Publish curated Unraid-AppOps-Gateway source from a480f280f26f4aa48c61394fa841d2233067c208

backend/app/services/forge_bootstrap_apply.py

@@ -4,7 +4,7 @@ import base64
 import hashlib
 import json
 import re
-from datetime import datetime
+from datetime import UTC, datetime
 from typing import Any
 
 from sqlalchemy import update
@@ -17,6 +17,10 @@ from ..db.models import DeploymentJob, Policy
 from ..schemas.enrollment import MANAGED_DOCKER_APPDATA_ROOT
 from ..schemas.forge_bootstrap import ForgeBootstrapPreflightV1
 from ..schemas.forge_bootstrap_apply import ForgeBootstrapApplyV1
+from ..schemas.forge_runtime_readiness import (
+    ForgeRuntimeReadinessResultV1,
+    ForgeRuntimeReadinessV1,
+)
 from .audit_logger import log_event
 from .deployment_broker import DeploymentBrokerClient
 from .enrollment_plane import EnrollmentPlane
@@ -83,6 +87,7 @@ _PROFILE_CHECKS = {
 _FAILED_CODES = {"migration_failed", "service_start_failed", "healthcheck_failed"}
 _ACTIVE_STATUSES = {"applying", "outcome_unknown", "needs_database_credentials"}
 _TERMINAL_STATUSES = {"deployed", "failed", "preflight_changed"}
+_RUNTIME_READINESS_SERVICES = ("api", "dashboard", "itworx-forge", "postgres", "worker")
 
 
 class ForgeBootstrapApplyError(ValueError):
@@ -715,6 +720,113 @@ class ForgeBootstrapApplyService:
             return None
         return self._refresh_job(session, job)
 
+    @staticmethod
+    def _runtime_readiness_unavailable() -> dict[str, Any]:
+        return ForgeRuntimeReadinessResultV1.model_validate(
+            {
+                "status": "unavailable",
+                "message": "forge_runtime_readiness_unavailable",
+                "health": {
+                    "status": "unavailable",
+                    "services": [
+                        {"name": name, "status": "unavailable"}
+                        for name in _RUNTIME_READINESS_SERVICES
+                    ],
+                },
+                "migrationCompleted": False,
+            }
+        ).model_dump(mode="json", by_alias=True, exclude_none=True)
+
+    def current_readiness(self, session: Session, job_id: str) -> dict[str, Any]:
+        """Read current controller state only for a verified successful Forge job."""
+        unavailable = self._runtime_readiness_unavailable()
+        if not re.fullmatch(r"forge-install-[0-9a-f]{64}", job_id):
+            return unavailable
+        try:
+            job = session.get(DeploymentJob, job_id)
+        except Exception:  # noqa: BLE001 - do not expose protected store/DB failures.
+            return unavailable
+        if (
+            job is None
+            or job.application_id != _APPLICATION_ID
+            or job.repository != _REPOSITORY
+            or job.status != "deployed"
+            or job.stage not in {"controller_deployed", "resume_controller_deployed"}
+            or job.completed_at is None
+            or not re.fullmatch(r"[0-9a-f]{64}", job.broker_request_id or "")
+        ):
+            return unavailable
+        try:
+            profile = ForgeBootstrapApplyV1.model_validate(job.plan_json)
+        except (TypeError, ValueError):
+            return unavailable
+        if (
+            job.revision != profile.revision
+            or not isinstance(job.plan_json, dict)
+            or _sha256(job.plan_json) != job.plan_sha256
+        ):
+            return unavailable
+        evidence = job.evidence_json
+        if (
+            not isinstance(evidence, dict)
+            or set(evidence) != {"profile", "controller"}
+            or evidence.get("profile") != "forge-first-install"
+        ):
+            return unavailable
+        historical_status, _stage, _summary, _safe_evidence = _classify_controller_result(
+            evidence.get("controller"),
+            request_id=job.broker_request_id or "",
+            profile=profile,
+        )
+        if historical_status != "deployed":
+            return unavailable
+
+        # This protected per-target secret lookup is deliberately after every
+        # durable job/profile/receipt validation above.
+        secret = _controller_secret(session)
+        if secret is None:
+            return unavailable
+        try:
+            response = self.broker.forge_bootstrap_readiness(
+                job.broker_request_id or "", secret=secret
+            )
+            current = ForgeRuntimeReadinessV1.model_validate(response)
+        except Exception:  # noqa: BLE001 - broker and schema errors are safe unavailable.
+            return unavailable
+        now = int(datetime.now(UTC).timestamp())
+        if (
+            current.request != job.broker_request_id
+            or current.repository != _REPOSITORY
+            or current.operation != _OPERATION
+            or current.profile.revision != profile.revision
+            or current.profile.workspace_image_digest != profile.workspace_image_digest
+            or current.profile.frontdoor_image_digest != profile.frontdoor_image_digest
+            or current.observed_at < now - 30
+            or current.observed_at > now + 5
+        ):
+            return unavailable
+        message = {
+            "ready": "forge_runtime_ready",
+            "not_ready": "forge_runtime_not_ready",
+            "unavailable": "forge_runtime_readiness_unavailable",
+        }[current.status]
+        return ForgeRuntimeReadinessResultV1.model_validate(
+            {
+                "status": current.status,
+                "message": message,
+                "jobId": job.id,
+                "revision": current.profile.revision,
+                "workspaceImageDigest": current.profile.workspace_image_digest,
+                "frontdoorImageDigest": current.profile.frontdoor_image_digest,
+                "observedAt": current.observed_at,
+                "health": current.health.model_dump(mode="python"),
+                "migrationCompleted": current.migration_completed,
+                "controllerArtifact": current.controller_artifact.model_dump(
+                    mode="python", by_alias=True
+                ),
+            }
+        ).model_dump(mode="json", by_alias=True, exclude_none=True)
+
     def resume(self, session: Session, job_id: str) -> dict[str, Any] | None:
         """Explicitly resume only after a signed read proves pre-migration pause."""
         if not re.fullmatch(r"forge-install-[0-9a-f]{64}", job_id):