1package app
2
3import (
4 "errors"
5 "fmt"
6 "os"
7 "path/filepath"
8
9 "github.com/bnema/vev/internal/adapters/brokerconfig"
10 "github.com/bnema/vev/internal/adapters/ipc"
11 "github.com/bnema/vev/internal/domain"
12 "github.com/bnema/vev/internal/platform"
13 "github.com/bnema/vev/internal/ports"
14 "github.com/bnema/vev/internal/protocol"
15 "github.com/bnema/vev/internal/protocol/catalogue"
16 "github.com/bnema/vev/internal/usecase/broker"
17 "github.com/bnema/vev/pkg/safedir"
18)
19
20// productionBrokerLayout is the single production broker filesystem contract.
21// Runtime ownership belongs to broker.Supervisor; state persists independently;
22// configuration remains under the user's vev configuration directory.
23func productionBrokerConfigPath() string {
24 return filepath.Join(filepath.Dir(platform.ConfigPath()), "broker.json")
25}
26
27// ensureProductionBrokerConfig creates the empty production bootstrap on first
28// use. Existing files are never rewritten: malformed or insecure operator
29// configuration must still fail closed in brokerconfig.LoadProduction.
30func ensureProductionBrokerConfig() error {
31 path := productionBrokerConfigPath()
32 if err := safedir.EnsurePrivate(filepath.Dir(path)); err != nil {
33 return fmt.Errorf("secure broker configuration directory: %w", err)
34 }
35 file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
36 if errors.Is(err, os.ErrExist) {
37 return nil
38 }
39 if err != nil {
40 return fmt.Errorf("create broker configuration: %w", err)
41 }
42 _, writeErr := file.WriteString(`{"marker":"vev.broker.offline/v1","registrations":[]}`)
43 closeErr := file.Close()
44 if writeErr == nil && closeErr == nil {
45 return nil
46 }
47 removeErr := os.Remove(path)
48 if writeErr != nil {
49 return errors.Join(fmt.Errorf("write broker configuration: %w", writeErr), closeErr, removeErr)
50 }
51 return errors.Join(fmt.Errorf("close broker configuration: %w", closeErr), removeErr)
52}
53
54// remoteBrokerPolicy builds the remote host policy for a CLI transport name
55// (hostTransportQUIC or hostTransportSSH). Callers pass a parsed value, so an
56// unknown name is a programming error.
57func remoteBrokerPolicy(transport string) ports.BrokerPolicy {
58 route, ok := hostTransportRoutes[transport]
59 if !ok {
60 panic(fmt.Sprintf("unknown host transport %q", transport))
61 }
62 return ports.BrokerPolicy{
63 ProtocolVersion: protocol.Version, CatalogSchemaVersion: catalogue.RemoteCatalogSchemaVersion,
64 EnvironmentPolicy: protocol.EnvironmentPolicyDaemonOwned, Transport: string(route),
65 Trust: "openssh-config-v1", Launch: broker.DaemonLaunchAuthority, Isolation: "per-user",
66 }
67}
68
69// upgradeBrokerHostVersions moves durable host policies to this build's
70// protocol and catalogue versions. Those fields describe the running binary,
71// not a user choice, so hosts pinned by an older build must follow an upgrade;
72// otherwise the unchanged daemon identity is refused as a conflicting policy.
73func upgradeBrokerHostVersions(store ports.BrokerHostStore) error {
74 hosts, err := store.LoadHosts()
75 if err != nil {
76 return fmt.Errorf("load broker hosts: %w", err)
77 }
78 changed := false
79 records := ports.CloneBrokerHostRecords(hosts.Hosts)
80 for i := range records {
81 policy := &records[i].Policy
82 if policy.ProtocolVersion == protocol.Version && policy.CatalogSchemaVersion == catalogue.RemoteCatalogSchemaVersion {
83 continue
84 }
85 // A policy change advances the generation so stale observations are fenced.
86 if records[i].Registration.Generation == ^domain.RemoteGeneration(0) {
87 return ports.ErrBrokerRevisionExhausted
88 }
89 records[i].Registration.Generation++
90 policy.ProtocolVersion = protocol.Version
91 policy.CatalogSchemaVersion = catalogue.RemoteCatalogSchemaVersion
92 changed = true
93 }
94 if !changed {
95 return nil
96 }
97 if err := store.ReplaceHosts(hosts.Revision, records); err != nil {
98 return fmt.Errorf("upgrade broker host versions: %w", err)
99 }
100 return nil
101}
102
103func localDaemonPolicy() ports.BrokerPolicy {
104 return ports.BrokerPolicy{
105 ProtocolVersion: protocol.Version, CatalogSchemaVersion: catalogue.RemoteCatalogSchemaVersion,
106 EnvironmentPolicy: protocol.EnvironmentPolicyClientOwned, Transport: "unix-mux",
107 Trust: "same-user", Launch: broker.DaemonLaunchAuthority, Isolation: "per-user",
108 }
109}
110
111func productionBrokerLayout() brokerconfig.Layout {
112 root := filepath.Join(platform.StateDir(), "broker")
113 runtime := filepath.Join(ipc.SocketDir(), "broker")
114 return brokerconfig.Layout{
115 Root: root,
116 Runtime: runtime,
117 State: filepath.Join(root, brokerconfig.StateDirName),
118 Log: filepath.Join(root, brokerconfig.LogDirName),
119 Spawn: filepath.Join(runtime, brokerconfig.SpawnDirName),
120 }
121}