Publish curated Unraid-AppOps-Gateway source from 451646fee806a47e3256731766980a05a262dcdd

backend/app/api/routes_deployments.py

@@ -16,6 +16,11 @@ from ..core.security import require_operator_request
 from ..db.session import get_session
 from ..schemas.deployment import DeploymentPlanV1
 from ..schemas.forge_bootstrap import ForgeBootstrapPreflightV1
+from ..schemas.forge_bootstrap_apply import ForgeBootstrapApplyV1
+from ..schemas.forge_secret_delivery import (
+    ForgeSecretDeliveryRequestV1,
+    ForgeSecretDeliveryResultV1,
+)
 from ..services.deployment_broker import DeploymentBrokerClient
 from ..services.deployment_control_plane import (
     DeploymentControlError,
@@ -117,6 +122,62 @@ def preflight_forge_bootstrap(
         raise HTTPException(status_code=409, detail=str(exc)) from exc
 
 
+@router.post(
+    "/forge-bootstrap/secrets",
+    response_model=ForgeSecretDeliveryResultV1,
+)
+def prepare_forge_bootstrap_secrets(
+    payload: ForgeSecretDeliveryRequestV1,
+    actor_identity: Annotated[str, Depends(_require_deployment_operator)],
+    session: DeploymentSession,
+    idempotency_key: DeploymentIdempotencyKey = None,
+):
+    """Deliver only the verified protected Forge inputs to the fixed controller."""
+    from ..services.forge_secret_delivery import prepare_forge_secret_delivery
+
+    try:
+        return prepare_forge_secret_delivery(
+            session,
+            profile=payload.profile,
+            idempotency_key=_idempotency_header(idempotency_key),
+            actor_identity=actor_identity,
+        )
+    except ValueError as exc:
+        # Service messages are fixed safe codes; never surface upstream text.
+        raise HTTPException(status_code=409, detail="forge_secret_delivery_failed") from exc
+
+
+@router.post("/forge-bootstrap/first-install")
+def apply_forge_first_install(
+    payload: ForgeBootstrapApplyV1,
+    session: DeploymentSession,
+    idempotency_key: DeploymentIdempotencyKey = None,
+):
+    from ..services.forge_bootstrap_apply import (
+        ForgeBootstrapApplyError,
+        ForgeBootstrapApplyService,
+    )
+
+    try:
+        return ForgeBootstrapApplyService().apply(
+            session,
+            payload,
+            idempotency_key=_idempotency_header(idempotency_key),
+        )
+    except ForgeBootstrapApplyError as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
+
+
+@router.post("/forge-bootstrap/first-install/{job_id}/resume")
+def resume_forge_first_install(job_id: str, session: DeploymentSession):
+    from ..services.forge_bootstrap_apply import ForgeBootstrapApplyService
+
+    result = ForgeBootstrapApplyService().resume(session, job_id)
+    if result is None:
+        raise HTTPException(status_code=404, detail="Forge first-install request not found.")
+    return result
+
+
 @router.get("/workmesh/promotions/{promotion_id}")
 def get_workmesh_promotion(promotion_id: str, session: DeploymentSession):
     from ..services.workmesh_promotion import WorkMeshPromotionService
@@ -137,6 +198,16 @@ def list_workmesh_promotions(
     return {"items": WorkMeshPromotionService.list_promotions(session, limit=limit)}
 
 
+@router.get("/forge-bootstrap/first-install/{job_id}")
+def get_forge_first_install(job_id: str, session: DeploymentSession):
+    from ..services.forge_bootstrap_apply import ForgeBootstrapApplyService
+
+    result = ForgeBootstrapApplyService().status(session, job_id)
+    if result is None:
+        raise HTTPException(status_code=404, detail="Forge first-install request not found.")
+    return result
+
+
 @router.get("")
 def list_deployments(session: DeploymentSession, limit: DeploymentLimit = 100):
     return {"items": DeploymentControlPlane().list_jobs(session, limit=limit)}
@@ -150,6 +221,11 @@ def get_delivery_status():
 
 @router.get("/{job_id}")
 def get_deployment(job_id: str, session: DeploymentSession):
+    if job_id.startswith("forge-install-"):
+        raise HTTPException(
+            status_code=404,
+            detail="Use the fixed Forge first-install status route for this job.",
+        )
     try:
         return DeploymentControlPlane().refresh(session, job_id)
     except DeploymentControlError as exc: