatramp.cfg` section to edit.
        section: Option<&'static str>,
        /// For a dynamic key: the one-line note.
        note: Option<&'static str>,
    },
    /// `config migrate` — an upgraded apply manifest.
    Migrated {
        /// `Some(path)` when rewritten in place (nothing to stdout); `None` when printed.
        written_to: Option<String>,
        manifest: String,
    },
    /// `config dump` — the resolved STATIC config, secret fields redacted.
    Dump {
        /// The exact `dump_redacted` text, for byte-for-byte human fidelity (not in JSON).
        #[serde(skip)]
        text: String,
        /// The parsed redacted config, so a JSON consumer reads it structurally.
        config: serde_json::Value,
    },
}

impl crate::output::Rendered for ConfigOutput {
    fn render_human(&self, w: &mut dyn std::io::Write) -> std::io::Result<()> {
        match self {
            Self::Get { generation, config } => {
                writeln!(
                    w,
                    "generation: {}",
                    generation.as_deref().unwrap_or("(file baseline)")
                )?;
                writeln!(
                    w,
                    "{}",
                    serde_json::to_string_pretty(config).map_err(std::io::Error::other)?
                )
            }
            Self::GetKey { value, .. } => writeln!(w, "{value}"),
            Self::Set {
                key,
                value,
                generation,
            } => writeln!(w, "set {key} = {value}  (generation {generation})"),
            Self::RolledBack { generation } => match generation {
                None => writeln!(w, "no prior generation to roll back to"),
                Some(g) => writeln!(w, "rolled back to generation {g}"),
            },
            Self::Applied { file, generation } => {
                writeln!(w, "applied {file} (generation {generation})")
            }
            Self::List { keys } => {
                writeln!(
                    w,
                    "Dynamic keys (change fleet-wide with `config set`, no restart):"
                )?;
                for k in keys {
                    writeln!(w, "  {:<32} {}", k.key, k.note)?;
                }
                writeln!(w)?;
                writeln!(
                    w,
                    "Trust anchors + posture + listener settings are restart-class"
                )?;
                writeln!(
                    w,
                    "(edit boatramp.cfg + restart). See `config describe <key>`."
                )
            }
            Self::Describe {
                key,
                class,
                section,
                note,
            } => match *class {
                "restart" => writeln!(
                    w,
                    "{key}: restart-class — edit `[{}]` in boatramp.cfg + restart.",
                    section.as_deref().unwrap_or("")
                ),
                "dynamic" => {
                    writeln!(
                        w,
                        "{key}: dynamic — `config set` converges it fleet-wide without a restart."
                    )?;
                    writeln!(w, "  {}", note.as_deref().unwrap_or(""))
                }
                _ => writeln!(w, "{key}: unknown; run `config list`."),
            },
            Self::Migrated {
                written_to,
                manifest,
            } => {
                // Printed to stdout when not `--write` (no trailing newline, matching the
                // former `print!`); the `--write` path logged its advisory to stderr and
                // left stdout empty, so render nothing here.
                if written_to.is_none() {
                    write!(w, "{manifest}")
                } else {
                    Ok(())
                }
            }
            Self::Dump { text, .. } => writeln!(w, "{text}"),
        }
    }
}

/// Entry point for `boatramp config`.
pub async fn run(args: ConfigArgs, config: &ProjectConfig) -> Result<ConfigOutput> {
    // `list` / `describe` / `migrate` / `dump` are static — no server needed.
    match &args.command {
        ConfigCommand::List => {
            return Ok(ConfigOutput::List {
                keys: dynamic_keys(),
            });
        }
        ConfigCommand::Describe { key } => {
            return Ok(describe(key));
        }
        ConfigCommand::Migrate { file, write } => {
            return migrate_manifest(file, *write);
        }
        ConfigCommand::Dump { file, explain } => {
            let resolved = crate::config::ServerConfig::load(file, None)?;
            let text = resolved.dump_redacted()?;
            if *explain {
                tracing::info!(
                    "resolved: built-in defaults < {} < BOATRAMP_* env  (secret fields redacted)",
                    file.display()
                );
            }
            let config = serde_json::from_str(&text)?;
            return Ok(ConfigOutput::Dump { text, config });
        }
        _ => {}
    }
    let server = client::resolve_server(args.server, config)?;
    let http = client::http_client(client::token(config).as_deref());
    match args.command {
        ConfigCommand::Get { key } => get(&http, &server, key).await,
        ConfigCommand::Set { key, value } => set(&http, &server, &key, &value).await,
        ConfigCommand::Rollback => rollback(&http, &server).await,
        ConfigCommand::Apply { file } => apply(&http, &server, &file).await,
        ConfigCommand::List
        | ConfigCommand::Describe { .. }
        | ConfigCommand::Migrate { .. }
        | ConfigCommand::Dump { .. } => {
            unreachable!("handled above")
        }
    }
}

/// `boatramp config migrate <file> [--write]`: run the `apply` manifest migration
/// pipeline on `file` and print (or, with `--write`, rewrite in place) the upgraded
/// manifest. The upgraded output omits `version:` (current = absent). Client-side
/// only — no server is contacted; the migration's advisory warnings go to stderr.
fn migrate_manifest(file: &std::path::Path, write: bool) -> Result<ConfigOutput> {
    let text = std::fs::read_to_string(file)?;
    // Runs the full loose-parse → migrate → typed pipeline (a version-less or
    // already-current manifest is a no-op that simply re-renders as current).
    let manifest = crate::apply::ApplyManifest::parse(&text)?;
    let upgraded = crate::apply_migrate::render_manifest(&manifest)?;
    let written_to = if write {
        std::fs::write(file, &upgraded)?;
        tracing::info!("upgraded {} to the current (v0.6.0) schema", file.display());
        Some(file.display().to_string())
    } else {
        None
    };
    Ok(ConfigOutput::Migrated {
        written_to,
        manifest: upgraded,
    })
}

async fn fetch(http: &crate::client::ApiClient, server: &str) -> Result<ConfigResponse> {
    Ok(http
        .get(format!("{server}/api/daemon/config"))
        .send()
        .await?
        .error_for_status()?
        .json()
        .await?)
}

async fn put(http: &crate::client::ApiClient, server: &str, cfg: &DaemonConfig) -> Result<String> {
    let resp = http
        .put(format!("{server}/api/daemon/config"))
        .json(cfg)
        .send()
        .await?;
    if resp.status() == reqwest::StatusCode::BAD_REQUEST {
        return Err(Error::Rejected(resp.text().await?.trim().to_string()));
    }
    let v: serde_json::Value = resp.error_for_status()?.json().await?;
    Ok(v["generation"].as_str().unwrap_or("").to_string())
}

async fn get(
    http: &crate::client::ApiClient,
    server: &str,
    key: Option<String>,
) -> Result<ConfigOutput> {
    let r = fetch(http, server).await?;
    Ok(match key {
        None => ConfigOutput::Get {
            generation: r.generation,
            config: Box::new(r.config),
        },
        Some(k) => {
            let value = read_key(&r.config, &k)?;
            ConfigOutput::GetKey { key: k, value }
        }
    })
}

async fn set(
    http: &crate::client::ApiClient,
    server: &str,
    key: &str,
    value: &str,
) -> Result<ConfigOutput> {
    let mut r = fetch(http, server).await?;
    write_key(&mut r.config, key, value)?;
    let generation = put(http, server, &r.config).await?;
    Ok(ConfigOutput::Set {
        key: key.to_string(),
        value: value.to_string(),
        generation,
    })
}

async fn rollback(http: &crate::client::ApiClient, server: &str) -> Result<ConfigOutput> {
    let resp = http
        .post(format!("{server}/api/daemon/config/rollback"))
        .send()
        .await?;
    if resp.status() == reqwest::StatusCode::CONFLICT {
        return Ok(ConfigOutput::RolledBack { generation: None });
    }
    let v: serde_json::Value = resp.error_for_status()?.json().await?;
    Ok(ConfigOutput::RolledBack {
        generation: Some(v["generation"].as_str().unwrap_or("?").to_string()),
    })
}

async fn apply(
    http: &crate::client::ApiClient,
    server: &str,
    file: &std::path::Path,
) -> Result<ConfigOutput> {
    let bytes = std::fs::read(file)?;
    let cfg: DaemonConfig = serde_json::from_slice(&bytes)?;
    let generation = put(http, server, &cfg).await?;
    Ok(ConfigOutput::Applied {
        file: file.display().to_string(),
        generation,
    })
}

/// A cleared value (`null`/`unset`/empty) resets the key to the file baseline.
fn is_clear(value: &str) -> bool {
    matches!(value, "null" | "unset" | "")
}

fn parse_bool(key: &str, value: &str) -> Result<bool> {
    value.parse().map_err(|_| Error::BadValue {
        key: key.to_string(),
        msg: format!("expected true/false, got {value:?}"),
    })
}

fn parse_u64(key: &str, value: &str) -> Result<u64> {
    value.parse().map_err(|_| Error::BadValue {
        key: key.to_string(),
        msg: format!("expected an integer, got {value:?}"),
    })
}

/// Restart-class keys the operator might reach for — reject with a clear pointer
/// instead of a cryptic "unknown key" (or the old SIGHUP silent no-op).
fn restart_class_section(key: &str) -> Option<&'static str> {
    match key {
        "addr" | "data_dir" | "http_redirect_addr" => Some("serve"),
        k if k.starts_with("auth_root") || k == "signer" || k == "bootstrap_secret" => {
            Some("serve")
        }
        k if k.starts_with("tls") || k.starts_with("acme") => Some("serve"),
        k if k.starts_with("security.") || k == "security" => Some("security"),
        k if k.starts_with("cluster.") || k == "cluster" => Some("cluster"),
        _ => None,
    }
}

fn write_key(cfg: &mut DaemonConfig, key: &str, value: &str) -> Result<()> {
    if let Some(section) = restart_class_section(key) {
        return Err(Error::RestartClass(key.to_string(), section));
    }
    let clear = is_clear(value);
    match key {
        "default_site" => cfg.default_site = (!clear).then(|| value.to_string()),
        "protect_previews" => cfg.protect_previews = clear_or(clear, parse_bool(key, value)?),
        "cluster_rate_limit" => cfg.cluster_rate_limit = clear_or(clear, parse_bool(key, value)?),
        "max_upload_bytes" => cfg.max_upload_bytes = clear_or(clear, parse_u64(key, value)?),
        "upload_idle_timeout_secs" => {
            cfg.upload_idle_timeout_secs = clear_or(clear, parse_u64(key, value)?);
        }
        "max_concurrent_uploads" => {
            cfg.max_concurrent_uploads = clear_or(clear, parse_u64(key, value)?);
        }
        "compute.vcpus" => cfg.compute.vcpus = clear_or(clear, parse_u64(key, value)? as u32),
        "compute.mem_mib" => cfg.compute.mem_mib = clear_or(clear, parse_u64(key, value)? as u32),
        // Guard the parse behind `clear` so `unset` resets to the baseline without
        // being parsed as a bool first.
        "console.enabled" => {
            cfg.console.enabled = if clear {
                None
            } else {
                Some(parse_bool(key, value)?)
            }
        }
        "console.host" => cfg.console.host = (!clear).then(|| value.to_string()),
        "console.path" => cfg.console.path = (!clear).then(|| value.to_string()),
        "mcp.enabled" => {
            cfg.mcp.enabled = if clear {
                None
            } else {
                Some(parse_bool(key, value)?)
            }
        }
        "compute.default_kernel" => {
            cfg.compute.default_kernel = if clear {
                None
            } else {
                Some(
                    serde_json::from_str::<KernelRef>(value).map_err(|e| Error::BadValue {
                        key: key.to_string(),
                        msg: format!("expected a KernelRef JSON object: {e}"),
                    })?,
                )
            }
        }
        "posture.oidc_require_audience" => {
            cfg.posture.oidc_require_audience = clear_or(clear, parse_bool(key, value)?);
        }
        "posture.ratelimit_fail_open" => {
            cfg.posture.ratelimit_fail_open = clear_or(clear, parse_bool(key, value)?);
        }
        "posture.allow_shared_kernel_compute" => {
            cfg.posture.allow_shared_kernel_compute = clear_or(clear, parse_bool(key, value)?);
        }
        _ => return Err(Error::UnknownKey(key.to_string())),
    }
    Ok(())
}

fn clear_or<T>(clear: bool, v: T) -> Option<T> {
    (!clear).then_some(v)
}

fn read_key(cfg: &DaemonConfig, key: &str) -> Result<String> {
    let json = serde_json::to_value(cfg)?;
    let mut node = &json;
    for part in key.split('.') {
        node = node.get(part).unwrap_or(&serde_json::Value::Null);
    }
    Ok(if node.is_null() {
        "(unset — file baseline)".to_string()
    } else {
        node.to_string()
    })
}

/// The dynamic-key rows for `config list` (JSON + human).
fn dynamic_keys() -> Vec<DynKey> {
    DYNAMIC_KEYS
        .iter()
        .map(|(key, note)| DynKey {
            key: (*key).to_string(),
            note: (*note).to_string(),
        })
        .collect()
}

fn describe(key: &str) -> ConfigOutput {
    if let Some(section) = restart_class_section(key) {
        return ConfigOutput::Describe {
            key: key.to_string(),
            class: "restart",
            section: Some(section),
            note: None,
        };
    }
    match DYNAMIC_KEYS.iter().find(|(k, _)| *k == key) {
        Some((_, class)) => ConfigOutput::Describe {
            key: key.to_string(),
            class: "dynamic",
            section: None,
            note: Some(*class),
        },
        None => ConfigOutput::Describe {
            key: key.to_string(),
            class: "unknown",
            section: None,
            note: None,
        },
    }
}

/// The dynamic keys + a one-line note.
const DYNAMIC_KEYS: &[(&str, &str)] = &[
    ("default_site", "catch-all site for an unmatched Host"),
    ("protect_previews", "require a token to view previews"),
    ("max_upload_bytes", "upload cap (≤ the posture ceiling)"),
    ("upload_idle_timeout_secs", "abort a stalled upload"),
    ("max_concurrent_uploads", "cap simultaneous uploads"),
    ("cluster_rate_limit", "rate-limit via the shared KV"),
    ("compute.vcpus", "advertised schedulable vCPUs"),
    ("compute.mem_mib", "advertised schedulable memory (MiB)"),
    (
        "compute.default_kernel",
        "fleet default microVM kernel (KernelRef JSON)",
    ),
    ("console.enabled", "serve the embedded web console"),
    (
        "console.host",
        "console host pattern (* / exact / *.suffix)",
    ),
    (
        "console.path",
        "console URL path prefix (default /_console)",
    ),
    (
        "posture.oidc_require_audience",
        "tighten-only: require an OIDC audience",
    ),
    (
        "posture.ratelimit_fail_open",
        "tighten-only: fail closed (set false)",
    ),
    (
        "posture.allow_shared_kernel_compute",
        "tighten-only: forbid shared-kernel (set false)",
    ),
];

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn set_scalars_and_clear() {
        let mut cfg = DaemonConfig::default();
        write_key(&mut cfg, "default_site", "blog").unwrap();
        assert_eq!(cfg.default_site.as_deref(), Some("blog"));
        write_key(&mut cfg, "max_upload_bytes", "1048576").unwrap();
        assert_eq!(cfg.max_upload_bytes, Some(1048576));
        write_key(&mut cfg, "compute.vcpus", "8").unwrap();
        assert_eq!(cfg.compute.vcpus, Some(8));
        // Clearing resets to the file baseline.
        write_key(&mut cfg, "default_site", "unset").unwrap();
        assert!(cfg.default_site.is_none());
    }

    #[test]
    fn set_console_keys() {
        let mut cfg = DaemonConfig::default();
        write_key(&mut cfg, "console.enabled", "true").unwrap();
        assert_eq!(cfg.console.enabled, Some(true));
        write_key(&mut cfg, "console.host", "console.example.com").unwrap();
        assert_eq!(cfg.console.host.as_deref(), Some("console.example.com"));
        write_key(&mut cfg, "console.path", "/admin").unwrap();
        assert_eq!(cfg.console.path.as_deref(), Some("/admin"));
        // Clearing resets to the file baseline.
        write_key(&mut cfg, "console.enabled", "unset").unwrap();
        assert!(cfg.console.enabled.is_none());
    }

    #[test]
    fn restart_class_and_unknown_are_rejected() {
        let mut cfg = DaemonConfig::default();
        // A trust anchor / posture / listener setting → clear restart-class error.
        assert!(matches!(
            write_key(&mut cfg, "auth_root_private_key", "x"),
            Err(Error::RestartClass(_, "serve"))
        ));
        assert!(matches!(
            write_key(
                &mut cfg,
                "security.allow_unauthenticated_public_bind",
                "true"
            ),
            Err(Error::RestartClass(_, "security"))
        ));
        // A genuinely unknown key.
        assert!(matches!(
            write_key(&mut cfg, "nope", "1"),
            Err(Error::UnknownKey(_))
        ));
        // A bad value.
        assert!(matches!(
            write_key(&mut cfg, "protect_previews", "maybe"),
            Err(Error::BadValue { .. })
        ));
    }

    #[test]
    fn read_key_reports_unset() {
        let cfg = DaemonConfig::default();
        assert!(read_key(&cfg, "default_site").unwrap().contains("unset"));
    }
}