fundaia 0.26.0

use std::path::{Path, PathBuf};

use anyhow::{bail, Context, Result};
use flate2::write::GzEncoder;
use flate2::Compression;
use ignore::WalkBuilder;
use owo_colors::OwoColorize;

use crate::api::client::ApiClient;
use crate::commands::deploy;
use crate::output::{self, Format};
use crate::render::theme;

/// Anything past this is refused before a byte leaves the machine.
///
/// The server refuses it too and that one is the rule; this is the courtesy —
/// finding out after uploading a hundred megabytes over a domestic connection
/// is a minute somebody does not get back. Kept in step with
/// `defaultUploadLimitBytes` on the platform.
const LIMIT_BYTES: u64 = 100 * 1024 * 1024;

/// Directories nobody ever means to deploy, whatever the ignore files say.
///
/// `.git` is the one that matters: it is frequently larger than the code, it is
/// not in `.gitignore` for obvious reasons, and no build has ever needed it.
/// The other two are what a previous build left behind, and shipping them means
/// uploading megabytes so the image can overwrite them.
const ALWAYS_EXCLUDED: [&str; 4] = [".git", ".hg", "node_modules", ".venv"];

/// Files that are credentials by name, and never part of a build.
///
/// Hidden files are kept on purpose (see `pack`), which is what makes this list
/// necessary: `.env` is hidden too, it is where every framework tells people to
/// put their secrets, and it is in `.gitignore` less often than anyone would
/// like. On this platform a secret is a variable set on the service, so a
/// build that needed one of these files inside the image is a build that
/// should not exist. The examples (`.env.example`, `.env.sample`…) stay: they
/// are documentation, and empty by convention.
fn looks_like_a_credential(name: &str) -> bool {
    const NAMES: [&str; 6] = [
        ".git-credentials",
        ".netrc",
        ".pypirc",
        ".ssh",
        ".aws",
        ".gnupg",
    ];
    const KEY_PREFIXES: [&str; 4] = ["id_rsa", "id_ed25519", "id_ecdsa", "id_dsa"];
    const EXAMPLE_SUFFIXES: [&str; 5] = [".example", ".sample", ".template", ".dist", ".defaults"];

    if name == ".env" || name.starts_with(".env.") {
        return !EXAMPLE_SUFFIXES.iter().any(|suffix| name.ends_with(suffix));
    }

    NAMES.contains(&name)
        || KEY_PREFIXES.iter().any(|prefix| name.starts_with(prefix))
        || name.ends_with(".pem")
        || name.ends_with(".key")
}

/// What a packed directory turned out to be.
pub struct Packed {
    pub bytes: Vec<u8>,
    pub files: usize,
    /// Credential files found and left out, relative to the directory, so the
    /// person sees what did not travel rather than wondering later.
    pub withheld: Vec<String>,
}

/// Uploads the code in a directory and watches it deploy.
///
/// The whole verb `fundaia up` is: a service built from uploaded code has no
/// branch to read, so the archive arriving *is* the push. Packing happens here
/// rather than on the server for the obvious reason and one less obvious one —
/// the ignore rules that decide what a build needs are files in the directory
/// being packed, and sending everything so the server can drop most of it is
/// the transfer this exists to avoid.
pub async fn run(
    client: &ApiClient,
    project_reference: &str,
    service_reference: &str,
    directory: &Path,
    deploy_it: bool,
    follow: bool,
    format: Format,
) -> Result<()> {
    let project = client.find_project(project_reference).await?;
    let service = client.find_service(&project.id, service_reference).await?;

    let packed = pack(directory)?;
    let name = archive_name(directory);

    if !format.is_json() {
        println!();
        for path in &packed.withheld {
            println!(
                "  {} {} {}",
                theme::SKIP.style(theme::muted()),
                path.style(theme::muted()),
                "no se sube: parece una credencial".style(theme::muted())
            );
        }
        println!(
            "  {} {} {} — {} archivos, {}",
            theme::ARROW.style(theme::accent()),
            project.name.style(theme::muted()),
            service.name.style(theme::strong()),
            packed.files.style(theme::strong()),
            human_size(packed.bytes.len() as u64).style(theme::strong()),
        );
        println!();
    }

    let accepted = client
        .upload(&service.id, packed.bytes, &name, deploy_it)
        .await?;

    let Some(deployment) = accepted.deployment else {
        // Nothing was built, so there is no pipeline to draw and nothing to
        // wait for: the archive is stored and that is the whole outcome.
        if format.is_json() {
            output::emit(&accepted.upload);
        } else {
            println!(
                "  {} Código guardado. Despliégalo con: fundaia deploy {} {}",
                theme::CHECK.style(theme::success()),
                project.slug,
                service.slug,
            );
        }
        return Ok(());
    };

    if format.is_json() {
        if !follow {
            output::emit(&deployment);
            return Ok(());
        }
        return deploy::watch_json(client, &deployment).await;
    }

    if !follow {
        println!(
            "  {}",
            format!(
                "Despliegue #{} en marcha. Síguelo con: fundaia logs {} {}",
                deployment.number, project.slug, service.slug
            )
            .style(theme::muted()),
        );
        return Ok(());
    }

    deploy::watch(client, &deployment).await
}

/// The archives this service has been given, newest first.
pub async fn list(
    client: &ApiClient,
    project_reference: &str,
    service_reference: &str,
    format: Format,
) -> Result<()> {
    let project = client.find_project(project_reference).await?;
    let service = client.find_service(&project.id, service_reference).await?;
    let page = client.uploads(&service.id).await?;

    if format.is_json() {
        output::emit(&page);
        return Ok(());
    }

    if page.uploads.is_empty() {
        println!();
        println!(
            "  {}",
            "Este servicio no tiene código todavía. Súbelo con `fundaia up`.".style(theme::muted()),
        );
        println!();
        return Ok(());
    }

    println!();
    for upload in &page.uploads {
        let current = page.current.as_deref() == Some(upload.id.as_str());
        // The one it builds from is marked rather than listed first: the order
        // is by arrival, and reordering it would hide when a rollback moved it.
        let mark = if current {
            theme::CHECK.style(theme::success()).to_string()
        } else {
            " ".to_owned()
        };
        let digest: String = upload.digest.chars().take(12).collect();

        println!(
            "  {} {}  {}  {}",
            mark,
            upload.file_name.style(theme::strong()),
            human_size(upload.size_bytes).style(theme::muted()),
            digest.style(theme::muted()),
        );
    }
    println!();
    Ok(())
}

/// Walks a directory into a gzipped tar, honouring every ignore file it finds.
///
/// `ignore` is the crate ripgrep uses, and taking it rather than reading
/// `.gitignore` by hand is the whole reason this is short: it already handles
/// nested ignore files, negations, `**`, the global git excludes and a
/// directory that is not a repository at all. `.fundaiaignore` is added as a
/// custom name so a project can exclude something from a deployment without
/// excluding it from git — test fixtures, a local database, a directory of
/// screenshots.
///
pub fn pack(directory: &Path) -> Result<Packed> {
    if !directory.is_dir() {
        bail!("{} is not a directory", directory.display());
    }
    if is_a_whole_home(directory) {
        bail!(
            "{} is a home directory or the root of the filesystem — run this inside the project",
            directory.display()
        );
    }

    let encoder = GzEncoder::new(Vec::new(), Compression::default());
    let mut archive = tar::Builder::new(encoder);
    let mut files = 0usize;
    let mut bytes = 0u64;
    let mut withheld = Vec::new();

    let mut walker = WalkBuilder::new(directory);
    /*
     * Spelled out rather than called as a method, and it is not style.
     * `OwoColorize` is implemented for every type and carries a `hidden()` of
     * its own — the ANSI attribute — so `walker.hidden(false)` resolves to the
     * colour trait and fails on the argument. Naming the type is what picks the
     * walker's.
     *
     * Hidden files are kept on purpose: `.env.example`, `.dockerignore` and
     * `.npmrc` are all hidden and all matter to a build.
     */
    WalkBuilder::hidden(&mut walker, false);
    walker.git_ignore(true);
    walker.git_global(true);
    walker.git_exclude(true);
    walker.add_custom_ignore_filename(".fundaiaignore");
    walker.filter_entry(|entry: &ignore::DirEntry| {
        !ALWAYS_EXCLUDED.contains(&entry.file_name().to_string_lossy().as_ref())
    });

    for entry in walker.build() {
        let entry = entry.context("could not read the directory")?;
        if !entry.file_type().is_some_and(|kind| kind.is_file()) {
            continue;
        }

        let relative = entry
            .path()
            .strip_prefix(directory)
            .context("a file walked out of the directory being packed")?;

        if relative
            .components()
            .any(|part| looks_like_a_credential(&part.as_os_str().to_string_lossy()))
        {
            withheld.push(relative.display().to_string());
            continue;
        }

        bytes += entry.metadata().map(|meta| meta.len()).unwrap_or(0);
        if bytes > LIMIT_BYTES {
            bail!(
                "the code is larger than {} — leave out what the build does not need with a .fundaiaignore",
                human_size(LIMIT_BYTES)
            );
        }

        archive
            .append_path_with_name(entry.path(), relative)
            .with_context(|| format!("could not pack {}", relative.display()))?;
        files += 1;
    }

    if files == 0 {
        bail!("there is nothing to upload in {}", directory.display());
    }

    let encoder = archive
        .into_inner()
        .context("could not finish the archive")?;
    let bytes = encoder.finish().context("could not compress the archive")?;

    Ok(Packed {
        bytes,
        files,
        withheld,
    })
}

/// A home directory or `/`: nobody deploys those, and packing one ships every
/// credential the person owns before the size limit says stop.
fn is_a_whole_home(directory: &Path) -> bool {
    let Ok(absolute) = directory.canonicalize() else {
        return false;
    };
    if absolute.parent().is_none() {
        return true;
    }
    dirs::home_dir()
        .and_then(|home| home.canonicalize().ok())
        .is_some_and(|home| home == absolute)
}

/// What the archive is called in the history: the directory's own name.
///
/// A person recognises `panel-web.tar.gz` and recognises nothing at all in a
/// timestamp, and the platform already records when it arrived.
pub fn archive_name(directory: &Path) -> String {
    let absolute = directory
        .canonicalize()
        .unwrap_or_else(|_| PathBuf::from(directory));

    let stem = absolute
        .file_name()
        .map(|name| name.to_string_lossy().to_string())
        .filter(|name| !name.is_empty())
        .unwrap_or_else(|| "código".to_owned());

    format!("{stem}.tar.gz")
}

/// Bytes as somebody would say them, which is never in bytes past a kilobyte.
pub fn human_size(bytes: u64) -> String {
    const KIB: f64 = 1024.0;
    let value = bytes as f64;

    if value < KIB {
        return format!("{bytes} B");
    }
    if value < KIB * KIB {
        return format!("{:.0} KB", value / KIB);
    }
    format!("{:.1} MB", value / (KIB * KIB))
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::fs;

    /// A directory with a `.gitignore`, something it ignores, and a `.git`.
    fn project() -> tempdir::Directory {
        let directory = tempdir::Directory::new();
        fs::write(directory.path().join("package.json"), "{}").unwrap();
        fs::write(directory.path().join(".gitignore"), "secret.txt\n").unwrap();
        fs::write(directory.path().join("secret.txt"), "shhh").unwrap();
        fs::create_dir(directory.path().join(".git")).unwrap();
        fs::write(directory.path().join(".git").join("HEAD"), "ref: x").unwrap();
        fs::create_dir(directory.path().join("node_modules")).unwrap();
        fs::write(directory.path().join("node_modules").join("a.js"), "x").unwrap();
        directory
    }

    fn packed_names(directory: &Path) -> Vec<String> {
        let packed = pack(directory).expect("the directory packs");
        let decoder = flate2::read::GzDecoder::new(packed.bytes.as_slice());
        let mut archive = tar::Archive::new(decoder);

        archive
            .entries()
            .expect("the archive can be read")
            .map(|entry| {
                entry
                    .expect("an entry")
                    .path()
                    .expect("a path")
                    .to_string_lossy()
                    .to_string()
            })
            .collect()
    }

    #[test]
    fn it_should_pack_the_files_a_build_needs() {
        let directory = project();

        assert!(packed_names(directory.path()).contains(&"package.json".to_owned()));
    }

    #[test]
    fn it_should_leave_out_what_gitignore_excludes() {
        let directory = project();

        assert!(!packed_names(directory.path()).contains(&"secret.txt".to_owned()));
    }

    #[test]
    fn it_should_leave_out_a_dotenv_that_gitignore_forgot() {
        let directory = project();
        fs::write(directory.path().join(".env"), "TOKEN=x").unwrap();

        assert!(!packed_names(directory.path()).contains(&".env".to_owned()));
    }

    #[test]
    fn it_should_report_which_credential_files_stayed_home() {
        let directory = project();
        fs::write(directory.path().join(".env.production"), "TOKEN=x").unwrap();

        let packed = pack(directory.path()).expect("the directory packs");

        assert_eq!(packed.withheld, vec![".env.production".to_owned()]);
    }

    #[test]
    fn it_should_keep_a_dotenv_example() {
        let directory = project();
        fs::write(directory.path().join(".env.example"), "TOKEN=").unwrap();

        assert!(packed_names(directory.path()).contains(&".env.example".to_owned()));
    }

    #[test]
    fn it_should_leave_out_a_private_key_in_a_subdirectory() {
        let directory = project();
        fs::create_dir(directory.path().join("certs")).unwrap();
        fs::write(directory.path().join("certs").join("server.key"), "---").unwrap();

        assert!(!packed_names(directory.path()).contains(&"certs/server.key".to_owned()));
    }

    #[test]
    fn it_should_refuse_to_pack_the_root_of_the_filesystem() {
        assert!(is_a_whole_home(Path::new("/")));
    }

    #[test]
    fn it_should_pack_an_ordinary_directory() {
        let directory = project();

        assert!(!is_a_whole_home(directory.path()));
    }

    /// `.git` is not in `.gitignore` for obvious reasons, and is frequently
    /// larger than the code it holds the history of.
    #[test]
    fn it_should_leave_out_the_git_directory() {
        let directory = project();

        assert!(!packed_names(directory.path())
            .iter()
            .any(|name| name.starts_with(".git/")));
    }

    #[test]
    fn it_should_leave_out_node_modules() {
        let directory = project();

        assert!(!packed_names(directory.path())
            .iter()
            .any(|name| name.starts_with("node_modules/")));
    }

    /// Hidden and load-bearing: a Containerfile reads `.dockerignore`, a build
    /// reads `.npmrc`, and the walker's own default would drop both.
    #[test]
    fn it_should_keep_a_hidden_file_a_build_reads() {
        let directory = project();
        fs::write(directory.path().join(".npmrc"), "registry=x").unwrap();

        assert!(packed_names(directory.path()).contains(&".npmrc".to_owned()));
    }

    #[test]
    fn it_should_refuse_a_directory_with_nothing_in_it() {
        let directory = tempdir::Directory::new();

        assert!(pack(directory.path()).is_err());
    }

    #[test]
    fn it_should_name_the_archive_after_the_directory() {
        let directory = tempdir::Directory::new();

        assert!(archive_name(directory.path()).ends_with(".tar.gz"));
    }

    #[test]
    fn it_should_print_megabytes_once_there_are_any() {
        assert_eq!(human_size(3 * 1024 * 1024), "3.0 MB");
    }

    #[test]
    fn it_should_print_plain_bytes_below_a_kilobyte() {
        assert_eq!(human_size(512), "512 B");
    }

    /// A temporary directory that removes itself, because a test that leaves
    /// one behind on every run fills a laptop a megabyte at a time.
    mod tempdir {
        use std::path::{Path, PathBuf};
        use std::sync::atomic::{AtomicUsize, Ordering};

        static COUNTER: AtomicUsize = AtomicUsize::new(0);

        pub struct Directory(PathBuf);

        impl Directory {
            pub fn new() -> Self {
                let unique = COUNTER.fetch_add(1, Ordering::Relaxed);
                let path = std::env::temp_dir()
                    .join(format!("fundaia-up-{}-{unique}", std::process::id()));
                std::fs::create_dir_all(&path).expect("a temporary directory");
                Self(path)
            }

            pub fn path(&self) -> &Path {
                &self.0
            }
        }

        impl Drop for Directory {
            fn drop(&mut self) {
                let _ = std::fs::remove_dir_all(&self.0);
            }
        }
    }
}