724 lines
22 KiB
Python
724 lines
22 KiB
Python
import json
|
|
import sqlite3
|
|
from collections.abc import Iterable, Mapping
|
|
from dataclasses import dataclass
|
|
from datetime import datetime, timezone
|
|
from os import PathLike
|
|
from typing import Any
|
|
|
|
from .adapters import NormalizedObject, Observation
|
|
|
|
|
|
_FORBIDDEN_PERSISTED_KEYS = frozenset(
|
|
{
|
|
"private_key",
|
|
"certificate_key",
|
|
"certificate",
|
|
"dns_provider_credentials",
|
|
"secret",
|
|
}
|
|
)
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class ObservationStatus:
|
|
endpoint_id: str
|
|
object_type: str
|
|
last_attempt_at: datetime
|
|
last_success_at: datetime | None
|
|
last_error: str | None
|
|
|
|
@property
|
|
def is_live(self) -> bool:
|
|
return self.last_error is None
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class DesiredState:
|
|
object: NormalizedObject
|
|
selected_at: datetime
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class AppliedState:
|
|
endpoint_id: str
|
|
object: NormalizedObject
|
|
applied_at: datetime
|
|
verification_attempted_at: datetime | None
|
|
verified_at: datetime | None
|
|
verification_error: str | None
|
|
|
|
@property
|
|
def is_verified(self) -> bool:
|
|
return (
|
|
self.verified_at is not None
|
|
and self.verification_error is None
|
|
)
|
|
|
|
|
|
def _utc(value: datetime, label: str) -> datetime:
|
|
if value.tzinfo is None:
|
|
raise RuntimeError(f"{label} must be timezone-aware")
|
|
return value.astimezone(timezone.utc)
|
|
|
|
|
|
def _timestamp(value: datetime, label: str) -> str:
|
|
return _utc(value, label).isoformat()
|
|
|
|
|
|
def _parse_timestamp(value: str | None) -> datetime | None:
|
|
if value is None:
|
|
return None
|
|
parsed = datetime.fromisoformat(value)
|
|
if parsed.tzinfo is None:
|
|
raise RuntimeError(
|
|
f"Persisted timestamp is not timezone-aware: {value!r}"
|
|
)
|
|
return parsed.astimezone(timezone.utc)
|
|
|
|
|
|
def _validate_safe_payload(value: Any, path: str = "payload") -> None:
|
|
if isinstance(value, Mapping):
|
|
for raw_key, child in value.items():
|
|
key = str(raw_key).strip().lower().replace("-", "_")
|
|
if key in _FORBIDDEN_PERSISTED_KEYS:
|
|
raise RuntimeError(
|
|
f"Refusing to persist sensitive field {path}.{key}"
|
|
)
|
|
_validate_safe_payload(child, f"{path}.{key}")
|
|
elif isinstance(value, (list, tuple)):
|
|
for index, child in enumerate(value):
|
|
_validate_safe_payload(child, f"{path}[{index}]")
|
|
|
|
|
|
def _serialize_payload(payload: Mapping[str, Any]) -> str:
|
|
_validate_safe_payload(payload)
|
|
try:
|
|
return json.dumps(
|
|
payload,
|
|
sort_keys=True,
|
|
separators=(",", ":"),
|
|
)
|
|
except (TypeError, ValueError) as exc:
|
|
raise RuntimeError(
|
|
f"Object payload is not JSON serializable: {exc}"
|
|
) from exc
|
|
|
|
|
|
def _deserialize_payload(value: str) -> dict[str, Any]:
|
|
try:
|
|
payload = json.loads(value)
|
|
except json.JSONDecodeError as exc:
|
|
raise RuntimeError("Persisted object payload is invalid JSON") from exc
|
|
|
|
if not isinstance(payload, dict):
|
|
raise RuntimeError("Persisted object payload is not a mapping")
|
|
return payload
|
|
|
|
|
|
class SQLiteStateStore:
|
|
def __init__(self, path: str | PathLike[str]):
|
|
self.path = str(path)
|
|
self.connection = sqlite3.connect(self.path)
|
|
self.connection.row_factory = sqlite3.Row
|
|
self.connection.execute("PRAGMA foreign_keys = ON")
|
|
self.connection.execute("PRAGMA busy_timeout = 5000")
|
|
if self.path != ":memory:":
|
|
self.connection.execute("PRAGMA journal_mode = WAL")
|
|
self._initialize()
|
|
|
|
def _initialize(self) -> None:
|
|
with self.connection:
|
|
self.connection.executescript(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS schema_meta (
|
|
version INTEGER NOT NULL
|
|
);
|
|
|
|
INSERT INTO schema_meta(version)
|
|
SELECT 1
|
|
WHERE NOT EXISTS (
|
|
SELECT 1 FROM schema_meta
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS observations (
|
|
endpoint_id TEXT NOT NULL,
|
|
object_type TEXT NOT NULL,
|
|
logical_key TEXT NOT NULL,
|
|
local_key TEXT NOT NULL,
|
|
payload_json TEXT NOT NULL,
|
|
observed_at TEXT NOT NULL,
|
|
PRIMARY KEY (
|
|
endpoint_id,
|
|
object_type,
|
|
local_key
|
|
)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS
|
|
observations_by_logical_identity
|
|
ON observations (
|
|
object_type,
|
|
logical_key
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS observation_status (
|
|
endpoint_id TEXT NOT NULL,
|
|
object_type TEXT NOT NULL,
|
|
last_attempt_at TEXT NOT NULL,
|
|
last_success_at TEXT,
|
|
last_error TEXT,
|
|
PRIMARY KEY (
|
|
endpoint_id,
|
|
object_type
|
|
)
|
|
);
|
|
"""
|
|
)
|
|
|
|
versions = self.connection.execute(
|
|
"SELECT version FROM schema_meta"
|
|
).fetchall()
|
|
if len(versions) != 1:
|
|
raise RuntimeError(
|
|
"SQLite state schema has invalid version metadata"
|
|
)
|
|
|
|
version = versions[0]["version"]
|
|
if version not in (1, 2):
|
|
raise RuntimeError(
|
|
"Unsupported SQLite state schema version: "
|
|
f"{version!r}"
|
|
)
|
|
|
|
if version == 1:
|
|
self.connection.executescript(
|
|
"""
|
|
CREATE TABLE desired_state (
|
|
object_type TEXT NOT NULL,
|
|
logical_key TEXT NOT NULL,
|
|
payload_json TEXT NOT NULL,
|
|
selected_at TEXT NOT NULL,
|
|
PRIMARY KEY (
|
|
object_type,
|
|
logical_key
|
|
)
|
|
);
|
|
|
|
CREATE TABLE applied_state (
|
|
endpoint_id TEXT NOT NULL,
|
|
object_type TEXT NOT NULL,
|
|
logical_key TEXT NOT NULL,
|
|
local_key TEXT,
|
|
payload_json TEXT NOT NULL,
|
|
applied_at TEXT NOT NULL,
|
|
verification_attempted_at TEXT,
|
|
verified_at TEXT,
|
|
verification_error TEXT,
|
|
PRIMARY KEY (
|
|
endpoint_id,
|
|
object_type,
|
|
logical_key
|
|
)
|
|
);
|
|
|
|
CREATE INDEX applied_state_by_object
|
|
ON applied_state (
|
|
object_type,
|
|
logical_key
|
|
);
|
|
|
|
UPDATE schema_meta
|
|
SET version = 2;
|
|
"""
|
|
)
|
|
|
|
def close(self) -> None:
|
|
self.connection.close()
|
|
|
|
def __enter__(self):
|
|
return self
|
|
|
|
def __exit__(self, exc_type, exc, traceback):
|
|
self.close()
|
|
|
|
def replace_observations(
|
|
self,
|
|
endpoint_id: str,
|
|
object_type: str,
|
|
observations: Iterable[Observation],
|
|
snapshot_at: datetime,
|
|
) -> None:
|
|
rows = list(observations)
|
|
snapshot_timestamp = _timestamp(
|
|
snapshot_at,
|
|
"Observation snapshot timestamp",
|
|
)
|
|
prepared: list[tuple[str, str, str, str, str, str]] = []
|
|
local_keys: set[str] = set()
|
|
|
|
for observation in rows:
|
|
normalized = observation.object
|
|
if observation.endpoint_id != endpoint_id:
|
|
raise RuntimeError(
|
|
"Observation endpoint does not match snapshot endpoint"
|
|
)
|
|
if normalized.object_type != object_type:
|
|
raise RuntimeError(
|
|
"Observation object type does not match snapshot type"
|
|
)
|
|
if normalized.local_key is None:
|
|
raise RuntimeError(
|
|
"Observed objects require an endpoint-local key"
|
|
)
|
|
if normalized.local_key in local_keys:
|
|
raise RuntimeError(
|
|
f"Duplicate endpoint-local key: {normalized.local_key}"
|
|
)
|
|
|
|
local_keys.add(normalized.local_key)
|
|
prepared.append(
|
|
(
|
|
endpoint_id,
|
|
object_type,
|
|
normalized.logical_key,
|
|
normalized.local_key,
|
|
_serialize_payload(normalized.payload),
|
|
_timestamp(
|
|
observation.observed_at,
|
|
"Observation timestamp",
|
|
),
|
|
)
|
|
)
|
|
|
|
with self.connection:
|
|
self.connection.execute(
|
|
"""
|
|
DELETE FROM observations
|
|
WHERE endpoint_id = ? AND object_type = ?
|
|
""",
|
|
(endpoint_id, object_type),
|
|
)
|
|
self.connection.executemany(
|
|
"""
|
|
INSERT INTO observations (
|
|
endpoint_id,
|
|
object_type,
|
|
logical_key,
|
|
local_key,
|
|
payload_json,
|
|
observed_at
|
|
) VALUES (?, ?, ?, ?, ?, ?)
|
|
""",
|
|
prepared,
|
|
)
|
|
self.connection.execute(
|
|
"""
|
|
INSERT INTO observation_status (
|
|
endpoint_id,
|
|
object_type,
|
|
last_attempt_at,
|
|
last_success_at,
|
|
last_error
|
|
) VALUES (?, ?, ?, ?, NULL)
|
|
ON CONFLICT(endpoint_id, object_type) DO UPDATE SET
|
|
last_attempt_at = excluded.last_attempt_at,
|
|
last_success_at = excluded.last_success_at,
|
|
last_error = NULL
|
|
""",
|
|
(
|
|
endpoint_id,
|
|
object_type,
|
|
snapshot_timestamp,
|
|
snapshot_timestamp,
|
|
),
|
|
)
|
|
|
|
def record_discovery_failure(
|
|
self,
|
|
endpoint_id: str,
|
|
object_type: str,
|
|
error: str,
|
|
attempted_at: datetime,
|
|
) -> None:
|
|
attempted_timestamp = _timestamp(
|
|
attempted_at,
|
|
"Discovery attempt timestamp",
|
|
)
|
|
with self.connection:
|
|
self.connection.execute(
|
|
"""
|
|
INSERT INTO observation_status (
|
|
endpoint_id,
|
|
object_type,
|
|
last_attempt_at,
|
|
last_success_at,
|
|
last_error
|
|
) VALUES (?, ?, ?, NULL, ?)
|
|
ON CONFLICT(endpoint_id, object_type) DO UPDATE SET
|
|
last_attempt_at = excluded.last_attempt_at,
|
|
last_error = excluded.last_error
|
|
""",
|
|
(
|
|
endpoint_id,
|
|
object_type,
|
|
attempted_timestamp,
|
|
str(error),
|
|
),
|
|
)
|
|
|
|
def load_observations(
|
|
self,
|
|
object_type: str | None = None,
|
|
) -> list[Observation]:
|
|
sql = """
|
|
SELECT
|
|
endpoint_id,
|
|
object_type,
|
|
logical_key,
|
|
local_key,
|
|
payload_json,
|
|
observed_at
|
|
FROM observations
|
|
"""
|
|
parameters: tuple[str, ...] = ()
|
|
if object_type is not None:
|
|
sql += " WHERE object_type = ?"
|
|
parameters = (object_type,)
|
|
sql += """
|
|
ORDER BY
|
|
endpoint_id,
|
|
object_type,
|
|
logical_key,
|
|
local_key
|
|
"""
|
|
|
|
rows = self.connection.execute(sql, parameters).fetchall()
|
|
return [
|
|
Observation(
|
|
endpoint_id=row["endpoint_id"],
|
|
object=NormalizedObject(
|
|
object_type=row["object_type"],
|
|
logical_key=row["logical_key"],
|
|
local_key=row["local_key"],
|
|
payload=_deserialize_payload(row["payload_json"]),
|
|
),
|
|
observed_at=_parse_timestamp(row["observed_at"]),
|
|
)
|
|
for row in rows
|
|
]
|
|
|
|
def replace_desired_state(
|
|
self,
|
|
object_type: str,
|
|
objects: Iterable[NormalizedObject],
|
|
selected_at: datetime,
|
|
) -> None:
|
|
rows = list(objects)
|
|
selected_timestamp = _timestamp(
|
|
selected_at,
|
|
"Desired-state selection timestamp",
|
|
)
|
|
prepared: list[tuple[str, str, str, str]] = []
|
|
logical_keys: set[str] = set()
|
|
|
|
for normalized in rows:
|
|
if normalized.object_type != object_type:
|
|
raise RuntimeError(
|
|
"Desired object type does not match snapshot type"
|
|
)
|
|
if normalized.local_key is not None:
|
|
raise RuntimeError(
|
|
"Canonical desired objects cannot contain "
|
|
"an endpoint-local key"
|
|
)
|
|
if normalized.logical_key in logical_keys:
|
|
raise RuntimeError(
|
|
"Duplicate desired logical key: "
|
|
f"{normalized.logical_key}"
|
|
)
|
|
|
|
logical_keys.add(normalized.logical_key)
|
|
prepared.append(
|
|
(
|
|
object_type,
|
|
normalized.logical_key,
|
|
_serialize_payload(normalized.payload),
|
|
selected_timestamp,
|
|
)
|
|
)
|
|
|
|
with self.connection:
|
|
self.connection.execute(
|
|
"""
|
|
DELETE FROM desired_state
|
|
WHERE object_type = ?
|
|
""",
|
|
(object_type,),
|
|
)
|
|
self.connection.executemany(
|
|
"""
|
|
INSERT INTO desired_state (
|
|
object_type,
|
|
logical_key,
|
|
payload_json,
|
|
selected_at
|
|
) VALUES (?, ?, ?, ?)
|
|
""",
|
|
prepared,
|
|
)
|
|
|
|
def load_desired_state(
|
|
self,
|
|
object_type: str | None = None,
|
|
) -> list[DesiredState]:
|
|
sql = """
|
|
SELECT
|
|
object_type,
|
|
logical_key,
|
|
payload_json,
|
|
selected_at
|
|
FROM desired_state
|
|
"""
|
|
parameters: tuple[str, ...] = ()
|
|
if object_type is not None:
|
|
sql += " WHERE object_type = ?"
|
|
parameters = (object_type,)
|
|
sql += " ORDER BY object_type, logical_key"
|
|
|
|
rows = self.connection.execute(sql, parameters).fetchall()
|
|
return [
|
|
DesiredState(
|
|
object=NormalizedObject(
|
|
object_type=row["object_type"],
|
|
logical_key=row["logical_key"],
|
|
payload=_deserialize_payload(row["payload_json"]),
|
|
),
|
|
selected_at=_parse_timestamp(row["selected_at"]),
|
|
)
|
|
for row in rows
|
|
]
|
|
|
|
def record_applied(
|
|
self,
|
|
endpoint_id: str,
|
|
object: NormalizedObject,
|
|
applied_at: datetime,
|
|
) -> None:
|
|
if not endpoint_id:
|
|
raise RuntimeError("Applied-state endpoint_id cannot be empty")
|
|
|
|
payload_json = _serialize_payload(object.payload)
|
|
applied_timestamp = _timestamp(
|
|
applied_at,
|
|
"Application timestamp",
|
|
)
|
|
|
|
with self.connection:
|
|
self.connection.execute(
|
|
"""
|
|
INSERT INTO applied_state (
|
|
endpoint_id,
|
|
object_type,
|
|
logical_key,
|
|
local_key,
|
|
payload_json,
|
|
applied_at,
|
|
verification_attempted_at,
|
|
verified_at,
|
|
verification_error
|
|
) VALUES (?, ?, ?, ?, ?, ?, NULL, NULL, NULL)
|
|
ON CONFLICT(
|
|
endpoint_id,
|
|
object_type,
|
|
logical_key
|
|
) DO UPDATE SET
|
|
local_key = excluded.local_key,
|
|
payload_json = excluded.payload_json,
|
|
applied_at = excluded.applied_at,
|
|
verification_attempted_at = NULL,
|
|
verified_at = NULL,
|
|
verification_error = NULL
|
|
""",
|
|
(
|
|
endpoint_id,
|
|
object.object_type,
|
|
object.logical_key,
|
|
object.local_key,
|
|
payload_json,
|
|
applied_timestamp,
|
|
),
|
|
)
|
|
|
|
def _record_verification(
|
|
self,
|
|
endpoint_id: str,
|
|
object: NormalizedObject,
|
|
attempted_at: datetime,
|
|
*,
|
|
succeeded: bool,
|
|
error: str | None,
|
|
) -> None:
|
|
attempted_timestamp = _timestamp(
|
|
attempted_at,
|
|
"Verification timestamp",
|
|
)
|
|
payload_json = _serialize_payload(object.payload)
|
|
|
|
if succeeded:
|
|
verified_at = attempted_timestamp
|
|
verification_error = None
|
|
else:
|
|
verified_at = None
|
|
verification_error = str(
|
|
error or "verification failed"
|
|
)
|
|
|
|
with self.connection:
|
|
cursor = self.connection.execute(
|
|
"""
|
|
UPDATE applied_state
|
|
SET
|
|
verification_attempted_at = ?,
|
|
verified_at = COALESCE(?, verified_at),
|
|
verification_error = ?
|
|
WHERE
|
|
endpoint_id = ?
|
|
AND object_type = ?
|
|
AND logical_key = ?
|
|
AND payload_json = ?
|
|
""",
|
|
(
|
|
attempted_timestamp,
|
|
verified_at,
|
|
verification_error,
|
|
endpoint_id,
|
|
object.object_type,
|
|
object.logical_key,
|
|
payload_json,
|
|
),
|
|
)
|
|
if cursor.rowcount != 1:
|
|
raise RuntimeError(
|
|
"Verification does not match the currently "
|
|
"applied object"
|
|
)
|
|
|
|
def record_verification_success(
|
|
self,
|
|
endpoint_id: str,
|
|
object: NormalizedObject,
|
|
verified_at: datetime,
|
|
) -> None:
|
|
self._record_verification(
|
|
endpoint_id,
|
|
object,
|
|
verified_at,
|
|
succeeded=True,
|
|
error=None,
|
|
)
|
|
|
|
def record_verification_failure(
|
|
self,
|
|
endpoint_id: str,
|
|
object: NormalizedObject,
|
|
error: str,
|
|
attempted_at: datetime,
|
|
) -> None:
|
|
self._record_verification(
|
|
endpoint_id,
|
|
object,
|
|
attempted_at,
|
|
succeeded=False,
|
|
error=error,
|
|
)
|
|
|
|
def load_applied_state(
|
|
self,
|
|
endpoint_id: str | None = None,
|
|
object_type: str | None = None,
|
|
) -> list[AppliedState]:
|
|
clauses: list[str] = []
|
|
parameters: list[str] = []
|
|
|
|
if endpoint_id is not None:
|
|
clauses.append("endpoint_id = ?")
|
|
parameters.append(endpoint_id)
|
|
if object_type is not None:
|
|
clauses.append("object_type = ?")
|
|
parameters.append(object_type)
|
|
|
|
sql = """
|
|
SELECT
|
|
endpoint_id,
|
|
object_type,
|
|
logical_key,
|
|
local_key,
|
|
payload_json,
|
|
applied_at,
|
|
verification_attempted_at,
|
|
verified_at,
|
|
verification_error
|
|
FROM applied_state
|
|
"""
|
|
if clauses:
|
|
sql += " WHERE " + " AND ".join(clauses)
|
|
sql += """
|
|
ORDER BY
|
|
endpoint_id,
|
|
object_type,
|
|
logical_key
|
|
"""
|
|
|
|
rows = self.connection.execute(
|
|
sql,
|
|
tuple(parameters),
|
|
).fetchall()
|
|
return [
|
|
AppliedState(
|
|
endpoint_id=row["endpoint_id"],
|
|
object=NormalizedObject(
|
|
object_type=row["object_type"],
|
|
logical_key=row["logical_key"],
|
|
local_key=row["local_key"],
|
|
payload=_deserialize_payload(row["payload_json"]),
|
|
),
|
|
applied_at=_parse_timestamp(row["applied_at"]),
|
|
verification_attempted_at=_parse_timestamp(
|
|
row["verification_attempted_at"]
|
|
),
|
|
verified_at=_parse_timestamp(row["verified_at"]),
|
|
verification_error=row["verification_error"],
|
|
)
|
|
for row in rows
|
|
]
|
|
|
|
def observation_status(
|
|
self,
|
|
endpoint_id: str,
|
|
object_type: str,
|
|
) -> ObservationStatus | None:
|
|
row = self.connection.execute(
|
|
"""
|
|
SELECT
|
|
endpoint_id,
|
|
object_type,
|
|
last_attempt_at,
|
|
last_success_at,
|
|
last_error
|
|
FROM observation_status
|
|
WHERE endpoint_id = ? AND object_type = ?
|
|
""",
|
|
(endpoint_id, object_type),
|
|
).fetchone()
|
|
if row is None:
|
|
return None
|
|
|
|
return ObservationStatus(
|
|
endpoint_id=row["endpoint_id"],
|
|
object_type=row["object_type"],
|
|
last_attempt_at=_parse_timestamp(row["last_attempt_at"]),
|
|
last_success_at=_parse_timestamp(row["last_success_at"]),
|
|
last_error=row["last_error"],
|
|
)
|