Publish curated Unraid-AppOps-Gateway source from a480f280f26f4aa48c61394fa841d2233067c208

backend/app/services/deployment_broker.py

@@ -29,6 +29,7 @@ from ..core.redaction import redact_message
 from ..schemas.deployment import DeploymentPlanV1
 from ..schemas.forge_bootstrap import ForgeBootstrapPreflightV1
 from ..schemas.forge_bootstrap_apply import ForgeBootstrapApplyV1
+from ..schemas.forge_runtime_readiness import ForgeRuntimeReadinessV1
 
 _REQUEST_ID = re.compile(r"^[0-9a-f]{64}$")
 _MAX_DELIVERY_STATUS_BYTES = 512 * 1024
@@ -40,6 +41,10 @@ _WORKMESH_IDEMPOTENCY = re.compile(r"^[A-Za-z0-9._:-]{8,128}$")
 _FORGE_SECRET_DELIVERY_PATH = "/v1/appops/forge/bootstrap/secrets"
 _MAX_FORGE_SECRET_DELIVERY_BODY_BYTES = 16 * 1024
 _MAX_FORGE_SECRET_DELIVERY_RESPONSE_BYTES = 64 * 1024
+_FORGE_RUNTIME_READINESS_PATH = "/v1/appops/forge/bootstrap/readiness/"
+_MAX_FORGE_RUNTIME_READINESS_RESPONSE_BYTES = 32 * 1024
+_FORGE_RUNTIME_READINESS_TOTAL_SECONDS = 35.0
+_FORGE_RUNTIME_READINESS_READ_SECONDS = 20.0
 
 
 def _unique_json_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
@@ -466,7 +471,7 @@ class DeploymentBrokerClient:
                 bytes(response_body).decode("utf-8"),
                 object_pairs_hook=_unique_json_object,
             )
-        except (UnicodeError, ValueError, TypeError):
+        except (UnicodeError, ValueError, TypeError, RecursionError):
             response_body.clear()
             return {
                 "status": "outcome_unknown",
@@ -508,6 +513,106 @@ class DeploymentBrokerClient:
             secret=secret,
         )
 
+    def forge_bootstrap_readiness(
+        self, request_id: str, *, secret: str
+    ) -> dict[str, Any]:
+        """Fetch one fresh fixed-profile runtime snapshot with no receipt fallback."""
+        if not _REQUEST_ID.fullmatch(request_id):
+            return {"status": "unavailable"}
+        if (
+            not self.is_configured()
+            or not isinstance(secret, str)
+            or len(secret) < 32
+            or not secret.isascii()
+            or not secret.isprintable()
+        ):
+            return {"status": "unavailable"}
+
+        timestamp = str(int(time.time()))
+        nonce = uuid.uuid4().hex
+        path = f"{_FORGE_RUNTIME_READINESS_PATH}{request_id}"
+        headers = {
+            "Accept": "application/json",
+            "Accept-Encoding": "identity",
+            "Cache-Control": "no-store",
+            "Pragma": "no-cache",
+            "X-ITWorx-Deployment-Timestamp": timestamp,
+            "X-ITWorx-Deployment-Nonce": nonce,
+            "X-ITWorx-Deployment-Signature": self._signature(
+                secret, "GET", path, timestamp, nonce, b""
+            ),
+        }
+        response_body = bytearray()
+        deadline = time.monotonic() + _FORGE_RUNTIME_READINESS_TOTAL_SECONDS
+        client_timeout = httpx.Timeout(
+            connect=min(self.timeout_seconds, 5.0),
+            read=_FORGE_RUNTIME_READINESS_READ_SECONDS,
+            write=min(self.timeout_seconds, 5.0),
+            pool=min(self.timeout_seconds, 5.0),
+        )
+        try:
+            with httpx.Client(
+                timeout=client_timeout,
+                verify=self._verify_option(),
+                follow_redirects=False,
+            ) as client, client.stream(
+                "GET",
+                f"{self.base_url}{path}",
+                content=b"",
+                headers=headers,
+            ) as response:
+                if response.status_code != 200:
+                    return {"status": "unavailable"}
+                content_lengths = response.headers.get_list("content-length")
+                if len(content_lengths) > 1:
+                    return {"status": "unavailable"}
+                content_length = content_lengths[0] if content_lengths else None
+                if content_length is not None and (
+                    not content_length.isascii()
+                    or not content_length.isdecimal()
+                    or len(content_length) > 10
+                    or int(content_length) > _MAX_FORGE_RUNTIME_READINESS_RESPONSE_BYTES
+                ):
+                    return {"status": "unavailable"}
+                content_encoding = response.headers.get("content-encoding", "identity").lower()
+                content_type = response.headers.get("content-type", "").split(";", 1)[0].strip().lower()
+                if content_encoding != "identity" or content_type != "application/json":
+                    return {"status": "unavailable"}
+                for chunk in response.iter_raw():
+                    if time.monotonic() > deadline:
+                        response_body.clear()
+                        return {"status": "unavailable"}
+                    response_body.extend(chunk)
+                    if len(response_body) > _MAX_FORGE_RUNTIME_READINESS_RESPONSE_BYTES:
+                        response_body.clear()
+                        return {"status": "unavailable"}
+        except Exception:  # noqa: BLE001 - transport diagnostics may contain held credentials.
+            response_body.clear()
+            return {"status": "unavailable"}
+        if time.monotonic() > deadline:
+            response_body.clear()
+            return {"status": "unavailable"}
+
+        try:
+            decoded = json.loads(
+                bytes(response_body).decode("utf-8", errors="strict"),
+                object_pairs_hook=_unique_json_object,
+            )
+            validated = ForgeRuntimeReadinessV1.model_validate(decoded)
+        except (UnicodeError, ValueError, TypeError, RecursionError):
+            response_body.clear()
+            return {"status": "unavailable"}
+        response_body.clear()
+        now = int(time.time())
+        if (
+            validated.request != request_id
+            or validated.nonce != nonce
+            or validated.observed_at < now - 30
+            or validated.observed_at > now + 5
+        ):
+            return {"status": "unavailable"}
+        return validated.model_dump(mode="json", by_alias=True)
+
     def enrollment_capabilities(self, *, secret: str) -> dict[str, Any]:
         """Read the bootstrap-protected enrollment controller capability."""
         return self._request(