refactor(#2352): move matrix provisioning behind host-socket wire commands

hive-c0re/src/server.rs

@@ -175,6 +175,15 @@ async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
                     .map_err(anyhow::Error::msg)?;
                 HostResponse::success()
             }
+            HostRequest::MatrixCreateUser { name, password } => {
+                handle_matrix_create_user(name, password.as_deref()).await?
+            }
+            HostRequest::MatrixSyncAdmin => handle_matrix_sync_admin().await?,
+            HostRequest::MatrixPromoteUser { name } => handle_matrix_promote_user(name).await?,
+            HostRequest::MatrixResetPassword { name } => handle_matrix_reset_password(name).await?,
+            HostRequest::MatrixInvite { user, room } => {
+                handle_matrix_invite(user, room.as_deref()).await?
+            }
         })
     }
     .await;
@@ -245,6 +254,167 @@ async fn handle_agent_status(coord: &Arc<Coordinator>) -> HostResponse {
     HostResponse::agent_statuses(rows)
 }
 
+// ---------------------------------------------------------------------------
+// Matrix provisioning handlers
+//
+// The `hivectl matrix` subcommands used to run these in-process, which forced
+// the standalone CLI to link the whole daemon crate (matrix-sdk, reqwest, …).
+// They now run daemon-side over the host socket: the daemon already holds the
+// register + admin tokens and the matrix creds dir. Each op returns the
+// operator-facing lines hivectl used to `println!` in `HostResponse::messages`
+// for the client to print verbatim.
+// ---------------------------------------------------------------------------
+
+/// Shared reqwest client for the matrix admin HTTP calls (30s timeout,
+/// mirroring the old in-CLI client).
+fn matrix_http_client() -> Result<reqwest::Client> {
+    reqwest::Client::builder()
+        .timeout(std::time::Duration::from_secs(30))
+        .build()
+        .context("build reqwest client")
+}
+
+/// True when `name` has a state dir under the agents root, i.e. it's a
+/// managed agent rather than a bare (operator/human) matrix account.
+fn agent_exists(name: &str) -> Result<bool> {
+    crate::paths::agent_state_dir(name)
+        .try_exists()
+        .with_context(|| format!("check agent state dir for {name}"))
+}
+
+/// Guard: matrix provisioning needs the homeserver container running.
+async fn require_matrix_present() -> Result<()> {
+    if crate::matrix::is_present().await {
+        return Ok(());
+    }
+    anyhow::bail!(
+        "hive-matrix container not running — start it (services.hyperhive.matrix.enable = true) before provisioning matrix users"
+    )
+}
+
+async fn handle_matrix_create_user(name: &str, password: Option<&str>) -> Result<HostResponse> {
+    require_matrix_present().await?;
+    let register_token =
+        crate::matrix::ensure_register_token().context("read matrix register token")?;
+    let client = matrix_http_client()?;
+    let mut out = Vec::new();
+    if agent_exists(name)? {
+        if password.is_some() {
+            // Agents auth by access_token, never by password — the
+            // boot-sweep provisioning path doesn't accept one. Refuse
+            // rather than silently dropping it.
+            anyhow::bail!(
+                "matrix create-user: a password is for non-agent (operator) accounts only; '{name}' is an agent which authenticates via access_token"
+            );
+        }
+        crate::matrix::ensure_user_for(&client, name, &register_token)
+            .await
+            .with_context(|| format!("matrix create-user {name}"))?;
+        let path = Coordinator::agent_notes_dir(name).join("matrix-token");
+        out.push(format!("matrix: provisioned agent user '{name}'"));
+        out.push(format!("token persisted at: {}", path.display()));
+    } else {
+        let effective_password = match password {
+            Some(p) => p.to_owned(),
+            None => crate::matrix::random_password().context("generate random matrix password")?,
+        };
+        let token = crate::matrix::provision_user_token(
+            &client,
+            name,
+            &register_token,
+            &effective_password,
+        )
+        .await
+        .with_context(|| format!("matrix create-user {name}"))?;
+        out.push(format!(
+            "matrix: provisioned user '{name}' (not an agent — token not persisted)"
+        ));
+        out.push(format!("token: {token}"));
+        if password.is_some() {
+            out.push(
+                "password: set as supplied — use it to log into a matrix web client".to_owned(),
+            );
+        } else {
+            out.push(
+                "password: random throwaway (not surfaced — pass --password or --password-stdin to set one you can use)".to_owned(),
+            );
+        }
+    }
+    Ok(HostResponse::messages(out))
+}
+
+async fn handle_matrix_sync_admin() -> Result<HostResponse> {
+    require_matrix_present().await?;
+    let register_token =
+        crate::matrix::ensure_register_token().context("read matrix register token")?;
+    let client = matrix_http_client()?;
+    crate::matrix::ensure_admin_user(&client, &register_token)
+        .await
+        .context("matrix sync-admin")?;
+    let path = crate::matrix::admin_token_path();
+    Ok(HostResponse::messages(vec![
+        format!(
+            "matrix: hive admin user '@{}' provisioned",
+            crate::matrix::HIVE_ADMIN_LOCALPART
+        ),
+        format!("token persisted at: {}", path.display()),
+    ]))
+}
+
+async fn handle_matrix_promote_user(name: &str) -> Result<HostResponse> {
+    require_matrix_present().await?;
+    let admin_token = crate::matrix::read_admin_token()?;
+    let client = matrix_http_client()?;
+    let server_name = crate::matrix::discover_server_name(&client)
+        .await
+        .context("discover matrix server_name")?;
+    crate::matrix::promote_user_to_admin(&client, &admin_token, name, &server_name)
+        .await
+        .with_context(|| format!("matrix promote-user {name}"))?;
+    Ok(HostResponse::messages(vec![format!(
+        "matrix: promoted @{name}:{server_name} to admin"
+    )]))
+}
+
+async fn handle_matrix_invite(user: &str, room: Option<&str>) -> Result<HostResponse> {
+    require_matrix_present().await?;
+    let admin_token = crate::matrix::read_admin_token()?;
+    let client = matrix_http_client()?;
+    let server_name = crate::matrix::discover_server_name(&client)
+        .await
+        .context("discover matrix server_name")?;
+    let room_id = crate::matrix::invite_user(&client, &admin_token, user, room, &server_name)
+        .await
+        .with_context(|| format!("matrix invite {user}"))?;
+    let target = if user.starts_with('@') {
+        user.to_owned()
+    } else {
+        format!("@{user}:{server_name}")
+    };
+    Ok(HostResponse::messages(vec![format!(
+        "matrix: invited {target} to {room_id}"
+    )]))
+}
+
+async fn handle_matrix_reset_password(name: &str) -> Result<HostResponse> {
+    require_matrix_present().await?;
+    let admin_token = crate::matrix::read_admin_token()?;
+    let client = matrix_http_client()?;
+    let server_name = crate::matrix::discover_server_name(&client)
+        .await
+        .context("discover matrix server_name")?;
+    crate::matrix::reset_user_password(&client, &admin_token, name, &server_name)
+        .await
+        .with_context(|| format!("matrix reset-password {name}"))?;
+    // Password is persisted by reset_user_password.
+    let pw_path = crate::paths::matrix_creds_dir().join(format!("{name}-password"));
+    Ok(HostResponse::messages(vec![
+        format!("matrix: password for @{name}:{server_name} reset"),
+        format!("password persisted at: {}", pw_path.display()),
+        format!("next: hivectl matrix create-user {name}   # mints a fresh access token"),
+    ]))
+}
+
 /// Single-agent queue verbs the admin socket exposes. Each submits the
 /// matching DAG (persisting the `wanted` intent, serializing on the
 /// agent's lease, with the transient/crash-watch suppression the old