appfactory-portal/app/routes/migration_readiness.py

import html

from fastapi import APIRouter, Depends, Form, HTTPException, Request
from fastapi.responses import HTMLResponse, RedirectResponse

from app.auth import require_user
from app.config import (
    get_auth_domain_readiness,
    get_google_redirect_uri,
    get_portal_public_url,
)
from app.db.audit import log_audit_event
from app.db.jobs import create_job
from app.db.migration_readiness import (
    BOOTSTRAP_SCRIPT,
    PREFLIGHT_SCRIPT,
    get_latest_bootstrap_job,
    get_latest_preflight_job,
    summarize_readiness,
    summarize_script_run,
)
from app.routes.jobs import render_job_status
from app.templates.layout import page

router = APIRouter()
BOOTSTRAP_MODES = {"check", "repair", "deploy"}


def render_readiness_pill(ready: bool) -> str:
    if ready:
        return '<span class="pill pill-success">READY</span>'
    return '<span class="pill pill-danger">NOT READY</span>'


def render_boolean_pill(enabled: bool) -> str:
    if enabled:
        return '<span class="pill pill-success">YES</span>'
    return '<span class="pill">NO</span>'


def render_auth_domain_readiness() -> str:
    readiness = get_auth_domain_readiness()
    public_url = get_portal_public_url() or "relative/proxy mode"
    redirect_uri = get_google_redirect_uri() or "not configured"
    warning = ""

    if readiness["google_oauth_enabled"] and (
        not readiness["portal_public_url_configured"] or not readiness["google_redirect_uri_configured"]
    ):
        warning = """
            <div class="alert alert-danger">
                <strong>Google OAuth is enabled but domain readiness is incomplete.</strong>
                <p>Set APPFACTORY_PORTAL_PUBLIC_URL or APPFACTORY_ENABLE_HTTPS=true with APPFACTORY_PORTAL_DOMAIN, and make sure a Google redirect URI is available.</p>
            </div>
        """

    return f"""
        <div class="card">
            <h2>Auth & Domain Readiness</h2>
            <table>
                <tr><th>Portal public URL</th><td>{html.escape(public_url)}</td></tr>
                <tr><th>HTTPS enabled</th><td>{render_boolean_pill(readiness["https_enabled"])}</td></tr>
                <tr><th>Google OAuth enabled</th><td>{render_boolean_pill(readiness["google_oauth_enabled"])}</td></tr>
                <tr><th>Google OAuth configured</th><td>{render_boolean_pill(readiness["google_oauth_configured"])}</td></tr>
                <tr><th>Google redirect URI effective value</th><td>{html.escape(redirect_uri)}</td></tr>
            </table>
            {warning}
        </div>
    """


def render_script_result(title: str, script_name: str, summary: dict) -> str:
    job = summary.get("job")
    job_rows = f'<tr><td colspan="2">Zatím není uložený žádný výsledek skriptu {html.escape(script_name)}.</td></tr>'
    if job:
        job_id = html.escape(str(job.get("id", "")))
        return_code = summary.get("return_code")
        return_code_label = "" if return_code is None else html.escape(str(return_code))
        job_rows = f"""
            <tr><th>Úloha</th><td><a href="/portal/jobs/{job_id}">#{job_id}</a></td></tr>
            <tr><th>Status</th><td>{render_job_status(job.get("status"))}</td></tr>
            <tr><th>Return code</th><td>{return_code_label}</td></tr>
            <tr><th>Started at</th><td>{html.escape(job.get("started_at", "") or "")}</td></tr>
            <tr><th>Finished at</th><td>{html.escape(job.get("finished_at", "") or "")}</td></tr>
        """

    stdout = html.escape(summary.get("stdout") or "Zatím není uložený žádný stdout log.")
    stderr = html.escape(summary.get("stderr") or "Zatím není uložený žádný stderr log.")

    return f"""
        <div class="card">
            <h2>{html.escape(title)}</h2>
            <p class="muted">Poslední výsledek maintenance skriptu {html.escape(script_name)} uložený v databázi.</p>
            <table>
                {job_rows}
            </table>
        </div>

        <div class="grid">
            <div class="card">
                <h2>Raw stdout log</h2>
                <pre class="log-viewer log-stdout">{stdout}</pre>
            </div>
            <div class="card">
                <h2>Raw stderr log</h2>
                <pre class="log-viewer log-stderr">{stderr}</pre>
            </div>
        </div>
    """


@router.get("/migration-readiness/auth-domain-config")
def auth_domain_readiness_config(user=Depends(require_user)):
    return get_auth_domain_readiness()


@router.get("/migration-readiness", response_class=HTMLResponse)
def migration_readiness_page(request: Request, user=Depends(require_user)):
    latest_job = get_latest_preflight_job()
    summary = summarize_readiness(latest_job)
    bootstrap_summary = summarize_script_run(get_latest_bootstrap_job())
    job = summary["job"]

    log_audit_event(
        user,
        action="migration_readiness.viewed",
        target_type="migration_readiness",
        target_id=PREFLIGHT_SCRIPT,
        metadata={"job_id": job.get("id") if job else None},
    )
    log_audit_event(
        user,
        action="auth_domain_readiness.viewed",
        target_type="auth_domain_readiness",
        metadata=get_auth_domain_readiness(),
    )

    job_rows = '<tr><td colspan="2">Zatím není uložený žádný výsledek preflight kontroly.</td></tr>'
    if job:
        job_id = html.escape(str(job.get("id", "")))
        return_code = summary.get("return_code")
        return_code_label = "" if return_code is None else html.escape(str(return_code))
        job_rows = f"""
            <tr><th>Úloha</th><td><a href="/portal/jobs/{job_id}">#{job_id}</a></td></tr>
            <tr><th>Stav úlohy</th><td>{render_job_status(job.get("status"))}</td></tr>
            <tr><th>Return code</th><td>{return_code_label}</td></tr>
            <tr><th>Vytvořeno</th><td>{html.escape(job.get("created_at", "") or "")}</td></tr>
            <tr><th>Spuštěno</th><td>{html.escape(job.get("started_at", "") or "")}</td></tr>
            <tr><th>Dokončeno</th><td>{html.escape(job.get("finished_at", "") or "")}</td></tr>
            <tr><th>Worker</th><td>{html.escape(job.get("worker_id", "") or "")}</td></tr>
        """

    stdout = html.escape(summary.get("stdout") or "Zatím není uložený žádný stdout log.")
    stderr = html.escape(summary.get("stderr") or "Zatím není uložený žádný stderr log.")

    return page(
        "Migration Readiness",
        f"""
        <div class="card">
            <h2><i class="fa-solid fa-diagram-project" aria-hidden="true"></i> Migration Readiness</h2>
            <p class="muted">Poslední výsledek maintenance skriptu {html.escape(PREFLIGHT_SCRIPT)} uložený v databázi. Stav READY / NOT READY vychází pouze z return code jobu.</p>
            <div class="inline-form">
                <form method="post" action="/portal/migration-readiness/run">
                    <button type="submit"><i class="fa-solid fa-play" aria-hidden="true"></i> Spustit preflight kontrolu</button>
                </form>
                <form method="post" action="/portal/migration-readiness/bootstrap">
                    <input type="hidden" name="mode" value="check">
                    <button type="submit" class="btn-secondary"><i class="fa-solid fa-clipboard-check" aria-hidden="true"></i> Run Bootstrap Check</button>
                </form>
                <form method="post" action="/portal/migration-readiness/bootstrap" onsubmit="return confirm('Spustit Bootstrap v2 repair? Tato akce opravuje práva přes maintenance job.');">
                    <input type="hidden" name="mode" value="repair">
                    <button type="submit" class="btn-secondary"><i class="fa-solid fa-screwdriver-wrench" aria-hidden="true"></i> Run Bootstrap Repair</button>
                </form>
            </div>
        </div>

        <div class="alert">
            <strong>Bootstrap v2 má explicitní režimy.</strong>
            <ul>
                <li><strong>check</strong> bezpečně ověřuje stav bez oprav.</li>
                <li><strong>repair</strong> opravuje ownership /opt/appfactory a nastavuje executable práva pro maintenance a alert skripty.</li>
                <li><strong>deploy</strong> provádí plný bootstrap včetně deploy core services a spuštění preflight-check.sh.</li>
            </ul>
            <p>Portál bootstrap nespouští přímo přes shell. Pouze založí maintenance job pro {html.escape(BOOTSTRAP_SCRIPT)}.</p>
        </div>

        <div class="alert alert-danger">
            <strong>Plný Bootstrap Deploy není výchozí akce.</strong>
            <p>Režim deploy deployuje core services a může změnit stav systému. Spouštějte ho jen po kontrole dopadu.</p>
            <form method="post" action="/portal/migration-readiness/bootstrap" onsubmit="return confirm('Spustit plný Bootstrap v2 deploy? Tato akce deployuje core services přes maintenance job.');">
                <input type="hidden" name="mode" value="deploy">
                <button type="submit" class="danger"><i class="fa-solid fa-rocket" aria-hidden="true"></i> Run Bootstrap Deploy</button>
            </form>
        </div>

        <div class="stats-grid">
            <div class="stat-card {"stat-success" if summary["ready"] else "stat-danger"}"><span>Stav</span><strong>{render_readiness_pill(summary["ready"])}</strong></div>
            <div class="stat-card stat-success"><span>OK</span><strong>{html.escape(str(summary["ok_count"]))}</strong></div>
            <div class="stat-card stat-warning"><span>WARN</span><strong>{html.escape(str(summary["warn_count"]))}</strong></div>
            <div class="stat-card stat-danger"><span>FAIL</span><strong>{html.escape(str(summary["fail_count"]))}</strong></div>
        </div>

        {render_auth_domain_readiness()}

        <div class="card">
            <h2>Poslední preflight úloha</h2>
            <table>
                {job_rows}
            </table>
        </div>

        <div class="grid">
            <div class="card">
                <h2>Raw preflight stdout</h2>
                <pre class="log-viewer log-stdout">{stdout}</pre>
            </div>
            <div class="card">
                <h2>Raw preflight stderr</h2>
                <pre class="log-viewer log-stderr">{stderr}</pre>
            </div>
        </div>

        {render_script_result("Poslední výsledek Bootstrap v2", BOOTSTRAP_SCRIPT, bootstrap_summary)}
        """,
        user=user,
    )


@router.post("/migration-readiness/run")
def run_migration_readiness(user=Depends(require_user)):
    job_id = create_job(
        job_type="run_script",
        target_type="maintenance_script",
        target_id=PREFLIGHT_SCRIPT,
        payload={"script_name": PREFLIGHT_SCRIPT},
        user=user,
        source="portal_manual",
    )
    return RedirectResponse(url=f"/portal/jobs/{job_id}", status_code=303)


@router.post("/migration-readiness/bootstrap")
def run_bootstrap_v2(mode: str = Form(...), user=Depends(require_user)):
    mode = (mode or "").strip().lower()
    if mode not in BOOTSTRAP_MODES:
        raise HTTPException(status_code=400, detail="Neplatný režim bootstrapu")

    job_id = create_job(
        job_type="run_script",
        target_type="maintenance_script",
        target_id=BOOTSTRAP_SCRIPT,
        payload={
            "script_name": BOOTSTRAP_SCRIPT,
            "args": [mode],
            "arguments": [mode],
            "mode": mode,
        },
        user=user,
        source="portal_manual",
    )
    return RedirectResponse(url=f"/portal/jobs/{job_id}", status_code=303)