ThothII/backend/src/catalog/runtime-binding.ts

import { dirname } from "node:path";

import { resolveRuntimeBindings, type RuntimeBindings } from "../workspaces/bindings.js";
import { buildInstallationContract, type InstallationSuffix } from "../workspaces/contracts.js";
import {
  discoverWorkspaceSecretRequirements,
} from "../workspaces/secret-requirements.js";
import type {
  WorkspaceSecretMaterialization,
  WorkspaceSecretStore,
} from "../workspaces/secret-store.js";
import {
  validateWorkspaceDescriptor,
  type WorkspaceDescriptor,
} from "../workspaces/schema.js";
import { CATALOG_SECRET_IDS } from "./secrets.js";
import type { WorkspaceDatabase } from "./types.js";

export interface CatalogRuntimeBindingLease {
  workspace: WorkspaceDescriptor;
  bindings: RuntimeBindings;
  release(): void;
}

const CATALOG_SECRET_BY_SUFFIX: Readonly<Partial<Record<InstallationSuffix, string>>> = {
  PASSWORD_FILE: CATALOG_SECRET_IDS.password,
  API_KEY_FILE: CATALOG_SECRET_IDS.apiKey,
  TLS_CA_FILE: CATALOG_SECRET_IDS.tlsCa,
  SSH_PRIVATE_KEY_FILE: CATALOG_SECRET_IDS.sshPrivateKey,
  SSH_KNOWN_HOSTS_FILE: CATALOG_SECRET_IDS.sshKnownHosts,
};

function runtimeWorkspace(
  workspace: WorkspaceDescriptor,
  database: WorkspaceDatabase,
): WorkspaceDescriptor {
  if (workspace.workspace.id !== database.workspaceId) {
    throw new Error("Catalog database binding does not belong to the workspace");
  }
  const { dwh: _legacyDwh, diagnostics: _legacyDiagnostics, ...descriptor } = workspace;
  const binding = database.binding;
  return validateWorkspaceDescriptor({
    ...descriptor,
    dwh: {
      engine: "postgres",
      database: database.databaseName,
      schema: database.schema,
      ...(binding.port === undefined ? {} : { port: binding.port }),
      supported_transports: [binding.transport],
    },
    ...(binding.transport === "rest_api" ? {
      diagnostics: {
        dwh_rest: {
          method: "GET",
          path: binding.restPath ?? "/health",
          auth: binding.restAuth ?? "bearer",
          response: { database: "database", schema: "schema" },
        },
      },
    } : {}),
  });
}

function setIfDefined(
  environment: NodeJS.ProcessEnv,
  name: string | undefined,
  value: string | number | undefined,
): void {
  if (name !== undefined && value !== undefined && value !== "") environment[name] = String(value);
}

/**
 * Project one PostgreSQL Catalog row into the legacy-shaped configuration consumed by the
 * Python runtime. The authored workspace remains database-free; this object exists only for
 * the lifetime of a backend-owned runtime lease.
 */
export function resolveCatalogRuntimeBinding(options: {
  workspace: WorkspaceDescriptor;
  database: WorkspaceDatabase;
  environment: NodeJS.ProcessEnv;
  secretRoots: readonly string[];
  secretStore: WorkspaceSecretStore;
}): CatalogRuntimeBindingLease {
  const workspace = runtimeWorkspace(options.workspace, options.database);
  const evidenceRequirements = discoverWorkspaceSecretRequirements(
    options.workspace,
    options.environment,
  ).filter(({ connector }) => connector === "evidence");
  const catalogSecretIds = Object.values(CATALOG_SECRET_IDS);
  let materialization: WorkspaceSecretMaterialization | undefined;
  try {
    materialization = options.secretStore.materialize(
      options.database.workspaceId,
      [...catalogSecretIds, ...evidenceRequirements.map(({ id }) => id)],
    );
    const environment: NodeJS.ProcessEnv = { ...options.environment };
    const roots = new Set(options.secretRoots);
    for (const path of materialization.files.values()) roots.add(dirname(path));

    const variables = buildInstallationContract(workspace).variables;
    const variable = (role: "DWH" | "EVIDENCE", suffix: InstallationSuffix) => (
      variables.find((candidate) => candidate.role === role && candidate.suffix === suffix)?.name
    );
    const binding = options.database.binding;
    setIfDefined(environment, variable("DWH", "TRANSPORT"), binding.transport);
    setIfDefined(environment, variable("DWH", "HOST"), binding.host);
    setIfDefined(environment, variable("DWH", "PORT"), binding.port);
    setIfDefined(environment, variable("DWH", "BASE_URL"), binding.baseUrl);
    setIfDefined(environment, variable("DWH", "USER"), binding.username);
    setIfDefined(environment, variable("DWH", "SSH_HOST"), binding.sshHost);
    setIfDefined(environment, variable("DWH", "SSH_PORT"), binding.sshPort);
    setIfDefined(environment, variable("DWH", "SSH_USER"), binding.sshUsername);
    setIfDefined(environment, variable("DWH", "SSH_TARGET_HOST"), binding.sshTargetHost);
    setIfDefined(environment, variable("DWH", "SSH_TARGET_PORT"), binding.sshTargetPort);
    for (const [suffix, secretId] of Object.entries(CATALOG_SECRET_BY_SUFFIX) as Array<[
      InstallationSuffix,
      string,
    ]>) {
      setIfDefined(environment, variable("DWH", suffix), materialization.files.get(secretId));
    }
    for (const requirement of evidenceRequirements) {
      setIfDefined(environment, requirement.variable, materialization.files.get(requirement.id));
    }

    const bindings = resolveRuntimeBindings(workspace, environment, [...roots]);
    let released = false;
    return {
      workspace,
      bindings,
      release: () => {
        if (released) return;
        released = true;
        materialization?.release();
      },
    };
  } catch (error) {
    materialization?.release();
    throw error;
  }
}