JiriUhlir
1855 lines
75 KiB
Python
1855 lines
75 KiB
Python
import html
|
||
import math
|
||
import re
|
||
from urllib.parse import quote, urlencode
|
||
|
||
from fastapi import APIRouter, Depends, Form, HTTPException, Query, Request
|
||
from fastapi.responses import HTMLResponse, RedirectResponse
|
||
|
||
from ..auth import is_admin, is_developer, require_admin, require_developer, require_user
|
||
from ..config import (
|
||
DEFAULT_GITEA_ORG,
|
||
DELETE_APP_SCRIPT_NAME,
|
||
DEPLOY_SCRIPT,
|
||
GENERATE_COMPOSE_SCRIPT,
|
||
get_appfactory_host,
|
||
get_gitea_public_url,
|
||
is_allowed_worker_script,
|
||
read_env_value,
|
||
)
|
||
from ..db.apps import (
|
||
create_app_ip_access_rule,
|
||
create_app_variable,
|
||
delete_app_ip_access_rule,
|
||
delete_app_variable,
|
||
get_app,
|
||
get_app_ip_access_rule,
|
||
get_app_ip_access_rules,
|
||
get_app_template,
|
||
get_app_deployments,
|
||
get_app_templates,
|
||
get_app_variables,
|
||
get_apps,
|
||
update_app_ip_access_rule,
|
||
update_app_metadata,
|
||
update_app_resources,
|
||
upsert_created_app,
|
||
update_app_variable,
|
||
)
|
||
from ..db.audit import log_audit_event
|
||
from ..db.health import get_latest_service_health, get_service_health, get_service_health_history
|
||
from ..db.incidents import get_service_incidents
|
||
from ..db.jobs import create_job, get_jobs, has_active_deploy_job
|
||
from ..environment import AppEnvironmentError, apply_all_app_environments, apply_app_environment, validate_environment_key
|
||
from ..repo_docs import RepoDocsError, is_markdown_path, list_markdown_files, read_markdown, render_markdown
|
||
from ..routes.deployments import render_status_pill
|
||
from ..routes.incidents import render_incident_history_rows
|
||
from ..shell import run_command
|
||
from ..templates.layout import page, render_result
|
||
|
||
router = APIRouter()
|
||
DEFAULT_PAGE_SIZE = 20
|
||
|
||
# Selectable method presets for IP access rules. WRITE = POST,PUT,PATCH,DELETE; ALL = every
|
||
# common HTTP method including GET. The Caddy generator will later interpret these values.
|
||
IP_ACCESS_METHOD_OPTIONS = (
|
||
"WRITE",
|
||
"ALL",
|
||
"GET",
|
||
"POST",
|
||
"PUT",
|
||
"PATCH",
|
||
"DELETE",
|
||
"GET,POST",
|
||
"POST,PATCH,DELETE",
|
||
)
|
||
METADATA_FIELDS = (
|
||
"name",
|
||
"description",
|
||
"owner",
|
||
"template",
|
||
"runtime",
|
||
"repository_url",
|
||
"repository_name",
|
||
"default_branch",
|
||
"domain",
|
||
"health_url",
|
||
"container_port",
|
||
"is_public",
|
||
"is_enabled",
|
||
)
|
||
|
||
|
||
# ID služby se používá jako Docker container/image name, Compose service name, Gitea repo,
|
||
# adresář workspace a část URL/domény. Nejpřísnější je Docker image name (jen lowercase)
|
||
# a DNS label (max 63 znaků, alfanumerické na začátku i konci). Proto povolujeme pouze
|
||
# malá písmena a-z, číslice a pomlčky uvnitř, bez diakritiky, podtržítek a teček.
|
||
APP_ID_MAX_LENGTH = 63
|
||
APP_ID_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$")
|
||
|
||
|
||
def validate_new_app_id(app_id: str) -> str | None:
|
||
"""Vrátí chybovou hlášku, pokud ID služby nesplňuje omezení, jinak None."""
|
||
if not app_id:
|
||
return "ID služby nesmí být prázdné."
|
||
if app_id != app_id.lower():
|
||
return "ID služby musí být malými písmeny (lowercase)."
|
||
if len(app_id) > APP_ID_MAX_LENGTH:
|
||
return f"ID služby může mít nejvýše {APP_ID_MAX_LENGTH} znaků (limit DNS/Docker)."
|
||
if not APP_ID_RE.match(app_id):
|
||
return (
|
||
"Neplatné ID služby. Povolena jsou jen malá písmena a-z, číslice a pomlčky; "
|
||
"musí začínat i končit písmenem nebo číslicí (např. gmail-service). "
|
||
"Bez diakritiky, mezer, podtržítek a teček — ID se používá jako název "
|
||
"Docker kontejneru, image a Gitea repozitáře."
|
||
)
|
||
return None
|
||
|
||
|
||
def clean_optional(value: str | None) -> str:
|
||
return (value or "").strip()
|
||
|
||
|
||
def parse_optional_int(value: str | None) -> int | None:
|
||
value = clean_optional(value)
|
||
if not value:
|
||
return None
|
||
try:
|
||
return int(value)
|
||
except ValueError:
|
||
raise HTTPException(status_code=400, detail="Neplatne cislo")
|
||
|
||
|
||
def bool_checked(value) -> str:
|
||
return " checked" if value else ""
|
||
|
||
|
||
def app_detail_url(app_id: str, anchor: str = "", message: str = "", error: str = "") -> str:
|
||
params = {}
|
||
if message:
|
||
params["message"] = message
|
||
if error:
|
||
params["error"] = error
|
||
|
||
url = f"/portal/apps/{quote(app_id, safe='')}"
|
||
if params:
|
||
url += f"?{urlencode(params)}"
|
||
if anchor:
|
||
url += f"#{anchor}"
|
||
return url
|
||
|
||
|
||
def redirect_app_detail(app_id: str, anchor: str = "", message: str = "", error: str = "") -> RedirectResponse:
|
||
return RedirectResponse(url=app_detail_url(app_id, anchor=anchor, message=message, error=error), status_code=303)
|
||
|
||
|
||
def apply_environment_message(app_id: str) -> str:
|
||
result = apply_app_environment(app_id)
|
||
if not result.get("changed"):
|
||
return "Environment unchanged."
|
||
if result.get("restarted"):
|
||
return "Environment applied and container restarted."
|
||
return "Environment file regenerated. Container was not running."
|
||
|
||
|
||
def apply_all_environments_message() -> str:
|
||
results = apply_all_app_environments()
|
||
changed = sum(1 for result in results.values() if result.get("changed"))
|
||
restarted = sum(1 for result in results.values() if result.get("restarted"))
|
||
return f"Regenerated environments for {len(results)} apps. Changed: {changed}. Restarted: {restarted}."
|
||
|
||
|
||
def ensure_variable_key_allowed(app_id: str, key: str, variable_id: int | None = None) -> None:
|
||
try:
|
||
validate_environment_key(key)
|
||
except AppEnvironmentError as exc:
|
||
raise HTTPException(status_code=400, detail=str(exc)) from exc
|
||
|
||
for variable in get_app_variables(app_id):
|
||
if variable_id is not None and int(variable.get("id")) == variable_id:
|
||
continue
|
||
if (variable.get("key") or "").strip() == key:
|
||
raise HTTPException(status_code=400, detail="Variable key already exists")
|
||
|
||
|
||
def render_template_options(templates: list[dict], selected_template: str, include_blank: bool = True) -> str:
|
||
options = ['<option value="">Bez šablony</option>'] if include_blank else []
|
||
selected_exists = not selected_template
|
||
for template in templates:
|
||
template_id = template.get("id", "") or ""
|
||
name = template.get("name", "") or ""
|
||
runtime = template.get("runtime", "") or ""
|
||
description = template.get("description", "") or ""
|
||
label_parts = [name]
|
||
if runtime:
|
||
label_parts.append(runtime)
|
||
if description:
|
||
label_parts.append(description)
|
||
selected = " selected" if selected_template == template_id else ""
|
||
if selected:
|
||
selected_exists = True
|
||
options.append(
|
||
f'<option value="{html.escape(template_id)}"{selected}>{html.escape(" - ".join(label_parts))}</option>'
|
||
)
|
||
if not selected_exists:
|
||
options.append(
|
||
f'<option value="{html.escape(selected_template)}" selected>Neznámá šablona</option>'
|
||
)
|
||
return "".join(options)
|
||
|
||
|
||
def render_template_label(templates: list[dict], template_id: str) -> str:
|
||
if not template_id:
|
||
return ""
|
||
for template in templates:
|
||
if template.get("id") == template_id:
|
||
return html.escape(template.get("name", "") or template_id)
|
||
return "Neznámá šablona"
|
||
|
||
|
||
def render_environment_usage_example(language: str, runtime: str, template: str) -> str:
|
||
normalized = " ".join((language or "", runtime or "", template or "")).lower()
|
||
title = "Použití v kódu"
|
||
if "fastapi" in normalized or "python" in normalized:
|
||
code = """import os
|
||
|
||
value = os.environ["MY_VARIABLE"]
|
||
optional_value = os.getenv("OPTIONAL_VARIABLE", "default")"""
|
||
description = "Python / FastAPI čte Variables i Secrets ze systémového prostředí."
|
||
elif "dotnet" in normalized or ".net" in normalized or "csharp" in normalized or "c#" in normalized:
|
||
code = """var value = Environment.GetEnvironmentVariable("MY_VARIABLE");
|
||
var optionalValue = builder.Configuration["OPTIONAL_VARIABLE"] ?? "default";"""
|
||
description = ".NET čte Variables i Secrets z environment variables, případně přes Configuration."
|
||
elif "node" in normalized or "javascript" in normalized or "typescript" in normalized:
|
||
code = """const value = process.env.MY_VARIABLE;
|
||
const optionalValue = process.env.OPTIONAL_VARIABLE ?? "default";"""
|
||
description = "Node.js čte Variables i Secrets přes process.env."
|
||
elif "php" in normalized:
|
||
code = """$value = getenv('MY_VARIABLE');
|
||
$optionalValue = getenv('OPTIONAL_VARIABLE') ?: 'default';"""
|
||
description = "PHP čte Variables i Secrets ze systémového prostředí."
|
||
elif "java" in normalized or "spring" in normalized:
|
||
code = """String value = System.getenv("MY_VARIABLE");
|
||
String optionalValue = System.getenv().getOrDefault("OPTIONAL_VARIABLE", "default");"""
|
||
description = "Java čte Variables i Secrets přes System.getenv."
|
||
else:
|
||
code = """MY_VARIABLE is available as an environment variable inside the container."""
|
||
description = "Variables i Secrets jsou dostupné jako environment variables v kontejneru."
|
||
|
||
return f"""
|
||
<div class="env-usage-example">
|
||
<h3>{html.escape(title)}</h3>
|
||
<p class="muted">{html.escape(description)}</p>
|
||
<pre><code>{html.escape(code)}</code></pre>
|
||
</div>
|
||
"""
|
||
|
||
|
||
def diff_metadata(before: dict, after: dict) -> dict:
|
||
changes = {}
|
||
for field in METADATA_FIELDS:
|
||
old_value = before.get(field)
|
||
new_value = after.get(field)
|
||
if field in ("is_public", "is_enabled"):
|
||
changed = bool(old_value) != bool(new_value)
|
||
else:
|
||
changed = str(old_value or "") != str(new_value or "")
|
||
if changed:
|
||
changes[field] = {"old": old_value, "new": new_value}
|
||
return changes
|
||
|
||
|
||
def render_health_status(status: str | None) -> str:
|
||
value = status or ""
|
||
normalized = value.lower()
|
||
labels = {
|
||
"healthy": "zdravá",
|
||
"unhealthy": "nezdravá",
|
||
"unreachable": "nedostupná",
|
||
}
|
||
class_name = "pill pill-muted"
|
||
if normalized == "healthy":
|
||
class_name = "pill pill-success"
|
||
elif normalized == "unhealthy":
|
||
class_name = "pill pill-warning"
|
||
elif normalized == "unreachable":
|
||
class_name = "pill pill-danger"
|
||
return f'<span class="{class_name}">{html.escape(labels.get(normalized, value or "neznámá"))}</span>'
|
||
|
||
|
||
def render_health_dot(status: str | None, checked_at: str | None) -> str:
|
||
normalized = (status or "").lower()
|
||
labels = {
|
||
"healthy": "zdravá",
|
||
"unhealthy": "nezdravá",
|
||
"unreachable": "nedostupná",
|
||
}
|
||
class_name = "health-dot health-dot-muted"
|
||
if normalized == "healthy":
|
||
class_name = "health-dot health-dot-success"
|
||
elif normalized == "unhealthy":
|
||
class_name = "health-dot health-dot-warning"
|
||
elif normalized == "unreachable":
|
||
class_name = "health-dot health-dot-danger"
|
||
|
||
label = labels.get(normalized, "zdraví neznámé")
|
||
title = label
|
||
if checked_at:
|
||
title = f"{label}, poslední kontrola: {checked_at}"
|
||
return f'<span class="{class_name}" title="{html.escape(title)}" aria-label="{html.escape(title)}"></span>'
|
||
|
||
|
||
def render_section(title: str, body: str, section_id: str = "", is_open: bool = False) -> str:
|
||
"""Sbalitelná karta detailu služby (defaultně zavřená, ať detail nezabírá tolik místa).
|
||
|
||
Title je hotové HTML (obvykle ikona + text), body celý obsah sekce. Odkaz s kotvou na
|
||
zavřenou sekci ji otevře až portal.js (openHashSection) - proto má sekce vlastní id.
|
||
"""
|
||
if not body.strip():
|
||
return ""
|
||
|
||
id_attr = f' id="{section_id}"' if section_id else ""
|
||
open_attr = " open" if is_open else ""
|
||
return f"""
|
||
<details class="card card-section"{id_attr}{open_attr}>
|
||
<summary class="card-section-summary">
|
||
<h2>{title}</h2>
|
||
<i class="fa-solid fa-chevron-down card-section-chevron" aria-hidden="true"></i>
|
||
</summary>
|
||
<div class="card-section-body">
|
||
{body}
|
||
</div>
|
||
</details>
|
||
"""
|
||
|
||
|
||
@router.get("/")
|
||
def portal_home(user=Depends(require_user)):
|
||
return RedirectResponse(url="/portal/apps", status_code=303)
|
||
|
||
|
||
@router.get("/apps", response_class=HTMLResponse)
|
||
def apps_page(
|
||
request: Request,
|
||
q: str = Query(""),
|
||
status: str = Query(""),
|
||
message: str = Query(""),
|
||
error: str = Query(""),
|
||
page_number: int = Query(1, alias="page", ge=1),
|
||
user=Depends(require_user),
|
||
):
|
||
apps = get_apps()
|
||
latest_health = get_latest_service_health()
|
||
query = q.strip()
|
||
selected_status = status.strip()
|
||
if query:
|
||
apps = [
|
||
item for item in apps
|
||
if query.lower() in (item.get("id", "") or "").lower()
|
||
or query.lower() in (item.get("name", "") or "").lower()
|
||
]
|
||
if selected_status:
|
||
apps = [item for item in apps if (item.get("status", "") or "") == selected_status]
|
||
sort = request.query_params.get("sort", "").strip()
|
||
if sort == "health":
|
||
order = {"unreachable": 0, "unhealthy": 1, "healthy": 2}
|
||
apps = sorted(
|
||
apps,
|
||
key=lambda item: (
|
||
order.get((latest_health.get(item.get("id", "")) or {}).get("status"), 3),
|
||
item.get("id", ""),
|
||
),
|
||
)
|
||
status_values = sorted({item.get("status", "") for item in get_apps() if item.get("status")})
|
||
total_apps = len(apps)
|
||
total_pages = max(1, math.ceil(total_apps / DEFAULT_PAGE_SIZE))
|
||
if page_number > total_pages:
|
||
page_number = total_pages
|
||
offset = (page_number - 1) * DEFAULT_PAGE_SIZE
|
||
apps = apps[offset : offset + DEFAULT_PAGE_SIZE]
|
||
|
||
gitea_url = get_gitea_public_url()
|
||
gitea_org = read_env_value("GITEA_ORG", DEFAULT_GITEA_ORG)
|
||
host = get_appfactory_host(request.url.hostname or "")
|
||
|
||
# Role-based visibility: a viewer only sees which services run and their documentation.
|
||
# Developers also get Git/clone and operational actions; only admins see the delete button.
|
||
can_manage = is_developer(user)
|
||
can_delete = is_admin(user)
|
||
|
||
rows = ""
|
||
|
||
for index, item in enumerate(apps, start=1):
|
||
app_id = html.escape(item.get("id", ""))
|
||
app_url_id = quote(item.get("id", ""), safe="")
|
||
app_name = html.escape(item.get("name", "") or "")
|
||
# Ve sloupci Služba zobrazujeme "Název (id)"; když název chybí nebo je shodný s ID,
|
||
# zůstane jen ID bez zdvojení.
|
||
service_label = f"{app_name} ({app_id})" if app_name and app_name != app_id else app_id
|
||
resource_modal_id = f"resources-{page_number}-{index}"
|
||
status = html.escape(item.get("status", ""))
|
||
health = latest_health.get(item.get("id", "")) or {}
|
||
health_checked_at = html.escape(health.get("checked_at", "") or "")
|
||
health_dot = render_health_dot(health.get("status"), health.get("checked_at"))
|
||
docs = html.escape(item.get("docs", f"/apps/{app_id}/docs"))
|
||
memory = html.escape(item.get("memory", "") or "")
|
||
cpus = html.escape(item.get("cpus", "") or "")
|
||
memory_label = memory or "výchozí"
|
||
cpus_label = cpus or "výchozí"
|
||
|
||
http_clone = html.escape(f"git clone {gitea_url}/{gitea_org}/{app_id}.git") if gitea_url else ""
|
||
ssh_clone = html.escape(f"git clone ssh://git@{host}:2222/{gitea_org}/{app_id}.git") if host else ""
|
||
|
||
# Resources: developers/admins can edit; viewers see only the read-only summary.
|
||
if can_manage:
|
||
resource_edit = f"""
|
||
<button type="button" class="btn btn-compact btn-secondary" onclick="openResourceModal('{resource_modal_id}')"><i class="fa-solid fa-gear" aria-hidden="true"></i> Upravit</button>
|
||
</div>
|
||
<dialog class="resource-modal" id="{resource_modal_id}">
|
||
<form method="post" action="/portal/update-resources">
|
||
<input type="hidden" name="app_id" value="{app_id}">
|
||
<div class="modal-header">
|
||
<h3>Prostředky služby</h3>
|
||
<button type="button" class="icon-button" onclick="closeResourceModal('{resource_modal_id}')" aria-label="Zavřít">×</button>
|
||
</div>
|
||
<p class="muted">Paměť je limit RAM. CPU určuje maximální podíl výpočetního výkonu. Příklad: 0,50 = polovina jádra, 1,00 = celé jádro.</p>
|
||
<label>Paměť</label>
|
||
<input name="memory" value="{memory}" placeholder="např. 512m, 1g nebo prázdné pro výchozí">
|
||
<label>CPU</label>
|
||
<input name="cpus" value="{cpus}" placeholder="např. 0.50, 1.00 nebo prázdné pro výchozí">
|
||
<div class="modal-actions">
|
||
<button type="button" class="btn btn-secondary" onclick="closeResourceModal('{resource_modal_id}')"><i class="fa-solid fa-xmark" aria-hidden="true"></i> Zrušit</button>
|
||
<button type="submit"><i class="fa-solid fa-check" aria-hidden="true"></i> Použít</button>
|
||
</div>
|
||
</form>
|
||
</dialog>"""
|
||
else:
|
||
resource_edit = "</div>"
|
||
|
||
# Git clone commands are an operational concern — visible to developers/admins only.
|
||
if can_manage and (http_clone or ssh_clone):
|
||
git_cell = f"""
|
||
<details class="clone-details">
|
||
<summary>Příkazy pro klonování</summary>
|
||
<label class="muted">HTTP</label>
|
||
<div class="cmd-row">
|
||
<input readonly value="{http_clone}" id="http-{app_id}">
|
||
<button type="button" onclick="return copyText(this)"><i class="fa-solid fa-copy" aria-hidden="true"></i> Kopírovat</button>
|
||
</div>
|
||
|
||
<label class="muted">SSH</label>
|
||
<div class="cmd-row">
|
||
<input readonly value="{ssh_clone}" id="ssh-{app_id}">
|
||
<button type="button" onclick="return copyText(this)"><i class="fa-solid fa-copy" aria-hidden="true"></i> Kopírovat</button>
|
||
</div>
|
||
</details>"""
|
||
else:
|
||
git_cell = '<span class="muted">—</span>'
|
||
|
||
# Deploy actions for developers/admins; delete is admin-only.
|
||
manage_icons = (
|
||
f"""
|
||
<a class="icon-action" href="/portal/deployments?app_id={app_url_id}" title="Nasazení" aria-label="Nasazení">
|
||
<i class="fa-solid fa-rocket" aria-hidden="true"></i>
|
||
</a>
|
||
<form method="post" action="/portal/apps/{app_url_id}/redeploy" onsubmit="return confirm('Spustit nové nasazení služby {app_id}?');">
|
||
<button type="submit" class="icon-action" title="Nasadit znovu" aria-label="Nasadit znovu">
|
||
<i class="fa-solid fa-arrows-rotate" aria-hidden="true"></i>
|
||
</button>
|
||
</form>"""
|
||
if can_manage
|
||
else ""
|
||
)
|
||
delete_icon = (
|
||
f"""
|
||
<form method="post" action="/portal/delete-app" onsubmit="return confirm('Smazat {app_id}? Worker odstraní kontejner, image, workspace, záznam v katalogu a Gitea repozitář. Akce se zařadí jako job.');">
|
||
<input type="hidden" name="app_id" value="{app_id}">
|
||
<button type="submit" class="icon-action icon-action-danger" title="Smazat" aria-label="Smazat">
|
||
<i class="fa-solid fa-trash" aria-hidden="true"></i>
|
||
</button>
|
||
</form>"""
|
||
if can_delete
|
||
else ""
|
||
)
|
||
|
||
rows += f"""
|
||
<tr class="service-row">
|
||
<td class="service-name-cell">
|
||
<div class="service-title">
|
||
{health_dot}
|
||
<div>
|
||
<strong>{service_label}</strong><br>
|
||
<span class="muted">/apps/{app_id}</span>
|
||
</div>
|
||
</div>
|
||
</td>
|
||
<td><span class="pill">{status}</span></td>
|
||
<td><a href="{docs}" target="_blank" rel="noopener">Swagger</a></td>
|
||
<td>
|
||
<div class="resource-summary">
|
||
<span>Paměť: <strong>{memory_label}</strong></span>
|
||
<span>CPU: <strong>{cpus_label}</strong></span>
|
||
{resource_edit}
|
||
</td>
|
||
<td>
|
||
{git_cell}
|
||
</td>
|
||
<td class="action-icons-cell">
|
||
<div class="action-icons">
|
||
<a class="icon-action" href="/portal/apps/{app_url_id}" title="Detail služby" aria-label="Detail služby">
|
||
<i class="fa-solid fa-circle-info" aria-hidden="true"></i>
|
||
</a>
|
||
{manage_icons}
|
||
{delete_icon}
|
||
</div>
|
||
</td>
|
||
</tr>
|
||
"""
|
||
|
||
if not rows:
|
||
rows = '<tr><td colspan="6">Zatím nejsou nasazené žádné služby.</td></tr>'
|
||
status_options = ['<option value="">Všechny stavy</option>']
|
||
for value in status_values:
|
||
selected = " selected" if selected_status == value else ""
|
||
escaped_value = html.escape(value)
|
||
status_options.append(f'<option value="{escaped_value}"{selected}>{escaped_value}</option>')
|
||
first_item = offset + 1 if total_apps else 0
|
||
last_item = min(offset + len(apps), total_apps)
|
||
|
||
def page_url(page: int) -> str:
|
||
params = {"page": page}
|
||
if query:
|
||
params["q"] = query
|
||
if selected_status:
|
||
params["status"] = selected_status
|
||
if sort:
|
||
params["sort"] = sort
|
||
return f"/portal/apps?{urlencode(params)}"
|
||
|
||
previous_link = (
|
||
f'<a class="btn btn-secondary" href="{page_url(page_number - 1)}"><i class="fa-solid fa-chevron-left" aria-hidden="true"></i> Předchozí</a>'
|
||
if page_number > 1
|
||
else ""
|
||
)
|
||
next_link = (
|
||
f'<a class="btn btn-secondary" href="{page_url(page_number + 1)}">Další <i class="fa-solid fa-chevron-right" aria-hidden="true"></i></a>'
|
||
if page_number < total_pages
|
||
else ""
|
||
)
|
||
pagination = ""
|
||
if total_pages > 1:
|
||
pagination = f"""
|
||
<div class="pagination">
|
||
<span>Zobrazeno {first_item}-{last_item} z {total_apps}</span>
|
||
<div class="pagination-actions">
|
||
{previous_link}
|
||
<span class="page-indicator">Strana {page_number} / {total_pages}</span>
|
||
{next_link}
|
||
</div>
|
||
</div>
|
||
"""
|
||
notice = ""
|
||
if message:
|
||
notice = f'<p class="alert">{html.escape(message)}</p>'
|
||
if error:
|
||
notice = f'<p class="alert alert-danger">{html.escape(error)}</p>'
|
||
|
||
# Creating services and regenerating .env files are write actions — developers/admins only.
|
||
manage_toolbar = (
|
||
"""
|
||
<p><a class="btn" href="/portal/new-app"><i class="fa-solid fa-plus" aria-hidden="true"></i> Nová služba</a></p>
|
||
<form method="post" action="/portal/apps/environment/apply-all" class="inline-form">
|
||
<button type="submit" class="btn-secondary"><i class="fa-solid fa-arrows-rotate" aria-hidden="true"></i> Regenerovat všechny .env z databáze</button>
|
||
</form>
|
||
"""
|
||
if can_manage
|
||
else ""
|
||
)
|
||
|
||
return page(
|
||
"Služby",
|
||
f"""
|
||
<div class="card">
|
||
<h2><i class="fa-solid fa-server" aria-hidden="true"></i> Nasazené služby</h2>
|
||
{notice}
|
||
{manage_toolbar}
|
||
<form method="get" action="/portal/apps" class="filter-form">
|
||
<input name="q" value="{html.escape(query)}" placeholder="Název nebo ID služby">
|
||
<select name="status">{"".join(status_options)}</select>
|
||
<select name="sort">
|
||
<option value="">Výchozí řazení</option>
|
||
<option value="health"{" selected" if sort == "health" else ""}>Podle zdraví</option>
|
||
</select>
|
||
<input type="hidden" name="page" value="1">
|
||
<button type="submit"><i class="fa-solid fa-filter" aria-hidden="true"></i> Filtrovat</button>
|
||
<a class="btn btn-secondary" href="/portal/apps"><i class="fa-solid fa-xmark" aria-hidden="true"></i> Reset</a>
|
||
</form>
|
||
{pagination}
|
||
<table>
|
||
<tr>
|
||
<th>Služba</th>
|
||
<th>Status</th>
|
||
<th>Dokumentace</th>
|
||
<th>Prostředky <span class="info-dot" tabindex="0" role="note" aria-label="Paměť je limit RAM. CPU určuje maximální podíl výpočetního výkonu. Příklad: 0,50 = polovina jádra, 1,00 = celé jádro." data-tooltip="Paměť je limit RAM. CPU určuje maximální podíl výpočetního výkonu. Příklad: 0,50 = polovina jádra, 1,00 = celé jádro."><i class="fa-solid fa-circle-info" aria-hidden="true"></i></span></th>
|
||
<th>Git</th>
|
||
<th>Akce</th>
|
||
</tr>
|
||
{rows}
|
||
</table>
|
||
{pagination}
|
||
</div>
|
||
""",
|
||
user=user,
|
||
)
|
||
|
||
|
||
@router.post("/apps/environment/apply-all")
|
||
def apply_all_app_environments_action(user=Depends(require_developer)):
|
||
try:
|
||
message = apply_all_environments_message()
|
||
except AppEnvironmentError as exc:
|
||
return RedirectResponse(url="/portal/apps?error=" + quote(f"Environment apply failed: {exc}"), status_code=303)
|
||
|
||
log_audit_event(
|
||
user,
|
||
action="app.environment.applied_all",
|
||
target_type="app",
|
||
metadata={"result": message},
|
||
)
|
||
return RedirectResponse(url="/portal/apps?message=" + quote(message), status_code=303)
|
||
|
||
|
||
@router.get("/apps/{app_id}", response_class=HTMLResponse)
|
||
def app_detail(app_id: str, request: Request, message: str = "", error: str = "", user=Depends(require_user)):
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
# Viewers may open the detail (services + docs are read-only here); editing the service,
|
||
# its variables or triggering a redeploy is reserved for developers/admins.
|
||
can_manage = is_developer(user)
|
||
|
||
log_audit_event(
|
||
user,
|
||
action="service.health.view",
|
||
target_type="service",
|
||
target_id=app_id,
|
||
)
|
||
|
||
escaped_app_id = html.escape(app.get("id", ""))
|
||
app_url_id = quote(app.get("id", ""), safe="")
|
||
name = html.escape(app.get("name", "") or "")
|
||
language_raw = app.get("language", "") or ""
|
||
runtime_raw = app.get("runtime", "") or ""
|
||
template_raw = app.get("template", "") or ""
|
||
language = html.escape(language_raw)
|
||
version = html.escape(app.get("version", "") or "")
|
||
status = html.escape(app.get("status", "") or "")
|
||
memory = html.escape(app.get("memory", "") or "")
|
||
cpus = html.escape(app.get("cpus", "") or "")
|
||
updated_at = html.escape(app.get("updated_at", "") or "")
|
||
description = html.escape(app.get("description", "") or "")
|
||
owner = html.escape(app.get("owner", "") or "")
|
||
runtime = html.escape(runtime_raw)
|
||
repository_url = html.escape(app.get("repository_url", "") or "")
|
||
repository_name = html.escape(app.get("repository_name", "") or "")
|
||
default_branch = html.escape(app.get("default_branch", "") or "")
|
||
domain = html.escape(app.get("domain", "") or "")
|
||
health_url = html.escape(app.get("health_url", "") or "")
|
||
container_port = html.escape(str(app.get("container_port") or ""))
|
||
is_public = bool(app.get("is_public"))
|
||
is_enabled = bool(app.get("is_enabled"))
|
||
templates = get_app_templates()
|
||
template_options = render_template_options(templates, app.get("template", "") or "")
|
||
template_value = render_template_label(templates, app.get("template", "") or "")
|
||
environment_usage_example = render_environment_usage_example(language_raw, runtime_raw, template_raw)
|
||
variables = get_app_variables(app.get("id", ""))
|
||
ip_access_rules = get_app_ip_access_rules(app.get("id", ""))
|
||
incidents = get_service_incidents(app.get("id", ""), limit=20)
|
||
current_health = get_service_health(app.get("id", ""))
|
||
health_history = get_service_health_history(app.get("id", ""), limit=50)
|
||
|
||
rows = ""
|
||
for deployment in get_app_deployments(app.get("id", ""), limit=10):
|
||
deployment_id = html.escape(str(deployment.get("id", "")))
|
||
started_at = html.escape(deployment.get("started_at", "") or "")
|
||
triggered_by = html.escape(
|
||
deployment.get("triggered_by_display_name")
|
||
or deployment.get("triggered_by_username")
|
||
or ""
|
||
)
|
||
rows += f"""
|
||
<tr>
|
||
<td><a href="/portal/deployments/{deployment_id}">#{deployment_id}</a></td>
|
||
<td>{render_status_pill(deployment.get("status"))}</td>
|
||
<td>{started_at}</td>
|
||
<td>{triggered_by}</td>
|
||
</tr>
|
||
"""
|
||
|
||
if not rows:
|
||
rows = '<tr><td colspan="4">Zatím nejsou evidovaná žádná nasazení této služby.</td></tr>'
|
||
|
||
job_rows = ""
|
||
for job in get_jobs(limit=100, target=app.get("id", "")):
|
||
if job.get("target_type") != "app" or job.get("target_id") != app.get("id", ""):
|
||
continue
|
||
|
||
job_id = html.escape(str(job.get("id", "")))
|
||
job_rows += f"""
|
||
<tr>
|
||
<td><a href="/portal/jobs/{job_id}">#{job_id}</a></td>
|
||
<td>{render_status_pill(job.get("status"))}</td>
|
||
<td>{html.escape(job.get("type", "") or "")}</td>
|
||
<td>{html.escape(job.get("created_at", "") or "")}</td>
|
||
</tr>
|
||
"""
|
||
|
||
if not job_rows:
|
||
job_rows = '<tr><td colspan="4">Zatím nejsou evidované žádné úlohy této služby.</td></tr>'
|
||
|
||
health_status = render_health_status(current_health.get("status") if current_health else None)
|
||
health_http_status = html.escape(str(current_health.get("http_status") or "")) if current_health else ""
|
||
health_response_time = html.escape(str(current_health.get("response_time_ms") or "")) if current_health else ""
|
||
health_checked_at = html.escape(current_health.get("checked_at", "") or "") if current_health else ""
|
||
health_rows = ""
|
||
for item in health_history:
|
||
error_text = item.get("error_text", "") or ""
|
||
error_preview = error_text if len(error_text) <= 140 else f"{error_text[:137]}..."
|
||
health_rows += f"""
|
||
<tr>
|
||
<td>{html.escape(item.get("checked_at", "") or "")}</td>
|
||
<td>{render_health_status(item.get("status"))}</td>
|
||
<td>{html.escape(str(item.get("http_status") or ""))}</td>
|
||
<td>{html.escape(str(item.get("response_time_ms") or ""))}</td>
|
||
<td>{html.escape(error_preview)}</td>
|
||
</tr>
|
||
"""
|
||
|
||
if not health_rows:
|
||
health_rows = '<tr><td colspan="5">Zatím nejsou evidované žádné kontroly zdraví.</td></tr>'
|
||
|
||
variable_rows = ""
|
||
for variable in variables:
|
||
variable_id = html.escape(str(variable.get("id", "")))
|
||
variable_key = html.escape(variable.get("key", "") or "")
|
||
variable_value_raw = variable.get("value", "") or ""
|
||
variable_is_secret = bool(variable.get("is_secret"))
|
||
variable_value = "---" if variable_is_secret else html.escape(variable_value_raw)
|
||
value_input = "" if variable_is_secret else html.escape(variable_value_raw)
|
||
secret_checked = bool_checked(variable_is_secret)
|
||
secret_hint = ' placeholder="---"' if variable_is_secret else ""
|
||
variable_rows += f"""
|
||
<tr>
|
||
<td>{variable_key}</td>
|
||
<td>{variable_value}</td>
|
||
<td>{"Ano" if variable_is_secret else "Ne"}</td>
|
||
<td>
|
||
<form method="post" action="/portal/apps/{app_url_id}/variables/{variable_id}/update" class="inline-form variable-form">
|
||
<input name="key" value="{variable_key}" required>
|
||
<input name="value" value="{value_input}"{secret_hint}>
|
||
<label class="checkbox-label"><input type="checkbox" name="is_secret" value="1"{secret_checked}> Secret</label>
|
||
<button type="submit" class="icon-action" title="Uložit" aria-label="Uložit"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i></button>
|
||
</form>
|
||
<form method="post" action="/portal/apps/{app_url_id}/variables/{variable_id}/delete" class="inline-form" onsubmit="return confirm('Smazat promennou {variable_key}?');">
|
||
<button type="submit" class="icon-action icon-action-danger" title="Smazat" aria-label="Smazat"><i class="fa-solid fa-trash" aria-hidden="true"></i></button>
|
||
</form>
|
||
</td>
|
||
</tr>
|
||
"""
|
||
|
||
if not variable_rows:
|
||
variable_rows = '<tr><td colspan="4">Zatím nejsou evidované žádné proměnné.</td></tr>'
|
||
|
||
def render_method_options(selected: str) -> str:
|
||
selected_upper = (selected or "").upper()
|
||
options = list(IP_ACCESS_METHOD_OPTIONS)
|
||
if selected_upper and selected_upper not in options:
|
||
options.append(selected_upper)
|
||
out = ""
|
||
for opt in options:
|
||
is_sel = " selected" if opt == selected_upper else ""
|
||
out += f'<option value="{html.escape(opt, quote=True)}"{is_sel}>{html.escape(opt)}</option>'
|
||
return out
|
||
|
||
# IP access rules — inputs in each column are associated with the per-row update form via the
|
||
# HTML5 form="..." attribute, so the whole row is editable inline while staying valid markup.
|
||
ip_access_rule_rows = ""
|
||
for rule in ip_access_rules:
|
||
rid = html.escape(str(rule.get("id", "")))
|
||
form_id = f"iprule-{rid}"
|
||
rule_ip = html.escape(rule.get("ip_cidr", "") or "", quote=True)
|
||
rule_desc = html.escape(rule.get("description", "") or "", quote=True)
|
||
rule_enabled = bool(rule.get("is_enabled", 1))
|
||
row_class = "" if rule_enabled else " rule-disabled"
|
||
enabled_checked = bool_checked(rule_enabled)
|
||
ip_label = html.escape(rule.get("ip_cidr", "") or "")
|
||
# Pravidla navázaná na katalog IP adres drží IP/CIDR i popis podle katalogu, aby se obě
|
||
# místa nerozešla – tady jsou proto jen ke čtení a mění se v centrální správě IP Access.
|
||
address_id = rule.get("address_id")
|
||
if address_id:
|
||
address_label = html.escape(rule.get("address_label") or rule.get("description") or "", quote=True)
|
||
source_cell = (
|
||
f'<a href="/portal/admin/ip-access?mode=address&address_id={html.escape(str(address_id), quote=True)}" '
|
||
f'title="Spravovat v centrální správě IP Access">{address_label}</a>'
|
||
)
|
||
ip_cell = f'<input name="ip_cidr" value="{rule_ip}" form="{form_id}" readonly>'
|
||
description_cell = f'<input name="description" value="{rule_desc}" form="{form_id}" readonly>'
|
||
else:
|
||
source_cell = '<span class="muted">ručně</span>'
|
||
ip_cell = f'<input name="ip_cidr" value="{rule_ip}" form="{form_id}" required>'
|
||
description_cell = f'<input name="description" value="{rule_desc}" form="{form_id}">'
|
||
ip_access_rule_rows += f"""
|
||
<tr class="ip-rule-row{row_class}">
|
||
<td>{ip_cell}</td>
|
||
<td><select name="methods" form="{form_id}">{render_method_options(rule.get("methods", ""))}</select></td>
|
||
<td>{description_cell}</td>
|
||
<td>{source_cell}</td>
|
||
<td><label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1" form="{form_id}"{enabled_checked}> Aktivní</label></td>
|
||
<td>
|
||
<form method="post" action="/portal/apps/{app_url_id}/ip-access-rules/{rid}/update" id="{form_id}" class="inline-form"></form>
|
||
<button type="submit" form="{form_id}" class="btn btn-compact"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Uložit</button>
|
||
<form method="post" action="/portal/apps/{app_url_id}/ip-access-rules/{rid}/delete" class="inline-form" onsubmit="return confirm('Smazat pravidlo {ip_label}?');">
|
||
<button type="submit" class="btn btn-secondary btn-compact"><i class="fa-solid fa-trash" aria-hidden="true"></i> Smazat</button>
|
||
</form>
|
||
</td>
|
||
</tr>
|
||
"""
|
||
|
||
if not ip_access_rule_rows:
|
||
ip_access_rule_rows = '<tr><td colspan="6">Zatím nejsou evidovaná žádná IP access pravidla.</td></tr>'
|
||
|
||
notice = ""
|
||
if message:
|
||
notice = f'<p class="alert">{html.escape(message)}</p>'
|
||
if error:
|
||
notice = f'<p class="alert alert-danger">{html.escape(error)}</p>'
|
||
|
||
# Editable sections are developer/admin only. Viewers keep the read-only Souhrn / Zdrav\u00ed /
|
||
# Historie cards below, which already present the service metadata without write access.
|
||
redeploy_block = (
|
||
f"""
|
||
<form method="post" action="/portal/apps/{app_url_id}/redeploy" onsubmit="return confirm('Spustit nov\u00e9 nasazen\u00ed slu\u017eby {escaped_app_id}?');">
|
||
<button type="submit"><i class="fa-solid fa-rotate-right" aria-hidden="true"></i> Nasadit znovu</button>
|
||
</form>
|
||
"""
|
||
if can_manage
|
||
else ""
|
||
)
|
||
|
||
# Odkazy jen otevřou a najedou na sekci - všechny sekce jsou defaultně sbalené.
|
||
manage_tabs = (
|
||
"""
|
||
<a class="btn btn-secondary" href="#metadata"><i class="fa-solid fa-table-list" aria-hidden="true"></i> Metadata</a>
|
||
<a class="btn btn-secondary" href="#promenne"><i class="fa-solid fa-sliders" aria-hidden="true"></i> Proměnné</a>
|
||
<a class="btn btn-secondary" href="#ip-access"><i class="fa-solid fa-shield-halved" aria-hidden="true"></i> Security / IP Access</a>
|
||
"""
|
||
if can_manage
|
||
else ""
|
||
)
|
||
detail_tabs = f"""
|
||
<div class="detail-tabs" aria-label="Sekce detailu služby">
|
||
<a class="btn btn-secondary" href="#dokumentace"><i class="fa-solid fa-book" aria-hidden="true"></i> Dokumentace</a>
|
||
{manage_tabs}
|
||
<a class="btn btn-secondary" href="#historie"><i class="fa-solid fa-clock-rotate-left" aria-hidden="true"></i> Historie</a>
|
||
</div>
|
||
"""
|
||
|
||
# Seznam *.md souborů se tahá z Gitea, proto se načítá až po rozbalení sekce (portal.js) -
|
||
# nedostupná Gitea tak nikdy nezdrží vykreslení detailu.
|
||
docs_card = render_section(
|
||
'<i class="fa-solid fa-book" aria-hidden="true"></i> Dokumentace',
|
||
f"""
|
||
<p class="inline-form">
|
||
<a class="btn btn-secondary" href="/apps/{app_url_id}/docs" target="_blank" rel="noopener">
|
||
<i class="fa-solid fa-book-open" aria-hidden="true"></i> Swagger / OpenAPI
|
||
</a>
|
||
<span class="muted">Interaktivní dokumentace API běžící služby.</span>
|
||
</p>
|
||
<h3 class="docs-subtitle">Soubory *.md v repozitáři</h3>
|
||
<div class="doc-list" data-lazy-src="/portal/apps/{app_url_id}/docs-files">
|
||
<p class="muted">Seznam souborů se načte po rozbalení sekce.</p>
|
||
</div>
|
||
""",
|
||
section_id="dokumentace",
|
||
)
|
||
|
||
metadata_card = (
|
||
render_section(
|
||
'<i class="fa-solid fa-table-list" aria-hidden="true"></i> Metadata',
|
||
f"""
|
||
<form method="post" action="/portal/apps/{app_url_id}/metadata" class="metadata-form">
|
||
<label>Název</label>
|
||
<input name="name" value="{name}" required>
|
||
|
||
<label>Popis</label>
|
||
<textarea name="description" rows="3">{description}</textarea>
|
||
|
||
<label>Vlastník</label>
|
||
<input name="owner" value="{owner}">
|
||
|
||
<label>Template</label>
|
||
<select name="template">{template_options}</select>
|
||
|
||
<label>Runtime</label>
|
||
<input name="runtime" value="{runtime}">
|
||
|
||
<label>Repository URL</label>
|
||
<input name="repository_url" value="{repository_url}">
|
||
|
||
<label>Repository Name</label>
|
||
<input name="repository_name" value="{repository_name}">
|
||
|
||
<label>Default Branch</label>
|
||
<input name="default_branch" value="{default_branch}">
|
||
|
||
<label>Domain</label>
|
||
<input name="domain" value="{domain}">
|
||
|
||
<label>Health URL</label>
|
||
<input name="health_url" value="{health_url}">
|
||
|
||
<label>Container Port</label>
|
||
<input name="container_port" value="{container_port}" inputmode="numeric">
|
||
|
||
<label class="checkbox-label"><input type="checkbox" name="is_public" value="1"{bool_checked(is_public)}> Veřejná služba</label>
|
||
<label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1"{bool_checked(is_enabled)}> Aktivní služba</label>
|
||
|
||
<div class="form-actions">
|
||
<button type="submit"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Uložit metadata</button>
|
||
</div>
|
||
</form>
|
||
""",
|
||
section_id="metadata",
|
||
)
|
||
if can_manage
|
||
else ""
|
||
)
|
||
|
||
variables_card = (
|
||
render_section(
|
||
'<i class="fa-solid fa-sliders" aria-hidden="true"></i> Proměnné',
|
||
f"""
|
||
<form method="post" action="/portal/apps/{app_url_id}/environment/apply" class="inline-form">
|
||
<button type="submit" class="btn-secondary"><i class="fa-solid fa-rotate" aria-hidden="true"></i> Regenerovat .env z databáze</button>
|
||
</form>
|
||
{environment_usage_example}
|
||
<table>
|
||
<tr>
|
||
<th>Key</th>
|
||
<th>Value</th>
|
||
<th>Secret</th>
|
||
<th>Akce</th>
|
||
</tr>
|
||
{variable_rows}
|
||
</table>
|
||
|
||
<form method="post" action="/portal/apps/{app_url_id}/variables" class="metadata-form add-variable-form">
|
||
<h3>Přidat proměnnou</h3>
|
||
<label>Key</label>
|
||
<input name="key" required>
|
||
<label>Value</label>
|
||
<input name="value">
|
||
<label class="checkbox-label"><input type="checkbox" name="is_secret" value="1"> Secret</label>
|
||
<div class="form-actions">
|
||
<button type="submit"><i class="fa-solid fa-plus" aria-hidden="true"></i> Přidat proměnnou</button>
|
||
</div>
|
||
</form>
|
||
""",
|
||
section_id="promenne",
|
||
)
|
||
if can_manage
|
||
else ""
|
||
)
|
||
|
||
ip_access_card = (
|
||
render_section(
|
||
'<i class="fa-solid fa-shield-halved" aria-hidden="true"></i> Security / IP Access',
|
||
f"""
|
||
<p class="muted">
|
||
Pravidla určují, z jakých IP/CIDR adres lze volat dané HTTP metody.
|
||
<strong>WRITE</strong> = POST, PUT, PATCH, DELETE; <strong>ALL</strong> = všechny běžné metody včetně GET.
|
||
Pravidla se zatím pouze ukládají (Caddy je začne vynucovat později).
|
||
</p>
|
||
<p class="inline-form">
|
||
<a class="btn btn-secondary" href="/portal/admin/ip-access?mode=service&app_id={app_url_id}">
|
||
<i class="fa-solid fa-diagram-project" aria-hidden="true"></i> Hromadné přiřazení IP adres
|
||
</a>
|
||
<span class="muted">Pojmenované adresy z katalogu (sloupec Zdroj) se spravují centrálně —
|
||
tam jednou adresou obsloužíte i deset služeb.</span>
|
||
</p>
|
||
<table>
|
||
<tr>
|
||
<th>IP/CIDR</th>
|
||
<th>Methods</th>
|
||
<th>Description</th>
|
||
<th>Zdroj</th>
|
||
<th>Enabled</th>
|
||
<th>Actions</th>
|
||
</tr>
|
||
{ip_access_rule_rows}
|
||
</table>
|
||
|
||
<form method="post" action="/portal/apps/{app_url_id}/ip-access-rules" class="metadata-form add-variable-form">
|
||
<h3>Přidat pravidlo</h3>
|
||
<label>IP/CIDR</label>
|
||
<input name="ip_cidr" placeholder="např. 185.10.20.30 nebo 10.0.0.0/24" required>
|
||
<label>Methods</label>
|
||
<select name="methods">{render_method_options("WRITE")}</select>
|
||
<label>Description</label>
|
||
<input name="description" placeholder="např. Office IP">
|
||
<label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1" checked> Aktivní</label>
|
||
<div class="form-actions">
|
||
<button type="submit"><i class="fa-solid fa-plus" aria-hidden="true"></i> Přidat pravidlo</button>
|
||
</div>
|
||
</form>
|
||
""",
|
||
section_id="ip-access",
|
||
)
|
||
if can_manage
|
||
else ""
|
||
)
|
||
|
||
summary_card = render_section(
|
||
'<i class="fa-solid fa-circle-info" aria-hidden="true"></i> Souhrn',
|
||
f"""
|
||
<table>
|
||
<tr><th>ID</th><td>{escaped_app_id}</td></tr>
|
||
<tr><th>N\u00e1zev</th><td>{name}</td></tr>
|
||
<tr><th>Popis</th><td>{description}</td></tr>
|
||
<tr><th>Vlastn\u00edk</th><td>{owner}</td></tr>
|
||
<tr><th>Template</th><td>{template_value}</td></tr>
|
||
<tr><th>Runtime</th><td>{runtime}</td></tr>
|
||
<tr><th>Repository URL</th><td>{repository_url}</td></tr>
|
||
<tr><th>Repository Name</th><td>{repository_name}</td></tr>
|
||
<tr><th>Default Branch</th><td>{default_branch}</td></tr>
|
||
<tr><th>Domain</th><td>{domain}</td></tr>
|
||
<tr><th>Health URL</th><td>{health_url}</td></tr>
|
||
<tr><th>Container Port</th><td>{container_port}</td></tr>
|
||
<tr><th>Ve\u0159ejn\u00e1 slu\u017eba</th><td>{"Ano" if is_public else "Ne"}</td></tr>
|
||
<tr><th>Aktivn\u00ed slu\u017eba</th><td>{"Ano" if is_enabled else "Ne"}</td></tr>
|
||
<tr><th>Jazyk</th><td>{language}</td></tr>
|
||
<tr><th>Verze</th><td>{version}</td></tr>
|
||
<tr><th>Status</th><td><span class="pill">{status}</span></td></tr>
|
||
<tr><th>Pam\u011b\u0165</th><td>{memory}</td></tr>
|
||
<tr><th>CPU</th><td>{cpus}</td></tr>
|
||
<tr><th>Upraveno</th><td>{updated_at}</td></tr>
|
||
<tr><th>Logy</th><td><a href="/portal/jobs?target={app_url_id}">Zobrazit \u00falohy a logy</a></td></tr>
|
||
</table>
|
||
""",
|
||
section_id="souhrn",
|
||
)
|
||
|
||
health_card = render_section(
|
||
'<i class="fa-solid fa-heart-pulse" aria-hidden="true"></i> Zdrav\u00ed slu\u017eby',
|
||
f"""
|
||
<table>
|
||
<tr><th>Aktu\u00e1ln\u00ed status</th><td>{health_status}</td></tr>
|
||
<tr><th>HTTP status</th><td>{health_http_status}</td></tr>
|
||
<tr><th>Odezva</th><td>{health_response_time}</td></tr>
|
||
<tr><th>Posledn\u00ed kontrola</th><td>{health_checked_at}</td></tr>
|
||
</table>
|
||
""",
|
||
section_id="zdravi",
|
||
)
|
||
|
||
health_history_card = render_section(
|
||
'<i class="fa-solid fa-clock-rotate-left" aria-hidden="true"></i> Historie kontrol',
|
||
f"""
|
||
<table>
|
||
<tr>
|
||
<th>\u010cas</th>
|
||
<th>Status</th>
|
||
<th>HTTP status</th>
|
||
<th>Odezva</th>
|
||
<th>Chyba</th>
|
||
</tr>
|
||
{health_rows}
|
||
</table>
|
||
""",
|
||
section_id="historie",
|
||
)
|
||
|
||
incidents_card = render_section(
|
||
'<i class="fa-solid fa-triangle-exclamation" aria-hidden="true"></i> Incidenty slu\u017eby',
|
||
f"""
|
||
<table>
|
||
<tr>
|
||
<th>N\u00e1zev</th>
|
||
<th>Za\u010d\u00e1tek</th>
|
||
<th>Konec</th>
|
||
<th>Trv\u00e1n\u00ed</th>
|
||
<th>Stav</th>
|
||
</tr>
|
||
{render_incident_history_rows(incidents, include_service=False)}
|
||
</table>
|
||
""",
|
||
section_id="incidenty",
|
||
)
|
||
|
||
deployments_card = render_section(
|
||
'<i class="fa-solid fa-rocket" aria-hidden="true"></i> Historie nasazen\u00ed',
|
||
f"""
|
||
<table>
|
||
<tr>
|
||
<th>ID</th>
|
||
<th>Status</th>
|
||
<th>\u010cas</th>
|
||
<th>Spustil</th>
|
||
</tr>
|
||
{rows}
|
||
</table>
|
||
""",
|
||
section_id="nasazeni",
|
||
)
|
||
|
||
jobs_card = render_section(
|
||
'<i class="fa-solid fa-list-check" aria-hidden="true"></i> Historie \u00faloh',
|
||
f"""
|
||
<table>
|
||
<tr>
|
||
<th>ID</th>
|
||
<th>Status</th>
|
||
<th>Typ</th>
|
||
<th>Vytvo\u0159eno</th>
|
||
</tr>
|
||
{job_rows}
|
||
</table>
|
||
""",
|
||
section_id="ulohy",
|
||
)
|
||
|
||
return page(
|
||
"Detail slu\u017eby",
|
||
f"""
|
||
<div class="card">
|
||
<h2>{escaped_app_id}</h2>
|
||
<p class="muted">{name}</p>
|
||
{notice}
|
||
<p>
|
||
<a class="btn" href="/portal/apps">← Zpět na služby</a>
|
||
<a class="btn btn-secondary" href="/portal/deployments?app_id={app_url_id}"><i class="fa-solid fa-rocket" aria-hidden="true"></i> Nasazení služby</a>
|
||
<a class="btn btn-secondary" href="/portal/jobs?target={app_url_id}"><i class="fa-solid fa-list-check" aria-hidden="true"></i> Úlohy služby</a>
|
||
</p>
|
||
{redeploy_block}
|
||
</div>
|
||
|
||
{detail_tabs}
|
||
|
||
{docs_card}
|
||
|
||
{metadata_card}
|
||
|
||
{variables_card}
|
||
|
||
{ip_access_card}
|
||
|
||
{summary_card}
|
||
|
||
{health_card}
|
||
|
||
{health_history_card}
|
||
|
||
{incidents_card}
|
||
|
||
{deployments_card}
|
||
|
||
{jobs_card}
|
||
""",
|
||
user=user,
|
||
)
|
||
|
||
|
||
def render_doc_size(size: int) -> str:
|
||
if size < 1024:
|
||
return f"{size} B"
|
||
return f"{round(size / 1024)} kB"
|
||
|
||
|
||
@router.get("/apps/{app_id}/docs-files", response_class=HTMLResponse)
|
||
def app_docs_files(app_id: str, user=Depends(require_user)):
|
||
"""HTML fragment se seznamem *.md souborů služby (načítá ho portal.js po rozbalení sekce)."""
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
repo = (app.get("repository_name") or app_id).strip()
|
||
branch = (app.get("default_branch") or "").strip()
|
||
try:
|
||
files = list_markdown_files(repo, branch)
|
||
except RepoDocsError as exc:
|
||
return HTMLResponse(f'<p class="muted">Dokumentaci se nepodařilo načíst: {html.escape(str(exc))}</p>')
|
||
|
||
if not files:
|
||
return HTMLResponse('<p class="muted">V repozitáři služby nejsou žádné soubory *.md.</p>')
|
||
|
||
items = ""
|
||
for item in files:
|
||
doc_path = item["path"]
|
||
doc_query = urlencode({"path": doc_path})
|
||
items += f"""
|
||
<details class="doc-file">
|
||
<summary>
|
||
<i class="fa-solid fa-file-lines" aria-hidden="true"></i>
|
||
<span>{html.escape(doc_path)}</span>
|
||
<span class="muted doc-file-size">{render_doc_size(item["size"])}</span>
|
||
</summary>
|
||
<div class="doc-file-body" data-lazy-src="/portal/apps/{quote(app_id, safe='')}/docs-file?{doc_query}">
|
||
<p class="muted">Obsah se načte po rozbalení.</p>
|
||
</div>
|
||
</details>
|
||
"""
|
||
|
||
return HTMLResponse(items)
|
||
|
||
|
||
@router.get("/apps/{app_id}/docs-file", response_class=HTMLResponse)
|
||
def app_docs_file(app_id: str, path: str = Query(""), user=Depends(require_user)):
|
||
"""HTML fragment s obsahem jednoho *.md souboru z repozitáře služby."""
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
if not is_markdown_path(path):
|
||
raise HTTPException(status_code=400, detail="Neplatná cesta k souboru dokumentace")
|
||
|
||
repo = (app.get("repository_name") or app_id).strip()
|
||
branch = (app.get("default_branch") or "").strip()
|
||
try:
|
||
text = read_markdown(repo, path, branch)
|
||
except RepoDocsError as exc:
|
||
return HTMLResponse(f'<p class="muted">Soubor se nepodařilo načíst: {html.escape(str(exc))}</p>')
|
||
|
||
return HTMLResponse(render_markdown(text, repo))
|
||
|
||
|
||
@router.post("/apps/{app_id}/metadata")
|
||
def save_app_metadata(
|
||
app_id: str,
|
||
name: str = Form(...),
|
||
description: str = Form(""),
|
||
owner: str = Form(""),
|
||
template: str = Form(""),
|
||
runtime: str = Form(""),
|
||
repository_url: str = Form(""),
|
||
repository_name: str = Form(""),
|
||
default_branch: str = Form(""),
|
||
domain: str = Form(""),
|
||
health_url: str = Form(""),
|
||
container_port: str = Form(""),
|
||
is_public: str | None = Form(None),
|
||
is_enabled: str | None = Form(None),
|
||
user=Depends(require_developer),
|
||
):
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
metadata = {
|
||
"name": clean_optional(name),
|
||
"description": clean_optional(description),
|
||
"owner": clean_optional(owner),
|
||
"template": clean_optional(template),
|
||
"runtime": clean_optional(runtime),
|
||
"repository_url": clean_optional(repository_url),
|
||
"repository_name": clean_optional(repository_name),
|
||
"default_branch": clean_optional(default_branch),
|
||
"domain": clean_optional(domain),
|
||
"health_url": clean_optional(health_url),
|
||
"container_port": parse_optional_int(container_port),
|
||
"is_public": bool(is_public),
|
||
"is_enabled": bool(is_enabled),
|
||
}
|
||
|
||
changes = diff_metadata(app, metadata)
|
||
update_app_metadata(app_id, metadata)
|
||
if changes:
|
||
log_audit_event(
|
||
user,
|
||
action="app.metadata.updated",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={"changes": changes},
|
||
)
|
||
|
||
return RedirectResponse(url=f"/portal/apps/{quote(app_id, safe='')}#metadata", status_code=303)
|
||
|
||
|
||
@router.post("/apps/{app_id}/variables")
|
||
def add_app_variable(
|
||
app_id: str,
|
||
key: str = Form(...),
|
||
value: str = Form(""),
|
||
is_secret: str | None = Form(None),
|
||
user=Depends(require_developer),
|
||
):
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
variable_key = clean_optional(key)
|
||
if not variable_key:
|
||
raise HTTPException(status_code=400, detail="Key is required")
|
||
ensure_variable_key_allowed(app_id, variable_key)
|
||
|
||
create_app_variable(app_id, variable_key, value, bool(is_secret))
|
||
log_audit_event(
|
||
user,
|
||
action="app.variable.created",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={"key": variable_key, "is_secret": bool(is_secret)},
|
||
)
|
||
|
||
try:
|
||
message = apply_environment_message(app_id)
|
||
except AppEnvironmentError as exc:
|
||
return redirect_app_detail(app_id, anchor="promenne", error=f"Variable saved, but environment apply failed: {exc}")
|
||
|
||
return redirect_app_detail(app_id, anchor="promenne", message=message)
|
||
|
||
|
||
@router.post("/apps/{app_id}/variables/{variable_id}/update")
|
||
def save_app_variable(
|
||
app_id: str,
|
||
variable_id: int,
|
||
key: str = Form(...),
|
||
value: str = Form(""),
|
||
is_secret: str | None = Form(None),
|
||
user=Depends(require_developer),
|
||
):
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
existing = next((item for item in get_app_variables(app_id) if int(item.get("id")) == variable_id), None)
|
||
if not existing:
|
||
raise HTTPException(status_code=404, detail="Variable not found")
|
||
|
||
variable_key = clean_optional(key)
|
||
if not variable_key:
|
||
raise HTTPException(status_code=400, detail="Key is required")
|
||
ensure_variable_key_allowed(app_id, variable_key, variable_id=variable_id)
|
||
|
||
stored_value = None if existing.get("is_secret") and bool(is_secret) and value == "" else value
|
||
update_app_variable(variable_id, app_id, variable_key, stored_value, bool(is_secret))
|
||
log_audit_event(
|
||
user,
|
||
action="app.variable.updated",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={"key": variable_key, "is_secret": bool(is_secret)},
|
||
)
|
||
|
||
try:
|
||
message = apply_environment_message(app_id)
|
||
except AppEnvironmentError as exc:
|
||
return redirect_app_detail(app_id, anchor="promenne", error=f"Variable saved, but environment apply failed: {exc}")
|
||
|
||
return redirect_app_detail(app_id, anchor="promenne", message=message)
|
||
|
||
|
||
@router.post("/apps/{app_id}/variables/{variable_id}/delete")
|
||
def remove_app_variable(app_id: str, variable_id: int, user=Depends(require_developer)):
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
existing = next((item for item in get_app_variables(app_id) if int(item.get("id")) == variable_id), None)
|
||
if not existing:
|
||
raise HTTPException(status_code=404, detail="Variable not found")
|
||
|
||
delete_app_variable(variable_id, app_id)
|
||
log_audit_event(
|
||
user,
|
||
action="app.variable.deleted",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={"key": existing.get("key"), "is_secret": bool(existing.get("is_secret"))},
|
||
)
|
||
|
||
try:
|
||
message = apply_environment_message(app_id)
|
||
except AppEnvironmentError as exc:
|
||
return redirect_app_detail(app_id, anchor="promenne", error=f"Variable deleted, but environment apply failed: {exc}")
|
||
|
||
return redirect_app_detail(app_id, anchor="promenne", message=message)
|
||
|
||
|
||
@router.post("/apps/{app_id}/environment/apply")
|
||
def apply_app_environment_action(app_id: str, user=Depends(require_developer)):
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
try:
|
||
message = apply_environment_message(app_id)
|
||
except AppEnvironmentError as exc:
|
||
return redirect_app_detail(app_id, anchor="promenne", error=f"Environment apply failed: {exc}")
|
||
|
||
log_audit_event(
|
||
user,
|
||
action="app.environment.applied",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={"result": message},
|
||
)
|
||
return redirect_app_detail(app_id, anchor="promenne", message=message)
|
||
|
||
|
||
@router.post("/apps/{app_id}/ip-access-rules")
|
||
def add_app_ip_access_rule(
|
||
app_id: str,
|
||
ip_cidr: str = Form(...),
|
||
methods: str = Form("WRITE"),
|
||
description: str = Form(""),
|
||
is_enabled: str | None = Form(None),
|
||
user=Depends(require_developer),
|
||
):
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
rule_ip = clean_optional(ip_cidr)
|
||
rule_methods = clean_optional(methods).upper()
|
||
if not rule_ip:
|
||
return redirect_app_detail(app_id, anchor="ip-access", error="IP/CIDR nesmí být prázdné.")
|
||
if not rule_methods:
|
||
return redirect_app_detail(app_id, anchor="ip-access", error="Methods nesmí být prázdné.")
|
||
|
||
create_app_ip_access_rule(app_id, rule_ip, rule_methods, description.strip(), bool(is_enabled))
|
||
log_audit_event(
|
||
user,
|
||
action="app.ip_access_rule.created",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={"ip_cidr": rule_ip, "methods": rule_methods, "is_enabled": bool(is_enabled)},
|
||
)
|
||
return redirect_app_detail(app_id, anchor="ip-access", message="IP access pravidlo přidáno.")
|
||
|
||
|
||
@router.post("/apps/{app_id}/ip-access-rules/{rule_id}/update")
|
||
def save_app_ip_access_rule(
|
||
app_id: str,
|
||
rule_id: int,
|
||
ip_cidr: str = Form(...),
|
||
methods: str = Form("WRITE"),
|
||
description: str = Form(""),
|
||
is_enabled: str | None = Form(None),
|
||
user=Depends(require_developer),
|
||
):
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
existing = get_app_ip_access_rule(rule_id, app_id)
|
||
if not existing:
|
||
return redirect_app_detail(app_id, anchor="ip-access", error="IP access pravidlo nebylo nalezeno.")
|
||
|
||
rule_ip = clean_optional(ip_cidr)
|
||
rule_methods = clean_optional(methods).upper()
|
||
rule_description = description.strip()
|
||
if not rule_methods:
|
||
return redirect_app_detail(app_id, anchor="ip-access", error="Methods nesmí být prázdné.")
|
||
|
||
# Pravidla z katalogu IP adres si IP/CIDR ani popis nedrží sama – ty patří katalogu, jinak by
|
||
# se obě místa rozešla. Editovatelné odtud zůstávají jen metody a zapnutí/vypnutí.
|
||
if existing.get("address_id"):
|
||
rule_ip = existing.get("ip_cidr") or ""
|
||
rule_description = existing.get("description") or ""
|
||
elif not rule_ip:
|
||
return redirect_app_detail(app_id, anchor="ip-access", error="IP/CIDR nesmí být prázdné.")
|
||
|
||
update_app_ip_access_rule(rule_id, app_id, rule_ip, rule_methods, rule_description, bool(is_enabled))
|
||
log_audit_event(
|
||
user,
|
||
action="app.ip_access_rule.updated",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={"rule_id": rule_id, "ip_cidr": rule_ip, "methods": rule_methods, "is_enabled": bool(is_enabled)},
|
||
)
|
||
return redirect_app_detail(app_id, anchor="ip-access", message="IP access pravidlo upraveno.")
|
||
|
||
|
||
@router.post("/apps/{app_id}/ip-access-rules/{rule_id}/delete")
|
||
def remove_app_ip_access_rule(app_id: str, rule_id: int, user=Depends(require_developer)):
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
existing = get_app_ip_access_rule(rule_id, app_id)
|
||
if not existing:
|
||
return redirect_app_detail(app_id, anchor="ip-access", error="IP access pravidlo nebylo nalezeno.")
|
||
|
||
delete_app_ip_access_rule(rule_id, app_id)
|
||
log_audit_event(
|
||
user,
|
||
action="app.ip_access_rule.deleted",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={"rule_id": rule_id, "ip_cidr": existing.get("ip_cidr"), "methods": existing.get("methods")},
|
||
)
|
||
return redirect_app_detail(app_id, anchor="ip-access", message="IP access pravidlo smazáno.")
|
||
|
||
|
||
@router.post("/apps/{app_id}/redeploy")
|
||
def redeploy_app(app_id: str, user=Depends(require_developer)):
|
||
app = get_app(app_id)
|
||
if not app:
|
||
raise HTTPException(status_code=404, detail="App not found")
|
||
|
||
try:
|
||
apply_environment_message(app_id)
|
||
except AppEnvironmentError as exc:
|
||
return redirect_app_detail(app_id, error=f"Environment apply failed: {exc}")
|
||
|
||
active_job = has_active_deploy_job("app", app_id)
|
||
if active_job:
|
||
return RedirectResponse(url=f"/portal/jobs/{active_job['id']}", status_code=303)
|
||
|
||
job_id = create_job(
|
||
job_type="deploy_app",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
payload={},
|
||
user=user,
|
||
source="portal",
|
||
)
|
||
log_audit_event(
|
||
user,
|
||
action="app.redeploy.queued",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={"job_id": job_id},
|
||
)
|
||
|
||
return RedirectResponse(url=f"/portal/jobs/{job_id}", status_code=303)
|
||
|
||
|
||
@router.get("/new-app", response_class=HTMLResponse)
|
||
def new_app_form(request: Request, user=Depends(require_developer)):
|
||
template_options = render_template_options(get_app_templates(create_enabled=True), "", include_blank=False)
|
||
return page(
|
||
"Nová služba",
|
||
f"""
|
||
<div class="card">
|
||
<h2>Vytvořit novou službu</h2>
|
||
<p class="muted">Vytvoří Gitea repozitář, webhook, lokální workspace, první commit a nasadí službu.</p>
|
||
|
||
<form method="post" action="/portal/new-app" id="new-app-form" data-ajax-form="new-app">
|
||
<p>
|
||
<label>ID služby</label><br>
|
||
<input name="app_id" placeholder="gmail-service" required
|
||
pattern="[a-z0-9]([a-z0-9\\-]*[a-z0-9])?" maxlength="{APP_ID_MAX_LENGTH}"
|
||
autocomplete="off" spellcheck="false"
|
||
title="Jen malá písmena a-z, číslice a pomlčky; musí začínat i končit písmenem nebo číslicí."><br>
|
||
<span class="muted">Jen malá písmena, číslice a pomlčky (např. gmail-service). ID se použije jako název Docker kontejneru, Gitea repozitáře a v URL — později ho nelze změnit.</span>
|
||
</p>
|
||
|
||
<p>
|
||
<label>Název služby</label><br>
|
||
<input name="app_name" placeholder="Gmail služba" required>
|
||
</p>
|
||
|
||
<p>
|
||
<label>Šablona</label><br>
|
||
<select name="template" required>{template_options}</select>
|
||
</p>
|
||
|
||
<div class="form-actions">
|
||
<button type="submit"><i class="fa-solid fa-circle-plus" aria-hidden="true"></i> Vytvořit službu</button>
|
||
<span class="form-loader" id="new-app-loader" hidden>
|
||
<span class="spinner" aria-hidden="true"></span>
|
||
Vytvářím službu...
|
||
</span>
|
||
</div>
|
||
<div class="async-status" id="new-app-status" aria-live="polite"></div>
|
||
</form>
|
||
<div id="new-app-result"></div>
|
||
|
||
<p><a href="/portal/apps">← Zpět</a></p>
|
||
</div>
|
||
""",
|
||
user=user,
|
||
)
|
||
|
||
|
||
@router.post("/new-app", response_class=HTMLResponse)
|
||
def create_app(
|
||
app_id: str = Form(...),
|
||
app_name: str = Form(...),
|
||
template: str = Form(...),
|
||
description: str = Form(""),
|
||
owner: str = Form(""),
|
||
memory: str = Form(""),
|
||
cpus: str = Form(""),
|
||
user=Depends(require_developer),
|
||
):
|
||
# Normalizace + validace ID: ID musí být vždy lowercase a splňovat omezení Dockeru,
|
||
# DNS a Gitea (viz validate_new_app_id). Bez toho by create script vytvořil kontejner
|
||
# nebo repozitář, který později nejde nasadit či adresovat.
|
||
app_id = clean_optional(app_id).lower()
|
||
app_name = clean_optional(app_name)
|
||
|
||
id_error = validate_new_app_id(app_id)
|
||
if id_error:
|
||
return HTMLResponse(id_error, status_code=400)
|
||
if not app_name:
|
||
return HTMLResponse("Název služby nesmí být prázdný.", status_code=400)
|
||
if get_app(app_id):
|
||
return HTMLResponse(f"Služba s ID '{app_id}' už existuje.", status_code=400)
|
||
|
||
selected_template = get_app_template(template, create_enabled=True)
|
||
if not selected_template:
|
||
return HTMLResponse("Nepodporovaná šablona", status_code=400)
|
||
create_script = clean_optional(selected_template.get("create_script"))
|
||
if not create_script:
|
||
return HTMLResponse("Šablona nemá nastavený create script", status_code=400)
|
||
|
||
create_result = run_command([create_script, app_id, app_name])
|
||
if create_result.returncode != 0:
|
||
log_audit_event(
|
||
user,
|
||
action="create_app",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={
|
||
"app_id": app_id,
|
||
"app_name": app_name,
|
||
"template": selected_template.get("id"),
|
||
"status": "FAILED",
|
||
"create_returncode": create_result.returncode,
|
||
},
|
||
)
|
||
return render_result(
|
||
title="Vytvoření služby: FAILED",
|
||
back_url="/portal/apps",
|
||
sections=[
|
||
("Výstup vytvoření", create_result.stdout),
|
||
("Chyba vytvoření", create_result.stderr),
|
||
],
|
||
user=user,
|
||
)
|
||
|
||
gitea_url = get_gitea_public_url()
|
||
gitea_org = read_env_value("GITEA_ORG", DEFAULT_GITEA_ORG)
|
||
repository_url = f"{gitea_url}/{gitea_org}/{app_id}.git" if gitea_url else None
|
||
owner_value = clean_optional(owner) or user.get("display_name") or user.get("username") or None
|
||
try:
|
||
upsert_created_app(
|
||
app_id,
|
||
{
|
||
"name": app_name,
|
||
"template": selected_template.get("id"),
|
||
"runtime": selected_template.get("runtime"),
|
||
"language": selected_template.get("language"),
|
||
"version": "1.0.0",
|
||
"status": "created",
|
||
"memory": clean_optional(memory),
|
||
"cpus": clean_optional(cpus),
|
||
"description": clean_optional(description),
|
||
"owner": owner_value,
|
||
"repository_name": app_id,
|
||
"repository_url": repository_url,
|
||
"default_branch": "main",
|
||
"health_url": selected_template.get("default_health_path"),
|
||
"container_port": selected_template.get("default_port"),
|
||
"is_public": True,
|
||
"is_enabled": True,
|
||
},
|
||
)
|
||
except Exception as exc:
|
||
log_audit_event(
|
||
user,
|
||
action="create_app",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={
|
||
"app_id": app_id,
|
||
"app_name": app_name,
|
||
"template": selected_template.get("id"),
|
||
"status": "FAILED",
|
||
"create_returncode": create_result.returncode,
|
||
"registration_error": str(exc),
|
||
},
|
||
)
|
||
return render_result(
|
||
title="Registrace služby: FAILED",
|
||
back_url="/portal/apps",
|
||
sections=[
|
||
("Výstup vytvoření", create_result.stdout),
|
||
("Chyba vytvoření", create_result.stderr),
|
||
("Chyba registrace", str(exc)),
|
||
],
|
||
user=user,
|
||
)
|
||
|
||
try:
|
||
apply_environment_message(app_id)
|
||
except AppEnvironmentError as exc:
|
||
log_audit_event(
|
||
user,
|
||
action="app.environment.apply_failed",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={"error": str(exc)},
|
||
)
|
||
return render_result(
|
||
title="GenerovánĂ prostĹ™edĂ: FAILED",
|
||
back_url="/portal/apps",
|
||
sections=[
|
||
("VĂ˝stup vytvoĹ™enĂ", create_result.stdout),
|
||
("Chyba vytvoĹ™enĂ", create_result.stderr),
|
||
("Chyba prostĹ™edĂ", str(exc)),
|
||
],
|
||
user=user,
|
||
)
|
||
|
||
job_id = create_job(
|
||
job_type="deploy_app",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
payload={"template": selected_template.get("id")},
|
||
user=user,
|
||
source="portal",
|
||
)
|
||
log_audit_event(
|
||
user,
|
||
action="create_app",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={
|
||
"app_id": app_id,
|
||
"app_name": app_name,
|
||
"template": selected_template.get("id"),
|
||
"status": "OK",
|
||
"create_returncode": create_result.returncode,
|
||
"job_id": job_id,
|
||
},
|
||
)
|
||
|
||
return render_result(
|
||
title="Vytvoření služby: OK",
|
||
back_url="/portal/apps",
|
||
sections=[
|
||
("Výstup vytvoření", create_result.stdout),
|
||
("Chyba vytvoření", create_result.stderr),
|
||
("Nasazení", f"Deploy job #{job_id} byl zařazen do fronty."),
|
||
],
|
||
extra_link=f"/portal/jobs/{job_id}",
|
||
extra_label="Otevřít deploy job",
|
||
user=user,
|
||
)
|
||
|
||
|
||
@router.post("/delete-app", response_class=HTMLResponse)
|
||
def delete_app(app_id: str = Form(...), user=Depends(require_admin)):
|
||
# Portál NEMAŽE workspace/container/image/gitea repo přímo – běží bez práv k workspace,
|
||
# takže rm padá na "Permission denied". Místo toho jen zařadí run_script job a mazání
|
||
# provede Worker přes delete-app.sh s právy serveru. Veškerá runtime/Docker logika patří
|
||
# do Workeru a shell skriptů, ne do portálu.
|
||
#
|
||
# KONTRAKT NÁZVU AKCE (proč dříve padalo "Invalid script name"):
|
||
# - do jobu se ukládá HOLÝ název skriptu: script_name = "delete-app.sh"
|
||
# (stejný formát jako ostatní run_script joby, viz preflight-check.sh / bootstrap-v2.sh
|
||
# a portálová validace v scheduled_scripts.validate_script_name);
|
||
# - Worker přijímá jen holý název, adresář scripts/ si doplní sám, a cokoli s cestou
|
||
# ("scripts/delete-app.sh", "../...", absolutní cesta) odmítne jako "Invalid script name".
|
||
# Job 221 padal právě proto, že se posílalo "scripts/delete-app.sh" (název s cestou).
|
||
# Stejný allowlist/validaci děláme i tady, ať portál nikdy nezaloží job, který Worker zahodí.
|
||
if not is_allowed_worker_script(DELETE_APP_SCRIPT_NAME):
|
||
return render_result(
|
||
title="Smazání služby: CHYBA",
|
||
back_url="/portal/apps",
|
||
sections=[
|
||
(
|
||
"Chyba",
|
||
f"Neplatný název skriptu pro Worker job: '{DELETE_APP_SCRIPT_NAME}'. "
|
||
"Musí to být holý povolený název bez cesty (např. 'delete-app.sh'), jinak "
|
||
"Worker job odmítne hláškou 'Invalid script name'. Job nebyl vytvořen.",
|
||
),
|
||
],
|
||
user=user,
|
||
)
|
||
|
||
payload = {
|
||
"script_name": DELETE_APP_SCRIPT_NAME,
|
||
"args": [app_id],
|
||
"arguments": [app_id],
|
||
}
|
||
job_id = create_job(
|
||
job_type="run_script",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
payload=payload,
|
||
user=user,
|
||
source="portal",
|
||
)
|
||
log_audit_event(
|
||
user,
|
||
action="delete_app",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={
|
||
"app_id": app_id,
|
||
"status": "QUEUED",
|
||
"script_name": DELETE_APP_SCRIPT_NAME,
|
||
"job_id": job_id,
|
||
},
|
||
)
|
||
|
||
# Worker zpracuje job asynchronně; pošleme uživatele rovnou na detail jobu, ať vidí
|
||
# živé logy mazání a výsledek.
|
||
return RedirectResponse(url=f"/portal/jobs/{job_id}", status_code=303)
|
||
|
||
|
||
@router.post("/update-resources", response_class=HTMLResponse)
|
||
def update_resources(
|
||
app_id: str = Form(...),
|
||
memory: str = Form(""),
|
||
cpus: str = Form(""),
|
||
user=Depends(require_developer),
|
||
):
|
||
memory = memory.strip()
|
||
cpus = cpus.strip()
|
||
|
||
update_app_resources(app_id, memory, cpus)
|
||
|
||
catalog_result = run_command(["/tools/generate-catalog.sh"])
|
||
compose_result = run_command([GENERATE_COMPOSE_SCRIPT])
|
||
deploy_result = run_command([DEPLOY_SCRIPT, app_id])
|
||
|
||
status = (
|
||
"OK"
|
||
if catalog_result.returncode == 0 and compose_result.returncode == 0 and deploy_result.returncode == 0
|
||
else "FAILED"
|
||
)
|
||
log_audit_event(
|
||
user,
|
||
action="update_resources",
|
||
target_type="app",
|
||
target_id=app_id,
|
||
metadata={
|
||
"app_id": app_id,
|
||
"memory": memory,
|
||
"cpus": cpus,
|
||
"status": status,
|
||
"catalog_returncode": catalog_result.returncode,
|
||
"compose_returncode": compose_result.returncode,
|
||
"deploy_returncode": deploy_result.returncode,
|
||
},
|
||
)
|
||
|
||
return render_result(
|
||
title=f"Úprava prostředků: {status}",
|
||
back_url="/portal/apps",
|
||
sections=[
|
||
("Výstup katalogu", catalog_result.stdout),
|
||
("Chyba katalogu", catalog_result.stderr),
|
||
("Výstup compose", compose_result.stdout),
|
||
("Chyba compose", compose_result.stderr),
|
||
("Výstup nasazení", deploy_result.stdout),
|
||
("Chyba nasazení", deploy_result.stderr),
|
||
],
|
||
user=user,
|
||
)
|