heicode-mananger/heicode/controller/heicode_cloud_deploy.go

package controller

import (
	"strconv"
	"strings"
	"time"

	"github.com/gin-gonic/gin"

	"github.com/heicode/manager/common"
	"github.com/heicode/manager/model"
)

// Cloud deployment control plane (unified spec §18). Manager validates,
// gates approval, resolves credentials and audits; a Deploy Worker (not yet
// connected) executes provider provisioning. Until a worker is wired, records
// rest in deployment_requested / waiting_approval with executor=pending_worker.

var cloudDeployTargets = map[string]bool{"azure": true, "aliyun": false, "aws": false}
var cloudDeployEnvironments = map[string]bool{"preview": true, "production": true}

// HeicodeDeploymentTargets lists deployable cloud targets (unified spec §18.1).
func HeicodeDeploymentTargets(c *gin.Context) {
	common.ApiSuccess(c, gin.H{
		"targets": []gin.H{
			{"id": "azure", "name": "Azure", "enabled": true, "supports_preview": true, "supports_production": true, "requires_approval": true, "credential_binding_required": true, "regions": []string{"eastasia", "southeastasia", "westus"}},
			{"id": "aliyun", "name": "阿里云", "enabled": false, "supports_preview": true, "supports_production": true, "requires_approval": true, "credential_binding_required": true},
			{"id": "aws", "name": "AWS", "enabled": false, "supports_preview": true, "supports_production": true, "requires_approval": true, "credential_binding_required": true},
		},
	})
}

type cloudDeployRequest struct {
	ArtifactID        string         `json:"artifact_id"`
	ArtifactRevision  int            `json:"artifact_revision"`
	Target            string         `json:"target"`
	Environment       string         `json:"environment"`
	Region            string         `json:"region"`
	DeploymentMode    string         `json:"deployment_mode"`
	ResourceBindingID int            `json:"resource_binding_id"`
	Options           map[string]any `json:"options"`
}

// HeicodeCreateDeployment validates and records a cloud deployment request
// (unified spec §18.3/§18.4). Production deployments enter waiting_approval.
func HeicodeCreateDeployment(c *gin.Context) {
	record, ok := requireAuthenticatedUserAgentDeployment(c)
	if !ok {
		return
	}
	var req cloudDeployRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		agentError(c, "POLICY_REJECTED", err.Error())
		return
	}
	req.Target = strings.ToLower(strings.TrimSpace(req.Target))
	req.Environment = strings.ToLower(strings.TrimSpace(req.Environment))
	if strings.TrimSpace(req.ArtifactID) == "" {
		agentError(c, "POLICY_REJECTED", "artifact_id is required")
		return
	}
	if !cloudDeployTargets[req.Target] {
		agentError(c, "DEPLOY_TARGET_DISABLED", "deployment target is not available")
		return
	}
	if !cloudDeployEnvironments[req.Environment] {
		agentError(c, "POLICY_REJECTED", "environment must be preview or production")
		return
	}
	// Client must reference a credential binding, never inline secrets (§17.6).
	if req.ResourceBindingID > 0 && model.DB != nil {
		uid, _ := strconv.Atoi(strings.TrimSpace(record.Plan.UserContext.UserID))
		var binding model.ResourceBinding
		if err := model.DB.Where("id = ? AND user_id = ?", req.ResourceBindingID, uid).First(&binding).Error; err != nil {
			agentError(c, "RESOURCE_BINDING_INVALID", "resource_binding_id not found or not owned by user")
			return
		}
	}

	status := "deployment_requested"
	if req.Environment == "production" {
		status = "waiting_approval"
	}
	now := time.Now().UnixMilli()
	runID := "deploy_" + common.GetUUID()[:12]
	payload, _ := common.Marshal(req)
	row := &model.AgentCloudDeployment{
		DeployRunID:       runID,
		DeploymentID:      record.DeploymentID,
		UserID:            record.Plan.UserContext.UserID,
		ArtifactID:        strings.TrimSpace(req.ArtifactID),
		ArtifactRevision:  req.ArtifactRevision,
		Target:            req.Target,
		Environment:       req.Environment,
		Region:            strings.TrimSpace(req.Region),
		ResourceBindingID: req.ResourceBindingID,
		Status:            status,
		PayloadJSON:       string(payload),
		CreatedAtMs:       now,
		UpdatedAtMs:       now,
	}
	if err := model.InsertAgentCloudDeployment(row); err != nil {
		common.SysLog("HeicodeCreateDeployment: " + err.Error())
		agentError(c, "DEPLOY_PERSIST_FAILED", "failed to record deployment request")
		return
	}
	recordAgentAuditEvent(agentEvent{
		EventID:       "evt_" + common.GetUUID()[:12],
		Event:         "deployment.requested",
		SchemaVersion: 1,
		UserID:        record.Plan.UserContext.UserID,
		DeploymentID:  record.DeploymentID,
		CorrelationID: record.Plan.Metadata.CorrelationID,
		OccurredAt:    agentNow(),
	}, "manager_cloud_deploy", runID, "", "ok")

	common.ApiSuccess(c, gin.H{
		"deployment_run_id": runID,
		"deployment_id":     record.DeploymentID,
		"target":            req.Target,
		"environment":       req.Environment,
		"status":            status,
		"executor":          "pending_worker",
	})
}

// HeicodeListDeployments lists cloud deployments for a task.
func HeicodeListDeployments(c *gin.Context) {
	record, ok := requireAuthenticatedUserAgentDeployment(c)
	if !ok {
		return
	}
	rows, err := model.ListAgentCloudDeploymentsByDeployment(record.DeploymentID)
	if err != nil {
		agentError(c, "DEPLOY_QUERY_FAILED", "failed to query deployments")
		return
	}
	common.ApiSuccess(c, gin.H{"items": rows, "total": len(rows)})
}