allowlist.py

"""
Allowlisted Operations - Pre-approved helper functions.

These are deterministic, safe operations that Claude can call directly.
They run on host (not sandboxed) because they need SSH access, but
they're explicitly defined and bounded.
"""

import asyncio
import re
import subprocess
import logging

from .config import SSH_CONFIG, SSH_HOST, INDEXER_NETWORKS

log = logging.getLogger(__name__)


async def check_indexer_status(network: str = None) -> tuple[bool, str]:
    """
    Check the status of indexer services on EC2.

    This is an ALLOWLISTED operation - deterministic and bounded.

    Args:
        network: Specific network to check (mainnet, shadownet, base-sepolia)
                 If None, checks all networks.

    Returns (success, status_report)
    """
    if network and network not in INDEXER_NETWORKS:
        return False, f"Unknown network: {network}. Valid: {', '.join(INDEXER_NETWORKS)}"

    networks_to_check = [network] if network else INDEXER_NETWORKS

    results = []
    for net in networks_to_check:
        cmd = f'ssh -F "{SSH_CONFIG}" {SSH_HOST} "sudo systemctl status indexer@{net} --no-pager -l"'

        try:
            result = subprocess.run(
                cmd,
                shell=True,
                capture_output=True,
                text=True,
                timeout=30
            )

            # Parse the output for key info
            output = result.stdout + result.stderr

            # Check if service is active
            if "Active: active (running)" in output:
                status = "🟢 Running"
            elif "Active: inactive" in output or "Active: dead" in output:
                status = "🔴 Stopped"
            elif "Active: failed" in output:
                status = "🔴 Failed"
            elif "could not be found" in output:
                status = "⚪ Not installed"
            else:
                status = "🟡 Unknown"

            # Get uptime if running
            uptime = ""
            if "Active: active" in output:
                match = re.search(r'Active:.*since (.+?);', output)
                if match:
                    uptime = f" (since {match.group(1).strip()})"

            results.append(f"**indexer@{net}**: {status}{uptime}")

        except subprocess.TimeoutExpired:
            results.append(f"**indexer@{net}**: ⚠️ Timeout connecting to EC2")
        except Exception as e:
            results.append(f"**indexer@{net}**: ⚠️ Error: {str(e)[:50]}")

    return True, "\n".join(results)


async def get_indexer_logs(network: str, lines: int = 50) -> tuple[bool, str]:
    """
    Get recent logs from an indexer service.

    This is an ALLOWLISTED operation - deterministic and bounded.

    Args:
        network: Network to get logs for (mainnet, shadownet, base-sepolia)
        lines: Number of log lines to retrieve (max 100)

    Returns (success, logs)
    """
    if network not in INDEXER_NETWORKS:
        return False, f"Unknown network: {network}. Valid: {', '.join(INDEXER_NETWORKS)}"

    lines = min(lines, 100)  # Cap at 100 lines

    cmd = f'ssh -F "{SSH_CONFIG}" {SSH_HOST} "sudo journalctl -u indexer@{network} -n {lines} --no-pager"'

    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,
            text=True,
            timeout=30
        )

        output = result.stdout or result.stderr

        # Truncate if too long for Discord
        if len(output) > 1800:
            output = output[-1800:] + "\n... (truncated)"

        return True, f"```\n{output}\n```"

    except subprocess.TimeoutExpired:
        return False, "Timeout connecting to EC2"
    except Exception as e:
        return False, f"Error: {str(e)[:100]}"


async def restart_indexer(network: str) -> tuple[bool, str]:
    """
    Restart an indexer service.

    This is an ALLOWLISTED operation - deterministic and bounded.

    Args:
        network: Network to restart (mainnet, shadownet, base-sepolia)

    Returns (success, result_message)
    """
    if network not in INDEXER_NETWORKS:
        return False, f"Unknown network: {network}. Valid: {', '.join(INDEXER_NETWORKS)}"

    cmd = f'ssh -F "{SSH_CONFIG}" {SSH_HOST} "sudo systemctl restart indexer@{network}"'

    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,
            text=True,
            timeout=60
        )

        if result.returncode == 0:
            # Verify it's running
            await asyncio.sleep(2)  # Give it a moment to start
            success, status = await check_indexer_status(network)
            return True, f"Restarted indexer@{network}\n{status}"
        else:
            return False, f"Restart failed: {result.stderr[:200]}"

    except subprocess.TimeoutExpired:
        return False, "Timeout during restart"
    except Exception as e:
        return False, f"Error: {str(e)[:100]}"