5785c0024c
swarm-controller's POST /api/agents now refuses (409) a name the swarm
has already placed on a different hive: a non-Destroyed declaration in
that hive's wanted state, or a SetAgentWanted node still queued for it.
The same name on the same hive is that agent being re-created and goes
through. A wanted state that cannot be read refuses (503/500) instead of
reading as "placed nowhere". Creations are serialised from that read to
the graph insert so two concurrent creations of one name cannot both
pass.
Hive-level creation is removed: hivectl `agent create` / `request-create`,
HostRequest::Spawn / RequestSpawn, the dashboard POST /api/request-spawn
route, and ApprovalKind::Spawn with its approve/resolve arms and the
approval-carrying `templates::spawn`. The swarm path (deploy request or
wanted-state sweep -> queue_first_deploy -> templates::first_deploy) used
none of them. Old `spawn` approval rows are skipped by collect_lenient,
as `init_config` rows were in a3b672d1.
policy.rs's comment on agent_object_name stated swarm-wide name
uniqueness as a fact; it now says where it is enforced and what that
check cannot see.
Refs #4396
109 lines
3.6 KiB
Rust
109 lines
3.6 KiB
Rust
//! Approval endpoints for the dashboard.
|
|
//!
|
|
//! Approve/deny actions plus the orphan-approval GC sweep used by the
|
|
//! `/api/state` builder.
|
|
|
|
use axum::{
|
|
extract::{Form, Path as AxumPath, State},
|
|
http::StatusCode,
|
|
response::{IntoResponse, Response},
|
|
};
|
|
use hive_sh4re::approvals::Approval;
|
|
use serde::Deserialize;
|
|
use utoipa::ToSchema;
|
|
|
|
use super::{AppState, error_response};
|
|
use crate::actions;
|
|
use crate::coordinator::Coordinator;
|
|
|
|
/// Approve a pending approval row.
|
|
#[utoipa::path(
|
|
post,
|
|
path = "/api/approve/{id}",
|
|
params(("id" = i64, Path, description = "approval row id")),
|
|
responses(
|
|
(status = 200, description = "approved", body = String),
|
|
(status = 500, description = "approve failed"),
|
|
),
|
|
tag = "approvals"
|
|
)]
|
|
pub(super) async fn post_approve(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
) -> Response {
|
|
match actions::approve(state.coord.clone(), id).await {
|
|
// 200 instead of 303 — `actions::approve` fires
|
|
// `ApprovalResolved` (success path) or the eventual failure
|
|
// event, both of which the dashboard's derived store applies
|
|
// live. The matching form carries `data-no-refresh`.
|
|
Ok(()) => (StatusCode::OK, "ok").into_response(),
|
|
Err(e) => error_response(&format!("approve {id} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
#[derive(Deserialize, Default, ToSchema)]
|
|
pub(super) struct DenyForm {
|
|
#[serde(default)]
|
|
note: Option<String>,
|
|
}
|
|
|
|
/// Deny a pending approval row, with an optional
|
|
/// note (form field `note`).
|
|
#[utoipa::path(
|
|
post,
|
|
path = "/api/deny/{id}",
|
|
params(("id" = i64, Path, description = "approval row id")),
|
|
request_body(content = DenyForm, content_type = "application/x-www-form-urlencoded"),
|
|
responses(
|
|
(status = 200, description = "denied", body = String),
|
|
(status = 500, description = "deny failed"),
|
|
),
|
|
tag = "approvals"
|
|
)]
|
|
pub(super) async fn post_deny(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
Form(form): Form<DenyForm>,
|
|
) -> Response {
|
|
let note = form
|
|
.note
|
|
.as_deref()
|
|
.map(str::trim)
|
|
.filter(|s| !s.is_empty());
|
|
match actions::deny(&state.coord, id, note) {
|
|
Ok(()) => (StatusCode::OK, "ok").into_response(),
|
|
Err(e) => error_response(&format!("deny {id} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// Filter out approvals whose agent state dir was wiped out from under us
|
|
/// (e.g. by a test script's cleanup). Marks them failed so they fall out of
|
|
/// `pending` on next render.
|
|
pub(super) fn gc_orphans(coord: &Coordinator, approvals: Vec<Approval>) -> Vec<Approval> {
|
|
approvals
|
|
.into_iter()
|
|
.filter(|a| {
|
|
if Coordinator::agent_proposed_dir(&a.agent).exists() {
|
|
true
|
|
} else {
|
|
let note = "agent state dir missing";
|
|
let _ = coord.approvals.mark_failed(a.id, note);
|
|
tracing::info!(id = a.id, agent = %a.agent, "auto-failed orphan approval");
|
|
let sha_short = a
|
|
.fetched_sha
|
|
.as_deref()
|
|
.map(|s| s[..s.len().min(12)].to_owned());
|
|
coord.emit_approval_resolved(crate::coordinator::ApprovalResolved {
|
|
id: a.id,
|
|
agent: a.agent.as_str(),
|
|
approval_kind: <&str>::from(a.kind),
|
|
sha_short,
|
|
status: "failed",
|
|
note: Some(note.to_owned()),
|
|
description: a.description.clone(),
|
|
});
|
|
false
|
|
}
|
|
})
|
|
.collect()
|
|
}
|