This file is a merged representation of the entire codebase, combined into a single document by Repomix.

<file_summary>
This section contains a summary of this file.

<purpose>
This file contains a packed representation of the entire repository's contents.
It is designed to be easily consumable by AI systems for analysis, code review,
or other automated processes.
</purpose>

<file_format>
The content is organized as follows:
1. This summary section
2. Repository information
3. Directory structure
4. Repository files (if enabled)
5. Multiple file entries, each consisting of:
  - File path as an attribute
  - Full contents of the file
</file_format>

<usage_guidelines>
- This file should be treated as read-only. Any changes should be made to the
  original repository files, not this packed version.
- When processing this file, use the file path to distinguish
  between different files in the repository.
- Be aware that this file may contain sensitive information. Handle it with
  the same level of security as you would the original repository.
</usage_guidelines>

<notes>
- Some files may have been excluded based on .gitignore rules and Repomix's configuration
- Binary files are not included in this packed representation. Please refer to the Repository Structure section for a complete list of file paths, including binary files
- Files matching patterns in .gitignore are excluded
- Files matching default ignore patterns are excluded
- Files are sorted by Git change count (files with more changes are at the bottom)
</notes>

</file_summary>

<directory_structure>
.github/
  configs/
    labeler.yml
  workflows/
    docker-publish.yml
  release.yml
cmd/
  db.go
  encryption.go
  keys_generate.go
  root.go
  serve.go
  version.go
internal/
  api/
    httpmiddleware/
      auth.go
      context.go
      platform_admin.go
      rbac.go
    mount_admin_routes.go
    mount_annotation_routes.go
    mount_api_routes.go
    mount_auth_routes.go
    mount_cluster_routes.go
    mount_credential_routes.go
    mount_db_studio.go
    mount_dns_routes.go
    mount_label_routes.go
    mount_load_balancer_routes.go
    mount_me_routes.go
    mount_meta_routes.go
    mount_node_pool_routes.go
    mount_org_routes.go
    mount_pprof_routes.go
    mount_server_routes.go
    mount_ssh_routes.go
    mount_swagger_routes.go
    mount_taint_routes.go
    mw_logger.go
    mw_security.go
    routes.go
    utils.go
  app/
    runtime.go
  auth/
    hash.go
    issue.go
    jwks_export.go
    jwt_issue.go
    jwt_signer.go
    jwt_validate.go
    refresh.go
    validate_keys.go
  bg/
    archer_cleanup.go
    backup_s3.go
    bastion.go
    bg.go
    cluster_action.go
    cluster_bootstrap.go
    cluster_setup.go
    dns.go
    org_key_sweeper.go
    prepare_cluster.go
    tokens_cleanup.go
  common/
    audit.go
  config/
    config.go
  db/
    db.go
    migrate.go
  handlers/
    dto/
      actions.go
      annotations.go
      auth.go
      cluster_runs.go
      clusters.go
      credentials.go
      dns.go
      jobs.go
      jwks.go
      labels.go
      load_balancers.go
      node_pools.go
      servers.go
      ssh_keys.go
      taints.go
    actions.go
    annotations.go
    auth.go
    cluster_runs.go
    clusters.go
    credentials.go
    dns.go
    health.go
    jobs.go
    jwks.go
    labels.go
    load_balancers.go
    me_keys.go
    me.go
    node_pools_test.go
    node_pools.go
    orgs.go
    servers_test.go
    servers.go
    ssh_keys.go
    taints.go
    version.go
  keys/
    base64util.go
    export.go
    keys.go
  mapper/
    cluster.go
  models/
    account.go
    action.go
    annotation.go
    api_key.go
    backup.go
    cluster_runs.go
    cluster.go
    credential.go
    domain.go
    job.go
    label.go
    load_balancer.go
    master_key.go
    membership.go
    node_pool.go
    organization-key.go
    organization.go
    refresh_token.go
    server.go
    signing_key.go
    ssh-key.go
    taint.go
    user_email.go
    user.go
  testutil/
    pgtest/
      pgtest.go
  utils/
    crypto.go
    helpers.go
    keys.go
    org-crypto.go
  version/
    version.go
  web/
    devproxy.go
    static.go
ui/
  public/
    vite.svg
  src/
    api/
      actions.ts
      annotations.ts
      archer_admin.ts
      clusters.ts
      credentials.ts
      dns.ts
      footer.ts
      labels.ts
      loadbalancers.ts
      me.ts
      node_pools.ts
      servers.ts
      ssh.ts
      taints.ts
      with-refresh.ts
    auth/
      logout.ts
      org.ts
      store.ts
    components/
      ui/
        accordion.tsx
        alert-dialog.tsx
        alert.tsx
        aspect-ratio.tsx
        avatar.tsx
        badge.tsx
        breadcrumb.tsx
        button-group.tsx
        button.tsx
        calendar.tsx
        card.tsx
        carousel.tsx
        chart.tsx
        checkbox.tsx
        collapsible.tsx
        command.tsx
        context-menu.tsx
        dialog.tsx
        drawer.tsx
        dropdown-menu.tsx
        empty.tsx
        field.tsx
        form.tsx
        hover-card.tsx
        input-group.tsx
        input-otp.tsx
        input.tsx
        item.tsx
        kbd.tsx
        label.tsx
        menubar.tsx
        navigation-menu.tsx
        pagination.tsx
        popover.tsx
        progress.tsx
        radio-group.tsx
        resizable.tsx
        scroll-area.tsx
        select.tsx
        separator.tsx
        sheet.tsx
        sidebar.tsx
        skeleton.tsx
        slider.tsx
        sonner.tsx
        spinner.tsx
        switch.tsx
        table.tsx
        tabs.tsx
        textarea.tsx
        toggle-group.tsx
        toggle.tsx
        tooltip.tsx
      protected-route.tsx
    hooks/
      use-auth-actions.ts
      use-auth.ts
      use-me.ts
      use-mobile.ts
    layouts/
      app-shell.tsx
      footer.tsx
      nav-config.ts
      org-switcher.tsx
      theme-switcher.tsx
      topbar.tsx
    lib/
      utils.ts
    pages/
      org/
        api-keys.tsx
        members.tsx
        settings.tsx
      actions-page.tsx
      annotation-page.tsx
      cluster-page.tsx
      credential-page.tsx
      dns-page.tsx
      docs-page.tsx
      jobs-page.tsx
      labels-page.tsx
      load-balancers-page.tsx
      login.tsx
      me-page.tsx
      node-pools-page.tsx
      server-page.tsx
      ssh-page.tsx
      taints-page.tsx
    providers/
      index.tsx
      theme-provider.tsx
    types/
      rapidoc.d.ts
    App.tsx
    index.css
    main.tsx
    sdkClient.ts
  .gitignore
  .prettierignore
  .prettierrc.json
  components.json
  eslint.config.js
  index.html
  package.json
  README.md
  tsconfig.app.json
  tsconfig.json
  tsconfig.node.json
  tsconfig.tsbuildinfo
  vite.config.ts
.dockerignore
.env.example
.gitignore
.semgrep.yml
agents.md
Archive.zip
docker-compose.yml
Dockerfile
go.mod
main.go
Makefile
README.md
ui.zip
</directory_structure>

<files>
This section contains the contents of the repository's files.

<file path=".github/configs/labeler.yml">
####
## This is managed via https://github.com/internal-GlueOps/github-shared-files-sync . Any changes to this file may be overridden by our automation
####

include-in-release-notes:
  - changed-files:
      - any-glob-to-any-file: '**'
</file>

<file path=".github/release.yml">
####
## This is managed via https://github.com/internal-GlueOps/github-shared-files-sync . Any changes to this file may be overridden by our automation
####

changelog:
  exclude:
    labels:
      - 'ignore'
    # authors:
    #   - 'glueops-terraform-svc-account'
    #   - 'glueops-svc-account'
    #   - 'glueops-renovatebot'
  categories:
    - title: Breaking Changes 🛠
      labels:
        - 'major'
        - 'breaking-change'
    - title: Enhancements 🎉
      labels:
        - 'minor'
        - 'enhancement'
        - 'new-feature'
    - title: Other 🐛
      labels:
        - 'auto-update'
        - 'patch'
        - 'fix'
        - 'bugfix'
        - 'bug'
        - 'hotfix'
        - 'dependencies'
        - 'include-in-release-notes'
</file>

<file path="cmd/db.go">
package cmd

import (
	"context"
	"errors"
	"fmt"
	"os"
	"os/exec"
	"runtime"
	"time"

	"github.com/glueops/autoglue/internal/config"
	"github.com/spf13/cobra"
)

var dbCmd = &cobra.Command{
	Use:   "db",
	Short: "Database utilities",
}

var dbPsqlCmd = &cobra.Command{
	Use:   "psql",
	Short: "Open a psql session to the app database",
	RunE: func(cmd *cobra.Command, args []string) error {
		cfg, err := config.Load()
		if err != nil {
			return err
		}
		if cfg.DbURL == "" {
			return errors.New("database.url is empty")
		}
		psql := "psql"
		if runtime.GOOS == "windows" {
			psql = "psql.exe"
		}

		ctx, cancel := context.WithTimeout(context.Background(), 72*time.Hour)
		defer cancel()

		psqlCmd := exec.CommandContext(ctx, psql, cfg.DbURL)
		psqlCmd.Stdin, psqlCmd.Stdout, psqlCmd.Stderr = os.Stdin, os.Stdout, os.Stderr
		fmt.Println("Launching psql…")
		return psqlCmd.Run()
	},
}

func init() {
	dbCmd.AddCommand(dbPsqlCmd)

	rootCmd.AddCommand(dbCmd)
}
</file>

<file path="cmd/encryption.go">
package cmd

import (
	"crypto/rand"
	"encoding/base64"
	"fmt"
	"io"

	"github.com/glueops/autoglue/internal/app"
	"github.com/glueops/autoglue/internal/models"
	"github.com/spf13/cobra"
)

var rotateMasterCmd = &cobra.Command{
	Use:   "rotate-master",
	Short: "Generate and activate a new master encryption key",
	Args:  cobra.NoArgs,
	RunE: func(cmd *cobra.Command, args []string) error {
		rt := app.NewRuntime()
		db := rt.DB

		key := make([]byte, 32)
		if _, err := io.ReadFull(rand.Reader, key); err != nil {
			return fmt.Errorf("generating random key: %w", err)
		}

		encoded := base64.StdEncoding.EncodeToString(key)

		if err := db.Model(&models.MasterKey{}).
			Where("is_active = ?", true).
			Update("is_active", false).Error; err != nil {
			return fmt.Errorf("deactivating previous key: %w", err)
		}

		if err := db.Create(&models.MasterKey{
			Key:      encoded,
			IsActive: true,
		}).Error; err != nil {
			return fmt.Errorf("creating new master key: %w", err)
		}

		fmt.Println("Master key rotated successfully")
		return nil
	},
}

var createMasterCmd = &cobra.Command{
	Use:   "create-master",
	Short: "Generate and activate a new master encryption key",
	Args:  cobra.NoArgs,
	RunE: func(cmd *cobra.Command, args []string) error {
		rt := app.NewRuntime()
		db := rt.DB
		key := make([]byte, 32)
		if _, err := io.ReadFull(rand.Reader, key); err != nil {
			return fmt.Errorf("generating random key: %w", err)
		}

		encoded := base64.StdEncoding.EncodeToString(key)

		if err := db.Create(&models.MasterKey{
			Key:      encoded,
			IsActive: true,
		}).Error; err != nil {
			return fmt.Errorf("creating master key: %w", err)
		}

		fmt.Println("Master key created successfully")
		return nil
	},
}

var encryptCmd = &cobra.Command{
	Use:   "encrypt",
	Short: "Manage autoglue encryption keys",
	Long:  "Manage autoglue master encryption keys used for securing data.",
}

func init() {
	encryptCmd.AddCommand(rotateMasterCmd)
	encryptCmd.AddCommand(createMasterCmd)
	rootCmd.AddCommand(encryptCmd)
}
</file>

<file path="cmd/keys_generate.go">
package cmd

import (
	"fmt"
	"time"

	"github.com/glueops/autoglue/internal/app"
	"github.com/glueops/autoglue/internal/keys"
	"github.com/spf13/cobra"
)

var (
	alg     string
	rsaBits int
	kidFlag string
	nbfStr  string
	expStr  string
)

var keysCmd = &cobra.Command{
	Use:   "keys",
	Short: "Manage JWT signing keys",
}

var keysGenCmd = &cobra.Command{
	Use:   "generate",
	Short: "Generate and store a new signing key",
	RunE: func(_ *cobra.Command, _ []string) error {
		rt := app.NewRuntime()

		var nbfPtr, expPtr *time.Time
		if nbfStr != "" {
			t, err := time.Parse(time.RFC3339, nbfStr)
			if err != nil {
				return err
			}
			nbfPtr = &t
		}
		if expStr != "" {
			t, err := time.Parse(time.RFC3339, expStr)
			if err != nil {
				return err
			}
			expPtr = &t
		}

		rec, err := keys.GenerateAndStore(rt.DB, rt.Cfg.JWTPrivateEncKey, keys.GenOpts{
			Alg:  alg,
			Bits: rsaBits,
			KID:  kidFlag,
			NBF:  nbfPtr,
			EXP:  expPtr,
		})
		if err != nil {
			return err
		}

		fmt.Printf("created signing key\n")
		fmt.Printf("  kid: %s\n", rec.Kid)
		fmt.Printf("  alg: %s\n", rec.Alg)
		fmt.Printf("  active: %v\n", rec.IsActive)
		if rec.NotBefore != nil {
			fmt.Printf("  nbf: %s\n", rec.NotBefore.Format(time.RFC3339))
		}
		if rec.ExpiresAt != nil {
			fmt.Printf("  exp: %s\n", rec.ExpiresAt.Format(time.RFC3339))
		}
		return nil
	},
}

func init() {
	rootCmd.AddCommand(keysCmd)
	keysCmd.AddCommand(keysGenCmd)

	keysGenCmd.Flags().StringVarP(&alg, "alg", "a", "EdDSA", "Signing alg: EdDSA|RS256|RS384|RS512")
	keysGenCmd.Flags().IntVarP(&rsaBits, "bits", "b", 3072, "RSA key size (when alg is RS*)")
	keysGenCmd.Flags().StringVarP(&kidFlag, "kid", "k", "", "Key ID (optional; auto if empty)")
	keysGenCmd.Flags().StringVarP(&nbfStr, "nbf", "n", "", "Not Before (RFC3339)")
	keysGenCmd.Flags().StringVarP(&expStr, "exp", "e", "", "Expires At (RFC3339)")
}
</file>

<file path="cmd/root.go">
package cmd

import (
	"log"

	"github.com/spf13/cobra"
)

var rootCmd = &cobra.Command{
	Use:   "autoglue",
	Short: "Autoglue Kubernetes Cluster Management",
	Long:  "autoglue is used to manage the lifecycle of kubernetes clusters on GlueOps supported cloud providers",
	Run: func(cmd *cobra.Command, args []string) {
		if len(args) == 0 {
			err := serveCmd.RunE(cmd, args)
			if err != nil {
				log.Fatal(err)
			}
		} else {
			_ = cmd.Help()
		}
	},
}

func Execute() {
	if err := rootCmd.Execute(); err != nil {
		log.Fatal(err)
	}
}

func init() {
	cobra.OnInitialize()
}
</file>

<file path="cmd/serve.go">
package cmd

import (
	"context"
	"errors"
	"fmt"
	"log"
	"net/http"
	"os"
	"os/signal"
	"strings"
	"syscall"
	"time"

	"github.com/dyaksa/archer"
	"github.com/glueops/autoglue/internal/api"
	"github.com/glueops/autoglue/internal/app"
	"github.com/glueops/autoglue/internal/auth"
	"github.com/glueops/autoglue/internal/bg"
	"github.com/glueops/autoglue/internal/config"
	"github.com/glueops/autoglue/internal/models"
	"github.com/google/uuid"
	"github.com/spf13/cobra"
)

var serveCmd = &cobra.Command{
	Use:   "serve",
	Short: "Start API server",
	RunE: func(_ *cobra.Command, _ []string) error {
		rt := app.NewRuntime()

		cfg, err := config.Load()
		if err != nil {
			return err
		}

		jobs, err := bg.NewJobs(rt.DB, cfg.DbURL)
		if err != nil {
			log.Fatalf("failed to init background jobs: %v", err)
		}

		rt.DB.Where("status IN ?", []string{"scheduled", "queued", "pending"}).Delete(&models.Job{})

		// Start workers in background ONCE
		go func() {
			if err := jobs.Start(); err != nil {
				log.Fatalf("failed to start background jobs: %v", err)
			}
		}()
		defer jobs.Stop()

		// daily cleanups
		{
			// schedule next 03:30 local time
			next := time.Now().Truncate(24 * time.Hour).Add(24 * time.Hour).Add(3*time.Hour + 30*time.Minute)
			_, err = jobs.Enqueue(
				context.Background(),
				uuid.NewString(),
				"archer_cleanup",
				bg.CleanupArgs{RetainDays: 7, Table: "jobs"},
				archer.WithScheduleTime(next),
				archer.WithMaxRetries(1),
			)
			if err != nil {
				log.Fatalf("failed to enqueue archer cleanup job: %v", err)
			}

			// schedule next 03:45 local time
			next2 := time.Now().Truncate(24 * time.Hour).Add(24 * time.Hour).Add(3*time.Hour + 45*time.Minute)
			_, err = jobs.Enqueue(
				context.Background(),
				uuid.NewString(),
				"tokens_cleanup",
				bg.TokensCleanupArgs{},
				archer.WithScheduleTime(next2),
				archer.WithMaxRetries(1),
			)
			if err != nil {
				log.Fatalf("failed to enqueue token cleanup job: %v", err)
			}

			_, err = jobs.Enqueue(
				context.Background(),
				uuid.NewString(),
				"db_backup_s3",
				bg.DbBackupArgs{IntervalS: 3600},
				archer.WithMaxRetries(1),
				archer.WithScheduleTime(time.Now().Add(1*time.Hour)),
			)
			if err != nil {
				log.Fatalf("failed to enqueue backup jobs: %v", err)
			}

			_, err = jobs.Enqueue(
				context.Background(),
				uuid.NewString(),
				"dns_reconcile",
				bg.DNSReconcileArgs{MaxDomains: 25, MaxRecords: 100, IntervalS: 10},
				archer.WithScheduleTime(time.Now().Add(5*time.Second)),
				archer.WithMaxRetries(1),
			)
			if err != nil {
				log.Fatalf("failed to enqueue dns reconcile: %v", err)
			}

			_, err := jobs.Enqueue(
				context.Background(),
				uuid.NewString(),
				"bootstrap_bastion",
				bg.BastionBootstrapArgs{IntervalS: 10},
				archer.WithMaxRetries(3),
				// while debugging, avoid extra schedule delay:
				archer.WithScheduleTime(time.Now().Add(60*time.Second)),
			)
			if err != nil {
				log.Printf("failed to enqueue bootstrap_bastion: %v", err)
			}

			/*
				_, err = jobs.Enqueue(
					context.Background(),
					uuid.NewString(),
					"prepare_cluster",
					bg.ClusterPrepareArgs{IntervalS: 120},
					archer.WithMaxRetries(3),
					archer.WithScheduleTime(time.Now().Add(60*time.Second)),
				)
				if err != nil {
					log.Printf("failed to enqueue prepare_cluster: %v", err)
				}

				_, err = jobs.Enqueue(
					context.Background(),
					uuid.NewString(),
					"cluster_setup",
					bg.ClusterSetupArgs{
						IntervalS: 120,
					},
					archer.WithMaxRetries(3),
					archer.WithScheduleTime(time.Now().Add(60*time.Second)),
				)

				if err != nil {
					log.Printf("failed to enqueue cluster setup: %v", err)
				}

				_, err = jobs.Enqueue(
					context.Background(),
					uuid.NewString(),
					"cluster_bootstrap",
					bg.ClusterBootstrapArgs{
						IntervalS: 120,
					},
					archer.WithMaxRetries(3),
					archer.WithScheduleTime(time.Now().Add(60*time.Second)),
				)
				if err != nil {
					log.Printf("failed to enqueue cluster bootstrap: %v", err)
				}
			*/

			_, err = jobs.Enqueue(
				context.Background(),
				uuid.NewString(),
				"org_key_sweeper",
				bg.OrgKeySweeperArgs{
					IntervalS:     3600,
					RetentionDays: 10,
				},
				archer.WithMaxRetries(1),
				archer.WithScheduleTime(time.Now()),
			)
			if err != nil {
				log.Printf("failed to enqueue org_key_sweeper: %v", err)
			}
		}

		_ = auth.Refresh(rt.DB, rt.Cfg.JWTPrivateEncKey)
		go func() {
			t := time.NewTicker(60 * time.Second)
			defer t.Stop()
			for range t.C {
				_ = auth.Refresh(rt.DB, rt.Cfg.JWTPrivateEncKey)
			}
		}()

		r := api.NewRouter(rt.DB, jobs, nil)

		if cfg.DBStudioEnabled {
			dbURL := cfg.DbURLRO
			if dbURL == "" {
				dbURL = cfg.DbURL
			}

			studio, err := api.MountDbStudio(
				dbURL,
				"db-studio",
				false,
			)
			if err != nil {
				log.Fatalf("failed to init db studio: %v", err)
			} else {
				r = api.NewRouter(rt.DB, jobs, studio)
				log.Printf("pgweb mounted at /db-studio/")
			}
		}

		addr := fmt.Sprintf("%s:%s", cfg.Host, cfg.Port)

		srv := &http.Server{
			Addr:         addr,
			Handler:      TimeoutExceptUpgrades(r, 60*time.Second, "request timed out"), // global safety
			ReadTimeout:  15 * time.Second,
			WriteTimeout: 60 * time.Second,
			IdleTimeout:  120 * time.Second,
		}

		ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
		defer stop()

		go func() {
			fmt.Printf("🚀 API running on http://%s (ui.dev=%v)\n", addr, cfg.UIDev)
			if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
				log.Fatalf("server error: %v", err)
			}
		}()

		<-ctx.Done()
		fmt.Println("\n⏳ Shutting down...")
		shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
		defer cancel()
		return srv.Shutdown(shutdownCtx)
	},
}

func init() {
	rootCmd.AddCommand(serveCmd)
}

func TimeoutExceptUpgrades(next http.Handler, d time.Duration, msg string) http.Handler {
	timeout := http.TimeoutHandler(next, d, msg)
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// If this is an upgrade (e.g., websocket), don't wrap.
		if isUpgrade(r) {
			next.ServeHTTP(w, r)
			return
		}
		timeout.ServeHTTP(w, r)
	})
}

func isUpgrade(r *http.Request) bool {
	// Connection: Upgrade, Upgrade: websocket
	if strings.Contains(strings.ToLower(r.Header.Get("Connection")), "upgrade") {
		return true
	}
	return false
}
</file>

<file path="cmd/version.go">
package cmd

import (
	"fmt"

	"github.com/glueops/autoglue/internal/version"
	"github.com/spf13/cobra"
)

var versionCmd = &cobra.Command{
	Use:   "version",
	Short: "Show version information",
	Run: func(cmd *cobra.Command, args []string) {
		fmt.Println(version.Info())
	},
}

func init() {
	rootCmd.AddCommand(versionCmd)
}
</file>

<file path="internal/api/httpmiddleware/auth.go">
package httpmiddleware

import (
	"net/http"
	"strings"

	"github.com/glueops/autoglue/internal/auth"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// AuthMiddleware authenticates either a user principal (JWT, user API key, app key/secret)
// or an org principal (org key/secret). If requireOrg is true, the request must have
// an organization resolved; otherwise org is optional.
//
// Org resolution order for user principals (when requireOrg == true):
//  1. X-Org-ID header (UUID)
//  2. chi URL param {id} (useful under /orgs/{id}/... routers)
//  3. single-membership fallback (exactly one membership)
//
// If none resolves, respond with org_required.
func AuthMiddleware(db *gorm.DB, requireOrg bool) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			var user *models.User
			var org *models.Organization
			var roles []string

			// --- 1) Authenticate principal ---
			// Prefer org principal if explicit machine access is provided.
			if orgKey := r.Header.Get("X-ORG-KEY"); orgKey != "" {
				secret := r.Header.Get("X-ORG-SECRET")
				org = auth.ValidateOrgKeyPair(orgKey, secret, db)
				if org == nil {
					utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "invalid org credentials")
					return
				}
				// org principal implies machine role
				roles = []string{"org:machine"}
			} else {
				// User principals
				if ah := r.Header.Get("Authorization"); strings.HasPrefix(ah, "Bearer ") {
					user = auth.ValidateJWT(ah[7:], db)
				} else if apiKey := r.Header.Get("X-API-KEY"); apiKey != "" {
					user = auth.ValidateAPIKey(apiKey, db)
				} else if appKey := r.Header.Get("X-APP-KEY"); appKey != "" {
					secret := r.Header.Get("X-APP-SECRET")
					user = auth.ValidateAppKeyPair(appKey, secret, db)
				} else if c, err := r.Cookie("ag_jwt"); err == nil {
					tok := strings.TrimSpace(c.Value)
					if strings.HasPrefix(strings.ToLower(tok), "bearer ") {
						tok = tok[7:]
					}
					if tok != "" {
						user = auth.ValidateJWT(tok, db)
					}
				}

				if user == nil {
					utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "invalid credentials")
					return
				}

				// --- 2) Resolve organization (user principal) ---
				// A) Try X-Org-ID if present
				if s := r.Header.Get("X-Org-ID"); s != "" {
					oid, err := uuid.Parse(s)
					if err != nil {
						utils.WriteError(w, http.StatusBadRequest, "invalid_org_id", "X-Org-ID must be a UUID")
						return
					}
					var o models.Organization
					if err := db.First(&o, "id = ?", oid).Error; err != nil {
						// Header provided but org not found
						utils.WriteError(w, http.StatusUnauthorized, "org_forbidden", "organization not found")
						return
					}
					// Verify membership
					if !userIsMember(db, user.ID, o.ID) {
						utils.WriteError(w, http.StatusUnauthorized, "org_forbidden", "user is not a member of specified org")
						return
					}
					org = &o
				}

				// B) If still no org and requireOrg==true, try chi URL param {id}
				if org == nil && requireOrg {
					if sid := chi.URLParam(r, "id"); sid != "" {
						if oid, err := uuid.Parse(sid); err == nil {
							var o models.Organization
							if err := db.First(&o, "id = ?", oid).Error; err == nil && userIsMember(db, user.ID, o.ID) {
								org = &o
							} else {
								utils.WriteError(w, http.StatusUnauthorized, "org_forbidden", "user is not a member of specified org")
								return
							}
						}
					}
				}

				// C) Single-membership fallback (only if requireOrg==true and still nil)
				if org == nil && requireOrg {
					var ms []models.Membership
					if err := db.Where("user_id = ?", user.ID).Find(&ms).Error; err == nil && len(ms) == 1 {
						var o models.Organization
						if err := db.First(&o, "id = ?", ms[0].OrganizationID).Error; err == nil {
							org = &o
						}
					}
				}

				// D) Final check
				if requireOrg && org == nil {
					utils.WriteError(w, http.StatusUnauthorized, "org_required", "specify X-Org-ID or use an endpoint that does not require org")
					return
				}

				// Populate roles if an org was resolved (optional for org-optional endpoints)
				if org != nil {
					roles = userRolesInOrg(db, user.ID, org.ID)
					if len(roles) == 0 {
						utils.WriteError(w, http.StatusForbidden, "forbidden", "no roles in organization")
						return
					}
				}
			}

			// --- 3) Attach to context and proceed ---
			ctx := r.Context()
			if user != nil {
				ctx = WithUser(ctx, user)
			}
			if org != nil {
				ctx = WithOrg(ctx, org)
			}
			if roles != nil {
				ctx = WithRoles(ctx, roles)
			}

			next.ServeHTTP(w, r.WithContext(ctx))
		})
	}
}

func userIsMember(db *gorm.DB, userID, orgID uuid.UUID) bool {
	var count int64
	db.Model(&models.Membership{}).
		Where("user_id = ? AND organization_id = ?", userID, orgID).
		Count(&count)
	return count > 0
}

func userRolesInOrg(db *gorm.DB, userID, orgID uuid.UUID) []string {
	var m models.Membership
	if err := db.Where("user_id = ? AND organization_id = ?", userID, orgID).First(&m).Error; err == nil {
		switch m.Role {
		case "owner":
			return []string{"role:owner", "role:admin", "role:member"}
		case "admin":
			return []string{"role:admin", "role:member"}
		default:
			return []string{"role:member"}
		}
	}
	return nil
}
</file>

<file path="internal/api/httpmiddleware/context.go">
package httpmiddleware

import (
	"context"

	"github.com/glueops/autoglue/internal/models"
	"github.com/google/uuid"
)

type ctxKey string

const (
	ctxUserKey  ctxKey = "ctx_user"
	ctxOrgKey   ctxKey = "ctx_org"
	ctxRolesKey ctxKey = "ctx_roles" // []string, user roles in current org
)

func WithUser(ctx context.Context, u *models.User) context.Context {
	return context.WithValue(ctx, ctxUserKey, u)
}
func WithOrg(ctx context.Context, o *models.Organization) context.Context {
	return context.WithValue(ctx, ctxOrgKey, o)
}
func WithRoles(ctx context.Context, roles []string) context.Context {
	return context.WithValue(ctx, ctxRolesKey, roles)
}

func UserFrom(ctx context.Context) (*models.User, bool) {
	u, ok := ctx.Value(ctxUserKey).(*models.User)
	return u, ok && u != nil
}
func OrgFrom(ctx context.Context) (*models.Organization, bool) {
	o, ok := ctx.Value(ctxOrgKey).(*models.Organization)
	return o, ok && o != nil
}
func OrgIDFrom(ctx context.Context) (uuid.UUID, bool) {
	if o, ok := OrgFrom(ctx); ok {
		return o.ID, true
	}
	return uuid.Nil, false
}
func RolesFrom(ctx context.Context) ([]string, bool) {
	r, ok := ctx.Value(ctxRolesKey).([]string)
	return r, ok && r != nil
}
</file>

<file path="internal/api/httpmiddleware/platform_admin.go">
package httpmiddleware

import (
	"net/http"

	"github.com/glueops/autoglue/internal/utils"
)

// RequireAuthenticatedUser ensures a user principal is present (i.e. not an org/machine key).
func RequireAuthenticatedUser() func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			if user, ok := UserFrom(r.Context()); !ok || user == nil {
				// No user in context -> probably org/machine principal, or unauthenticated
				utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "user principal required")
				return
			}
			next.ServeHTTP(w, r)
		})
	}
}

// RequirePlatformAdmin requires a user principal with IsAdmin=true.
// This is platform-wide (non-org) admin and does NOT depend on org roles.
func RequirePlatformAdmin() func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			user, ok := UserFrom(r.Context())
			if !ok || user == nil {
				utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "user principal required")
				return
			}
			if !user.IsAdmin {
				utils.WriteError(w, http.StatusForbidden, "forbidden", "platform admin required")
				return
			}
			next.ServeHTTP(w, r)
		})
	}
}

// RequireUserAdmin is an alias for RequirePlatformAdmin for readability at call sites.
func RequireUserAdmin() func(http.Handler) http.Handler {
	return RequirePlatformAdmin()
}
</file>

<file path="internal/api/httpmiddleware/rbac.go">
package httpmiddleware

import (
	"net/http"

	"github.com/glueops/autoglue/internal/utils"
)

func RequireRole(minRole string) func(http.Handler) http.Handler {
	// order: owner > admin > member
	rank := map[string]int{
		"role:member":    1,
		"role:admin":     2,
		"role:owner":     3,
		"org:machine":    2,
		"org:machine:ro": 1,
	}
	need := map[string]bool{
		"member": true, "admin": true, "owner": true,
	}
	if !need[minRole] {
		minRole = "member"
	}

	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			roles, ok := RolesFrom(r.Context())
			if !ok || len(roles) == 0 {
				utils.WriteError(w, http.StatusForbidden, "forbidden", "no roles in context")
				return
			}
			max := 0
			for _, ro := range roles {
				if rank[ro] > max {
					max = rank[ro]
				}
			}
			if max < rank["role:"+minRole] {
				utils.WriteError(w, http.StatusForbidden, "forbidden", "insufficient role")
				return
			}
			next.ServeHTTP(w, r)
		})
	}
}
</file>

<file path="internal/api/mount_admin_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/bg"
	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountAdminRoutes(r chi.Router, db *gorm.DB, jobs *bg.Jobs, authUser func(http.Handler) http.Handler) {
	r.Route("/admin", func(admin chi.Router) {
		admin.Route("/archer", func(archer chi.Router) {
			archer.Use(authUser)
			archer.Use(httpmiddleware.RequirePlatformAdmin())

			archer.Get("/jobs", handlers.AdminListArcherJobs(db))
			archer.Post("/jobs", handlers.AdminEnqueueArcherJob(db, jobs))
			archer.Post("/jobs/{id}/retry", handlers.AdminRetryArcherJob(db))
			archer.Post("/jobs/{id}/cancel", handlers.AdminCancelArcherJob(db))
			archer.Get("/queues", handlers.AdminListArcherQueues(db))
		})
		admin.Route("/actions", func(action chi.Router) {
			action.Use(authUser)
			action.Use(httpmiddleware.RequirePlatformAdmin())

			action.Get("/", handlers.ListActions(db))
			action.Post("/", handlers.CreateAction(db))

			action.Get("/{actionID}", handlers.GetAction(db))
			action.Patch("/{actionID}", handlers.UpdateAction(db))
			action.Delete("/{actionID}", handlers.DeleteAction(db))
		})
	})
}
</file>

<file path="internal/api/mount_annotation_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountAnnotationRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
	r.Route("/annotations", func(a chi.Router) {
		a.Use(authOrg)
		a.Get("/", handlers.ListAnnotations(db))
		a.Post("/", handlers.CreateAnnotation(db))
		a.Get("/{id}", handlers.GetAnnotation(db))
		a.Patch("/{id}", handlers.UpdateAnnotation(db))
		a.Delete("/{id}", handlers.DeleteAnnotation(db))
	})
}
</file>

<file path="internal/api/mount_api_routes.go">
package api

import (
	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/bg"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountAPIRoutes(r chi.Router, db *gorm.DB, jobs *bg.Jobs) {
	r.Route("/api", func(api chi.Router) {
		api.Route("/v1", func(v1 chi.Router) {
			authUser := httpmiddleware.AuthMiddleware(db, false)
			authOrg := httpmiddleware.AuthMiddleware(db, true)

			// shared basics
			mountMetaRoutes(v1)
			mountAuthRoutes(v1, db)

			// admin
			mountAdminRoutes(v1, db, jobs, authUser)

			// user/org scoped
			mountMeRoutes(v1, db, authUser)
			mountOrgRoutes(v1, db, authUser, authOrg)

			mountCredentialRoutes(v1, db, authOrg)
			mountSSHRoutes(v1, db, authOrg)
			mountServerRoutes(v1, db, authOrg)
			mountTaintRoutes(v1, db, authOrg)
			mountLabelRoutes(v1, db, authOrg)
			mountAnnotationRoutes(v1, db, authOrg)
			mountNodePoolRoutes(v1, db, authOrg)
			mountDNSRoutes(v1, db, authOrg)
			mountLoadBalancerRoutes(v1, db, authOrg)
			mountClusterRoutes(v1, db, jobs, authOrg)
		})
	})
}
</file>

<file path="internal/api/mount_auth_routes.go">
package api

import (
	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountAuthRoutes(r chi.Router, db *gorm.DB) {
	r.Route("/auth", func(a chi.Router) {
		a.Post("/{provider}/start", handlers.AuthStart(db))
		a.Get("/{provider}/callback", handlers.AuthCallback(db))
		a.Post("/refresh", handlers.Refresh(db))
		a.Post("/logout", handlers.Logout(db))
	})
}
</file>

<file path="internal/api/mount_cluster_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/bg"
	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountClusterRoutes(r chi.Router, db *gorm.DB, jobs *bg.Jobs, authOrg func(http.Handler) http.Handler) {
	r.Route("/clusters", func(c chi.Router) {
		c.Use(authOrg)
		c.Get("/", handlers.ListClusters(db))
		c.Post("/", handlers.CreateCluster(db))

		c.Get("/{clusterID}", handlers.GetCluster(db))
		c.Patch("/{clusterID}", handlers.UpdateCluster(db))
		c.Delete("/{clusterID}", handlers.DeleteCluster(db))

		c.Post("/{clusterID}/captain-domain", handlers.AttachCaptainDomain(db))
		c.Delete("/{clusterID}/captain-domain", handlers.DetachCaptainDomain(db))

		c.Post("/{clusterID}/control-plane-record-set", handlers.AttachControlPlaneRecordSet(db))
		c.Delete("/{clusterID}/control-plane-record-set", handlers.DetachControlPlaneRecordSet(db))

		c.Post("/{clusterID}/apps-load-balancer", handlers.AttachAppsLoadBalancer(db))
		c.Delete("/{clusterID}/apps-load-balancer", handlers.DetachAppsLoadBalancer(db))
		c.Post("/{clusterID}/glueops-load-balancer", handlers.AttachGlueOpsLoadBalancer(db))
		c.Delete("/{clusterID}/glueops-load-balancer", handlers.DetachGlueOpsLoadBalancer(db))

		c.Post("/{clusterID}/bastion", handlers.AttachBastionServer(db))
		c.Delete("/{clusterID}/bastion", handlers.DetachBastionServer(db))

		c.Post("/{clusterID}/kubeconfig", handlers.SetClusterKubeconfig(db))
		c.Delete("/{clusterID}/kubeconfig", handlers.ClearClusterKubeconfig(db))

		c.Post("/{clusterID}/node-pools", handlers.AttachNodePool(db))
		c.Delete("/{clusterID}/node-pools/{nodePoolID}", handlers.DetachNodePool(db))

		c.Get("/{clusterID}/runs", handlers.ListClusterRuns(db))
		c.Get("/{clusterID}/runs/{runID}", handlers.GetClusterRun(db))
		c.Post("/{clusterID}/actions/{actionID}/runs", handlers.RunClusterAction(db, jobs))
	})
}
</file>

<file path="internal/api/mount_credential_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountCredentialRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
	r.Route("/credentials", func(c chi.Router) {
		c.Use(authOrg)
		c.Get("/", handlers.ListCredentials(db))
		c.Post("/", handlers.CreateCredential(db))
		c.Get("/{id}", handlers.GetCredential(db))
		c.Patch("/{id}", handlers.UpdateCredential(db))
		c.Delete("/{id}", handlers.DeleteCredential(db))
		c.Post("/{id}/reveal", handlers.RevealCredential(db))
	})
}
</file>

<file path="internal/api/mount_db_studio.go">
package api

import (
	"net/http"
	"strings"

	"github.com/gin-gonic/gin"
	pgapi "github.com/sosedoff/pgweb/pkg/api"
	pgclient "github.com/sosedoff/pgweb/pkg/client"
	pgcmd "github.com/sosedoff/pgweb/pkg/command"
)

func MountDbStudio(dbURL, prefix string, readonly bool) (http.Handler, error) {
	// Normalize prefix for pgweb:
	//  - no leading slash
	//  - always trailing slash if not empty
	prefix = strings.Trim(prefix, "/")
	if prefix != "" {
		prefix = prefix + "/"
	}

	pgcmd.Opts = pgcmd.Options{
		URL:         dbURL,
		Prefix:      prefix, // e.g. "db-studio/"
		ReadOnly:    readonly,
		Sessions:    false,
		LockSession: true,
		SkipOpen:    true,
	}

	cli, err := pgclient.NewFromUrl(dbURL, nil)
	if err != nil {
		return nil, err
	}
	if readonly {
		_ = cli.SetReadOnlyMode()
	}

	if err := cli.Test(); err != nil {
		return nil, err
	}

	pgapi.DbClient = cli

	gin.SetMode(gin.ReleaseMode)
	g := gin.New()
	g.Use(gin.Recovery())

	pgapi.SetupRoutes(g)
	pgapi.SetupMetrics(g)

	return g, nil
}
</file>

<file path="internal/api/mount_dns_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountDNSRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
	r.Route("/dns", func(d chi.Router) {
		d.Use(authOrg)

		d.Get("/domains", handlers.ListDomains(db))
		d.Post("/domains", handlers.CreateDomain(db))
		d.Get("/domains/{id}", handlers.GetDomain(db))
		d.Patch("/domains/{id}", handlers.UpdateDomain(db))
		d.Delete("/domains/{id}", handlers.DeleteDomain(db))

		d.Get("/domains/{domain_id}/records", handlers.ListRecordSets(db))
		d.Post("/domains/{domain_id}/records", handlers.CreateRecordSet(db))
		d.Get("/records/{id}", handlers.GetRecordSet(db))
		d.Patch("/records/{id}", handlers.UpdateRecordSet(db))
		d.Delete("/records/{id}", handlers.DeleteRecordSet(db))
	})
}
</file>

<file path="internal/api/mount_label_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountLabelRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
	r.Route("/labels", func(l chi.Router) {
		l.Use(authOrg)
		l.Get("/", handlers.ListLabels(db))
		l.Post("/", handlers.CreateLabel(db))
		l.Get("/{id}", handlers.GetLabel(db))
		l.Patch("/{id}", handlers.UpdateLabel(db))
		l.Delete("/{id}", handlers.DeleteLabel(db))
	})
}
</file>

<file path="internal/api/mount_load_balancer_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountLoadBalancerRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
	r.Route("/load-balancers", func(l chi.Router) {
		l.Use(authOrg)
		l.Get("/", handlers.ListLoadBalancers(db))
		l.Post("/", handlers.CreateLoadBalancer(db))
		l.Get("/{id}", handlers.GetLoadBalancer(db))
		l.Patch("/{id}", handlers.UpdateLoadBalancer(db))
		l.Delete("/{id}", handlers.DeleteLoadBalancer(db))
	})
}
</file>

<file path="internal/api/mount_me_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountMeRoutes(r chi.Router, db *gorm.DB, authUser func(http.Handler) http.Handler) {
	r.Route("/me", func(me chi.Router) {
		me.Use(authUser)

		me.Get("/", handlers.GetMe(db))
		me.Patch("/", handlers.UpdateMe(db))

		me.Get("/api-keys", handlers.ListUserAPIKeys(db))
		me.Post("/api-keys", handlers.CreateUserAPIKey(db))
		me.Delete("/api-keys/{id}", handlers.DeleteUserAPIKey(db))
	})
}
</file>

<file path="internal/api/mount_meta_routes.go">
package api

import (
	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
)

func mountMetaRoutes(r chi.Router) {
	// Versioned JWKS for swagger
	r.Get("/.well-known/jwks.json", handlers.JWKSHandler)
	r.Get("/healthz", handlers.HealthCheck)
	r.Get("/version", handlers.Version)
}
</file>

<file path="internal/api/mount_node_pool_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountNodePoolRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
	r.Route("/node-pools", func(n chi.Router) {
		n.Use(authOrg)
		n.Get("/", handlers.ListNodePools(db))
		n.Post("/", handlers.CreateNodePool(db))
		n.Get("/{id}", handlers.GetNodePool(db))
		n.Patch("/{id}", handlers.UpdateNodePool(db))
		n.Delete("/{id}", handlers.DeleteNodePool(db))

		// Servers
		n.Get("/{id}/servers", handlers.ListNodePoolServers(db))
		n.Post("/{id}/servers", handlers.AttachNodePoolServers(db))
		n.Delete("/{id}/servers/{serverId}", handlers.DetachNodePoolServer(db))

		// Taints
		n.Get("/{id}/taints", handlers.ListNodePoolTaints(db))
		n.Post("/{id}/taints", handlers.AttachNodePoolTaints(db))
		n.Delete("/{id}/taints/{taintId}", handlers.DetachNodePoolTaint(db))

		// Labels
		n.Get("/{id}/labels", handlers.ListNodePoolLabels(db))
		n.Post("/{id}/labels", handlers.AttachNodePoolLabels(db))
		n.Delete("/{id}/labels/{labelId}", handlers.DetachNodePoolLabel(db))

		// Annotations
		n.Get("/{id}/annotations", handlers.ListNodePoolAnnotations(db))
		n.Post("/{id}/annotations", handlers.AttachNodePoolAnnotations(db))
		n.Delete("/{id}/annotations/{annotationId}", handlers.DetachNodePoolAnnotation(db))
	})
}
</file>

<file path="internal/api/mount_org_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountOrgRoutes(r chi.Router, db *gorm.DB, authUser, authOrg func(http.Handler) http.Handler) {
	r.Route("/orgs", func(o chi.Router) {
		o.Use(authUser)
		o.Get("/", handlers.ListMyOrgs(db))
		o.Post("/", handlers.CreateOrg(db))

		o.Group(func(og chi.Router) {
			og.Use(authOrg)

			og.Get("/{id}", handlers.GetOrg(db))
			og.Patch("/{id}", handlers.UpdateOrg(db))
			og.Delete("/{id}", handlers.DeleteOrg(db))

			// members
			og.Get("/{id}/members", handlers.ListMembers(db))
			og.Post("/{id}/members", handlers.AddOrUpdateMember(db))
			og.Delete("/{id}/members/{user_id}", handlers.RemoveMember(db))

			// org-scoped key/secret pair
			og.Get("/{id}/api-keys", handlers.ListOrgKeys(db))
			og.Post("/{id}/api-keys", handlers.CreateOrgKey(db))
			og.Delete("/{id}/api-keys/{key_id}", handlers.DeleteOrgKey(db))
		})
	})
}
</file>

<file path="internal/api/mount_pprof_routes.go">
package api

import (
	httpPprof "net/http/pprof"

	"github.com/go-chi/chi/v5"
)

func mountPprofRoutes(r chi.Router) {
	r.Route("/debug/pprof", func(pr chi.Router) {
		pr.Get("/", httpPprof.Index)
		pr.Get("/cmdline", httpPprof.Cmdline)
		pr.Get("/profile", httpPprof.Profile)
		pr.Get("/symbol", httpPprof.Symbol)
		pr.Get("/trace", httpPprof.Trace)

		pr.Handle("/allocs", httpPprof.Handler("allocs"))
		pr.Handle("/block", httpPprof.Handler("block"))
		pr.Handle("/goroutine", httpPprof.Handler("goroutine"))
		pr.Handle("/heap", httpPprof.Handler("heap"))
		pr.Handle("/mutex", httpPprof.Handler("mutex"))
		pr.Handle("/threadcreate", httpPprof.Handler("threadcreate"))
	})
}
</file>

<file path="internal/api/mount_server_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountServerRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
	r.Route("/servers", func(s chi.Router) {
		s.Use(authOrg)
		s.Get("/", handlers.ListServers(db))
		s.Post("/", handlers.CreateServer(db))
		s.Get("/{id}", handlers.GetServer(db))
		s.Patch("/{id}", handlers.UpdateServer(db))
		s.Delete("/{id}", handlers.DeleteServer(db))
		s.Post("/{id}/reset-hostkey", handlers.ResetServerHostKey(db))
	})
}
</file>

<file path="internal/api/mount_ssh_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountSSHRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
	r.Route("/ssh", func(s chi.Router) {
		s.Use(authOrg)
		s.Get("/", handlers.ListPublicSshKeys(db))
		s.Post("/", handlers.CreateSSHKey(db))
		s.Get("/{id}", handlers.GetSSHKey(db))
		s.Delete("/{id}", handlers.DeleteSSHKey(db))
		s.Get("/{id}/download", handlers.DownloadSSHKey(db))
	})
}
</file>

<file path="internal/api/mount_swagger_routes.go">
package api

import (
	"fmt"
	"html/template"
	"net/http"

	"github.com/glueops/autoglue/docs"
	"github.com/go-chi/chi/v5"
)

func mountSwaggerRoutes(r chi.Router) {
	r.Get("/swagger", RapidDocHandler("/swagger/swagger.yaml"))
	r.Get("/swagger/index.html", RapidDocHandler("/swagger/swagger.yaml"))
	r.Get("/swagger/openapi.json", serveSwaggerFromEmbed(docs.SwaggerJSON, "application/json"))
	r.Get("/swagger/openapi.yaml", serveSwaggerFromEmbed(docs.SwaggerYAML, "application/x-yaml"))
}

var rapidDocTmpl = template.Must(template.New("redoc").Parse(`<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8" />
  <title>AutoGlue API Docs</title>
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta charset="utf-8">
  <style>
    body { margin: 0; padding: 0; }
    .redoc-container { height: 100vh; }
  </style>
</head>
<body>
  <rapi-doc
    id="autoglue-docs"
    spec-url="{{.SpecURL}}"
    render-style="read"
    theme="dark"
    show-header="false"
    persist-auth="true"
	allow-advanced-search="true"
	schema-description-expanded="true"                                                                                                                                   
	allow-schema-description-expand-toggle="false"                                                                                                                       
	allow-spec-file-download="true"                                                                                                                                      
	allow-spec-file-load="false"                                                                                                                                         
	allow-spec-url-load="false"                       
    allow-try="true"
    schema-style="tree"
	fetch-credentials="include"
    default-api-server="{{.DefaultServer}}"
 	api-key-name="X-ORG-ID"
  	api-key-location="header"
  	api-key-value=""
  />
  <script type="module" src="https://unpkg.com/rapidoc/dist/rapidoc-min.js"></script>
  <script>
    window.addEventListener('DOMContentLoaded', () => {
      const rd = document.getElementById('autoglue-docs');
      if (!rd) return;

      const storedOrg = localStorage.getItem('autoglue.org');
      if (storedOrg) {
        rd.setAttribute('api-key-value', storedOrg);
      }
    }
  </script>
</body>
</html>`))

func RapidDocHandler(specURL string) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		scheme := "http"
		if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" {
			scheme = "https"
		}

		host := r.Host
		defaultServer := fmt.Sprintf("%s://%s/api/v1", scheme, host)

		w.Header().Set("Content-Type", "text/html; charset=utf-8")
		if err := rapidDocTmpl.Execute(w, map[string]string{
			"SpecURL":       specURL,
			"DefaultServer": defaultServer,
		}); err != nil {
			http.Error(w, "failed to render docs", http.StatusInternalServerError)
			return
		}
	}
}
</file>

<file path="internal/api/mount_taint_routes.go">
package api

import (
	"net/http"

	"github.com/glueops/autoglue/internal/handlers"
	"github.com/go-chi/chi/v5"
	"gorm.io/gorm"
)

func mountTaintRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
	r.Route("/taints", func(t chi.Router) {
		t.Use(authOrg)
		t.Get("/", handlers.ListTaints(db))
		t.Post("/", handlers.CreateTaint(db))
		t.Get("/{id}", handlers.GetTaint(db))
		t.Patch("/{id}", handlers.UpdateTaint(db))
		t.Delete("/{id}", handlers.DeleteTaint(db))
	})
}
</file>

<file path="internal/api/mw_logger.go">
package api

import (
	"net/http"
	"time"

	"github.com/go-chi/chi/v5/middleware"
	"github.com/rs/zerolog/log"
)

func zeroLogMiddleware() func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			ww := middleware.NewWrapResponseWriter(w, r.ProtoMajor)
			start := time.Now()

			next.ServeHTTP(ww, r)

			dur := time.Since(start)
			ev := log.Info()
			if ww.Status() >= 500 {
				ev = log.Error()
			}
			ev.
				Str("remote_ip", r.RemoteAddr).
				Str("request_id", middleware.GetReqID(r.Context())).
				Str("method", r.Method).
				Str("path", r.URL.Path).
				Int("status", ww.Status()).
				Int("bytes", ww.BytesWritten()).
				Dur("duration", dur).
				Msg("http_request")
		})
	}
}
</file>

<file path="internal/api/mw_security.go">
package api

import (
	"net/http"
	"strings"

	"github.com/glueops/autoglue/internal/config"
)

func SecurityHeaders(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// HSTS (enable only over TLS/behind HTTPS)
		// HSTS only when not in dev and over TLS/behind a proxy that terminates TLS
		if !config.IsDev() {
			w.Header().Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload")
		}

		w.Header().Set("X-Frame-Options", "DENY")
		w.Header().Set("X-Content-Type-Options", "nosniff")
		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
		w.Header().Set("Permissions-Policy", "geolocation=(), camera=(), microphone=(), interest-cohort=()")

		if config.IsDev() {
			// --- Relaxed CSP for Vite dev server & Google Fonts ---
			// Allows inline/eval for React Refresh preamble, HMR websocket, and fonts.
			// Tighten these as you move to prod or self-host fonts.
			w.Header().Set("Content-Security-Policy", strings.Join([]string{
				"default-src 'self'",
				"base-uri 'self'",
				"form-action 'self'",
				// Vite dev & inline preamble/eval:
				"script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:5173 https://unpkg.com",
				// allow dev style + Google Fonts
				"style-src 'self' 'unsafe-inline' http://localhost:5173 https://fonts.googleapis.com",
				"img-src 'self' data: blob:",
				// Google font files
				"font-src 'self' data: https://fonts.gstatic.com",
				// HMR connections
				"connect-src 'self' http://localhost:5173 ws://localhost:5173 ws://localhost:8080 https://api.github.com https://unpkg.com",
				"frame-ancestors 'none'",
			}, "; "))
		} else {
			// --- Strict CSP for production ---
			// If you keep using Google Fonts in prod, add:
			//   style-src ... https://fonts.googleapis.com
			//   font-src  ... https://fonts.gstatic.com
			// Recommended: self-host fonts in prod and keep these tight.
			w.Header().Set("Content-Security-Policy", strings.Join([]string{
				"default-src 'self'",
				"base-uri 'self'",
				"form-action 'self'",
				"script-src 'self' 'unsafe-inline' https://unpkg.com",
				"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
				"img-src 'self' data: blob:",
				"font-src 'self' data: https://fonts.gstatic.com",
				"connect-src 'self' ws://localhost:8080 https://api.github.com https://unpkg.com",
				"frame-ancestors 'none'",
			}, "; "))
		}

		next.ServeHTTP(w, r)
	})
}
</file>

<file path="internal/api/routes.go">
package api

import (
	"fmt"
	"net/http"
	"os"
	"strings"
	"time"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/bg"
	"github.com/glueops/autoglue/internal/config"
	"github.com/glueops/autoglue/internal/handlers"
	"github.com/glueops/autoglue/internal/web"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
	"github.com/go-chi/cors"
	"github.com/go-chi/httprate"

	"gorm.io/gorm"

	"github.com/rs/zerolog"
	"github.com/rs/zerolog/log"
)

func NewRouter(db *gorm.DB, jobs *bg.Jobs, studio http.Handler) http.Handler {
	zerolog.TimeFieldFormat = time.RFC3339

	l := log.Output(zerolog.ConsoleWriter{Out: os.Stdout, TimeFormat: "15:04:05"})
	log.Logger = l

	r := chi.NewRouter()
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(zeroLogMiddleware())
	r.Use(middleware.Recoverer)
	r.Use(SecurityHeaders)
	r.Use(requestBodyLimit(10 << 20))
	r.Use(httprate.LimitByIP(1000, 1*time.Minute))
	r.Use(middleware.StripSlashes)

	allowed := getAllowedOrigins()
	r.Use(cors.Handler(cors.Options{
		AllowedOrigins: allowed,
		AllowedMethods: []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
		AllowedHeaders: []string{
			"Content-Type",
			"Authorization",
			"X-Org-ID",
			"X-API-KEY",
			"X-ORG-KEY",
			"X-ORG-SECRET",
		},
		ExposedHeaders:   []string{"Link"},
		AllowCredentials: true,
		MaxAge:           600,
	}))

	r.Use(middleware.Maybe(
		middleware.AllowContentType("application/json"),
		func(r *http.Request) bool {
			// return true  => run AllowContentType
			// return false => skip AllowContentType for this request
			return !strings.HasPrefix(r.URL.Path, "/db-studio")
		}))
	//r.Use(middleware.AllowContentType("application/json"))

	// Unversioned, non-auth endpoints
	r.Get("/.well-known/jwks.json", handlers.JWKSHandler)

	// Versioned API
	mountAPIRoutes(r, db, jobs)

	// Optional DB studio
	if studio != nil {
		r.Group(func(gr chi.Router) {
			authUser := httpmiddleware.AuthMiddleware(db, false)
			adminOnly := httpmiddleware.RequirePlatformAdmin()
			gr.Use(authUser, adminOnly)
			gr.Mount("/db-studio", studio)
		})
	}

	// pprof
	if config.IsDebug() {
		mountPprofRoutes(r)
	}

	// Swagger
	if config.IsSwaggerEnabled() {
		mountSwaggerRoutes(r)
	}

	// UI dev/prod
	if config.IsUIDev() {
		fmt.Println("Running in development mode")
		proxy, err := web.DevProxy("http://localhost:5173")
		if err != nil {
			log.Error().Err(err).Msg("dev proxy init failed")
			return r // fallback
		}

		mux := http.NewServeMux()
		mux.Handle("/api/", r)
		mux.Handle("/api", r)
		mux.Handle("/swagger", r)
		mux.Handle("/swagger/", r)
		mux.Handle("/db-studio/", r)
		mux.Handle("/debug/pprof/", r)
		mux.Handle("/", proxy)
		return mux
	} else {
		fmt.Println("Running in production mode")
		if h, err := web.SPAHandler(); err == nil {
			r.NotFound(h.ServeHTTP)
		} else {
			log.Error().Err(err).Msg("spa handler init failed")
		}
	}

	return r
}
</file>

<file path="internal/api/utils.go">
package api

import (
	"net/http"
	"os"
	"strings"
)

func requestBodyLimit(maxBytes int64) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			r.Body = http.MaxBytesReader(w, r.Body, maxBytes)
			next.ServeHTTP(w, r)
		})
	}
}

func getAllowedOrigins() []string {
	if v := os.Getenv("CORS_ALLOWED_ORIGINS"); v != "" {
		parts := strings.Split(v, ",")
		out := make([]string, 0, len(parts))
		for _, p := range parts {
			s := strings.TrimSpace(p)
			if s != "" {
				out = append(out, s)
			}
		}
		if len(out) > 0 {
			return out
		}
	}
	// Defaults (dev)
	return []string{
		"http://localhost:5173",
		"http://localhost:8080",
	}
}

func serveSwaggerFromEmbed(data []byte, contentType string) http.HandlerFunc {
	return func(w http.ResponseWriter, _ *http.Request) {
		w.Header().Set("Content-Type", contentType)
		w.WriteHeader(http.StatusOK)
		// nosemgrep: go.lang.security.audit.xss.no-direct-write-to-responsewriter
		_, _ = w.Write(data)
	}
}
</file>

<file path="internal/app/runtime.go">
package app

import (
	"log"

	"github.com/glueops/autoglue/internal/config"
	"github.com/glueops/autoglue/internal/db"
	"github.com/glueops/autoglue/internal/models"
	"gorm.io/gorm"
)

type Runtime struct {
	Cfg config.Config
	DB  *gorm.DB
}

func NewRuntime() *Runtime {
	cfg, err := config.Load()
	if err != nil {
		log.Fatal(err)
	}
	d := db.Open(cfg.DbURL)

	err = db.Run(d,
		&models.Job{},
		&models.MasterKey{},
		&models.SigningKey{},
		&models.User{},
		&models.Organization{},
		&models.Account{},
		&models.Membership{},
		&models.APIKey{},
		&models.UserEmail{},
		&models.RefreshToken{},
		&models.OrganizationKey{},
		&models.SshKey{},
		&models.Server{},
		&models.Taint{},
		&models.Label{},
		&models.Annotation{},
		&models.NodePool{},
		&models.Credential{},
		&models.Domain{},
		&models.RecordSet{},
		&models.LoadBalancer{},
		&models.Cluster{},
		&models.Action{},
		&models.Cluster{},
		&models.ClusterRun{},
	)

	if err != nil {
		log.Fatalf("Error initializing database: %v", err)
	}
	return &Runtime{
		Cfg: cfg,
		DB:  d,
	}
}
</file>

<file path="internal/auth/hash.go">
package auth

import (
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"time"

	"github.com/alexedwards/argon2id"
)

func SHA256Hex(s string) string {
	sum := sha256.Sum256([]byte(s))
	return hex.EncodeToString(sum[:])
}

var argonParams = &argon2id.Params{
	Memory:      64 * 1024, // 64MB
	Iterations:  3,
	Parallelism: 2,
	SaltLength:  16,
	KeyLength:   32,
}

func HashSecretArgon2id(plain string) (string, error) {
	return argon2id.CreateHash(plain, argonParams)
}

func VerifySecretArgon2id(encodedHash, plain string) (bool, error) {
	if encodedHash == "" {
		return false, errors.New("empty hash")
	}
	return argon2id.ComparePasswordAndHash(plain, encodedHash)
}

func NotExpired(expiresAt *time.Time) bool {
	return expiresAt == nil || time.Now().Before(*expiresAt)
}
</file>

<file path="internal/auth/issue.go">
package auth

import (
	"crypto/rand"
	"encoding/base64"
	"time"

	"github.com/glueops/autoglue/internal/models"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

func randomToken(n int) (string, error) {
	b := make([]byte, n)
	if _, err := rand.Read(b); err != nil {
		return "", err
	}
	// URL-safe, no padding
	return base64.RawURLEncoding.EncodeToString(b), nil
}

// IssueUserAPIKey creates a single-token user API key (X-API-KEY)
func IssueUserAPIKey(db *gorm.DB, userID uuid.UUID, name string, ttl *time.Duration) (plaintext string, rec models.APIKey, err error) {
	plaintext, err = randomToken(32)
	if err != nil {
		return "", models.APIKey{}, err
	}
	rec = models.APIKey{
		Name:    name,
		Scope:   "user",
		UserID:  &userID,
		KeyHash: SHA256Hex(plaintext), // deterministic lookup
	}
	if ttl != nil {
		ex := time.Now().Add(*ttl)
		rec.ExpiresAt = &ex
	}
	if err = db.Create(&rec).Error; err != nil {
		return "", models.APIKey{}, err
	}
	return plaintext, rec, nil
}
</file>

<file path="internal/auth/jwks_export.go">
package auth

import (
	"crypto/ed25519"
	"crypto/rsa"
	"encoding/base64"
	"fmt"
	"math/big"
)

// base64url (no padding)
func b64url(b []byte) string {
	return base64.RawURLEncoding.EncodeToString(b)
}

// convert small int (RSA exponent) to big-endian bytes
func fromInt(i int) []byte {
	var x big.Int
	x.SetInt64(int64(i))
	return x.Bytes()
}

// --- public accessors for JWKS ---

// KeyMeta is a minimal metadata view exposed for JWKS rendering.
type KeyMeta struct {
	Alg string
}

// MetaFor returns minimal metadata (currently the alg) for a given kid.
// If not found, returns zero value (Alg == "").
func MetaFor(kid string) KeyMeta {
	kc.mu.RLock()
	defer kc.mu.RUnlock()
	if m, ok := kc.meta[kid]; ok {
		return KeyMeta{Alg: m.Alg}
	}
	return KeyMeta{}
}

// KcCopy invokes fn with a shallow copy of the public key map (kid -> public key instance).
// Useful to iterate without holding the lock during JSON building.
func KcCopy(fn func(map[string]interface{})) {
	kc.mu.RLock()
	defer kc.mu.RUnlock()
	out := make(map[string]interface{}, len(kc.pub))
	for kid, pk := range kc.pub {
		out[kid] = pk
	}
	fmt.Println(out)
	fn(out)
}

// PubToJWK converts a parsed public key into bare JWK parameters + kty.
// - RSA: returns n/e (base64url) and kty="RSA"
// - Ed25519: returns x (base64url) and kty="OKP"
func PubToJWK(_kid, _alg string, pub any) (map[string]string, string) {
	switch k := pub.(type) {
	case *rsa.PublicKey:
		return map[string]string{
			"n": b64url(k.N.Bytes()),
			"e": b64url(fromInt(k.E)),
		}, "RSA"
	case ed25519.PublicKey:
		return map[string]string{
			"x": b64url([]byte(k)),
		}, "OKP"
	default:
		return nil, ""
	}
}
</file>

<file path="internal/auth/jwt_issue.go">
package auth

import (
	"errors"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

type IssueOpts struct {
	Subject  string
	Issuer   string
	Audience string
	TTL      time.Duration
	Claims   map[string]any // extra app claims
}

func IssueAccessToken(opts IssueOpts) (string, error) {
	kc.mu.RLock()
	defer kc.mu.RUnlock()

	if kc.selPriv == nil || kc.selKid == "" || kc.selAlg == "" {
		return "", errors.New("no active signing key")
	}

	claims := jwt.MapClaims{
		"iss": opts.Issuer,
		"aud": opts.Audience,
		"sub": opts.Subject,
		"iat": time.Now().Unix(),
		"exp": time.Now().Add(opts.TTL).Unix(),
	}
	for k, v := range opts.Claims {
		claims[k] = v
	}

	var method jwt.SigningMethod
	switch kc.selAlg {
	case "RS256":
		method = jwt.SigningMethodRS256
	case "RS384":
		method = jwt.SigningMethodRS384
	case "RS512":
		method = jwt.SigningMethodRS512
	case "EdDSA":
		method = jwt.SigningMethodEdDSA
	default:
		return "", errors.New("unsupported alg")
	}

	token := jwt.NewWithClaims(method, claims)
	token.Header["kid"] = kc.selKid

	return token.SignedString(kc.selPriv)
}
</file>

<file path="internal/auth/jwt_signer.go">
package auth

import (
	"crypto/ed25519"
	"crypto/rsa"
	"crypto/x509"
	"encoding/pem"
	"errors"
	"sync"
	"time"

	"github.com/glueops/autoglue/internal/keys"
	"github.com/glueops/autoglue/internal/models"
	"gorm.io/gorm"
)

type keyCache struct {
	mu      sync.RWMutex
	pub     map[string]interface{} // kid -> public key object
	meta    map[string]models.SigningKey
	selKid  string
	selAlg  string
	selPriv any
}

var kc keyCache

// Refresh loads active keys into memory. Call on startup and periodically (ticker/cron).
func Refresh(db *gorm.DB, encKeyB64 string) error {
	var rows []models.SigningKey
	if err := db.Where("is_active = true AND (expires_at IS NULL OR expires_at > ?)", time.Now()).
		Order("created_at desc").Find(&rows).Error; err != nil {
		return err
	}

	pub := make(map[string]interface{}, len(rows))
	meta := make(map[string]models.SigningKey, len(rows))
	var selKid string
	var selAlg string
	var selPriv any

	for i, r := range rows {
		// parse public
		block, _ := pem.Decode([]byte(r.PublicPEM))
		if block == nil {
			continue
		}
		var pubKey any
		switch r.Alg {
		case "RS256", "RS384", "RS512":
			pubKey, _ = x509.ParsePKCS1PublicKey(block.Bytes)
			if pubKey == nil {
				// also allow PKIX format
				if k, err := x509.ParsePKIXPublicKey(block.Bytes); err == nil {
					pubKey = k
				}
			}
		case "EdDSA":
			k, err := x509.ParsePKIXPublicKey(block.Bytes)
			if err == nil {
				if edk, ok := k.(ed25519.PublicKey); ok {
					pubKey = edk
				}
			}
		}
		if pubKey == nil {
			continue
		}
		pub[r.Kid] = pubKey
		meta[r.Kid] = r

		// pick first row as current signer (most recent because of order desc)
		if i == 0 {
			privPEM := r.PrivatePEM
			// decrypt if necessary
			if len(privPEM) > 10 && privPEM[:10] == "enc:aesgcm" {
				pt, err := keysDecrypt(encKeyB64, privPEM)
				if err != nil {
					continue
				}
				privPEM = string(pt)
			}
			blockPriv, _ := pem.Decode([]byte(privPEM))
			if blockPriv == nil {
				continue
			}
			switch r.Alg {
			case "RS256", "RS384", "RS512":
				if k, err := x509.ParsePKCS1PrivateKey(blockPriv.Bytes); err == nil {
					selPriv = k
					selAlg = r.Alg
					selKid = r.Kid
				} else if kAny, err := x509.ParsePKCS8PrivateKey(blockPriv.Bytes); err == nil {
					if k, ok := kAny.(*rsa.PrivateKey); ok {
						selPriv = k
						selAlg = r.Alg
						selKid = r.Kid
					}
				}
			case "EdDSA":
				if kAny, err := x509.ParsePKCS8PrivateKey(blockPriv.Bytes); err == nil {
					if k, ok := kAny.(ed25519.PrivateKey); ok {
						selPriv = k
						selAlg = r.Alg
						selKid = r.Kid
					}
				}
			}
		}
	}

	kc.mu.Lock()
	defer kc.mu.Unlock()
	kc.pub = pub
	kc.meta = meta
	kc.selKid = selKid
	kc.selAlg = selAlg
	kc.selPriv = selPriv
	return nil
}

func keysDecrypt(encKey, enc string) ([]byte, error) {
	return keysDecryptImpl(encKey, enc)
}

// indirection for same package
var keysDecryptImpl = func(encKey, enc string) ([]byte, error) {
	return nil, errors.New("not wired")
}

// Wire up from keys package
func init() {
	keysDecryptImpl = keysDecryptShim
}

func keysDecryptShim(encKey, enc string) ([]byte, error) {
	return keys.Decrypt(encKey, enc)
}
</file>

<file path="internal/auth/jwt_validate.go">
package auth

import (
	"github.com/glueops/autoglue/internal/config"
	"github.com/glueops/autoglue/internal/models"
	"github.com/golang-jwt/jwt/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// ValidateJWT verifies RS256/RS384/RS512/EdDSA tokens using the in-memory key cache.
// It honors kid when present, and falls back to any active key.
func ValidateJWT(tokenStr string, db *gorm.DB) *models.User {
	cfg, _ := config.Load()

	parser := jwt.NewParser(
		jwt.WithIssuer(cfg.JWTIssuer),
		jwt.WithAudience(cfg.JWTAudience),
		jwt.WithValidMethods([]string{"RS256", "RS384", "RS512", "EdDSA"}),
	)

	token, err := parser.Parse(tokenStr, func(t *jwt.Token) (any, error) {
		// Resolve by kid first
		kid, _ := t.Header["kid"].(string)

		kc.mu.RLock()
		defer kc.mu.RUnlock()

		if kid != "" {
			if k, ok := kc.pub[kid]; ok {
				return k, nil
			}
		}
		// Fallback: try first active key
		for _, k := range kc.pub {
			return k, nil
		}
		return nil, jwt.ErrTokenUnverifiable
	})
	if err != nil || !token.Valid {
		return nil
	}

	claims, _ := token.Claims.(jwt.MapClaims)
	sub, _ := claims["sub"].(string)
	uid, err := uuid.Parse(sub)
	if err != nil {
		return nil
	}

	var u models.User
	if err := db.First(&u, "id = ? AND is_disabled = false", uid).Error; err != nil {
		return nil
	}
	return &u
}
</file>

<file path="internal/auth/refresh.go">
package auth

import (
	"crypto/rand"
	"encoding/base64"
	"errors"
	"time"

	"github.com/glueops/autoglue/internal/models"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// random opaque token (returned to client once)
func generateOpaqueToken(n int) (string, error) {
	b := make([]byte, n)
	if _, err := rand.Read(b); err != nil {
		return "", err
	}
	return base64.RawURLEncoding.EncodeToString(b), nil
}

type RefreshPair struct {
	Plain  string
	Record models.RefreshToken
}

// Issue a new refresh token (new family if familyID == nil)
func IssueRefreshToken(db *gorm.DB, userID uuid.UUID, ttl time.Duration, familyID *uuid.UUID) (RefreshPair, error) {
	plain, err := generateOpaqueToken(32)
	if err != nil {
		return RefreshPair{}, err
	}
	hash, err := HashSecretArgon2id(plain)
	if err != nil {
		return RefreshPair{}, err
	}

	fid := uuid.New()
	if familyID != nil {
		fid = *familyID
	}

	rec := models.RefreshToken{
		UserID:    userID,
		FamilyID:  fid,
		TokenHash: hash,
		ExpiresAt: time.Now().Add(ttl),
	}
	if err := db.Create(&rec).Error; err != nil {
		return RefreshPair{}, err
	}
	return RefreshPair{Plain: plain, Record: rec}, nil
}

// ValidateRefreshToken refresh token; returns record if valid & not revoked/expired
func ValidateRefreshToken(db *gorm.DB, plain string) (*models.RefreshToken, error) {
	if plain == "" {
		return nil, errors.New("empty")
	}
	// var rec models.RefreshToken
	// We can't query by hash w/ Argon; scan candidates by expiry window. Keep small TTL (e.g. 30d).
	if err := db.Where("expires_at > ? AND revoked_at IS NULL", time.Now()).
		Find(&[]models.RefreshToken{}).Error; err != nil {
		return nil, err
	}
	// Better: add a prefix column to narrow scan; omitted for brevity.

	// Pragmatic approach: single SELECT per token:
	// Add a TokenHashSHA256 column for deterministic lookup if you want O(1). (Optional)

	// Minimal: iterate limited set; for simplicity we fetch by created window:
	var recs []models.RefreshToken
	if err := db.Where("expires_at > ? AND revoked_at IS NULL", time.Now()).
		Order("created_at desc").Limit(500).Find(&recs).Error; err != nil {
		return nil, err
	}
	for _, r := range recs {
		ok, _ := VerifySecretArgon2id(r.TokenHash, plain)
		if ok {
			return &r, nil
		}
	}
	return nil, errors.New("invalid")
}

// RevokeFamily revokes all tokens in a family (logout everywhere)
func RevokeFamily(db *gorm.DB, familyID uuid.UUID) error {
	now := time.Now()
	return db.Model(&models.RefreshToken{}).
		Where("family_id = ? AND revoked_at IS NULL", familyID).
		Update("revoked_at", &now).Error
}

// RotateRefreshToken replaces one token with a fresh one within the same family
func RotateRefreshToken(db *gorm.DB, used *models.RefreshToken, ttl time.Duration) (RefreshPair, error) {
	// revoke the used token (one-time use)
	now := time.Now()
	if err := db.Model(&models.RefreshToken{}).
		Where("id = ? AND revoked_at IS NULL", used.ID).
		Update("revoked_at", &now).Error; err != nil {
		return RefreshPair{}, err
	}
	return IssueRefreshToken(db, used.UserID, ttl, &used.FamilyID)
}
</file>

<file path="internal/auth/validate_keys.go">
package auth

import (
	"time"

	"github.com/glueops/autoglue/internal/models"
	"gorm.io/gorm"
)

// ValidateAPIKey validates a single-token user API key sent via X-API-KEY.
func ValidateAPIKey(rawKey string, db *gorm.DB) *models.User {
	if rawKey == "" {
		return nil
	}
	digest := SHA256Hex(rawKey)

	var k models.APIKey
	if err := db.
		Where("key_hash = ? AND scope = ? AND (expires_at IS NULL OR expires_at > ?)", digest, "user", time.Now()).
		First(&k).Error; err != nil {
		return nil
	}
	if k.UserID == nil {
		return nil
	}
	var u models.User
	if err := db.First(&u, "id = ? AND is_disabled = false", *k.UserID).Error; err != nil {
		return nil
	}
	// Optional: touch last_used_at here if you've added it on the model.
	return &u
}

// ValidateAppKeyPair validates a user key/secret pair via X-APP-KEY / X-APP-SECRET.
func ValidateAppKeyPair(appKey, secret string, db *gorm.DB) *models.User {
	if appKey == "" || secret == "" {
		return nil
	}
	digest := SHA256Hex(appKey)

	var k models.APIKey
	if err := db.
		Where("key_hash = ? AND scope = ? AND (expires_at IS NULL OR expires_at > ?)", digest, "user", time.Now()).
		First(&k).Error; err != nil {
		return nil
	}
	ok, _ := VerifySecretArgon2id(zeroIfNil(k.SecretHash), secret)
	if !ok || k.UserID == nil {
		return nil
	}
	var u models.User
	if err := db.First(&u, "id = ? AND is_disabled = false", *k.UserID).Error; err != nil {
		return nil
	}
	return &u
}

// ValidateOrgKeyPair validates an org key/secret via X-ORG-KEY / X-ORG-SECRET.
func ValidateOrgKeyPair(orgKey, secret string, db *gorm.DB) *models.Organization {
	if orgKey == "" || secret == "" {
		return nil
	}
	digest := SHA256Hex(orgKey)

	var k models.APIKey
	if err := db.
		Where("key_hash = ? AND scope = ? AND (expires_at IS NULL OR expires_at > ?)", digest, "org", time.Now()).
		First(&k).Error; err != nil {
		return nil
	}
	ok, _ := VerifySecretArgon2id(zeroIfNil(k.SecretHash), secret)
	if !ok || k.OrgID == nil {
		return nil
	}
	var o models.Organization
	if err := db.First(&o, "id = ?", *k.OrgID).Error; err != nil {
		return nil
	}
	return &o
}

// local helper; avoids nil-deref when comparing secrets
func zeroIfNil(s *string) string {
	if s == nil {
		return ""
	}
	return *s
}
</file>

<file path="internal/bg/archer_cleanup.go">
package bg

import (
	"context"
	"time"

	"github.com/dyaksa/archer"
	"github.com/dyaksa/archer/job"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

type CleanupArgs struct {
	RetainDays int    `json:"retain_days"`
	Table      string `json:"table"`
}

type JobRow struct {
	ID        string `gorm:"primaryKey"`
	Status    string
	UpdatedAt time.Time
}

func (JobRow) TableName() string { return "jobs" }

func CleanupWorker(gdb *gorm.DB, jobs *Jobs, retainDays int) archer.WorkerFn {
	return func(ctx context.Context, j job.Job) (any, error) {
		if err := CleanupJobs(gdb, retainDays); err != nil {
			return nil, err
		}

		// schedule tomorrow 03:30
		next := time.Now().Truncate(24 * time.Hour).Add(24 * time.Hour).Add(3*time.Hour + 30*time.Minute)

		_, _ = jobs.Enqueue(
			ctx,
			uuid.NewString(),
			"archer_cleanup",
			CleanupArgs{RetainDays: retainDays, Table: "jobs"},
			archer.WithScheduleTime(next),
			archer.WithMaxRetries(1),
		)
		return nil, nil
	}
}

func CleanupJobs(db *gorm.DB, retainDays int) error {
	cutoff := time.Now().AddDate(0, 0, -retainDays)
	return db.
		Where("status IN ?", []string{"success", "failed", "cancelled"}).
		Where("updated_at < ?", cutoff).
		Delete(&JobRow{}).Error
}
</file>

<file path="internal/bg/backup_s3.go">
package bg

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"mime"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"time"

	"github.com/aws/aws-sdk-go-v2/aws"
	awsconfig "github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/credentials"
	"github.com/aws/aws-sdk-go-v2/service/s3"
	s3types "github.com/aws/aws-sdk-go-v2/service/s3/types"
	"github.com/dyaksa/archer"
	"github.com/dyaksa/archer/job"
	"github.com/glueops/autoglue/internal/config"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/google/uuid"
	"github.com/rs/zerolog/log"
	"gorm.io/gorm"
)

type DbBackupArgs struct {
	IntervalS int `json:"interval_seconds,omitempty"`
}

type s3Scope struct {
	Service string `json:"service"`
	Region  string `json:"region"`
}

type encAWS struct {
	AccessKeyID     string `json:"access_key_id"`
	SecretAccessKey string `json:"secret_access_key"`
}

func DbBackupWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
	return func(ctx context.Context, j job.Job) (any, error) {
		args := DbBackupArgs{IntervalS: 3600}
		_ = j.ParseArguments(&args)

		if args.IntervalS <= 0 {
			args.IntervalS = 3600
		}

		if err := DbBackup(ctx, db); err != nil {
			return nil, err
		}

		queue := j.QueueName
		if strings.TrimSpace(queue) == "" {
			queue = "db_backup_s3"
		}

		next := time.Now().Add(time.Duration(args.IntervalS) * time.Second)

		payload := DbBackupArgs{}

		opts := []archer.FnOptions{
			archer.WithScheduleTime(next),
			archer.WithMaxRetries(1),
		}

		if _, err := jobs.Enqueue(ctx, uuid.NewString(), queue, payload, opts...); err != nil {
			log.Error().Err(err).Str("queue", queue).Time("next", next).Msg("failed to enqueue next db backup")
		} else {
			log.Info().Str("queue", queue).Time("next", next).Msg("scheduled next db backup")
		}
		return nil, nil
	}
}

func DbBackup(ctx context.Context, db *gorm.DB) error {
	cfg, err := config.Load()
	if err != nil {
		return fmt.Errorf("load config: %w", err)
	}

	cred, sc, err := loadS3Credential(ctx, db)
	if err != nil {
		return fmt.Errorf("load credential: %w", err)
	}

	ak, sk, err := decryptAwsAccessKeys(ctx, db, cred)
	if err != nil {
		return fmt.Errorf("decrypt aws keys: %w", err)
	}

	region := sc.Region

	if strings.TrimSpace(region) == "" {
		region = cred.Region
		if strings.TrimSpace(region) == "" {
			region = "us-west-1"
		}
	}

	bucket := strings.ToLower(fmt.Sprintf("%s-autoglue-backups-%s", cred.OrganizationID, region))

	s3cli, err := makeS3Client(ctx, ak, sk, region)
	if err != nil {
		return err
	}

	if err := ensureBucket(ctx, s3cli, bucket, region); err != nil {
		return fmt.Errorf("ensure bucket: %w", err)
	}

	tmpDir := os.TempDir()
	now := time.Now().UTC()
	key := fmt.Sprintf("%04d/%02d/%02d/backup-%02d.sql", now.Year(), now.Month(), now.Day(), now.Hour())
	outPath := filepath.Join(tmpDir, "autoglue-backup-"+now.Format("20060102T150405Z")+".sql")

	if err := runPgDump(ctx, cfg.DbURL, outPath); err != nil {
		return fmt.Errorf("pg_dump: %w", err)
	}
	defer os.Remove(outPath)

	if err := uploadFileToS3(ctx, s3cli, bucket, key, outPath); err != nil {
		return fmt.Errorf("s3 upload: %w", err)
	}

	log.Info().Str("bucket", bucket).Str("key", key).Msg("backup uploaded")

	return nil
}

// --- Helpers

func loadS3Credential(ctx context.Context, db *gorm.DB) (models.Credential, s3Scope, error) {
	var c models.Credential
	err := db.
		WithContext(ctx).
		Where("provider = ? AND kind = ? AND scope_kind = ?", "aws", "aws_access_key", "service").
		Where("scope ->> 'service' = ?", "s3").
		Order("created_at DESC").
		First(&c).Error
	if err != nil {
		return models.Credential{}, s3Scope{}, fmt.Errorf("load credential: %w", err)
	}

	var sc s3Scope
	_ = json.Unmarshal(c.Scope, &sc)
	return c, sc, nil
}

func decryptAwsAccessKeys(ctx context.Context, db *gorm.DB, c models.Credential) (string, string, error) {
	plain, err := utils.DecryptForOrg(c.OrganizationID, c.EncryptedData, c.IV, c.Tag, db)
	if err != nil {
		return "", "", err
	}

	var payload encAWS
	if err := json.Unmarshal([]byte(plain), &payload); err != nil {
		return "", "", fmt.Errorf("parse decrypted payload: %w", err)
	}

	if payload.AccessKeyID == "" || payload.SecretAccessKey == "" {
		return "", "", errors.New("decrypted payload missing keys")
	}
	return payload.AccessKeyID, payload.SecretAccessKey, nil
}

func makeS3Client(ctx context.Context, accessKey, secret, region string) (*s3.Client, error) {
	staticCredentialsProvider := credentials.NewStaticCredentialsProvider(accessKey, secret, "")
	cfg, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithCredentialsProvider(staticCredentialsProvider), awsconfig.WithRegion(region))
	if err != nil {
		return nil, fmt.Errorf("aws config: %w", err)
	}
	return s3.NewFromConfig(cfg), nil
}

func ensureBucket(ctx context.Context, s3cli *s3.Client, bucket, region string) error {
	_, err := s3cli.HeadBucket(ctx, &s3.HeadBucketInput{Bucket: aws.String(bucket)})
	if err == nil {
		return nil
	}

	if out, err := s3cli.GetBucketLocation(ctx, &s3.GetBucketLocationInput{Bucket: aws.String(bucket)}); err == nil {
		existing := string(out.LocationConstraint)
		if existing == "" {
			existing = "us-east-1"
		}
		if existing != region {
			return fmt.Errorf("bucket %q already exists in region %q (requested %q)", bucket, existing, region)
		}
	}

	// Create; LocationConstraint except us-east-1
	in := &s3.CreateBucketInput{Bucket: aws.String(bucket)}
	if region != "us-east-1" {
		in.CreateBucketConfiguration = &s3types.CreateBucketConfiguration{
			LocationConstraint: s3types.BucketLocationConstraint(region),
		}
	}
	if _, err := s3cli.CreateBucket(ctx, in); err != nil {
		return fmt.Errorf("create bucket: %w", err)
	}

	// default SSE (best-effort)
	_, _ = s3cli.PutBucketEncryption(ctx, &s3.PutBucketEncryptionInput{
		Bucket: aws.String(bucket),
		ServerSideEncryptionConfiguration: &s3types.ServerSideEncryptionConfiguration{
			Rules: []s3types.ServerSideEncryptionRule{
				{ApplyServerSideEncryptionByDefault: &s3types.ServerSideEncryptionByDefault{
					SSEAlgorithm: s3types.ServerSideEncryptionAes256,
				}},
			},
		},
	})
	return nil
}

func runPgDump(ctx context.Context, dbURL, outPath string) error {
	if err := os.MkdirAll(filepath.Dir(outPath), 0o755); err != nil {
		return err
	}

	args := []string{
		"--no-owner",
		"--no-privileges",
		"--format=plain",
		"--file", outPath,
		dbURL,
	}

	cmd := exec.CommandContext(ctx, "pg_dump", args...)
	var stderr bytes.Buffer
	cmd.Stderr = &stderr
	if err := cmd.Run(); err != nil {
		return fmt.Errorf("pg_dump failed: %v | %s", err, stderr.String())
	}

	return nil
}

func uploadFileToS3(ctx context.Context, s3cli *s3.Client, bucket, key, path string) error {
	f, err := os.Open(path)
	if err != nil {
		return err
	}

	defer f.Close()

	info, _ := f.Stat()
	_, err = s3cli.PutObject(ctx, &s3.PutObjectInput{
		Bucket:               aws.String(bucket),
		Key:                  aws.String(key),
		Body:                 f,
		ContentLength:        aws.Int64(info.Size()),
		ContentType:          aws.String(mime.TypeByExtension(filepath.Ext(path))),
		ServerSideEncryption: s3types.ServerSideEncryptionAes256,
	})

	return err
}
</file>

<file path="internal/bg/bg.go">
package bg

import (
	"context"
	"net"
	"net/url"
	"strings"
	"time"

	"github.com/dyaksa/archer"
	"github.com/rs/zerolog/log"
	"github.com/spf13/viper"
	"gorm.io/gorm"
)

type Jobs struct{ Client *archer.Client }

func archerOptionsFromDSN(dsn string) (*archer.Options, error) {
	u, err := url.Parse(dsn)
	if err != nil {
		return nil, err
	}

	var user, pass string
	if u.User != nil {
		user = u.User.Username()
		pass, _ = u.User.Password()
	}

	host := u.Host
	if !strings.Contains(host, ":") {
		host = net.JoinHostPort(host, "5432")
	}

	return &archer.Options{
		Addr:     host,
		User:     user,
		Password: pass,
		DBName:   strings.TrimPrefix(u.Path, "/"),
		SSL:      u.Query().Get("sslmode"), // forward sslmode
	}, nil
}

func NewJobs(gdb *gorm.DB, dbUrl string) (*Jobs, error) {
	opts, err := archerOptionsFromDSN(dbUrl)
	if err != nil {
		return nil, err
	}

	instances := viper.GetInt("archer.instances")
	if instances <= 0 {
		instances = 1
	}

	timeoutSec := viper.GetInt("archer.timeoutSec")
	if timeoutSec <= 0 {
		timeoutSec = 60
	}

	retainDays := viper.GetInt("archer.cleanup_retain_days")
	if retainDays <= 0 {
		retainDays = 7
	}

	c := archer.NewClient(
		opts,
		archer.WithSetTableName("jobs"), // <- ensure correct table
		archer.WithSleepInterval(1*time.Second), // fast poll while debugging
		archer.WithErrHandler(func(err error) { // bubble up worker SQL errors
			log.Error().Err(err).Msg("[archer] worker error")
		}),
	)

	jobs := &Jobs{Client: c}

	c.Register(
		"bootstrap_bastion",
		BastionBootstrapWorker(gdb, jobs),
		archer.WithInstances(instances),
		archer.WithTimeout(time.Duration(timeoutSec)*time.Second),
	)

	c.Register(
		"archer_cleanup",
		CleanupWorker(gdb, jobs, retainDays),
		archer.WithInstances(1),
		archer.WithTimeout(5*time.Minute),
	)

	c.Register(
		"tokens_cleanup",
		TokensCleanupWorker(gdb, jobs),
		archer.WithInstances(1),
		archer.WithTimeout(5*time.Minute),
	)

	c.Register(
		"db_backup_s3",
		DbBackupWorker(gdb, jobs),
		archer.WithInstances(1),
		archer.WithTimeout(15*time.Minute),
	)

	c.Register(
		"dns_reconcile",
		DNSReconsileWorker(gdb, jobs),
		archer.WithInstances(1),
		archer.WithTimeout(2*time.Minute),
	)
	/*
		c.Register(
			"prepare_cluster",
			ClusterPrepareWorker(gdb, jobs),
			archer.WithInstances(1),
			archer.WithTimeout(2*time.Minute),
		)

		c.Register(
			"cluster_setup",
			ClusterSetupWorker(gdb, jobs),
			archer.WithInstances(1),
			archer.WithTimeout(2*time.Minute),
		)

		c.Register(
			"cluster_bootstrap",
			ClusterBootstrapWorker(gdb, jobs),
			archer.WithInstances(1),
			archer.WithTimeout(60*time.Minute),
		)

	*/

	c.Register(
		"org_key_sweeper",
		OrgKeySweeperWorker(gdb, jobs),
		archer.WithInstances(1),
		archer.WithTimeout(5*time.Minute),
	)

	c.Register(
		"cluster_action",
		ClusterActionWorker(gdb),
		archer.WithInstances(1),
	)
	return jobs, nil
}

func (j *Jobs) Start() error { return j.Client.Start() }
func (j *Jobs) Stop()        { j.Client.Stop() }

func (j *Jobs) Enqueue(ctx context.Context, id, queue string, args any, opts ...archer.FnOptions) (any, error) {
	return j.Client.Schedule(ctx, id, queue, args, opts...)
}
</file>

<file path="internal/bg/cluster_action.go">
package bg

import (
	"context"
	"encoding/json"
	"fmt"
	"time"

	"github.com/dyaksa/archer"
	"github.com/dyaksa/archer/job"
	"github.com/glueops/autoglue/internal/mapper"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/google/uuid"
	"github.com/rs/zerolog/log"
	"gorm.io/gorm"
)

type ClusterActionArgs struct {
	OrgID      uuid.UUID `json:"org_id"`
	ClusterID  uuid.UUID `json:"cluster_id"`
	Action     string    `json:"action"`
	MakeTarget string    `json:"make_target"`
}

type ClusterActionResult struct {
	Status    string `json:"status"`
	Action    string `json:"action"`
	ClusterID string `json:"cluster_id"`
	ElapsedMs int    `json:"elapsed_ms"`
}

func ClusterActionWorker(db *gorm.DB) archer.WorkerFn {
	return func(ctx context.Context, j job.Job) (any, error) {
		start := time.Now()
		var args ClusterActionArgs
		_ = j.ParseArguments(&args)

		runID, _ := uuid.Parse(j.ID)

		updateRun := func(status string, errMsg string) {
			updates := map[string]any{
				"status": status,
				"error":  errMsg,
			}
			if status == "succeeded" || status == "failed" {
				updates["finished_at"] = time.Now().UTC().Format(time.RFC3339)
			}
			db.Model(&models.ClusterRun{}).Where("id = ?", runID).Updates(updates)
		}

		updateRun("running", "")

		logger := log.With().
			Str("job", j.ID).
			Str("cluster_id", args.ClusterID.String()).
			Str("action", args.Action).
			Logger()

		var c models.Cluster
		if err := db.
			Preload("BastionServer.SshKey").
			Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers.SshKey").
			Where("id = ? AND organization_id = ?", args.ClusterID, args.OrgID).
			First(&c).Error; err != nil {
			updateRun("failed", fmt.Errorf("load cluster: %w", err).Error())
			return nil, fmt.Errorf("load cluster: %w", err)
		}

		// ---- Step 1: Prepare (mostly lifted from ClusterPrepareWorker)
		if err := setClusterStatus(db, c.ID, clusterStatusBootstrapping, ""); err != nil {
			updateRun("failed", err.Error())
			return nil, fmt.Errorf("mark bootstrapping: %w", err)
		}
		c.Status = clusterStatusBootstrapping

		if err := validateClusterForPrepare(&c); err != nil {
			_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
			updateRun("failed", err.Error())
			return nil, fmt.Errorf("validate: %w", err)
		}

		allServers := flattenClusterServers(&c)
		keyPayloads, sshConfig, err := buildSSHAssetsForCluster(db, &c, allServers)
		if err != nil {
			_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
			updateRun("failed", err.Error())
			return nil, fmt.Errorf("build ssh assets: %w", err)
		}

		dtoCluster := mapper.ClusterToDTO(c)

		if c.EncryptedKubeconfig != "" && c.KubeIV != "" && c.KubeTag != "" {
			kubeconfig, err := utils.DecryptForOrg(
				c.OrganizationID,
				c.EncryptedKubeconfig,
				c.KubeIV,
				c.KubeTag,
				db,
			)
			if err != nil {
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
				return nil, fmt.Errorf("decrypt kubeconfig: %w", err)
			}
			dtoCluster.Kubeconfig = &kubeconfig
		}

		orgKey, orgSecret, err := findOrCreateClusterAutomationKey(db, c.OrganizationID, c.ID, 24*time.Hour)
		if err != nil {
			_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
			updateRun("failed", err.Error())
			return nil, fmt.Errorf("org key: %w", err)
		}
		dtoCluster.OrgKey = &orgKey
		dtoCluster.OrgSecret = &orgSecret

		payloadJSON, err := json.MarshalIndent(dtoCluster, "", "  ")
		if err != nil {
			_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
			updateRun("failed", err.Error())
			return nil, fmt.Errorf("marshal payload: %w", err)
		}

		{
			runCtx, cancel := context.WithTimeout(ctx, 8*time.Minute)
			err := pushAssetsToBastion(runCtx, db, &c, sshConfig, keyPayloads, payloadJSON)
			cancel()
			if err != nil {
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
				updateRun("failed", err.Error())
				return nil, fmt.Errorf("push assets: %w", err)
			}
		}

		if err := setClusterStatus(db, c.ID, clusterStatusPending, ""); err != nil {
			updateRun("failed", err.Error())
			return nil, fmt.Errorf("mark pending: %w", err)
		}
		c.Status = clusterStatusPending

		// ---- Step 2: Setup (ping-servers)
		{
			runCtx, cancel := context.WithTimeout(ctx, 30*time.Minute)
			out, err := runMakeOnBastion(runCtx, db, &c, "ping-servers")
			cancel()
			if err != nil {
				logger.Error().Err(err).Str("output", out).Msg("ping-servers failed")
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, fmt.Sprintf("make ping-servers: %v", err))
				updateRun("failed", err.Error())
				return nil, fmt.Errorf("ping-servers: %w", err)
			}
		}

		if err := setClusterStatus(db, c.ID, clusterStatusProvisioning, ""); err != nil {
			updateRun("failed", err.Error())
			return nil, fmt.Errorf("mark provisioning: %w", err)
		}
		c.Status = clusterStatusProvisioning

		// ---- Step 3: Bootstrap (parameterized target)
		{
			runCtx, cancel := context.WithTimeout(ctx, 60*time.Minute)
			out, err := runMakeOnBastion(runCtx, db, &c, args.MakeTarget)
			cancel()
			if err != nil {
				logger.Error().Err(err).Str("output", out).Msg("bootstrap target failed")
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, fmt.Sprintf("make %s: %v", args.MakeTarget, err))
				updateRun("failed", err.Error())
				return nil, fmt.Errorf("make %s: %w", args.MakeTarget, err)
			}
		}

		if err := setClusterStatus(db, c.ID, clusterStatusReady, ""); err != nil {
			updateRun("failed", err.Error())
			return nil, fmt.Errorf("mark ready: %w", err)
		}

		updateRun("succeeded", "")

		return ClusterActionResult{
			Status:    "ok",
			Action:    args.Action,
			ClusterID: c.ID.String(),
			ElapsedMs: int(time.Since(start).Milliseconds()),
		}, nil
	}
}
</file>

<file path="internal/bg/cluster_bootstrap.go">
package bg

import (
	"context"
	"fmt"
	"time"

	"github.com/dyaksa/archer"
	"github.com/dyaksa/archer/job"
	"github.com/glueops/autoglue/internal/models"
	"github.com/google/uuid"
	"github.com/rs/zerolog/log"
	"gorm.io/gorm"
)

type ClusterBootstrapArgs struct {
	IntervalS int `json:"interval_seconds,omitempty"`
}

type ClusterBootstrapResult struct {
	Status    string      `json:"status"`
	Processed int         `json:"processed"`
	Ready     int         `json:"ready"`
	Failed    int         `json:"failed"`
	ElapsedMs int         `json:"elapsed_ms"`
	FailedIDs []uuid.UUID `json:"failed_cluster_ids"`
}

func ClusterBootstrapWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
	return func(ctx context.Context, j job.Job) (any, error) {
		args := ClusterBootstrapArgs{IntervalS: 120}
		jobID := j.ID
		start := time.Now()

		_ = j.ParseArguments(&args)
		if args.IntervalS <= 0 {
			args.IntervalS = 120
		}

		var clusters []models.Cluster
		if err := db.
			Preload("BastionServer.SshKey").
			Where("status = ?", clusterStatusProvisioning).
			Find(&clusters).Error; err != nil {
			log.Error().Err(err).Msg("[cluster_bootstrap] query clusters failed")
			return nil, err
		}

		proc, ready, failCount := 0, 0, 0
		var failedIDs []uuid.UUID

		perClusterTimeout := 60 * time.Minute

		for i := range clusters {
			c := &clusters[i]
			proc++

			if c.BastionServer.ID == uuid.Nil || c.BastionServer.Status != "ready" {
				continue
			}

			logger := log.With().
				Str("job", jobID).
				Str("cluster_id", c.ID.String()).
				Str("cluster_name", c.Name).
				Logger()

			logger.Info().Msg("[cluster_bootstrap] running make bootstrap")

			runCtx, cancel := context.WithTimeout(ctx, perClusterTimeout)
			out, err := runMakeOnBastion(runCtx, db, c, "setup")
			cancel()

			if err != nil {
				failCount++
				failedIDs = append(failedIDs, c.ID)
				logger.Error().Err(err).Str("output", out).Msg("[cluster_bootstrap] make setup failed")
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, fmt.Sprintf("make setup: %v", err))
				continue
			}

			// you can choose a different terminal status here if you like
			if err := setClusterStatus(db, c.ID, clusterStatusReady, ""); err != nil {
				failCount++
				failedIDs = append(failedIDs, c.ID)
				logger.Error().Err(err).Msg("[cluster_bootstrap] failed to mark cluster ready")
				continue
			}

			ready++
			logger.Info().Msg("[cluster_bootstrap] cluster marked ready")
		}

		res := ClusterBootstrapResult{
			Status:    "ok",
			Processed: proc,
			Ready:     ready,
			Failed:    failCount,
			ElapsedMs: int(time.Since(start).Milliseconds()),
			FailedIDs: failedIDs,
		}

		log.Info().
			Int("processed", proc).
			Int("ready", ready).
			Int("failed", failCount).
			Msg("[cluster_bootstrap] reconcile tick ok")

		// self-reschedule
		next := time.Now().Add(time.Duration(args.IntervalS) * time.Second)
		_, _ = jobs.Enqueue(
			ctx,
			uuid.NewString(),
			"cluster_bootstrap",
			args,
			archer.WithScheduleTime(next),
			archer.WithMaxRetries(1),
		)
		return res, nil
	}
}
</file>

<file path="internal/bg/cluster_setup.go">
package bg

import (
	"context"
	"fmt"
	"time"

	"github.com/dyaksa/archer"
	"github.com/dyaksa/archer/job"
	"github.com/glueops/autoglue/internal/models"
	"github.com/google/uuid"
	"github.com/rs/zerolog/log"
	"gorm.io/gorm"
)

type ClusterSetupArgs struct {
	IntervalS int `json:"interval_seconds,omitempty"`
}

type ClusterSetupResult struct {
	Status        string      `json:"status"`
	Processed     int         `json:"processed"`
	Provisioning  int         `json:"provisioning"`
	Failed        int         `json:"failed"`
	ElapsedMs     int         `json:"elapsed_ms"`
	FailedCluster []uuid.UUID `json:"failed_cluster_ids"`
}

func ClusterSetupWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
	return func(ctx context.Context, j job.Job) (any, error) {
		args := ClusterSetupArgs{IntervalS: 120}
		jobID := j.ID
		start := time.Now()

		_ = j.ParseArguments(&args)
		if args.IntervalS <= 0 {
			args.IntervalS = 120
		}

		var clusters []models.Cluster
		if err := db.
			Preload("BastionServer.SshKey").
			Where("status = ?", clusterStatusPending).
			Find(&clusters).Error; err != nil {
			log.Error().Err(err).Msg("[cluster_setup] query clusters failed")
			return nil, err
		}

		proc, prov, failCount := 0, 0, 0
		var failedIDs []uuid.UUID

		perClusterTimeout := 30 * time.Minute

		for i := range clusters {
			c := &clusters[i]
			proc++

			if c.BastionServer.ID == uuid.Nil || c.BastionServer.Status != "ready" {
				continue
			}

			logger := log.With().
				Str("job", jobID).
				Str("cluster_id", c.ID.String()).
				Str("cluster_name", c.Name).
				Logger()

			logger.Info().Msg("[cluster_setup] running make setup")

			runCtx, cancel := context.WithTimeout(ctx, perClusterTimeout)
			out, err := runMakeOnBastion(runCtx, db, c, "ping-servers")
			cancel()

			if err != nil {
				failCount++
				failedIDs = append(failedIDs, c.ID)
				logger.Error().Err(err).Str("output", out).Msg("[cluster_setup] make ping-servers failed")
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, fmt.Sprintf("make ping-servers: %v", err))
				continue
			}

			if err := setClusterStatus(db, c.ID, clusterStatusProvisioning, ""); err != nil {
				failCount++
				failedIDs = append(failedIDs, c.ID)
				logger.Error().Err(err).Msg("[cluster_setup] failed to mark cluster provisioning")
				continue
			}

			prov++
			logger.Info().Msg("[cluster_setup] cluster moved to provisioning")
		}

		res := ClusterSetupResult{
			Status:        "ok",
			Processed:     proc,
			Provisioning:  prov,
			Failed:        failCount,
			ElapsedMs:     int(time.Since(start).Milliseconds()),
			FailedCluster: failedIDs,
		}

		log.Info().
			Int("processed", proc).
			Int("provisioning", prov).
			Int("failed", failCount).
			Msg("[cluster_setup] reconcile tick ok")

		// self-reschedule
		next := time.Now().Add(time.Duration(args.IntervalS) * time.Second)
		_, _ = jobs.Enqueue(
			ctx,
			uuid.NewString(),
			"cluster_setup",
			args,
			archer.WithScheduleTime(next),
			archer.WithMaxRetries(1),
		)
		return res, nil
	}
}
</file>

<file path="internal/bg/dns.go">
package bg

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"strconv"
	"strings"
	"time"

	"github.com/dyaksa/archer"
	"github.com/dyaksa/archer/job"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/google/uuid"
	"github.com/rs/zerolog"
	"github.com/rs/zerolog/log"
	"gorm.io/gorm"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/credentials"
	r53 "github.com/aws/aws-sdk-go-v2/service/route53"
	r53types "github.com/aws/aws-sdk-go-v2/service/route53/types"
	"github.com/aws/smithy-go"
	smithyhttp "github.com/aws/smithy-go/transport/http"
)

/************* args & small DTOs *************/

type DNSReconcileArgs struct {
	MaxDomains int `json:"max_domains,omitempty"`
	MaxRecords int `json:"max_records,omitempty"`
	IntervalS  int `json:"interval_seconds,omitempty"`
}

// TXT marker content (compact)
type ownershipMarker struct {
	Ver string `json:"v"`   // "ag1"
	Org string `json:"org"` // org UUID
	Rec string `json:"rec"` // record UUID
	Fp  string `json:"fp"`  // short fp (first 16 of sha256)
}

// ExternalDNS poison owner id – MUST NOT match any real external-dns --txt-owner-id
const externalDNSPoisonOwner = "autoglue-lock"

// ExternalDNS poison content – fake owner so real external-dns skips it.
const externalDNSPoisonValue = "heritage=external-dns,external-dns/owner=" + externalDNSPoisonOwner + ",external-dns/resource=manual/autoglue"

// Default TTL for non-alias records (alias not supported in this reconciler)
const defaultRecordTTLSeconds int64 = 300

/************* entrypoint worker *************/

func DNSReconsileWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
	return func(ctx context.Context, j job.Job) (any, error) {
		args := DNSReconcileArgs{MaxDomains: 25, MaxRecords: 100, IntervalS: 30}
		_ = j.ParseArguments(&args)

		if args.MaxDomains <= 0 {
			args.MaxDomains = 25
		}
		if args.MaxRecords <= 0 {
			args.MaxRecords = 100
		}
		if args.IntervalS <= 0 {
			args.IntervalS = 30
		}

		processedDomains, processedRecords, err := reconcileDNSOnce(ctx, db, args)
		if err != nil {
			log.Error().Err(err).Msg("[dns] reconcile tick failed")
		} else {
			log.Debug().
				Int("domains", processedDomains).
				Int("records", processedRecords).
				Msg("[dns] reconcile tick ok")
		}

		next := time.Now().Add(time.Duration(args.IntervalS) * time.Second)
		_, _ = jobs.Enqueue(ctx, uuid.NewString(), "dns_reconcile", args,
			archer.WithScheduleTime(next),
			archer.WithMaxRetries(1),
		)

		return map[string]any{
			"domains_processed": processedDomains,
			"records_processed": processedRecords,
		}, nil
	}
}

/************* core tick *************/

func reconcileDNSOnce(ctx context.Context, db *gorm.DB, args DNSReconcileArgs) (int, int, error) {
	var domains []models.Domain

	// 1) validate/backfill pending domains
	if err := db.
		Where("status = ?", "pending").
		Order("created_at ASC").
		Limit(args.MaxDomains).
		Find(&domains).Error; err != nil {
		return 0, 0, err
	}

	domainsProcessed := 0
	for i := range domains {
		if err := processDomain(ctx, db, &domains[i]); err != nil {
			log.Error().Err(err).Str("domain", domains[i].DomainName).Msg("[dns] domain processing failed")
		} else {
			domainsProcessed++
		}
	}

	// 2) apply pending record sets for ready domains
	var readyDomains []models.Domain
	if err := db.Where("status = ?", "ready").Find(&readyDomains).Error; err != nil {
		return domainsProcessed, 0, err
	}

	recordsProcessed := 0
	for i := range readyDomains {
		n, err := processPendingRecordsForDomain(ctx, db, &readyDomains[i], args.MaxRecords)
		if err != nil {
			log.Error().Err(err).Str("domain", readyDomains[i].DomainName).Msg("[dns] record processing failed")
			continue
		}
		recordsProcessed += n
	}

	return domainsProcessed, recordsProcessed, nil
}

/************* domain processing *************/

func processDomain(ctx context.Context, db *gorm.DB, d *models.Domain) error {
	orgID := d.OrganizationID

	// 1) Load credential (org-guarded)
	var cred models.Credential
	if err := db.Where("id = ? AND organization_id = ?", d.CredentialID, orgID).First(&cred).Error; err != nil {
		return setDomainFailed(db, d, fmt.Errorf("credential not found: %w", err))
	}

	// 2) Decrypt → dto.AWSCredential
	secret, err := utils.DecryptForOrg(orgID, cred.EncryptedData, cred.IV, cred.Tag, db)
	if err != nil {
		return setDomainFailed(db, d, fmt.Errorf("decrypt: %w", err))
	}
	var awsCred dto.AWSCredential
	if err := jsonUnmarshalStrict([]byte(secret), &awsCred); err != nil {
		return setDomainFailed(db, d, fmt.Errorf("secret decode: %w", err))
	}

	// 3) Client
	r53c, _, err := newRoute53Client(ctx, awsCred)
	if err != nil {
		return setDomainFailed(db, d, err)
	}

	// 4) Backfill zone id if missing
	zoneID := strings.TrimSpace(d.ZoneID)
	if zoneID == "" {
		zid, err := findHostedZoneID(ctx, r53c, d.DomainName)
		if err != nil {
			return setDomainFailed(db, d, fmt.Errorf("discover zone id: %w", err))
		}
		zoneID = zid
		d.ZoneID = zoneID
	}

	// 5) Sanity: can fetch zone
	if _, err := r53c.GetHostedZone(ctx, &r53.GetHostedZoneInput{Id: aws.String(zoneID)}); err != nil {
		return setDomainFailed(db, d, fmt.Errorf("get hosted zone: %w", err))
	}

	// 6) Mark ready
	d.Status = "ready"
	d.LastError = ""
	if err := db.Save(d).Error; err != nil {
		return err
	}
	return nil
}

func setDomainFailed(db *gorm.DB, d *models.Domain, cause error) error {
	d.Status = "failed"
	d.LastError = truncateErr(cause.Error())
	_ = db.Save(d).Error
	return cause
}

/************* record processing *************/

func processPendingRecordsForDomain(ctx context.Context, db *gorm.DB, d *models.Domain, max int) (int, error) {
	orgID := d.OrganizationID

	// reload credential
	var cred models.Credential
	if err := db.Where("id = ? AND organization_id = ?", d.CredentialID, orgID).First(&cred).Error; err != nil {
		return 0, err
	}

	secret, err := utils.DecryptForOrg(orgID, cred.EncryptedData, cred.IV, cred.Tag, db)
	if err != nil {
		return 0, err
	}

	var awsCred dto.AWSCredential
	if err := jsonUnmarshalStrict([]byte(secret), &awsCred); err != nil {
		return 0, err
	}
	r53c, _, err := newRoute53Client(ctx, awsCred)
	if err != nil {
		return 0, err
	}

	var records []models.RecordSet
	if err := db.
		Where("domain_id = ? AND status = ?", d.ID, "pending").
		Order("created_at ASC").
		Limit(max).
		Find(&records).Error; err != nil {
		return 0, err
	}

	applied := 0
	for i := range records {
		if err := applyRecord(ctx, db, r53c, d, &records[i]); err != nil {
			log.Error().
				Err(err).
				Str("zone_id", d.ZoneID).
				Str("domain", d.DomainName).
				Str("record_id", records[i].ID.String()).
				Str("name", records[i].Name).
				Str("type", strings.ToUpper(records[i].Type)).
				Msg("[dns] apply record failed")
			_ = setRecordFailed(db, &records[i], err)
			continue
		}
		applied++
	}
	return applied, nil
}

// core write + ownership + external-dns hardening

func applyRecord(ctx context.Context, db *gorm.DB, r53c *r53.Client, d *models.Domain, r *models.RecordSet) error {
	zoneID := strings.TrimSpace(d.ZoneID)
	if zoneID == "" {
		return errors.New("domain has no zone_id")
	}

	rt := strings.ToUpper(r.Type)

	// FQDN & marker
	fq := recordFQDN(r.Name, d.DomainName) // ends with "."
	mname := markerName(fq)
	expected := buildMarkerValue(d.OrganizationID.String(), r.ID.String(), r.Fingerprint)

	logCtx := log.With().
		Str("zone_id", zoneID).
		Str("domain", d.DomainName).
		Str("fqdn", fq).
		Str("rr_type", rt).
		Str("record_id", r.ID.String()).
		Str("org_id", d.OrganizationID.String()).
		Logger()

	start := time.Now()

	// ---- ExternalDNS preflight ----
	extOwned, err := hasExternalDNSOwnership(ctx, r53c, zoneID, fq, rt)
	if err != nil {
		return fmt.Errorf("external_dns_lookup: %w", err)
	}
	if extOwned {
		logCtx.Warn().Msg("[dns] ownership conflict: external-dns claims this record")
		r.Owner = "external"
		_ = db.Save(r).Error
		return fmt.Errorf("ownership_conflict: external-dns claims %s; refusing to modify", strings.TrimSuffix(fq, "."))
	}

	// ---- Autoglue ownership preflight via _autoglue.<fqdn> TXT ----
	markerVals, err := getMarkerTXTValues(ctx, r53c, zoneID, mname)
	if err != nil {
		return fmt.Errorf("marker lookup: %w", err)
	}

	hasForeignOwner := false
	hasOurExact := false
	for _, v := range markerVals {
		mk, ok := parseMarkerValue(v)
		if !ok {
			continue
		}
		switch {
		case mk.Org == d.OrganizationID.String() && mk.Rec == r.ID.String() && mk.Fp == shortFP(r.Fingerprint):
			hasOurExact = true
		case mk.Org != d.OrganizationID.String() || mk.Rec != r.ID.String():
			hasForeignOwner = true
		}
	}

	logCtx.Debug().
		Bool("externaldns_owned", extOwned).
		Int("marker_txt_count", len(markerVals)).
		Bool("marker_has_our_exact", hasOurExact).
		Bool("marker_has_foreign", hasForeignOwner).
		Msg("[dns] ownership preflight")

	if hasForeignOwner {
		logCtx.Warn().Msg("[dns] ownership conflict: foreign _autoglue marker")
		r.Owner = "external"
		_ = db.Save(r).Error
		return fmt.Errorf("ownership_conflict: marker for %s is owned by another controller; refusing to modify", strings.TrimSuffix(fq, "."))
	}

	// Decode user values
	var userVals []string
	rawVals := strings.TrimSpace(string(r.Values))
	if rawVals != "" && rawVals != "null" {
		if err := jsonUnmarshalStrict([]byte(rawVals), &userVals); err != nil {
			return fmt.Errorf("values decode: %w", err)
		}
	}

	// Quote TXT values as required by Route53
	recs := make([]r53types.ResourceRecord, 0, len(userVals))
	for _, v := range userVals {
		v = strings.TrimSpace(v)
		if v == "" {
			continue
		}
		if rt == "TXT" && !(strings.HasPrefix(v, `"`) && strings.HasSuffix(v, `"`)) {
			v = strconv.Quote(v)
		}
		recs = append(recs, r53types.ResourceRecord{Value: aws.String(v)})
	}

	// Alias is NOT supported - enforce at least one value for all record types we manage
	if len(recs) == 0 {
		logCtx.Warn().
			Str("raw_values", truncateForLog(string(r.Values), 240)).
			Int("decoded_value_count", len(userVals)).
			Msg("[dns] invalid record: no values (alias not supported)")
		return fmt.Errorf("invalid_record: %s %s requires at least one value (alias not supported)", strings.TrimSuffix(fq, "."), rt)
	}

	ttl := defaultRecordTTLSeconds
	if r.TTL != nil && *r.TTL > 0 {
		ttl = int64(*r.TTL)
	}

	// Build RR change (UPSERT)
	rrChange := r53types.Change{
		Action: r53types.ChangeActionUpsert,
		ResourceRecordSet: &r53types.ResourceRecordSet{
			Name:            aws.String(fq),
			Type:            r53types.RRType(rt),
			TTL:             aws.Int64(ttl),
			ResourceRecords: recs,
		},
	}

	// Build marker TXT change (UPSERT)
	markerChange := r53types.Change{
		Action: r53types.ChangeActionUpsert,
		ResourceRecordSet: &r53types.ResourceRecordSet{
			Name: aws.String(mname),
			Type: r53types.RRTypeTxt,
			TTL:  aws.Int64(defaultRecordTTLSeconds),
			ResourceRecords: []r53types.ResourceRecord{
				{Value: aws.String(strconv.Quote(expected))},
			},
		},
	}

	// Build external-dns poison TXT changes
	poisonChanges := buildExternalDNSPoisonTXTChanges(fq, rt)

	// Apply all in one batch (atomic-ish)
	changes := []r53types.Change{rrChange, markerChange}
	changes = append(changes, poisonChanges...)

	// Log what we are about to send
	logCtx.Debug().
		Interface("route53_change_batch", toLogChangeBatch(zoneID, changes)).
		Msg("[dns] route53 request preview")

	_, err = r53c.ChangeResourceRecordSets(ctx, &r53.ChangeResourceRecordSetsInput{
		HostedZoneId: aws.String(zoneID),
		ChangeBatch:  &r53types.ChangeBatch{Changes: changes},
	})
	if err != nil {
		logAWSError(logCtx, err)
		logCtx.Info().Dur("elapsed", time.Since(start)).Msg("[dns] apply failed")
		return err
	}

	logCtx.Info().
		Dur("elapsed", time.Since(start)).
		Int("change_count", len(changes)).
		Msg("[dns] apply ok")

	// Success → mark ready & ownership
	r.Status = "ready"
	r.LastError = ""
	r.Owner = "autoglue"
	if err := db.Save(r).Error; err != nil {
		return err
	}

	_ = hasOurExact // could be used to skip marker write in future
	return nil
}

func setRecordFailed(db *gorm.DB, r *models.RecordSet, cause error) error {
	msg := truncateErr(cause.Error())
	r.Status = "failed"
	r.LastError = msg
	// classify ownership on conflict
	if strings.HasPrefix(msg, "ownership_conflict") {
		r.Owner = "external"
	} else if r.Owner == "" || r.Owner == "unknown" {
		r.Owner = "unknown"
	}
	_ = db.Save(r).Error
	return cause
}

/************* AWS helpers *************/

func newRoute53Client(ctx context.Context, cred dto.AWSCredential) (*r53.Client, *aws.Config, error) {
	// Route53 is global, but config still wants a region
	region := strings.TrimSpace(cred.Region)
	if region == "" {
		region = "us-east-1"
	}
	cfg, err := config.LoadDefaultConfig(ctx,
		config.WithRegion(region),
		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
			cred.AccessKeyID, cred.SecretAccessKey, "",
		)),
	)
	if err != nil {
		return nil, nil, err
	}
	return r53.NewFromConfig(cfg), &cfg, nil
}

func findHostedZoneID(ctx context.Context, c *r53.Client, domain string) (string, error) {
	d := normalizeDomain(domain)
	out, err := c.ListHostedZonesByName(ctx, &r53.ListHostedZonesByNameInput{
		DNSName: aws.String(d),
	})
	if err != nil {
		return "", err
	}
	for _, hz := range out.HostedZones {
		if strings.TrimSuffix(aws.ToString(hz.Name), ".") == d {
			return trimZoneID(aws.ToString(hz.Id)), nil
		}
	}
	return "", fmt.Errorf("hosted zone not found for %q", d)
}

func trimZoneID(id string) string {
	return strings.TrimPrefix(id, "/hostedzone/")
}

func normalizeDomain(s string) string {
	s = strings.TrimSpace(strings.ToLower(s))
	return strings.TrimSuffix(s, ".")
}

func recordFQDN(name, domain string) string {
	name = strings.TrimSpace(name)
	if name == "" || name == "@" {
		return normalizeDomain(domain) + "."
	}
	if strings.HasSuffix(name, ".") {
		return name
	}
	return fmt.Sprintf("%s.%s.", name, normalizeDomain(domain))
}

/************* TXT marker / external-dns helpers *************/

func markerName(fqdn string) string {
	trimmed := strings.TrimSuffix(fqdn, ".")
	return "_autoglue." + trimmed + "."
}

func shortFP(full string) string {
	if len(full) > 16 {
		return full[:16]
	}
	return full
}

func buildMarkerValue(orgID, recID, fp string) string {
	return "v=ag1 org=" + orgID + " rec=" + recID + " fp=" + shortFP(fp)
}

func parseMarkerValue(s string) (ownershipMarker, bool) {
	out := ownershipMarker{}
	fields := strings.Fields(s)
	if len(fields) < 4 {
		return out, false
	}
	kv := map[string]string{}
	for _, f := range fields {
		parts := strings.SplitN(f, "=", 2)
		if len(parts) == 2 {
			kv[parts[0]] = parts[1]
		}
	}
	if kv["v"] == "" || kv["org"] == "" || kv["rec"] == "" || kv["fp"] == "" {
		return out, false
	}
	out.Ver, out.Org, out.Rec, out.Fp = kv["v"], kv["org"], kv["rec"], kv["fp"]
	return out, true
}

func getMarkerTXTValues(ctx context.Context, c *r53.Client, zoneID, marker string) ([]string, error) {
	return getTXTValues(ctx, c, zoneID, marker)
}

// generic TXT fetcher
func getTXTValues(ctx context.Context, c *r53.Client, zoneID, name string) ([]string, error) {
	out, err := c.ListResourceRecordSets(ctx, &r53.ListResourceRecordSetsInput{
		HostedZoneId:    aws.String(zoneID),
		StartRecordName: aws.String(name),
		StartRecordType: r53types.RRTypeTxt,
		MaxItems:        aws.Int32(1),
	})
	if err != nil {
		return nil, err
	}
	if len(out.ResourceRecordSets) == 0 {
		return nil, nil
	}
	rrset := out.ResourceRecordSets[0]
	if aws.ToString(rrset.Name) != name || rrset.Type != r53types.RRTypeTxt {
		return nil, nil
	}
	vals := make([]string, 0, len(rrset.ResourceRecords))
	for _, rr := range rrset.ResourceRecords {
		vals = append(vals, aws.ToString(rr.Value))
	}
	return vals, nil
}

// detect external-dns-style ownership for this fqdn/type
func hasExternalDNSOwnership(ctx context.Context, c *r53.Client, zoneID, fqdn, rrType string) (bool, error) {
	base := strings.TrimSuffix(fqdn, ".")
	candidates := []string{
		// with txtPrefix=extdns-, external-dns writes both:
		// extdns-<fqdn> and extdns-<rrtype-lc>-<fqdn>
		"extdns-" + base + ".",
		"extdns-" + strings.ToLower(rrType) + "-" + base + ".",
	}
	for _, name := range candidates {
		vals, err := getTXTValues(ctx, c, zoneID, name)
		if err != nil {
			return false, err
		}
		for _, raw := range vals {
			v := strings.TrimSpace(raw)
			// strip surrounding quotes if present
			if len(v) >= 2 && v[0] == '"' && v[len(v)-1] == '"' {
				if unq, err := strconv.Unquote(v); err == nil {
					v = unq
				}
			}
			meta := parseExternalDNSMeta(v)
			if meta == nil {
				continue
			}
			if meta["heritage"] == "external-dns" &&
				meta["external-dns/owner"] != "" &&
				meta["external-dns/owner"] != externalDNSPoisonOwner {
				return true, nil
			}
		}
	}
	return false, nil
}

// parseExternalDNSMeta parses the comma-separated external-dns TXT format into a small map.
func parseExternalDNSMeta(v string) map[string]string {
	parts := strings.Split(v, ",")
	if len(parts) == 0 {
		return nil
	}
	meta := make(map[string]string, len(parts))
	for _, p := range parts {
		p = strings.TrimSpace(p)
		if p == "" {
			continue
		}
		kv := strings.SplitN(p, "=", 2)
		if len(kv) != 2 {
			continue
		}
		meta[kv[0]] = kv[1]
	}
	if len(meta) == 0 {
		return nil
	}
	return meta
}

// build poison TXT records so external-dns thinks some *other* owner manages this
func buildExternalDNSPoisonTXTChanges(fqdn, rrType string) []r53types.Change {
	base := strings.TrimSuffix(fqdn, ".")
	names := []string{
		"extdns-" + base + ".",
		"extdns-" + strings.ToLower(rrType) + "-" + base + ".",
	}
	val := strconv.Quote(externalDNSPoisonValue)
	changes := make([]r53types.Change, 0, len(names))
	for _, n := range names {
		changes = append(changes, r53types.Change{
			Action: r53types.ChangeActionUpsert,
			ResourceRecordSet: &r53types.ResourceRecordSet{
				Name: aws.String(n),
				Type: r53types.RRTypeTxt,
				TTL:  aws.Int64(defaultRecordTTLSeconds),
				ResourceRecords: []r53types.ResourceRecord{
					{Value: aws.String(val)},
				},
			},
		})
	}
	return changes
}

/************* misc utils *************/

func truncateErr(s string) string {
	const max = 2000
	if len(s) > max {
		return s[:max]
	}
	return s
}

// Strict unmarshal that treats "null" -> zero value correctly.
func jsonUnmarshalStrict(b []byte, dst any) error {
	if len(b) == 0 {
		return errors.New("empty json")
	}
	return json.Unmarshal(b, dst)
}

/************* logging DTOs & helpers *************/

type logRR struct {
	Value string `json:"value"`
}

type logRRSet struct {
	Action         string  `json:"action"`
	Name           string  `json:"name"`
	Type           string  `json:"type"`
	TTL            *int64  `json:"ttl,omitempty"`
	Records        []logRR `json:"records,omitempty"`
	RecordCount    int     `json:"record_count"`
	HasAliasTarget bool    `json:"has_alias_target"`
	SetIdentifier  *string `json:"set_identifier,omitempty"`
}

type logChangeBatch struct {
	HostedZoneID string     `json:"hosted_zone_id"`
	ChangeCount  int        `json:"change_count"`
	Changes      []logRRSet `json:"changes"`
}

func truncateForLog(s string, max int) string {
	s = strings.TrimSpace(s)
	if max <= 0 || len(s) <= max {
		return s
	}
	return s[:max] + "…"
}

func toLogChangeBatch(zoneID string, changes []r53types.Change) logChangeBatch {
	out := logChangeBatch{
		HostedZoneID: zoneID,
		ChangeCount:  len(changes),
		Changes:      make([]logRRSet, 0, len(changes)),
	}

	for _, ch := range changes {
		if ch.ResourceRecordSet == nil {
			continue
		}
		rrs := ch.ResourceRecordSet
		lc := logRRSet{
			Action:         string(ch.Action),
			Name:           aws.ToString(rrs.Name),
			Type:           string(rrs.Type),
			TTL:            rrs.TTL,
			HasAliasTarget: rrs.AliasTarget != nil,
			SetIdentifier:  rrs.SetIdentifier,
			RecordCount:    len(rrs.ResourceRecords),
			Records:        make([]logRR, 0, min(len(rrs.ResourceRecords), 5)),
		}

		// Log up to first 5 values (truncate each) to avoid log bloat / secrets
		for i, rr := range rrs.ResourceRecords {
			if i >= 5 {
				break
			}
			lc.Records = append(lc.Records, logRR{Value: truncateForLog(aws.ToString(rr.Value), 160)})
		}

		out.Changes = append(out.Changes, lc)
	}
	return out
}

func min(a, b int) int {
	if a < b {
		return a
	}
	return b
}

// logAWSError extracts useful smithy/HTTP metadata (status code + request id + api code) into logs.
// logAWSError extracts useful smithy/HTTP metadata (status code + request id + api code) into logs.
func logAWSError(l zerolog.Logger, err error) {
	// Add operation context if present
	var opErr *smithy.OperationError
	if errors.As(err, &opErr) {
		l = l.With().
			Str("aws_service", opErr.ServiceID).
			Str("aws_operation", opErr.OperationName).
			Logger()
		err = opErr.Unwrap()
	}

	// HTTP status + request id (smithy-go transport/http)
	var re *smithyhttp.ResponseError
	if errors.As(err, &re) {
		status := re.HTTPStatusCode()

		reqID := ""
		if resp := re.HTTPResponse(); resp != nil && resp.Header != nil {
			reqID = resp.Header.Get("x-amzn-RequestId")
			if reqID == "" {
				reqID = resp.Header.Get("x-amz-request-id")
			}
		}

		ev := l.Error().Int("http_status", status).Err(err)
		if reqID != "" {
			ev = ev.Str("aws_request_id", reqID)
		}
		ev.Msg("[dns] aws route53 call failed")
		return
	}

	// API error code/message (best-effort)
	var apiErr smithy.APIError
	if errors.As(err, &apiErr) {
		l.Error().
			Str("aws_error_code", apiErr.ErrorCode()).
			Str("aws_error_message", apiErr.ErrorMessage()).
			Err(err).
			Msg("[dns] aws route53 api error")
		return
	}

	l.Error().Err(err).Msg("[dns] aws route53 error")
}
</file>

<file path="internal/bg/org_key_sweeper.go">
package bg

import (
	"context"
	"time"

	"github.com/dyaksa/archer"
	"github.com/dyaksa/archer/job"
	"github.com/glueops/autoglue/internal/models"
	"github.com/google/uuid"
	"github.com/rs/zerolog/log"
	"gorm.io/gorm"
)

type OrgKeySweeperArgs struct {
	IntervalS     int `json:"interval_seconds,omitempty"`
	RetentionDays int `json:"retention_days,omitempty"`
}

type OrgKeySweeperResult struct {
	Status           string `json:"status"`
	MarkedRevoked    int    `json:"marked_revoked"`
	DeletedEphemeral int    `json:"deleted_ephemeral"`
	ElapsedMs        int    `json:"elapsed_ms"`
}

func OrgKeySweeperWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
	return func(ctx context.Context, j job.Job) (any, error) {
		args := OrgKeySweeperArgs{
			IntervalS:     3600,
			RetentionDays: 10,
		}
		start := time.Now()

		_ = j.ParseArguments(&args)
		if args.IntervalS <= 0 {
			args.IntervalS = 3600
		}
		if args.RetentionDays <= 0 {
			args.RetentionDays = 10
		}

		now := time.Now()

		// 1) Mark expired keys as revoked
		res1 := db.Model(&models.APIKey{}).
			Where("expires_at IS NOT NULL AND expires_at <= ? AND revoked = false", now).
			Updates(map[string]any{
				"revoked":    true,
				"updated_at": now,
			})

		if res1.Error != nil {
			log.Error().Err(res1.Error).Msg("[org_key_sweeper] mark expired revoked failed")
			return nil, res1.Error
		}
		markedRevoked := int(res1.RowsAffected)

		// 2) Hard-delete ephemeral keys that are revoked and older than retention
		cutoff := now.Add(-time.Duration(args.RetentionDays) * 24 * time.Hour)
		res2 := db.
			Where("is_ephemeral = ? AND revoked = ? AND updated_at <= ?", true, true, cutoff).
			Delete(&models.APIKey{})

		if res2.Error != nil {
			log.Error().Err(res2.Error).Msg("[org_key_sweeper] delete revoked ephemeral keys failed")
			return nil, res2.Error
		}
		deletedEphemeral := int(res2.RowsAffected)

		out := OrgKeySweeperResult{
			Status:           "ok",
			MarkedRevoked:    markedRevoked,
			DeletedEphemeral: deletedEphemeral,
			ElapsedMs:        int(time.Since(start).Milliseconds()),
		}

		log.Info().
			Int("marked_revoked", markedRevoked).
			Int("deleted_ephemeral", deletedEphemeral).
			Msg("[org_key_sweeper] cleanup tick ok")

		// Re-enqueue the sweeper
		next := time.Now().Add(time.Duration(args.IntervalS) * time.Second)
		_, _ = jobs.Enqueue(
			ctx,
			uuid.NewString(),
			"org_key_sweeper",
			args,
			archer.WithScheduleTime(next),
			archer.WithMaxRetries(1),
		)
		return out, nil
	}
}
</file>

<file path="internal/bg/prepare_cluster.go">
package bg

import (
	"bytes"
	"context"
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"net"
	"strings"
	"time"

	"github.com/dyaksa/archer"
	"github.com/dyaksa/archer/job"
	"github.com/glueops/autoglue/internal/auth"
	"github.com/glueops/autoglue/internal/mapper"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/google/uuid"
	"github.com/rs/zerolog/log"
	"golang.org/x/crypto/ssh"
	"gorm.io/gorm"
)

type ClusterPrepareArgs struct {
	IntervalS int `json:"interval_seconds,omitempty"`
}

type ClusterPrepareFailure struct {
	ClusterID uuid.UUID `json:"cluster_id"`
	Step      string    `json:"step"`
	Reason    string    `json:"reason"`
}

type ClusterPrepareResult struct {
	Status        string                  `json:"status"`
	Processed     int                     `json:"processed"`
	MarkedPending int                     `json:"marked_pending"`
	Failed        int                     `json:"failed"`
	ElapsedMs     int                     `json:"elapsed_ms"`
	FailedIDs     []uuid.UUID             `json:"failed_cluster_ids"`
	Failures      []ClusterPrepareFailure `json:"failures"`
}

// Alias the status constants from models to avoid string drift.
const (
	clusterStatusPrePending    = models.ClusterStatusPrePending
	clusterStatusPending       = models.ClusterStatusPending
	clusterStatusProvisioning  = models.ClusterStatusProvisioning
	clusterStatusReady         = models.ClusterStatusReady
	clusterStatusFailed        = models.ClusterStatusFailed
	clusterStatusBootstrapping = models.ClusterStatusBootstrapping
)

func ClusterPrepareWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
	return func(ctx context.Context, j job.Job) (any, error) {
		args := ClusterPrepareArgs{IntervalS: 120}
		jobID := j.ID
		start := time.Now()

		_ = j.ParseArguments(&args)
		if args.IntervalS <= 0 {
			args.IntervalS = 120
		}

		// Load all clusters that are pre_pending; we’ll filter for bastion.ready in memory.
		var clusters []models.Cluster
		if err := db.
			Preload("BastionServer.SshKey").
			Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers.SshKey").
			Where("status = ?", clusterStatusPrePending).
			Find(&clusters).Error; err != nil {
			log.Error().Err(err).Msg("[cluster_prepare] query clusters failed")
			return nil, err
		}

		proc, ok, fail := 0, 0, 0
		var failedIDs []uuid.UUID
		var failures []ClusterPrepareFailure

		perClusterTimeout := 8 * time.Minute

		for i := range clusters {
			c := &clusters[i]
			proc++

			// bastion must exist and be ready
			if c.BastionServer == nil || c.BastionServerID == nil || *c.BastionServerID == uuid.Nil || c.BastionServer.Status != "ready" {
				continue
			}

			if err := setClusterStatus(db, c.ID, clusterStatusBootstrapping, ""); err != nil {
				log.Error().Err(err).Msg("[cluster_prepare] failed to mark cluster bootstrapping")
				continue
			}

			c.Status = clusterStatusBootstrapping

			clusterLog := log.With().
				Str("job", jobID).
				Str("cluster_id", c.ID.String()).
				Str("cluster_name", c.Name).
				Logger()

			clusterLog.Info().Msg("[cluster_prepare] starting")

			if err := validateClusterForPrepare(c); err != nil {
				fail++
				failedIDs = append(failedIDs, c.ID)
				failures = append(failures, ClusterPrepareFailure{
					ClusterID: c.ID,
					Step:      "validate",
					Reason:    err.Error(),
				})
				clusterLog.Error().Err(err).Msg("[cluster_prepare] validation failed")
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
				continue
			}

			allServers := flattenClusterServers(c)
			keyPayloads, sshConfig, err := buildSSHAssetsForCluster(db, c, allServers)
			if err != nil {
				fail++
				failedIDs = append(failedIDs, c.ID)
				failures = append(failures, ClusterPrepareFailure{
					ClusterID: c.ID,
					Step:      "build_ssh_assets",
					Reason:    err.Error(),
				})
				clusterLog.Error().Err(err).Msg("[cluster_prepare] build ssh assets failed")
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
				continue
			}

			dtoCluster := mapper.ClusterToDTO(*c)

			if c.EncryptedKubeconfig != "" && c.KubeIV != "" && c.KubeTag != "" {
				kubeconfig, err := utils.DecryptForOrg(
					c.OrganizationID,
					c.EncryptedKubeconfig,
					c.KubeIV,
					c.KubeTag,
					db,
				)
				if err != nil {
					fail++
					failedIDs = append(failedIDs, c.ID)
					failures = append(failures, ClusterPrepareFailure{
						ClusterID: c.ID,
						Step:      "decrypt_kubeconfig",
						Reason:    err.Error(),
					})
					clusterLog.Error().Err(err).Msg("[cluster_prepare] decrypt kubeconfig failed")
					_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
					continue
				}
				dtoCluster.Kubeconfig = &kubeconfig
			}

			orgKey, orgSecret, err := findOrCreateClusterAutomationKey(
				db,
				c.OrganizationID,
				c.ID,
				24*time.Hour,
			)

			if err != nil {
				fail++
				failedIDs = append(failedIDs, c.ID)
				failures = append(failures, ClusterPrepareFailure{
					ClusterID: c.ID,
					Step:      "create_org_key",
					Reason:    err.Error(),
				})
				clusterLog.Error().Err(err).Msg("[cluster_prepare] create org key for payload failed")
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
				continue
			}

			dtoCluster.OrgKey = &orgKey
			dtoCluster.OrgSecret = &orgSecret

			payloadJSON, err := json.MarshalIndent(dtoCluster, "", "  ")
			if err != nil {
				fail++
				failedIDs = append(failedIDs, c.ID)
				failures = append(failures, ClusterPrepareFailure{
					ClusterID: c.ID,
					Step:      "marshal_payload",
					Reason:    err.Error(),
				})
				clusterLog.Error().Err(err).Msg("[cluster_prepare] json marshal failed")
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
				continue
			}

			runCtx, cancel := context.WithTimeout(ctx, perClusterTimeout)
			err = pushAssetsToBastion(runCtx, db, c, sshConfig, keyPayloads, payloadJSON)
			cancel()

			if err != nil {
				fail++
				failedIDs = append(failedIDs, c.ID)
				failures = append(failures, ClusterPrepareFailure{
					ClusterID: c.ID,
					Step:      "ssh_push",
					Reason:    err.Error(),
				})
				clusterLog.Error().Err(err).Msg("[cluster_prepare] failed to push assets to bastion")
				_ = setClusterStatus(db, c.ID, clusterStatusFailed, err.Error())
				continue
			}

			if err := setClusterStatus(db, c.ID, clusterStatusPending, ""); err != nil {
				fail++
				failedIDs = append(failedIDs, c.ID)
				failures = append(failures, ClusterPrepareFailure{
					ClusterID: c.ID,
					Step:      "set_pending",
					Reason:    err.Error(),
				})
				clusterLog.Error().Err(err).Msg("[cluster_prepare] failed to mark cluster pending")
				continue
			}

			ok++
			clusterLog.Info().Msg("[cluster_prepare] cluster marked pending")
		}

		res := ClusterPrepareResult{
			Status:        "ok",
			Processed:     proc,
			MarkedPending: ok,
			Failed:        fail,
			ElapsedMs:     int(time.Since(start).Milliseconds()),
			FailedIDs:     failedIDs,
			Failures:      failures,
		}

		log.Info().
			Int("processed", proc).
			Int("pending", ok).
			Int("failed", fail).
			Msg("[cluster_prepare] reconcile tick ok")

		next := time.Now().Add(time.Duration(args.IntervalS) * time.Second)
		_, _ = jobs.Enqueue(
			ctx,
			uuid.NewString(),
			"prepare_cluster",
			args,
			archer.WithScheduleTime(next),
			archer.WithMaxRetries(1),
		)
		return res, nil
	}
}

// ---------- helpers ----------

func validateClusterForPrepare(c *models.Cluster) error {
	if c.BastionServer == nil || c.BastionServerID == nil || *c.BastionServerID == uuid.Nil {
		return fmt.Errorf("missing bastion server")
	}
	if c.BastionServer.Status != "ready" {
		return fmt.Errorf("bastion server not ready (status=%s)", c.BastionServer.Status)
	}

	// CaptainDomain is a value type; presence is via *ID
	if c.CaptainDomainID == nil || *c.CaptainDomainID == uuid.Nil {
		return fmt.Errorf("missing captain domain for cluster")
	}

	// ControlPlaneRecordSet is a pointer; presence is via *ID + non-nil struct
	if c.ControlPlaneRecordSetID == nil || *c.ControlPlaneRecordSetID == uuid.Nil || c.ControlPlaneRecordSet == nil {
		return fmt.Errorf("missing control_plane_record_set for cluster")
	}

	if len(c.NodePools) == 0 {
		return fmt.Errorf("cluster has no node pools")
	}

	hasServer := false
	for i := range c.NodePools {
		if len(c.NodePools[i].Servers) > 0 {
			hasServer = true
			break
		}
	}
	if !hasServer {
		return fmt.Errorf("cluster has no servers attached to node pools")
	}

	return nil
}

func flattenClusterServers(c *models.Cluster) []*models.Server {
	var out []*models.Server
	for i := range c.NodePools {
		for j := range c.NodePools[i].Servers {
			s := &c.NodePools[i].Servers[j]
			out = append(out, s)
		}
	}
	return out
}

type keyPayload struct {
	FileName      string
	PrivateKeyB64 string
}

// build ssh-config for all servers + decrypt keys.
// ssh-config is intended to live on the bastion and connect via *private* IPs.
func buildSSHAssetsForCluster(db *gorm.DB, c *models.Cluster, servers []*models.Server) (map[uuid.UUID]keyPayload, string, error) {
	var sb strings.Builder
	keys := make(map[uuid.UUID]keyPayload)

	for _, s := range servers {
		// Defensive checks
		if strings.TrimSpace(s.PrivateIPAddress) == "" {
			return nil, "", fmt.Errorf("server %s missing private ip", s.ID)
		}
		if s.SshKeyID == uuid.Nil {
			return nil, "", fmt.Errorf("server %s missing ssh key relation", s.ID)
		}

		// de-dupe keys: many servers may share the same ssh key
		if _, ok := keys[s.SshKeyID]; !ok {
			priv, err := utils.DecryptForOrg(
				s.OrganizationID,
				s.SshKey.EncryptedPrivateKey,
				s.SshKey.PrivateIV,
				s.SshKey.PrivateTag,
				db,
			)
			if err != nil {
				return nil, "", fmt.Errorf("decrypt key for server %s: %w", s.ID, err)
			}

			fname := fmt.Sprintf("%s.pem", s.SshKeyID.String())
			keys[s.SshKeyID] = keyPayload{
				FileName:      fname,
				PrivateKeyB64: base64.StdEncoding.EncodeToString([]byte(priv)),
			}
		}

		// ssh config entry per server
		keyFile := keys[s.SshKeyID].FileName

		hostAlias := s.Hostname
		if hostAlias == "" {
			hostAlias = s.ID.String()
		}

		sb.WriteString(fmt.Sprintf("Host %s\n", hostAlias))
		sb.WriteString(fmt.Sprintf("  HostName %s\n", s.PrivateIPAddress))
		sb.WriteString(fmt.Sprintf("  User %s\n", s.SSHUser))
		sb.WriteString(fmt.Sprintf("  IdentityFile ~/.ssh/autoglue/keys/%s\n", keyFile))
		sb.WriteString("  IdentitiesOnly yes\n")
		sb.WriteString("  StrictHostKeyChecking accept-new\n\n")
	}

	return keys, sb.String(), nil
}

func pushAssetsToBastion(
	ctx context.Context,
	db *gorm.DB,
	c *models.Cluster,
	sshConfig string,
	keyPayloads map[uuid.UUID]keyPayload,
	payloadJSON []byte,
) error {
	bastion := c.BastionServer
	if bastion == nil {
		return fmt.Errorf("bastion server is nil")
	}

	if bastion.PublicIPAddress == nil || strings.TrimSpace(*bastion.PublicIPAddress) == "" {
		return fmt.Errorf("bastion server missing public ip")
	}

	privKey, err := utils.DecryptForOrg(
		bastion.OrganizationID,
		bastion.SshKey.EncryptedPrivateKey,
		bastion.SshKey.PrivateIV,
		bastion.SshKey.PrivateTag,
		db,
	)
	if err != nil {
		return fmt.Errorf("decrypt bastion key: %w", err)
	}

	signer, err := ssh.ParsePrivateKey([]byte(privKey))
	if err != nil {
		return fmt.Errorf("parse bastion private key: %w", err)
	}

	hkcb := makeDBHostKeyCallback(db, bastion)

	config := &ssh.ClientConfig{
		User:            bastion.SSHUser,
		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
		HostKeyCallback: hkcb,
		Timeout:         30 * time.Second,
	}

	host := net.JoinHostPort(*bastion.PublicIPAddress, "22")

	dialer := &net.Dialer{}
	conn, err := dialer.DialContext(ctx, "tcp", host)
	if err != nil {
		return fmt.Errorf("dial bastion: %w", err)
	}
	defer conn.Close()

	cconn, chans, reqs, err := ssh.NewClientConn(conn, host, config)
	if err != nil {
		return fmt.Errorf("ssh handshake bastion: %w", err)
	}
	client := ssh.NewClient(cconn, chans, reqs)
	defer client.Close()

	sess, err := client.NewSession()
	if err != nil {
		return fmt.Errorf("ssh session: %w", err)
	}
	defer sess.Close()

	// build one shot script to:
	// - mkdir ~/.ssh/autoglue/keys
	// - write cluster-specific ssh-config
	// - write all private keys
	// - write payload.json
	clusterDir := fmt.Sprintf("$HOME/autoglue/clusters/%s", c.ID.String())
	configPath := fmt.Sprintf("$HOME/.ssh/autoglue/cluster-%s.config", c.ID.String())

	var script bytes.Buffer

	script.WriteString("set -euo pipefail\n")
	script.WriteString("mkdir -p \"$HOME/.ssh/autoglue/keys\"\n")
	script.WriteString("mkdir -p " + clusterDir + "\n")
	script.WriteString("chmod 700 \"$HOME/.ssh\" || true\n")

	// ssh-config
	script.WriteString("cat > " + configPath + " <<'EOF_CFG'\n")
	script.WriteString(sshConfig)
	script.WriteString("EOF_CFG\n")
	script.WriteString("chmod 600 " + configPath + "\n")

	// keys
	for id, kp := range keyPayloads {
		tag := "KEY_" + id.String()
		target := fmt.Sprintf("$HOME/.ssh/autoglue/keys/%s", kp.FileName)

		script.WriteString("cat <<'" + tag + "' | base64 -d > " + target + "\n")
		script.WriteString(kp.PrivateKeyB64 + "\n")
		script.WriteString(tag + "\n")
		script.WriteString("chmod 600 " + target + "\n")
	}

	// payload.json
	payloadPath := clusterDir + "/payload.json"
	script.WriteString("cat > " + payloadPath + " <<'EOF_PAYLOAD'\n")
	script.Write(payloadJSON)
	script.WriteString("\nEOF_PAYLOAD\n")
	script.WriteString("chmod 600 " + payloadPath + "\n")

	// If you later want to always include cluster configs automatically, you can
	// optionally manage ~/.ssh/config here (kept simple for now).

	sess.Stdin = strings.NewReader(script.String())
	out, runErr := sess.CombinedOutput("bash -s")

	if runErr != nil {
		return wrapSSHError(runErr, string(out))
	}
	return nil
}

func setClusterStatus(db *gorm.DB, id uuid.UUID, status, lastError string) error {
	updates := map[string]any{
		"status":     status,
		"updated_at": time.Now(),
	}
	if lastError != "" {
		updates["last_error"] = lastError
	}
	return db.Model(&models.Cluster{}).
		Where("id = ?", id).
		Updates(updates).Error
}

// runMakeOnBastion runs `make <target>` from the cluster's directory on the bastion.
func runMakeOnBastion(
	ctx context.Context,
	db *gorm.DB,
	c *models.Cluster,
	target string,
) (string, error) {
	logger := log.With().
		Str("cluster_id", c.ID.String()).
		Str("cluster_name", c.Name).
		Logger()

	bastion := c.BastionServer
	if bastion == nil {
		return "", fmt.Errorf("bastion server is nil")
	}

	if bastion.PublicIPAddress == nil || strings.TrimSpace(*bastion.PublicIPAddress) == "" {
		return "", fmt.Errorf("bastion server missing public ip")
	}

	privKey, err := utils.DecryptForOrg(
		bastion.OrganizationID,
		bastion.SshKey.EncryptedPrivateKey,
		bastion.SshKey.PrivateIV,
		bastion.SshKey.PrivateTag,
		db,
	)
	if err != nil {
		return "", fmt.Errorf("decrypt bastion key: %w", err)
	}

	signer, err := ssh.ParsePrivateKey([]byte(privKey))
	if err != nil {
		return "", fmt.Errorf("parse bastion private key: %w", err)
	}

	hkcb := makeDBHostKeyCallback(db, bastion)

	config := &ssh.ClientConfig{
		User:            bastion.SSHUser,
		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
		HostKeyCallback: hkcb,
		Timeout:         30 * time.Second,
	}

	host := net.JoinHostPort(*bastion.PublicIPAddress, "22")

	dialer := &net.Dialer{}
	conn, err := dialer.DialContext(ctx, "tcp", host)
	if err != nil {
		return "", fmt.Errorf("dial bastion: %w", err)
	}
	defer conn.Close()

	cconn, chans, reqs, err := ssh.NewClientConn(conn, host, config)
	if err != nil {
		return "", fmt.Errorf("ssh handshake bastion: %w", err)
	}
	client := ssh.NewClient(cconn, chans, reqs)
	defer client.Close()

	sess, err := client.NewSession()
	if err != nil {
		return "", fmt.Errorf("ssh session: %w", err)
	}
	defer sess.Close()

	clusterDir := fmt.Sprintf("$HOME/autoglue/clusters/%s", c.ID.String())
	sshDir := fmt.Sprintf("$HOME/.ssh")

	cmd := fmt.Sprintf("cd %s && docker run -v %s:/root/.ssh -v ./payload.json:/opt/gluekube/platform.json %s:%s make %s", clusterDir, sshDir, c.DockerImage, c.DockerTag, target)

	logger.Info().
		Str("cmd", cmd).
		Msg("[runMakeOnBastion] executing remote command")

	out, runErr := sess.CombinedOutput(cmd)
	if runErr != nil {
		return string(out), wrapSSHError(runErr, string(out))
	}
	return string(out), nil
}

func randomB64URL(n int) (string, error) {
	b := make([]byte, n)
	if _, err := rand.Read(b); err != nil {
		return "", err
	}
	return base64.RawURLEncoding.EncodeToString(b), nil
}

func findOrCreateClusterAutomationKey(
	db *gorm.DB,
	orgID uuid.UUID,
	clusterID uuid.UUID,
	ttl time.Duration,
) (orgKey string, orgSecret string, err error) {
	now := time.Now()
	name := fmt.Sprintf("cluster-%s-bastion", clusterID.String())

	// 1) Delete any existing ephemeral cluster-bastion key for this org+cluster
	if err := db.Where(
		"org_id = ? AND scope = ? AND purpose = ? AND cluster_id = ? AND is_ephemeral = ?",
		orgID, "org", "cluster_bastion", clusterID, true,
	).Delete(&models.APIKey{}).Error; err != nil {
		return "", "", fmt.Errorf("delete existing cluster key: %w", err)
	}

	// 2) Mint a fresh keypair
	keySuffix, err := randomB64URL(16)
	if err != nil {
		return "", "", fmt.Errorf("entropy_error: %w", err)
	}
	sec, err := randomB64URL(32)
	if err != nil {
		return "", "", fmt.Errorf("entropy_error: %w", err)
	}

	orgKey = "org_" + keySuffix
	orgSecret = sec

	keyHash := auth.SHA256Hex(orgKey)
	secretHash, err := auth.HashSecretArgon2id(orgSecret)
	if err != nil {
		return "", "", fmt.Errorf("hash_error: %w", err)
	}

	exp := now.Add(ttl)

	prefix := orgKey
	if len(prefix) > 12 {
		prefix = prefix[:12]
	}

	rec := models.APIKey{
		OrgID:       &orgID,
		Scope:       "org",
		Purpose:     "cluster_bastion",
		ClusterID:   &clusterID,
		IsEphemeral: true,
		Name:        name,
		KeyHash:     keyHash,
		SecretHash:  &secretHash,
		ExpiresAt:   &exp,
		Revoked:     false,
		Prefix:      &prefix,
	}

	if err := db.Create(&rec).Error; err != nil {
		return "", "", fmt.Errorf("db_error: %w", err)
	}

	return orgKey, orgSecret, nil
}
</file>

<file path="internal/bg/tokens_cleanup.go">
package bg

import (
	"context"
	"time"

	"github.com/dyaksa/archer"
	"github.com/dyaksa/archer/job"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

type RefreshTokenRow struct {
	ID        string `gorm:"primaryKey"`
	RevokedAt *time.Time
	ExpiresAt time.Time
	UpdatedAt time.Time
}

func (RefreshTokenRow) TableName() string { return "refresh_tokens" }

type TokensCleanupArgs struct {
	// kept in case you want to change retention or add dry-run later
}

func TokensCleanupWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
	return func(ctx context.Context, j job.Job) (any, error) {
		if err := CleanupRefreshTokens(db); err != nil {
			return nil, err
		}

		// schedule tomorrow 03:45
		next := time.Now().Truncate(24 * time.Hour).Add(24 * time.Hour).Add(3*time.Hour + 45*time.Minute)
		_, _ = jobs.Enqueue(
			ctx,
			uuid.NewString(),
			"tokens_cleanup",
			TokensCleanupArgs{},
			archer.WithScheduleTime(next),
			archer.WithMaxRetries(1),
		)
		return nil, nil
	}
}

func CleanupRefreshTokens(db *gorm.DB) error {
	now := time.Now()
	return db.
		Where("revoked_at IS NOT NULL OR expires_at < ?", now).
		Delete(&RefreshTokenRow{}).Error
}
</file>

<file path="internal/common/audit.go">
package common

import (
	"time"

	"github.com/google/uuid"
)

type AuditFields struct {
	ID             uuid.UUID `json:"id"                   gorm:"primaryKey;type:uuid;default:gen_random_uuid()"`
	OrganizationID uuid.UUID `json:"organization_id"      gorm:"type:uuid;index"`
	CreatedAt      time.Time `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
	UpdatedAt      time.Time `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
}
</file>

<file path="internal/config/config.go">
package config

import (
	"errors"
	"fmt"
	"strings"
	"sync"

	"github.com/joho/godotenv"
	"github.com/spf13/viper"
	"gopkg.in/yaml.v3"
)

type Config struct {
	DbURL              string
	DbURLRO            string
	Port               string
	Host               string
	JWTIssuer          string
	JWTAudience        string
	JWTPrivateEncKey   string
	OAuthRedirectBase  string
	GoogleClientID     string
	GoogleClientSecret string
	GithubClientID     string
	GithubClientSecret string

	UIDev       bool
	Env         string
	Debug       bool
	Swagger     bool
	SwaggerHost string

	DBStudioEnabled bool
	DBStudioBind    string
	DBStudioPort    string
	DBStudioUser    string
	DBStudioPass    string
}

var (
	once    sync.Once
	cached  Config
	loadErr error
)

func Load() (Config, error) {
	once.Do(func() {
		_ = godotenv.Load()

		// Use a private viper to avoid global mutation/races
		v := viper.New()

		// Defaults
		v.SetDefault("bind.address", "127.0.0.1")
		v.SetDefault("bind.port", "8080")
		v.SetDefault("database.url", "postgres://user:pass@localhost:5432/db?sslmode=disable")
		v.SetDefault("database.url_ro", "")
		v.SetDefault("db_studio.enabled", false)
		v.SetDefault("db_studio.bind", "127.0.0.1")
		v.SetDefault("db_studio.port", "0") // 0 = random
		v.SetDefault("db_studio.user", "")
		v.SetDefault("db_studio.pass", "")

		v.SetDefault("ui.dev", false)
		v.SetDefault("env", "development")
		v.SetDefault("debug", false)
		v.SetDefault("swagger", false)
		v.SetDefault("swagger.host", "localhost:8080")

		// Env setup and binding
		v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
		v.AutomaticEnv()

		keys := []string{
			"bind.address",
			"bind.port",
			"database.url",
			"database.url_ro",
			"jwt.issuer",
			"jwt.audience",
			"jwt.private.enc.key",
			"oauth.redirect.base",
			"google.client.id",
			"google.client.secret",
			"github.client.id",
			"github.client.secret",
			"ui.dev",
			"env",
			"debug",
			"swagger",
			"swagger.host",
			"db_studio.enabled",
			"db_studio.bind",
			"db_studio.port",
			"db_studio.user",
			"db_studio.pass",
		}
		for _, k := range keys {
			_ = v.BindEnv(k)
		}

		// Build config
		cfg := Config{
			DbURL:              v.GetString("database.url"),
			DbURLRO:            v.GetString("database.url_ro"),
			Port:               v.GetString("bind.port"),
			Host:               v.GetString("bind.address"),
			JWTIssuer:          v.GetString("jwt.issuer"),
			JWTAudience:        v.GetString("jwt.audience"),
			JWTPrivateEncKey:   v.GetString("jwt.private.enc.key"),
			OAuthRedirectBase:  v.GetString("oauth.redirect.base"),
			GoogleClientID:     v.GetString("google.client.id"),
			GoogleClientSecret: v.GetString("google.client.secret"),
			GithubClientID:     v.GetString("github.client.id"),
			GithubClientSecret: v.GetString("github.client.secret"),

			UIDev:       v.GetBool("ui.dev"),
			Env:         v.GetString("env"),
			Debug:       v.GetBool("debug"),
			Swagger:     v.GetBool("swagger"),
			SwaggerHost: v.GetString("swagger.host"),

			DBStudioEnabled: v.GetBool("db_studio.enabled"),
			DBStudioBind:    v.GetString("db_studio.bind"),
			DBStudioPort:    v.GetString("db_studio.port"),
			DBStudioUser:    v.GetString("db_studio.user"),
			DBStudioPass:    v.GetString("db_studio.pass"),
		}

		// Validate
		if err := validateConfig(cfg); err != nil {
			loadErr = err
			return
		}

		cached = cfg
	})
	return cached, loadErr
}

func validateConfig(cfg Config) error {
	var errs []string

	// Required general settings
	req := map[string]string{
		"jwt.issuer":          cfg.JWTIssuer,
		"jwt.audience":        cfg.JWTAudience,
		"jwt.private.enc.key": cfg.JWTPrivateEncKey,
		"oauth.redirect.base": cfg.OAuthRedirectBase,
	}
	for k, v := range req {
		if strings.TrimSpace(v) == "" {
			errs = append(errs, fmt.Sprintf("missing required config key %q (env %s)", k, envNameFromKey(k)))
		}
	}

	// OAuth provider requirements:
	googleOK := strings.TrimSpace(cfg.GoogleClientID) != "" && strings.TrimSpace(cfg.GoogleClientSecret) != ""
	githubOK := strings.TrimSpace(cfg.GithubClientID) != "" && strings.TrimSpace(cfg.GithubClientSecret) != ""

	// If partially configured, report what's missing for each
	if !googleOK && (cfg.GoogleClientID != "" || cfg.GoogleClientSecret != "") {
		if cfg.GoogleClientID == "" {
			errs = append(errs, fmt.Sprintf("google.client.id is missing (env %s) while google.client.secret is set", envNameFromKey("google.client.id")))
		}
		if cfg.GoogleClientSecret == "" {
			errs = append(errs, fmt.Sprintf("google.client.secret is missing (env %s) while google.client.id is set", envNameFromKey("google.client.secret")))
		}
	}
	if !githubOK && (cfg.GithubClientID != "" || cfg.GithubClientSecret != "") {
		if cfg.GithubClientID == "" {
			errs = append(errs, fmt.Sprintf("github.client.id is missing (env %s) while github.client.secret is set", envNameFromKey("github.client.id")))
		}
		if cfg.GithubClientSecret == "" {
			errs = append(errs, fmt.Sprintf("github.client.secret is missing (env %s) while github.client.id is set", envNameFromKey("github.client.secret")))
		}
	}

	// Enforce minimum: at least one full provider
	if !googleOK && !githubOK {
		errs = append(errs, "at least one OAuth provider must be fully configured: either Google (google.client.id + google.client.secret) or GitHub (github.client.id + github.client.secret)")
	}

	if len(errs) > 0 {
		return errors.New(strings.Join(errs, "; "))
	}
	return nil
}

func envNameFromKey(key string) string {
	return strings.ToUpper(strings.ReplaceAll(key, ".", "_"))
}

func DebugPrintConfig() {
	cfg, _ := Load()
	b, err := yaml.Marshal(cfg)
	if err != nil {
		fmt.Println("error marshalling config:", err)
		return
	}
	fmt.Println("Loaded configuration:")
	fmt.Println(string(b))
}

func IsUIDev() bool {
	cfg, _ := Load()
	return cfg.UIDev
}

func IsDev() bool {
	cfg, _ := Load()
	return strings.EqualFold(cfg.Env, "development")
}

func IsDebug() bool {
	cfg, _ := Load()
	return cfg.Debug
}

func IsSwaggerEnabled() bool {
	cfg, _ := Load()
	return cfg.Swagger
}
</file>

<file path="internal/db/db.go">
package db

import (
	"log"

	"gorm.io/driver/postgres"
	"gorm.io/gorm"
	"gorm.io/gorm/logger"
)

func Open(dsn string) *gorm.DB {
	db, err := gorm.Open(postgres.Open(dsn), &gorm.Config{Logger: logger.Default.LogMode(logger.Warn)})
	if err != nil {
		log.Fatalf("failed to connect to db: %v", err)
	}
	return db
}
</file>

<file path="internal/db/migrate.go">
package db

import (
	"fmt"

	"gorm.io/gorm"
)

func Run(db *gorm.DB, models ...any) error {
	return db.Transaction(func(tx *gorm.DB) error {
		// 0) Extensions
		if err := tx.Exec(`CREATE EXTENSION IF NOT EXISTS pgcrypto`).Error; err != nil {
			return fmt.Errorf("enable pgcrypto: %w", err)
		}
		if err := tx.Exec(`CREATE EXTENSION IF NOT EXISTS citext`).Error; err != nil {
			return fmt.Errorf("enable citext: %w", err)
		}

		// 1) AutoMigrate (pass parents before children in caller)
		if err := tx.AutoMigrate(models...); err != nil {
			return fmt.Errorf("automigrate: %w", err)
		}
		return nil
	})
}
</file>

<file path="internal/handlers/dto/actions.go">
package dto

import (
	"time"

	"github.com/google/uuid"
)

type ActionResponse struct {
	ID          uuid.UUID `json:"id" format:"uuid"`
	Label       string    `json:"label"`
	Description string    `json:"description"`
	MakeTarget  string    `json:"make_target"`
	CreatedAt   time.Time `json:"created_at" format:"date-time"`
	UpdatedAt   time.Time `json:"updated_at" format:"date-time"`
}

type CreateActionRequest struct {
	Label       string `json:"label"`
	Description string `json:"description"`
	MakeTarget  string `json:"make_target"`
}

type UpdateActionRequest struct {
	Label       *string `json:"label,omitempty"`
	Description *string `json:"description,omitempty"`
	MakeTarget  *string `json:"make_target,omitempty"`
}
</file>

<file path="internal/handlers/dto/annotations.go">
package dto

import "github.com/glueops/autoglue/internal/common"

type AnnotationResponse struct {
	common.AuditFields
	Key   string `json:"key"`
	Value string `json:"value"`
}

type CreateAnnotationRequest struct {
	Key   string `json:"key"`
	Value string `json:"value"`
}

type UpdateAnnotationRequest struct {
	Key   *string `json:"key,omitempty"`
	Value *string `json:"value,omitempty"`
}
</file>

<file path="internal/handlers/dto/auth.go">
package dto

// swagger:model AuthStartResponse
type AuthStartResponse struct {
	AuthURL string `json:"auth_url" example:"https://accounts.google.com/o/oauth2/v2/auth?client_id=..."`
}

// swagger:model TokenPair
type TokenPair struct {
	AccessToken  string `json:"access_token" example:"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ij..."`
	RefreshToken string `json:"refresh_token" example:"m0l9o8rT3t0V8d3eFf...."`
	TokenType    string `json:"token_type" example:"Bearer"`
	ExpiresIn    int64  `json:"expires_in" example:"3600"`
}

// swagger:model RefreshRequest
type RefreshRequest struct {
	RefreshToken string `json:"refresh_token" example:"m0l9o8rT3t0V8d3eFf..."`
}

// swagger:model LogoutRequest
type LogoutRequest struct {
	RefreshToken string `json:"refresh_token" example:"m0l9o8rT3t0V8d3eFf..."`
}
</file>

<file path="internal/handlers/dto/cluster_runs.go">
package dto

import (
	"time"

	"github.com/google/uuid"
)

type ClusterRunResponse struct {
	ID             uuid.UUID  `json:"id" format:"uuid"`
	OrganizationID uuid.UUID  `json:"organization_id" format:"uuid"`
	ClusterID      uuid.UUID  `json:"cluster_id" format:"uuid"`
	Action         string     `json:"action"`
	Status         string     `json:"status"`
	Error          string     `json:"error"`
	CreatedAt      time.Time  `json:"created_at" format:"date-time"`
	UpdatedAt      time.Time  `json:"updated_at" format:"date-time"`
	FinishedAt     *time.Time `json:"finished_at,omitempty" format:"date-time"`
}
</file>

<file path="internal/handlers/dto/clusters.go">
package dto

import (
	"time"

	"github.com/google/uuid"
)

type ClusterResponse struct {
	ID                    uuid.UUID             `json:"id"`
	Name                  string                `json:"name"`
	CaptainDomain         *DomainResponse       `json:"captain_domain,omitempty"`
	ControlPlaneRecordSet *RecordSetResponse    `json:"control_plane_record_set,omitempty"`
	ControlPlaneFQDN      *string               `json:"control_plane_fqdn,omitempty"`
	AppsLoadBalancer      *LoadBalancerResponse `json:"apps_load_balancer,omitempty"`
	GlueOpsLoadBalancer   *LoadBalancerResponse `json:"glueops_load_balancer,omitempty"`
	BastionServer         *ServerResponse       `json:"bastion_server,omitempty"`
	Provider              string                `json:"cluster_provider"`
	Region                string                `json:"region"`
	Status                string                `json:"status"`
	LastError             string                `json:"last_error"`
	RandomToken           string                `json:"random_token"`
	CertificateKey        string                `json:"certificate_key"`
	NodePools             []NodePoolResponse    `json:"node_pools,omitempty"`
	DockerImage           string                `json:"docker_image"`
	DockerTag             string                `json:"docker_tag"`
	Kubeconfig            *string               `json:"kubeconfig,omitempty"`
	OrgKey                *string               `json:"org_key,omitempty"`
	OrgSecret             *string               `json:"org_secret,omitempty"`
	CreatedAt             time.Time             `json:"created_at"`
	UpdatedAt             time.Time             `json:"updated_at"`
}

type CreateClusterRequest struct {
	Name            string `json:"name"`
	ClusterProvider string `json:"cluster_provider"`
	Region          string `json:"region"`
	DockerImage     string `json:"docker_image"`
	DockerTag       string `json:"docker_tag"`
}

type UpdateClusterRequest struct {
	Name            *string `json:"name,omitempty"`
	ClusterProvider *string `json:"cluster_provider,omitempty"`
	Region          *string `json:"region,omitempty"`
	DockerImage     *string `json:"docker_image,omitempty"`
	DockerTag       *string `json:"docker_tag,omitempty"`
}

type AttachCaptainDomainRequest struct {
	DomainID uuid.UUID `json:"domain_id"`
}

type AttachRecordSetRequest struct {
	RecordSetID uuid.UUID `json:"record_set_id"`
}

type AttachLoadBalancerRequest struct {
	LoadBalancerID uuid.UUID `json:"load_balancer_id"`
}

type AttachBastionRequest struct {
	ServerID uuid.UUID `json:"server_id"`
}

type SetKubeconfigRequest struct {
	Kubeconfig string `json:"kubeconfig"`
}

type AttachNodePoolRequest struct {
	NodePoolID uuid.UUID `json:"node_pool_id"`
}
</file>

<file path="internal/handlers/dto/credentials.go">
package dto

import (
	"encoding/json"

	"github.com/go-playground/validator/v10"
)

// RawJSON is a swagger-friendly wrapper for json.RawMessage.
type RawJSON = json.RawMessage

var Validate = validator.New()

func init() {
	_ = Validate.RegisterValidation("awsarn", func(fl validator.FieldLevel) bool {
		v := fl.Field().String()
		return len(v) > 10 && len(v) < 2048 && len(v) >= 4 && v[:4] == "arn:"
	})
}

/*** Shapes for secrets ***/

type AWSCredential struct {
	AccessKeyID     string `json:"access_key_id" validate:"required,alphanum,len=20"`
	SecretAccessKey string `json:"secret_access_key" validate:"required"`
	Region          string `json:"region" validate:"omitempty"`
}

type BasicAuth struct {
	Username string `json:"username" validate:"required"`
	Password string `json:"password" validate:"required"`
}

type APIToken struct {
	Token string `json:"token" validate:"required"`
}

type OAuth2Credential struct {
	ClientID     string `json:"client_id" validate:"required"`
	ClientSecret string `json:"client_secret" validate:"required"`
	RefreshToken string `json:"refresh_token" validate:"required"`
}

/*** Shapes for scopes ***/

type AWSProviderScope struct{}

type AWSServiceScope struct {
	Service string `json:"service" validate:"required,oneof=route53 s3 ec2 iam rds dynamodb"`
}

type AWSResourceScope struct {
	ARN string `json:"arn" validate:"required,awsarn"`
}

/*** Registries ***/

type ProviderDef struct {
	New      func() any
	Validate func(any) error
}

type ScopeDef struct {
	New         func() any
	Validate    func(any) error
	Specificity int // 0=provider, 1=service, 2=resource
}

// Secret shapes per provider/kind/version

var CredentialRegistry = map[string]map[string]map[int]ProviderDef{
	"aws": {
		"aws_access_key": {
			1: {New: func() any { return &AWSCredential{} }, Validate: func(x any) error { return Validate.Struct(x) }},
		},
	},
	"cloudflare":   {"api_token": {1: {New: func() any { return &APIToken{} }, Validate: func(x any) error { return Validate.Struct(x) }}}},
	"hetzner":      {"api_token": {1: {New: func() any { return &APIToken{} }, Validate: func(x any) error { return Validate.Struct(x) }}}},
	"digitalocean": {"api_token": {1: {New: func() any { return &APIToken{} }, Validate: func(x any) error { return Validate.Struct(x) }}}},
	"generic": {
		"basic_auth": {1: {New: func() any { return &BasicAuth{} }, Validate: func(x any) error { return Validate.Struct(x) }}},
		"oauth2":     {1: {New: func() any { return &OAuth2Credential{} }, Validate: func(x any) error { return Validate.Struct(x) }}},
	},
}

// Scope shapes per provider/scopeKind/version

var ScopeRegistry = map[string]map[string]map[int]ScopeDef{
	"aws": {
		"provider": {1: {New: func() any { return &AWSProviderScope{} }, Validate: func(any) error { return nil }, Specificity: 0}},
		"service":  {1: {New: func() any { return &AWSServiceScope{} }, Validate: func(x any) error { return Validate.Struct(x) }, Specificity: 1}},
		"resource": {1: {New: func() any { return &AWSResourceScope{} }, Validate: func(x any) error { return Validate.Struct(x) }, Specificity: 2}},
	},
}

/*** API DTOs used by swagger ***/

// CreateCredentialRequest represents the POST /credentials payload
type CreateCredentialRequest struct {
	CredentialProvider string  `json:"credential_provider" validate:"required,oneof=aws cloudflare hetzner digitalocean generic"`
	Kind               string  `json:"kind" validate:"required"`                 // aws_access_key, api_token, basic_auth, oauth2
	SchemaVersion      int     `json:"schema_version" validate:"required,gte=1"` // secret schema version
	Name               string  `json:"name" validate:"omitempty,max=100"`        // human label
	ScopeKind          string  `json:"scope_kind" validate:"required,oneof=credential_provider service resource"`
	ScopeVersion       int     `json:"scope_version" validate:"required,gte=1"`        // scope schema version
	Scope              RawJSON `json:"scope" validate:"required" swaggertype:"object"` // {"service":"route53"} or {"arn":"..."}
	AccountID          string  `json:"account_id,omitempty" validate:"omitempty,max=32"`
	Region             string  `json:"region,omitempty" validate:"omitempty,max=32"`
	Secret             RawJSON `json:"secret" validate:"required" swaggertype:"object"` // encrypted later
}

// UpdateCredentialRequest represents PATCH /credentials/{id}
type UpdateCredentialRequest struct {
	Name         *string  `json:"name,omitempty"`
	AccountID    *string  `json:"account_id,omitempty"`
	Region       *string  `json:"region,omitempty"`
	ScopeKind    *string  `json:"scope_kind,omitempty"`
	ScopeVersion *int     `json:"scope_version,omitempty"`
	Scope        *RawJSON `json:"scope,omitempty" swaggertype:"object"`
	Secret       *RawJSON `json:"secret,omitempty" swaggertype:"object"` // set if rotating

}

// CredentialOut is what we return (no secrets)
type CredentialOut struct {
	ID                 string  `json:"id"`
	CredentialProvider string  `json:"credential_provider"`
	Kind               string  `json:"kind"`
	SchemaVersion      int     `json:"schema_version"`
	Name               string  `json:"name"`
	ScopeKind          string  `json:"scope_kind"`
	ScopeVersion       int     `json:"scope_version"`
	Scope              RawJSON `json:"scope" swaggertype:"object"`
	AccountID          string  `json:"account_id,omitempty"`
	Region             string  `json:"region,omitempty"`
	CreatedAt          string  `json:"created_at"`
	UpdatedAt          string  `json:"updated_at"`
}
</file>

<file path="internal/handlers/dto/dns.go">
package dto

import (
	"encoding/json"
	"strings"

	"github.com/go-playground/validator/v10"
)

var dnsValidate = validator.New()

func init() {
	_ = dnsValidate.RegisterValidation("fqdn", func(fl validator.FieldLevel) bool {
		s := strings.TrimSpace(fl.Field().String())
		if s == "" || len(s) > 253 {
			return false
		}
		// Minimal: lower-cased, no trailing dot in our API (normalize server-side)
		// You can add stricter checks later.
		return !strings.HasPrefix(s, ".") && !strings.Contains(s, "..")
	})
	_ = dnsValidate.RegisterValidation("rrtype", func(fl validator.FieldLevel) bool {
		switch strings.ToUpper(fl.Field().String()) {
		case "A", "AAAA", "CNAME", "TXT", "MX", "NS", "SRV", "CAA":
			return true
		default:
			return false
		}
	})
}

// ---- Domains ----

type CreateDomainRequest struct {
	DomainName   string `json:"domain_name" validate:"required,fqdn"`
	CredentialID string `json:"credential_id" validate:"required,uuid4"`
	ZoneID       string `json:"zone_id,omitempty" validate:"omitempty,max=128"`
}

type UpdateDomainRequest struct {
	CredentialID *string `json:"credential_id,omitempty" validate:"omitempty,uuid4"`
	ZoneID       *string `json:"zone_id,omitempty" validate:"omitempty,max=128"`
	Status       *string `json:"status,omitempty" validate:"omitempty,oneof=pending provisioning ready failed"`
	DomainName   *string `json:"domain_name,omitempty" validate:"omitempty,fqdn"`
}

type DomainResponse struct {
	ID             string `json:"id"`
	OrganizationID string `json:"organization_id"`
	DomainName     string `json:"domain_name"`
	ZoneID         string `json:"zone_id"`
	Status         string `json:"status"`
	LastError      string `json:"last_error"`
	CredentialID   string `json:"credential_id"`
	CreatedAt      string `json:"created_at"`
	UpdatedAt      string `json:"updated_at"`
}

// ---- Record Sets ----

type AliasTarget struct {
	HostedZoneID         string `json:"hosted_zone_id" validate:"required"`
	DNSName              string `json:"dns_name" validate:"required"`
	EvaluateTargetHealth bool   `json:"evaluate_target_health"`
}

type CreateRecordSetRequest struct {
	// Name relative to domain ("endpoint") OR FQDN ("endpoint.example.com").
	// Server normalizes to relative.
	Name   string   `json:"name" validate:"required,max=253"`
	Type   string   `json:"type" validate:"required,rrtype"`
	TTL    *int     `json:"ttl,omitempty" validate:"omitempty,gte=1,lte=86400"`
	Values []string `json:"values" validate:"omitempty,dive,min=1,max=1024"`
}

type UpdateRecordSetRequest struct {
	// Any change flips status back to pending (worker will UPSERT)
	Name   *string   `json:"name,omitempty" validate:"omitempty,max=253"`
	Type   *string   `json:"type,omitempty" validate:"omitempty,rrtype"`
	TTL    *int      `json:"ttl,omitempty" validate:"omitempty,gte=1,lte=86400"`
	Values *[]string `json:"values,omitempty" validate:"omitempty,dive,min=1,max=1024"`
	Status *string   `json:"status,omitempty" validate:"omitempty,oneof=pending provisioning ready failed"`
}

type RecordSetResponse struct {
	ID          string          `json:"id"`
	DomainID    string          `json:"domain_id"`
	Name        string          `json:"name"`
	Type        string          `json:"type"`
	TTL         *int            `json:"ttl,omitempty"`
	Values      json.RawMessage `json:"values" swaggertype:"object"` // []string JSON
	Fingerprint string          `json:"fingerprint"`
	Status      string          `json:"status"`
	LastError   string          `json:"last_error"`
	Owner       string          `json:"owner"`
	CreatedAt   string          `json:"created_at"`
	UpdatedAt   string          `json:"updated_at"`
}

// DNSValidate Quick helper to validate DTOs in handlers
func DNSValidate(i any) error {
	return dnsValidate.Struct(i)
}
</file>

<file path="internal/handlers/dto/jobs.go">
package dto

import (
	"encoding/json"
	"time"
)

type JobStatus string

const (
	StatusQueued    JobStatus = "queued"
	StatusRunning   JobStatus = "running"
	StatusSucceeded JobStatus = "succeeded"
	StatusFailed    JobStatus = "failed"
	StatusCanceled  JobStatus = "canceled"
	StatusRetrying  JobStatus = "retrying"
	StatusScheduled JobStatus = "scheduled"
)

// Job represents a background job managed by Archer.
// swagger:model Job
type Job struct {
	ID          string     `json:"id" example:"01HF7SZK8Z8WG1M3J7S2Z8M2N6"`
	Type        string     `json:"type" example:"email.send"`
	Queue       string     `json:"queue" example:"default"`
	Status      JobStatus  `json:"status" example:"queued" enums:"queued|running|succeeded|failed|canceled|retrying|scheduled"`
	Attempts    int        `json:"attempts" example:"0"`
	MaxAttempts int        `json:"max_attempts,omitempty" example:"3"`
	CreatedAt   time.Time  `json:"created_at" example:"2025-11-04T09:30:00Z"`
	UpdatedAt   *time.Time `json:"updated_at,omitempty" example:"2025-11-04T09:30:00Z"`
	LastError   *string    `json:"last_error,omitempty" example:"error message"`
	RunAt       *time.Time `json:"run_at,omitempty" example:"2025-11-04T09:30:00Z"`
	Payload     any        `json:"payload,omitempty"`
}

// QueueInfo holds queue-level counts.
// swagger:model QueueInfo
type QueueInfo struct {
	Name      string `json:"name" example:"default"`
	Pending   int    `json:"pending" example:"42"`
	Running   int    `json:"running" example:"3"`
	Failed    int    `json:"failed" example:"5"`
	Scheduled int    `json:"scheduled" example:"7"`
}

// PageJob is a concrete paginated response for Job (generics not supported by swag).
// swagger:model PageJob
type PageJob struct {
	Items    []Job `json:"items"`
	Total    int   `json:"total" example:"120"`
	Page     int   `json:"page" example:"1"`
	PageSize int   `json:"page_size" example:"25"`
}

// EnqueueRequest is the POST body for creating a job.
// swagger:model EnqueueRequest
type EnqueueRequest struct {
	Queue   string          `json:"queue" example:"default"`
	Type    string          `json:"type" example:"email.send"`
	Payload json.RawMessage `json:"payload" swaggertype:"object"`
	RunAt   *time.Time      `json:"run_at" example:"2025-11-05T08:00:00Z"`
}
</file>

<file path="internal/handlers/dto/jwks.go">
package dto

// JWK represents a single JSON Web Key (public only).
// swagger:model JWK
type JWK struct {
	Kty string `json:"kty" example:"RSA" gorm:"-"`
	Use string `json:"use,omitempty" example:"sig" gorm:"-"`
	Kid string `json:"kid,omitempty" example:"7c6f1d0a-7a98-4e6a-9dbf-6b1af4b9f345" gorm:"-"`
	Alg string `json:"alg,omitempty" example:"RS256" gorm:"-"`
	N   string `json:"n,omitempty" gorm:"-"`
	E   string `json:"e,omitempty" example:"AQAB" gorm:"-"`
	X   string `json:"x,omitempty" gorm:"-"`
}

// JWKS is a JSON Web Key Set container.
// swagger:model JWKS
type JWKS struct {
	Keys []JWK `json:"keys" gorm:"-"`
}
</file>

<file path="internal/handlers/dto/labels.go">
package dto

import (
	"github.com/glueops/autoglue/internal/common"
)

type LabelResponse struct {
	common.AuditFields
	Key   string `json:"key"`
	Value string `json:"value"`
}

type CreateLabelRequest struct {
	Key   string `json:"key"`
	Value string `json:"value"`
}

type UpdateLabelRequest struct {
	Key   *string `json:"key"`
	Value *string `json:"value"`
}
</file>

<file path="internal/handlers/dto/load_balancers.go">
package dto

import (
	"time"

	"github.com/google/uuid"
)

type LoadBalancerResponse struct {
	ID               uuid.UUID `json:"id"`
	OrganizationID   uuid.UUID `json:"organization_id"`
	Name             string    `json:"name"`
	Kind             string    `json:"kind"`
	PublicIPAddress  string    `json:"public_ip_address"`
	PrivateIPAddress string    `json:"private_ip_address"`
	CreatedAt        time.Time `json:"created_at"`
	UpdatedAt        time.Time `json:"updated_at"`
}

type CreateLoadBalancerRequest struct {
	Name             string `json:"name" example:"glueops"`
	Kind             string `json:"kind" example:"public" enums:"glueops,public"`
	PublicIPAddress  string `json:"public_ip_address" example:"8.8.8.8"`
	PrivateIPAddress string `json:"private_ip_address" example:"192.168.0.2"`
}

type UpdateLoadBalancerRequest struct {
	Name             *string `json:"name" example:"glue"`
	Kind             *string `json:"kind" example:"public" enums:"glueops,public"`
	PublicIPAddress  *string `json:"public_ip_address" example:"8.8.8.8"`
	PrivateIPAddress *string `json:"private_ip_address" example:"192.168.0.2"`
}
</file>

<file path="internal/handlers/dto/node_pools.go">
package dto

import "github.com/glueops/autoglue/internal/common"

type NodeRole string

const (
	NodeRoleMaster NodeRole = "master"
	NodeRoleWorker NodeRole = "worker"
)

type CreateNodePoolRequest struct {
	Name string   `json:"name"`
	Role NodeRole `json:"role" enums:"master,worker" swaggertype:"string"`
}

type UpdateNodePoolRequest struct {
	Name *string   `json:"name"`
	Role *NodeRole `json:"role" enums:"master,worker" swaggertype:"string"`
}

type NodePoolResponse struct {
	common.AuditFields
	Name        string               `json:"name"`
	Role        NodeRole             `json:"role" enums:"master,worker" swaggertype:"string"`
	Servers     []ServerResponse     `json:"servers"`
	Annotations []AnnotationResponse `json:"annotations"`
	Labels      []LabelResponse      `json:"labels"`
	Taints      []TaintResponse      `json:"taints"`
}

type AttachServersRequest struct {
	ServerIDs []string `json:"server_ids"`
}

type AttachTaintsRequest struct {
	TaintIDs []string `json:"taint_ids"`
}

type AttachLabelsRequest struct {
	LabelIDs []string `json:"label_ids"`
}

type AttachAnnotationsRequest struct {
	AnnotationIDs []string `json:"annotation_ids"`
}
</file>

<file path="internal/handlers/dto/servers.go">
package dto

import "github.com/google/uuid"

type CreateServerRequest struct {
	Hostname         string `json:"hostname,omitempty"`
	PublicIPAddress  string `json:"public_ip_address,omitempty"`
	PrivateIPAddress string `json:"private_ip_address"`
	SSHUser          string `json:"ssh_user"`
	SshKeyID         string `json:"ssh_key_id"`
	Role             string `json:"role" example:"master|worker|bastion" enums:"master,worker,bastion"`
	Status           string `json:"status,omitempty" example:"pending|provisioning|ready|failed" enums:"pending,provisioning,ready,failed"`
}

type UpdateServerRequest struct {
	Hostname         *string `json:"hostname,omitempty"`
	PublicIPAddress  *string `json:"public_ip_address,omitempty"`
	PrivateIPAddress *string `json:"private_ip_address,omitempty"`
	SSHUser          *string `json:"ssh_user,omitempty"`
	SshKeyID         *string `json:"ssh_key_id,omitempty"`
	Role             *string `json:"role" example:"master|worker|bastion" enums:"master,worker,bastion"`
	Status           *string `json:"status,omitempty" example:"pending|provisioning|ready|failed" enums:"pending,provisioning,ready,failed"`
}

type ServerResponse struct {
	ID               uuid.UUID `json:"id"`
	OrganizationID   uuid.UUID `json:"organization_id"`
	Hostname         string    `json:"hostname"`
	PublicIPAddress  *string   `json:"public_ip_address,omitempty"`
	PrivateIPAddress string    `json:"private_ip_address"`
	SSHUser          string    `json:"ssh_user"`
	SshKeyID         uuid.UUID `json:"ssh_key_id"`
	Role             string    `json:"role" example:"master|worker|bastion" enums:"master,worker,bastion"`
	Status           string    `json:"status,omitempty" example:"pending|provisioning|ready|failed" enums:"pending,provisioning,ready,failed"`
	CreatedAt        string    `json:"created_at,omitempty"`
	UpdatedAt        string    `json:"updated_at,omitempty"`
}
</file>

<file path="internal/handlers/dto/ssh_keys.go">
package dto

import (
	"github.com/glueops/autoglue/internal/common"
)

type CreateSSHRequest struct {
	Name    string  `json:"name"`
	Comment string  `json:"comment,omitempty" example:"deploy@autoglue"`
	Bits    *int    `json:"bits,omitempty"` // Only for RSA
	Type    *string `json:"type,omitempty"` // "rsa" (default) or "ed25519"
}

type SshResponse struct {
	common.AuditFields
	Name                string `json:"name"`
	PublicKey           string `json:"public_key"`
	Fingerprint         string `json:"fingerprint"`
	EncryptedPrivateKey string `json:"-"`
	PrivateIV           string `json:"-"`
	PrivateTag          string `json:"-"`
}

type SshRevealResponse struct {
	SshResponse
	PrivateKey string `json:"private_key"`
}

type SshMaterialJSON struct {
	ID          string `json:"id"`
	Name        string `json:"name"`
	Fingerprint string `json:"fingerprint"`
	// Exactly one of the following will be populated for part=public/private.
	PublicKey  *string `json:"public_key,omitempty"`  // OpenSSH authorized_key (string)
	PrivatePEM *string `json:"private_pem,omitempty"` // PKCS#1/PEM (string)
	// For part=both with mode=json we'll return a base64 zip
	ZipBase64 *string `json:"zip_base64,omitempty"` // base64-encoded zip
	// Suggested filenames (SDKs can save to disk without inferring names)
	Filenames []string `json:"filenames"`
}
</file>

<file path="internal/handlers/dto/taints.go">
package dto

import "github.com/google/uuid"

type TaintResponse struct {
	ID             uuid.UUID `json:"id"`
	OrganizationID uuid.UUID `json:"organization_id"`
	Key            string    `json:"key"`
	Value          string    `json:"value"`
	Effect         string    `json:"effect"`
	CreatedAt      string    `json:"created_at,omitempty"`
	UpdatedAt      string    `json:"updated_at,omitempty"`
}

type CreateTaintRequest struct {
	Key    string `json:"key"`
	Value  string `json:"value"`
	Effect string `json:"effect"`
}

type UpdateTaintRequest struct {
	Key    *string `json:"key,omitempty"`
	Value  *string `json:"value,omitempty"`
	Effect *string `json:"effect,omitempty"`
}
</file>

<file path="internal/handlers/actions.go">
package handlers

import (
	"encoding/json"
	"errors"
	"net/http"
	"strings"

	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// ListActions godoc
//
//	@ID				ListActions
//	@Summary		List available actions
//	@Description	Returns all admin-configured actions.
//	@Tags			Actions
//	@Produce		json
//	@Success		200	{array}		dto.ActionResponse
//	@Failure		401	{string}	string	"Unauthorized"
//	@Failure		500	{string}	string	"db error"
//	@Router			/admin/actions [get]
//	@Security		BearerAuth
func ListActions(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		var rows []models.Action
		if err := db.Order("label ASC").Find(&rows).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := make([]dto.ActionResponse, 0, len(rows))
		for _, a := range rows {
			out = append(out, actionToDTO(a))
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetAction godoc
//
//	@ID				GetAction
//	@Summary		Get a single action by ID
//	@Description	Returns a single action.
//	@Tags			Actions
//	@Produce		json
//	@Param			actionID	path		string	true	"Action ID"
//	@Success		200			{object}	dto.ActionResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/admin/actions/{actionID} [get]
//	@Security		BearerAuth
func GetAction(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		actionID, err := uuid.Parse(chi.URLParam(r, "actionID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_action_id", "invalid action id")
			return
		}

		var row models.Action
		if err := db.Where("id = ?", actionID).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "action not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		utils.WriteJSON(w, http.StatusOK, actionToDTO(row))
	}
}

// CreateAction godoc
//
//	@ID				CreateAction
//	@Summary		Create an action
//	@Description	Creates a new admin-configured action.
//	@Tags			Actions
//	@Accept			json
//	@Produce		json
//	@Param			body	body		dto.CreateActionRequest	true	"payload"
//	@Success		201		{object}	dto.ActionResponse
//	@Failure		400		{string}	string	"bad request"
//	@Failure		401		{string}	string	"Unauthorized"
//	@Failure		500		{string}	string	"db error"
//	@Router			/admin/actions [post]
//	@Security		BearerAuth
func CreateAction(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		var in dto.CreateActionRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		label := strings.TrimSpace(in.Label)
		desc := strings.TrimSpace(in.Description)
		target := strings.TrimSpace(in.MakeTarget)

		if label == "" {
			utils.WriteError(w, http.StatusBadRequest, "validation_error", "label is required")
			return
		}
		if desc == "" {
			utils.WriteError(w, http.StatusBadRequest, "validation_error", "description is required")
			return
		}
		if target == "" {
			utils.WriteError(w, http.StatusBadRequest, "validation_error", "make_target is required")
			return
		}

		row := models.Action{
			Label:       label,
			Description: desc,
			MakeTarget:  target,
		}

		if err := db.Create(&row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		utils.WriteJSON(w, http.StatusCreated, actionToDTO(row))
	}
}

// UpdateAction godoc
//
//	@ID				UpdateAction
//	@Summary		Update an action
//	@Description	Updates an action. Only provided fields are modified.
//	@Tags			Actions
//	@Accept			json
//	@Produce		json
//	@Param			actionID	path		string					true	"Action ID"
//	@Param			body		body		dto.UpdateActionRequest	true	"payload"
//	@Success		200			{object}	dto.ActionResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/admin/actions/{actionID} [patch]
//	@Security		BearerAuth
func UpdateAction(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		actionID, err := uuid.Parse(chi.URLParam(r, "actionID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_action_id", "invalid action id")
			return
		}

		var in dto.UpdateActionRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		var row models.Action
		if err := db.Where("id = ?", actionID).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "action not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		if in.Label != nil {
			v := strings.TrimSpace(*in.Label)
			if v == "" {
				utils.WriteError(w, http.StatusBadRequest, "validation_error", "label cannot be empty")
				return
			}
			row.Label = v
		}
		if in.Description != nil {
			v := strings.TrimSpace(*in.Description)
			if v == "" {
				utils.WriteError(w, http.StatusBadRequest, "validation_error", "description cannot be empty")
				return
			}
			row.Description = v
		}
		if in.MakeTarget != nil {
			v := strings.TrimSpace(*in.MakeTarget)
			if v == "" {
				utils.WriteError(w, http.StatusBadRequest, "validation_error", "make_target cannot be empty")
				return
			}
			row.MakeTarget = v
		}

		if err := db.Save(&row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, actionToDTO(row))
	}
}

// DeleteAction godoc
//
//	@ID				DeleteAction
//	@Summary		Delete an action
//	@Description	Deletes an action.
//	@Tags			Actions
//	@Produce		json
//	@Param			actionID	path		string	true	"Action ID"
//	@Success		204			{string}	string	"deleted"
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/admin/actions/{actionID} [delete]
//	@Security		BearerAuth
func DeleteAction(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		actionID, err := uuid.Parse(chi.URLParam(r, "actionID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_action_id", "invalid action id")
			return
		}

		tx := db.Where("id = ?", actionID).Delete(&models.Action{})
		if tx.Error != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		if tx.RowsAffected == 0 {
			utils.WriteError(w, http.StatusNotFound, "not_found", "action not found")
			return
		}

		w.WriteHeader(http.StatusNoContent)
	}
}

func actionToDTO(a models.Action) dto.ActionResponse {
	return dto.ActionResponse{
		ID:          a.ID,
		Label:       a.Label,
		Description: a.Description,
		MakeTarget:  a.MakeTarget,
		CreatedAt:   a.CreatedAt,
		UpdatedAt:   a.UpdatedAt,
	}
}
</file>

<file path="internal/handlers/annotations.go">
package handlers

import (
	"encoding/json"
	"errors"
	"net/http"
	"strings"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/common"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// ListAnnotations godoc
//
//	@ID				ListAnnotations
//	@Summary		List annotations (org scoped)
//	@Description	Returns annotations for the organization in X-Org-ID. Filters: `key`, `value`, and `q` (key contains). Add `include=node_pools` to include linked node pools.
//	@Tags			Annotations
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			key			query		string	false	"Exact key"
//	@Param			value		query		string	false	"Exact value"
//	@Param			q			query		string	false	"key contains (case-insensitive)"
//	@Success		200			{array}		dto.AnnotationResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"failed to list annotations"
//	@Router			/annotations [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListAnnotations(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		q := db.Where("organization_id = ?", orgID)

		if key := strings.TrimSpace(r.URL.Query().Get("key")); key != "" {
			q = q.Where(`key = ?`, key)
		}
		if val := strings.TrimSpace(r.URL.Query().Get("value")); val != "" {
			q = q.Where(`value = ?`, val)
		}
		if needle := strings.TrimSpace(r.URL.Query().Get("q")); needle != "" {
			q = q.Where(`key ILIKE ?`, "%"+needle+"%")
		}

		var out []dto.AnnotationResponse
		if err := q.Model(&models.Annotation{}).Order("created_at DESC").Scan(&out).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		if out == nil {
			out = []dto.AnnotationResponse{}
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetAnnotation godoc
//
//	@ID				GetAnnotation
//	@Summary		Get annotation by ID (org scoped)
//	@Description	Returns one annotation. Add `include=node_pools` to include node pools.
//	@Tags			Annotations
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			id			path		string	true	"Annotation ID (UUID)"
//	@Success		200			{object}	dto.AnnotationResponse
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"fetch failed"
//	@Router			/annotations/{id} [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func GetAnnotation(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		var out dto.AnnotationResponse
		if err := db.Model(&models.Annotation{}).Where("id = ? AND organization_id = ?", id, orgID).First(&out).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "not_found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// CreateAnnotation godoc
//
//	@ID				CreateAnnotation
//	@Summary		Create annotation (org scoped)
//	@Description	Creates an annotation.
//	@Tags			Annotations
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string						false	"Organization UUID"
//	@Param			body		body		dto.CreateAnnotationRequest	true	"Annotation payload"
//	@Success		201			{object}	dto.AnnotationResponse
//	@Failure		400			{string}	string	"invalid json / missing fields"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"create failed"
//	@Router			/annotations [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func CreateAnnotation(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var req dto.CreateAnnotationRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		req.Key = strings.TrimSpace(req.Key)
		req.Value = strings.TrimSpace(req.Value)

		if req.Key == "" || req.Value == "" {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "missing key/value")
			return
		}

		a := models.Annotation{
			AuditFields: common.AuditFields{OrganizationID: orgID},
			Key:         req.Key,
			Value:       req.Value,
		}

		if err := db.Create(&a).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := dto.AnnotationResponse{
			AuditFields: a.AuditFields,
			Key:         a.Key,
			Value:       a.Value,
		}
		utils.WriteJSON(w, http.StatusCreated, out)
	}
}

// UpdateAnnotation godoc
//
//	@ID				UpdateAnnotation
//	@Summary		Update annotation (org scoped)
//	@Description	Partially update annotation fields.
//	@Tags			Annotations
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string						false	"Organization UUID"
//	@Param			id			path		string						true	"Annotation ID (UUID)"
//	@Param			body		body		dto.UpdateAnnotationRequest	true	"Fields to update"
//	@Success		200			{object}	dto.AnnotationResponse
//	@Failure		400			{string}	string	"invalid id / invalid json"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"update failed"
//	@Router			/annotations/{id} [patch]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func UpdateAnnotation(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		var a models.Annotation
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&a).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "not_found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var req dto.UpdateAnnotationRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		if req.Key != nil {
			a.Key = strings.TrimSpace(*req.Key)
		}
		if req.Value != nil {
			a.Value = strings.TrimSpace(*req.Value)
		}

		if err := db.Save(&a).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := dto.AnnotationResponse{
			AuditFields: a.AuditFields,
			Key:         a.Key,
			Value:       a.Value,
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// DeleteAnnotation godoc
//
//	@ID				DeleteAnnotation
//	@Summary		Delete annotation (org scoped)
//	@Description	Permanently deletes the annotation.
//	@Tags			Annotations
//	@Produce		json
//	@Param			X-Org-ID	header	string	false	"Organization UUID"
//	@Param			id			path	string	true	"Annotation ID (UUID)"
//	@Success		204			"No Content"
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"delete failed"
//	@Router			/annotations/{id} [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DeleteAnnotation(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		if err := db.Where("id = ? AND organization_id = ?", id, orgID).Delete(&models.Annotation{}).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}
</file>

<file path="internal/handlers/auth.go">
package handlers

import (
	"context"
	"encoding/base64"
	"encoding/json"
	"html/template"
	"net/http"
	"net/url"
	"strings"
	"time"

	"github.com/coreos/go-oidc/v3/oidc"
	"github.com/glueops/autoglue/internal/auth"
	"github.com/glueops/autoglue/internal/config"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"golang.org/x/oauth2"
	"gorm.io/gorm"
)

type oauthProvider struct {
	Name     string
	Issuer   string
	Scopes   []string
	ClientID string
	Secret   string
}

func providerConfig(cfg config.Config, name string) (oauthProvider, bool) {
	switch strings.ToLower(name) {
	case "google":
		return oauthProvider{
			Name:     "google",
			Issuer:   "https://accounts.google.com",
			Scopes:   []string{oidc.ScopeOpenID, "email", "profile"},
			ClientID: cfg.GoogleClientID,
			Secret:   cfg.GoogleClientSecret,
		}, true
	case "github":
		// GitHub is not a pure OIDC provider; we use OAuth2 + user email API
		return oauthProvider{
			Name:     "github",
			Issuer:   "github",
			Scopes:   []string{"read:user", "user:email"},
			ClientID: cfg.GithubClientID, Secret: cfg.GithubClientSecret,
		}, true
	}
	return oauthProvider{}, false
}

// AuthStart godoc
//
//	@ID				AuthStart
//	@Summary		Begin social login
//	@Description	Returns provider authorization URL for the frontend to redirect
//	@Tags			Auth
//	@Param			provider	path	string	true	"google|github"
//	@Produce		json
//	@Success		200	{object}	dto.AuthStartResponse
//	@Router			/auth/{provider}/start [post]
func AuthStart(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		cfg, _ := config.Load()
		provider := strings.ToLower(chi.URLParam(r, "provider"))

		p, ok := providerConfig(cfg, provider)
		if !ok || p.ClientID == "" || p.Secret == "" {
			utils.WriteError(w, http.StatusBadRequest, "unsupported_provider", "provider not configured")
			return
		}

		redirect := cfg.OAuthRedirectBase + "/api/v1/auth/" + p.Name + "/callback"

		// Optional SPA hints to be embedded into state
		mode := r.URL.Query().Get("mode")     // "spa" enables postMessage callback page
		origin := r.URL.Query().Get("origin") // e.g. http://localhost:5173

		state := uuid.NewString()
		if mode == "spa" && origin != "" {
			state = state + "|mode=spa|origin=" + url.QueryEscape(origin)
		}

		var authURL string

		if p.Issuer == "github" {
			o := &oauth2.Config{
				ClientID:     p.ClientID,
				ClientSecret: p.Secret,
				RedirectURL:  redirect,
				Scopes:       p.Scopes,
				Endpoint: oauth2.Endpoint{
					AuthURL:  "https://github.com/login/oauth/authorize",
					TokenURL: "https://github.com/login/oauth/access_token",
				},
			}
			authURL = o.AuthCodeURL(state, oauth2.AccessTypeOffline)
		} else {
			// Google OIDC
			ctx := context.Background()
			prov, err := oidc.NewProvider(ctx, p.Issuer)
			if err != nil {
				utils.WriteError(w, http.StatusInternalServerError, "oidc_discovery_failed", err.Error())
				return
			}
			o := &oauth2.Config{
				ClientID:     p.ClientID,
				ClientSecret: p.Secret,
				RedirectURL:  redirect,
				Endpoint:     prov.Endpoint(),
				Scopes:       p.Scopes,
			}
			authURL = o.AuthCodeURL(state, oauth2.AccessTypeOffline)
		}

		utils.WriteJSON(w, http.StatusOK, dto.AuthStartResponse{AuthURL: authURL})
	}
}

// AuthCallback godoc
//
//	@ID			AuthCallback
//	@Summary	Handle social login callback
//	@Tags		Auth
//	@Param		provider	path	string	true	"google|github"
//	@Produce	json
//	@Success	200	{object}	dto.TokenPair
//	@Router		/auth/{provider}/callback [get]
func AuthCallback(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		cfg, _ := config.Load()
		provider := strings.ToLower(chi.URLParam(r, "provider"))

		p, ok := providerConfig(cfg, provider)
		if !ok {
			utils.WriteError(w, http.StatusBadRequest, "unsupported_provider", "provider not configured")
			return
		}

		code := r.URL.Query().Get("code")
		if code == "" {
			utils.WriteError(w, http.StatusBadRequest, "invalid_request", "missing code")
			return
		}
		redirect := cfg.OAuthRedirectBase + "/api/v1/auth/" + p.Name + "/callback"

		var email, display, subject string

		if p.Issuer == "github" {
			// OAuth2 code exchange
			o := &oauth2.Config{
				ClientID:     p.ClientID,
				ClientSecret: p.Secret,
				RedirectURL:  redirect,
				Scopes:       p.Scopes,
				Endpoint: oauth2.Endpoint{
					AuthURL:  "https://github.com/login/oauth/authorize",
					TokenURL: "https://github.com/login/oauth/access_token",
				},
			}
			tok, err := o.Exchange(r.Context(), code)
			if err != nil {
				utils.WriteError(w, http.StatusUnauthorized, "exchange_failed", err.Error())
				return
			}
			// Fetch user primary email
			req, _ := http.NewRequest("GET", "https://api.github.com/user/emails", nil)
			req.Header.Set("Authorization", "token "+tok.AccessToken)
			resp, err := http.DefaultClient.Do(req)
			if err != nil || resp.StatusCode != 200 {
				utils.WriteError(w, http.StatusUnauthorized, "email_fetch_failed", "github user/emails")
				return
			}
			defer resp.Body.Close()
			var emails []struct {
				Email    string `json:"email"`
				Primary  bool   `json:"primary"`
				Verified bool   `json:"verified"`
			}
			if err := json.NewDecoder(resp.Body).Decode(&emails); err != nil || len(emails) == 0 {
				utils.WriteError(w, http.StatusUnauthorized, "email_parse_failed", err.Error())
				return
			}
			email = emails[0].Email
			for _, e := range emails {
				if e.Primary {
					email = e.Email
					break
				}
			}
			subject = "github:" + email
			display = strings.Split(email, "@")[0]
		} else {
			// Google OIDC
			oidcProv, err := oidc.NewProvider(r.Context(), p.Issuer)
			if err != nil {
				utils.WriteError(w, 500, "oidc_discovery_failed", err.Error())
				return
			}
			o := &oauth2.Config{
				ClientID:     p.ClientID,
				ClientSecret: p.Secret,
				RedirectURL:  redirect,
				Endpoint:     oidcProv.Endpoint(),
				Scopes:       p.Scopes,
			}
			tok, err := o.Exchange(r.Context(), code)
			if err != nil {
				utils.WriteError(w, 401, "exchange_failed", err.Error())
				return
			}

			verifier := oidcProv.Verifier(&oidc.Config{ClientID: p.ClientID})
			rawIDToken, ok := tok.Extra("id_token").(string)
			if !ok {
				utils.WriteError(w, 401, "no_id_token", "")
				return
			}
			idt, err := verifier.Verify(r.Context(), rawIDToken)
			if err != nil {
				utils.WriteError(w, 401, "id_token_invalid", err.Error())
				return
			}

			var claims struct {
				Email         string `json:"email"`
				EmailVerified bool   `json:"email_verified"`
				Name          string `json:"name"`
				Sub           string `json:"sub"`
			}
			if err := idt.Claims(&claims); err != nil {
				utils.WriteError(w, 401, "claims_parse_error", err.Error())
				return
			}
			email = strings.ToLower(claims.Email)
			display = claims.Name
			subject = "google:" + claims.Sub
		}

		// Upsert Account + User; domain auto-join (member)
		user, err := upsertAccountAndUser(db, p.Name, subject, email, display)
		if err != nil {
			utils.WriteError(w, 500, "account_upsert_failed", err.Error())
			return
		}

		// Org auto-join: Organization.Domain == email domain
		_ = ensureAutoMembership(db, user.ID, email)

		// Issue tokens
		accessTTL := 1 * time.Hour
		refreshTTL := 30 * 24 * time.Hour

		cfgLoaded, _ := config.Load()
		access, err := auth.IssueAccessToken(auth.IssueOpts{
			Subject:  user.ID.String(),
			Issuer:   cfgLoaded.JWTIssuer,
			Audience: cfgLoaded.JWTAudience,
			TTL:      accessTTL,
			Claims: map[string]any{
				"email": email,
				"name":  display,
			},
		})
		if err != nil {
			utils.WriteError(w, 500, "issue_access_failed", err.Error())
			return
		}

		rp, err := auth.IssueRefreshToken(db, user.ID, refreshTTL, nil)
		if err != nil {
			utils.WriteError(w, 500, "issue_refresh_failed", err.Error())
			return
		}

		secure := true
		if u, err := url.Parse(cfg.OAuthRedirectBase); err == nil && isLocalDev(u) {
			secure = false
		}
		if xf := r.Header.Get("X-Forwarded-Proto"); xf != "" {
			secure = strings.EqualFold(xf, "https")
		}

		http.SetCookie(w, &http.Cookie{
			Name:     "ag_jwt",
			Value:    "Bearer " + access,
			Path:     "/",
			HttpOnly: true,
			SameSite: http.SameSiteLaxMode,
			Secure:   secure,
			MaxAge:   int((time.Hour * 8).Seconds()),
		})

		// If the state indicates SPA popup mode, postMessage tokens to the opener and close
		state := r.URL.Query().Get("state")
		if strings.Contains(state, "mode=spa") {
			origin := canonicalOrigin(cfg.OAuthRedirectBase)
			if origin == "" {
				origin = cfg.OAuthRedirectBase
			}
			payload := dto.TokenPair{
				AccessToken:  access,
				RefreshToken: rp.Plain,
				TokenType:    "Bearer",
				ExpiresIn:    int64(accessTTL.Seconds()),
			}
			writePostMessageHTML(w, origin, payload)
			return
		}

		// Default JSON response
		utils.WriteJSON(w, http.StatusOK, dto.TokenPair{
			AccessToken:  access,
			RefreshToken: rp.Plain,
			TokenType:    "Bearer",
			ExpiresIn:    int64(accessTTL.Seconds()),
		})
	}
}

// Refresh godoc
//
//	@ID			Refresh
//	@Summary	Rotate refresh token
//	@Tags		Auth
//	@Accept		json
//	@Produce	json
//	@Param		body	body		dto.RefreshRequest	true	"Refresh token"
//	@Success	200		{object}	dto.TokenPair
//	@Router		/auth/refresh [post]
func Refresh(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		cfg, _ := config.Load()
		var req dto.RefreshRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, 400, "invalid_json", err.Error())
			return
		}
		rec, err := auth.ValidateRefreshToken(db, req.RefreshToken)
		if err != nil {
			utils.WriteError(w, 401, "invalid_refresh", "")
			return
		}

		var u models.User
		if err := db.First(&u, "id = ? AND is_disabled = false", rec.UserID).Error; err != nil {
			utils.WriteError(w, 401, "user_disabled", "")
			return
		}

		// rotate
		newPair, err := auth.RotateRefreshToken(db, rec, 30*24*time.Hour)
		if err != nil {
			utils.WriteError(w, 500, "rotate_failed", err.Error())
			return
		}

		// new access
		access, err := auth.IssueAccessToken(auth.IssueOpts{
			Subject:  u.ID.String(),
			Issuer:   cfg.JWTIssuer,
			Audience: cfg.JWTAudience,
			TTL:      1 * time.Hour,
		})
		if err != nil {
			utils.WriteError(w, 500, "issue_access_failed", err.Error())
			return
		}

		secure := true
		if uParsed, err := url.Parse(cfg.OAuthRedirectBase); err == nil && isLocalDev(uParsed) {
			secure = false
		}
		if xf := r.Header.Get("X-Forwarded-Proto"); xf != "" {
			secure = strings.EqualFold(xf, "https")
		}

		http.SetCookie(w, &http.Cookie{
			Name:     "ag_jwt",
			Value:    "Bearer " + access,
			Path:     "/",
			HttpOnly: true,
			SameSite: http.SameSiteLaxMode,
			Secure:   secure,
			MaxAge:   int((time.Hour * 8).Seconds()),
		})

		utils.WriteJSON(w, 200, dto.TokenPair{
			AccessToken:  access,
			RefreshToken: newPair.Plain,
			TokenType:    "Bearer",
			ExpiresIn:    3600,
		})
	}
}

// Logout godoc
//
//	@ID			Logout
//	@Summary	Revoke refresh token family (logout everywhere)
//	@Tags		Auth
//	@Accept		json
//	@Produce	json
//	@Param		body	body	dto.LogoutRequest	true	"Refresh token"
//	@Success	204		"No Content"
//	@Router		/auth/logout [post]
func Logout(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		cfg, _ := config.Load()
		var req dto.LogoutRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, 400, "invalid_json", err.Error())
			return
		}
		rec, err := auth.ValidateRefreshToken(db, req.RefreshToken)
		if err != nil {
			w.WriteHeader(204) // already invalid/revoked
			goto clearCookie
		}
		if err := auth.RevokeFamily(db, rec.FamilyID); err != nil {
			utils.WriteError(w, 500, "revoke_failed", err.Error())
			return
		}

	clearCookie:
		secure := true
		if uParsed, err := url.Parse(cfg.OAuthRedirectBase); err == nil && isLocalDev(uParsed) {
			secure = false
		}

		http.SetCookie(w, &http.Cookie{
			Name:     "ag_jwt",
			Value:    "",
			Path:     "/",
			HttpOnly: true,
			MaxAge:   -1,
			Expires:  time.Unix(0, 0),
			SameSite: http.SameSiteLaxMode,
			Secure:   secure,
		})

		w.WriteHeader(204)
	}
}

// Helpers

func upsertAccountAndUser(db *gorm.DB, provider, subject, email, display string) (*models.User, error) {
	email = strings.ToLower(email)
	var acc models.Account
	if err := db.Where("provider = ? AND subject = ?", provider, subject).First(&acc).Error; err == nil {
		var u models.User
		if err := db.First(&u, "id = ?", acc.UserID).Error; err != nil {
			return nil, err
		}
		return &u, nil
	}
	// Link by email if exists
	var ue models.UserEmail
	if err := db.Where("LOWER(email) = ?", email).First(&ue).Error; err == nil {
		acc = models.Account{
			UserID:        ue.UserID,
			Provider:      provider,
			Subject:       subject,
			Email:         &email,
			EmailVerified: true,
		}
		if err := db.Create(&acc).Error; err != nil {
			return nil, err
		}
		var u models.User
		if err := db.First(&u, "id = ?", ue.UserID).Error; err != nil {
			return nil, err
		}
		return &u, nil
	}
	// Create user
	u := models.User{DisplayName: &display, PrimaryEmail: &email}
	if err := db.Create(&u).Error; err != nil {
		return nil, err
	}
	ue = models.UserEmail{UserID: u.ID, Email: email, IsVerified: true, IsPrimary: true}
	_ = db.Create(&ue).Error
	acc = models.Account{UserID: u.ID, Provider: provider, Subject: subject, Email: &email, EmailVerified: true}
	_ = db.Create(&acc).Error
	return &u, nil
}

func ensureAutoMembership(db *gorm.DB, userID uuid.UUID, email string) error {
	parts := strings.SplitN(strings.ToLower(email), "@", 2)
	if len(parts) != 2 {
		return nil
	}
	domain := parts[1]
	var org models.Organization
	if err := db.Where("LOWER(domain) = ?", domain).First(&org).Error; err != nil {
		return nil
	}
	// if already member, done
	var c int64
	db.Model(&models.Membership{}).
		Where("user_id = ? AND organization_id = ?", userID, org.ID).
		Count(&c)
	if c > 0 {
		return nil
	}
	return db.Create(&models.Membership{
		UserID: userID, OrganizationID: org.ID, Role: "member",
	}).Error
}

// postMessage HTML template
var postMessageTpl = template.Must(template.New("postmsg").Parse(`<!doctype html>
<html>
  <body>
    <script>
      (function(){
        try {
          var data = JSON.parse(atob("{{.PayloadB64}}"));
          if (window.opener) {
            window.opener.postMessage(
              { type: 'autoglue:auth', payload: data },
              "{{.Origin}}"
            );
          }
        } catch (e) {}
        window.close();
      })();
    </script>
  </body>
</html>`))

type postMessageData struct {
	Origin     string
	PayloadB64 string
}

// writePostMessageHTML sends a tiny HTML page that posts tokens to the SPA and closes the window.
func writePostMessageHTML(w http.ResponseWriter, origin string, payload dto.TokenPair) {
	b, _ := json.Marshal(payload)

	data := postMessageData{
		Origin:     origin,
		PayloadB64: base64.StdEncoding.EncodeToString(b),
	}

	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	w.Header().Set("Cache-Control", "no-store")
	w.WriteHeader(http.StatusOK)
	_ = postMessageTpl.Execute(w, data)
}

// canonicalOrigin returns scheme://host[:port] for a given URL, or "" if invalid.
func canonicalOrigin(raw string) string {
	u, err := url.Parse(raw)
	if err != nil || u.Scheme == "" || u.Host == "" {
		return ""
	}

	// Normalize: no path/query/fragment — just the origin.
	return (&url.URL{
		Scheme: u.Scheme,
		Host:   u.Host,
	}).String()
}

func isLocalDev(u *url.URL) bool {
	host := strings.ToLower(u.Hostname())
	return u.Scheme == "http" &&
		(host == "localhost" || host == "127.0.0.1")
}
</file>

<file path="internal/handlers/cluster_runs.go">
package handlers

import (
	"errors"
	"net/http"
	"time"

	"github.com/dyaksa/archer"
	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/bg"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// ListClusterRuns godoc
//
//	@ID				ListClusterRuns
//	@Summary		List cluster runs (org scoped)
//	@Description	Returns runs for a cluster within the organization in X-Org-ID.
//	@Tags			ClusterRuns
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Success		200			{array}		dto.ClusterRunResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/runs [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListClusterRuns(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		// Ensure cluster exists + org scoped
		if err := db.Select("id").
			Where("id = ? AND organization_id = ?", clusterID, orgID).
			First(&models.Cluster{}).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var rows []models.ClusterRun
		if err := db.
			Where("organization_id = ? AND cluster_id = ?", orgID, clusterID).
			Order("created_at DESC").
			Find(&rows).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := make([]dto.ClusterRunResponse, 0, len(rows))
		for _, cr := range rows {
			out = append(out, clusterRunToDTO(cr))
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetClusterRun godoc
//
//	@ID				GetClusterRun
//	@Summary		Get a cluster run (org scoped)
//	@Description	Returns a single run for a cluster within the organization in X-Org-ID.
//	@Tags			ClusterRuns
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Param			runID		path		string	true	"Run ID"
//	@Success		200			{object}	dto.ClusterRunResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/runs/{runID} [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func GetClusterRun(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		runID, err := uuid.Parse(chi.URLParam(r, "runID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_run_id", "invalid run id")
			return
		}

		var row models.ClusterRun
		if err := db.
			Where("id = ? AND organization_id = ? AND cluster_id = ?", runID, orgID, clusterID).
			First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "run not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterRunToDTO(row))
	}
}

// RunClusterAction godoc
//
//	@ID				RunClusterAction
//	@Summary		Run an admin-configured action on a cluster (org scoped)
//	@Description	Creates a ClusterRun record for the cluster/action. Execution is handled asynchronously by workers.
//	@Tags			ClusterRuns
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Param			actionID	path		string	true	"Action ID"
//	@Success		201			{object}	dto.ClusterRunResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster or action not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/actions/{actionID}/runs [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func RunClusterAction(db *gorm.DB, jobs *bg.Jobs) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		actionID, err := uuid.Parse(chi.URLParam(r, "actionID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_action_id", "invalid action id")
			return
		}

		// cluster must exist + org scoped
		var cluster models.Cluster
		if err := db.Select("id", "organization_id").
			Where("id = ? AND organization_id = ?", clusterID, orgID).
			First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		// action is global/admin-configured (not org scoped)
		var action models.Action
		if err := db.Where("id = ?", actionID).First(&action).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "action_not_found", "action not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		run := models.ClusterRun{
			OrganizationID: orgID,
			ClusterID:      clusterID,
			Action:         action.MakeTarget, // this is what you actually execute
			Status:         models.ClusterRunStatusQueued,
			Error:          "",
			FinishedAt:     time.Time{},
		}

		if err := db.Create(&run).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		args := bg.ClusterActionArgs{
			OrgID:      orgID,
			ClusterID:  clusterID,
			Action:     action.MakeTarget,
			MakeTarget: action.MakeTarget,
		}
		// Enqueue with run.ID as the job ID so the worker can look it up.
		_, enqueueErr := jobs.Enqueue(
			r.Context(),
			run.ID.String(),
			"cluster_action",
			args,
			archer.WithMaxRetries(0),
		)

		if enqueueErr != nil {
			_ = db.Model(&models.ClusterRun{}).
				Where("id = ?", run.ID).
				Updates(map[string]any{
					"status":      models.ClusterRunStatusFailed,
					"error":       "failed to enqueue job: " + enqueueErr.Error(),
					"finished_at": time.Now().UTC(),
				}).Error

			utils.WriteError(w, http.StatusInternalServerError, "job_error", "failed to enqueue cluster action")
			return
		}
		utils.WriteJSON(w, http.StatusCreated, clusterRunToDTO(run))

	}
}

func clusterRunToDTO(cr models.ClusterRun) dto.ClusterRunResponse {
	var finished *time.Time
	if !cr.FinishedAt.IsZero() {
		t := cr.FinishedAt
		finished = &t
	}
	return dto.ClusterRunResponse{
		ID:             cr.ID,
		OrganizationID: cr.OrganizationID,
		ClusterID:      cr.ClusterID,
		Action:         cr.Action,
		Status:         cr.Status,
		Error:          cr.Error,
		CreatedAt:      cr.CreatedAt,
		UpdatedAt:      cr.UpdatedAt,
		FinishedAt:     finished,
	}
}
</file>

<file path="internal/handlers/clusters.go">
package handlers

import (
	"crypto/rand"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"strings"
	"time"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/common"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// ListClusters godoc
//
//	@ID				ListClusters
//	@Summary		List clusters (org scoped)
//	@Description	Returns clusters for the organization in X-Org-ID. Filter by `q` (name contains).
//	@Tags			Clusters
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			q			query		string	false	"Name contains (case-insensitive)"
//	@Success		200			{array}		dto.ClusterResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"failed to list clusters"
//	@Router			/clusters [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListClusters(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		q := db.Where("organization_id = ?", orgID)
		if needle := strings.TrimSpace(r.URL.Query().Get("q")); needle != "" {
			q = q.Where(`name ILIKE ?`, "%"+needle+"%")
		}

		var rows []models.Cluster
		if err := q.
			Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			Find(&rows).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := make([]dto.ClusterResponse, 0, len(rows))
		for _, row := range rows {
			cr := clusterToDTO(row)

			if row.EncryptedKubeconfig != "" && row.KubeIV != "" && row.KubeTag != "" {
				kubeconfig, err := utils.DecryptForOrg(orgID, row.EncryptedKubeconfig, row.KubeIV, row.KubeTag, db)
				if err != nil {
					utils.WriteError(w, http.StatusInternalServerError, "kubeconfig_decrypt_failed", "failed to decrypt kubeconfig")
					return
				}
				cr.Kubeconfig = &kubeconfig
			}
			out = append(out, cr)
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetCluster godoc
//
//	@ID				GetCluster
//	@Summary		Get a single cluster by ID (org scoped)
//	@Description	Returns a cluster with all related resources (domain, record set, load balancers, bastion, node pools).
//	@Tags			Clusters
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID} [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func GetCluster(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var cluster models.Cluster
		if err := db.
			Where("id = ? AND organization_id = ?", clusterID, orgID).
			Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster).Error; err != nil {

			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		resp := clusterToDTO(cluster)

		if cluster.EncryptedKubeconfig != "" && cluster.KubeIV != "" && cluster.KubeTag != "" {
			kubeconfig, err := utils.DecryptForOrg(orgID, cluster.EncryptedKubeconfig, cluster.KubeIV, cluster.KubeTag, db)
			if err != nil {
				utils.WriteError(w, http.StatusInternalServerError, "kubeconfig_decrypt_failed", "failed to decrypt kubeconfig")
				return
			}
			resp.Kubeconfig = &kubeconfig
		}

		utils.WriteJSON(w, http.StatusOK, resp)
	}
}

// CreateCluster godoc
//
//	@ID				CreateCluster
//	@Summary		Create cluster (org scoped)
//	@Description	Creates a cluster. Status is managed by the system and starts as `pre_pending` for validation.
//	@Tags			Clusters
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string						false	"Organization UUID"
//	@Param			body		body		dto.CreateClusterRequest	true	"payload"
//	@Success		201			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"invalid json"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"create failed"
//	@Router			/clusters [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func CreateCluster(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var in dto.CreateClusterRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		certificateKey, err := GenerateSecureHex(32)
		if err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "internal_error", "failed to generate certificate key")
			return
		}

		randomToken, err := GenerateFormattedToken()
		if err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "internal_error", "failed to generate random token")
			return
		}

		c := models.Cluster{
			OrganizationID: orgID,
			Name:           in.Name,
			Provider:       in.ClusterProvider,
			Region:         in.Region,
			Status:         models.ClusterStatusPrePending,
			LastError:      "",
			CertificateKey: certificateKey,
			RandomToken:    randomToken,
			DockerImage:    in.DockerImage,
			DockerTag:      in.DockerTag,
		}

		if err := db.Create(&c).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusCreated, clusterToDTO(c))
	}
}

// UpdateCluster godoc
//
//	@ID				UpdateCluster
//	@Summary		Update basic cluster details (org scoped)
//	@Description	Updates the cluster name, provider, and/or region. Status is managed by the system.
//	@Tags			Clusters
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string						false	"Organization UUID"
//	@Param			clusterID	path		string						true	"Cluster ID"
//	@Param			body		body		dto.UpdateClusterRequest	true	"payload"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID} [patch]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func UpdateCluster(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var in dto.UpdateClusterRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		// Apply only provided fields
		if in.Name != nil {
			cluster.Name = *in.Name
		}
		if in.ClusterProvider != nil {
			cluster.Provider = *in.ClusterProvider
		}
		if in.Region != nil {
			cluster.Region = *in.Region
		}

		if in.DockerImage != nil {
			cluster.DockerImage = *in.DockerImage
		}

		if in.DockerTag != nil {
			cluster.DockerTag = *in.DockerTag
		}

		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		// Any change to the cluster config may require re-validation.
		_ = markClusterNeedsValidation(db, cluster.ID)

		// Preload for a rich response
		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// DeleteCluster godoc
//
//	@ID				DeleteCluster
//	@Summary		Delete a cluster (org scoped)
//	@Description	Deletes the cluster. Related resources are cleaned up via DB constraints (e.g. CASCADE).
//	@Tags			Clusters
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Success		204			{string}	string	"deleted"
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID} [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DeleteCluster(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		tx := db.Where("id = ? AND organization_id = ?", clusterID, orgID).Delete(&models.Cluster{})
		if tx.Error != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		if tx.RowsAffected == 0 {
			utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
			return
		}

		w.WriteHeader(http.StatusNoContent)
	}
}

// AttachCaptainDomain godoc
//
//	@ID				AttachCaptainDomain
//	@Summary		Attach a captain domain to a cluster
//	@Description	Sets captain_domain_id on the cluster. Validation of shape happens asynchronously.
//	@Tags			Clusters
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string							false	"Organization UUID"
//	@Param			clusterID	path		string							true	"Cluster ID"
//	@Param			body		body		dto.AttachCaptainDomainRequest	true	"payload"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster or domain not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/captain-domain [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func AttachCaptainDomain(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var in dto.AttachCaptainDomainRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		// Ensure domain exists and belongs to the org
		var domain models.Domain
		if err := db.Where("id = ? AND organization_id = ?", in.DomainID, orgID).First(&domain).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "domain_not_found", "domain not found for organization")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.CaptainDomainID = &domain.ID
		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		if err := markClusterNeedsValidation(db, cluster.ID); err != nil {
			// Don't fail the request, just log if you have logging.
		}

		// Preload domain for response
		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// DetachCaptainDomain godoc
//
//	@ID				DetachCaptainDomain
//	@Summary		Detach the captain domain from a cluster
//	@Description	Clears captain_domain_id on the cluster. This will likely cause the cluster to become incomplete.
//	@Tags			Clusters
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/captain-domain [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DetachCaptainDomain(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.CaptainDomainID = nil
		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// AttachControlPlaneRecordSet godoc
//
//	@ID				AttachControlPlaneRecordSet
//	@Summary		Attach a control plane record set to a cluster
//	@Description	Sets control_plane_record_set_id on the cluster.
//	@Tags			Clusters
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string						false	"Organization UUID"
//	@Param			clusterID	path		string						true	"Cluster ID"
//	@Param			body		body		dto.AttachRecordSetRequest	true	"payload"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster or record set not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/control-plane-record-set [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func AttachControlPlaneRecordSet(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var in dto.AttachRecordSetRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		// record sets are indirectly org-scoped via their domain
		var rs models.RecordSet
		if err := db.
			Joins("JOIN domains d ON d.id = record_sets.domain_id").
			Where("record_sets.id = ? AND d.organization_id = ?", in.RecordSetID, orgID).
			First(&rs).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "recordset_not_found", "record set not found for organization")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.ControlPlaneRecordSetID = &rs.ID
		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// DetachControlPlaneRecordSet godoc
//
//	@ID				DetachControlPlaneRecordSet
//	@Summary		Detach the control plane record set from a cluster
//	@Description	Clears control_plane_record_set_id on the cluster.
//	@Tags			Clusters
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/control-plane-record-set [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DetachControlPlaneRecordSet(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.ControlPlaneRecordSetID = nil
		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// AttachAppsLoadBalancer godoc
//
//	@ID				AttachAppsLoadBalancer
//	@Summary		Attach an apps load balancer to a cluster
//	@Description	Sets apps_load_balancer_id on the cluster.
//	@Tags			Clusters
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string							false	"Organization UUID"
//	@Param			clusterID	path		string							true	"Cluster ID"
//	@Param			body		body		dto.AttachLoadBalancerRequest	true	"payload"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster or load balancer not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/apps-load-balancer [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func AttachAppsLoadBalancer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var in dto.AttachLoadBalancerRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var lb models.LoadBalancer
		if err := db.Where("id = ? AND organization_id = ?", in.LoadBalancerID, orgID).First(&lb).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "lb_not_found", "load balancer not found for organization")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.AppsLoadBalancerID = &lb.ID
		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// DetachAppsLoadBalancer godoc
//
//	@ID				DetachAppsLoadBalancer
//	@Summary		Detach the apps load balancer from a cluster
//	@Description	Clears apps_load_balancer_id on the cluster.
//	@Tags			Clusters
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/apps-load-balancer [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DetachAppsLoadBalancer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.AppsLoadBalancerID = nil
		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// AttachGlueOpsLoadBalancer godoc
//
//	@ID				AttachGlueOpsLoadBalancer
//	@Summary		Attach a GlueOps/control-plane load balancer to a cluster
//	@Description	Sets glueops_load_balancer_id on the cluster.
//	@Tags			Clusters
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string							false	"Organization UUID"
//	@Param			clusterID	path		string							true	"Cluster ID"
//	@Param			body		body		dto.AttachLoadBalancerRequest	true	"payload"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster or load balancer not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/glueops-load-balancer [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func AttachGlueOpsLoadBalancer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var in dto.AttachLoadBalancerRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var lb models.LoadBalancer
		if err := db.Where("id = ? AND organization_id = ?", in.LoadBalancerID, orgID).First(&lb).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "lb_not_found", "load balancer not found for organization")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.GlueOpsLoadBalancerID = &lb.ID
		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// DetachGlueOpsLoadBalancer godoc
//
//	@ID				DetachGlueOpsLoadBalancer
//	@Summary		Detach the GlueOps/control-plane load balancer from a cluster
//	@Description	Clears glueops_load_balancer_id on the cluster.
//	@Tags			Clusters
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/glueops-load-balancer [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DetachGlueOpsLoadBalancer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.GlueOpsLoadBalancerID = nil
		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// AttachBastionServer godoc
//
//	@ID				AttachBastionServer
//	@Summary		Attach a bastion server to a cluster
//	@Description	Sets bastion_server_id on the cluster.
//	@Tags			Clusters
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string						false	"Organization UUID"
//	@Param			clusterID	path		string						true	"Cluster ID"
//	@Param			body		body		dto.AttachBastionRequest	true	"payload"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster or server not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/bastion [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func AttachBastionServer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var in dto.AttachBastionRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var server models.Server
		if err := db.Where("id = ? AND organization_id = ?", in.ServerID, orgID).First(&server).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "server_not_found", "server not found for organization")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.BastionServerID = &server.ID
		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// DetachBastionServer godoc
//
//	@ID				DetachBastionServer
//	@Summary		Detach the bastion server from a cluster
//	@Description	Clears bastion_server_id on the cluster.
//	@Tags			Clusters
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/bastion [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DetachBastionServer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.BastionServerID = nil
		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// SetClusterKubeconfig godoc
//
//	@ID				SetClusterKubeconfig
//	@Summary		Set (or replace) the kubeconfig for a cluster
//	@Description	Stores the kubeconfig encrypted per organization. The kubeconfig is never returned in responses.
//	@Tags			Clusters
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string						false	"Organization UUID"
//	@Param			clusterID	path		string						true	"Cluster ID"
//	@Param			body		body		dto.SetKubeconfigRequest	true	"payload"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/kubeconfig [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func SetClusterKubeconfig(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var in dto.SetKubeconfigRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		ct, iv, tag, err := utils.EncryptForOrg(orgID, []byte(in.Kubeconfig), db)
		if err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "encryption_error", "failed to encrypt kubeconfig")
			return
		}

		cluster.EncryptedKubeconfig = ct
		cluster.KubeIV = iv
		cluster.KubeTag = tag

		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// ClearClusterKubeconfig godoc
//
//	@ID				ClearClusterKubeconfig
//	@Summary		Clear the kubeconfig for a cluster
//	@Description	Removes the encrypted kubeconfig, IV, and tag from the cluster record.
//	@Tags			Clusters
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/kubeconfig [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ClearClusterKubeconfig(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var cluster models.Cluster
		if err := db.Where("id = ? AND organization_id = ?", clusterID, orgID).First(&cluster).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		cluster.EncryptedKubeconfig = ""
		cluster.KubeIV = ""
		cluster.KubeTag = ""

		if err := db.Save(&cluster).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// AttachNodePool godoc
//
//	@ID				AttachNodePool
//	@Summary		Attach a node pool to a cluster
//	@Description	Adds an entry in the cluster_node_pools join table.
//	@Tags			Clusters
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string						false	"Organization UUID"
//	@Param			clusterID	path		string						true	"Cluster ID"
//	@Param			body		body		dto.AttachNodePoolRequest	true	"payload"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster or node pool not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/node-pools [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func AttachNodePool(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		var in dto.AttachNodePoolRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		// Load cluster (org scoped)
		var cluster models.Cluster
		if err := db.
			Where("id = ? AND organization_id = ?", clusterID, orgID).
			First(&cluster).Error; err != nil {

			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		// Load node pool (org scoped)
		var np models.NodePool
		if err := db.
			Where("id = ? AND organization_id = ?", in.NodePoolID, orgID).
			First(&np).Error; err != nil {

			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "nodepool_not_found", "node pool not found for organization")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		// Create association in join table
		if err := db.Model(&cluster).Association("NodePools").Append(&np); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to attach node pool")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		// Reload for rich response
		if err := db.
			Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {

			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// DetachNodePool godoc
//
//	@ID				DetachNodePool
//	@Summary		Detach a node pool from a cluster
//	@Description	Removes an entry from the cluster_node_pools join table.
//	@Tags			Clusters
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			clusterID	path		string	true	"Cluster ID"
//	@Param			nodePoolID	path		string	true	"Node Pool ID"
//	@Success		200			{object}	dto.ClusterResponse
//	@Failure		400			{string}	string	"bad request"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"cluster or node pool not found"
//	@Failure		500			{string}	string	"db error"
//	@Router			/clusters/{clusterID}/node-pools/{nodePoolID} [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DetachNodePool(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		clusterID, err := uuid.Parse(chi.URLParam(r, "clusterID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_cluster_id", "invalid cluster id")
			return
		}

		nodePoolID, err := uuid.Parse(chi.URLParam(r, "nodePoolID"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_nodepool_id", "invalid node pool id")
			return
		}

		var cluster models.Cluster
		if err := db.
			Where("id = ? AND organization_id = ?", clusterID, orgID).
			First(&cluster).Error; err != nil {

			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "cluster not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var np models.NodePool
		if err := db.
			Where("id = ? AND organization_id = ?", nodePoolID, orgID).
			First(&np).Error; err != nil {

			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "nodepool_not_found", "node pool not found for organization")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		if err := db.Model(&cluster).Association("NodePools").Delete(&np); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to detach node pool")
			return
		}

		_ = markClusterNeedsValidation(db, cluster.ID)

		if err := db.
			Preload("CaptainDomain").
			Preload("ControlPlaneRecordSet").
			Preload("AppsLoadBalancer").
			Preload("GlueOpsLoadBalancer").
			Preload("BastionServer").
			Preload("NodePools").
			Preload("NodePools.Labels").
			Preload("NodePools.Annotations").
			Preload("NodePools.Taints").
			Preload("NodePools.Servers").
			First(&cluster, "id = ?", cluster.ID).Error; err != nil {

			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, clusterToDTO(cluster))
	}
}

// -- Helpers

func clusterToDTO(c models.Cluster) dto.ClusterResponse {
	var bastion *dto.ServerResponse
	if c.BastionServer != nil {
		b := serverToDTO(*c.BastionServer)
		bastion = &b
	}

	var captainDomain *dto.DomainResponse
	if c.CaptainDomainID != nil && c.CaptainDomain.ID != uuid.Nil {
		dr := domainToDTO(c.CaptainDomain)
		captainDomain = &dr
	}

	var controlPlane *dto.RecordSetResponse
	if c.ControlPlaneRecordSet != nil {
		rr := recordSetToDTO(*c.ControlPlaneRecordSet)
		controlPlane = &rr
	}

	var cfqdn *string
	if captainDomain != nil && controlPlane != nil {
		fq := fmt.Sprintf("%s.%s", controlPlane.Name, captainDomain.DomainName)
		cfqdn = &fq
	}

	var appsLB *dto.LoadBalancerResponse
	if c.AppsLoadBalancer != nil {
		lr := loadBalancerToDTO(*c.AppsLoadBalancer)
		appsLB = &lr
	}

	var glueOpsLB *dto.LoadBalancerResponse
	if c.GlueOpsLoadBalancer != nil {
		lr := loadBalancerToDTO(*c.GlueOpsLoadBalancer)
		glueOpsLB = &lr
	}

	nps := make([]dto.NodePoolResponse, 0, len(c.NodePools))
	for _, np := range c.NodePools {
		nps = append(nps, nodePoolToDTO(np))
	}

	return dto.ClusterResponse{
		ID:                    c.ID,
		Name:                  c.Name,
		CaptainDomain:         captainDomain,
		ControlPlaneRecordSet: controlPlane,
		ControlPlaneFQDN:      cfqdn,
		AppsLoadBalancer:      appsLB,
		GlueOpsLoadBalancer:   glueOpsLB,
		BastionServer:         bastion,
		Provider:              c.Provider,
		Region:                c.Region,
		Status:                c.Status,
		LastError:             c.LastError,
		RandomToken:           c.RandomToken,
		CertificateKey:        c.CertificateKey,
		NodePools:             nps,
		DockerImage:           c.DockerImage,
		DockerTag:             c.DockerTag,
		CreatedAt:             c.CreatedAt,
		UpdatedAt:             c.UpdatedAt,
	}
}

func nodePoolToDTO(np models.NodePool) dto.NodePoolResponse {
	labels := make([]dto.LabelResponse, 0, len(np.Labels))
	for _, l := range np.Labels {
		labels = append(labels, dto.LabelResponse{
			Key:   l.Key,
			Value: l.Value,
		})
	}

	annotations := make([]dto.AnnotationResponse, 0, len(np.Annotations))
	for _, a := range np.Annotations {
		annotations = append(annotations, dto.AnnotationResponse{
			Key:   a.Key,
			Value: a.Value,
		})
	}

	taints := make([]dto.TaintResponse, 0, len(np.Taints))
	for _, t := range np.Taints {
		taints = append(taints, dto.TaintResponse{
			Key:    t.Key,
			Value:  t.Value,
			Effect: t.Effect,
		})
	}

	servers := make([]dto.ServerResponse, 0, len(np.Servers))
	for _, s := range np.Servers {
		servers = append(servers, serverToDTO(s))
	}

	return dto.NodePoolResponse{
		AuditFields: common.AuditFields{
			ID:             np.ID,
			OrganizationID: np.OrganizationID,
			CreatedAt:      np.CreatedAt,
			UpdatedAt:      np.UpdatedAt,
		},
		Name:        np.Name,
		Role:        dto.NodeRole(np.Role),
		Labels:      labels,
		Annotations: annotations,
		Taints:      taints,
		Servers:     servers,
	}
}

func serverToDTO(s models.Server) dto.ServerResponse {
	return dto.ServerResponse{
		ID:               s.ID,
		Hostname:         s.Hostname,
		PrivateIPAddress: s.PrivateIPAddress,
		PublicIPAddress:  s.PublicIPAddress,
		Role:             s.Role,
		Status:           s.Status,
		SSHUser:          s.SSHUser,
		SshKeyID:         s.SshKeyID,
		CreatedAt:        s.CreatedAt.UTC().Format(time.RFC3339),
		UpdatedAt:        s.UpdatedAt.UTC().Format(time.RFC3339),
	}
}

func domainToDTO(d models.Domain) dto.DomainResponse {
	return dto.DomainResponse{
		ID:             d.ID.String(),
		OrganizationID: d.OrganizationID.String(),
		DomainName:     d.DomainName,
		ZoneID:         d.ZoneID,
		Status:         d.Status,
		LastError:      d.LastError,
		CredentialID:   d.CredentialID.String(),
		CreatedAt:      d.CreatedAt.UTC().Format(time.RFC3339),
		UpdatedAt:      d.UpdatedAt.UTC().Format(time.RFC3339),
	}
}

func recordSetToDTO(rs models.RecordSet) dto.RecordSetResponse {
	return dto.RecordSetResponse{
		ID:          rs.ID.String(),
		DomainID:    rs.DomainID.String(),
		Name:        rs.Name,
		Type:        rs.Type,
		TTL:         rs.TTL,
		Values:      []byte(rs.Values),
		Fingerprint: rs.Fingerprint,
		Status:      rs.Status,
		Owner:       rs.Owner,
		LastError:   rs.LastError,
		CreatedAt:   rs.CreatedAt.UTC().Format(time.RFC3339),
		UpdatedAt:   rs.UpdatedAt.UTC().Format(time.RFC3339),
	}
}

func loadBalancerToDTO(lb models.LoadBalancer) dto.LoadBalancerResponse {
	return dto.LoadBalancerResponse{
		ID:               lb.ID,
		OrganizationID:   lb.OrganizationID,
		Name:             lb.Name,
		Kind:             lb.Kind,
		PublicIPAddress:  lb.PublicIPAddress,
		PrivateIPAddress: lb.PrivateIPAddress,
		CreatedAt:        lb.CreatedAt,
		UpdatedAt:        lb.UpdatedAt,
	}
}

func GenerateSecureHex(n int) (string, error) {
	bytes := make([]byte, n)
	if _, err := rand.Read(bytes); err != nil {
		return "", fmt.Errorf("failed to generate random bytes: %w", err)
	}
	return hex.EncodeToString(bytes), nil
}

func GenerateFormattedToken() (string, error) {
	part1, err := GenerateSecureHex(3)
	if err != nil {
		return "", fmt.Errorf("failed to generate token part 1: %w", err)
	}
	part2, err := GenerateSecureHex(8)
	if err != nil {
		return "", fmt.Errorf("failed to generate token part 2: %w", err)
	}
	return fmt.Sprintf("%s.%s", part1, part2), nil
}

func markClusterNeedsValidation(db *gorm.DB, clusterID uuid.UUID) error {
	return db.Model(&models.Cluster{}).Where("id = ?", clusterID).Updates(map[string]any{
		"status":     models.ClusterStatusPrePending,
		"last_error": "",
	}).Error
}
</file>

<file path="internal/handlers/credentials.go">
package handlers

import (
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"sort"
	"time"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/datatypes"
	"gorm.io/gorm"
)

// ListCredentials godoc
//
//	@ID				ListCredentials
//	@Summary		List credentials (metadata only)
//	@Description	Returns credential metadata for the current org. Secrets are never returned.
//	@Tags			Credentials
//	@Produce		json
//	@Param			X-Org-ID			header		string	false	"Organization ID (UUID)"
//	@Param			credential_provider	query		string	false	"Filter by provider (e.g., aws)"
//	@Param			kind				query		string	false	"Filter by kind (e.g., aws_access_key)"
//	@Param			scope_kind			query		string	false	"Filter by scope kind (credential_provider/service/resource)"
//	@Success		200					{array}		dto.CredentialOut
//	@Failure		401					{string}	string	"Unauthorized"
//	@Failure		403					{string}	string	"organization required"
//	@Failure		500					{string}	string	"internal server error"
//	@Router			/credentials [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListCredentials(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		q := db.Where("organization_id = ?", orgID)
		if v := r.URL.Query().Get("credential_provider"); v != "" {
			q = q.Where("provider = ?", v)
		}
		if v := r.URL.Query().Get("kind"); v != "" {
			q = q.Where("kind = ?", v)
		}
		if v := r.URL.Query().Get("scope_kind"); v != "" {
			q = q.Where("scope_kind = ?", v)
		}

		var rows []models.Credential
		if err := q.Order("updated_at DESC").Find(&rows).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		out := make([]dto.CredentialOut, 0, len(rows))
		for i := range rows {
			out = append(out, credOut(&rows[i]))
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetCredential godoc
//
//	@ID			GetCredential
//	@Summary	Get credential by ID (metadata only)
//	@Tags		Credentials
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization ID (UUID)"
//	@Param		id			path		string	true	"Credential ID (UUID)"
//	@Success	200			{object}	dto.CredentialOut
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	500			{string}	string	"internal server error"
//	@Router		/credentials/{id} [get]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func GetCredential(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		idStr := chi.URLParam(r, "id")
		id, err := uuid.Parse(idStr)
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}

		var row models.Credential
		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "credential not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusOK, credOut(&row))
	}
}

// CreateCredential godoc
//
//	@ID			CreateCredential
//	@Summary	Create a credential (encrypts secret)
//	@Tags		Credentials
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string						false	"Organization ID (UUID)"
//	@Param		body		body		dto.CreateCredentialRequest	true	"Credential payload"
//	@Success	201			{object}	dto.CredentialOut
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	500			{string}	string	"internal server error"
//	@Router		/credentials [post]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func CreateCredential(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var in dto.CreateCredentialRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		if err := dto.Validate.Struct(in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "validation_error", err.Error())
			return
		}

		cred, err := SaveCredentialWithScope(
			r.Context(), db, orgID,
			in.CredentialProvider, in.Kind, in.SchemaVersion,
			in.ScopeKind, in.ScopeVersion, json.RawMessage(in.Scope), json.RawMessage(in.Secret),
			in.Name, in.AccountID, in.Region,
		)
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "save_failed", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusCreated, credOut(cred))
	}
}

// UpdateCredential godoc
//
//	@ID			UpdateCredential
//	@Summary	Update credential metadata and/or rotate secret
//	@Tags		Credentials
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string						false	"Organization ID (UUID)"
//	@Param		id			path		string						true	"Credential ID (UUID)"
//	@Param		body		body		dto.UpdateCredentialRequest	true	"Fields to update"
//	@Success	200			{object}	dto.CredentialOut
//	@Failure	403			{string}	string	"X-Org-ID required"
//	@Failure	404			{string}	string	"not found"
//	@Router		/credentials/{id} [patch]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func UpdateCredential(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}

		var row models.Credential
		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "credential not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		var in dto.UpdateCredentialRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		// Update metadata
		if in.Name != nil {
			row.Name = *in.Name
		}
		if in.AccountID != nil {
			row.AccountID = *in.AccountID
		}
		if in.Region != nil {
			row.Region = *in.Region
		}

		// Update scope (re-validate + fingerprint)
		if in.ScopeKind != nil || in.Scope != nil || in.ScopeVersion != nil {
			newKind := row.ScopeKind
			if in.ScopeKind != nil {
				newKind = *in.ScopeKind
			}
			newVersion := row.ScopeVersion
			if in.ScopeVersion != nil {
				newVersion = *in.ScopeVersion
			}
			if in.Scope == nil {
				utils.WriteError(w, http.StatusBadRequest, "validation_error", "scope must be provided when changing scope kind/version")
				return
			}
			prScopes := dto.ScopeRegistry[row.Provider]
			kScopes := prScopes[newKind]
			sdef := kScopes[newVersion]
			dst := sdef.New()
			if err := json.Unmarshal(*in.Scope, dst); err != nil {
				utils.WriteError(w, http.StatusBadRequest, "invalid_scope_json", err.Error())
				return
			}
			if err := sdef.Validate(dst); err != nil {
				utils.WriteError(w, http.StatusBadRequest, "invalid_scope", err.Error())
				return
			}
			canonScope, err := canonicalJSON(dst)
			if err != nil {
				utils.WriteError(w, http.StatusInternalServerError, "canon_error", err.Error())
				return
			}
			row.Scope = canonScope
			row.ScopeKind = newKind
			row.ScopeVersion = newVersion
			row.ScopeFingerprint = sha256Hex(canonScope)
		}

		// Rotate secret
		if in.Secret != nil {
			// validate against current Provider/Kind/SchemaVersion
			def := dto.CredentialRegistry[row.Provider][row.Kind][row.SchemaVersion]
			dst := def.New()
			if err := json.Unmarshal(*in.Secret, dst); err != nil {
				utils.WriteError(w, http.StatusBadRequest, "invalid_secret_json", err.Error())
				return
			}
			if err := def.Validate(dst); err != nil {
				utils.WriteError(w, http.StatusBadRequest, "invalid_secret", err.Error())
				return
			}
			canonSecret, err := canonicalJSON(dst)
			if err != nil {
				utils.WriteError(w, http.StatusInternalServerError, "canon_error", err.Error())
				return
			}
			cipher, iv, tag, err := utils.EncryptForOrg(orgID, canonSecret, db)
			if err != nil {
				utils.WriteError(w, http.StatusInternalServerError, "encrypt_error", err.Error())
				return
			}
			row.EncryptedData = cipher
			row.IV = iv
			row.Tag = tag
		}

		if err := db.Save(&row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusOK, credOut(&row))
	}
}

// DeleteCredential godoc
//
//	@ID			DeleteCredential
//	@Summary	Delete credential
//	@Tags		Credentials
//	@Produce	json
//	@Param		X-Org-ID	header	string	false	"Organization ID (UUID)"
//	@Param		id			path	string	true	"Credential ID (UUID)"
//	@Success	204
//	@Failure	404	{string}	string	"not found"
//	@Router		/credentials/{id} [delete]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func DeleteCredential(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}
		res := db.Where("organization_id = ? AND id = ?", orgID, id).Delete(&models.Credential{})
		if res.Error != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", res.Error.Error())
			return
		}
		if res.RowsAffected == 0 {
			utils.WriteError(w, http.StatusNotFound, "not_found", "credential not found")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// RevealCredential godoc
//
//	@ID			RevealCredential
//	@Summary	Reveal decrypted secret (one-time read)
//	@Tags		Credentials
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization ID (UUID)"
//	@Param		id			path		string	true	"Credential ID (UUID)"
//	@Success	200			{object}	map[string]any
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Router		/credentials/{id}/reveal [post]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func RevealCredential(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}

		var row models.Credential
		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "credential not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		plain, err := utils.DecryptForOrg(orgID, row.EncryptedData, row.IV, row.Tag, db)
		if err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "decrypt_error", err.Error())
			return
		}

		utils.WriteJSON(w, http.StatusOK, plain)
	}
}

// -- Helpers

func canonicalJSON(v any) ([]byte, error) {
	b, err := json.Marshal(v)
	if err != nil {
		return nil, err
	}
	var m any
	if err := json.Unmarshal(b, &m); err != nil {
		return nil, err
	}
	return marshalSorted(m)
}

func marshalSorted(v any) ([]byte, error) {
	switch vv := v.(type) {
	case map[string]any:
		keys := make([]string, 0, len(vv))
		for k := range vv {
			keys = append(keys, k)
		}
		sort.Strings(keys)
		buf := bytes.NewBufferString("{")
		for i, k := range keys {
			if i > 0 {
				buf.WriteByte(',')
			}
			kb, _ := json.Marshal(k)
			buf.Write(kb)
			buf.WriteByte(':')
			b, err := marshalSorted(vv[k])
			if err != nil {
				return nil, err
			}
			buf.Write(b)
		}
		buf.WriteByte('}')
		return buf.Bytes(), nil
	case []any:
		buf := bytes.NewBufferString("[")
		for i, e := range vv {
			if i > 0 {
				buf.WriteByte(',')
			}
			b, err := marshalSorted(e)
			if err != nil {
				return nil, err
			}
			buf.Write(b)
		}
		buf.WriteByte(']')
		return buf.Bytes(), nil
	default:
		return json.Marshal(v)
	}
}

func sha256Hex(b []byte) string {
	sum := sha256.Sum256(b)
	return hex.EncodeToString(sum[:])
}

// SaveCredentialWithScope validates secret+scope, encrypts, fingerprints, and stores.
func SaveCredentialWithScope(
	ctx context.Context,
	db *gorm.DB,
	orgID uuid.UUID,
	provider, kind string,
	schemaVersion int,
	scopeKind string,
	scopeVersion int,
	rawScope json.RawMessage,
	rawSecret json.RawMessage,
	name, accountID, region string,
) (*models.Credential, error) {
	// 1) secret shape
	pv, ok := dto.CredentialRegistry[provider]
	if !ok {
		return nil, fmt.Errorf("unknown provider %q", provider)
	}
	kv, ok := pv[kind]
	if !ok {
		return nil, fmt.Errorf("unknown kind %q for provider %q", kind, provider)
	}
	def, ok := kv[schemaVersion]
	if !ok {
		return nil, fmt.Errorf("unsupported schema version %d for %s/%s", schemaVersion, provider, kind)
	}

	secretDst := def.New()
	if err := json.Unmarshal(rawSecret, secretDst); err != nil {
		return nil, fmt.Errorf("payload is not valid JSON for %s/%s: %w", provider, kind, err)
	}
	if err := def.Validate(secretDst); err != nil {
		return nil, fmt.Errorf("invalid %s/%s: %w", provider, kind, err)
	}

	// 2) scope shape
	prScopes, ok := dto.ScopeRegistry[provider]
	if !ok {
		return nil, fmt.Errorf("no scopes registered for provider %q", provider)
	}
	kScopes, ok := prScopes[scopeKind]
	if !ok {
		return nil, fmt.Errorf("invalid scope_kind %q for provider %q", scopeKind, provider)
	}
	sdef, ok := kScopes[scopeVersion]
	if !ok {
		return nil, fmt.Errorf("unsupported scope version %d for %s/%s", scopeVersion, provider, scopeKind)
	}

	scopeDst := sdef.New()
	if err := json.Unmarshal(rawScope, scopeDst); err != nil {
		return nil, fmt.Errorf("invalid scope JSON: %w", err)
	}
	if err := sdef.Validate(scopeDst); err != nil {
		return nil, fmt.Errorf("invalid scope: %w", err)
	}

	// 3) canonicalize scope (also what we persist in plaintext)
	canonScope, err := canonicalJSON(scopeDst)
	if err != nil {
		return nil, err
	}
	fp := sha256Hex(canonScope) // or HMAC if you have a server-side key

	// 4) canonicalize + encrypt secret
	canonSecret, err := canonicalJSON(secretDst)
	if err != nil {
		return nil, err
	}
	cipher, iv, tag, err := utils.EncryptForOrg(orgID, canonSecret, db)
	if err != nil {
		return nil, fmt.Errorf("encrypt: %w", err)
	}

	cred := &models.Credential{
		OrganizationID:   orgID,
		Provider:         provider,
		Kind:             kind,
		SchemaVersion:    schemaVersion,
		Name:             name,
		ScopeKind:        scopeKind,
		Scope:            datatypes.JSON(canonScope),
		ScopeVersion:     scopeVersion,
		AccountID:        accountID,
		Region:           region,
		ScopeFingerprint: fp,
		EncryptedData:    cipher,
		IV:               iv,
		Tag:              tag,
	}

	if err := db.WithContext(ctx).Create(cred).Error; err != nil {
		return nil, err
	}
	return cred, nil
}

// credOut converts model → response DTO
func credOut(c *models.Credential) dto.CredentialOut {
	return dto.CredentialOut{
		ID:                 c.ID.String(),
		CredentialProvider: c.Provider,
		Kind:               c.Kind,
		SchemaVersion:      c.SchemaVersion,
		Name:               c.Name,
		ScopeKind:          c.ScopeKind,
		ScopeVersion:       c.ScopeVersion,
		Scope:              dto.RawJSON(c.Scope),
		AccountID:          c.AccountID,
		Region:             c.Region,
		CreatedAt:          c.CreatedAt.UTC().Format(time.RFC3339),
		UpdatedAt:          c.UpdatedAt.UTC().Format(time.RFC3339),
	}
}
</file>

<file path="internal/handlers/dns.go">
package handlers

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"strings"
	"time"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"github.com/rs/zerolog/log"
	"gorm.io/datatypes"
	"gorm.io/gorm"
)

// ---------- Helpers ----------

func normLowerNoDot(s string) string {
	s = strings.TrimSpace(strings.ToLower(s))
	return strings.TrimSuffix(s, ".")
}

func fqdn(domain string, rel string) string {
	d := normLowerNoDot(domain)
	r := normLowerNoDot(rel)
	if r == "" || r == "@" {
		return d
	}
	return r + "." + d
}

func canonicalJSONAny(v any) ([]byte, error) {
	b, err := json.Marshal(v)
	if err != nil {
		return nil, err
	}
	var anyv any
	if err := json.Unmarshal(b, &anyv); err != nil {
		return nil, err
	}
	return marshalSortedDNS(anyv)
}

func marshalSortedDNS(v any) ([]byte, error) {
	switch vv := v.(type) {
	case map[string]any:
		keys := make([]string, 0, len(vv))
		for k := range vv {
			keys = append(keys, k)
		}
		sortStrings(keys)
		var buf bytes.Buffer
		buf.WriteByte('{')
		for i, k := range keys {
			if i > 0 {
				buf.WriteByte(',')
			}
			kb, _ := json.Marshal(k)
			buf.Write(kb)
			buf.WriteByte(':')
			b, err := marshalSortedDNS(vv[k])
			if err != nil {
				return nil, err
			}
			buf.Write(b)
		}
		buf.WriteByte('}')
		return buf.Bytes(), nil
	case []any:
		var buf bytes.Buffer
		buf.WriteByte('[')
		for i, e := range vv {
			if i > 0 {
				buf.WriteByte(',')
			}
			b, err := marshalSortedDNS(e)
			if err != nil {
				return nil, err
			}
			buf.Write(b)
		}
		buf.WriteByte(']')
		return buf.Bytes(), nil
	default:
		return json.Marshal(v)
	}
}

func sortStrings(a []string) {
	for i := 0; i < len(a); i++ {
		for j := i + 1; j < len(a); j++ {
			if a[j] < a[i] {
				a[i], a[j] = a[j], a[i]
			}
		}
	}
}

func sha256HexBytes(b []byte) string {
	sum := sha256.Sum256(b)
	return hex.EncodeToString(sum[:])
}

/* Fingerprint (provider-agnostic) */
type desiredRecord struct {
	ZoneID string   `json:"zone_id"`
	FQDN   string   `json:"fqdn"`
	Type   string   `json:"type"`
	TTL    *int     `json:"ttl,omitempty"`
	Values []string `json:"values,omitempty"`
}

func computeFingerprint(zoneID, fqdn, typ string, ttl *int, values datatypes.JSON) (string, error) {
	var vals []string
	if len(values) > 0 && string(values) != "null" {
		if err := json.Unmarshal(values, &vals); err != nil {
			return "", err
		}
		sortStrings(vals)
	}
	payload := &desiredRecord{
		ZoneID: zoneID, FQDN: fqdn, Type: strings.ToUpper(typ), TTL: ttl, Values: vals,
	}
	can, err := canonicalJSONAny(payload)
	if err != nil {
		return "", err
	}
	return sha256HexBytes(can), nil
}

func mustSameOrgDomainWithCredential(db *gorm.DB, orgID uuid.UUID, credID uuid.UUID) error {
	var cred models.Credential
	if err := db.Where("id = ? AND organization_id = ?", credID, orgID).First(&cred).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return fmt.Errorf("credential not found or belongs to different org")
		}
		return err
	}
	if cred.Provider != "aws" || cred.ScopeKind != "service" {
		return fmt.Errorf("credential must be AWS Route 53 service scoped")
	}
	var scope map[string]any
	if err := json.Unmarshal(cred.Scope, &scope); err != nil {
		return fmt.Errorf("credential scope invalid json: %w", err)
	}
	if strings.ToLower(fmt.Sprint(scope["service"])) != "route53" {
		return fmt.Errorf("credential scope.service must be route53")
	}
	return nil
}

// ---------- Domain Handlers ----------

// ListDomains godoc
//
//	@ID				ListDomains
//	@Summary		List domains (org scoped)
//	@Description	Returns domains for X-Org-ID. Filters: `domain_name`, `status`, `q` (contains).
//	@Tags			DNS
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			domain_name	query		string	false	"Exact domain name (lowercase, no trailing dot)"
//	@Param			status		query		string	false	"pending|provisioning|ready|failed"
//	@Param			q			query		string	false	"Domain contains (case-insensitive)"
//	@Success		200			{array}		dto.DomainResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"db error"
//	@Router			/dns/domains [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListDomains(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		q := db.Model(&models.Domain{}).Where("organization_id = ?", orgID)
		if v := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("domain_name"))); v != "" {
			q = q.Where("LOWER(domain_name) = ?", v)
		}
		if v := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("status"))); v != "" {
			q = q.Where("status = ?", v)
		}
		if needle := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("q"))); needle != "" {
			q = q.Where("LOWER(domain_name) LIKE ?", "%"+needle+"%")
		}

		var rows []models.Domain
		if err := q.Order("created_at DESC").Find(&rows).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		out := make([]dto.DomainResponse, 0, len(rows))
		for i := range rows {
			out = append(out, domainOut(&rows[i]))
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetDomain godoc
//
//	@ID			GetDomain
//	@Summary	Get a domain (org scoped)
//	@Tags		DNS
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization UUID"
//	@Param		id			path		string	true	"Domain ID (UUID)"
//	@Success	200			{object}	dto.DomainResponse
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Router		/dns/domains/{id} [get]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func GetDomain(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}
		var row models.Domain
		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "domain not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		utils.WriteJSON(w, http.StatusOK, domainOut(&row))
	}
}

// CreateDomain godoc
//
//	@ID				CreateDomain
//	@Summary		Create a domain (org scoped)
//	@Description	Creates a domain bound to a Route 53 scoped credential. Archer will backfill ZoneID if omitted.
//	@Tags			DNS
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string					false	"Organization UUID"
//	@Param			body		body		dto.CreateDomainRequest	true	"Domain payload"
//	@Success		201			{object}	dto.DomainResponse
//	@Failure		400			{string}	string	"validation error"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"db error"
//	@Router			/dns/domains [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func CreateDomain(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		var in dto.CreateDomainRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}
		if err := dto.DNSValidate(in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "validation_error", err.Error())
			return
		}
		credID, _ := uuid.Parse(in.CredentialID)
		if err := mustSameOrgDomainWithCredential(db, orgID, credID); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "invalid_credential", err.Error())
			return
		}

		row := &models.Domain{
			OrganizationID: orgID,
			DomainName:     normLowerNoDot(in.DomainName),
			ZoneID:         strings.TrimSpace(in.ZoneID),
			Status:         "pending",
			LastError:      "",
			CredentialID:   credID,
		}
		if err := db.Create(row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusCreated, domainOut(row))
	}
}

// UpdateDomain godoc
//
//	@ID			UpdateDomain
//	@Summary	Update a domain (org scoped)
//	@Tags		DNS
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string					false	"Organization UUID"
//	@Param		id			path		string					true	"Domain ID (UUID)"
//	@Param		body		body		dto.UpdateDomainRequest	true	"Fields to update"
//	@Success	200			{object}	dto.DomainResponse
//	@Failure	400			{string}	string	"validation error"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Router		/dns/domains/{id} [patch]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func UpdateDomain(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}
		var row models.Domain
		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "domain not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		var in dto.UpdateDomainRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}
		if err := dto.DNSValidate(in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "validation_error", err.Error())
			return
		}
		if in.DomainName != nil {
			row.DomainName = normLowerNoDot(*in.DomainName)
		}
		if in.CredentialID != nil {
			credID, _ := uuid.Parse(*in.CredentialID)
			if err := mustSameOrgDomainWithCredential(db, orgID, credID); err != nil {
				utils.WriteError(w, http.StatusBadRequest, "invalid_credential", err.Error())
				return
			}
			row.CredentialID = credID
			row.Status = "pending"
			row.LastError = ""
		}
		if in.ZoneID != nil {
			row.ZoneID = strings.TrimSpace(*in.ZoneID)
		}
		if in.Status != nil {
			row.Status = *in.Status
			if row.Status == "pending" {
				row.LastError = ""
			}
		}
		if err := db.Save(&row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusOK, domainOut(&row))
	}
}

// DeleteDomain godoc
//
//	@ID			DeleteDomain
//	@Summary	Delete a domain
//	@Tags		DNS
//	@Produce	json
//	@Param		X-Org-ID	header	string	false	"Organization UUID"
//	@Param		id			path	string	true	"Domain ID (UUID)"
//	@Success	204
//	@Failure	403	{string}	string	"organization required"
//	@Failure	404	{string}	string	"not found"
//	@Router		/dns/domains/{id} [delete]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func DeleteDomain(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}
		res := db.Where("organization_id = ? AND id = ?", orgID, id).Delete(&models.Domain{})
		if res.Error != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", res.Error.Error())
			return
		}
		if res.RowsAffected == 0 {
			utils.WriteError(w, http.StatusNotFound, "not_found", "domain not found")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// ---------- Record Set Handlers ----------

// ListRecordSets godoc
//
//	@ID				ListRecordSets
//	@Summary		List record sets for a domain
//	@Description	Filters: `name`, `type`, `status`.
//	@Tags			DNS
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			domain_id	path		string	true	"Domain ID (UUID)"
//	@Param			name		query		string	false	"Exact relative name or FQDN (server normalizes)"
//	@Param			type		query		string	false	"RR type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)"
//	@Param			status		query		string	false	"pending|provisioning|ready|failed"
//	@Success		200			{array}		dto.RecordSetResponse
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"domain not found"
//	@Router			/dns/domains/{domain_id}/records [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListRecordSets(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		did, err := uuid.Parse(chi.URLParam(r, "domain_id"))
		if err != nil {
			log.Info().Msg(err.Error())
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid domain UUID:")
			return
		}
		var domain models.Domain
		if err := db.Where("organization_id = ? AND id = ?", orgID, did).First(&domain).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "domain not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		q := db.Model(&models.RecordSet{}).Where("domain_id = ?", did)
		if v := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("name"))); v != "" {
			dn := strings.ToLower(domain.DomainName)
			rel := v
			// normalize apex or FQDN into relative
			if v == dn || v == dn+"." {
				rel = ""
			} else {
				rel = strings.TrimSuffix(v, "."+dn)
				rel = normLowerNoDot(rel)
			}
			q = q.Where("LOWER(name) = ?", rel)
		}
		if v := strings.TrimSpace(strings.ToUpper(r.URL.Query().Get("type"))); v != "" {
			q = q.Where("type = ?", v)
		}
		if v := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("status"))); v != "" {
			q = q.Where("status = ?", v)
		}

		var rows []models.RecordSet
		if err := q.Order("created_at DESC").Find(&rows).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		out := make([]dto.RecordSetResponse, 0, len(rows))
		for i := range rows {
			out = append(out, recordOut(&rows[i]))
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetRecordSet godoc
//
//	@ID			GetRecordSet
//	@Summary	Get a record set (org scoped)
//	@Tags		DNS
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization UUID"
//	@Param		id			path		string	true	"Record Set ID (UUID)"
//	@Success	200			{object}	dto.RecordSetResponse
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Router		/dns/records/{id} [get]
func GetRecordSet(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}

		var row models.RecordSet
		if err := db.
			Joins("Domain").
			Where(`record_sets.id = ? AND "Domain"."organization_id" = ?`, id, orgID).
			First(&row).Error; err != nil {

			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "record set not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		utils.WriteJSON(w, http.StatusOK, recordOut(&row))
	}
}

// CreateRecordSet godoc
//
//	@ID			CreateRecordSet
//	@Summary	Create a record set (pending; Archer will UPSERT to Route 53)
//	@Tags		DNS
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string						false	"Organization UUID"
//	@Param		domain_id	path		string						true	"Domain ID (UUID)"
//	@Param		body		body		dto.CreateRecordSetRequest	true	"Record set payload"
//	@Success	201			{object}	dto.RecordSetResponse
//	@Failure	400			{string}	string	"validation error"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"domain not found"
//	@Router		/dns/domains/{domain_id}/records [post]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func CreateRecordSet(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		did, err := uuid.Parse(chi.URLParam(r, "domain_id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid domain UUID")
			return
		}
		var domain models.Domain
		if err := db.Where("organization_id = ? AND id = ?", orgID, did).First(&domain).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "domain not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		var in dto.CreateRecordSetRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}
		if err := dto.DNSValidate(in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "validation_error", err.Error())
			return
		}
		t := strings.ToUpper(in.Type)
		if t == "CNAME" && len(in.Values) != 1 {
			utils.WriteError(w, http.StatusBadRequest, "validation_error", "CNAME requires exactly one value")
			return
		}

		rel := normLowerNoDot(in.Name)
		fq := fqdn(domain.DomainName, rel)

		// Pre-flight: block duplicate tuple and protect from non-autoglue rows
		var existing models.RecordSet
		if err := db.Where("domain_id = ? AND LOWER(name) = ? AND type = ?",
			domain.ID, strings.ToLower(rel), t).First(&existing).Error; err == nil {
			if existing.Owner != "" && existing.Owner != "autoglue" {
				utils.WriteError(w, http.StatusConflict, "ownership_conflict",
					"record with the same (name,type) exists but is not owned by autoglue")
				return
			}
			utils.WriteError(w, http.StatusConflict, "already_exists",
				"a record with the same (name,type) already exists; use PATCH to modify")
			return
		} else if !errors.Is(err, gorm.ErrRecordNotFound) {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		valuesJSON, _ := json.Marshal(in.Values)
		fp, err := computeFingerprint(domain.ZoneID, fq, t, in.TTL, datatypes.JSON(valuesJSON))
		if err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "fingerprint_error", err.Error())
			return
		}

		row := &models.RecordSet{
			DomainID:    domain.ID,
			Name:        rel,
			Type:        t,
			TTL:         in.TTL,
			Values:      datatypes.JSON(valuesJSON),
			Fingerprint: fp,
			Status:      "pending",
			LastError:   "",
			Owner:       "autoglue",
		}
		if err := db.Create(row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusCreated, recordOut(row))
	}
}

// UpdateRecordSet godoc
//
//	@ID			UpdateRecordSet
//	@Summary	Update a record set (flips to pending for reconciliation)
//	@Tags		DNS
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string						false	"Organization UUID"
//	@Param		id			path		string						true	"Record Set ID (UUID)"
//	@Param		body		body		dto.UpdateRecordSetRequest	true	"Fields to update"
//	@Success	200			{object}	dto.RecordSetResponse
//	@Failure	400			{string}	string	"validation error"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Router		/dns/records/{id} [patch]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func UpdateRecordSet(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}

		var row models.RecordSet
		if err := db.
			Joins("Domain").
			Where(`record_sets.id = ? AND "Domain"."organization_id" = ?`, id, orgID).
			First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "record set not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		var domain models.Domain
		if err := db.Where("id = ?", row.DomainID).First(&domain).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		var in dto.UpdateRecordSetRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}
		if err := dto.DNSValidate(in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "validation_error", err.Error())
			return
		}
		if row.Owner != "" && row.Owner != "autoglue" {
			utils.WriteError(w, http.StatusConflict, "ownership_conflict",
				"record is not owned by autoglue; refuse to modify")
			return
		}

		// Mutations
		if in.Name != nil {
			row.Name = normLowerNoDot(*in.Name)
		}
		if in.Type != nil {
			row.Type = strings.ToUpper(*in.Type)
		}
		if in.TTL != nil {
			row.TTL = in.TTL
		}
		if in.Values != nil {
			t := row.Type
			if in.Type != nil {
				t = strings.ToUpper(*in.Type)
			}
			if t == "CNAME" && len(*in.Values) != 1 {
				utils.WriteError(w, http.StatusBadRequest, "validation_error", "CNAME requires exactly one value")
				return
			}
			b, _ := json.Marshal(*in.Values)
			row.Values = datatypes.JSON(b)
		}

		if in.Status != nil {
			row.Status = *in.Status
		} else {
			row.Status = "pending"
			row.LastError = ""
		}

		fq := fqdn(domain.DomainName, row.Name)
		fp, err := computeFingerprint(domain.ZoneID, fq, row.Type, row.TTL, row.Values)
		if err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "fingerprint_error", err.Error())
			return
		}
		row.Fingerprint = fp

		if err := db.Save(&row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusOK, recordOut(&row))
	}
}

// DeleteRecordSet godoc
//
//	@ID			DeleteRecordSet
//	@Summary	Delete a record set (API removes row; worker can optionally handle external deletion policy)
//	@Tags		DNS
//	@Produce	json
//	@Param		X-Org-ID	header	string	false	"Organization UUID"
//	@Param		id			path	string	true	"Record Set ID (UUID)"
//	@Success	204
//	@Failure	403	{string}	string	"organization required"
//	@Failure	404	{string}	string	"not found"
//	@Router		/dns/records/{id} [delete]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func DeleteRecordSet(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}
		sub := db.Model(&models.RecordSet{}).
			Select("record_sets.id").
			Joins("JOIN domains ON domains.id = record_sets.domain_id").
			Where("record_sets.id = ? AND domains.organization_id = ?", id, orgID)

		res := db.Where("id IN (?)", sub).Delete(&models.RecordSet{})
		if res.Error != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", res.Error.Error())
			return
		}
		if res.RowsAffected == 0 {
			utils.WriteError(w, http.StatusNotFound, "not_found", "record set not found")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// ---------- Out mappers ----------

func domainOut(m *models.Domain) dto.DomainResponse {
	return dto.DomainResponse{
		ID:             m.ID.String(),
		OrganizationID: m.OrganizationID.String(),
		DomainName:     m.DomainName,
		ZoneID:         m.ZoneID,
		Status:         m.Status,
		LastError:      m.LastError,
		CredentialID:   m.CredentialID.String(),
		CreatedAt:      m.CreatedAt.UTC().Format(time.RFC3339),
		UpdatedAt:      m.UpdatedAt.UTC().Format(time.RFC3339),
	}
}

func recordOut(r *models.RecordSet) dto.RecordSetResponse {
	vals := r.Values
	if len(vals) == 0 {
		vals = datatypes.JSON("[]")
	}
	return dto.RecordSetResponse{
		ID:          r.ID.String(),
		DomainID:    r.DomainID.String(),
		Name:        r.Name,
		Type:        r.Type,
		TTL:         r.TTL,
		Values:      []byte(vals),
		Fingerprint: r.Fingerprint,
		Status:      r.Status,
		LastError:   r.LastError,
		Owner:       r.Owner,
		CreatedAt:   r.CreatedAt.UTC().Format(time.RFC3339),
		UpdatedAt:   r.UpdatedAt.UTC().Format(time.RFC3339),
	}
}
</file>

<file path="internal/handlers/health.go">
package handlers

import (
	"net/http"

	"github.com/glueops/autoglue/internal/utils"
)

type HealthStatus struct {
	Status string `json:"status" example:"ok"`
}

// HealthCheck godoc
//
//	@Summary		Basic health check
//	@Description	Returns 200 OK when the service is up
//	@Tags			Health
//	@ID				HealthCheck               // operationId
//	@Produce		json
//	@Success		200	{object}	HealthStatus
//	@Router			/healthz [get]
func HealthCheck(w http.ResponseWriter, r *http.Request) {
	utils.WriteJSON(w, http.StatusOK, HealthStatus{Status: "ok"})
}
</file>

<file path="internal/handlers/jobs.go">
package handlers

import (
	"context"
	"encoding/json"
	"net/http"
	"strconv"
	"strings"
	"time"

	"github.com/dyaksa/archer"
	"github.com/glueops/autoglue/internal/bg"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
	"gorm.io/gorm/clause"
)

// AdminListArcherJobs godoc
//
//	@ID				AdminListArcherJobs
//	@Summary		List Archer jobs (admin)
//	@Description	Paginated background jobs with optional filters. Search `q` may match id, type, error, payload (implementation-dependent).
//	@Tags			ArcherAdmin
//	@Produce		json
//	@Param			status		query		string	false	"Filter by status"	Enums(queued,running,succeeded,failed,canceled,retrying,scheduled)
//	@Param			queue		query		string	false	"Filter by queue name / worker name"
//	@Param			q			query		string	false	"Free-text search"
//	@Param			page		query		int		false	"Page number"		default(1)
//	@Param			page_size	query		int		false	"Items per page"	minimum(1)	maximum(100)	default(25)
//	@Success		200			{object}	dto.PageJob
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"forbidden"
//	@Failure		500			{string}	string	"internal error"
//	@Router			/admin/archer/jobs [get]
//	@Security		BearerAuth
func AdminListArcherJobs(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		status := strings.TrimSpace(r.URL.Query().Get("status"))
		queue := strings.TrimSpace(r.URL.Query().Get("queue"))
		q := strings.TrimSpace(r.URL.Query().Get("q"))
		page := atoiDefault(r.URL.Query().Get("page"), 1)
		size := clamp(atoiDefault(r.URL.Query().Get("page_size"), 25), 1, 100)

		base := db.Model(&models.Job{})
		if status != "" {
			base = base.Where("status = ?", status)
		}
		if queue != "" {
			base = base.Where("queue_name = ?", queue)
		}
		if q != "" {
			like := "%" + q + "%"
			base = base.Where(
				db.Where("id ILIKE ?", like).
					Or("queue_name ILIKE ?", like).
					Or("COALESCE(last_error,'') ILIKE ?", like).
					Or("CAST(arguments AS TEXT) ILIKE ?", like),
			)
		}

		var total int64
		if err := base.Count(&total).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		var rows []models.Job
		offset := (page - 1) * size
		if err := base.Order("created_at DESC").Limit(size).Offset(offset).Find(&rows).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		items := make([]dto.Job, 0, len(rows))
		for _, m := range rows {
			items = append(items, mapModelJobToDTO(m))
		}

		utils.WriteJSON(w, http.StatusOK, dto.PageJob{
			Items:    items,
			Total:    int(total),
			Page:     page,
			PageSize: size,
		})
	}
}

// AdminEnqueueArcherJob godoc
//
//	@ID				AdminEnqueueArcherJob
//	@Summary		Enqueue a new Archer job (admin)
//	@Description	Create a job immediately or schedule it for the future via `run_at`.
//	@Tags			ArcherAdmin
//	@Accept			json
//	@Produce		json
//	@Param			body	body		dto.EnqueueRequest	true	"Job parameters"
//	@Success		200		{object}	dto.Job
//	@Failure		400		{string}	string	"invalid json or missing fields"
//	@Failure		401		{string}	string	"Unauthorized"
//	@Failure		403		{string}	string	"forbidden"
//	@Failure		500		{string}	string	"internal error"
//	@Router			/admin/archer/jobs [post]
//	@Security		BearerAuth
func AdminEnqueueArcherJob(db *gorm.DB, jobs *bg.Jobs) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		var in dto.EnqueueRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid json")
			return
		}
		in.Queue = strings.TrimSpace(in.Queue)
		in.Type = strings.TrimSpace(in.Type)
		if in.Queue == "" || in.Type == "" {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "queue and type are required")
			return
		}

		// Parse payload into generic 'args' for Archer.
		var args any
		if len(in.Payload) > 0 && string(in.Payload) != "null" {
			if err := json.Unmarshal(in.Payload, &args); err != nil {
				utils.WriteError(w, http.StatusBadRequest, "bad_request", "payload must be valid JSON")
				return
			}
		}

		id := uuid.NewString()

		opts := []archer.FnOptions{
			archer.WithMaxRetries(0), // adjust or expose in request if needed
		}
		if in.RunAt != nil {
			opts = append(opts, archer.WithScheduleTime(*in.RunAt))
		}

		// Schedule with Archer (queue == worker name).
		if _, err := jobs.Enqueue(context.Background(), id, in.Queue, args, opts...); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "enqueue_failed", err.Error())
			return
		}

		// Read back the just-created row.
		var m models.Job
		if err := db.First(&m, "id = ?", id).Error; err != nil {
			// Fallback: return a synthesized job if row not visible yet.
			now := time.Now()
			out := dto.Job{
				ID:          id,
				Type:        in.Type,
				Queue:       in.Queue,
				Status:      dto.StatusQueued,
				Attempts:    0,
				MaxAttempts: 0,
				CreatedAt:   now,
				UpdatedAt:   &now,
				RunAt:       in.RunAt,
				Payload:     args,
			}
			utils.WriteJSON(w, http.StatusOK, out)
			return
		}

		utils.WriteJSON(w, http.StatusOK, mapModelJobToDTO(m))
	}
}

// AdminRetryArcherJob godoc
//
//	@ID				AdminRetryArcherJob
//	@Summary		Retry a failed/canceled Archer job (admin)
//	@Description	Marks the job retriable (DB flip). Swap this for an Archer admin call if you expose one.
//	@Tags			ArcherAdmin
//	@Accept			json
//	@Produce		json
//	@Param			id	path		string	true	"Job ID"
//	@Success		200	{object}	dto.Job
//	@Failure		400	{string}	string	"invalid job or not eligible"
//	@Failure		401	{string}	string	"Unauthorized"
//	@Failure		403	{string}	string	"forbidden"
//	@Failure		404	{string}	string	"not found"
//	@Router			/admin/archer/jobs/{id}/retry [post]
//	@Security		BearerAuth
func AdminRetryArcherJob(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		id := chi.URLParam(r, "id")
		var m models.Job
		if err := db.Clauses(clause.Locking{Strength: "UPDATE"}).First(&m, "id = ?", id).Error; err != nil {
			if err == gorm.ErrRecordNotFound {
				utils.WriteError(w, http.StatusNotFound, "not_found", "job not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		// Only allow retry from failed/canceled (adjust as you see fit).
		if m.Status != string(dto.StatusFailed) && m.Status != string(dto.StatusCanceled) {
			utils.WriteError(w, http.StatusBadRequest, "not_eligible", "job is not failed/canceled")
			return
		}

		// Reset to queued; clear started_at; bump updated_at.
		now := time.Now()
		if err := db.Model(&m).Updates(map[string]any{
			"status":     string(dto.StatusQueued),
			"started_at": nil,
			"updated_at": now,
		}).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		// Re-read and return.
		if err := db.First(&m, "id = ?", id).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusOK, mapModelJobToDTO(m))
	}
}

// AdminCancelArcherJob godoc
//
//	@ID				AdminCancelArcherJob
//	@Summary		Cancel an Archer job (admin)
//	@Description	Set job status to canceled if cancellable. For running jobs, this only affects future picks; wire to Archer if you need active kill.
//	@Tags			ArcherAdmin
//	@Accept			json
//	@Produce		json
//	@Param			id	path		string	true	"Job ID"
//	@Success		200	{object}	dto.Job
//	@Failure		400	{string}	string	"invalid job or not cancellable"
//	@Failure		401	{string}	string	"Unauthorized"
//	@Failure		403	{string}	string	"forbidden"
//	@Failure		404	{string}	string	"not found"
//	@Router			/admin/archer/jobs/{id}/cancel [post]
//	@Security		BearerAuth
func AdminCancelArcherJob(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		id := chi.URLParam(r, "id")
		var m models.Job
		if err := db.Clauses(clause.Locking{Strength: "UPDATE"}).First(&m, "id = ?", id).Error; err != nil {
			if err == gorm.ErrRecordNotFound {
				utils.WriteError(w, http.StatusNotFound, "not_found", "job not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		// If already finished, bail.
		switch m.Status {
		case string(dto.StatusSucceeded), string(dto.StatusCanceled):
			utils.WriteError(w, http.StatusBadRequest, "not_cancellable", "job already finished")
			return
		}

		now := time.Now()
		if err := db.Model(&m).Updates(map[string]any{
			"status":     string(dto.StatusCanceled),
			"updated_at": now,
		}).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		if err := db.First(&m, "id = ?", id).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusOK, mapModelJobToDTO(m))
	}
}

// AdminListArcherQueues godoc
//
//	@ID				AdminListArcherQueues
//	@Summary		List Archer queues (admin)
//	@Description	Summary metrics per queue (pending, running, failed, scheduled).
//	@Tags			ArcherAdmin
//	@Produce		json
//	@Success		200	{array}		dto.QueueInfo
//	@Failure		401	{string}	string	"Unauthorized"
//	@Failure		403	{string}	string	"forbidden"
//	@Failure		500	{string}	string	"internal error"
//	@Router			/admin/archer/queues [get]
//	@Security		BearerAuth
func AdminListArcherQueues(db *gorm.DB) http.HandlerFunc {
	type row struct {
		QueueName string
		Pending   int
		Running   int
		Failed    int
		Scheduled int
	}

	return func(w http.ResponseWriter, r *http.Request) {
		var rows []row
		// Use filtered aggregate; adjust status values if your Archer differs.
		if err := db.
			Raw(`
				SELECT
					queue_name,
					COUNT(*) FILTER (WHERE status = 'queued')     AS pending,
					COUNT(*) FILTER (WHERE status = 'running')    AS running,
					COUNT(*) FILTER (WHERE status = 'failed')     AS failed,
					COUNT(*) FILTER (WHERE status = 'scheduled')  AS scheduled
				FROM jobs
				GROUP BY queue_name
				ORDER BY queue_name ASC
			`).Scan(&rows).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		out := make([]dto.QueueInfo, 0, len(rows))
		for _, r := range rows {
			out = append(out, dto.QueueInfo{
				Name:      r.QueueName,
				Pending:   r.Pending,
				Running:   r.Running,
				Failed:    r.Failed,
				Scheduled: r.Scheduled,
			})
		}

		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// Helpers
func atoiDefault(s string, def int) int {
	if s == "" {
		return def
	}
	if n, err := strconv.Atoi(s); err == nil {
		return n
	}
	return def
}
func clamp(n, lo, hi int) int {
	if n < lo {
		return lo
	}
	if n > hi {
		return hi
	}
	return n
}

func mapModelJobToDTO(m models.Job) dto.Job {
	var payload any
	if len(m.Arguments) > 0 {
		_ = json.Unmarshal([]byte(m.Arguments), &payload)
	}

	var updated *time.Time
	if !m.UpdatedAt.IsZero() {
		updated = &m.UpdatedAt
	}

	var runAt *time.Time
	if !m.ScheduledAt.IsZero() {
		rt := m.ScheduledAt
		runAt = &rt
	}

	return dto.Job{
		ID: m.ID,
		// If you distinguish between queue and type elsewhere, set Type accordingly.
		Type:        m.QueueName,
		Queue:       m.QueueName,
		Status:      dto.JobStatus(m.Status),
		Attempts:    m.RetryCount,
		MaxAttempts: m.MaxRetry,
		CreatedAt:   m.CreatedAt,
		UpdatedAt:   updated,
		LastError:   m.LastError,
		RunAt:       runAt,
		Payload:     payload,
	}
}
</file>

<file path="internal/handlers/jwks.go">
package handlers

import (
	"net/http"

	"github.com/glueops/autoglue/internal/auth"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/utils"
)

type jwk struct {
	Kty string `json:"kty"`
	Use string `json:"use,omitempty"`
	Kid string `json:"kid,omitempty"`
	Alg string `json:"alg,omitempty"`
	N   string `json:"n,omitempty"` // RSA modulus (base64url)
	E   string `json:"e,omitempty"` // RSA exponent (base64url)
	X   string `json:"x,omitempty"` // Ed25519 public key (base64url)
}

type jwks struct {
	Keys []jwk `json:"keys"`
}

// JWKSHandler godoc
//
//	@ID				getJWKS
//	@Summary		Get JWKS
//	@Description	Returns the JSON Web Key Set for token verification
//	@Tags			Auth
//	@Produce		json
//	@Success		200	{object}	dto.JWKS
//	@Router			/.well-known/jwks.json [get]
func JWKSHandler(w http.ResponseWriter, _ *http.Request) {
	out := dto.JWKS{Keys: make([]dto.JWK, 0)}

	auth.KcCopy(func(pub map[string]interface{}) {
		for kid, pk := range pub {
			meta := auth.MetaFor(kid)
			params, kty := auth.PubToJWK(kid, meta.Alg, pk)
			if kty == "" {
				continue
			}
			j := dto.JWK{
				Kty: kty,
				Use: "sig",
				Kid: kid,
				Alg: meta.Alg,
				N:   params["n"],
				E:   params["e"],
				X:   params["x"],
			}
			out.Keys = append(out.Keys, j)
		}
	})
	utils.WriteJSON(w, http.StatusOK, out)
}
</file>

<file path="internal/handlers/labels.go">
package handlers

import (
	"encoding/json"
	"errors"
	"net/http"
	"strings"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/common"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// ListLabels godoc
//
//	@ID				ListLabels
//	@Summary		List node labels (org scoped)
//	@Description	Returns node labels for the organization in X-Org-ID. Filters: `key`, `value`, and `q` (key contains). Add `include=node_pools` to include linked node groups.
//	@Tags			Labels
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			key			query		string	false	"Exact key"
//	@Param			value		query		string	false	"Exact value"
//	@Param			q			query		string	false	"Key contains (case-insensitive)"
//	@Success		200			{array}		dto.LabelResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"failed to list node taints"
//	@Router			/labels [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListLabels(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		q := db.Where("organization_id = ?", orgID)

		if key := strings.TrimSpace(r.URL.Query().Get("key")); key != "" {
			q = q.Where(`key = ?`, key)
		}
		if val := strings.TrimSpace(r.URL.Query().Get("value")); val != "" {
			q = q.Where(`value = ?`, val)
		}
		if needle := strings.TrimSpace(r.URL.Query().Get("q")); needle != "" {
			q = q.Where(`key ILIKE ?`, "%"+needle+"%")
		}
		var out []dto.LabelResponse
		if err := q.Model(&models.Label{}).Order("created_at DESC").Scan(&out).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		if out == nil {
			out = []dto.LabelResponse{}
		}

		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetLabel godoc
//
//	@ID				GetLabel
//	@Summary		Get label by ID (org scoped)
//	@Description	Returns one label.
//	@Tags			Labels
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			id			path		string	true	"Label ID (UUID)"
//	@Success		200			{object}	dto.LabelResponse
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"fetch failed"
//	@Router			/labels/{id} [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func GetLabel(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "id required")
			return
		}

		var out dto.LabelResponse
		if err := db.Model(&models.Label{}).Where("id = ? AND organization_id = ?", id, orgID).Limit(1).Scan(&out).Error; err != nil {
			if out.ID == uuid.Nil {
				utils.WriteError(w, http.StatusNotFound, "label_not_found", "label not found")
				return
			}
		}

		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// CreateLabel godoc
//
//	@ID				CreateLabel
//	@Summary		Create label (org scoped)
//	@Description	Creates a label.
//	@Tags			Labels
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string					false	"Organization UUID"
//	@Param			body		body		dto.CreateLabelRequest	true	"Label payload"
//	@Success		201			{object}	dto.LabelResponse
//	@Failure		400			{string}	string	"invalid json / missing fields / invalid node_pool_ids"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"create failed"
//	@Router			/labels [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func CreateLabel(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var req dto.CreateLabelRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		req.Key = strings.TrimSpace(req.Key)
		req.Value = strings.TrimSpace(req.Value)

		if req.Key == "" || req.Value == "" {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "missing key/value")
			return
		}

		l := models.Label{
			AuditFields: common.AuditFields{OrganizationID: orgID},
			Key:         req.Key,
			Value:       req.Value,
		}
		if err := db.Create(&l).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := dto.LabelResponse{
			AuditFields: l.AuditFields,
			Key:         l.Key,
			Value:       l.Value,
		}
		utils.WriteJSON(w, http.StatusCreated, out)
	}
}

// UpdateLabel godoc
// UpdateLabel godoc
//
//	@ID				UpdateLabel
//	@Summary		Update label (org scoped)
//	@Description	Partially update label fields.
//	@Tags			Labels
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string					false	"Organization UUID"
//	@Param			id			path		string					true	"Label ID (UUID)"
//	@Param			body		body		dto.UpdateLabelRequest	true	"Fields to update"
//	@Success		200			{object}	dto.LabelResponse
//	@Failure		400			{string}	string	"invalid id / invalid json"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"update failed"
//	@Router			/labels/{id} [patch]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func UpdateLabel(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "id required")
			return
		}

		var l models.Label
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&l).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "label_not_found", "label not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var req dto.UpdateLabelRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		if req.Key != nil {
			l.Key = strings.TrimSpace(*req.Key)
		}
		if req.Value != nil {
			l.Value = strings.TrimSpace(*req.Value)
		}

		if err := db.Save(&l).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := dto.LabelResponse{
			AuditFields: l.AuditFields,
			Key:         l.Key,
			Value:       l.Value,
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// DeleteLabel godoc
//
//	@ID				DeleteLabel
//	@Summary		Delete label (org scoped)
//	@Description	Permanently deletes the label.
//	@Tags			Labels
//	@Produce		json
//	@Param			X-Org-ID	header	string	false	"Organization UUID"
//	@Param			id			path	string	true	"Label ID (UUID)"
//	@Success		204			"No Content"
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"delete failed"
//	@Router			/labels/{id} [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DeleteLabel(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "id required")
			return
		}

		if err := db.Where("id = ? AND organization_id = ?", id, orgID).Delete(&models.Label{}).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}
</file>

<file path="internal/handlers/load_balancers.go">
package handlers

import (
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"strings"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// ListLoadBalancers godoc
//
//	@ID				ListLoadBalancers
//	@Summary		List load balancers (org scoped)
//	@Description	Returns load balancers for the organization in X-Org-ID.
//	@Tags			LoadBalancers
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Success		200			{array}		dto.LoadBalancerResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"failed to list clusters"
//	@Router			/load-balancers [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListLoadBalancers(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var rows []models.LoadBalancer
		if err := db.Where("organization_id = ?", orgID).Find(&rows).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		out := make([]dto.LoadBalancerResponse, 0, len(rows))
		for _, row := range rows {
			out = append(out, loadBalancerOut(&row))
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetLoadBalancer godoc
//
//	@ID				GetLoadBalancers
//	@Summary		Get a load balancer (org scoped)
//	@Description	Returns load balancer for the organization in X-Org-ID.
//	@Tags			LoadBalancers
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			id			path		string	true	"LoadBalancer ID (UUID)"
//	@Success		200			{array}		dto.LoadBalancerResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"failed to list clusters"
//	@Router			/load-balancers/{id} [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func GetLoadBalancer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}

		var row models.LoadBalancer
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "load balancer not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		out := loadBalancerOut(&row)
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// CreateLoadBalancer godoc
//
//	@ID			CreateLoadBalancer
//	@Summary	Create a load balancer
//	@Tags		LoadBalancers
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string							false	"Organization UUID"
//	@Param		body		body		dto.CreateLoadBalancerRequest	true	"Record set payload"
//	@Success	201			{object}	dto.LoadBalancerResponse
//	@Failure	400			{string}	string	"validation error"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"domain not found"
//	@Router		/load-balancers [post]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func CreateLoadBalancer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var in dto.CreateLoadBalancerRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}

		if strings.ToLower(in.Kind) != "glueops" && strings.ToLower(in.Kind) != "public" {
			fmt.Println(in.Kind)
			utils.WriteError(w, http.StatusBadRequest, "bad_kind", "invalid kind only 'glueops' or 'public'")
			return
		}

		row := &models.LoadBalancer{
			OrganizationID:   orgID,
			Name:             in.Name,
			Kind:             strings.ToLower(in.Kind),
			PublicIPAddress:  in.PublicIPAddress,
			PrivateIPAddress: in.PrivateIPAddress,
		}
		if err := db.Create(row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusCreated, loadBalancerOut(row))
	}
}

// UpdateLoadBalancer godoc
//
//	@ID			UpdateLoadBalancer
//	@Summary	Update a load balancer (org scoped)
//	@Tags		LoadBalancers
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string							false	"Organization UUID"
//	@Param		id			path		string							true	"Load Balancer ID (UUID)"
//	@Param		body		body		dto.UpdateLoadBalancerRequest	true	"Fields to update"
//	@Success	200			{object}	dto.LoadBalancerResponse
//	@Failure	400			{string}	string	"validation error"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Router		/load-balancers/{id} [patch]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func UpdateLoadBalancer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}

		row := &models.LoadBalancer{}
		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "load balancer not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		var in dto.UpdateLoadBalancerRequest
		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
			return
		}
		if in.Name != nil {
			row.Name = *in.Name
		}
		if in.Kind != nil {
			fmt.Println(*in.Kind)
			if strings.ToLower(*in.Kind) != "glueops" && strings.ToLower(*in.Kind) != "public" {
				utils.WriteError(w, http.StatusBadRequest, "bad_kind", "invalid kind only 'glueops' or 'public'")
				return
			}
			row.Kind = strings.ToLower(*in.Kind)
		}
		if in.PublicIPAddress != nil {
			row.PublicIPAddress = *in.PublicIPAddress
		}
		if in.PrivateIPAddress != nil {
			row.PrivateIPAddress = *in.PrivateIPAddress
		}
		if err := db.Save(row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusOK, loadBalancerOut(row))

	}
}

// DeleteLoadBalancer godoc
//
//	@ID			DeleteLoadBalancer
//	@Summary	Delete a load balancer
//	@Tags		LoadBalancers
//	@Produce	json
//	@Param		X-Org-ID	header	string	false	"Organization UUID"
//	@Param		id			path	string	true	"Load Balancer ID (UUID)"
//	@Success	204
//	@Failure	403	{string}	string	"organization required"
//	@Failure	404	{string}	string	"not found"
//	@Router		/load-balancers/{id} [delete]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func DeleteLoadBalancer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
			return
		}

		row := &models.LoadBalancer{}
		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "load balancer not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}

		if err := db.Delete(row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// ---------- Out mappers ----------

func loadBalancerOut(m *models.LoadBalancer) dto.LoadBalancerResponse {
	return dto.LoadBalancerResponse{
		ID:               m.ID,
		OrganizationID:   m.OrganizationID,
		Name:             m.Name,
		Kind:             m.Kind,
		PublicIPAddress:  m.PublicIPAddress,
		PrivateIPAddress: m.PrivateIPAddress,
		CreatedAt:        m.CreatedAt.UTC(),
		UpdatedAt:        m.UpdatedAt.UTC(),
	}
}
</file>

<file path="internal/handlers/me_keys.go">
package handlers

import (
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"net/http"
	"time"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/auth"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

type userAPIKeyOut struct {
	ID         uuid.UUID  `json:"id" format:"uuid"`
	Name       *string    `json:"name,omitempty"`
	Scope      string     `json:"scope"` // "user"
	CreatedAt  time.Time  `json:"created_at"`
	ExpiresAt  *time.Time `json:"expires_at,omitempty"`
	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
	Plain      *string    `json:"plain,omitempty"` // Shown only on create:
}

// ListUserAPIKeys godoc
//
//	@ID			ListUserAPIKeys
//	@Summary	List my API keys
//	@Tags		MeAPIKeys
//	@Produce	json
//	@Success	200	{array}	userAPIKeyOut
//	@Router		/me/api-keys [get]
//	@Security	BearerAuth
//	@Security	ApiKeyAuth
func ListUserAPIKeys(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := httpmiddleware.UserFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "not signed in")
			return
		}
		var rows []models.APIKey
		if err := db.
			Where("scope = ? AND user_id = ?", "user", u.ID).
			Order("created_at desc").
			Find(&rows).Error; err != nil {
			utils.WriteError(w, 500, "db_error", err.Error())
			return
		}
		out := make([]userAPIKeyOut, 0, len(rows))
		for _, k := range rows {
			out = append(out, toUserKeyOut(k, nil))
		}
		utils.WriteJSON(w, 200, out)
	}
}

type createUserKeyRequest struct {
	Name           string `json:"name,omitempty"`
	ExpiresInHours *int   `json:"expires_in_hours,omitempty"` // optional TTL
}

// CreateUserAPIKey godoc
//
//	@ID				CreateUserAPIKey
//	@Summary		Create a new user API key
//	@Description	Returns the plaintext key once. Store it securely on the client side.
//	@Tags			MeAPIKeys
//	@Accept			json
//	@Produce		json
//	@Param			body	body		createUserKeyRequest	true	"Key options"
//	@Success		201		{object}	userAPIKeyOut
//	@Router			/me/api-keys [post]
//	@Security		BearerAuth
//	@Security		ApiKeyAuth
func CreateUserAPIKey(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := httpmiddleware.UserFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "not signed in")
			return
		}
		var req createUserKeyRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, 400, "invalid_json", err.Error())
			return
		}

		plain, err := generateUserAPIKey()
		if err != nil {
			utils.WriteError(w, 500, "gen_failed", err.Error())
			return
		}
		hash := auth.SHA256Hex(plain)

		var exp *time.Time
		if req.ExpiresInHours != nil && *req.ExpiresInHours > 0 {
			t := time.Now().Add(time.Duration(*req.ExpiresInHours) * time.Hour)
			exp = &t
		}

		rec := models.APIKey{
			Scope:     "user",
			UserID:    &u.ID,
			KeyHash:   hash,
			Name:      req.Name, // if field exists
			ExpiresAt: exp,
			// SecretHash: nil (not used for user keys)
		}
		if err := db.Create(&rec).Error; err != nil {
			utils.WriteError(w, 500, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, http.StatusCreated, toUserKeyOut(rec, &plain))
	}
}

// DeleteUserAPIKey godoc
//
//	@ID			DeleteUserAPIKey
//	@Summary	Delete a user API key
//	@Tags		MeAPIKeys
//	@Produce	json
//	@Param		id	path	string	true	"Key ID (UUID)"
//	@Success	204	"No Content"
//	@Router		/me/api-keys/{id} [delete]
//	@Security	BearerAuth
func DeleteUserAPIKey(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := httpmiddleware.UserFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "not signed in")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, 400, "invalid_id", "must be uuid")
			return
		}
		tx := db.Where("id = ? AND scope = ? AND user_id = ?", id, "user", u.ID).
			Delete(&models.APIKey{})
		if tx.Error != nil {
			utils.WriteError(w, 500, "db_error", tx.Error.Error())
			return
		}
		if tx.RowsAffected == 0 {
			utils.WriteError(w, 404, "not_found", "key not found")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

func toUserKeyOut(k models.APIKey, plain *string) userAPIKeyOut {
	return userAPIKeyOut{
		ID:         k.ID,
		Name:       &k.Name, // if your model has it; else remove
		Scope:      k.Scope,
		CreatedAt:  k.CreatedAt,
		ExpiresAt:  k.ExpiresAt,
		LastUsedAt: k.LastUsedAt, // if present; else remove
		Plain:      plain,
	}
}

func generateUserAPIKey() (string, error) {
	// 24 random bytes → base64url (no padding), with "u_" prefix
	b := make([]byte, 24)
	if _, err := rand.Read(b); err != nil {
		return "", err
	}
	s := base64.RawURLEncoding.EncodeToString(b)
	return "u_" + s, nil
}
</file>

<file path="internal/handlers/me.go">
package handlers

import (
	"encoding/json"
	"net/http"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"gorm.io/gorm"
)

type meResponse struct {
	models.User   `json:",inline"`
	Emails        []models.UserEmail    `json:"emails"`
	Organizations []models.Organization `json:"organizations"`
}

// GetMe godoc
//
//	@ID			GetMe
//	@Summary	Get current user profile
//	@Tags		Me
//	@Produce	json
//	@Success	200	{object}	meResponse
//	@Router		/me [get]
//	@Security	BearerAuth
//	@Security	ApiKeyAuth
func GetMe(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := httpmiddleware.UserFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "not signed in")
			return
		}

		var user models.User
		if err := db.First(&user, "id = ? AND is_disabled = false", u.ID).Error; err != nil {
			utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "user not found/disabled")
			return
		}

		var emails []models.UserEmail
		_ = db.Preload("User").Where("user_id = ?", user.ID).Order("is_primary desc, created_at asc").Find(&emails).Error

		var orgs []models.Organization
		{
			var rows []models.Membership
			_ = db.Where("user_id = ?", user.ID).Find(&rows).Error
			if len(rows) > 0 {
				var ids []interface{}
				for _, m := range rows {
					ids = append(ids, m.OrganizationID)
				}
				_ = db.Find(&orgs, "id IN ?", ids).Error
			}
		}

		utils.WriteJSON(w, http.StatusOK, meResponse{
			User:          user,
			Emails:        emails,
			Organizations: orgs,
		})
	}
}

type updateMeRequest struct {
	DisplayName *string `json:"display_name,omitempty"`
	// You can add more editable fields here (timezone, avatar, etc)
}

// UpdateMe godoc
//
//	@ID			UpdateMe
//	@Summary	Update current user profile
//	@Tags		Me
//	@Accept		json
//	@Produce	json
//	@Param		body	body		updateMeRequest	true	"Patch profile"
//	@Success	200		{object}	models.User
//	@Router		/me [patch]
//	@Security	BearerAuth
//	@Security	ApiKeyAuth
func UpdateMe(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := httpmiddleware.UserFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "not signed in")
			return
		}

		var req updateMeRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "invalid_json", err.Error())
		}

		updates := map[string]interface{}{}

		if req.DisplayName != nil {
			updates["display_name"] = req.DisplayName
		}

		if len(updates) == 0 {
			var user models.User
			if err := db.First(&user, "id = ?", u.ID).Error; err != nil {
				utils.WriteError(w, 404, "not_found", "user")
				return
			}
			utils.WriteJSON(w, 200, user)
			return
		}

		if err := db.Model(&models.User{}).Where("id = ?", u.ID).Updates(updates).Error; err != nil {
			utils.WriteError(w, 500, "db_error", err.Error())
			return
		}

		var out models.User
		_ = db.First(&out, "id = ?", u.ID).Error
		utils.WriteJSON(w, 200, out)
	}
}
</file>

<file path="internal/handlers/node_pools_test.go">
package handlers

import (
	"os"
	"testing"

	"github.com/glueops/autoglue/internal/common"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/testutil/pgtest"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

func TestMain(m *testing.M) {
	code := m.Run()
	pgtest.Stop()
	os.Exit(code)
}

func TestParseUUIDs_Success(t *testing.T) {
	u1 := uuid.New()
	u2 := uuid.New()

	got, err := parseUUIDs([]string{u1.String(), u2.String()})
	if err != nil {
		t.Fatalf("parseUUIDs returned error: %v", err)
	}
	if len(got) != 2 {
		t.Fatalf("expected 2 UUIDs, got %d", len(got))
	}
	if got[0] != u1 || got[1] != u2 {
		t.Fatalf("unexpected UUIDs: got=%v", got)
	}
}

func TestParseUUIDs_Invalid(t *testing.T) {
	_, err := parseUUIDs([]string{"not-a-uuid"})
	if err == nil {
		t.Fatalf("expected error for invalid UUID, got nil")
	}
}

// --- ensureServersBelongToOrg ---

func TestEnsureServersBelongToOrg_AllBelong(t *testing.T) {
	db := pgtest.DB(t)

	org := models.Organization{Name: "org-a"}
	if err := db.Create(&org).Error; err != nil {
		t.Fatalf("create org: %v", err)
	}

	sshKey := createTestSshKey(t, db, org.ID, "org-a-key")

	s1 := models.Server{
		OrganizationID: org.ID,
		Hostname:       "srv-1",
		SSHUser:        "ubuntu",
		SshKeyID:       sshKey.ID,
		Role:           "worker",
		Status:         "pending",
	}
	s2 := models.Server{
		OrganizationID: org.ID,
		Hostname:       "srv-2",
		SSHUser:        "ubuntu",
		SshKeyID:       sshKey.ID,
		Role:           "worker",
		Status:         "pending",
	}

	if err := db.Create(&s1).Error; err != nil {
		t.Fatalf("create server 1: %v", err)
	}
	if err := db.Create(&s2).Error; err != nil {
		t.Fatalf("create server 2: %v", err)
	}

	ids := []uuid.UUID{s1.ID, s2.ID}
	if err := ensureServersBelongToOrg(org.ID, ids, db); err != nil {
		t.Fatalf("expected no error, got %v", err)
	}
}

func TestEnsureServersBelongToOrg_ForeignOrgFails(t *testing.T) {
	db := pgtest.DB(t)

	orgA := models.Organization{Name: "org-a"}
	orgB := models.Organization{Name: "org-b"}

	if err := db.Create(&orgA).Error; err != nil {
		t.Fatalf("create orgA: %v", err)
	}
	if err := db.Create(&orgB).Error; err != nil {
		t.Fatalf("create orgB: %v", err)
	}

	sshKeyA := createTestSshKey(t, db, orgA.ID, "org-a-key")
	sshKeyB := createTestSshKey(t, db, orgB.ID, "org-b-key")

	s1 := models.Server{
		OrganizationID: orgA.ID,
		Hostname:       "srv-a-1",
		SSHUser:        "ubuntu",
		SshKeyID:       sshKeyA.ID,
		Role:           "worker",
		Status:         "pending",
	}
	s2 := models.Server{
		OrganizationID: orgB.ID,
		Hostname:       "srv-b-1",
		SSHUser:        "ubuntu",
		SshKeyID:       sshKeyB.ID,
		Role:           "worker",
		Status:         "pending",
	}

	if err := db.Create(&s1).Error; err != nil {
		t.Fatalf("create server s1: %v", err)
	}
	if err := db.Create(&s2).Error; err != nil {
		t.Fatalf("create server s2: %v", err)
	}

	ids := []uuid.UUID{s1.ID, s2.ID}
	if err := ensureServersBelongToOrg(orgA.ID, ids, db); err == nil {
		t.Fatalf("expected error when one server belongs to a different org")
	}
}

// --- ensureTaintsBelongToOrg ---

func TestEnsureTaintsBelongToOrg_AllBelong(t *testing.T) {
	db := pgtest.DB(t)

	org := models.Organization{Name: "org-taints"}
	if err := db.Create(&org).Error; err != nil {
		t.Fatalf("create org: %v", err)
	}

	t1 := models.Taint{
		OrganizationID: org.ID,
		Key:            "key1",
		Value:          "val1",
		Effect:         "NoSchedule",
	}
	t2 := models.Taint{
		OrganizationID: org.ID,
		Key:            "key2",
		Value:          "val2",
		Effect:         "PreferNoSchedule",
	}

	if err := db.Create(&t1).Error; err != nil {
		t.Fatalf("create taint 1: %v", err)
	}
	if err := db.Create(&t2).Error; err != nil {
		t.Fatalf("create taint 2: %v", err)
	}

	ids := []uuid.UUID{t1.ID, t2.ID}
	if err := ensureTaintsBelongToOrg(org.ID, ids, db); err != nil {
		t.Fatalf("expected no error, got %v", err)
	}
}

func TestEnsureTaintsBelongToOrg_ForeignOrgFails(t *testing.T) {
	db := pgtest.DB(t)

	orgA := models.Organization{Name: "org-a"}
	orgB := models.Organization{Name: "org-b"}
	if err := db.Create(&orgA).Error; err != nil {
		t.Fatalf("create orgA: %v", err)
	}
	if err := db.Create(&orgB).Error; err != nil {
		t.Fatalf("create orgB: %v", err)
	}

	t1 := models.Taint{
		OrganizationID: orgA.ID,
		Key:            "key1",
		Value:          "val1",
		Effect:         "NoSchedule",
	}
	t2 := models.Taint{
		OrganizationID: orgB.ID,
		Key:            "key2",
		Value:          "val2",
		Effect:         "NoSchedule",
	}

	if err := db.Create(&t1).Error; err != nil {
		t.Fatalf("create taint 1: %v", err)
	}
	if err := db.Create(&t2).Error; err != nil {
		t.Fatalf("create taint 2: %v", err)
	}

	ids := []uuid.UUID{t1.ID, t2.ID}
	if err := ensureTaintsBelongToOrg(orgA.ID, ids, db); err == nil {
		t.Fatalf("expected error when a taint belongs to another org")
	}
}

// --- ensureLabelsBelongToOrg ---

func TestEnsureLabelsBelongToOrg_AllBelong(t *testing.T) {
	db := pgtest.DB(t)

	org := models.Organization{Name: "org-labels"}
	if err := db.Create(&org).Error; err != nil {
		t.Fatalf("create org: %v", err)
	}

	l1 := models.Label{
		AuditFields: common.AuditFields{
			OrganizationID: org.ID,
		},
		Key:   "env",
		Value: "dev",
	}
	l2 := models.Label{
		AuditFields: common.AuditFields{
			OrganizationID: org.ID,
		},
		Key:   "env",
		Value: "prod",
	}

	if err := db.Create(&l1).Error; err != nil {
		t.Fatalf("create label 1: %v", err)
	}
	if err := db.Create(&l2).Error; err != nil {
		t.Fatalf("create label 2: %v", err)
	}

	ids := []uuid.UUID{l1.ID, l2.ID}
	if err := ensureLabelsBelongToOrg(org.ID, ids, db); err != nil {
		t.Fatalf("expected no error, got %v", err)
	}
}

func TestEnsureLabelsBelongToOrg_ForeignOrgFails(t *testing.T) {
	db := pgtest.DB(t)

	orgA := models.Organization{Name: "org-a"}
	orgB := models.Organization{Name: "org-b"}
	if err := db.Create(&orgA).Error; err != nil {
		t.Fatalf("create orgA: %v", err)
	}
	if err := db.Create(&orgB).Error; err != nil {
		t.Fatalf("create orgB: %v", err)
	}

	l1 := models.Label{
		AuditFields: common.AuditFields{
			OrganizationID: orgA.ID,
		},
		Key:   "env",
		Value: "dev",
	}
	l2 := models.Label{
		AuditFields: common.AuditFields{
			OrganizationID: orgB.ID,
		},
		Key:   "env",
		Value: "prod",
	}

	if err := db.Create(&l1).Error; err != nil {
		t.Fatalf("create label 1: %v", err)
	}
	if err := db.Create(&l2).Error; err != nil {
		t.Fatalf("create label 2: %v", err)
	}

	ids := []uuid.UUID{l1.ID, l2.ID}
	if err := ensureLabelsBelongToOrg(orgA.ID, ids, db); err == nil {
		t.Fatalf("expected error when a label belongs to another org")
	}
}

// --- ensureAnnotaionsBelongToOrg (typo in original name is preserved) ---

func TestEnsureAnnotationsBelongToOrg_AllBelong(t *testing.T) {
	db := pgtest.DB(t)

	org := models.Organization{Name: "org-annotations"}
	if err := db.Create(&org).Error; err != nil {
		t.Fatalf("create org: %v", err)
	}

	a1 := models.Annotation{
		AuditFields: common.AuditFields{
			OrganizationID: org.ID,
		},
		Key:   "team",
		Value: "core",
	}
	a2 := models.Annotation{
		AuditFields: common.AuditFields{
			OrganizationID: org.ID,
		},
		Key:   "team",
		Value: "platform",
	}

	if err := db.Create(&a1).Error; err != nil {
		t.Fatalf("create annotation 1: %v", err)
	}
	if err := db.Create(&a2).Error; err != nil {
		t.Fatalf("create annotation 2: %v", err)
	}

	ids := []uuid.UUID{a1.ID, a2.ID}
	if err := ensureAnnotaionsBelongToOrg(org.ID, ids, db); err != nil {
		t.Fatalf("expected no error, got %v", err)
	}
}

func TestEnsureAnnotationsBelongToOrg_ForeignOrgFails(t *testing.T) {
	db := pgtest.DB(t)

	orgA := models.Organization{Name: "org-a"}
	orgB := models.Organization{Name: "org-b"}
	if err := db.Create(&orgA).Error; err != nil {
		t.Fatalf("create orgA: %v", err)
	}
	if err := db.Create(&orgB).Error; err != nil {
		t.Fatalf("create orgB: %v", err)
	}

	a1 := models.Annotation{
		AuditFields: common.AuditFields{
			OrganizationID: orgA.ID,
		},
		Key:   "team",
		Value: "core",
	}
	a2 := models.Annotation{
		AuditFields: common.AuditFields{
			OrganizationID: orgB.ID,
		},
		Key:   "team",
		Value: "platform",
	}

	if err := db.Create(&a1).Error; err != nil {
		t.Fatalf("create annotation 1: %v", err)
	}
	if err := db.Create(&a2).Error; err != nil {
		t.Fatalf("create annotation 2: %v", err)
	}

	ids := []uuid.UUID{a1.ID, a2.ID}
	if err := ensureAnnotaionsBelongToOrg(orgA.ID, ids, db); err == nil {
		t.Fatalf("expected error when an annotation belongs to another org")
	}
}

func createTestSshKey(t *testing.T, db *gorm.DB, orgID uuid.UUID, name string) models.SshKey {
	t.Helper()

	key := models.SshKey{
		AuditFields: common.AuditFields{
			OrganizationID: orgID,
		},
		Name:                name,
		PublicKey:           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestKey",
		EncryptedPrivateKey: "encrypted",
		PrivateIV:           "iv",
		PrivateTag:          "tag",
		Fingerprint:         "fp-" + name,
	}

	if err := db.Create(&key).Error; err != nil {
		t.Fatalf("create ssh key %s: %v", name, err)
	}

	return key
}
</file>

<file path="internal/handlers/node_pools.go">
package handlers

import (
	"encoding/json"
	"errors"
	"net/http"
	"strings"
	"time"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/common"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// -- Node Pools Core

// ListNodePools godoc
//
//	@ID				ListNodePools
//	@Summary		List node pools (org scoped)
//	@Description	Returns node pools for the organization in X-Org-ID.
//	@Tags			NodePools
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			q			query		string	false	"Name contains (case-insensitive)"
//	@Success		200			{array}		dto.NodePoolResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"failed to list node pools"
//	@Router			/node-pools [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListNodePools(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		q := db.Where("organization_id = ?", orgID)
		if needle := strings.TrimSpace(r.URL.Query().Get("q")); needle != "" {
			q = q.Where("name LIKE ?", "%"+needle+"%")
		}

		var pools []models.NodePool
		if err := q.
			Preload("Servers").
			Preload("Labels").
			Preload("Taints").
			Preload("Annotations").
			Order("created_at DESC").
			Find(&pools).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := make([]dto.NodePoolResponse, 0, len(pools))
		for _, p := range pools {
			npr := dto.NodePoolResponse{
				AuditFields: p.AuditFields,
				Name:        p.Name,
				Role:        dto.NodeRole(p.Role),
				Servers:     make([]dto.ServerResponse, 0, len(p.Servers)),
				Labels:      make([]dto.LabelResponse, 0, len(p.Labels)),
				Taints:      make([]dto.TaintResponse, 0, len(p.Taints)),
				Annotations: make([]dto.AnnotationResponse, 0, len(p.Annotations)),
			}
			//Servers
			for _, s := range p.Servers {
				outSrv := dto.ServerResponse{
					ID:               s.ID,
					Hostname:         s.Hostname,
					PublicIPAddress:  s.PublicIPAddress,
					PrivateIPAddress: s.PrivateIPAddress,
					OrganizationID:   s.OrganizationID,
					SshKeyID:         s.SshKeyID,
					SSHUser:          s.SSHUser,
					Role:             s.Role,
					Status:           s.Status,
					CreatedAt:        s.CreatedAt.UTC().Format(time.RFC3339),
					UpdatedAt:        s.UpdatedAt.UTC().Format(time.RFC3339),
					// add more fields as needed
				}
				npr.Servers = append(npr.Servers, outSrv)
			}
			//Labels
			for _, l := range p.Labels {
				outL := dto.LabelResponse{
					AuditFields: common.AuditFields{
						ID:             l.ID,
						OrganizationID: l.OrganizationID,
						CreatedAt:      l.CreatedAt,
						UpdatedAt:      l.UpdatedAt,
					},
					Key:   l.Key,
					Value: l.Value,
				}
				npr.Labels = append(npr.Labels, outL)
			}
			// Taints
			for _, t := range p.Taints {
				outT := dto.TaintResponse{
					ID:             t.ID,
					OrganizationID: t.OrganizationID,
					CreatedAt:      t.CreatedAt.UTC().Format(time.RFC3339),
					UpdatedAt:      t.UpdatedAt.UTC().Format(time.RFC3339),
					Key:            t.Key,
					Value:          t.Value,
					Effect:         t.Effect,
				}
				npr.Taints = append(npr.Taints, outT)
			}
			// Annotations
			for _, a := range p.Annotations {
				outA := dto.AnnotationResponse{
					AuditFields: common.AuditFields{
						ID:             a.ID,
						OrganizationID: a.OrganizationID,
						CreatedAt:      a.CreatedAt,
						UpdatedAt:      a.UpdatedAt,
					},
					Key:   a.Key,
					Value: a.Value,
				}
				npr.Annotations = append(npr.Annotations, outA)
			}

			out = append(out, npr)
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetNodePool godoc
//
//	@ID				GetNodePool
//	@Summary		Get node pool by ID (org scoped)
//	@Description	Returns one node pool. Add `include=servers` to include servers.
//	@Tags			NodePools
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			id			path		string	true	"Node Pool ID (UUID)"
//	@Success		200			{object}	dto.NodePoolResponse
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"fetch failed"
//	@Router			/node-pools/{id} [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func GetNodePool(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "id required")
			return
		}

		var out dto.NodePoolResponse
		if err := db.Model(&models.NodePool{}).Preload("Servers").Where("id = ? AND organization_id = ?", id, orgID).First(&out, id).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// CreateNodePool godoc
//
//	@ID				CreateNodePool
//	@Summary		Create node pool (org scoped)
//	@Description	Creates a node pool. Optionally attach initial servers.
//	@Tags			NodePools
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string						false	"Organization UUID"
//	@Param			body		body		dto.CreateNodePoolRequest	true	"NodePool payload"
//	@Success		201			{object}	dto.NodePoolResponse
//	@Failure		400			{string}	string	"invalid json / missing fields / invalid server_ids"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"create failed"
//	@Router			/node-pools [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func CreateNodePool(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var req dto.CreateNodePoolRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		req.Name = strings.TrimSpace(req.Name)
		req.Role = dto.NodeRole(strings.TrimSpace(string(req.Role)))

		if req.Name == "" || req.Role == "" {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "missing name/role")
			return
		}

		n := models.NodePool{
			AuditFields: common.AuditFields{
				OrganizationID: orgID,
			},
			Name: req.Name,
			Role: string(req.Role),
		}

		if err := db.Create(&n).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := dto.NodePoolResponse{
			AuditFields: n.AuditFields,
			Name:        n.Name,
			Role:        dto.NodeRole(n.Role),
		}
		utils.WriteJSON(w, http.StatusCreated, out)
	}
}

// UpdateNodePool godoc
//
//	@ID				UpdateNodePool
//	@Summary		Update node pool (org scoped)
//	@Description	Partially update node pool fields.
//	@Tags			NodePools
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string						false	"Organization UUID"
//	@Param			id			path		string						true	"Node Pool ID (UUID)"
//	@Param			body		body		dto.UpdateNodePoolRequest	true	"Fields to update"
//	@Success		200			{object}	dto.NodePoolResponse
//	@Failure		400			{string}	string	"invalid id / invalid json"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"update failed"
//	@Router			/node-pools/{id} [patch]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func UpdateNodePool(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "id required")
			return
		}

		var n models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&n).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var req dto.UpdateNodePoolRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		if req.Name != nil {
			n.Name = strings.TrimSpace(*req.Name)
		}
		if req.Role != nil {
			v := dto.NodeRole(strings.TrimSpace(string(*req.Role)))
			n.Role = string(v)
		}

		if err := db.Save(&n).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		out := dto.NodePoolResponse{
			AuditFields: n.AuditFields,
			Name:        n.Name,
			Role:        dto.NodeRole(n.Role),
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// DeleteNodePool godoc
//
//	@ID				DeleteNodePool
//	@Summary		Delete node pool (org scoped)
//	@Description	Permanently deletes the node pool.
//	@Tags			NodePools
//	@Produce		json
//	@Param			X-Org-ID	header	string	false	"Organization UUID"
//	@Param			id			path	string	true	"Node Pool ID (UUID)"
//	@Success		204			"No Content"
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"delete failed"
//	@Router			/node-pools/{id} [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DeleteNodePool(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "id required")
			return
		}

		if err := db.Where("id = ? AND organization_id = ?", id, orgID).Delete(&models.NodePool{}).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// -- Node Pools Servers

// ListNodePoolServers godoc
//
//	@ID			ListNodePoolServers
//	@Summary	List servers attached to a node pool (org scoped)
//	@Tags		NodePools
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization UUID"
//	@Param		id			path		string	true	"Node Pool ID (UUID)"
//	@Success	200			{array}		dto.ServerResponse
//	@Failure	400			{string}	string	"invalid id"
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Failure	500			{string}	string	"fetch failed"
//	@Router		/node-pools/{id}/servers [get]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func ListNodePoolServers(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "id required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).Preload("Servers").First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := make([]dto.ServerResponse, 0, len(np.Servers))
		for _, server := range np.Servers {
			out = append(out, dto.ServerResponse{
				ID:               server.ID,
				OrganizationID:   server.OrganizationID,
				Hostname:         server.Hostname,
				PrivateIPAddress: server.PrivateIPAddress,
				PublicIPAddress:  server.PublicIPAddress,
				Role:             server.Role,
				SshKeyID:         server.SshKeyID,
				SSHUser:          server.SSHUser,
				Status:           server.Status,
				CreatedAt:        server.CreatedAt.UTC().Format(time.RFC3339),
				UpdatedAt:        server.UpdatedAt.UTC().Format(time.RFC3339),
			})
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// AttachNodePoolServers godoc
//
//	@ID			AttachNodePoolServers
//	@Summary	Attach servers to a node pool (org scoped)
//	@Tags		NodePools
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string						false	"Organization UUID"
//	@Param		id			path		string						true	"Node Pool ID (UUID)"
//	@Param		body		body		dto.AttachServersRequest	true	"Server IDs to attach"
//	@Success	204			{string}	string						"No Content"
//	@Failure	400			{string}	string						"invalid id / invalid server_ids"
//	@Failure	401			{string}	string						"Unauthorized"
//	@Failure	403			{string}	string						"organization required"
//	@Failure	404			{string}	string						"not found"
//	@Failure	500			{string}	string						"attach failed"
//	@Router		/node-pools/{id}/servers [post]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func AttachNodePoolServers(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "id required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var req dto.AttachServersRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		ids, err := parseUUIDs(req.ServerIDs)
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid server_ids")
			return
		}

		if len(ids) == 0 {
			// nothing to attach
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "nothing to attach")
			return
		}

		// validate IDs belong to org
		if err := ensureServersBelongToOrg(orgID, ids, db); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid server_ids for this organization")
			return
		}

		// fetch only the requested servers
		var servers []models.Server
		if err := db.Where("organization_id = ? AND id IN ?", orgID, ids).Find(&servers).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "attach db error")
			return
		}

		if len(servers) == 0 {
			w.WriteHeader(http.StatusNoContent)
			return
		}

		if err := db.Model(&np).Association("Servers").Append(&servers); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "attach failed")
			return
		}

		w.WriteHeader(http.StatusNoContent)
	}
}

// DetachNodePoolServer godoc
//
//	@ID			DetachNodePoolServer
//	@Summary	Detach one server from a node pool (org scoped)
//	@Tags		NodePools
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization UUID"
//	@Param		id			path		string	true	"Node Pool ID (UUID)"
//	@Param		serverId	path		string	true	"Server ID (UUID)"
//	@Success	204			{string}	string	"No Content"
//	@Failure	400			{string}	string	"invalid id"
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Failure	500			{string}	string	"detach failed"
//	@Router		/node-pools/{id}/servers/{serverId} [delete]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func DetachNodePoolServer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool id required")
			return
		}
		serverId, err := uuid.Parse(chi.URLParam(r, "serverId"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "server id required")
			return
		}
		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var s models.Server
		if err := db.Where("id = ? AND organization_id = ?", serverId, orgID).First(&s).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "server_not_found", "server not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		if err := db.Model(&np).Association("Servers").Delete(&s); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "detach error")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// -- Node Pools Taints

// ListNodePoolTaints godoc
//
//	@ID			ListNodePoolTaints
//	@Summary	List taints attached to a node pool (org scoped)
//	@Tags		NodePools
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization UUID"
//	@Param		id			path		string	true	"Node Pool ID (UUID)"
//	@Success	200			{array}		dto.TaintResponse
//	@Failure	400			{string}	string	"invalid id"
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Failure	500			{string}	string	"fetch failed"
//	@Router		/node-pools/{id}/taints [get]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func ListNodePoolTaints(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool id required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).Preload("Taints").First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := make([]dto.TaintResponse, 0, len(np.Taints))
		for _, t := range np.Taints {
			out = append(out, dto.TaintResponse{
				ID:     t.ID,
				Key:    t.Key,
				Value:  t.Value,
				Effect: t.Effect,
			})
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// AttachNodePoolTaints godoc
//
//	@ID			AttachNodePoolTaints
//	@Summary	Attach taints to a node pool (org scoped)
//	@Tags		NodePools
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string					false	"Organization UUID"
//	@Param		id			path		string					true	"Node Pool ID (UUID)"
//	@Param		body		body		dto.AttachTaintsRequest	true	"Taint IDs to attach"
//	@Success	204			{string}	string					"No Content"
//	@Failure	400			{string}	string					"invalid id / invalid taint_ids"
//	@Failure	401			{string}	string					"Unauthorized"
//	@Failure	403			{string}	string					"organization required"
//	@Failure	404			{string}	string					"not found"
//	@Failure	500			{string}	string					"attach failed"
//	@Router		/node-pools/{id}/taints [post]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func AttachNodePoolTaints(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool id required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var req dto.AttachTaintsRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		ids, err := parseUUIDs(req.TaintIDs)
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid taint_ids")
			return
		}

		if len(ids) == 0 {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "nothing to attach")
			return
		}

		// validate IDs belong to org
		if err := ensureTaintsBelongToOrg(orgID, ids, db); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid taint_ids for this organization")
			return
		}

		var taints []models.Taint
		if err := db.Where("organization_id = ? AND id IN ?", orgID, ids).Find(&taints).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "attach db error")
			return
		}

		if len(taints) == 0 {
			w.WriteHeader(http.StatusNoContent)
			return
		}

		if err := db.Model(&np).Association("Taints").Append(&taints); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "attach db error")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// DetachNodePoolTaint godoc
//
//	@ID			DetachNodePoolTaint
//	@Summary	Detach one taint from a node pool (org scoped)
//	@Tags		NodePools
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization UUID"
//	@Param		id			path		string	true	"Node Pool ID (UUID)"
//	@Param		taintId		path		string	true	"Taint ID (UUID)"
//	@Success	204			{string}	string	"No Content"
//	@Failure	400			{string}	string	"invalid id"
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Failure	500			{string}	string	"detach failed"
//	@Router		/node-pools/{id}/taints/{taintId} [delete]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func DetachNodePoolTaint(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool id required")
			return
		}
		taintId, err := uuid.Parse(chi.URLParam(r, "taintId"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "taintId_required", "taint id required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var t models.Taint
		if err := db.Where("id = ? AND organization_id = ?", taintId, orgID).First(&t).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "taint_not_found", "taint not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		if err := db.Model(&np).Association("Taints").Delete(&t); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// -- Node Pools Labels

// ListNodePoolLabels godoc
//
//	@ID			ListNodePoolLabels
//	@Summary	List labels attached to a node pool (org scoped)
//	@Tags		NodePools
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization UUID"
//	@Param		id			path		string	true	"Label Pool ID (UUID)"
//	@Success	200			{array}		dto.LabelResponse
//	@Failure	400			{string}	string	"invalid id"
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Failure	500			{string}	string	"fetch failed"
//	@Router		/node-pools/{id}/labels [get]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func ListNodePoolLabels(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool id required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).Preload("Labels").First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := make([]dto.LabelResponse, 0, len(np.Taints))
		for _, label := range np.Labels {
			out = append(out, dto.LabelResponse{
				AuditFields: common.AuditFields{
					ID:             label.ID,
					OrganizationID: label.OrganizationID,
					CreatedAt:      label.CreatedAt,
					UpdatedAt:      label.UpdatedAt,
				},
				Key:   label.Key,
				Value: label.Value,
			})
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// AttachNodePoolLabels godoc
//
//	@ID			AttachNodePoolLabels
//	@Summary	Attach labels to a node pool (org scoped)
//	@Tags		NodePools
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string					false	"Organization UUID"
//	@Param		id			path		string					true	"Node Pool ID (UUID)"
//	@Param		body		body		dto.AttachLabelsRequest	true	"Label IDs to attach"
//	@Success	204			{string}	string					"No Content"
//	@Failure	400			{string}	string					"invalid id / invalid server_ids"
//	@Failure	401			{string}	string					"Unauthorized"
//	@Failure	403			{string}	string					"organization required"
//	@Failure	404			{string}	string					"not found"
//	@Failure	500			{string}	string					"attach failed"
//	@Router		/node-pools/{id}/labels [post]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func AttachNodePoolLabels(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool id required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var req dto.AttachLabelsRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		ids, err := parseUUIDs(req.LabelIDs)
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid label_ids")
			return
		}

		if len(ids) == 0 {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "nothing to attach")
			return
		}

		if err := ensureLabelsBelongToOrg(orgID, ids, db); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid label_ids for this organization")
		}

		var labels []models.Label
		if err := db.Where("organization_id = ? AND id IN ?", orgID, ids).Find(&labels).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "attach db error")
			return
		}

		if len(labels) == 0 {
			w.WriteHeader(http.StatusNoContent)
			return
		}

		if err := db.Model(&np).Association("Labels").Append(&labels); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "attach failed")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// DetachNodePoolLabel godoc
//
//	@ID			DetachNodePoolLabel
//	@Summary	Detach one label from a node pool (org scoped)
//	@Tags		NodePools
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization UUID"
//	@Param		id			path		string	true	"Node Pool ID (UUID)"
//	@Param		labelId		path		string	true	"Label ID (UUID)"
//	@Success	204			{string}	string	"No Content"
//	@Failure	400			{string}	string	"invalid id"
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Failure	500			{string}	string	"detach failed"
//	@Router		/node-pools/{id}/labels/{labelId} [delete]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func DetachNodePoolLabel(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool id required")
			return
		}
		labelId, err := uuid.Parse(chi.URLParam(r, "labelId"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "labelId required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var l models.Label
		if err := db.Where("id = ? AND organization_id = ?", labelId, orgID).First(&l).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "label_not_found", "label not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		if err := db.Model(&np).Association("Labels").Delete(&l); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "detach error")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// -- Node Pools Annotations

// ListNodePoolAnnotations godoc
//
//	@ID			ListNodePoolAnnotations
//	@Summary	List annotations attached to a node pool (org scoped)
//	@Tags		NodePools
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization UUID"
//	@Param		id			path		string	true	"Node Pool ID (UUID)"
//	@Success	200			{array}		dto.AnnotationResponse
//	@Failure	400			{string}	string	"invalid id"
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Failure	500			{string}	string	"fetch failed"
//	@Router		/node-pools/{id}/annotations [get]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func ListNodePoolAnnotations(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool id required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).Preload("Labels").First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := make([]dto.AnnotationResponse, 0, len(np.Annotations))
		for _, ann := range np.Annotations {
			out = append(out, dto.AnnotationResponse{
				AuditFields: common.AuditFields{
					ID:             ann.ID,
					OrganizationID: ann.OrganizationID,
					CreatedAt:      ann.CreatedAt,
					UpdatedAt:      ann.UpdatedAt,
				},
				Key:   ann.Key,
				Value: ann.Value,
			})
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// AttachNodePoolAnnotations godoc
//
//	@ID			AttachNodePoolAnnotations
//	@Summary	Attach annotation to a node pool (org scoped)
//	@Tags		NodePools
//	@Accept		json
//	@Produce	json
//	@Param		X-Org-ID	header		string							false	"Organization UUID"
//	@Param		id			path		string							true	"Node Group ID (UUID)"
//	@Param		body		body		dto.AttachAnnotationsRequest	true	"Annotation IDs to attach"
//	@Success	204			{string}	string							"No Content"
//	@Failure	400			{string}	string							"invalid id / invalid server_ids"
//	@Failure	401			{string}	string							"Unauthorized"
//	@Failure	403			{string}	string							"organization required"
//	@Failure	404			{string}	string							"not found"
//	@Failure	500			{string}	string							"attach failed"
//	@Router		/node-pools/{id}/annotations [post]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func AttachNodePoolAnnotations(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool id required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var req dto.AttachAnnotationsRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		ids, err := parseUUIDs(req.AnnotationIDs)
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid annotation ids")
			return
		}

		if len(ids) == 0 {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "nothing to attach")
			return
		}

		if err := ensureAnnotaionsBelongToOrg(orgID, ids, db); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid annotation ids for this organization")
			return
		}

		var ann []models.Annotation
		if err := db.Where("organization_id = ? AND id IN ?", orgID, ids).Find(&ann).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		if len(ann) == 0 {
			w.WriteHeader(http.StatusNoContent)
			return
		}

		if err := db.Model(&np).Association("Annotations").Append(&ann); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "attach failed")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// DetachNodePoolAnnotation godoc
//
//	@ID			DetachNodePoolAnnotation
//	@Summary	Detach one annotation from a node pool (org scoped)
//	@Tags		NodePools
//	@Produce	json
//	@Param		X-Org-ID		header		string	false	"Organization UUID"
//	@Param		id				path		string	true	"Node Pool ID (UUID)"
//	@Param		annotationId	path		string	true	"Annotation ID (UUID)"
//	@Success	204				{string}	string	"No Content"
//	@Failure	400				{string}	string	"invalid id"
//	@Failure	401				{string}	string	"Unauthorized"
//	@Failure	403				{string}	string	"organization required"
//	@Failure	404				{string}	string	"not found"
//	@Failure	500				{string}	string	"detach failed"
//	@Router		/node-pools/{id}/annotations/{annotationId} [delete]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func DetachNodePoolAnnotation(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}
		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool id required")
			return
		}
		annotationId, err := uuid.Parse(chi.URLParam(r, "annotationId"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_required", "node pool annotation id required")
			return
		}

		var np models.NodePool
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&np).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "node_pool_not_found", "node pool not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var ann []models.Annotation
		if err := db.Where("id = ? AND organization_id = ?", annotationId, orgID).First(&ann).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "annotation_not_found", "annotation not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		if err := db.Model(&np).Association("Annotations").Delete(&ann); err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// -- Helpers
func parseUUIDs(ids []string) ([]uuid.UUID, error) {
	out := make([]uuid.UUID, 0, len(ids))
	for _, id := range ids {
		u, err := uuid.Parse(id)
		if err != nil {
			return nil, err
		}
		out = append(out, u)
	}
	return out, nil
}

func ensureServersBelongToOrg(orgID uuid.UUID, ids []uuid.UUID, db *gorm.DB) error {
	var count int64
	if err := db.Model(&models.Server{}).Where("organization_id = ? AND id IN ?", orgID, ids).Count(&count).Error; err != nil {
		return err
	}
	if count != int64(len(ids)) {
		return errors.New("some servers do not belong to this org")
	}
	return nil
}

func ensureTaintsBelongToOrg(orgID uuid.UUID, ids []uuid.UUID, db *gorm.DB) error {
	var count int64
	if err := db.Model(&models.Taint{}).Where("organization_id = ? AND id IN ?", orgID, ids).Count(&count).Error; err != nil {
		return err
	}
	if count != int64(len(ids)) {
		return errors.New("some taints do not belong to this org")
	}
	return nil
}

func ensureLabelsBelongToOrg(orgID uuid.UUID, ids []uuid.UUID, db *gorm.DB) error {
	var count int64
	if err := db.Model(&models.Label{}).Where("organization_id = ? AND id IN ?", orgID, ids).Count(&count).Error; err != nil {
		return err
	}
	if count != int64(len(ids)) {
		return errors.New("some labels do not belong to this org")
	}
	return nil
}

func ensureAnnotaionsBelongToOrg(orgID uuid.UUID, ids []uuid.UUID, db *gorm.DB) error {
	var count int64
	if err := db.Model(&models.Annotation{}).Where("organization_id = ? AND id IN ?", orgID, ids).Count(&count).Error; err != nil {
		return err
	}
	if count != int64(len(ids)) {
		return errors.New("some annotations do not belong to this org")
	}
	return nil
}
</file>

<file path="internal/handlers/orgs.go">
package handlers

import (
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"errors"
	"net/http"
	"strings"
	"time"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/auth"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// ---------- Helpers ----------

func mustUser(r *http.Request) (*models.User, bool) {
	return httpmiddleware.UserFrom(r.Context())
}

func isOrgRole(db *gorm.DB, userID, orgID uuid.UUID, want ...string) (bool, string) {
	var m models.Membership
	if err := db.Where("user_id = ? AND organization_id = ?", userID, orgID).First(&m).Error; err != nil {
		return false, ""
	}
	got := strings.ToLower(m.Role)
	for _, w := range want {
		if got == strings.ToLower(w) {
			return true, got
		}
	}
	return false, got
}

func mustMember(db *gorm.DB, userID, orgID uuid.UUID) bool {
	ok, _ := isOrgRole(db, userID, orgID, "owner", "admin", "member")
	return ok
}

func randomB64URL(n int) (string, error) {
	b := make([]byte, n)
	if _, err := rand.Read(b); err != nil {
		return "", err
	}
	return base64.RawURLEncoding.EncodeToString(b), nil
}

// ---------- Orgs: list/create/get/update/delete ----------

type orgCreateReq struct {
	Name   string  `json:"name" example:"Acme Corp"`
	Domain *string `json:"domain,omitempty" example:"acme.com"`
}

// CreateOrg godoc
//
//	@ID			CreateOrg
//	@Summary	Create organization
//	@Tags		Orgs
//	@Accept		json
//	@Produce	json
//	@Param		body	body		orgCreateReq	true	"Org payload"
//	@Success	201		{object}	models.Organization
//	@Failure	400		{object}	utils.ErrorResponse
//	@Failure	401		{object}	utils.ErrorResponse
//	@Failure	409		{object}	utils.ErrorResponse
//	@Router		/orgs [post]
//	@ID			createOrg
//	@Security	BearerAuth
func CreateOrg(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "")
			return
		}

		var req orgCreateReq
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, 400, "invalid_json", err.Error())
			return
		}

		if strings.TrimSpace(req.Name) == "" {
			utils.WriteError(w, 400, "validation_error", "name is required")
			return
		}

		org := models.Organization{Name: req.Name}
		if req.Domain != nil && strings.TrimSpace(*req.Domain) != "" {
			org.Domain = req.Domain
		}

		if err := db.Create(&org).Error; err != nil {
			utils.WriteError(w, 409, "conflict", err.Error())
			return
		}

		// creator is owner
		_ = db.Create(&models.Membership{
			UserID: u.ID, OrganizationID: org.ID, Role: "owner",
		}).Error

		utils.WriteJSON(w, 201, org)
	}
}

// ListMyOrgs godoc
//
//	@ID			ListMyOrgs
//	@Summary	List organizations I belong to
//	@Tags		Orgs
//	@Produce	json
//	@Success	200	{array}		models.Organization
//	@Failure	401	{object}	utils.ErrorResponse
//	@Router		/orgs [get]
//	@ID			listMyOrgs
//	@Security	BearerAuth
func ListMyOrgs(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, http.StatusUnauthorized, "unauthorized", "")
			return
		}

		var orgs []models.Organization
		if err := db.
			Joins("join memberships m on m.organization_id = organizations.id").
			Where("m.user_id = ?", u.ID).
			Order("organizations.created_at desc").
			Find(&orgs).Error; err != nil {
			utils.WriteError(w, 500, "db_error", err.Error())
			return
		}
		utils.WriteJSON(w, 200, orgs)
	}
}

// GetOrg godoc
//
//	@ID			GetOrg
//	@Summary	Get organization
//	@Tags		Orgs
//	@Produce	json
//	@Param		id	path		string	true	"Org ID (UUID)"
//	@Success	200	{object}	models.Organization
//	@Failure	401	{object}	utils.ErrorResponse
//	@Failure	404	{object}	utils.ErrorResponse
//	@Router		/orgs/{id} [get]
//	@ID			getOrg
//	@Security	BearerAuth
func GetOrg(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, 401, "unauthorized", "")
			return
		}
		oid, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, 404, "not_found", "org not found")
			return
		}
		if !mustMember(db, u.ID, oid) {
			utils.WriteError(w, 401, "forbidden", "not a member")
			return
		}
		var org models.Organization
		if err := db.First(&org, "id = ?", oid).Error; err != nil {
			utils.WriteError(w, 404, "not_found", "org not found")
			return
		}
		utils.WriteJSON(w, 200, org)
	}
}

type orgUpdateReq struct {
	Name   *string `json:"name,omitempty"`
	Domain *string `json:"domain,omitempty"`
}

// UpdateOrg godoc
//
//	@ID			UpdateOrg
//	@Summary	Update organization (owner/admin)
//	@Tags		Orgs
//	@Accept		json
//	@Produce	json
//	@Param		id		path		string			true	"Org ID (UUID)"
//	@Param		body	body		orgUpdateReq	true	"Update payload"
//	@Success	200		{object}	models.Organization
//	@Failure	401		{object}	utils.ErrorResponse
//	@Failure	404		{object}	utils.ErrorResponse
//	@Router		/orgs/{id} [patch]
//	@ID			updateOrg
//	@Security	BearerAuth
func UpdateOrg(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, 401, "unauthorized", "")
			return
		}
		oid, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, 404, "not_found", "org not found")
			return
		}
		if ok, _ := isOrgRole(db, u.ID, oid, "owner", "admin"); !ok {
			utils.WriteError(w, 401, "forbidden", "admin or owner required")
			return
		}
		var req orgUpdateReq
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, 400, "invalid_json", err.Error())
			return
		}
		changes := map[string]any{}
		if req.Name != nil {
			changes["name"] = strings.TrimSpace(*req.Name)
		}
		if req.Domain != nil {
			if d := strings.TrimSpace(*req.Domain); d == "" {
				changes["domain"] = nil
			} else {
				changes["domain"] = d
			}
		}
		if len(changes) > 0 {
			if err := db.Model(&models.Organization{}).Where("id = ?", oid).Updates(changes).Error; err != nil {
				utils.WriteError(w, 500, "db_error", err.Error())
				return
			}
		}
		var out models.Organization
		_ = db.First(&out, "id = ?", oid).Error
		utils.WriteJSON(w, 200, out)
	}
}

// DeleteOrg godoc
//
//	@ID			DeleteOrg
//	@Summary	Delete organization (owner)
//	@Tags		Orgs
//	@Produce	json
//	@Param		id	path	string	true	"Org ID (UUID)"
//	@Success	204	"Deleted"
//	@Failure	401	{object}	utils.ErrorResponse
//	@Failure	404	{object}	utils.ErrorResponse
//	@Router		/orgs/{id} [delete]
//	@ID			deleteOrg
//	@Security	BearerAuth
func DeleteOrg(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, 401, "unauthorized", "")
			return
		}
		oid, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, 404, "not_found", "org not found")
			return
		}
		if ok, _ := isOrgRole(db, u.ID, oid, "owner"); !ok {
			utils.WriteError(w, 401, "forbidden", "owner required")
			return
		}
		// Optional safety: deny if members >1 or resources exist; here we just delete.
		res := db.Delete(&models.Organization{}, "id = ?", oid)
		if res.Error != nil {
			utils.WriteError(w, 500, "db_error", res.Error.Error())
			return
		}
		if res.RowsAffected == 0 {
			utils.WriteError(w, 404, "not_found", "org not found")
			return
		}
		w.WriteHeader(204)
	}
}

// ---------- Members: list/add/update/delete ----------

type memberOut struct {
	UserID uuid.UUID `json:"user_id" format:"uuid"`
	Email  string    `json:"email"`
	Role   string    `json:"role"` // owner/admin/member
}

type memberUpsertReq struct {
	UserID uuid.UUID `json:"user_id" format:"uuid"`
	Role   string    `json:"role" example:"member"`
}

// ListMembers godoc
//
//	@ID			ListMembers
//	@Summary	List members in org
//	@Tags		Orgs
//	@Produce	json
//	@Param		id	path		string	true	"Org ID (UUID)"
//	@Success	200	{array}		memberOut
//	@Failure	401	{object}	utils.ErrorResponse
//	@Router		/orgs/{id}/members [get]
//	@ID			listMembers
//	@Security	BearerAuth
func ListMembers(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, 401, "unauthorized", "")
			return
		}
		oid, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil || !mustMember(db, u.ID, oid) {
			utils.WriteError(w, 401, "forbidden", "")
			return
		}
		var ms []models.Membership
		if err := db.Where("organization_id = ?", oid).Find(&ms).Error; err != nil {
			utils.WriteError(w, 500, "db_error", err.Error())
			return
		}

		// load emails
		userIDs := make([]uuid.UUID, 0, len(ms))
		for _, m := range ms {
			userIDs = append(userIDs, m.UserID)
		}
		var emails []models.UserEmail
		if len(userIDs) > 0 {
			_ = db.Where("user_id in ?", userIDs).Where("is_primary = true").Find(&emails).Error
		}
		emailByUser := map[uuid.UUID]string{}
		for _, e := range emails {
			emailByUser[e.UserID] = e.Email
		}

		out := make([]memberOut, 0, len(ms))
		for _, m := range ms {
			out = append(out, memberOut{
				UserID: m.UserID,
				Email:  emailByUser[m.UserID],
				Role:   m.Role,
			})
		}
		utils.WriteJSON(w, 200, out)
	}
}

// AddOrUpdateMember godoc
//
//	@ID			AddOrUpdateMember
//	@Summary	Add or update a member (owner/admin)
//	@Tags		Orgs
//	@Accept		json
//	@Produce	json
//	@Param		id		path		string			true	"Org ID (UUID)"
//	@Param		body	body		memberUpsertReq	true	"User & role"
//	@Success	200		{object}	memberOut
//	@Failure	401		{object}	utils.ErrorResponse
//	@Router		/orgs/{id}/members [post]
//	@ID			addOrUpdateMember
//	@Security	BearerAuth
func AddOrUpdateMember(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, 401, "unauthorized", "")
			return
		}
		oid, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, 404, "not_found", "org not found")
			return
		}
		if ok, _ := isOrgRole(db, u.ID, oid, "owner", "admin"); !ok {
			utils.WriteError(w, 401, "forbidden", "admin or owner required")
			return
		}
		var req memberUpsertReq
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, 400, "invalid_json", err.Error())
			return
		}
		role := strings.ToLower(strings.TrimSpace(req.Role))
		if role != "owner" && role != "admin" && role != "member" {
			utils.WriteError(w, 400, "validation_error", "role must be owner|admin|member")
			return
		}
		var m models.Membership
		tx := db.Where("user_id = ? AND organization_id = ?", req.UserID, oid).First(&m)
		if tx.Error == nil {
			// update
			if err := db.Model(&m).Update("role", role).Error; err != nil {
				utils.WriteError(w, 500, "db_error", err.Error())
				return
			}
		} else if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
			m = models.Membership{UserID: req.UserID, OrganizationID: oid, Role: role}
			if err := db.Create(&m).Error; err != nil {
				utils.WriteError(w, 500, "db_error", err.Error())
				return
			}
		} else {
			utils.WriteError(w, 500, "db_error", tx.Error.Error())
			return
		}

		// make response
		var ue models.UserEmail
		_ = db.Where("user_id = ? AND is_primary = true", req.UserID).First(&ue).Error
		utils.WriteJSON(w, 200, memberOut{
			UserID: req.UserID, Email: ue.Email, Role: m.Role,
		})
	}
}

// RemoveMember godoc
//
//	@ID			RemoveMember
//	@Summary	Remove a member (owner/admin)
//	@Tags		Orgs
//	@Produce	json
//	@Param		id		path	string	true	"Org ID (UUID)"
//	@Param		user_id	path	string	true	"User ID (UUID)"
//	@Success	204		"Removed"
//	@Failure	401		{object}	utils.ErrorResponse
//	@Router		/orgs/{id}/members/{user_id} [delete]
//	@ID			removeMember
//	@Security	BearerAuth
func RemoveMember(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, 401, "unauthorized", "")
			return
		}
		oid, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, 404, "not_found", "org not found")
			return
		}
		if ok, _ := isOrgRole(db, u.ID, oid, "owner", "admin"); !ok {
			utils.WriteError(w, 401, "forbidden", "admin or owner required")
			return
		}
		uid, err := uuid.Parse(chi.URLParam(r, "user_id"))
		if err != nil {
			utils.WriteError(w, 400, "invalid_user_id", "")
			return
		}
		res := db.Where("user_id = ? AND organization_id = ?", uid, oid).Delete(&models.Membership{})
		if res.Error != nil {
			utils.WriteError(w, 500, "db_error", res.Error.Error())
			return
		}
		w.WriteHeader(204)
	}
}

// ---------- Org API Keys (key/secret pair) ----------

type orgKeyCreateReq struct {
	Name           string `json:"name,omitempty" example:"automation-bot"`
	ExpiresInHours *int   `json:"expires_in_hours,omitempty" example:"720"`
}

type orgKeyCreateResp struct {
	ID        uuid.UUID  `json:"id"`
	Name      string     `json:"name,omitempty"`
	Scope     string     `json:"scope"` // "org"
	CreatedAt time.Time  `json:"created_at"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
	OrgKey    string     `json:"org_key"`    // shown once:
	OrgSecret string     `json:"org_secret"` // shown once:
}

// ListOrgKeys godoc
//
//	@ID			ListOrgKeys
//	@Summary	List org-scoped API keys (no secrets)
//	@Tags		Orgs
//	@Produce	json
//	@Param		id	path		string	true	"Org ID (UUID)"
//	@Success	200	{array}		models.APIKey
//	@Failure	401	{object}	utils.ErrorResponse
//	@Router		/orgs/{id}/api-keys [get]
//	@ID			listOrgKeys
//	@Security	BearerAuth
func ListOrgKeys(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, 401, "unauthorized", "")
			return
		}
		oid, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil || !mustMember(db, u.ID, oid) {
			utils.WriteError(w, 401, "forbidden", "")
			return
		}
		var keys []models.APIKey
		if err := db.Where("org_id = ? AND scope = ?", oid, "org").
			Order("created_at desc").
			Find(&keys).Error; err != nil {
			utils.WriteError(w, 500, "db_error", err.Error())
			return
		}
		// SecretHash must not be exposed; your json tags likely hide it already.
		utils.WriteJSON(w, 200, keys)
	}
}

// CreateOrgKey godoc
//
//	@ID			CreateOrgKey
//	@Summary	Create org key/secret pair (owner/admin)
//	@Tags		Orgs
//	@Accept		json
//	@Produce	json
//	@Param		id		path		string			true	"Org ID (UUID)"
//	@Param		body	body		orgKeyCreateReq	true	"Key name + optional expiry"
//	@Success	201		{object}	orgKeyCreateResp
//	@Failure	401		{object}	utils.ErrorResponse
//	@Router		/orgs/{id}/api-keys [post]
//	@ID			createOrgKey
//	@Security	BearerAuth
func CreateOrgKey(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, 401, "unauthorized", "")
			return
		}
		oid, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, 404, "not_found", "org not found")
			return
		}
		if ok, _ := isOrgRole(db, u.ID, oid, "owner", "admin"); !ok {
			utils.WriteError(w, 401, "forbidden", "admin or owner required")
			return
		}

		var req orgKeyCreateReq
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, 400, "invalid_json", err.Error())
			return
		}

		// generate
		keySuffix, err := randomB64URL(16)
		if err != nil {
			utils.WriteError(w, 500, "entropy_error", err.Error())
			return
		}
		sec, err := randomB64URL(32)
		if err != nil {
			utils.WriteError(w, 500, "entropy_error", err.Error())
			return
		}
		orgKey := "org_" + keySuffix
		secretPlain := sec

		keyHash := auth.SHA256Hex(orgKey)
		secretHash, err := auth.HashSecretArgon2id(secretPlain)
		if err != nil {
			utils.WriteError(w, 500, "hash_error", err.Error())
			return
		}

		var exp *time.Time
		if req.ExpiresInHours != nil && *req.ExpiresInHours > 0 {
			e := time.Now().Add(time.Duration(*req.ExpiresInHours) * time.Hour)
			exp = &e
		}

		prefix := orgKey
		if len(prefix) > 12 {
			prefix = prefix[:12]
		}

		rec := models.APIKey{
			OrgID:       &oid,
			Scope:       "org",
			Purpose:     "user",
			IsEphemeral: false,
			Name:        req.Name,
			KeyHash:     keyHash,
			SecretHash:  &secretHash,
			ExpiresAt:   exp,
			Revoked:     false,
			Prefix:      &prefix,
		}
		if err := db.Create(&rec).Error; err != nil {
			utils.WriteError(w, 500, "db_error", err.Error())
			return
		}

		utils.WriteJSON(w, 201, orgKeyCreateResp{
			ID:        rec.ID,
			Name:      rec.Name,
			Scope:     rec.Scope,
			CreatedAt: rec.CreatedAt,
			ExpiresAt: rec.ExpiresAt,
			OrgKey:    orgKey,
			OrgSecret: secretPlain,
		})
	}
}

// DeleteOrgKey godoc
//
//	@ID			DeleteOrgKey
//	@Summary	Delete org key (owner/admin)
//	@Tags		Orgs
//	@Produce	json
//	@Param		id		path	string	true	"Org ID (UUID)"
//	@Param		key_id	path	string	true	"Key ID (UUID)"
//	@Success	204		"Deleted"
//	@Failure	401		{object}	utils.ErrorResponse
//	@Router		/orgs/{id}/api-keys/{key_id} [delete]
//	@ID			deleteOrgKey
//	@Security	BearerAuth
func DeleteOrgKey(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		u, ok := mustUser(r)
		if !ok {
			utils.WriteError(w, 401, "unauthorized", "")
			return
		}
		oid, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, 404, "not_found", "org not found")
			return
		}
		if ok, _ := isOrgRole(db, u.ID, oid, "owner", "admin"); !ok {
			utils.WriteError(w, 401, "forbidden", "admin or owner required")
			return
		}
		kid, err := uuid.Parse(chi.URLParam(r, "key_id"))
		if err != nil {
			utils.WriteError(w, 400, "invalid_key_id", "")
			return
		}
		res := db.Where("id = ? AND org_id = ? AND scope = ?", kid, oid, "org").Delete(&models.APIKey{})
		if res.Error != nil {
			utils.WriteError(w, 500, "db_error", res.Error.Error())
			return
		}
		if res.RowsAffected == 0 {
			utils.WriteError(w, 404, "not_found", "key not found")
			return
		}
		w.WriteHeader(204)
	}
}
</file>

<file path="internal/handlers/servers_test.go">
package handlers

import (
	"testing"

	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/testutil/pgtest"
	"github.com/google/uuid"
)

func TestValidStatus(t *testing.T) {
	// known-good statuses from servers.go
	valid := []string{"pending", "provisioning", "ready", "failed"}
	for _, s := range valid {
		if !validStatus(s) {
			t.Errorf("expected validStatus(%q) = true, got false", s)
		}
	}

	invalid := []string{"foobar", "unknown"}
	for _, s := range invalid {
		if validStatus(s) {
			t.Errorf("expected validStatus(%q) = false, got true", s)
		}
	}
}

func TestEnsureKeyBelongsToOrg_Success(t *testing.T) {
	db := pgtest.DB(t)

	org := models.Organization{Name: "servers-org"}
	if err := db.Create(&org).Error; err != nil {
		t.Fatalf("create org: %v", err)
	}

	key := createTestSshKey(t, db, org.ID, "org-key")

	if err := ensureKeyBelongsToOrg(org.ID, key.ID, db); err != nil {
		t.Fatalf("expected no error, got %v", err)
	}
}

func TestEnsureKeyBelongsToOrg_WrongOrg(t *testing.T) {
	db := pgtest.DB(t)

	orgA := models.Organization{Name: "org-a"}
	orgB := models.Organization{Name: "org-b"}

	if err := db.Create(&orgA).Error; err != nil {
		t.Fatalf("create orgA: %v", err)
	}
	if err := db.Create(&orgB).Error; err != nil {
		t.Fatalf("create orgB: %v", err)
	}

	keyA := createTestSshKey(t, db, orgA.ID, "org-a-key")

	// ask for orgB with a key that belongs to orgA → should fail
	if err := ensureKeyBelongsToOrg(orgB.ID, keyA.ID, db); err == nil {
		t.Fatalf("expected error when ssh key belongs to a different org, got nil")
	}
}

func TestEnsureKeyBelongsToOrg_NotFound(t *testing.T) {
	db := pgtest.DB(t)

	org := models.Organization{Name: "org-nokey"}
	if err := db.Create(&org).Error; err != nil {
		t.Fatalf("create org: %v", err)
	}

	// random keyID that doesn't exist
	randomKeyID := uuid.New()

	if err := ensureKeyBelongsToOrg(org.ID, randomKeyID, db); err == nil {
		t.Fatalf("expected error when ssh key does not exist, got nil")
	}
}
</file>

<file path="internal/handlers/servers.go">
package handlers

import (
	"encoding/json"
	"errors"
	"net/http"
	"strings"
	"time"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// ListServers godoc
//
//	@ID				ListServers
//	@Summary		List servers (org scoped)
//	@Description	Returns servers for the organization in X-Org-ID. Optional filters: status, role.
//	@Tags			Servers
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			status		query		string	false	"Filter by status (pending|provisioning|ready|failed)"
//	@Param			role		query		string	false	"Filter by role"
//	@Success		200			{array}		dto.ServerResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"failed to list servers"
//	@Router			/servers [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListServers(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		q := db.Where("organization_id = ?", orgID)

		if s := strings.TrimSpace(r.URL.Query().Get("status")); s != "" {
			if !validStatus(s) {
				utils.WriteError(w, http.StatusBadRequest, "status_invalid", "invalid status")
				return
			}
			q = q.Where("status = ?", strings.ToLower(s))
		}

		if role := strings.TrimSpace(r.URL.Query().Get("role")); role != "" {
			q = q.Where("role = ?", role)
		}

		var rows []models.Server
		if err := q.Order("created_at DESC").Find(&rows).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to list servers")
			return
		}

		out := make([]dto.ServerResponse, 0, len(rows))
		for _, row := range rows {
			out = append(out, dto.ServerResponse{
				ID:               row.ID,
				OrganizationID:   row.OrganizationID,
				Hostname:         row.Hostname,
				PublicIPAddress:  row.PublicIPAddress,
				PrivateIPAddress: row.PrivateIPAddress,
				SSHUser:          row.SSHUser,
				SshKeyID:         row.SshKeyID,
				Role:             row.Role,
				Status:           row.Status,
				CreatedAt:        row.CreatedAt.UTC().Format(time.RFC3339),
				UpdatedAt:        row.UpdatedAt.UTC().Format(time.RFC3339),
			})
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetServer godoc
//
//	@ID				GetServer
//	@Summary		Get server by ID (org scoped)
//	@Description	Returns one server in the given organization.
//	@Tags			Servers
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			id			path		string	true	"Server ID (UUID)"
//	@Success		200			{object}	dto.ServerResponse
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"fetch failed"
//	@Router			/servers/{id} [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func GetServer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_invalid", "invalid id")
			return
		}

		var row models.Server
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "server_not_found", "server not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to get server")
			return
		}

		utils.WriteJSON(w, http.StatusOK, row)
	}
}

// CreateServer godoc
//
//	@ID				CreateServer
//	@Summary		Create server (org scoped)
//	@Description	Creates a server bound to the org in X-Org-ID. Validates that ssh_key_id belongs to the org.
//	@Tags			Servers
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string					false	"Organization UUID"
//	@Param			body		body		dto.CreateServerRequest	true	"Server payload"
//	@Success		201			{object}	dto.ServerResponse
//	@Failure		400			{string}	string	"invalid json / missing fields / invalid status / invalid ssh_key_id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"create failed"
//	@Router			/servers [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func CreateServer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var req dto.CreateServerRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		req.Role = strings.ToLower(strings.TrimSpace(req.Role))
		req.Status = strings.ToLower(strings.TrimSpace(req.Status))
		pub := strings.TrimSpace(req.PublicIPAddress)

		if req.PrivateIPAddress == "" || req.SSHUser == "" || req.SshKeyID == "" || req.Role == "" {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "private_ip_address, ssh_user, ssh_key_id and role are required")
			return
		}

		if req.Status != "" && !validStatus(req.Status) {
			utils.WriteError(w, http.StatusBadRequest, "status_invalid", "invalid status")
			return
		}

		if req.Role == "bastion" && pub == "" {
			utils.WriteError(w, http.StatusBadRequest, "public_ip_required", "public_ip_address is required for role=bastion")
			return
		}

		keyID, err := uuid.Parse(req.SshKeyID)
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid ssh_key_id")
			return
		}
		if err := ensureKeyBelongsToOrg(orgID, keyID, db); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid or unauthorized ssh_key_id")
			return
		}

		var publicPtr *string
		if pub != "" {
			publicPtr = &pub
		}

		s := models.Server{
			OrganizationID:   orgID,
			Hostname:         req.Hostname,
			PublicIPAddress:  publicPtr,
			PrivateIPAddress: req.PrivateIPAddress,
			SSHUser:          req.SSHUser,
			SshKeyID:         keyID,
			Role:             req.Role,
			Status:           "pending",
		}
		if req.Status != "" {
			s.Status = strings.ToLower(req.Status)
		}

		if err := db.Create(&s).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to create server")
			return
		}
		utils.WriteJSON(w, http.StatusCreated, s)
	}
}

// UpdateServer godoc
//
//	@ID				UpdateServer
//	@Summary		Update server (org scoped)
//	@Description	Partially update fields; changing ssh_key_id validates ownership.
//	@Tags			Servers
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string					false	"Organization UUID"
//	@Param			id			path		string					true	"Server ID (UUID)"
//	@Param			body		body		dto.UpdateServerRequest	true	"Fields to update"
//	@Success		200			{object}	dto.ServerResponse
//	@Failure		400			{string}	string	"invalid id / invalid json / invalid status / invalid ssh_key_id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"update failed"
//	@Router			/servers/{id} [patch]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func UpdateServer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_invalid", "invalid id")
			return
		}

		var server models.Server
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&server).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "server_not_found", "server not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to get server")
			return
		}

		var req dto.UpdateServerRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		next := server

		if req.Hostname != nil {
			next.Hostname = *req.Hostname
		}
		if req.PrivateIPAddress != nil {
			next.PrivateIPAddress = *req.PrivateIPAddress
		}
		if req.PublicIPAddress != nil {
			next.PublicIPAddress = req.PublicIPAddress
		}
		if req.SSHUser != nil {
			next.SSHUser = *req.SSHUser
		}
		if req.Role != nil {
			next.Role = *req.Role
		}
		if req.Status != nil {
			st := strings.ToLower(strings.TrimSpace(*req.Status))
			if !validStatus(st) {
				utils.WriteError(w, http.StatusBadRequest, "status_invalid", "invalid status")
				return
			}
			next.Status = st
		}
		if req.SshKeyID != nil {
			keyID, err := uuid.Parse(*req.SshKeyID)
			if err != nil {
				utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid ssh_key_id")
				return
			}
			if err := ensureKeyBelongsToOrg(orgID, keyID, db); err != nil {
				utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid or unauthorized ssh_key_id")
				return
			}
			next.SshKeyID = keyID
		}

		if strings.EqualFold(next.Role, "bastion") &&
			(next.PublicIPAddress == nil || strings.TrimSpace(*next.PublicIPAddress) == "") {
			utils.WriteError(w, http.StatusBadRequest, "public_ip_required", "public_ip_address is required for role=bastion")
			return
		}

		if err := db.Save(&next).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to update server")
			return
		}
		utils.WriteJSON(w, http.StatusOK, server)
	}
}

// DeleteServer godoc
//
//	@ID				DeleteServer
//	@Summary		Delete server (org scoped)
//	@Description	Permanently deletes the server.
//	@Tags			Servers
//	@Produce		json
//	@Param			X-Org-ID	header	string	false	"Organization UUID"
//	@Param			id			path	string	true	"Server ID (UUID)"
//	@Success		204			"No Content"
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"delete failed"
//	@Router			/servers/{id} [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DeleteServer(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_invalid", "invalid id")
			return
		}

		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&models.Server{}).Error; err != nil {
			utils.WriteError(w, http.StatusNotFound, "server_not_found", "server not found")
			return
		}

		if err := db.Where("id = ? AND organization_id = ?", id, orgID).Delete(&models.Server{}).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to delete server")
			return
		}

		w.WriteHeader(http.StatusNoContent)
	}
}

// ResetServerHostKey godoc
//
//	@ID				ResetServerHostKey
//	@Summary		Reset SSH host key (org scoped)
//	@Description	Clears the stored SSH host key for this server. The next SSH connection will re-learn the host key (trust-on-first-use).
//	@Tags			Servers
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			id			path		string	true	"Server ID (UUID)"
//	@Success		200			{object}	dto.ServerResponse
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"reset failed"
//	@Router			/servers/{id}/reset-hostkey [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ResetServerHostKey(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "id_invalid", "invalid id")
			return
		}

		var server models.Server
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&server).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "server_not_found", "server not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to get server")
			return
		}

		// Clear stored host key so next SSH handshake will TOFU and persist a new one.
		server.SSHHostKey = ""
		server.SSHHostKeyAlgo = ""

		if err := db.Save(&server).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to reset host key")
			return
		}

		utils.WriteJSON(w, http.StatusOK, server)
	}
}

// --- Helpers ---

func validStatus(status string) bool {
	switch strings.ToLower(status) {
	case "pending", "provisioning", "ready", "failed", "":
		return true
	default:
		return false
	}
}

func ensureKeyBelongsToOrg(orgID, keyID uuid.UUID, db *gorm.DB) error {
	var k models.SshKey
	if err := db.Where("id = ? AND organization_id = ?", keyID, orgID).First(&k).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return errors.New("ssh key not found for this organization")
		}
		return err
	}
	return nil
}
</file>

<file path="internal/handlers/ssh_keys.go">
package handlers

import (
	"archive/zip"
	"bytes"
	"crypto/ed25519"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"encoding/json"
	"encoding/pem"
	"errors"
	"fmt"
	"net/http"
	"strings"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/common"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"golang.org/x/crypto/ssh"
	"gorm.io/gorm"
)

// ListPublicSshKeys godoc
//
//	@ID				ListPublicSshKeys
//	@Summary		List ssh keys (org scoped)
//	@Description	Returns ssh keys for the organization in X-Org-ID.
//	@Tags			Ssh
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Success		200			{array}		dto.SshResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"failed to list keys"
//	@Router			/ssh [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListPublicSshKeys(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var out []dto.SshResponse
		if err := db.
			Model(&models.SshKey{}).
			Where("organization_id = ?", orgID).
			// avoid selecting encrypted columns here
			Select("id", "organization_id", "name", "public_key", "fingerprint", "created_at", "updated_at").
			Order("created_at DESC").
			Scan(&out).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to list ssh keys")
			return
		}

		if out == nil {
			out = []dto.SshResponse{}
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// CreateSSHKey
//
//	@ID				CreateSSHKey
//	@Summary		Create ssh keypair (org scoped)
//	@Description	Generates an RSA or ED25519 keypair, saves it, and returns metadata. For RSA you may set bits (2048/3072/4096). Default is 4096. ED25519 ignores bits.
//	@Tags			Ssh
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string					false	"Organization UUID"
//	@Param			body		body		dto.CreateSSHRequest	true	"Key generation options"
//	@Success		201			{object}	dto.SshResponse
//	@Failure		400			{string}	string	"invalid json / invalid bits"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"generation/create failed"
//	@Router			/ssh [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func CreateSSHKey(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var req dto.CreateSSHRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "invalid_payload", "invalid JSON payload")
			return
		}

		keyType := "rsa"
		if req.Type != nil && strings.TrimSpace(*req.Type) != "" {
			keyType = strings.ToLower(strings.TrimSpace(*req.Type))
		}

		if keyType != "rsa" && keyType != "ed25519" {
			utils.WriteError(w, http.StatusBadRequest, "invalid_type", "invalid type (rsa|ed25519)")
			return
		}

		var (
			privPEM string
			pubAuth string
			err     error
		)

		switch keyType {
		case "rsa":
			bits := 4096
			if req.Bits != nil {
				if !allowedBits(*req.Bits) {
					utils.WriteError(w, http.StatusBadRequest, "invalid_bits", "invalid bits (allowed: 2048, 3072, 4096)")
					return
				}
				bits = *req.Bits
			}
			privPEM, pubAuth, err = GenerateRSAPEMAndAuthorized(bits, strings.TrimSpace(req.Comment))

		case "ed25519":
			if req.Bits != nil {
				utils.WriteError(w, http.StatusBadRequest, "invalid_bits_for_type", "bits is only valid for RSA")
				return
			}
			privPEM, pubAuth, err = GenerateEd25519PEMAndAuthorized(strings.TrimSpace(req.Comment))
		}

		if err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "keygen_failure", "key generation failed")
			return
		}

		cipher, iv, tag, err := utils.EncryptForOrg(orgID, []byte(privPEM), db)
		if err != nil {
			http.Error(w, "encryption failed", http.StatusInternalServerError)
			return
		}

		parsed, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pubAuth))
		if err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "ssh_failure", "ssh public key parsing failed")
			return
		}

		fp := ssh.FingerprintSHA256(parsed)

		key := models.SshKey{
			AuditFields: common.AuditFields{
				OrganizationID: orgID,
			},
			Name:                req.Name,
			PublicKey:           pubAuth,
			EncryptedPrivateKey: cipher,
			PrivateIV:           iv,
			PrivateTag:          tag,
			Fingerprint:         fp,
		}

		if err := db.Create(&key).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to create ssh key")
			return
		}

		utils.WriteJSON(w, http.StatusCreated, dto.SshResponse{
			AuditFields: key.AuditFields,
			Name:        key.Name,
			PublicKey:   key.PublicKey,
			Fingerprint: key.Fingerprint,
		})
	}
}

// GetSSHKey godoc
//
//	@ID				GetSSHKey
//	@Summary		Get ssh key by ID (org scoped)
//	@Description	Returns public key fields. Append `?reveal=true` to include the private key PEM.
//	@Tags			Ssh
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			id			path		string	true	"SSH Key ID (UUID)"
//	@Param			reveal		query		bool	false	"Reveal private key PEM"
//	@Success		200			{object}	dto.SshResponse
//	@Success		200			{object}	dto.SshRevealResponse	"When reveal=true"
//	@Failure		400			{string}	string					"invalid id"
//	@Failure		401			{string}	string					"Unauthorized"
//	@Failure		403			{string}	string					"organization required"
//	@Failure		404			{string}	string					"not found"
//	@Failure		500			{string}	string					"fetch failed"
//	@Router			/ssh/{id} [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func GetSSHKey(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "invalid_ssh_key_id", "invalid SSH Key ID")
			return
		}

		reveal := strings.EqualFold(r.URL.Query().Get("reveal"), "true")

		if !reveal {
			var out dto.SshResponse
			if err := db.
				Model(&models.SshKey{}).
				Where("id = ? AND organization_id = ?", id, orgID).
				Select("id", "organization_id", "name", "public_key", "fingerprint", "created_at", "updated_at").
				Limit(1).
				Scan(&out).Error; err != nil {
				utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to get ssh key")
				return
			}
			if out.ID == uuid.Nil {
				utils.WriteError(w, http.StatusNotFound, "ssh_key_not_found", "ssh key not found")
				return
			}
			utils.WriteJSON(w, http.StatusOK, out)
			return
		}

		var secret dto.SshResponse
		if err := db.
			Model(&models.SshKey{}).
			Where("id = ? AND organization_id = ?", id, orgID).
			// include the encrypted bits too
			Select("id", "organization_id", "name", "public_key", "fingerprint",
				"encrypted_private_key", "private_iv", "private_tag",
				"created_at", "updated_at").
			Limit(1).
			Scan(&secret).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to get ssh key")
			return
		}

		if secret.ID == uuid.Nil {
			utils.WriteError(w, http.StatusNotFound, "ssh_key_not_found", "ssh key not found")
			return
		}

		plain, err := utils.DecryptForOrg(orgID, secret.EncryptedPrivateKey, secret.PrivateIV, secret.PrivateTag, db)
		if err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to decrypt ssh key")
			return
		}

		utils.WriteJSON(w, http.StatusOK, dto.SshRevealResponse{
			SshResponse: dto.SshResponse{
				AuditFields: secret.AuditFields,
				Name:        secret.Name,
				PublicKey:   secret.PublicKey,
				Fingerprint: secret.Fingerprint,
			},
			PrivateKey: plain,
		})
	}
}

// DeleteSSHKey godoc
//
//	@ID				DeleteSSHKey
//	@Summary		Delete ssh keypair (org scoped)
//	@Description	Permanently deletes a keypair.
//	@Tags			Ssh
//	@Produce		json
//	@Param			X-Org-ID	header	string	false	"Organization UUID"
//	@Param			id			path	string	true	"SSH Key ID (UUID)"
//	@Success		204			"No Content"
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"delete failed"
//	@Router			/ssh/{id} [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DeleteSSHKey(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "invalid_ssh_key_id", "invalid SSH Key ID")
			return
		}

		res := db.Where("id = ? AND organization_id = ?", id, orgID).
			Delete(&models.SshKey{})
		if res.Error != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to delete ssh key")
			return
		}
		if res.RowsAffected == 0 {
			utils.WriteError(w, http.StatusNotFound, "ssh_key_not_found", "ssh key not found")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// DownloadSSHKey godoc
//
//	@ID				DownloadSSHKey
//	@Summary		Download ssh key files by ID (org scoped)
//	@Description	Download `part=public|private|both` of the keypair. `both` returns a zip file.
//	@Tags			Ssh
//	@Produce		json
//	@Param			X-Org-ID	header		string	true	"Organization UUID"
//	@Param			id			path		string	true	"SSH Key ID (UUID)"
//	@Param			part		query		string	true	"Which part to download"	Enums(public,private,both)
//	@Success		200			{string}	string	"file content"
//	@Failure		400			{string}	string	"invalid id / invalid part"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"download failed"
//	@Router			/ssh/{id}/download [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DownloadSSHKey(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "invalid_ssh_key_id", "invalid SSH Key ID")
			return
		}

		var key models.SshKey
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).
			First(&key).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "ssh_key_not_found", "ssh key not found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to get ssh key")
			return
		}

		part := strings.ToLower(r.URL.Query().Get("part"))
		if part == "" {
			utils.WriteError(w, http.StatusBadRequest, "invalid_ssh_part", "invalid part (public|private|both)")
			return
		}

		mode := strings.ToLower(r.URL.Query().Get("mode"))
		if mode != "" && mode != "json" {
			utils.WriteError(w, http.StatusBadRequest, "invalid_mode", "invalid mode (json|attachment[default])")
			return
		}

		if mode == "json" {
			resp := dto.SshMaterialJSON{
				ID:          key.ID.String(),
				Name:        key.Name,
				Fingerprint: key.Fingerprint,
			}
			switch part {
			case "public":
				pub := key.PublicKey
				resp.PublicKey = &pub
				resp.Filenames = []string{fmt.Sprintf("%s.pub", key.ID.String())}
				utils.WriteJSON(w, http.StatusOK, resp)
				return

			case "private":
				plain, err := utils.DecryptForOrg(orgID, key.EncryptedPrivateKey, key.PrivateIV, key.PrivateTag, db)
				if err != nil {
					utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to decrypt ssh key")
					return
				}
				resp.PrivatePEM = &plain
				resp.Filenames = []string{fmt.Sprintf("%s.pem", key.ID.String())}
				utils.WriteJSON(w, http.StatusOK, resp)
				return

			case "both":
				plain, err := utils.DecryptForOrg(orgID, key.EncryptedPrivateKey, key.PrivateIV, key.PrivateTag, db)
				if err != nil {
					utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to decrypt ssh key")
					return
				}

				var buf bytes.Buffer
				zw := zip.NewWriter(&buf)
				_ = toZipFile(fmt.Sprintf("%s.pem", key.ID.String()), []byte(plain), zw)
				_ = toZipFile(fmt.Sprintf("%s.pub", key.ID.String()), []byte(key.PublicKey), zw)
				_ = zw.Close()

				b64 := utils.EncodeB64(buf.Bytes())
				resp.ZipBase64 = &b64
				resp.Filenames = []string{
					fmt.Sprintf("%s.zip", key.ID.String()),
					fmt.Sprintf("%s.pem", key.ID.String()),
					fmt.Sprintf("%s.pub", key.ID.String()),
				}
				utils.WriteJSON(w, http.StatusOK, resp)
				return

			default:
				utils.WriteError(w, http.StatusBadRequest, "invalid_ssh_part", "invalid part (public|private|both)")
				return
			}
		}

		switch part {
		case "public":
			filename := fmt.Sprintf("%s.pub", key.ID.String())
			w.Header().Set("Content-Type", "text/plain")
			w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, filename))
			_, _ = w.Write([]byte(key.PublicKey))
			return

		case "private":
			plain, err := utils.DecryptForOrg(orgID, key.EncryptedPrivateKey, key.PrivateIV, key.PrivateTag, db)
			if err != nil {
				utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to decrypt ssh key")
				return
			}
			filename := fmt.Sprintf("%s.pem", key.ID.String())
			w.Header().Set("Content-Type", "application/x-pem-file")
			w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, filename))
			_, _ = w.Write([]byte(plain))
			return

		case "both":
			plain, err := utils.DecryptForOrg(orgID, key.EncryptedPrivateKey, key.PrivateIV, key.PrivateTag, db)
			if err != nil {
				utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to decrypt ssh key")
				return
			}

			var buf bytes.Buffer
			zw := zip.NewWriter(&buf)
			_ = toZipFile(fmt.Sprintf("%s.pem", key.ID.String()), []byte(plain), zw)
			_ = toZipFile(fmt.Sprintf("%s.pub", key.ID.String()), []byte(key.PublicKey), zw)
			_ = zw.Close()

			filename := fmt.Sprintf("ssh_key_%s.zip", key.ID.String())
			w.Header().Set("Content-Type", "application/zip")
			w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, filename))
			_, _ = w.Write(buf.Bytes())
			return

		default:
			utils.WriteError(w, http.StatusBadRequest, "invalid_ssh_part", "invalid part (public|private|both)")
			return
		}
	}
}

// --- Helpers ---

func allowedBits(b int) bool {
	return b == 2048 || b == 3072 || b == 4096
}

func GenerateRSA(bits int) (*rsa.PrivateKey, error) {
	return rsa.GenerateKey(rand.Reader, bits)
}

func RSAPrivateToPEMAndAuthorized(priv *rsa.PrivateKey, comment string) (privPEM string, authorized string, err error) {
	der := x509.MarshalPKCS1PrivateKey(priv)
	block := &pem.Block{Type: "RSA PRIVATE KEY", Bytes: der}
	var buf bytes.Buffer
	if err = pem.Encode(&buf, block); err != nil {
		return "", "", err
	}

	pub, err := ssh.NewPublicKey(&priv.PublicKey)
	if err != nil {
		return "", "", err
	}
	auth := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(pub)))
	comment = strings.TrimSpace(comment)
	if comment != "" {
		auth += " " + comment
	}
	return buf.String(), auth, nil
}

func GenerateRSAPEMAndAuthorized(bits int, comment string) (string, string, error) {
	priv, err := GenerateRSA(bits)
	if err != nil {
		return "", "", err
	}
	return RSAPrivateToPEMAndAuthorized(priv, comment)
}

func toZipFile(filename string, content []byte, zw *zip.Writer) error {
	f, err := zw.Create(filename)
	if err != nil {
		return err
	}
	_, err = f.Write(content)
	return err
}

func keyFilenamePrefix(pubAuth string) string {
	pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pubAuth))
	if err != nil {
		return "id_key"
	}
	switch pk.Type() {
	case "ssh-ed25519":
		return "id_ed25519"
	case "ssh-rsa":
		return "id_rsa"
	default:
		return "id_key"
	}
}

func GenerateEd25519PEMAndAuthorized(comment string) (privPEM string, authorized string, err error) {
	// Generate ed25519 keypair
	pub, priv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		return "", "", err
	}

	// Private: PKCS#8 PEM
	der, err := x509.MarshalPKCS8PrivateKey(priv)
	if err != nil {
		return "", "", err
	}
	block := &pem.Block{Type: "PRIVATE KEY", Bytes: der}
	var buf bytes.Buffer
	if err := pem.Encode(&buf, block); err != nil {
		return "", "", err
	}

	// Public: OpenSSH authorized_key
	sshPub, err := ssh.NewPublicKey(ed25519.PublicKey(pub))
	if err != nil {
		return "", "", err
	}
	auth := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(sshPub)))
	comment = strings.TrimSpace(comment)
	if comment != "" {
		auth += " " + comment
	}

	return buf.String(), auth, nil
}
</file>

<file path="internal/handlers/taints.go">
package handlers

import (
	"encoding/json"
	"errors"
	"net/http"
	"strings"
	"time"

	"github.com/glueops/autoglue/internal/api/httpmiddleware"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/go-chi/chi/v5"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

// ListTaints godoc
//
//	@ID				ListTaints
//	@Summary		List node pool taints (org scoped)
//	@Description	Returns node taints for the organization in X-Org-ID. Filters: `key`, `value`, and `q` (key contains). Add `include=node_pools` to include linked node pools.
//	@Tags			Taints
//	@Produce		json
//	@Param			X-Org-ID	header		string	false	"Organization UUID"
//	@Param			key			query		string	false	"Exact key"
//	@Param			value		query		string	false	"Exact value"
//	@Param			q			query		string	false	"key contains (case-insensitive)"
//	@Success		200			{array}		dto.TaintResponse
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"failed to list node taints"
//	@Router			/taints [get]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func ListTaints(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		q := db.Where("organization_id = ?", orgID)

		if key := strings.TrimSpace(r.URL.Query().Get("key")); key != "" {
			q = q.Where(`key = ?`, key)
		}
		if val := strings.TrimSpace(r.URL.Query().Get("value")); val != "" {
			q = q.Where(`value = ?`, val)
		}
		if needle := strings.TrimSpace(r.URL.Query().Get("q")); needle != "" {
			q = q.Where(`key ILIKE ?`, "%"+needle+"%")
		}

		var out []dto.TaintResponse
		if err := q.Model(&models.Taint{}).Order("created_at DESC").Find(&out).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// GetTaint godoc
//
//	@ID			GetTaint
//	@Summary	Get node taint by ID (org scoped)
//	@Tags		Taints
//	@Produce	json
//	@Param		X-Org-ID	header		string	false	"Organization UUID"
//	@Param		id			path		string	true	"Node Taint ID (UUID)"
//	@Success	200			{object}	dto.TaintResponse
//	@Failure	400			{string}	string	"invalid id"
//	@Failure	401			{string}	string	"Unauthorized"
//	@Failure	403			{string}	string	"organization required"
//	@Failure	404			{string}	string	"not found"
//	@Failure	500			{string}	string	"fetch failed"
//	@Router		/taints/{id} [get]
//	@Security	BearerAuth
//	@Security	OrgKeyAuth
//	@Security	OrgSecretAuth
func GetTaint(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		var out dto.TaintResponse
		if err := db.Model(&models.Taint{}).Where("id = ? AND organization_id = ?", id, orgID).First(&out).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "not_found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// CreateTaint godoc
//
//	@ID				CreateTaint
//	@Summary		Create node taint (org scoped)
//	@Description	Creates a taint.
//	@Tags			Taints
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string					false	"Organization UUID"
//	@Param			body		body		dto.CreateTaintRequest	true	"Taint payload"
//	@Success		201			{object}	dto.TaintResponse
//	@Failure		400			{string}	string	"invalid json / missing fields / invalid node_pool_ids"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"create failed"
//	@Router			/taints [post]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func CreateTaint(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		var req dto.CreateTaintRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		req.Key = strings.TrimSpace(req.Key)
		req.Value = strings.TrimSpace(req.Value)
		req.Effect = strings.TrimSpace(req.Effect)

		if req.Key == "" || req.Value == "" || req.Effect == "" {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "missing key/value/effect")
			return
		}

		if _, ok := allowedEffects[req.Effect]; !ok {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid effect")
			return
		}

		t := models.Taint{
			OrganizationID: orgID,
			Key:            req.Key,
			Value:          req.Value,
			Effect:         req.Effect,
		}
		if err := db.Create(&t).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := dto.TaintResponse{
			ID:             t.ID,
			Key:            t.Key,
			Value:          t.Value,
			Effect:         t.Effect,
			OrganizationID: t.OrganizationID,
			CreatedAt:      t.CreatedAt.UTC().Format(time.RFC3339),
			UpdatedAt:      t.UpdatedAt.UTC().Format(time.RFC3339),
		}
		utils.WriteJSON(w, http.StatusCreated, out)
	}
}

// UpdateTaint godoc
//
//	@ID				UpdateTaint
//	@Summary		Update node taint (org scoped)
//	@Description	Partially update taint fields.
//	@Tags			Taints
//	@Accept			json
//	@Produce		json
//	@Param			X-Org-ID	header		string					false	"Organization UUID"
//	@Param			id			path		string					true	"Node Taint ID (UUID)"
//	@Param			body		body		dto.UpdateTaintRequest	true	"Fields to update"
//	@Success		200			{object}	dto.TaintResponse
//	@Failure		400			{string}	string	"invalid id / invalid json"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		404			{string}	string	"not found"
//	@Failure		500			{string}	string	"update failed"
//	@Router			/taints/{id} [patch]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func UpdateTaint(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		var t models.Taint
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&t).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "not_found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		var req dto.UpdateTaintRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		next := t

		if req.Key != nil {
			next.Key = strings.TrimSpace(*req.Key)
		}
		if req.Value != nil {
			next.Value = strings.TrimSpace(*req.Value)
		}
		if req.Effect != nil {
			e := strings.TrimSpace(*req.Effect)
			if e == "" {
				utils.WriteError(w, http.StatusBadRequest, "bad_request", "missing effect")
				return
			}
			if _, ok := allowedEffects[e]; !ok {
				utils.WriteError(w, http.StatusBadRequest, "bad_request", "invalid effect")
				return
			}
			next.Effect = e
		}

		if err := db.Save(&next).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		out := dto.TaintResponse{
			ID:             next.ID,
			Key:            next.Key,
			Value:          next.Value,
			Effect:         next.Effect,
			OrganizationID: next.OrganizationID,
			CreatedAt:      next.CreatedAt.UTC().Format(time.RFC3339),
			UpdatedAt:      next.UpdatedAt.UTC().Format(time.RFC3339),
		}
		utils.WriteJSON(w, http.StatusOK, out)
	}
}

// DeleteTaint godoc
//
//	@ID				DeleteTaint
//	@Summary		Delete taint (org scoped)
//	@Description	Permanently deletes the taint.
//	@Tags			Taints
//	@Produce		json
//	@Param			X-Org-ID	header	string	false	"Organization UUID"
//	@Param			id			path	string	true	"Node Taint ID (UUID)"
//	@Success		204			"No Content"
//	@Failure		400			{string}	string	"invalid id"
//	@Failure		401			{string}	string	"Unauthorized"
//	@Failure		403			{string}	string	"organization required"
//	@Failure		500			{string}	string	"delete failed"
//	@Router			/taints/{id} [delete]
//	@Security		BearerAuth
//	@Security		OrgKeyAuth
//	@Security		OrgSecretAuth
func DeleteTaint(db *gorm.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
		if !ok {
			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
			return
		}

		id, err := uuid.Parse(chi.URLParam(r, "id"))
		if err != nil {
			utils.WriteError(w, http.StatusBadRequest, "bad_request", "bad request")
			return
		}

		var row models.Taint
		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&row).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				utils.WriteError(w, http.StatusNotFound, "not_found", "not_found")
				return
			}
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}

		if err := db.Delete(&row).Error; err != nil {
			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// --- Helpers ---
var allowedEffects = map[string]struct{}{
	"NoSchedule":       {},
	"PreferNoSchedule": {},
	"NoExecute":        {},
}
</file>

<file path="internal/handlers/version.go">
package handlers

import (
	"net/http"
	"runtime"
	"runtime/debug"
	"strconv"

	"github.com/glueops/autoglue/internal/utils"
	"github.com/glueops/autoglue/internal/version"
)

type VersionResponse struct {
	Version    string `json:"version"  example:"1.4.2"`
	Commit     string `json:"commit"   example:"a1b2c3d"`
	Built      string `json:"built"    example:"2025-11-08T12:34:56Z"`
	BuiltBy    string `json:"builtBy"  example:"ci"`
	Go         string `json:"go"     example:"go1.23.3"`
	GOOS       string `json:"goOS"   example:"linux"`
	GOARCH     string `json:"goArch" example:"amd64"`
	VCS        string `json:"vcs,omitempty"        example:"git"`
	Revision   string `json:"revision,omitempty"   example:"a1b2c3d4e5f6abcdef"`
	CommitTime string `json:"commitTime,omitempty" example:"2025-11-08T12:31:00Z"`
	Modified   *bool  `json:"modified,omitempty"   example:"false"`
}

// Version godoc
//
//	@Summary		Service version information
//	@Description	Returns build/runtime metadata for the running service.
//	@Tags			Meta
//	@ID				Version                 // operationId
//	@Produce		json
//	@Success		200	{object}	VersionResponse
//	@Router			/version [get]
func Version(w http.ResponseWriter, r *http.Request) {
	resp := VersionResponse{
		Version: version.Version,
		Commit:  version.Commit,
		Built:   version.Date,
		BuiltBy: version.BuiltBy,
		Go:      runtime.Version(),
		GOOS:    runtime.GOOS,
		GOARCH:  runtime.GOARCH,
	}

	if bi, ok := debug.ReadBuildInfo(); ok {
		for _, s := range bi.Settings {
			switch s.Key {
			case "vcs":
				resp.VCS = s.Value
			case "vcs.revision":
				resp.Revision = s.Value
			case "vcs.time":
				resp.CommitTime = s.Value
			case "vcs.modified":
				if b, err := strconv.ParseBool(s.Value); err == nil {
					resp.Modified = &b
				}
			}
		}
	}
	utils.WriteJSON(w, http.StatusOK, resp)
}
</file>

<file path="internal/keys/base64util.go">
package keys

import (
	"encoding/base64"
	"errors"
	"strings"
)

func decode32ByteKey(s string) ([]byte, error) {
	try := func(enc *base64.Encoding, v string) ([]byte, bool) {
		if b, err := enc.DecodeString(v); err == nil && len(b) == 32 {
			return b, true
		}
		return nil, false
	}

	// Try raw (no padding) variants first
	if b, ok := try(base64.RawURLEncoding, s); ok {
		return b, nil
	}
	if b, ok := try(base64.RawStdEncoding, s); ok {
		return b, nil
	}

	// Try padded variants (add padding if missing)
	pad := func(v string) string { return v + strings.Repeat("=", (4-len(v)%4)%4) }
	if b, ok := try(base64.URLEncoding, pad(s)); ok {
		return b, nil
	}
	if b, ok := try(base64.StdEncoding, pad(s)); ok {
		return b, nil
	}

	return nil, errors.New("key must be 32 bytes in base64/base64url")
}
</file>

<file path="internal/keys/export.go">
package keys

func Decrypt(encKeyB64, enc string) ([]byte, error) {
	return decryptAESGCM(encKeyB64, enc)
}
</file>

<file path="internal/keys/keys.go">
package keys

import (
	"bytes"
	"crypto/aes"
	"crypto/cipher"
	"crypto/ed25519"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"encoding/base64"
	"encoding/pem"
	"errors"
	"fmt"
	"time"

	"github.com/glueops/autoglue/internal/models"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

type GenOpts struct {
	Alg  string // "RS256"|"RS384"|"RS512"|"EdDSA"
	Bits int    // RSA bits (2048/3072/4096). ignored for EdDSA
	KID  string // optional; if empty we generate one
	NBF  *time.Time
	EXP  *time.Time
}

func GenerateAndStore(db *gorm.DB, encKeyB64 string, opts GenOpts) (*models.SigningKey, error) {
	if opts.KID == "" {
		opts.KID = uuid.NewString()
	}

	var pubPEM, privPEM []byte
	var alg = opts.Alg

	switch alg {
	case "RS256", "RS384", "RS512":
		if opts.Bits == 0 {
			opts.Bits = 3072
		}
		priv, err := rsa.GenerateKey(rand.Reader, opts.Bits)
		if err != nil {
			return nil, err
		}
		privDER := x509.MarshalPKCS1PrivateKey(priv)
		privPEM = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: privDER})

		pubDER := x509.MarshalPKCS1PublicKey(&priv.PublicKey)
		pubPEM = pem.EncodeToMemory(&pem.Block{Type: "RSA PUBLIC KEY", Bytes: pubDER})

	case "EdDSA":
		pub, priv, err := ed25519.GenerateKey(rand.Reader)
		if err != nil {
			return nil, err
		}
		privDER, err := x509.MarshalPKCS8PrivateKey(priv)
		if err != nil {
			return nil, err
		}
		privPEM = pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: privDER})

		pubDER, err := x509.MarshalPKIXPublicKey(pub)
		if err != nil {
			return nil, err
		}
		pubPEM = pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: pubDER})

	default:
		return nil, fmt.Errorf("unsupported alg: %s", alg)
	}

	privateOut := string(privPEM)
	if encKeyB64 != "" {
		enc, err := encryptAESGCM(encKeyB64, privPEM)
		if err != nil {
			return nil, err
		}
		privateOut = enc
	}

	rec := models.SigningKey{
		Kid:        opts.KID,
		Alg:        alg,
		Use:        "sig",
		IsActive:   true,
		PublicPEM:  string(pubPEM),
		PrivatePEM: privateOut,
		NotBefore:  opts.NBF,
		ExpiresAt:  opts.EXP,
	}
	if err := db.Create(&rec).Error; err != nil {
		return nil, err
	}
	return &rec, nil
}

func encryptAESGCM(b64 string, plaintext []byte) (string, error) {
	key, err := decode32ByteKey(b64)
	if err != nil {
		return "", err
	}
	if len(key) != 32 {
		return "", errors.New("JWT_PRIVATE_ENC_KEY must be 32 bytes (base64url)")
	}
	block, err := aes.NewCipher(key)
	if err != nil {
		return "", err
	}
	aead, err := cipher.NewGCM(block)
	if err != nil {
		return "", err
	}
	nonce := make([]byte, aead.NonceSize())
	if _, err = rand.Read(nonce); err != nil {
		return "", err
	}
	out := aead.Seal(nonce, nonce, plaintext, nil)
	return "enc:aesgcm:" + base64.RawStdEncoding.EncodeToString(out), nil
}

func decryptAESGCM(b64 string, enc string) ([]byte, error) {
	if !bytes.HasPrefix([]byte(enc), []byte("enc:aesgcm:")) {
		return nil, errors.New("not encrypted")
	}
	key, err := decode32ByteKey(b64)
	if err != nil {
		return nil, err
	}
	blob, err := base64.RawStdEncoding.DecodeString(enc[len("enc:aesgcm:"):])
	if err != nil {
		return nil, err
	}
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}
	aead, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}
	nonceSize := aead.NonceSize()
	if len(blob) < nonceSize {
		return nil, errors.New("ciphertext too short")
	}
	nonce, ct := blob[:nonceSize], blob[nonceSize:]
	return aead.Open(nil, nonce, ct, nil)
}
</file>

<file path="internal/mapper/cluster.go">
package mapper

import (
	"fmt"
	"time"

	"github.com/glueops/autoglue/internal/common"
	"github.com/glueops/autoglue/internal/handlers/dto"
	"github.com/glueops/autoglue/internal/models"
	"github.com/google/uuid"
)

func ClusterToDTO(c models.Cluster) dto.ClusterResponse {
	var bastion *dto.ServerResponse
	if c.BastionServer != nil {
		b := ServerToDTO(*c.BastionServer)
		bastion = &b
	}

	var captainDomain *dto.DomainResponse
	if c.CaptainDomainID != nil && c.CaptainDomain.ID != uuid.Nil {
		dr := DomainToDTO(c.CaptainDomain)
		captainDomain = &dr
	}

	var controlPlane *dto.RecordSetResponse
	if c.ControlPlaneRecordSet != nil {
		rr := RecordSetToDTO(*c.ControlPlaneRecordSet)
		controlPlane = &rr
	}

	var cfqdn *string
	if captainDomain != nil && controlPlane != nil {
		fq := fmt.Sprintf("%s.%s", controlPlane.Name, captainDomain.DomainName)
		cfqdn = &fq
	}

	var appsLB *dto.LoadBalancerResponse
	if c.AppsLoadBalancer != nil {
		lr := LoadBalancerToDTO(*c.AppsLoadBalancer)
		appsLB = &lr
	}

	var glueOpsLB *dto.LoadBalancerResponse
	if c.GlueOpsLoadBalancer != nil {
		lr := LoadBalancerToDTO(*c.GlueOpsLoadBalancer)
		glueOpsLB = &lr
	}

	nps := make([]dto.NodePoolResponse, 0, len(c.NodePools))
	for _, np := range c.NodePools {
		nps = append(nps, NodePoolToDTO(np))
	}

	return dto.ClusterResponse{
		ID:                    c.ID,
		Name:                  c.Name,
		CaptainDomain:         captainDomain,
		ControlPlaneRecordSet: controlPlane,
		ControlPlaneFQDN:      cfqdn,
		AppsLoadBalancer:      appsLB,
		GlueOpsLoadBalancer:   glueOpsLB,
		BastionServer:         bastion,
		Provider:              c.Provider,
		Region:                c.Region,
		Status:                c.Status,
		LastError:             c.LastError,
		RandomToken:           c.RandomToken,
		CertificateKey:        c.CertificateKey,
		NodePools:             nps,
		DockerImage:           c.DockerImage,
		DockerTag:             c.DockerTag,
		CreatedAt:             c.CreatedAt,
		UpdatedAt:             c.UpdatedAt,
	}
}

func NodePoolToDTO(np models.NodePool) dto.NodePoolResponse {
	labels := make([]dto.LabelResponse, 0, len(np.Labels))
	for _, l := range np.Labels {
		labels = append(labels, dto.LabelResponse{
			Key:   l.Key,
			Value: l.Value,
		})
	}

	annotations := make([]dto.AnnotationResponse, 0, len(np.Annotations))
	for _, a := range np.Annotations {
		annotations = append(annotations, dto.AnnotationResponse{
			Key:   a.Key,
			Value: a.Value,
		})
	}

	taints := make([]dto.TaintResponse, 0, len(np.Taints))
	for _, t := range np.Taints {
		taints = append(taints, dto.TaintResponse{
			Key:    t.Key,
			Value:  t.Value,
			Effect: t.Effect,
		})
	}

	servers := make([]dto.ServerResponse, 0, len(np.Servers))
	for _, s := range np.Servers {
		servers = append(servers, ServerToDTO(s))
	}

	return dto.NodePoolResponse{
		AuditFields: common.AuditFields{
			ID:             np.ID,
			OrganizationID: np.OrganizationID,
			CreatedAt:      np.CreatedAt,
			UpdatedAt:      np.UpdatedAt,
		},
		Name:        np.Name,
		Role:        dto.NodeRole(np.Role),
		Labels:      labels,
		Annotations: annotations,
		Taints:      taints,
		Servers:     servers,
	}
}

func ServerToDTO(s models.Server) dto.ServerResponse {
	return dto.ServerResponse{
		ID:               s.ID,
		Hostname:         s.Hostname,
		PrivateIPAddress: s.PrivateIPAddress,
		PublicIPAddress:  s.PublicIPAddress,
		Role:             s.Role,
		Status:           s.Status,
		SSHUser:          s.SSHUser,
		SshKeyID:         s.SshKeyID,
		CreatedAt:        s.CreatedAt.UTC().Format(time.RFC3339),
		UpdatedAt:        s.UpdatedAt.UTC().Format(time.RFC3339),
	}
}

func DomainToDTO(d models.Domain) dto.DomainResponse {
	return dto.DomainResponse{
		ID:             d.ID.String(),
		OrganizationID: d.OrganizationID.String(),
		DomainName:     d.DomainName,
		ZoneID:         d.ZoneID,
		Status:         d.Status,
		LastError:      d.LastError,
		CredentialID:   d.CredentialID.String(),
		CreatedAt:      d.CreatedAt.UTC().Format(time.RFC3339),
		UpdatedAt:      d.UpdatedAt.UTC().Format(time.RFC3339),
	}
}

func RecordSetToDTO(rs models.RecordSet) dto.RecordSetResponse {
	return dto.RecordSetResponse{
		ID:          rs.ID.String(),
		DomainID:    rs.DomainID.String(),
		Name:        rs.Name,
		Type:        rs.Type,
		TTL:         rs.TTL,
		Values:      []byte(rs.Values),
		Fingerprint: rs.Fingerprint,
		Status:      rs.Status,
		Owner:       rs.Owner,
		LastError:   rs.LastError,
		CreatedAt:   rs.CreatedAt.UTC().Format(time.RFC3339),
		UpdatedAt:   rs.UpdatedAt.UTC().Format(time.RFC3339),
	}
}

func LoadBalancerToDTO(lb models.LoadBalancer) dto.LoadBalancerResponse {
	return dto.LoadBalancerResponse{
		ID:               lb.ID,
		OrganizationID:   lb.OrganizationID,
		Name:             lb.Name,
		Kind:             lb.Kind,
		PublicIPAddress:  lb.PublicIPAddress,
		PrivateIPAddress: lb.PrivateIPAddress,
		CreatedAt:        lb.CreatedAt,
		UpdatedAt:        lb.UpdatedAt,
	}
}
</file>

<file path="internal/models/account.go">
package models

import (
	"time"

	"github.com/google/uuid"
	"gorm.io/datatypes"
)

type Account struct {
	// example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
	ID            uuid.UUID      `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id" format:"uuid"`
	UserID        uuid.UUID      `gorm:"index;not null" json:"user_id" format:"uuid"`
	User          User           `gorm:"foreignKey:UserID" json:"-"`
	Provider      string         `gorm:"not null" json:"provider"`
	Subject       string         `gorm:"not null" json:"subject"`
	Email         *string        `json:"email,omitempty"`
	EmailVerified bool           `gorm:"not null;default:false" json:"email_verified"`
	Profile       datatypes.JSON `gorm:"type:jsonb;not null;default:'{}'" json:"profile"`
	SecretHash    *string        `json:"-"`
	CreatedAt     time.Time      `gorm:"type:timestamptz;column:created_at;not null;default:now()" json:"created_at" format:"date-time"`
	UpdatedAt     time.Time      `gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at" format:"date-time"`
}
</file>

<file path="internal/models/action.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type Action struct {
	ID          uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id" format:"uuid"`
	Label       string    `gorm:"type:varchar(255);not null;uniqueIndex" json:"label"`
	Description string    `gorm:"type:text;not null" json:"description"`
	MakeTarget  string    `gorm:"type:varchar(255);not null;uniqueIndex" json:"make_target"`
	CreatedAt   time.Time `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()" format:"date-time"`
	UpdatedAt   time.Time `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" format:"date-time"`
}
</file>

<file path="internal/models/annotation.go">
package models

import (
	"github.com/glueops/autoglue/internal/common"
)

type Annotation struct {
	common.AuditFields `gorm:"embedded"`
	Organization       Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	Key                string       `gorm:"not null" json:"key"`
	Value              string       `gorm:"not null" json:"value"`
	NodePools          []NodePool   `gorm:"many2many:node_annotations;constraint:OnDelete:CASCADE" json:"node_pools,omitempty"`
}
</file>

<file path="internal/models/api_key.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type APIKey struct {
	ID          uuid.UUID  `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id" format:"uuid"`
	OrgID       *uuid.UUID `json:"org_id,omitempty" format:"uuid"`
	Scope       string     `gorm:"not null;default:''" json:"scope"`
	Purpose     string     `json:"purpose"`
	ClusterID   *uuid.UUID `json:"cluster_id,omitempty"`
	IsEphemeral bool       `json:"is_ephemeral"`
	Name        string     `gorm:"not null;default:''" json:"name"`
	KeyHash     string     `gorm:"uniqueIndex;not null" json:"-"`
	SecretHash  *string    `json:"-"`
	UserID      *uuid.UUID `json:"user_id,omitempty" format:"uuid"`
	ExpiresAt   *time.Time `json:"expires_at,omitempty" format:"date-time"`
	Revoked     bool       `gorm:"not null;default:false" json:"revoked"`
	Prefix      *string    `json:"prefix,omitempty"`
	LastUsedAt  *time.Time `json:"last_used_at,omitempty" format:"date-time"`
	CreatedAt   time.Time  `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()" format:"date-time"`
	UpdatedAt   time.Time  `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" format:"date-time"`
}
</file>

<file path="internal/models/backup.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type Backup struct {
	ID             uuid.UUID    `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
	OrganizationID uuid.UUID    `gorm:"type:uuid;not null;index;uniqueIndex:uniq_org_credential,priority:1"`
	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	Enabled        bool         `gorm:"not null;default:false" json:"enabled"`
	CredentialID   uuid.UUID    `gorm:"type:uuid;not null;uniqueIndex:uniq_org_credential,priority:2" json:"credential_id"`
	Credential     Credential   `gorm:"foreignKey:CredentialID" json:"credential,omitempty"`
	CreatedAt      time.Time    `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
	UpdatedAt      time.Time    `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
}
</file>

<file path="internal/models/cluster_runs.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

const (
	ClusterRunStatusQueued   = "queued"
	ClusterRunStatusRunning  = "running"
	ClusterRunStatusSuccess  = "success"
	ClusterRunStatusFailed   = "failed"
	ClusterRunStatusCanceled = "canceled"
)

type ClusterRun struct {
	ID             uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id" format:"uuid"`
	OrganizationID uuid.UUID `json:"organization_id" gorm:"type:uuid;index"`
	ClusterID      uuid.UUID `json:"cluster_id" gorm:"type:uuid;index"`
	Action         string    `json:"action" gorm:"type:text;not null"`
	Status         string    `json:"status" gorm:"type:text;not null"`
	Error          string    `json:"error" gorm:"type:text;not null"`
	CreatedAt      time.Time `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()" format:"date-time"`
	UpdatedAt      time.Time `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" format:"date-time"`
	FinishedAt     time.Time `json:"finished_at,omitempty" gorm:"type:timestamptz" format:"date-time"`
}
</file>

<file path="internal/models/cluster.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

const (
	ClusterStatusPrePending    = "pre_pending" // needs validation
	ClusterStatusIncomplete    = "incomplete"  // invalid/missing shape
	ClusterStatusPending       = "pending"     // valid shape, waiting for provisioning
	ClusterStatusProvisioning  = "provisioning"
	ClusterStatusReady         = "ready"
	ClusterStatusFailed        = "failed" // provisioning/runtime failure
	ClusterStatusBootstrapping = "bootstrapping"
)

type Cluster struct {
	ID                      uuid.UUID     `gorm:"type:uuid;default:gen_random_uuid();primaryKey" json:"id"`
	OrganizationID          uuid.UUID     `gorm:"type:uuid;not null" json:"organization_id"`
	Organization            Organization  `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	Name                    string        `gorm:"not null" json:"name"`
	Provider                string        `json:"provider"`
	Region                  string        `json:"region"`
	Status                  string        `gorm:"type:varchar(20);not null;default:'pre_pending'" json:"status"`
	LastError               string        `gorm:"type:text;not null;default:''" json:"last_error"`
	CaptainDomainID         *uuid.UUID    `gorm:"type:uuid" json:"captain_domain_id"`
	CaptainDomain           Domain        `gorm:"foreignKey:CaptainDomainID" json:"captain_domain"`
	ControlPlaneRecordSetID *uuid.UUID    `gorm:"type:uuid" json:"control_plane_record_set_id,omitempty"`
	ControlPlaneRecordSet   *RecordSet    `gorm:"foreignKey:ControlPlaneRecordSetID" json:"control_plane_record_set,omitempty"`
	AppsLoadBalancerID      *uuid.UUID    `gorm:"type:uuid" json:"apps_load_balancer_id,omitempty"`
	AppsLoadBalancer        *LoadBalancer `gorm:"foreignKey:AppsLoadBalancerID" json:"apps_load_balancer,omitempty"`
	GlueOpsLoadBalancerID   *uuid.UUID    `gorm:"type:uuid" json:"glueops_load_balancer_id,omitempty"`
	GlueOpsLoadBalancer     *LoadBalancer `gorm:"foreignKey:GlueOpsLoadBalancerID" json:"glueops_load_balancer,omitempty"`
	BastionServerID         *uuid.UUID    `gorm:"type:uuid" json:"bastion_server_id,omitempty"`
	BastionServer           *Server       `gorm:"foreignKey:BastionServerID" json:"bastion_server,omitempty"`
	NodePools               []NodePool    `gorm:"many2many:cluster_node_pools;constraint:OnDelete:CASCADE" json:"node_pools,omitempty"`
	RandomToken             string        `json:"random_token"`
	CertificateKey          string        `json:"certificate_key"`
	EncryptedKubeconfig     string        `gorm:"type:text" json:"-"`
	KubeIV                  string        `json:"-"`
	KubeTag                 string        `json:"-"`
	DockerImage             string        `json:"docker_image"`
	DockerTag               string        `json:"docker_tag"`
	CreatedAt               time.Time     `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
	UpdatedAt               time.Time     `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
}
</file>

<file path="internal/models/credential.go">
package models

import (
	"time"

	"github.com/google/uuid"
	"gorm.io/datatypes"
)

type Credential struct {
	ID               uuid.UUID      `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
	OrganizationID   uuid.UUID      `gorm:"type:uuid;not null;index;uniqueIndex:uniq_org_provider_scopekind_scope,priority:1" json:"organization_id"`
	Organization     Organization   `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	Provider         string         `gorm:"type:varchar(50);not null;uniqueIndex:uniq_org_provider_scopekind_scope,priority:2;index:idx_provider_kind"`
	Kind             string         `gorm:"type:varchar(50);not null;index:idx_provider_kind;index:idx_kind_scope"`
	ScopeKind        string         `gorm:"type:varchar(20);not null;uniqueIndex:uniq_org_provider_scopekind_scope,priority:3"`
	Scope            datatypes.JSON `gorm:"type:jsonb;not null;default:'{}';index:idx_kind_scope"`
	ScopeFingerprint string         `gorm:"type:char(64);not null;uniqueIndex:uniq_org_provider_scopekind_scope,priority:4;index"`
	SchemaVersion    int            `gorm:"not null;default:1"`
	Name             string         `gorm:"type:varchar(100);not null;default:''"`
	ScopeVersion     int            `gorm:"not null;default:1"`
	AccountID        string         `gorm:"type:varchar(32)"`
	Region           string         `gorm:"type:varchar(32)"`
	EncryptedData    string         `gorm:"not null"`
	IV               string         `gorm:"not null"`
	Tag              string         `gorm:"not null"`
	CreatedAt        time.Time      `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()" format:"date-time"`
	UpdatedAt        time.Time      `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" format:"date-time"`
}
</file>

<file path="internal/models/domain.go">
package models

import (
	"time"

	"github.com/google/uuid"
	"gorm.io/datatypes"
)

type Domain struct {
	ID             uuid.UUID    `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
	OrganizationID uuid.UUID    `gorm:"type:uuid;not null;index;uniqueIndex:uniq_org_domain,priority:1"`
	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	DomainName     string       `gorm:"type:varchar(253);not null;uniqueIndex:uniq_org_domain,priority:2"`
	ZoneID         string       `gorm:"type:varchar(128);not null;default:''"`       // backfilled for R53 (e.g. "/hostedzone/Z123...")
	Status         string       `gorm:"type:varchar(20);not null;default:'pending'"` // pending, provisioning, ready, failed
	LastError      string       `gorm:"type:text;not null;default:''"`
	CredentialID   uuid.UUID    `gorm:"type:uuid;not null" json:"credential_id"`
	Credential     Credential   `gorm:"foreignKey:CredentialID" json:"credential,omitempty"`
	CreatedAt      time.Time    `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
	UpdatedAt      time.Time    `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
}

type RecordSet struct {
	ID          uuid.UUID      `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
	DomainID    uuid.UUID      `gorm:"type:uuid;not null;index"`
	Domain      Domain         `gorm:"foreignKey:DomainID;constraint:OnDelete:CASCADE"`
	Name        string         `gorm:"type:varchar(253);not null"`      // e.g. "endpoint" (relative to DomainName)
	Type        string         `gorm:"type:varchar(10);not null;index"` // A, AAAA, CNAME, TXT, MX, SRV, NS, CAA...
	TTL         *int           `gorm:""`                                // nil for alias targets (Route 53 ignores TTL for alias)
	Values      datatypes.JSON `gorm:"type:jsonb;not null;default:'[]'"`
	Fingerprint string         `gorm:"type:char(64);not null;index"` // sha256 of canonical(name,type,ttl,values|alias)
	Status      string         `gorm:"type:varchar(20);not null;default:'pending'"`
	Owner       string         `gorm:"type:varchar(16);not null;default:'unknown'"` // 'autoglue' | 'external' | 'unknown'
	LastError   string         `gorm:"type:text;not null;default:''"`
	_           struct{}       `gorm:"uniqueIndex:uniq_domain_name_type,priority:1"` // tag holder
	_           struct{}       `gorm:"uniqueIndex:uniq_domain_name_type,priority:2"`
	_           struct{}       `gorm:"uniqueIndex:uniq_domain_name_type,priority:3"`
	CreatedAt   time.Time      `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
	UpdatedAt   time.Time      `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
}
</file>

<file path="internal/models/job.go">
package models

import (
	"time"

	"gorm.io/datatypes"
)

type Job struct {
	ID            string         `gorm:"type:varchar;primaryKey" json:"id"` // no default; supply from app
	QueueName     string         `gorm:"type:varchar;not null" json:"queue_name"`
	Status        string         `gorm:"type:varchar;not null" json:"status"`
	Arguments     datatypes.JSON `gorm:"type:jsonb;not null;default:'{}'"`
	Result        datatypes.JSON `gorm:"type:jsonb;not null;default:'{}'"`
	LastError     *string        `gorm:"type:varchar"`
	RetryCount    int            `gorm:"not null;default:0"`
	MaxRetry      int            `gorm:"not null;default:0"`
	RetryInterval int            `gorm:"not null;default:0"`
	ScheduledAt   time.Time      `gorm:"type:timestamptz;default:now();index"`
	StartedAt     *time.Time     `gorm:"type:timestamptz;index"`
	CreatedAt     time.Time      `gorm:"type:timestamptz;column:created_at;not null;default:now()"`
	UpdatedAt     time.Time      `gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
}
</file>

<file path="internal/models/label.go">
package models

import (
	"github.com/glueops/autoglue/internal/common"
)

type Label struct {
	common.AuditFields
	Organization Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	Key          string       `gorm:"not null" json:"key"`
	Value        string       `gorm:"not null" json:"value"`
	NodePools    []NodePool   `gorm:"many2many:node_labels;constraint:OnDelete:CASCADE" json:"node_pools,omitempty"`
}
</file>

<file path="internal/models/load_balancer.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type LoadBalancer struct {
	ID               uuid.UUID    `json:"id" gorm:"primaryKey;type:uuid;default:gen_random_uuid()"`
	OrganizationID   uuid.UUID    `json:"organization_id" gorm:"type:uuid;index"`
	Organization     Organization `json:"organization" gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE"`
	Name             string       `json:"name" gorm:"not null"`
	Kind             string       `json:"kind" gorm:"not null"`
	PublicIPAddress  string       `json:"public_ip_address" gorm:"not null"`
	PrivateIPAddress string       `json:"private_ip_address" gorm:"not null"`
	CreatedAt        time.Time    `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
	UpdatedAt        time.Time    `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
}
</file>

<file path="internal/models/master_key.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type MasterKey struct {
	ID        uuid.UUID `gorm:"type:uuid;default:gen_random_uuid();primaryKey" json:"id"`
	Key       string    `gorm:"not null"`
	IsActive  bool      `gorm:"default:true"`
	CreatedAt time.Time `gorm:"column:created_at;not null;default:now()" json:"created_at"`
	UpdatedAt time.Time `gorm:"autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at"`
}
</file>

<file path="internal/models/membership.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type Membership struct {
	ID             uuid.UUID    `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id" format:"uuid"`
	UserID         uuid.UUID    `gorm:"index;not null" json:"user_id" format:"uuid"`
	User           User         `gorm:"foreignKey:UserID" json:"-"`
	OrganizationID uuid.UUID    `gorm:"index;not null" json:"org_id" format:"uuid"`
	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"-"`
	Role           string       `gorm:"not null;default:'member'" json:"role"`
	CreatedAt      time.Time    `gorm:"not null;default:now()" json:"created_at" format:"date-time"`
	UpdatedAt      time.Time    `gorm:"not null;default:now()" json:"updated_at" format:"date-time"`
}
</file>

<file path="internal/models/node_pool.go">
package models

import (
	"github.com/glueops/autoglue/internal/common"
)

type NodePool struct {
	common.AuditFields
	Organization Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	Name         string       `gorm:"not null" json:"name"`
	Servers      []Server     `gorm:"many2many:node_servers;constraint:OnDelete:CASCADE" json:"servers,omitempty"`
	Annotations  []Annotation `gorm:"many2many:node_annotations;constraint:OnDelete:CASCADE" json:"annotations,omitempty"`
	Labels       []Label      `gorm:"many2many:node_labels;constraint:OnDelete:CASCADE" json:"labels,omitempty"`
	Taints       []Taint      `gorm:"many2many:node_taints;constraint:OnDelete:CASCADE" json:"taints,omitempty"`
	Clusters     []Cluster    `gorm:"many2many:cluster_node_pools;constraint:OnDelete:CASCADE" json:"clusters,omitempty"`
	//Topology  string    `gorm:"not null,default:'stacked'" json:"topology,omitempty"` // stacked or external
	Role string `gorm:"not null,default:'worker'" json:"role,omitempty"` // master, worker, or etcd (etcd only if topology = external
}
</file>

<file path="internal/models/organization-key.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type OrganizationKey struct {
	ID             uuid.UUID    `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
	OrganizationID uuid.UUID    `gorm:"type:uuid;not null" json:"organization_id"`
	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	MasterKeyID    uuid.UUID    `gorm:"type:uuid;not null"`
	MasterKey      MasterKey    `gorm:"foreignKey:MasterKeyID;constraint:OnDelete:CASCADE" json:"master_key"`
	EncryptedKey   string       `gorm:"not null"`
	IV             string       `gorm:"not null"`
	Tag            string       `gorm:"not null"`
	CreatedAt      time.Time    `gorm:"not null;default:now()" json:"created_at" format:"date-time"`
	UpdatedAt      time.Time    `gorm:"not null;default:now()" json:"updated_at" format:"date-time"`
}
</file>

<file path="internal/models/organization.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type Organization struct {
	// example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
	ID        uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id" format:"uuid"`
	Name      string    `gorm:"not null" json:"name"`
	Domain    *string   `gorm:"index" json:"domain"`
	CreatedAt time.Time `gorm:"column:created_at;not null;default:now()" json:"created_at" format:"date-time"`
	UpdatedAt time.Time `gorm:"autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at" format:"date-time"`
}
</file>

<file path="internal/models/refresh_token.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type RefreshToken struct {
	ID        uuid.UUID  `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	UserID    uuid.UUID  `gorm:"index;not null" json:"user_id"`
	FamilyID  uuid.UUID  `gorm:"type:uuid;index;not null" json:"family_id"`
	TokenHash string     `gorm:"uniqueIndex;not null" json:"-"`
	ExpiresAt time.Time  `gorm:"not null" json:"expires_at"`
	RevokedAt *time.Time `json:"revoked_at"`
	CreatedAt time.Time  `gorm:"not null;default:now()" json:"created_at"`
}
</file>

<file path="internal/models/server.go">
package models

import (
	"errors"
	"strings"
	"time"

	"github.com/google/uuid"
	"gorm.io/gorm"
)

type Server struct {
	ID               uuid.UUID    `gorm:"type:uuid;default:gen_random_uuid();primaryKey" json:"id"`
	OrganizationID   uuid.UUID    `gorm:"type:uuid;not null" json:"organization_id"`
	Organization     Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	Hostname         string       `json:"hostname"`
	PublicIPAddress  *string      `json:"public_ip_address,omitempty"`
	PrivateIPAddress string       `gorm:"not null" json:"private_ip_address"`
	SSHUser          string       `gorm:"not null" json:"ssh_user"`
	SshKeyID         uuid.UUID    `gorm:"type:uuid;not null" json:"ssh_key_id"`
	SshKey           SshKey       `gorm:"foreignKey:SshKeyID" json:"ssh_key"`
	Role             string       `gorm:"not null" json:"role" enums:"master,worker,bastion"`                           // e.g., "master", "worker", "bastion"
	Status           string       `gorm:"default:'pending'" json:"status" enums:"pending, provisioning, ready, failed"` // pending, provisioning, ready, failed
	NodePools        []NodePool   `gorm:"many2many:node_servers;constraint:OnDelete:CASCADE" json:"node_pools,omitempty"`
	SSHHostKey       string       `gorm:"column:ssh_host_key"`
	SSHHostKeyAlgo   string       `gorm:"column:ssh_host_key_algo"`
	CreatedAt        time.Time    `gorm:"not null;default:now()" json:"created_at" format:"date-time"`
	UpdatedAt        time.Time    `gorm:"not null;default:now()" json:"updated_at" format:"date-time"`
}

func (s *Server) BeforeSave(tx *gorm.DB) error {
	role := strings.ToLower(strings.TrimSpace(s.Role))
	if role == "bastion" {
		if s.PublicIPAddress == nil || strings.TrimSpace(*s.PublicIPAddress) == "" {
			return errors.New("public_ip_address is required for role=bastion")
		}
	}
	return nil
}
</file>

<file path="internal/models/signing_key.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type SigningKey struct {
	ID          uuid.UUID  `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	Kid         string     `gorm:"uniqueIndex;not null" json:"kid"`   // key id (header 'kid')
	Alg         string     `gorm:"not null" json:"alg"`               // RS256|RS384|RS512|EdDSA
	Use         string     `gorm:"not null;default:'sig'" json:"use"` // "sig"
	IsActive    bool       `gorm:"not null;default:true" json:"is_active"`
	PublicPEM   string     `gorm:"type:text;not null" json:"-"`
	PrivatePEM  string     `gorm:"type:text;not null" json:"-"`
	NotBefore   *time.Time `json:"-"`
	ExpiresAt   *time.Time `json:"-"`
	CreatedAt   time.Time  `gorm:"not null;default:now()" json:"created_at"`
	UpdatedAt   time.Time  `gorm:"not null;default:now()" json:"updated_at"`
	RotatedFrom *uuid.UUID `json:"-"` // previous key id, if any
}
</file>

<file path="internal/models/ssh-key.go">
package models

import (
	"github.com/glueops/autoglue/internal/common"
)

type SshKey struct {
	common.AuditFields
	Organization        Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	Name                string       `gorm:"not null" json:"name"`
	PublicKey           string       `gorm:"not null"`
	EncryptedPrivateKey string       `gorm:"not null"`
	PrivateIV           string       `gorm:"not null"`
	PrivateTag          string       `gorm:"not null"`
	Fingerprint         string       `gorm:"not null;index" json:"fingerprint"`
}
</file>

<file path="internal/models/taint.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type Taint struct {
	ID             uuid.UUID    `gorm:"type:uuid;default:gen_random_uuid();primaryKey" json:"id"`
	OrganizationID uuid.UUID    `gorm:"type:uuid;not null" json:"organization_id"`
	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
	Key            string       `gorm:"not null" json:"key"`
	Value          string       `gorm:"not null" json:"value"`
	Effect         string       `gorm:"not null" json:"effect"`
	NodePools      []NodePool   `gorm:"many2many:node_taints;constraint:OnDelete:CASCADE" json:"servers,omitempty"`
	CreatedAt      time.Time    `gorm:"column:created_at;not null;default:now()" json:"created_at" format:"date-time"`
	UpdatedAt      time.Time    `gorm:"autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at" format:"date-time"`
}
</file>

<file path="internal/models/user_email.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type UserEmail struct {
	// example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
	ID         uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id" format:"uuid"`
	UserID     uuid.UUID `gorm:"index;not null" json:"user_id" format:"uuid"`
	User       User      `gorm:"foreignKey:UserID" json:"user"`
	Email      string    `gorm:"not null" json:"email"`
	IsVerified bool      `gorm:"not null;default:false" json:"is_verified"`
	IsPrimary  bool      `gorm:"not null;default:false" json:"is_primary"`
	CreatedAt  time.Time `gorm:"column:created_at;not null;default:now()" json:"created_at" format:"date-time"`
	UpdatedAt  time.Time `gorm:"autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at" format:"date-time"`
}
</file>

<file path="internal/models/user.go">
package models

import (
	"time"

	"github.com/google/uuid"
)

type User struct {
	// example: 3fa85f64-5717-4562-b3fc-2c963f66afa6
	ID           uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id" format:"uuid"`
	DisplayName  *string   `json:"display_name,omitempty"`
	PrimaryEmail *string   `json:"primary_email,omitempty"`
	AvatarURL    *string   `json:"avatar_url,omitempty"`
	IsDisabled   bool      `json:"is_disabled"`
	IsAdmin      bool      `gorm:"default:false" json:"is_admin"`
	CreatedAt    time.Time `gorm:"column:created_at;not null;default:now()" json:"created_at" format:"date-time"`
	UpdatedAt    time.Time `gorm:"autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at" format:"date-time"`
}
</file>

<file path="internal/testutil/pgtest/pgtest.go">
package pgtest

import (
	"fmt"
	"log"
	"sync"
	"testing"
	"time"

	embeddedpostgres "github.com/fergusstrange/embedded-postgres"
	"github.com/glueops/autoglue/internal/db"
	"github.com/glueops/autoglue/internal/models"
	"gorm.io/driver/postgres"
	"gorm.io/gorm"
)

var (
	once    sync.Once
	epg     *embeddedpostgres.EmbeddedPostgres
	gdb     *gorm.DB
	initErr error
	dsn     string
)

// initDB is called once via sync.Once. It starts embedded Postgres,
// opens a GORM connection and runs the same migrations as NewRuntime.
func initDB() {
	const port uint32 = 55432

	cfg := embeddedpostgres.
		DefaultConfig().
		Database("autoglue_test").
		Username("autoglue").
		Password("autoglue").
		Port(port).
		StartTimeout(30 * time.Second)

	epg = embeddedpostgres.NewDatabase(cfg)
	if err := epg.Start(); err != nil {
		initErr = fmt.Errorf("start embedded postgres: %w", err)
		return
	}

	dsn = fmt.Sprintf(
		"host=127.0.0.1 port=%d user=%s password=%s dbname=%s sslmode=disable",
		port,
		"autoglue",
		"autoglue",
		"autoglue_test",
	)

	dbConn, err := gorm.Open(postgres.Open(dsn), &gorm.Config{})
	if err != nil {
		initErr = fmt.Errorf("open gorm: %w", err)
		return
	}

	// Use the same model list as app.NewRuntime so schema matches prod
	if err := db.Run(
		dbConn,
		&models.Job{},
		&models.MasterKey{},
		&models.SigningKey{},
		&models.User{},
		&models.Organization{},
		&models.Account{},
		&models.Membership{},
		&models.APIKey{},
		&models.UserEmail{},
		&models.RefreshToken{},
		&models.OrganizationKey{},
		&models.SshKey{},
		&models.Server{},
		&models.Taint{},
		&models.Label{},
		&models.Annotation{},
		&models.NodePool{},
		&models.Cluster{},
		&models.Credential{},
		&models.Domain{},
		&models.RecordSet{},
	); err != nil {
		initErr = fmt.Errorf("migrate: %w", err)
		return
	}

	gdb = dbConn
}

// DB returns a lazily-initialized *gorm.DB backed by embedded Postgres.
//
// Call this from any test that needs a real DB. If init fails, the test
// will fail immediately with a clear message.
func DB(t *testing.T) *gorm.DB {
	t.Helper()
	once.Do(initDB)
	if initErr != nil {
		t.Fatalf("failed to init embedded postgres: %v", initErr)
	}
	return gdb
}

// URL returns the DSN for the embedded Postgres instance, useful for code
// that expects a DB URL (e.g. bg.NewJobs).
func URL(t *testing.T) string {
	t.Helper()
	DB(t) // ensure initialized
	return dsn
}

// Stop stops the embedded Postgres process. Call from TestMain in at
// least one package, or let the OS clean it up on process exit.
func Stop() {
	if epg != nil {
		if err := epg.Stop(); err != nil {
			log.Printf("stop embedded postgres: %v", err)
		}
	}
}
</file>

<file path="internal/utils/crypto.go">
package utils

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"errors"
	"fmt"
	"io"
)

var (
	ErrNoActiveMasterKey   = errors.New("no active master key found")
	ErrInvalidOrgID        = errors.New("invalid organization ID")
	ErrCredentialNotFound  = errors.New("credential not found")
	ErrInvalidMasterKeyLen = errors.New("invalid master key length")
)

func randomBytes(n int) ([]byte, error) {
	b := make([]byte, n)
	if _, err := io.ReadFull(rand.Reader, b); err != nil {
		return nil, fmt.Errorf("rand: %w", err)
	}
	return b, nil
}

func encryptAESGCM(plaintext, key []byte) (cipherNoTag, iv, tag []byte, _ error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, nil, nil, fmt.Errorf("cipher: %w", err)
	}

	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, nil, nil, fmt.Errorf("gcm: %w", err)
	}
	if gcm.NonceSize() != 12 {
		return nil, nil, nil, fmt.Errorf("unexpected nonce size: %d", gcm.NonceSize())
	}

	iv, err = randomBytes(gcm.NonceSize())
	if err != nil {
		return nil, nil, nil, err
	}

	// Go’s GCM returns ciphertext||tag, with 16-byte tag.
	cipherWithTag := gcm.Seal(nil, iv, plaintext, nil)
	if len(cipherWithTag) < 16 {
		return nil, nil, nil, errors.New("ciphertext too short")
	}
	tagLen := 16
	cipherNoTag = cipherWithTag[:len(cipherWithTag)-tagLen]
	tag = cipherWithTag[len(cipherWithTag)-tagLen:]
	return cipherNoTag, iv, tag, nil
}

func decryptAESGCM(cipherNoTag, key, iv, tag []byte) ([]byte, error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, fmt.Errorf("cipher: %w", err)
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, fmt.Errorf("gcm: %w", err)
	}
	if gcm.NonceSize() != len(iv) {
		return nil, fmt.Errorf("bad nonce size: %d", len(iv))
	}
	// Reattach tag
	cipherWithTag := append(append([]byte{}, cipherNoTag...), tag...)
	plain, err := gcm.Open(nil, iv, cipherWithTag, nil)
	if err != nil {
		return nil, fmt.Errorf("gcm open: %w", err)
	}
	return plain, nil
}

func EncodeB64(b []byte) string {
	return base64.StdEncoding.EncodeToString(b)
}

func DecodeB64(s string) ([]byte, error) {
	return base64.StdEncoding.DecodeString(s)
}
</file>

<file path="internal/utils/helpers.go">
package utils

import (
	"encoding/json"
	"net/http"
)

// ErrorResponse is a simple, reusable error payload.
// swagger:model ErrorResponse
type ErrorResponse struct {
	// A machine-readable error code, e.g. "validation_error"
	// example: validation_error
	Code string `json:"code"`
	// Human-readable message
	// example: slug is required
	Message string `json:"message"`
}

func WriteJSON(w http.ResponseWriter, status int, v any) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(v)
}

func WriteError(w http.ResponseWriter, status int, code, msg string) {
	WriteJSON(w, status, ErrorResponse{Code: code, Message: msg})
}
</file>

<file path="internal/utils/keys.go">
package utils

import (
	"encoding/base64"
	"errors"
	"fmt"

	"github.com/glueops/autoglue/internal/models"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

func getMasterKey(db *gorm.DB) ([]byte, error) {
	var mk models.MasterKey
	if err := db.Where("is_active = ?", true).Order("created_at DESC").First(&mk).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return nil, ErrNoActiveMasterKey
		}
		return nil, fmt.Errorf("querying master key: %w", err)
	}

	keyBytes, err := base64.StdEncoding.DecodeString(mk.Key)
	if err != nil {
		return nil, fmt.Errorf("decoding master key: %w", err)
	}
	if len(keyBytes) != 32 {
		return nil, fmt.Errorf("%w: got %d, want 32", ErrInvalidMasterKeyLen, len(keyBytes))
	}
	return keyBytes, nil
}

func getOrCreateTenantKey(orgID string, db *gorm.DB) ([]byte, error) {
	var orgKey models.OrganizationKey
	err := db.Where("organization_id = ?", orgID).First(&orgKey).Error
	if err == nil {
		encKeyB64 := orgKey.EncryptedKey
		ivB64 := orgKey.IV
		tagB64 := orgKey.Tag

		encryptedKey, err := DecodeB64(encKeyB64)
		if err != nil {
			return nil, fmt.Errorf("decode enc key: %w", err)
		}

		iv, err := DecodeB64(ivB64)
		if err != nil {
			return nil, fmt.Errorf("decode iv: %w", err)
		}

		tag, err := DecodeB64(tagB64)
		if err != nil {
			return nil, fmt.Errorf("decode tag: %w", err)
		}

		masterKey, err := getMasterKey(db)
		if err != nil {
			return nil, err
		}

		return decryptAESGCM(encryptedKey, masterKey, iv, tag)
	}

	if !errors.Is(err, gorm.ErrRecordNotFound) {
		return nil, err
	}

	// Create new tenant key and wrap with the current master key
	orgUUID, err := uuid.Parse(orgID)
	if err != nil {
		return nil, fmt.Errorf("%w: %v", ErrInvalidOrgID, err)
	}

	tenantKey, err := randomBytes(32)
	if err != nil {
		return nil, fmt.Errorf("tenant key gen: %w", err)
	}

	masterKey, err := getMasterKey(db)
	if err != nil {
		return nil, err
	}

	encrypted, iv, tag, err := encryptAESGCM(tenantKey, masterKey)
	if err != nil {
		return nil, fmt.Errorf("wrap tenant key: %w", err)
	}

	var mk models.MasterKey
	if err := db.Where("is_active = ?", true).Order("created_at DESC").First(&mk).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return nil, ErrNoActiveMasterKey
		}
		return nil, fmt.Errorf("querying master key: %w", err)
	}

	orgKey = models.OrganizationKey{
		OrganizationID: orgUUID,
		MasterKeyID:    mk.ID,
		EncryptedKey:   EncodeB64(encrypted),
		IV:             EncodeB64(iv),
		Tag:            EncodeB64(tag),
	}
	if err := db.Create(&orgKey).Error; err != nil {
		return nil, fmt.Errorf("persist org key: %w", err)
	}
	return tenantKey, nil
}
</file>

<file path="internal/utils/org-crypto.go">
package utils

import (
	"fmt"

	"github.com/google/uuid"
	"gorm.io/gorm"
)

func EncryptForOrg(orgID uuid.UUID, plaintext []byte, db *gorm.DB) (cipherB64, ivB64, tagB64 string, err error) {
	tenantKey, err := getOrCreateTenantKey(orgID.String(), db)
	if err != nil {
		return "", "", "", err
	}
	ct, iv, tag, err := encryptAESGCM(plaintext, tenantKey)
	if err != nil {
		return "", "", "", err
	}
	return EncodeB64(ct), EncodeB64(iv), EncodeB64(tag), nil
}

func DecryptForOrg(orgID uuid.UUID, cipherB64, ivB64, tagB64 string, db *gorm.DB) (string, error) {
	tenantKey, err := getOrCreateTenantKey(orgID.String(), db)
	if err != nil {
		return "", err
	}
	ct, err := DecodeB64(cipherB64)
	if err != nil {
		return "", fmt.Errorf("decode cipher: %w", err)
	}
	iv, err := DecodeB64(ivB64)
	if err != nil {
		return "", fmt.Errorf("decode iv: %w", err)
	}
	tag, err := DecodeB64(tagB64)
	if err != nil {
		return "", fmt.Errorf("decode tag: %w", err)
	}
	plain, err := decryptAESGCM(ct, tenantKey, iv, tag)
	if err != nil {
		return "", err
	}
	return string(plain), nil
}
</file>

<file path="internal/version/version.go">
package version

import (
	"fmt"
	"runtime"
	"runtime/debug"
)

var (
	Version = "dev"
	Commit  = "none"
	Date    = "unknown"
	BuiltBy = "local"
)

func Info() string {
	v := fmt.Sprintf("Version: %s\nCommit: %s\nBuilt: %s\nBuiltBy: %s\nGo: %s %s/%s",
		Version, Commit, Date, BuiltBy, runtime.Version(), runtime.GOOS, runtime.GOARCH)

	// Include VCS info from embedded build metadata (if available)
	if bi, ok := debug.ReadBuildInfo(); ok {
		for _, s := range bi.Settings {
			switch s.Key {
			case "vcs":
				v += fmt.Sprintf("\nVCS: %s", s.Value)
			case "vcs.revision":
				v += fmt.Sprintf("\nRevision: %s", s.Value)
			case "vcs.time":
				v += fmt.Sprintf("\nCommitTime: %s", s.Value)
			case "vcs.modified":
				v += fmt.Sprintf("\nModified: %s", s.Value)
			}
		}
	}
	return v
}
</file>

<file path="internal/web/devproxy.go">
package web

import (
	"net/http"
	"net/http/httputil"
	"net/url"
)

func DevProxy(target string) (http.Handler, error) {
	u, err := url.Parse(target)
	if err != nil {
		return nil, err
	}
	p := httputil.NewSingleHostReverseProxy(u)
	return p, nil
}
</file>

<file path="internal/web/static.go">
package web

import (
	"embed"
	"io"
	"io/fs"
	"net/http"
	"path"
	"path/filepath"
	"strings"
	"time"
)

// NOTE: Vite outputs to web/dist with assets in dist/assets.
// If you add more nested folders in the future, include them here too.

//go:embed dist
var distFS embed.FS

// spaFileSystem serves embedded dist/ files with SPA fallback to index.html
type spaFileSystem struct {
	fs fs.FS
}

func (s spaFileSystem) Open(name string) (fs.File, error) {
	// Normalize, strip leading slash
	if strings.HasPrefix(name, "/") {
		name = name[1:]
	}
	// Try exact file
	f, err := s.fs.Open(name)
	if err == nil {
		return f, nil
	}

	// If the requested file doesn't exist, fall back to index.html for SPA routes
	// BUT only if it's not obviously a static asset extension
	ext := strings.ToLower(filepath.Ext(name))
	switch ext {
	case ".js", ".css", ".map", ".json", ".txt", ".ico", ".png", ".jpg", ".jpeg",
		".svg", ".webp", ".gif", ".woff", ".woff2", ".ttf", ".otf", ".eot", ".wasm", ".br", ".gz":
		return nil, fs.ErrNotExist
	}

	return s.fs.Open("index.html")
}

func newDistFS() (fs.FS, error) {
	return fs.Sub(distFS, "dist")
}

// SPAHandler returns an http.Handler that serves the embedded UI (with caching)
func SPAHandler() (http.Handler, error) {
	sub, err := newDistFS()
	if err != nil {
		return nil, err
	}
	spa := spaFileSystem{fs: sub}

	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if strings.HasPrefix(r.URL.Path, "/api/") ||
			r.URL.Path == "/api" ||
			strings.HasPrefix(r.URL.Path, "/swagger") ||
			strings.HasPrefix(r.URL.Path, "/db-studio") ||
			strings.HasPrefix(r.URL.Path, "/debug/pprof") {
			http.NotFound(w, r)
			return
		}

		raw := strings.TrimSpace(r.URL.Path)
		if raw == "" || raw == "/" {
			raw = "/index.html"
		}

		clean := path.Clean("/" + raw) // nosemgrep: autoglue.filesystem.no-path-clean
		filePath := strings.TrimPrefix(clean, "/")
		if filePath == "" {
			filePath = "index.html"
		}

		// Try compressed variants for assets and HTML
		// NOTE: we only change *Content-Encoding*; Content-Type derives from original ext
		// Always vary on Accept-Encoding
		w.Header().Add("Vary", "Accept-Encoding")

		enc := r.Header.Get("Accept-Encoding")
		if tryServeCompressed(w, r, spa, filePath, enc) {
			return
		}

		// Fallback: normal open (or SPA fallback)
		f, err := spa.Open(filePath)
		if err != nil {
			http.NotFound(w, r)
			return
		}
		defer f.Close()

		if strings.HasSuffix(filePath, ".html") {
			w.Header().Set("Cache-Control", "no-cache")
		} else {
			w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
		}

		info, _ := f.Stat()
		modTime := time.Now()
		if info != nil {
			modTime = info.ModTime()
		}
		http.ServeContent(w, r, filePath, modTime, file{f})
	}), nil
}

func tryServeCompressed(w http.ResponseWriter, r *http.Request, spa spaFileSystem, filePath, enc string) bool {
	wantsBR := strings.Contains(enc, "br")
	wantsGZ := strings.Contains(enc, "gzip")

	type cand struct {
		logical  string // MIME/type decision uses this (uncompressed name)
		physical string // actual file we open (with .br/.gz)
		enc      string
	}

	var cands []cand

	// 1) direct compressed variant of requested path (rare for SPA routes, but cheap to try)
	if wantsBR {
		cands = append(cands, cand{logical: filePath, physical: filePath + ".br", enc: "br"})
	}
	if wantsGZ {
		cands = append(cands, cand{logical: filePath, physical: filePath + ".gz", enc: "gzip"})
	}

	// 2) SPA route: fall back to compressed index.html
	if filepath.Ext(filePath) == "" {
		if wantsBR {
			cands = append(cands, cand{logical: "index.html", physical: "index.html.br", enc: "br"})
		}
		if wantsGZ {
			cands = append(cands, cand{logical: "index.html", physical: "index.html.gz", enc: "gzip"})
		}
	}

	for _, c := range cands {
		f, err := spa.fs.Open(c.physical) // open EXACT path so we don't accidentally get SPA fallback
		if err != nil {
			continue
		}
		defer f.Close()

		// Cache headers
		if strings.HasSuffix(c.logical, ".html") {
			w.Header().Set("Cache-Control", "no-cache")
		} else {
			w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
		}

		if ct := mimeByExt(path.Ext(c.logical)); ct != "" {
			w.Header().Set("Content-Type", ct)
		}
		w.Header().Set("Content-Encoding", c.enc)
		w.Header().Add("Vary", "Accept-Encoding")

		info, _ := f.Stat()
		modTime := time.Now()
		if info != nil {
			modTime = info.ModTime()
		}

		// Serve the precompressed bytes
		http.ServeContent(w, r, c.physical, modTime, file{f})
		return true
	}
	return false
}

func serveIfExists(w http.ResponseWriter, r *http.Request, spa spaFileSystem, filePath, ext, encoding string) bool {
	cf := filePath + ext
	f, err := spa.Open(cf)
	if err != nil {
		return false
	}
	defer f.Close()

	// Set caching headers
	if strings.HasSuffix(filePath, ".html") {
		w.Header().Set("Cache-Control", "no-cache")
	} else {
		w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
	}
	// Preserve original content type by extension of *uncompressed* file
	if ct := mimeByExt(path.Ext(filePath)); ct != "" {
		w.Header().Set("Content-Type", ct)
	}
	w.Header().Set("Content-Encoding", encoding)

	info, _ := f.Stat()
	modTime := time.Now()
	if info != nil {
		modTime = info.ModTime()
	}

	// Serve the compressed bytes as an io.ReadSeeker if possible
	http.ServeContent(w, r, cf, modTime, file{f})
	return true
}

func mimeByExt(ext string) string {
	switch strings.ToLower(ext) {
	case ".html":
		return "text/html; charset=utf-8"
	case ".js":
		return "application/javascript"
	case ".css":
		return "text/css; charset=utf-8"
	case ".json":
		return "application/json"
	case ".svg":
		return "image/svg+xml"
	case ".png":
		return "image/png"
	case ".jpg", ".jpeg":
		return "image/jpeg"
	case ".webp":
		return "image/webp"
	case ".ico":
		return "image/x-icon"
	case ".woff2":
		return "font/woff2"
	case ".woff":
		return "font/woff"
	default:
		return "" // let Go sniff if empty
	}
}

// file wraps fs.File to implement io.ReadSeeker if possible (for ServeContent)
type file struct{ fs.File }

func (f file) Seek(offset int64, whence int) (int64, error) {
	if s, ok := f.File.(io.Seeker); ok {
		return s.Seek(offset, whence)
	}
	// Fallback: not seekable
	return 0, fs.ErrInvalid
}
</file>

<file path="ui/public/vite.svg">
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="31.88" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 257"><defs><linearGradient id="IconifyId1813088fe1fbc01fb466" x1="-.828%" x2="57.636%" y1="7.652%" y2="78.411%"><stop offset="0%" stop-color="#41D1FF"></stop><stop offset="100%" stop-color="#BD34FE"></stop></linearGradient><linearGradient id="IconifyId1813088fe1fbc01fb467" x1="43.376%" x2="50.316%" y1="2.242%" y2="89.03%"><stop offset="0%" stop-color="#FFEA83"></stop><stop offset="8.333%" stop-color="#FFDD35"></stop><stop offset="100%" stop-color="#FFA800"></stop></linearGradient></defs><path fill="url(#IconifyId1813088fe1fbc01fb466)" d="M255.153 37.938L134.897 252.976c-2.483 4.44-8.862 4.466-11.382.048L.875 37.958c-2.746-4.814 1.371-10.646 6.827-9.67l120.385 21.517a6.537 6.537 0 0 0 2.322-.004l117.867-21.483c5.438-.991 9.574 4.796 6.877 9.62Z"></path><path fill="url(#IconifyId1813088fe1fbc01fb467)" d="M185.432.063L96.44 17.501a3.268 3.268 0 0 0-2.634 3.014l-5.474 92.456a3.268 3.268 0 0 0 3.997 3.378l24.777-5.718c2.318-.535 4.413 1.507 3.936 3.838l-7.361 36.047c-.495 2.426 1.782 4.5 4.151 3.78l15.304-4.649c2.372-.72 4.652 1.36 4.15 3.788l-11.698 56.621c-.732 3.542 3.979 5.473 5.943 2.437l1.313-2.028l72.516-144.72c1.215-2.423-.88-5.186-3.54-4.672l-25.505 4.922c-2.396.462-4.435-1.77-3.759-4.114l16.646-57.705c.677-2.35-1.37-4.583-3.769-4.113Z"></path></svg>
</file>

<file path="ui/src/api/footer.ts">
export const metaApi = {
  footer: async () => {
    const res = await fetch("/api/v1/version", { cache: "no-store" })
    if (!res.ok) throw new Error("failed to fetch version")
    return (await res.json()) as {
      built: string
      builtBy: string
      commit: string
      go: string
      goArch: string
      goOS: string
      version: string
    }
  },
}
</file>

<file path="ui/src/api/with-refresh.ts">
// api/with-refresh.ts
import { authStore, type TokenPair } from "@/auth/store.ts"
import { API_BASE } from "@/sdkClient.ts"

let inflightRefresh: Promise<boolean> | null = null

async function doRefresh(): Promise<boolean> {
  const tokens = authStore.get()
  if (!tokens?.refresh_token) return false

  try {
    const res = await fetch(`${API_BASE}/auth/refresh`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ refresh_token: tokens.refresh_token }),
    })

    if (!res.ok) return false

    const next = (await res.json()) as TokenPair
    authStore.set(next)
    return true
  } catch {
    return false
  }
}

async function refreshOnce(): Promise<boolean> {
  if (!inflightRefresh) {
    inflightRefresh = doRefresh().finally(() => {
      inflightRefresh = null
    })
  }
  return inflightRefresh
}

function isUnauthorized(err: any): boolean {
  return (
    err?.status === 401 ||
    err?.cause?.status === 401 ||
    err?.response?.status === 401 ||
    (err instanceof Response && err.status === 401)
  )
}

export async function withRefresh<T>(fn: () => Promise<T>): Promise<T> {
  // Optional: attempt a proactive refresh if close to expiry
  if (authStore.willExpireSoon?.(30)) {
    await refreshOnce()
  }

  try {
    return await fn()
  } catch (error) {
    if (!isUnauthorized(error)) throw error

    const ok = await refreshOnce()
    if (!ok) throw error

    return await fn()
  }
}
</file>

<file path="ui/src/auth/org.ts">
const KEY = "autoglue.org"

let cache: string | null = localStorage.getItem(KEY)

export const orgStore = {
  get(): string | null {
    return cache
  },
  set(id: string) {
    cache = id
    localStorage.setItem(KEY, id)
    window.dispatchEvent(new CustomEvent("autoglue:org-change", { detail: id }))
  },
  subscribe(fn: (id: string | null) => void) {
    const onCustom = (e: Event) => fn((e as CustomEvent<string>).detail ?? null)
    const onStorage = (e: StorageEvent) => {
      if (e.key === KEY) {
        cache = e.newValue
        fn(cache)
      }
    }
    window.addEventListener("autoglue:org-change", onCustom as EventListener)
    window.addEventListener("storage", onStorage)
    return () => {
      window.removeEventListener("autoglue:org-change", onCustom as EventListener)
      window.removeEventListener("storage", onStorage)
    }
  },
}
</file>

<file path="ui/src/auth/store.ts">
export type TokenPair = {
  access_token: string
  refresh_token: string
  token_type: string
  expires_in: number
}

const KEY = "autoglue.tokens"
const EVT = "autoglue.auth-change"

let cache: TokenPair | null = read()

function read(): TokenPair | null {
  try {
    const raw = localStorage.getItem(KEY)
    return raw ? (JSON.parse(raw) as TokenPair) : null
  } catch {
    return null
  }
}

function write(tokens: TokenPair | null) {
  if (tokens) localStorage.setItem(KEY, JSON.stringify(tokens))
  else localStorage.removeItem(KEY)
}

function emit(tokens: TokenPair | null) {
  // include payload for convenience
  window.dispatchEvent(new CustomEvent<TokenPair | null>(EVT, { detail: tokens }))
}

export const authStore = {
  /** Current tokens (from in-memory cache). */
  get(): TokenPair | null {
    return cache
  },

  /** Set tokens; updates memory, localStorage, broadcasts event. */
  set(tokens: TokenPair | null) {
    cache = tokens
    write(tokens)
    emit(tokens)
  },

  /** Fresh read from storage (useful if you suspect out-of-band changes). */
  reload(): TokenPair | null {
    cache = read()
    return cache
  },

  /** Is there an access token at all? (not checking expiry) */
  isAuthed(): boolean {
    return !!cache?.access_token
  },

  /** Convenience accessor */
  getAccessToken(): string | null {
    return cache?.access_token ?? null
  },

  /** Decode JWT exp and check expiry (no clock skew handling here). */
  isExpired(nowSec = Math.floor(Date.now() / 1000)): boolean {
    const exp = decodeExp(cache?.access_token)
    return exp !== null ? nowSec >= exp : true
  },

  /** Will expire within `thresholdSec` (default 60s). */
  willExpireSoon(thresholdSec = 60, nowSec = Math.floor(Date.now() / 1000)): boolean {
    const exp = decodeExp(cache?.access_token)
    return exp !== null ? exp - nowSec <= thresholdSec : true
  },

  logout() {
    authStore.set(null)
  },

  /** Subscribe to changes (pairs well with useSyncExternalStore). */
  subscribe(fn: (tokens: TokenPair | null) => void): () => void {
    const onCustom = (e: Event) => fn((e as CustomEvent<TokenPair | null>).detail ?? null)
    const onStorage = (e: StorageEvent) => {
      if (e.key === KEY) {
        cache = read()
        fn(cache)
      }
    }

    window.addEventListener(EVT, onCustom as EventListener)
    window.addEventListener("storage", onStorage)
    return () => {
      window.removeEventListener(EVT, onCustom as EventListener)
      window.removeEventListener("storage", onStorage)
    }
  },
}

// --- helpers ---
function decodeExp(jwt?: string): number | null {
  if (!jwt) return null
  const parts = jwt.split(".")
  if (parts.length < 2) return null
  try {
    const json = JSON.parse(atob(base64urlToBase64(parts[1])))
    const exp = typeof json?.exp === "number" ? json.exp : null
    return exp ?? null
  } catch {
    return null
  }
}

function base64urlToBase64(s: string) {
  return s.replace(/-/g, "+").replace(/_/g, "/") + "==".slice((2 - ((s.length * 3) % 4)) % 4)
}
</file>

<file path="ui/src/components/ui/accordion.tsx">
import * as React from "react"
import * as AccordionPrimitive from "@radix-ui/react-accordion"
import { ChevronDownIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function Accordion({ ...props }: React.ComponentProps<typeof AccordionPrimitive.Root>) {
  return <AccordionPrimitive.Root data-slot="accordion" {...props} />
}

function AccordionItem({
  className,
  ...props
}: React.ComponentProps<typeof AccordionPrimitive.Item>) {
  return (
    <AccordionPrimitive.Item
      data-slot="accordion-item"
      className={cn("border-b last:border-b-0", className)}
      {...props}
    />
  )
}

function AccordionTrigger({
  className,
  children,
  ...props
}: React.ComponentProps<typeof AccordionPrimitive.Trigger>) {
  return (
    <AccordionPrimitive.Header className="flex">
      <AccordionPrimitive.Trigger
        data-slot="accordion-trigger"
        className={cn(
          "focus-visible:border-ring focus-visible:ring-ring/50 flex flex-1 items-start justify-between gap-4 rounded-md py-4 text-left text-sm font-medium transition-all outline-none hover:underline focus-visible:ring-[3px] disabled:pointer-events-none disabled:opacity-50 [&[data-state=open]>svg]:rotate-180",
          className
        )}
        {...props}
      >
        {children}
        <ChevronDownIcon className="text-muted-foreground pointer-events-none size-4 shrink-0 translate-y-0.5 transition-transform duration-200" />
      </AccordionPrimitive.Trigger>
    </AccordionPrimitive.Header>
  )
}

function AccordionContent({
  className,
  children,
  ...props
}: React.ComponentProps<typeof AccordionPrimitive.Content>) {
  return (
    <AccordionPrimitive.Content
      data-slot="accordion-content"
      className="data-[state=closed]:animate-accordion-up data-[state=open]:animate-accordion-down overflow-hidden text-sm"
      {...props}
    >
      <div className={cn("pt-0 pb-4", className)}>{children}</div>
    </AccordionPrimitive.Content>
  )
}

export { Accordion, AccordionItem, AccordionTrigger, AccordionContent }
</file>

<file path="ui/src/components/ui/alert-dialog.tsx">
import * as React from "react"
import * as AlertDialogPrimitive from "@radix-ui/react-alert-dialog"

import { cn } from "@/lib/utils"
import { buttonVariants } from "@/components/ui/button"

function AlertDialog({ ...props }: React.ComponentProps<typeof AlertDialogPrimitive.Root>) {
  return <AlertDialogPrimitive.Root data-slot="alert-dialog" {...props} />
}

function AlertDialogTrigger({
  ...props
}: React.ComponentProps<typeof AlertDialogPrimitive.Trigger>) {
  return <AlertDialogPrimitive.Trigger data-slot="alert-dialog-trigger" {...props} />
}

function AlertDialogPortal({ ...props }: React.ComponentProps<typeof AlertDialogPrimitive.Portal>) {
  return <AlertDialogPrimitive.Portal data-slot="alert-dialog-portal" {...props} />
}

function AlertDialogOverlay({
  className,
  ...props
}: React.ComponentProps<typeof AlertDialogPrimitive.Overlay>) {
  return (
    <AlertDialogPrimitive.Overlay
      data-slot="alert-dialog-overlay"
      className={cn(
        "data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-50 bg-black/50",
        className
      )}
      {...props}
    />
  )
}

function AlertDialogContent({
  className,
  ...props
}: React.ComponentProps<typeof AlertDialogPrimitive.Content>) {
  return (
    <AlertDialogPortal>
      <AlertDialogOverlay />
      <AlertDialogPrimitive.Content
        data-slot="alert-dialog-content"
        className={cn(
          "bg-background data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 fixed top-[50%] left-[50%] z-50 grid w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] gap-4 rounded-lg border p-6 shadow-lg duration-200 sm:max-w-lg",
          className
        )}
        {...props}
      />
    </AlertDialogPortal>
  )
}

function AlertDialogHeader({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="alert-dialog-header"
      className={cn("flex flex-col gap-2 text-center sm:text-left", className)}
      {...props}
    />
  )
}

function AlertDialogFooter({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="alert-dialog-footer"
      className={cn("flex flex-col-reverse gap-2 sm:flex-row sm:justify-end", className)}
      {...props}
    />
  )
}

function AlertDialogTitle({
  className,
  ...props
}: React.ComponentProps<typeof AlertDialogPrimitive.Title>) {
  return (
    <AlertDialogPrimitive.Title
      data-slot="alert-dialog-title"
      className={cn("text-lg font-semibold", className)}
      {...props}
    />
  )
}

function AlertDialogDescription({
  className,
  ...props
}: React.ComponentProps<typeof AlertDialogPrimitive.Description>) {
  return (
    <AlertDialogPrimitive.Description
      data-slot="alert-dialog-description"
      className={cn("text-muted-foreground text-sm", className)}
      {...props}
    />
  )
}

function AlertDialogAction({
  className,
  ...props
}: React.ComponentProps<typeof AlertDialogPrimitive.Action>) {
  return <AlertDialogPrimitive.Action className={cn(buttonVariants(), className)} {...props} />
}

function AlertDialogCancel({
  className,
  ...props
}: React.ComponentProps<typeof AlertDialogPrimitive.Cancel>) {
  return (
    <AlertDialogPrimitive.Cancel
      className={cn(buttonVariants({ variant: "outline" }), className)}
      {...props}
    />
  )
}

export {
  AlertDialog,
  AlertDialogPortal,
  AlertDialogOverlay,
  AlertDialogTrigger,
  AlertDialogContent,
  AlertDialogHeader,
  AlertDialogFooter,
  AlertDialogTitle,
  AlertDialogDescription,
  AlertDialogAction,
  AlertDialogCancel,
}
</file>

<file path="ui/src/components/ui/alert.tsx">
import * as React from "react"
import { cva, type VariantProps } from "class-variance-authority"

import { cn } from "@/lib/utils"

const alertVariants = cva(
  "relative w-full rounded-lg border px-4 py-3 text-sm grid has-[>svg]:grid-cols-[calc(var(--spacing)*4)_1fr] grid-cols-[0_1fr] has-[>svg]:gap-x-3 gap-y-0.5 items-start [&>svg]:size-4 [&>svg]:translate-y-0.5 [&>svg]:text-current",
  {
    variants: {
      variant: {
        default: "bg-card text-card-foreground",
        destructive:
          "text-destructive bg-card [&>svg]:text-current *:data-[slot=alert-description]:text-destructive/90",
      },
    },
    defaultVariants: {
      variant: "default",
    },
  }
)

function Alert({
  className,
  variant,
  ...props
}: React.ComponentProps<"div"> & VariantProps<typeof alertVariants>) {
  return (
    <div
      data-slot="alert"
      role="alert"
      className={cn(alertVariants({ variant }), className)}
      {...props}
    />
  )
}

function AlertTitle({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="alert-title"
      className={cn("col-start-2 line-clamp-1 min-h-4 font-medium tracking-tight", className)}
      {...props}
    />
  )
}

function AlertDescription({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="alert-description"
      className={cn(
        "text-muted-foreground col-start-2 grid justify-items-start gap-1 text-sm [&_p]:leading-relaxed",
        className
      )}
      {...props}
    />
  )
}

export { Alert, AlertTitle, AlertDescription }
</file>

<file path="ui/src/components/ui/aspect-ratio.tsx">
"use client"

import * as AspectRatioPrimitive from "@radix-ui/react-aspect-ratio"

function AspectRatio({ ...props }: React.ComponentProps<typeof AspectRatioPrimitive.Root>) {
  return <AspectRatioPrimitive.Root data-slot="aspect-ratio" {...props} />
}

export { AspectRatio }
</file>

<file path="ui/src/components/ui/avatar.tsx">
import * as React from "react"
import * as AvatarPrimitive from "@radix-ui/react-avatar"

import { cn } from "@/lib/utils"

function Avatar({ className, ...props }: React.ComponentProps<typeof AvatarPrimitive.Root>) {
  return (
    <AvatarPrimitive.Root
      data-slot="avatar"
      className={cn("relative flex size-8 shrink-0 overflow-hidden rounded-full", className)}
      {...props}
    />
  )
}

function AvatarImage({ className, ...props }: React.ComponentProps<typeof AvatarPrimitive.Image>) {
  return (
    <AvatarPrimitive.Image
      data-slot="avatar-image"
      className={cn("aspect-square size-full", className)}
      {...props}
    />
  )
}

function AvatarFallback({
  className,
  ...props
}: React.ComponentProps<typeof AvatarPrimitive.Fallback>) {
  return (
    <AvatarPrimitive.Fallback
      data-slot="avatar-fallback"
      className={cn("bg-muted flex size-full items-center justify-center rounded-full", className)}
      {...props}
    />
  )
}

export { Avatar, AvatarImage, AvatarFallback }
</file>

<file path="ui/src/components/ui/badge.tsx">
import * as React from "react"
import { Slot } from "@radix-ui/react-slot"
import { cva, type VariantProps } from "class-variance-authority"

import { cn } from "@/lib/utils"

const badgeVariants = cva(
  "inline-flex items-center justify-center rounded-full border px-2 py-0.5 text-xs font-medium w-fit whitespace-nowrap shrink-0 [&>svg]:size-3 gap-1 [&>svg]:pointer-events-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive transition-[color,box-shadow] overflow-hidden",
  {
    variants: {
      variant: {
        default: "border-transparent bg-primary text-primary-foreground [a&]:hover:bg-primary/90",
        secondary:
          "border-transparent bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90",
        destructive:
          "border-transparent bg-destructive text-white [a&]:hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/60",
        outline: "text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground",
      },
    },
    defaultVariants: {
      variant: "default",
    },
  }
)

function Badge({
  className,
  variant,
  asChild = false,
  ...props
}: React.ComponentProps<"span"> & VariantProps<typeof badgeVariants> & { asChild?: boolean }) {
  const Comp = asChild ? Slot : "span"

  return <Comp data-slot="badge" className={cn(badgeVariants({ variant }), className)} {...props} />
}

export { Badge, badgeVariants }
</file>

<file path="ui/src/components/ui/breadcrumb.tsx">
import * as React from "react"
import { Slot } from "@radix-ui/react-slot"
import { ChevronRight, MoreHorizontal } from "lucide-react"

import { cn } from "@/lib/utils"

function Breadcrumb({ ...props }: React.ComponentProps<"nav">) {
  return <nav aria-label="breadcrumb" data-slot="breadcrumb" {...props} />
}

function BreadcrumbList({ className, ...props }: React.ComponentProps<"ol">) {
  return (
    <ol
      data-slot="breadcrumb-list"
      className={cn(
        "text-muted-foreground flex flex-wrap items-center gap-1.5 text-sm break-words sm:gap-2.5",
        className
      )}
      {...props}
    />
  )
}

function BreadcrumbItem({ className, ...props }: React.ComponentProps<"li">) {
  return (
    <li
      data-slot="breadcrumb-item"
      className={cn("inline-flex items-center gap-1.5", className)}
      {...props}
    />
  )
}

function BreadcrumbLink({
  asChild,
  className,
  ...props
}: React.ComponentProps<"a"> & {
  asChild?: boolean
}) {
  const Comp = asChild ? Slot : "a"

  return (
    <Comp
      data-slot="breadcrumb-link"
      className={cn("hover:text-foreground transition-colors", className)}
      {...props}
    />
  )
}

function BreadcrumbPage({ className, ...props }: React.ComponentProps<"span">) {
  return (
    <span
      data-slot="breadcrumb-page"
      role="link"
      aria-disabled="true"
      aria-current="page"
      className={cn("text-foreground font-normal", className)}
      {...props}
    />
  )
}

function BreadcrumbSeparator({ children, className, ...props }: React.ComponentProps<"li">) {
  return (
    <li
      data-slot="breadcrumb-separator"
      role="presentation"
      aria-hidden="true"
      className={cn("[&>svg]:size-3.5", className)}
      {...props}
    >
      {children ?? <ChevronRight />}
    </li>
  )
}

function BreadcrumbEllipsis({ className, ...props }: React.ComponentProps<"span">) {
  return (
    <span
      data-slot="breadcrumb-ellipsis"
      role="presentation"
      aria-hidden="true"
      className={cn("flex size-9 items-center justify-center", className)}
      {...props}
    >
      <MoreHorizontal className="size-4" />
      <span className="sr-only">More</span>
    </span>
  )
}

export {
  Breadcrumb,
  BreadcrumbList,
  BreadcrumbItem,
  BreadcrumbLink,
  BreadcrumbPage,
  BreadcrumbSeparator,
  BreadcrumbEllipsis,
}
</file>

<file path="ui/src/components/ui/button-group.tsx">
import { Slot } from "@radix-ui/react-slot"
import { cva, type VariantProps } from "class-variance-authority"

import { cn } from "@/lib/utils"
import { Separator } from "@/components/ui/separator"

const buttonGroupVariants = cva(
  "flex w-fit items-stretch [&>*]:focus-visible:z-10 [&>*]:focus-visible:relative [&>[data-slot=select-trigger]:not([class*='w-'])]:w-fit [&>input]:flex-1 has-[select[aria-hidden=true]:last-child]:[&>[data-slot=select-trigger]:last-of-type]:rounded-r-md has-[>[data-slot=button-group]]:gap-2",
  {
    variants: {
      orientation: {
        horizontal:
          "[&>*:not(:first-child)]:rounded-l-none [&>*:not(:first-child)]:border-l-0 [&>*:not(:last-child)]:rounded-r-none",
        vertical:
          "flex-col [&>*:not(:first-child)]:rounded-t-none [&>*:not(:first-child)]:border-t-0 [&>*:not(:last-child)]:rounded-b-none",
      },
    },
    defaultVariants: {
      orientation: "horizontal",
    },
  }
)

function ButtonGroup({
  className,
  orientation,
  ...props
}: React.ComponentProps<"div"> & VariantProps<typeof buttonGroupVariants>) {
  return (
    <div
      role="group"
      data-slot="button-group"
      data-orientation={orientation}
      className={cn(buttonGroupVariants({ orientation }), className)}
      {...props}
    />
  )
}

function ButtonGroupText({
  className,
  asChild = false,
  ...props
}: React.ComponentProps<"div"> & {
  asChild?: boolean
}) {
  const Comp = asChild ? Slot : "div"

  return (
    <Comp
      className={cn(
        "bg-muted flex items-center gap-2 rounded-md border px-4 text-sm font-medium shadow-xs [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    />
  )
}

function ButtonGroupSeparator({
  className,
  orientation = "vertical",
  ...props
}: React.ComponentProps<typeof Separator>) {
  return (
    <Separator
      data-slot="button-group-separator"
      orientation={orientation}
      className={cn(
        "bg-input relative !m-0 self-stretch data-[orientation=vertical]:h-auto",
        className
      )}
      {...props}
    />
  )
}

export { ButtonGroup, ButtonGroupSeparator, ButtonGroupText, buttonGroupVariants }
</file>

<file path="ui/src/components/ui/button.tsx">
import * as React from "react"
import { Slot } from "@radix-ui/react-slot"
import { cva, type VariantProps } from "class-variance-authority"

import { cn } from "@/lib/utils"

const buttonVariants = cva(
  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 shrink-0 [&_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive",
  {
    variants: {
      variant: {
        default: "bg-primary text-primary-foreground hover:bg-primary/90",
        destructive:
          "bg-destructive text-white hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/60",
        outline:
          "border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50",
        secondary: "bg-secondary text-secondary-foreground hover:bg-secondary/80",
        ghost: "hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50",
        link: "text-primary underline-offset-4 hover:underline",
      },
      size: {
        default: "h-9 px-4 py-2 has-[>svg]:px-3",
        sm: "h-8 rounded-md gap-1.5 px-3 has-[>svg]:px-2.5",
        lg: "h-10 rounded-md px-6 has-[>svg]:px-4",
        icon: "size-9",
        "icon-sm": "size-8",
        "icon-lg": "size-10",
      },
    },
    defaultVariants: {
      variant: "default",
      size: "default",
    },
  }
)

function Button({
  className,
  variant,
  size,
  asChild = false,
  ...props
}: React.ComponentProps<"button"> &
  VariantProps<typeof buttonVariants> & {
    asChild?: boolean
  }) {
  const Comp = asChild ? Slot : "button"

  return (
    <Comp
      data-slot="button"
      className={cn(buttonVariants({ variant, size, className }))}
      {...props}
    />
  )
}

export { Button, buttonVariants }
</file>

<file path="ui/src/components/ui/calendar.tsx">
"use client"

import * as React from "react"
import { ChevronDownIcon, ChevronLeftIcon, ChevronRightIcon } from "lucide-react"
import { DayButton, DayPicker, getDefaultClassNames } from "react-day-picker"

import { cn } from "@/lib/utils"
import { Button, buttonVariants } from "@/components/ui/button"

function Calendar({
  className,
  classNames,
  showOutsideDays = true,
  captionLayout = "label",
  buttonVariant = "ghost",
  formatters,
  components,
  ...props
}: React.ComponentProps<typeof DayPicker> & {
  buttonVariant?: React.ComponentProps<typeof Button>["variant"]
}) {
  const defaultClassNames = getDefaultClassNames()

  return (
    <DayPicker
      showOutsideDays={showOutsideDays}
      className={cn(
        "bg-background group/calendar p-3 [--cell-size:--spacing(8)] [[data-slot=card-content]_&]:bg-transparent [[data-slot=popover-content]_&]:bg-transparent",
        String.raw`rtl:**:[.rdp-button\_next>svg]:rotate-180`,
        String.raw`rtl:**:[.rdp-button\_previous>svg]:rotate-180`,
        className
      )}
      captionLayout={captionLayout}
      formatters={{
        formatMonthDropdown: (date) => date.toLocaleString("default", { month: "short" }),
        ...formatters,
      }}
      classNames={{
        root: cn("w-fit", defaultClassNames.root),
        months: cn("flex gap-4 flex-col md:flex-row relative", defaultClassNames.months),
        month: cn("flex flex-col w-full gap-4", defaultClassNames.month),
        nav: cn(
          "flex items-center gap-1 w-full absolute top-0 inset-x-0 justify-between",
          defaultClassNames.nav
        ),
        button_previous: cn(
          buttonVariants({ variant: buttonVariant }),
          "size-(--cell-size) aria-disabled:opacity-50 p-0 select-none",
          defaultClassNames.button_previous
        ),
        button_next: cn(
          buttonVariants({ variant: buttonVariant }),
          "size-(--cell-size) aria-disabled:opacity-50 p-0 select-none",
          defaultClassNames.button_next
        ),
        month_caption: cn(
          "flex items-center justify-center h-(--cell-size) w-full px-(--cell-size)",
          defaultClassNames.month_caption
        ),
        dropdowns: cn(
          "w-full flex items-center text-sm font-medium justify-center h-(--cell-size) gap-1.5",
          defaultClassNames.dropdowns
        ),
        dropdown_root: cn(
          "relative has-focus:border-ring border border-input shadow-xs has-focus:ring-ring/50 has-focus:ring-[3px] rounded-md",
          defaultClassNames.dropdown_root
        ),
        dropdown: cn("absolute bg-popover inset-0 opacity-0", defaultClassNames.dropdown),
        caption_label: cn(
          "select-none font-medium",
          captionLayout === "label"
            ? "text-sm"
            : "rounded-md pl-2 pr-1 flex items-center gap-1 text-sm h-8 [&>svg]:text-muted-foreground [&>svg]:size-3.5",
          defaultClassNames.caption_label
        ),
        table: "w-full border-collapse",
        weekdays: cn("flex", defaultClassNames.weekdays),
        weekday: cn(
          "text-muted-foreground rounded-md flex-1 font-normal text-[0.8rem] select-none",
          defaultClassNames.weekday
        ),
        week: cn("flex w-full mt-2", defaultClassNames.week),
        week_number_header: cn("select-none w-(--cell-size)", defaultClassNames.week_number_header),
        week_number: cn(
          "text-[0.8rem] select-none text-muted-foreground",
          defaultClassNames.week_number
        ),
        day: cn(
          "relative w-full h-full p-0 text-center [&:last-child[data-selected=true]_button]:rounded-r-md group/day aspect-square select-none",
          props.showWeekNumber
            ? "[&:nth-child(2)[data-selected=true]_button]:rounded-l-md"
            : "[&:first-child[data-selected=true]_button]:rounded-l-md",
          defaultClassNames.day
        ),
        range_start: cn("rounded-l-md bg-accent", defaultClassNames.range_start),
        range_middle: cn("rounded-none", defaultClassNames.range_middle),
        range_end: cn("rounded-r-md bg-accent", defaultClassNames.range_end),
        today: cn(
          "bg-accent text-accent-foreground rounded-md data-[selected=true]:rounded-none",
          defaultClassNames.today
        ),
        outside: cn(
          "text-muted-foreground aria-selected:text-muted-foreground",
          defaultClassNames.outside
        ),
        disabled: cn("text-muted-foreground opacity-50", defaultClassNames.disabled),
        hidden: cn("invisible", defaultClassNames.hidden),
        ...classNames,
      }}
      components={{
        Root: ({ className, rootRef, ...props }) => {
          return <div data-slot="calendar" ref={rootRef} className={cn(className)} {...props} />
        },
        Chevron: ({ className, orientation, ...props }) => {
          if (orientation === "left") {
            return <ChevronLeftIcon className={cn("size-4", className)} {...props} />
          }

          if (orientation === "right") {
            return <ChevronRightIcon className={cn("size-4", className)} {...props} />
          }

          return <ChevronDownIcon className={cn("size-4", className)} {...props} />
        },
        DayButton: CalendarDayButton,
        WeekNumber: ({ children, ...props }) => {
          return (
            <td {...props}>
              <div className="flex size-(--cell-size) items-center justify-center text-center">
                {children}
              </div>
            </td>
          )
        },
        ...components,
      }}
      {...props}
    />
  )
}

function CalendarDayButton({
  className,
  day,
  modifiers,
  ...props
}: React.ComponentProps<typeof DayButton>) {
  const defaultClassNames = getDefaultClassNames()

  const ref = React.useRef<HTMLButtonElement>(null)
  React.useEffect(() => {
    if (modifiers.focused) ref.current?.focus()
  }, [modifiers.focused])

  return (
    <Button
      ref={ref}
      variant="ghost"
      size="icon"
      data-day={day.date.toLocaleDateString()}
      data-selected-single={
        modifiers.selected &&
        !modifiers.range_start &&
        !modifiers.range_end &&
        !modifiers.range_middle
      }
      data-range-start={modifiers.range_start}
      data-range-end={modifiers.range_end}
      data-range-middle={modifiers.range_middle}
      className={cn(
        "data-[selected-single=true]:bg-primary data-[selected-single=true]:text-primary-foreground data-[range-middle=true]:bg-accent data-[range-middle=true]:text-accent-foreground data-[range-start=true]:bg-primary data-[range-start=true]:text-primary-foreground data-[range-end=true]:bg-primary data-[range-end=true]:text-primary-foreground group-data-[focused=true]/day:border-ring group-data-[focused=true]/day:ring-ring/50 dark:hover:text-accent-foreground flex aspect-square size-auto w-full min-w-(--cell-size) flex-col gap-1 leading-none font-normal group-data-[focused=true]/day:relative group-data-[focused=true]/day:z-10 group-data-[focused=true]/day:ring-[3px] data-[range-end=true]:rounded-md data-[range-end=true]:rounded-r-md data-[range-middle=true]:rounded-none data-[range-start=true]:rounded-md data-[range-start=true]:rounded-l-md [&>span]:text-xs [&>span]:opacity-70",
        defaultClassNames.day,
        className
      )}
      {...props}
    />
  )
}

export { Calendar, CalendarDayButton }
</file>

<file path="ui/src/components/ui/card.tsx">
import * as React from "react"

import { cn } from "@/lib/utils"

function Card({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="card"
      className={cn(
        "bg-card text-card-foreground flex flex-col gap-6 rounded-xl border py-6 shadow-sm",
        className
      )}
      {...props}
    />
  )
}

function CardHeader({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="card-header"
      className={cn(
        "@container/card-header grid auto-rows-min grid-rows-[auto_auto] items-start gap-2 px-6 has-data-[slot=card-action]:grid-cols-[1fr_auto] [.border-b]:pb-6",
        className
      )}
      {...props}
    />
  )
}

function CardTitle({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="card-title"
      className={cn("leading-none font-semibold", className)}
      {...props}
    />
  )
}

function CardDescription({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="card-description"
      className={cn("text-muted-foreground text-sm", className)}
      {...props}
    />
  )
}

function CardAction({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="card-action"
      className={cn("col-start-2 row-span-2 row-start-1 self-start justify-self-end", className)}
      {...props}
    />
  )
}

function CardContent({ className, ...props }: React.ComponentProps<"div">) {
  return <div data-slot="card-content" className={cn("px-6", className)} {...props} />
}

function CardFooter({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="card-footer"
      className={cn("flex items-center px-6 [.border-t]:pt-6", className)}
      {...props}
    />
  )
}

export { Card, CardHeader, CardFooter, CardTitle, CardAction, CardDescription, CardContent }
</file>

<file path="ui/src/components/ui/carousel.tsx">
import * as React from "react"
import useEmblaCarousel, { type UseEmblaCarouselType } from "embla-carousel-react"
import { ArrowLeft, ArrowRight } from "lucide-react"

import { cn } from "@/lib/utils"
import { Button } from "@/components/ui/button"

type CarouselApi = UseEmblaCarouselType[1]
type UseCarouselParameters = Parameters<typeof useEmblaCarousel>
type CarouselOptions = UseCarouselParameters[0]
type CarouselPlugin = UseCarouselParameters[1]

type CarouselProps = {
  opts?: CarouselOptions
  plugins?: CarouselPlugin
  orientation?: "horizontal" | "vertical"
  setApi?: (api: CarouselApi) => void
}

type CarouselContextProps = {
  carouselRef: ReturnType<typeof useEmblaCarousel>[0]
  api: ReturnType<typeof useEmblaCarousel>[1]
  scrollPrev: () => void
  scrollNext: () => void
  canScrollPrev: boolean
  canScrollNext: boolean
} & CarouselProps

const CarouselContext = React.createContext<CarouselContextProps | null>(null)

function useCarousel() {
  const context = React.useContext(CarouselContext)

  if (!context) {
    throw new Error("useCarousel must be used within a <Carousel />")
  }

  return context
}

function Carousel({
  orientation = "horizontal",
  opts,
  setApi,
  plugins,
  className,
  children,
  ...props
}: React.ComponentProps<"div"> & CarouselProps) {
  const [carouselRef, api] = useEmblaCarousel(
    {
      ...opts,
      axis: orientation === "horizontal" ? "x" : "y",
    },
    plugins
  )
  const [canScrollPrev, setCanScrollPrev] = React.useState(false)
  const [canScrollNext, setCanScrollNext] = React.useState(false)

  const onSelect = React.useCallback((api: CarouselApi) => {
    if (!api) return
    setCanScrollPrev(api.canScrollPrev())
    setCanScrollNext(api.canScrollNext())
  }, [])

  const scrollPrev = React.useCallback(() => {
    api?.scrollPrev()
  }, [api])

  const scrollNext = React.useCallback(() => {
    api?.scrollNext()
  }, [api])

  const handleKeyDown = React.useCallback(
    (event: React.KeyboardEvent<HTMLDivElement>) => {
      if (event.key === "ArrowLeft") {
        event.preventDefault()
        scrollPrev()
      } else if (event.key === "ArrowRight") {
        event.preventDefault()
        scrollNext()
      }
    },
    [scrollPrev, scrollNext]
  )

  React.useEffect(() => {
    if (!api || !setApi) return
    setApi(api)
  }, [api, setApi])

  React.useEffect(() => {
    if (!api) return
    onSelect(api)
    api.on("reInit", onSelect)
    api.on("select", onSelect)

    return () => {
      api?.off("select", onSelect)
    }
  }, [api, onSelect])

  return (
    <CarouselContext.Provider
      value={{
        carouselRef,
        api: api,
        opts,
        orientation: orientation || (opts?.axis === "y" ? "vertical" : "horizontal"),
        scrollPrev,
        scrollNext,
        canScrollPrev,
        canScrollNext,
      }}
    >
      <div
        onKeyDownCapture={handleKeyDown}
        className={cn("relative", className)}
        role="region"
        aria-roledescription="carousel"
        data-slot="carousel"
        {...props}
      >
        {children}
      </div>
    </CarouselContext.Provider>
  )
}

function CarouselContent({ className, ...props }: React.ComponentProps<"div">) {
  const { carouselRef, orientation } = useCarousel()

  return (
    <div ref={carouselRef} className="overflow-hidden" data-slot="carousel-content">
      <div
        className={cn("flex", orientation === "horizontal" ? "-ml-4" : "-mt-4 flex-col", className)}
        {...props}
      />
    </div>
  )
}

function CarouselItem({ className, ...props }: React.ComponentProps<"div">) {
  const { orientation } = useCarousel()

  return (
    <div
      role="group"
      aria-roledescription="slide"
      data-slot="carousel-item"
      className={cn(
        "min-w-0 shrink-0 grow-0 basis-full",
        orientation === "horizontal" ? "pl-4" : "pt-4",
        className
      )}
      {...props}
    />
  )
}

function CarouselPrevious({
  className,
  variant = "outline",
  size = "icon",
  ...props
}: React.ComponentProps<typeof Button>) {
  const { orientation, scrollPrev, canScrollPrev } = useCarousel()

  return (
    <Button
      data-slot="carousel-previous"
      variant={variant}
      size={size}
      className={cn(
        "absolute size-8 rounded-full",
        orientation === "horizontal"
          ? "top-1/2 -left-12 -translate-y-1/2"
          : "-top-12 left-1/2 -translate-x-1/2 rotate-90",
        className
      )}
      disabled={!canScrollPrev}
      onClick={scrollPrev}
      {...props}
    >
      <ArrowLeft />
      <span className="sr-only">Previous slide</span>
    </Button>
  )
}

function CarouselNext({
  className,
  variant = "outline",
  size = "icon",
  ...props
}: React.ComponentProps<typeof Button>) {
  const { orientation, scrollNext, canScrollNext } = useCarousel()

  return (
    <Button
      data-slot="carousel-next"
      variant={variant}
      size={size}
      className={cn(
        "absolute size-8 rounded-full",
        orientation === "horizontal"
          ? "top-1/2 -right-12 -translate-y-1/2"
          : "-bottom-12 left-1/2 -translate-x-1/2 rotate-90",
        className
      )}
      disabled={!canScrollNext}
      onClick={scrollNext}
      {...props}
    >
      <ArrowRight />
      <span className="sr-only">Next slide</span>
    </Button>
  )
}

export { type CarouselApi, Carousel, CarouselContent, CarouselItem, CarouselPrevious, CarouselNext }
</file>

<file path="ui/src/components/ui/chart.tsx">
"use client"

import * as React from "react"
import * as RechartsPrimitive from "recharts"

import { cn } from "@/lib/utils"

// Format: { THEME_NAME: CSS_SELECTOR }
const THEMES = { light: "", dark: ".dark" } as const

export type ChartConfig = {
  [k in string]: {
    label?: React.ReactNode
    icon?: React.ComponentType
  } & (
    | { color?: string; theme?: never }
    | { color?: never; theme: Record<keyof typeof THEMES, string> }
  )
}

type ChartContextProps = {
  config: ChartConfig
}

const ChartContext = React.createContext<ChartContextProps | null>(null)

function useChart() {
  const context = React.useContext(ChartContext)

  if (!context) {
    throw new Error("useChart must be used within a <ChartContainer />")
  }

  return context
}

function ChartContainer({
  id,
  className,
  children,
  config,
  ...props
}: React.ComponentProps<"div"> & {
  config: ChartConfig
  children: React.ComponentProps<typeof RechartsPrimitive.ResponsiveContainer>["children"]
}) {
  const uniqueId = React.useId()
  const chartId = `chart-${id || uniqueId.replace(/:/g, "")}`

  return (
    <ChartContext.Provider value={{ config }}>
      <div
        data-slot="chart"
        data-chart={chartId}
        className={cn(
          "[&_.recharts-cartesian-axis-tick_text]:fill-muted-foreground [&_.recharts-cartesian-grid_line[stroke='#ccc']]:stroke-border/50 [&_.recharts-curve.recharts-tooltip-cursor]:stroke-border [&_.recharts-polar-grid_[stroke='#ccc']]:stroke-border [&_.recharts-radial-bar-background-sector]:fill-muted [&_.recharts-rectangle.recharts-tooltip-cursor]:fill-muted [&_.recharts-reference-line_[stroke='#ccc']]:stroke-border flex aspect-video justify-center text-xs [&_.recharts-dot[stroke='#fff']]:stroke-transparent [&_.recharts-layer]:outline-hidden [&_.recharts-sector]:outline-hidden [&_.recharts-sector[stroke='#fff']]:stroke-transparent [&_.recharts-surface]:outline-hidden",
          className
        )}
        {...props}
      >
        <ChartStyle id={chartId} config={config} />
        <RechartsPrimitive.ResponsiveContainer>{children}</RechartsPrimitive.ResponsiveContainer>
      </div>
    </ChartContext.Provider>
  )
}

const ChartStyle = ({ id, config }: { id: string; config: ChartConfig }) => {
  const colorConfig = Object.entries(config).filter(([, config]) => config.theme || config.color)

  if (!colorConfig.length) {
    return null
  }

  return (
    <style
      dangerouslySetInnerHTML={{
        __html: Object.entries(THEMES)
          .map(
            ([theme, prefix]) => `
${prefix} [data-chart=${id}] {
${colorConfig
  .map(([key, itemConfig]) => {
    const color = itemConfig.theme?.[theme as keyof typeof itemConfig.theme] || itemConfig.color
    return color ? `  --color-${key}: ${color};` : null
  })
  .join("\n")}
}
`
          )
          .join("\n"),
      }}
    />
  )
}

const ChartTooltip = RechartsPrimitive.Tooltip

function ChartTooltipContent({
  active,
  payload,
  className,
  indicator = "dot",
  hideLabel = false,
  hideIndicator = false,
  label,
  labelFormatter,
  labelClassName,
  formatter,
  color,
  nameKey,
  labelKey,
}: React.ComponentProps<typeof RechartsPrimitive.Tooltip> &
  React.ComponentProps<"div"> & {
    hideLabel?: boolean
    hideIndicator?: boolean
    indicator?: "line" | "dot" | "dashed"
    nameKey?: string
    labelKey?: string
  }) {
  const { config } = useChart()

  const tooltipLabel = React.useMemo(() => {
    if (hideLabel || !payload?.length) {
      return null
    }

    const [item] = payload
    const key = `${labelKey || item?.dataKey || item?.name || "value"}`
    const itemConfig = getPayloadConfigFromPayload(config, item, key)
    const value =
      !labelKey && typeof label === "string"
        ? config[label as keyof typeof config]?.label || label
        : itemConfig?.label

    if (labelFormatter) {
      return (
        <div className={cn("font-medium", labelClassName)}>{labelFormatter(value, payload)}</div>
      )
    }

    if (!value) {
      return null
    }

    return <div className={cn("font-medium", labelClassName)}>{value}</div>
  }, [label, labelFormatter, payload, hideLabel, labelClassName, config, labelKey])

  if (!active || !payload?.length) {
    return null
  }

  const nestLabel = payload.length === 1 && indicator !== "dot"

  return (
    <div
      className={cn(
        "border-border/50 bg-background grid min-w-[8rem] items-start gap-1.5 rounded-lg border px-2.5 py-1.5 text-xs shadow-xl",
        className
      )}
    >
      {!nestLabel ? tooltipLabel : null}
      <div className="grid gap-1.5">
        {payload
          .filter((item) => item.type !== "none")
          .map((item, index) => {
            const key = `${nameKey || item.name || item.dataKey || "value"}`
            const itemConfig = getPayloadConfigFromPayload(config, item, key)
            const indicatorColor = color || item.payload.fill || item.color

            return (
              <div
                key={item.dataKey}
                className={cn(
                  "[&>svg]:text-muted-foreground flex w-full flex-wrap items-stretch gap-2 [&>svg]:h-2.5 [&>svg]:w-2.5",
                  indicator === "dot" && "items-center"
                )}
              >
                {formatter && item?.value !== undefined && item.name ? (
                  formatter(item.value, item.name, item, index, item.payload)
                ) : (
                  <>
                    {itemConfig?.icon ? (
                      <itemConfig.icon />
                    ) : (
                      !hideIndicator && (
                        <div
                          className={cn(
                            "shrink-0 rounded-[2px] border-(--color-border) bg-(--color-bg)",
                            {
                              "h-2.5 w-2.5": indicator === "dot",
                              "w-1": indicator === "line",
                              "w-0 border-[1.5px] border-dashed bg-transparent":
                                indicator === "dashed",
                              "my-0.5": nestLabel && indicator === "dashed",
                            }
                          )}
                          style={
                            {
                              "--color-bg": indicatorColor,
                              "--color-border": indicatorColor,
                            } as React.CSSProperties
                          }
                        />
                      )
                    )}
                    <div
                      className={cn(
                        "flex flex-1 justify-between leading-none",
                        nestLabel ? "items-end" : "items-center"
                      )}
                    >
                      <div className="grid gap-1.5">
                        {nestLabel ? tooltipLabel : null}
                        <span className="text-muted-foreground">
                          {itemConfig?.label || item.name}
                        </span>
                      </div>
                      {item.value && (
                        <span className="text-foreground font-mono font-medium tabular-nums">
                          {item.value.toLocaleString()}
                        </span>
                      )}
                    </div>
                  </>
                )}
              </div>
            )
          })}
      </div>
    </div>
  )
}

const ChartLegend = RechartsPrimitive.Legend

function ChartLegendContent({
  className,
  hideIcon = false,
  payload,
  verticalAlign = "bottom",
  nameKey,
}: React.ComponentProps<"div"> &
  Pick<RechartsPrimitive.LegendProps, "payload" | "verticalAlign"> & {
    hideIcon?: boolean
    nameKey?: string
  }) {
  const { config } = useChart()

  if (!payload?.length) {
    return null
  }

  return (
    <div
      className={cn(
        "flex items-center justify-center gap-4",
        verticalAlign === "top" ? "pb-3" : "pt-3",
        className
      )}
    >
      {payload
        .filter((item) => item.type !== "none")
        .map((item) => {
          const key = `${nameKey || item.dataKey || "value"}`
          const itemConfig = getPayloadConfigFromPayload(config, item, key)

          return (
            <div
              key={item.value}
              className={cn(
                "[&>svg]:text-muted-foreground flex items-center gap-1.5 [&>svg]:h-3 [&>svg]:w-3"
              )}
            >
              {itemConfig?.icon && !hideIcon ? (
                <itemConfig.icon />
              ) : (
                <div
                  className="h-2 w-2 shrink-0 rounded-[2px]"
                  style={{
                    backgroundColor: item.color,
                  }}
                />
              )}
              {itemConfig?.label}
            </div>
          )
        })}
    </div>
  )
}

// Helper to extract item config from a payload.
function getPayloadConfigFromPayload(config: ChartConfig, payload: unknown, key: string) {
  if (typeof payload !== "object" || payload === null) {
    return undefined
  }

  const payloadPayload =
    "payload" in payload && typeof payload.payload === "object" && payload.payload !== null
      ? payload.payload
      : undefined

  let configLabelKey: string = key

  if (key in payload && typeof payload[key as keyof typeof payload] === "string") {
    configLabelKey = payload[key as keyof typeof payload] as string
  } else if (
    payloadPayload &&
    key in payloadPayload &&
    typeof payloadPayload[key as keyof typeof payloadPayload] === "string"
  ) {
    configLabelKey = payloadPayload[key as keyof typeof payloadPayload] as string
  }

  return configLabelKey in config ? config[configLabelKey] : config[key as keyof typeof config]
}

export {
  ChartContainer,
  ChartTooltip,
  ChartTooltipContent,
  ChartLegend,
  ChartLegendContent,
  ChartStyle,
}
</file>

<file path="ui/src/components/ui/checkbox.tsx">
"use client"

import * as React from "react"
import * as CheckboxPrimitive from "@radix-ui/react-checkbox"
import { CheckIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function Checkbox({ className, ...props }: React.ComponentProps<typeof CheckboxPrimitive.Root>) {
  return (
    <CheckboxPrimitive.Root
      data-slot="checkbox"
      className={cn(
        "peer border-input dark:bg-input/30 data-[state=checked]:bg-primary data-[state=checked]:text-primary-foreground dark:data-[state=checked]:bg-primary data-[state=checked]:border-primary focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive size-4 shrink-0 rounded-[4px] border shadow-xs transition-shadow outline-none focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50",
        className
      )}
      {...props}
    >
      <CheckboxPrimitive.Indicator
        data-slot="checkbox-indicator"
        className="grid place-content-center text-current transition-none"
      >
        <CheckIcon className="size-3.5" />
      </CheckboxPrimitive.Indicator>
    </CheckboxPrimitive.Root>
  )
}

export { Checkbox }
</file>

<file path="ui/src/components/ui/collapsible.tsx">
import * as CollapsiblePrimitive from "@radix-ui/react-collapsible"

function Collapsible({ ...props }: React.ComponentProps<typeof CollapsiblePrimitive.Root>) {
  return <CollapsiblePrimitive.Root data-slot="collapsible" {...props} />
}

function CollapsibleTrigger({
  ...props
}: React.ComponentProps<typeof CollapsiblePrimitive.CollapsibleTrigger>) {
  return <CollapsiblePrimitive.CollapsibleTrigger data-slot="collapsible-trigger" {...props} />
}

function CollapsibleContent({
  ...props
}: React.ComponentProps<typeof CollapsiblePrimitive.CollapsibleContent>) {
  return <CollapsiblePrimitive.CollapsibleContent data-slot="collapsible-content" {...props} />
}

export { Collapsible, CollapsibleTrigger, CollapsibleContent }
</file>

<file path="ui/src/components/ui/command.tsx">
import * as React from "react"
import { Command as CommandPrimitive } from "cmdk"
import { SearchIcon } from "lucide-react"

import { cn } from "@/lib/utils"
import {
  Dialog,
  DialogContent,
  DialogDescription,
  DialogHeader,
  DialogTitle,
} from "@/components/ui/dialog"

function Command({ className, ...props }: React.ComponentProps<typeof CommandPrimitive>) {
  return (
    <CommandPrimitive
      data-slot="command"
      className={cn(
        "bg-popover text-popover-foreground flex h-full w-full flex-col overflow-hidden rounded-md",
        className
      )}
      {...props}
    />
  )
}

function CommandDialog({
  title = "Command Palette",
  description = "Search for a command to run...",
  children,
  className,
  showCloseButton = true,
  ...props
}: React.ComponentProps<typeof Dialog> & {
  title?: string
  description?: string
  className?: string
  showCloseButton?: boolean
}) {
  return (
    <Dialog {...props}>
      <DialogHeader className="sr-only">
        <DialogTitle>{title}</DialogTitle>
        <DialogDescription>{description}</DialogDescription>
      </DialogHeader>
      <DialogContent
        className={cn("overflow-hidden p-0", className)}
        showCloseButton={showCloseButton}
      >
        <Command className="[&_[cmdk-group-heading]]:text-muted-foreground **:data-[slot=command-input-wrapper]:h-12 [&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:font-medium [&_[cmdk-group]]:px-2 [&_[cmdk-group]:not([hidden])_~[cmdk-group]]:pt-0 [&_[cmdk-input-wrapper]_svg]:h-5 [&_[cmdk-input-wrapper]_svg]:w-5 [&_[cmdk-input]]:h-12 [&_[cmdk-item]]:px-2 [&_[cmdk-item]]:py-3 [&_[cmdk-item]_svg]:h-5 [&_[cmdk-item]_svg]:w-5">
          {children}
        </Command>
      </DialogContent>
    </Dialog>
  )
}

function CommandInput({
  className,
  ...props
}: React.ComponentProps<typeof CommandPrimitive.Input>) {
  return (
    <div data-slot="command-input-wrapper" className="flex h-9 items-center gap-2 border-b px-3">
      <SearchIcon className="size-4 shrink-0 opacity-50" />
      <CommandPrimitive.Input
        data-slot="command-input"
        className={cn(
          "placeholder:text-muted-foreground flex h-10 w-full rounded-md bg-transparent py-3 text-sm outline-hidden disabled:cursor-not-allowed disabled:opacity-50",
          className
        )}
        {...props}
      />
    </div>
  )
}

function CommandList({ className, ...props }: React.ComponentProps<typeof CommandPrimitive.List>) {
  return (
    <CommandPrimitive.List
      data-slot="command-list"
      className={cn("max-h-[300px] scroll-py-1 overflow-x-hidden overflow-y-auto", className)}
      {...props}
    />
  )
}

function CommandEmpty({ ...props }: React.ComponentProps<typeof CommandPrimitive.Empty>) {
  return (
    <CommandPrimitive.Empty
      data-slot="command-empty"
      className="py-6 text-center text-sm"
      {...props}
    />
  )
}

function CommandGroup({
  className,
  ...props
}: React.ComponentProps<typeof CommandPrimitive.Group>) {
  return (
    <CommandPrimitive.Group
      data-slot="command-group"
      className={cn(
        "text-foreground [&_[cmdk-group-heading]]:text-muted-foreground overflow-hidden p-1 [&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:py-1.5 [&_[cmdk-group-heading]]:text-xs [&_[cmdk-group-heading]]:font-medium",
        className
      )}
      {...props}
    />
  )
}

function CommandSeparator({
  className,
  ...props
}: React.ComponentProps<typeof CommandPrimitive.Separator>) {
  return (
    <CommandPrimitive.Separator
      data-slot="command-separator"
      className={cn("bg-border -mx-1 h-px", className)}
      {...props}
    />
  )
}

function CommandItem({ className, ...props }: React.ComponentProps<typeof CommandPrimitive.Item>) {
  return (
    <CommandPrimitive.Item
      data-slot="command-item"
      className={cn(
        "data-[selected=true]:bg-accent data-[selected=true]:text-accent-foreground [&_svg:not([class*='text-'])]:text-muted-foreground relative flex cursor-default items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-hidden select-none data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    />
  )
}

function CommandShortcut({ className, ...props }: React.ComponentProps<"span">) {
  return (
    <span
      data-slot="command-shortcut"
      className={cn("text-muted-foreground ml-auto text-xs tracking-widest", className)}
      {...props}
    />
  )
}

export {
  Command,
  CommandDialog,
  CommandInput,
  CommandList,
  CommandEmpty,
  CommandGroup,
  CommandItem,
  CommandShortcut,
  CommandSeparator,
}
</file>

<file path="ui/src/components/ui/context-menu.tsx">
"use client"

import * as React from "react"
import * as ContextMenuPrimitive from "@radix-ui/react-context-menu"
import { CheckIcon, ChevronRightIcon, CircleIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function ContextMenu({ ...props }: React.ComponentProps<typeof ContextMenuPrimitive.Root>) {
  return <ContextMenuPrimitive.Root data-slot="context-menu" {...props} />
}

function ContextMenuTrigger({
  ...props
}: React.ComponentProps<typeof ContextMenuPrimitive.Trigger>) {
  return <ContextMenuPrimitive.Trigger data-slot="context-menu-trigger" {...props} />
}

function ContextMenuGroup({ ...props }: React.ComponentProps<typeof ContextMenuPrimitive.Group>) {
  return <ContextMenuPrimitive.Group data-slot="context-menu-group" {...props} />
}

function ContextMenuPortal({ ...props }: React.ComponentProps<typeof ContextMenuPrimitive.Portal>) {
  return <ContextMenuPrimitive.Portal data-slot="context-menu-portal" {...props} />
}

function ContextMenuSub({ ...props }: React.ComponentProps<typeof ContextMenuPrimitive.Sub>) {
  return <ContextMenuPrimitive.Sub data-slot="context-menu-sub" {...props} />
}

function ContextMenuRadioGroup({
  ...props
}: React.ComponentProps<typeof ContextMenuPrimitive.RadioGroup>) {
  return <ContextMenuPrimitive.RadioGroup data-slot="context-menu-radio-group" {...props} />
}

function ContextMenuSubTrigger({
  className,
  inset,
  children,
  ...props
}: React.ComponentProps<typeof ContextMenuPrimitive.SubTrigger> & {
  inset?: boolean
}) {
  return (
    <ContextMenuPrimitive.SubTrigger
      data-slot="context-menu-sub-trigger"
      data-inset={inset}
      className={cn(
        "focus:bg-accent focus:text-accent-foreground data-[state=open]:bg-accent data-[state=open]:text-accent-foreground [&_svg:not([class*='text-'])]:text-muted-foreground flex cursor-default items-center rounded-sm px-2 py-1.5 text-sm outline-hidden select-none data-[inset]:pl-8 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    >
      {children}
      <ChevronRightIcon className="ml-auto" />
    </ContextMenuPrimitive.SubTrigger>
  )
}

function ContextMenuSubContent({
  className,
  ...props
}: React.ComponentProps<typeof ContextMenuPrimitive.SubContent>) {
  return (
    <ContextMenuPrimitive.SubContent
      data-slot="context-menu-sub-content"
      className={cn(
        "bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 min-w-[8rem] origin-(--radix-context-menu-content-transform-origin) overflow-hidden rounded-md border p-1 shadow-lg",
        className
      )}
      {...props}
    />
  )
}

function ContextMenuContent({
  className,
  ...props
}: React.ComponentProps<typeof ContextMenuPrimitive.Content>) {
  return (
    <ContextMenuPrimitive.Portal>
      <ContextMenuPrimitive.Content
        data-slot="context-menu-content"
        className={cn(
          "bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 max-h-(--radix-context-menu-content-available-height) min-w-[8rem] origin-(--radix-context-menu-content-transform-origin) overflow-x-hidden overflow-y-auto rounded-md border p-1 shadow-md",
          className
        )}
        {...props}
      />
    </ContextMenuPrimitive.Portal>
  )
}

function ContextMenuItem({
  className,
  inset,
  variant = "default",
  ...props
}: React.ComponentProps<typeof ContextMenuPrimitive.Item> & {
  inset?: boolean
  variant?: "default" | "destructive"
}) {
  return (
    <ContextMenuPrimitive.Item
      data-slot="context-menu-item"
      data-inset={inset}
      data-variant={variant}
      className={cn(
        "focus:bg-accent focus:text-accent-foreground data-[variant=destructive]:text-destructive data-[variant=destructive]:focus:bg-destructive/10 dark:data-[variant=destructive]:focus:bg-destructive/20 data-[variant=destructive]:focus:text-destructive data-[variant=destructive]:*:[svg]:!text-destructive [&_svg:not([class*='text-'])]:text-muted-foreground relative flex cursor-default items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-hidden select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 data-[inset]:pl-8 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    />
  )
}

function ContextMenuCheckboxItem({
  className,
  children,
  checked,
  ...props
}: React.ComponentProps<typeof ContextMenuPrimitive.CheckboxItem>) {
  return (
    <ContextMenuPrimitive.CheckboxItem
      data-slot="context-menu-checkbox-item"
      className={cn(
        "focus:bg-accent focus:text-accent-foreground relative flex cursor-default items-center gap-2 rounded-sm py-1.5 pr-2 pl-8 text-sm outline-hidden select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      checked={checked}
      {...props}
    >
      <span className="pointer-events-none absolute left-2 flex size-3.5 items-center justify-center">
        <ContextMenuPrimitive.ItemIndicator>
          <CheckIcon className="size-4" />
        </ContextMenuPrimitive.ItemIndicator>
      </span>
      {children}
    </ContextMenuPrimitive.CheckboxItem>
  )
}

function ContextMenuRadioItem({
  className,
  children,
  ...props
}: React.ComponentProps<typeof ContextMenuPrimitive.RadioItem>) {
  return (
    <ContextMenuPrimitive.RadioItem
      data-slot="context-menu-radio-item"
      className={cn(
        "focus:bg-accent focus:text-accent-foreground relative flex cursor-default items-center gap-2 rounded-sm py-1.5 pr-2 pl-8 text-sm outline-hidden select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    >
      <span className="pointer-events-none absolute left-2 flex size-3.5 items-center justify-center">
        <ContextMenuPrimitive.ItemIndicator>
          <CircleIcon className="size-2 fill-current" />
        </ContextMenuPrimitive.ItemIndicator>
      </span>
      {children}
    </ContextMenuPrimitive.RadioItem>
  )
}

function ContextMenuLabel({
  className,
  inset,
  ...props
}: React.ComponentProps<typeof ContextMenuPrimitive.Label> & {
  inset?: boolean
}) {
  return (
    <ContextMenuPrimitive.Label
      data-slot="context-menu-label"
      data-inset={inset}
      className={cn("text-foreground px-2 py-1.5 text-sm font-medium data-[inset]:pl-8", className)}
      {...props}
    />
  )
}

function ContextMenuSeparator({
  className,
  ...props
}: React.ComponentProps<typeof ContextMenuPrimitive.Separator>) {
  return (
    <ContextMenuPrimitive.Separator
      data-slot="context-menu-separator"
      className={cn("bg-border -mx-1 my-1 h-px", className)}
      {...props}
    />
  )
}

function ContextMenuShortcut({ className, ...props }: React.ComponentProps<"span">) {
  return (
    <span
      data-slot="context-menu-shortcut"
      className={cn("text-muted-foreground ml-auto text-xs tracking-widest", className)}
      {...props}
    />
  )
}

export {
  ContextMenu,
  ContextMenuTrigger,
  ContextMenuContent,
  ContextMenuItem,
  ContextMenuCheckboxItem,
  ContextMenuRadioItem,
  ContextMenuLabel,
  ContextMenuSeparator,
  ContextMenuShortcut,
  ContextMenuGroup,
  ContextMenuPortal,
  ContextMenuSub,
  ContextMenuSubContent,
  ContextMenuSubTrigger,
  ContextMenuRadioGroup,
}
</file>

<file path="ui/src/components/ui/dialog.tsx">
import * as React from "react"
import * as DialogPrimitive from "@radix-ui/react-dialog"
import { XIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function Dialog({ ...props }: React.ComponentProps<typeof DialogPrimitive.Root>) {
  return <DialogPrimitive.Root data-slot="dialog" {...props} />
}

function DialogTrigger({ ...props }: React.ComponentProps<typeof DialogPrimitive.Trigger>) {
  return <DialogPrimitive.Trigger data-slot="dialog-trigger" {...props} />
}

function DialogPortal({ ...props }: React.ComponentProps<typeof DialogPrimitive.Portal>) {
  return <DialogPrimitive.Portal data-slot="dialog-portal" {...props} />
}

function DialogClose({ ...props }: React.ComponentProps<typeof DialogPrimitive.Close>) {
  return <DialogPrimitive.Close data-slot="dialog-close" {...props} />
}

function DialogOverlay({
  className,
  ...props
}: React.ComponentProps<typeof DialogPrimitive.Overlay>) {
  return (
    <DialogPrimitive.Overlay
      data-slot="dialog-overlay"
      className={cn(
        "data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-50 bg-black/50",
        className
      )}
      {...props}
    />
  )
}

function DialogContent({
  className,
  children,
  showCloseButton = true,
  ...props
}: React.ComponentProps<typeof DialogPrimitive.Content> & {
  showCloseButton?: boolean
}) {
  return (
    <DialogPortal data-slot="dialog-portal">
      <DialogOverlay />
      <DialogPrimitive.Content
        data-slot="dialog-content"
        className={cn(
          "bg-background data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 fixed top-[50%] left-[50%] z-50 grid w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] gap-4 rounded-lg border p-6 shadow-lg duration-200 sm:max-w-lg",
          className
        )}
        {...props}
      >
        {children}
        {showCloseButton && (
          <DialogPrimitive.Close
            data-slot="dialog-close"
            className="ring-offset-background focus:ring-ring data-[state=open]:bg-accent data-[state=open]:text-muted-foreground absolute top-4 right-4 rounded-xs opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-hidden disabled:pointer-events-none [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4"
          >
            <XIcon />
            <span className="sr-only">Close</span>
          </DialogPrimitive.Close>
        )}
      </DialogPrimitive.Content>
    </DialogPortal>
  )
}

function DialogHeader({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="dialog-header"
      className={cn("flex flex-col gap-2 text-center sm:text-left", className)}
      {...props}
    />
  )
}

function DialogFooter({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="dialog-footer"
      className={cn("flex flex-col-reverse gap-2 sm:flex-row sm:justify-end", className)}
      {...props}
    />
  )
}

function DialogTitle({ className, ...props }: React.ComponentProps<typeof DialogPrimitive.Title>) {
  return (
    <DialogPrimitive.Title
      data-slot="dialog-title"
      className={cn("text-lg leading-none font-semibold", className)}
      {...props}
    />
  )
}

function DialogDescription({
  className,
  ...props
}: React.ComponentProps<typeof DialogPrimitive.Description>) {
  return (
    <DialogPrimitive.Description
      data-slot="dialog-description"
      className={cn("text-muted-foreground text-sm", className)}
      {...props}
    />
  )
}

export {
  Dialog,
  DialogClose,
  DialogContent,
  DialogDescription,
  DialogFooter,
  DialogHeader,
  DialogOverlay,
  DialogPortal,
  DialogTitle,
  DialogTrigger,
}
</file>

<file path="ui/src/components/ui/drawer.tsx">
"use client"

import * as React from "react"
import { Drawer as DrawerPrimitive } from "vaul"

import { cn } from "@/lib/utils"

function Drawer({ ...props }: React.ComponentProps<typeof DrawerPrimitive.Root>) {
  return <DrawerPrimitive.Root data-slot="drawer" {...props} />
}

function DrawerTrigger({ ...props }: React.ComponentProps<typeof DrawerPrimitive.Trigger>) {
  return <DrawerPrimitive.Trigger data-slot="drawer-trigger" {...props} />
}

function DrawerPortal({ ...props }: React.ComponentProps<typeof DrawerPrimitive.Portal>) {
  return <DrawerPrimitive.Portal data-slot="drawer-portal" {...props} />
}

function DrawerClose({ ...props }: React.ComponentProps<typeof DrawerPrimitive.Close>) {
  return <DrawerPrimitive.Close data-slot="drawer-close" {...props} />
}

function DrawerOverlay({
  className,
  ...props
}: React.ComponentProps<typeof DrawerPrimitive.Overlay>) {
  return (
    <DrawerPrimitive.Overlay
      data-slot="drawer-overlay"
      className={cn(
        "data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-50 bg-black/50",
        className
      )}
      {...props}
    />
  )
}

function DrawerContent({
  className,
  children,
  ...props
}: React.ComponentProps<typeof DrawerPrimitive.Content>) {
  return (
    <DrawerPortal data-slot="drawer-portal">
      <DrawerOverlay />
      <DrawerPrimitive.Content
        data-slot="drawer-content"
        className={cn(
          "group/drawer-content bg-background fixed z-50 flex h-auto flex-col",
          "data-[vaul-drawer-direction=top]:inset-x-0 data-[vaul-drawer-direction=top]:top-0 data-[vaul-drawer-direction=top]:mb-24 data-[vaul-drawer-direction=top]:max-h-[80vh] data-[vaul-drawer-direction=top]:rounded-b-lg data-[vaul-drawer-direction=top]:border-b",
          "data-[vaul-drawer-direction=bottom]:inset-x-0 data-[vaul-drawer-direction=bottom]:bottom-0 data-[vaul-drawer-direction=bottom]:mt-24 data-[vaul-drawer-direction=bottom]:max-h-[80vh] data-[vaul-drawer-direction=bottom]:rounded-t-lg data-[vaul-drawer-direction=bottom]:border-t",
          "data-[vaul-drawer-direction=right]:inset-y-0 data-[vaul-drawer-direction=right]:right-0 data-[vaul-drawer-direction=right]:w-3/4 data-[vaul-drawer-direction=right]:border-l data-[vaul-drawer-direction=right]:sm:max-w-sm",
          "data-[vaul-drawer-direction=left]:inset-y-0 data-[vaul-drawer-direction=left]:left-0 data-[vaul-drawer-direction=left]:w-3/4 data-[vaul-drawer-direction=left]:border-r data-[vaul-drawer-direction=left]:sm:max-w-sm",
          className
        )}
        {...props}
      >
        <div className="bg-muted mx-auto mt-4 hidden h-2 w-[100px] shrink-0 rounded-full group-data-[vaul-drawer-direction=bottom]/drawer-content:block" />
        {children}
      </DrawerPrimitive.Content>
    </DrawerPortal>
  )
}

function DrawerHeader({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="drawer-header"
      className={cn(
        "flex flex-col gap-0.5 p-4 group-data-[vaul-drawer-direction=bottom]/drawer-content:text-center group-data-[vaul-drawer-direction=top]/drawer-content:text-center md:gap-1.5 md:text-left",
        className
      )}
      {...props}
    />
  )
}

function DrawerFooter({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="drawer-footer"
      className={cn("mt-auto flex flex-col gap-2 p-4", className)}
      {...props}
    />
  )
}

function DrawerTitle({ className, ...props }: React.ComponentProps<typeof DrawerPrimitive.Title>) {
  return (
    <DrawerPrimitive.Title
      data-slot="drawer-title"
      className={cn("text-foreground font-semibold", className)}
      {...props}
    />
  )
}

function DrawerDescription({
  className,
  ...props
}: React.ComponentProps<typeof DrawerPrimitive.Description>) {
  return (
    <DrawerPrimitive.Description
      data-slot="drawer-description"
      className={cn("text-muted-foreground text-sm", className)}
      {...props}
    />
  )
}

export {
  Drawer,
  DrawerPortal,
  DrawerOverlay,
  DrawerTrigger,
  DrawerClose,
  DrawerContent,
  DrawerHeader,
  DrawerFooter,
  DrawerTitle,
  DrawerDescription,
}
</file>

<file path="ui/src/components/ui/dropdown-menu.tsx">
import * as React from "react"
import * as DropdownMenuPrimitive from "@radix-ui/react-dropdown-menu"
import { CheckIcon, ChevronRightIcon, CircleIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function DropdownMenu({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) {
  return <DropdownMenuPrimitive.Root data-slot="dropdown-menu" {...props} />
}

function DropdownMenuPortal({
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.Portal>) {
  return <DropdownMenuPrimitive.Portal data-slot="dropdown-menu-portal" {...props} />
}

function DropdownMenuTrigger({
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.Trigger>) {
  return <DropdownMenuPrimitive.Trigger data-slot="dropdown-menu-trigger" {...props} />
}

function DropdownMenuContent({
  className,
  sideOffset = 4,
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.Content>) {
  return (
    <DropdownMenuPrimitive.Portal>
      <DropdownMenuPrimitive.Content
        data-slot="dropdown-menu-content"
        sideOffset={sideOffset}
        className={cn(
          "bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 max-h-(--radix-dropdown-menu-content-available-height) min-w-[8rem] origin-(--radix-dropdown-menu-content-transform-origin) overflow-x-hidden overflow-y-auto rounded-md border p-1 shadow-md",
          className
        )}
        {...props}
      />
    </DropdownMenuPrimitive.Portal>
  )
}

function DropdownMenuGroup({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Group>) {
  return <DropdownMenuPrimitive.Group data-slot="dropdown-menu-group" {...props} />
}

function DropdownMenuItem({
  className,
  inset,
  variant = "default",
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.Item> & {
  inset?: boolean
  variant?: "default" | "destructive"
}) {
  return (
    <DropdownMenuPrimitive.Item
      data-slot="dropdown-menu-item"
      data-inset={inset}
      data-variant={variant}
      className={cn(
        "focus:bg-accent focus:text-accent-foreground data-[variant=destructive]:text-destructive data-[variant=destructive]:focus:bg-destructive/10 dark:data-[variant=destructive]:focus:bg-destructive/20 data-[variant=destructive]:focus:text-destructive data-[variant=destructive]:*:[svg]:!text-destructive [&_svg:not([class*='text-'])]:text-muted-foreground relative flex cursor-default items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-hidden select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 data-[inset]:pl-8 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    />
  )
}

function DropdownMenuCheckboxItem({
  className,
  children,
  checked,
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.CheckboxItem>) {
  return (
    <DropdownMenuPrimitive.CheckboxItem
      data-slot="dropdown-menu-checkbox-item"
      className={cn(
        "focus:bg-accent focus:text-accent-foreground relative flex cursor-default items-center gap-2 rounded-sm py-1.5 pr-2 pl-8 text-sm outline-hidden select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      checked={checked}
      {...props}
    >
      <span className="pointer-events-none absolute left-2 flex size-3.5 items-center justify-center">
        <DropdownMenuPrimitive.ItemIndicator>
          <CheckIcon className="size-4" />
        </DropdownMenuPrimitive.ItemIndicator>
      </span>
      {children}
    </DropdownMenuPrimitive.CheckboxItem>
  )
}

function DropdownMenuRadioGroup({
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioGroup>) {
  return <DropdownMenuPrimitive.RadioGroup data-slot="dropdown-menu-radio-group" {...props} />
}

function DropdownMenuRadioItem({
  className,
  children,
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioItem>) {
  return (
    <DropdownMenuPrimitive.RadioItem
      data-slot="dropdown-menu-radio-item"
      className={cn(
        "focus:bg-accent focus:text-accent-foreground relative flex cursor-default items-center gap-2 rounded-sm py-1.5 pr-2 pl-8 text-sm outline-hidden select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    >
      <span className="pointer-events-none absolute left-2 flex size-3.5 items-center justify-center">
        <DropdownMenuPrimitive.ItemIndicator>
          <CircleIcon className="size-2 fill-current" />
        </DropdownMenuPrimitive.ItemIndicator>
      </span>
      {children}
    </DropdownMenuPrimitive.RadioItem>
  )
}

function DropdownMenuLabel({
  className,
  inset,
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.Label> & {
  inset?: boolean
}) {
  return (
    <DropdownMenuPrimitive.Label
      data-slot="dropdown-menu-label"
      data-inset={inset}
      className={cn("px-2 py-1.5 text-sm font-medium data-[inset]:pl-8", className)}
      {...props}
    />
  )
}

function DropdownMenuSeparator({
  className,
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.Separator>) {
  return (
    <DropdownMenuPrimitive.Separator
      data-slot="dropdown-menu-separator"
      className={cn("bg-border -mx-1 my-1 h-px", className)}
      {...props}
    />
  )
}

function DropdownMenuShortcut({ className, ...props }: React.ComponentProps<"span">) {
  return (
    <span
      data-slot="dropdown-menu-shortcut"
      className={cn("text-muted-foreground ml-auto text-xs tracking-widest", className)}
      {...props}
    />
  )
}

function DropdownMenuSub({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Sub>) {
  return <DropdownMenuPrimitive.Sub data-slot="dropdown-menu-sub" {...props} />
}

function DropdownMenuSubTrigger({
  className,
  inset,
  children,
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.SubTrigger> & {
  inset?: boolean
}) {
  return (
    <DropdownMenuPrimitive.SubTrigger
      data-slot="dropdown-menu-sub-trigger"
      data-inset={inset}
      className={cn(
        "focus:bg-accent focus:text-accent-foreground data-[state=open]:bg-accent data-[state=open]:text-accent-foreground [&_svg:not([class*='text-'])]:text-muted-foreground flex cursor-default items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-hidden select-none data-[inset]:pl-8 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    >
      {children}
      <ChevronRightIcon className="ml-auto size-4" />
    </DropdownMenuPrimitive.SubTrigger>
  )
}

function DropdownMenuSubContent({
  className,
  ...props
}: React.ComponentProps<typeof DropdownMenuPrimitive.SubContent>) {
  return (
    <DropdownMenuPrimitive.SubContent
      data-slot="dropdown-menu-sub-content"
      className={cn(
        "bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 min-w-[8rem] origin-(--radix-dropdown-menu-content-transform-origin) overflow-hidden rounded-md border p-1 shadow-lg",
        className
      )}
      {...props}
    />
  )
}

export {
  DropdownMenu,
  DropdownMenuPortal,
  DropdownMenuTrigger,
  DropdownMenuContent,
  DropdownMenuGroup,
  DropdownMenuLabel,
  DropdownMenuItem,
  DropdownMenuCheckboxItem,
  DropdownMenuRadioGroup,
  DropdownMenuRadioItem,
  DropdownMenuSeparator,
  DropdownMenuShortcut,
  DropdownMenuSub,
  DropdownMenuSubTrigger,
  DropdownMenuSubContent,
}
</file>

<file path="ui/src/components/ui/empty.tsx">
import { cva, type VariantProps } from "class-variance-authority"

import { cn } from "@/lib/utils"

function Empty({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="empty"
      className={cn(
        "flex min-w-0 flex-1 flex-col items-center justify-center gap-6 rounded-lg border-dashed p-6 text-center text-balance md:p-12",
        className
      )}
      {...props}
    />
  )
}

function EmptyHeader({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="empty-header"
      className={cn("flex max-w-sm flex-col items-center gap-2 text-center", className)}
      {...props}
    />
  )
}

const emptyMediaVariants = cva(
  "flex shrink-0 items-center justify-center mb-2 [&_svg]:pointer-events-none [&_svg]:shrink-0",
  {
    variants: {
      variant: {
        default: "bg-transparent",
        icon: "bg-muted text-foreground flex size-10 shrink-0 items-center justify-center rounded-lg [&_svg:not([class*='size-'])]:size-6",
      },
    },
    defaultVariants: {
      variant: "default",
    },
  }
)

function EmptyMedia({
  className,
  variant = "default",
  ...props
}: React.ComponentProps<"div"> & VariantProps<typeof emptyMediaVariants>) {
  return (
    <div
      data-slot="empty-icon"
      data-variant={variant}
      className={cn(emptyMediaVariants({ variant, className }))}
      {...props}
    />
  )
}

function EmptyTitle({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="empty-title"
      className={cn("text-lg font-medium tracking-tight", className)}
      {...props}
    />
  )
}

function EmptyDescription({ className, ...props }: React.ComponentProps<"p">) {
  return (
    <div
      data-slot="empty-description"
      className={cn(
        "text-muted-foreground [&>a:hover]:text-primary text-sm/relaxed [&>a]:underline [&>a]:underline-offset-4",
        className
      )}
      {...props}
    />
  )
}

function EmptyContent({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="empty-content"
      className={cn(
        "flex w-full max-w-sm min-w-0 flex-col items-center gap-4 text-sm text-balance",
        className
      )}
      {...props}
    />
  )
}

export { Empty, EmptyHeader, EmptyTitle, EmptyDescription, EmptyContent, EmptyMedia }
</file>

<file path="ui/src/components/ui/field.tsx">
import { useMemo } from "react"
import { cva, type VariantProps } from "class-variance-authority"

import { cn } from "@/lib/utils"
import { Label } from "@/components/ui/label"
import { Separator } from "@/components/ui/separator"

function FieldSet({ className, ...props }: React.ComponentProps<"fieldset">) {
  return (
    <fieldset
      data-slot="field-set"
      className={cn(
        "flex flex-col gap-6",
        "has-[>[data-slot=checkbox-group]]:gap-3 has-[>[data-slot=radio-group]]:gap-3",
        className
      )}
      {...props}
    />
  )
}

function FieldLegend({
  className,
  variant = "legend",
  ...props
}: React.ComponentProps<"legend"> & { variant?: "legend" | "label" }) {
  return (
    <legend
      data-slot="field-legend"
      data-variant={variant}
      className={cn(
        "mb-3 font-medium",
        "data-[variant=legend]:text-base",
        "data-[variant=label]:text-sm",
        className
      )}
      {...props}
    />
  )
}

function FieldGroup({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="field-group"
      className={cn(
        "group/field-group @container/field-group flex w-full flex-col gap-7 data-[slot=checkbox-group]:gap-3 [&>[data-slot=field-group]]:gap-4",
        className
      )}
      {...props}
    />
  )
}

const fieldVariants = cva("group/field flex w-full gap-3 data-[invalid=true]:text-destructive", {
  variants: {
    orientation: {
      vertical: ["flex-col [&>*]:w-full [&>.sr-only]:w-auto"],
      horizontal: [
        "flex-row items-center",
        "[&>[data-slot=field-label]]:flex-auto",
        "has-[>[data-slot=field-content]]:items-start has-[>[data-slot=field-content]]:[&>[role=checkbox],[role=radio]]:mt-px",
      ],
      responsive: [
        "flex-col [&>*]:w-full [&>.sr-only]:w-auto @md/field-group:flex-row @md/field-group:items-center @md/field-group:[&>*]:w-auto",
        "@md/field-group:[&>[data-slot=field-label]]:flex-auto",
        "@md/field-group:has-[>[data-slot=field-content]]:items-start @md/field-group:has-[>[data-slot=field-content]]:[&>[role=checkbox],[role=radio]]:mt-px",
      ],
    },
  },
  defaultVariants: {
    orientation: "vertical",
  },
})

function Field({
  className,
  orientation = "vertical",
  ...props
}: React.ComponentProps<"div"> & VariantProps<typeof fieldVariants>) {
  return (
    <div
      role="group"
      data-slot="field"
      data-orientation={orientation}
      className={cn(fieldVariants({ orientation }), className)}
      {...props}
    />
  )
}

function FieldContent({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="field-content"
      className={cn("group/field-content flex flex-1 flex-col gap-1.5 leading-snug", className)}
      {...props}
    />
  )
}

function FieldLabel({ className, ...props }: React.ComponentProps<typeof Label>) {
  return (
    <Label
      data-slot="field-label"
      className={cn(
        "group/field-label peer/field-label flex w-fit gap-2 leading-snug group-data-[disabled=true]/field:opacity-50",
        "has-[>[data-slot=field]]:w-full has-[>[data-slot=field]]:flex-col has-[>[data-slot=field]]:rounded-md has-[>[data-slot=field]]:border [&>*]:data-[slot=field]:p-4",
        "has-data-[state=checked]:bg-primary/5 has-data-[state=checked]:border-primary dark:has-data-[state=checked]:bg-primary/10",
        className
      )}
      {...props}
    />
  )
}

function FieldTitle({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="field-label"
      className={cn(
        "flex w-fit items-center gap-2 text-sm leading-snug font-medium group-data-[disabled=true]/field:opacity-50",
        className
      )}
      {...props}
    />
  )
}

function FieldDescription({ className, ...props }: React.ComponentProps<"p">) {
  return (
    <p
      data-slot="field-description"
      className={cn(
        "text-muted-foreground text-sm leading-normal font-normal group-has-[[data-orientation=horizontal]]/field:text-balance",
        "last:mt-0 nth-last-2:-mt-1 [[data-variant=legend]+&]:-mt-1.5",
        "[&>a:hover]:text-primary [&>a]:underline [&>a]:underline-offset-4",
        className
      )}
      {...props}
    />
  )
}

function FieldSeparator({
  children,
  className,
  ...props
}: React.ComponentProps<"div"> & {
  children?: React.ReactNode
}) {
  return (
    <div
      data-slot="field-separator"
      data-content={!!children}
      className={cn(
        "relative -my-2 h-5 text-sm group-data-[variant=outline]/field-group:-mb-2",
        className
      )}
      {...props}
    >
      <Separator className="absolute inset-0 top-1/2" />
      {children && (
        <span
          className="bg-background text-muted-foreground relative mx-auto block w-fit px-2"
          data-slot="field-separator-content"
        >
          {children}
        </span>
      )}
    </div>
  )
}

function FieldError({
  className,
  children,
  errors,
  ...props
}: React.ComponentProps<"div"> & {
  errors?: Array<{ message?: string } | undefined>
}) {
  const content = useMemo(() => {
    if (children) {
      return children
    }

    if (!errors?.length) {
      return null
    }

    const uniqueErrors = [...new Map(errors.map((error) => [error?.message, error])).values()]

    if (uniqueErrors?.length == 1) {
      return uniqueErrors[0]?.message
    }

    return (
      <ul className="ml-4 flex list-disc flex-col gap-1">
        {uniqueErrors.map((error, index) => error?.message && <li key={index}>{error.message}</li>)}
      </ul>
    )
  }, [children, errors])

  if (!content) {
    return null
  }

  return (
    <div
      role="alert"
      data-slot="field-error"
      className={cn("text-destructive text-sm font-normal", className)}
      {...props}
    >
      {content}
    </div>
  )
}

export {
  Field,
  FieldLabel,
  FieldDescription,
  FieldError,
  FieldGroup,
  FieldLegend,
  FieldSeparator,
  FieldSet,
  FieldContent,
  FieldTitle,
}
</file>

<file path="ui/src/components/ui/form.tsx">
"use client"

import * as React from "react"
import * as LabelPrimitive from "@radix-ui/react-label"
import { Slot } from "@radix-ui/react-slot"
import {
  Controller,
  FormProvider,
  useFormContext,
  useFormState,
  type ControllerProps,
  type FieldPath,
  type FieldValues,
} from "react-hook-form"

import { cn } from "@/lib/utils"
import { Label } from "@/components/ui/label"

const Form = FormProvider

type FormFieldContextValue<
  TFieldValues extends FieldValues = FieldValues,
  TName extends FieldPath<TFieldValues> = FieldPath<TFieldValues>,
> = {
  name: TName
}

const FormFieldContext = React.createContext<FormFieldContextValue>({} as FormFieldContextValue)

const FormField = <
  TFieldValues extends FieldValues = FieldValues,
  TName extends FieldPath<TFieldValues> = FieldPath<TFieldValues>,
>({
  ...props
}: ControllerProps<TFieldValues, TName>) => {
  return (
    <FormFieldContext.Provider value={{ name: props.name }}>
      <Controller {...props} />
    </FormFieldContext.Provider>
  )
}

const useFormField = () => {
  const fieldContext = React.useContext(FormFieldContext)
  const itemContext = React.useContext(FormItemContext)
  const { getFieldState } = useFormContext()
  const formState = useFormState({ name: fieldContext.name })
  const fieldState = getFieldState(fieldContext.name, formState)

  if (!fieldContext) {
    throw new Error("useFormField should be used within <FormField>")
  }

  const { id } = itemContext

  return {
    id,
    name: fieldContext.name,
    formItemId: `${id}-form-item`,
    formDescriptionId: `${id}-form-item-description`,
    formMessageId: `${id}-form-item-message`,
    ...fieldState,
  }
}

type FormItemContextValue = {
  id: string
}

const FormItemContext = React.createContext<FormItemContextValue>({} as FormItemContextValue)

function FormItem({ className, ...props }: React.ComponentProps<"div">) {
  const id = React.useId()

  return (
    <FormItemContext.Provider value={{ id }}>
      <div data-slot="form-item" className={cn("grid gap-2", className)} {...props} />
    </FormItemContext.Provider>
  )
}

function FormLabel({ className, ...props }: React.ComponentProps<typeof LabelPrimitive.Root>) {
  const { error, formItemId } = useFormField()

  return (
    <Label
      data-slot="form-label"
      data-error={!!error}
      className={cn("data-[error=true]:text-destructive", className)}
      htmlFor={formItemId}
      {...props}
    />
  )
}

function FormControl({ ...props }: React.ComponentProps<typeof Slot>) {
  const { error, formItemId, formDescriptionId, formMessageId } = useFormField()

  return (
    <Slot
      data-slot="form-control"
      id={formItemId}
      aria-describedby={!error ? `${formDescriptionId}` : `${formDescriptionId} ${formMessageId}`}
      aria-invalid={!!error}
      {...props}
    />
  )
}

function FormDescription({ className, ...props }: React.ComponentProps<"p">) {
  const { formDescriptionId } = useFormField()

  return (
    <p
      data-slot="form-description"
      id={formDescriptionId}
      className={cn("text-muted-foreground text-sm", className)}
      {...props}
    />
  )
}

function FormMessage({ className, ...props }: React.ComponentProps<"p">) {
  const { error, formMessageId } = useFormField()
  const body = error ? String(error?.message ?? "") : props.children

  if (!body) {
    return null
  }

  return (
    <p
      data-slot="form-message"
      id={formMessageId}
      className={cn("text-destructive text-sm", className)}
      {...props}
    >
      {body}
    </p>
  )
}

export {
  useFormField,
  Form,
  FormItem,
  FormLabel,
  FormControl,
  FormDescription,
  FormMessage,
  FormField,
}
</file>

<file path="ui/src/components/ui/hover-card.tsx">
"use client"

import * as React from "react"
import * as HoverCardPrimitive from "@radix-ui/react-hover-card"

import { cn } from "@/lib/utils"

function HoverCard({ ...props }: React.ComponentProps<typeof HoverCardPrimitive.Root>) {
  return <HoverCardPrimitive.Root data-slot="hover-card" {...props} />
}

function HoverCardTrigger({ ...props }: React.ComponentProps<typeof HoverCardPrimitive.Trigger>) {
  return <HoverCardPrimitive.Trigger data-slot="hover-card-trigger" {...props} />
}

function HoverCardContent({
  className,
  align = "center",
  sideOffset = 4,
  ...props
}: React.ComponentProps<typeof HoverCardPrimitive.Content>) {
  return (
    <HoverCardPrimitive.Portal data-slot="hover-card-portal">
      <HoverCardPrimitive.Content
        data-slot="hover-card-content"
        align={align}
        sideOffset={sideOffset}
        className={cn(
          "bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-64 origin-(--radix-hover-card-content-transform-origin) rounded-md border p-4 shadow-md outline-hidden",
          className
        )}
        {...props}
      />
    </HoverCardPrimitive.Portal>
  )
}

export { HoverCard, HoverCardTrigger, HoverCardContent }
</file>

<file path="ui/src/components/ui/input-group.tsx">
"use client"

import * as React from "react"
import { cva, type VariantProps } from "class-variance-authority"

import { cn } from "@/lib/utils"
import { Button } from "@/components/ui/button"
import { Input } from "@/components/ui/input"
import { Textarea } from "@/components/ui/textarea"

function InputGroup({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="input-group"
      role="group"
      className={cn(
        "group/input-group border-input dark:bg-input/30 relative flex w-full items-center rounded-md border shadow-xs transition-[color,box-shadow] outline-none",
        "h-9 min-w-0 has-[>textarea]:h-auto",

        // Variants based on alignment.
        "has-[>[data-align=inline-start]]:[&>input]:pl-2",
        "has-[>[data-align=inline-end]]:[&>input]:pr-2",
        "has-[>[data-align=block-start]]:h-auto has-[>[data-align=block-start]]:flex-col has-[>[data-align=block-start]]:[&>input]:pb-3",
        "has-[>[data-align=block-end]]:h-auto has-[>[data-align=block-end]]:flex-col has-[>[data-align=block-end]]:[&>input]:pt-3",

        // Focus state.
        "has-[[data-slot=input-group-control]:focus-visible]:border-ring has-[[data-slot=input-group-control]:focus-visible]:ring-ring/50 has-[[data-slot=input-group-control]:focus-visible]:ring-[3px]",

        // Error state.
        "has-[[data-slot][aria-invalid=true]]:ring-destructive/20 has-[[data-slot][aria-invalid=true]]:border-destructive dark:has-[[data-slot][aria-invalid=true]]:ring-destructive/40",

        className
      )}
      {...props}
    />
  )
}

const inputGroupAddonVariants = cva(
  "text-muted-foreground flex h-auto cursor-text items-center justify-center gap-2 py-1.5 text-sm font-medium select-none [&>svg:not([class*='size-'])]:size-4 [&>kbd]:rounded-[calc(var(--radius)-5px)] group-data-[disabled=true]/input-group:opacity-50",
  {
    variants: {
      align: {
        "inline-start": "order-first pl-3 has-[>button]:ml-[-0.45rem] has-[>kbd]:ml-[-0.35rem]",
        "inline-end": "order-last pr-3 has-[>button]:mr-[-0.45rem] has-[>kbd]:mr-[-0.35rem]",
        "block-start":
          "order-first w-full justify-start px-3 pt-3 [.border-b]:pb-3 group-has-[>input]/input-group:pt-2.5",
        "block-end":
          "order-last w-full justify-start px-3 pb-3 [.border-t]:pt-3 group-has-[>input]/input-group:pb-2.5",
      },
    },
    defaultVariants: {
      align: "inline-start",
    },
  }
)

function InputGroupAddon({
  className,
  align = "inline-start",
  ...props
}: React.ComponentProps<"div"> & VariantProps<typeof inputGroupAddonVariants>) {
  return (
    <div
      role="group"
      data-slot="input-group-addon"
      data-align={align}
      className={cn(inputGroupAddonVariants({ align }), className)}
      onClick={(e) => {
        if ((e.target as HTMLElement).closest("button")) {
          return
        }
        e.currentTarget.parentElement?.querySelector("input")?.focus()
      }}
      {...props}
    />
  )
}

const inputGroupButtonVariants = cva("text-sm shadow-none flex gap-2 items-center", {
  variants: {
    size: {
      xs: "h-6 gap-1 px-2 rounded-[calc(var(--radius)-5px)] [&>svg:not([class*='size-'])]:size-3.5 has-[>svg]:px-2",
      sm: "h-8 px-2.5 gap-1.5 rounded-md has-[>svg]:px-2.5",
      "icon-xs": "size-6 rounded-[calc(var(--radius)-5px)] p-0 has-[>svg]:p-0",
      "icon-sm": "size-8 p-0 has-[>svg]:p-0",
    },
  },
  defaultVariants: {
    size: "xs",
  },
})

function InputGroupButton({
  className,
  type = "button",
  variant = "ghost",
  size = "xs",
  ...props
}: Omit<React.ComponentProps<typeof Button>, "size"> &
  VariantProps<typeof inputGroupButtonVariants>) {
  return (
    <Button
      type={type}
      data-size={size}
      variant={variant}
      className={cn(inputGroupButtonVariants({ size }), className)}
      {...props}
    />
  )
}

function InputGroupText({ className, ...props }: React.ComponentProps<"span">) {
  return (
    <span
      className={cn(
        "text-muted-foreground flex items-center gap-2 text-sm [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    />
  )
}

function InputGroupInput({ className, ...props }: React.ComponentProps<"input">) {
  return (
    <Input
      data-slot="input-group-control"
      className={cn(
        "flex-1 rounded-none border-0 bg-transparent shadow-none focus-visible:ring-0 dark:bg-transparent",
        className
      )}
      {...props}
    />
  )
}

function InputGroupTextarea({ className, ...props }: React.ComponentProps<"textarea">) {
  return (
    <Textarea
      data-slot="input-group-control"
      className={cn(
        "flex-1 resize-none rounded-none border-0 bg-transparent py-3 shadow-none focus-visible:ring-0 dark:bg-transparent",
        className
      )}
      {...props}
    />
  )
}

export {
  InputGroup,
  InputGroupAddon,
  InputGroupButton,
  InputGroupText,
  InputGroupInput,
  InputGroupTextarea,
}
</file>

<file path="ui/src/components/ui/input-otp.tsx">
import * as React from "react"
import { OTPInput, OTPInputContext } from "input-otp"
import { MinusIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function InputOTP({
  className,
  containerClassName,
  ...props
}: React.ComponentProps<typeof OTPInput> & {
  containerClassName?: string
}) {
  return (
    <OTPInput
      data-slot="input-otp"
      containerClassName={cn("flex items-center gap-2 has-disabled:opacity-50", containerClassName)}
      className={cn("disabled:cursor-not-allowed", className)}
      {...props}
    />
  )
}

function InputOTPGroup({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div data-slot="input-otp-group" className={cn("flex items-center", className)} {...props} />
  )
}

function InputOTPSlot({
  index,
  className,
  ...props
}: React.ComponentProps<"div"> & {
  index: number
}) {
  const inputOTPContext = React.useContext(OTPInputContext)
  const { char, hasFakeCaret, isActive } = inputOTPContext?.slots[index] ?? {}

  return (
    <div
      data-slot="input-otp-slot"
      data-active={isActive}
      className={cn(
        "data-[active=true]:border-ring data-[active=true]:ring-ring/50 data-[active=true]:aria-invalid:ring-destructive/20 dark:data-[active=true]:aria-invalid:ring-destructive/40 aria-invalid:border-destructive data-[active=true]:aria-invalid:border-destructive dark:bg-input/30 border-input relative flex h-9 w-9 items-center justify-center border-y border-r text-sm shadow-xs transition-all outline-none first:rounded-l-md first:border-l last:rounded-r-md data-[active=true]:z-10 data-[active=true]:ring-[3px]",
        className
      )}
      {...props}
    >
      {char}
      {hasFakeCaret && (
        <div className="pointer-events-none absolute inset-0 flex items-center justify-center">
          <div className="animate-caret-blink bg-foreground h-4 w-px duration-1000" />
        </div>
      )}
    </div>
  )
}

function InputOTPSeparator({ ...props }: React.ComponentProps<"div">) {
  return (
    <div data-slot="input-otp-separator" role="separator" {...props}>
      <MinusIcon />
    </div>
  )
}

export { InputOTP, InputOTPGroup, InputOTPSlot, InputOTPSeparator }
</file>

<file path="ui/src/components/ui/input.tsx">
import * as React from "react"

import { cn } from "@/lib/utils"

function Input({ className, type, ...props }: React.ComponentProps<"input">) {
  return (
    <input
      type={type}
      data-slot="input"
      className={cn(
        "file:text-foreground placeholder:text-muted-foreground selection:bg-primary selection:text-primary-foreground dark:bg-input/30 border-input h-9 w-full min-w-0 rounded-md border bg-transparent px-3 py-1 text-base shadow-xs transition-[color,box-shadow] outline-none file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
        "focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px]",
        "aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive",
        className
      )}
      {...props}
    />
  )
}

export { Input }
</file>

<file path="ui/src/components/ui/item.tsx">
import * as React from "react"
import { Slot } from "@radix-ui/react-slot"
import { cva, type VariantProps } from "class-variance-authority"

import { cn } from "@/lib/utils"
import { Separator } from "@/components/ui/separator"

function ItemGroup({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      role="list"
      data-slot="item-group"
      className={cn("group/item-group flex flex-col", className)}
      {...props}
    />
  )
}

function ItemSeparator({ className, ...props }: React.ComponentProps<typeof Separator>) {
  return (
    <Separator
      data-slot="item-separator"
      orientation="horizontal"
      className={cn("my-0", className)}
      {...props}
    />
  )
}

const itemVariants = cva(
  "group/item flex items-center border border-transparent text-sm rounded-md transition-colors [a]:hover:bg-accent/50 [a]:transition-colors duration-100 flex-wrap outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px]",
  {
    variants: {
      variant: {
        default: "bg-transparent",
        outline: "border-border",
        muted: "bg-muted/50",
      },
      size: {
        default: "p-4 gap-4 ",
        sm: "py-3 px-4 gap-2.5",
      },
    },
    defaultVariants: {
      variant: "default",
      size: "default",
    },
  }
)

function Item({
  className,
  variant = "default",
  size = "default",
  asChild = false,
  ...props
}: React.ComponentProps<"div"> & VariantProps<typeof itemVariants> & { asChild?: boolean }) {
  const Comp = asChild ? Slot : "div"
  return (
    <Comp
      data-slot="item"
      data-variant={variant}
      data-size={size}
      className={cn(itemVariants({ variant, size, className }))}
      {...props}
    />
  )
}

const itemMediaVariants = cva(
  "flex shrink-0 items-center justify-center gap-2 group-has-[[data-slot=item-description]]/item:self-start [&_svg]:pointer-events-none group-has-[[data-slot=item-description]]/item:translate-y-0.5",
  {
    variants: {
      variant: {
        default: "bg-transparent",
        icon: "size-8 border rounded-sm bg-muted [&_svg:not([class*='size-'])]:size-4",
        image: "size-10 rounded-sm overflow-hidden [&_img]:size-full [&_img]:object-cover",
      },
    },
    defaultVariants: {
      variant: "default",
    },
  }
)

function ItemMedia({
  className,
  variant = "default",
  ...props
}: React.ComponentProps<"div"> & VariantProps<typeof itemMediaVariants>) {
  return (
    <div
      data-slot="item-media"
      data-variant={variant}
      className={cn(itemMediaVariants({ variant, className }))}
      {...props}
    />
  )
}

function ItemContent({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="item-content"
      className={cn("flex flex-1 flex-col gap-1 [&+[data-slot=item-content]]:flex-none", className)}
      {...props}
    />
  )
}

function ItemTitle({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="item-title"
      className={cn("flex w-fit items-center gap-2 text-sm leading-snug font-medium", className)}
      {...props}
    />
  )
}

function ItemDescription({ className, ...props }: React.ComponentProps<"p">) {
  return (
    <p
      data-slot="item-description"
      className={cn(
        "text-muted-foreground line-clamp-2 text-sm leading-normal font-normal text-balance",
        "[&>a:hover]:text-primary [&>a]:underline [&>a]:underline-offset-4",
        className
      )}
      {...props}
    />
  )
}

function ItemActions({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div data-slot="item-actions" className={cn("flex items-center gap-2", className)} {...props} />
  )
}

function ItemHeader({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="item-header"
      className={cn("flex basis-full items-center justify-between gap-2", className)}
      {...props}
    />
  )
}

function ItemFooter({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="item-footer"
      className={cn("flex basis-full items-center justify-between gap-2", className)}
      {...props}
    />
  )
}

export {
  Item,
  ItemMedia,
  ItemContent,
  ItemActions,
  ItemGroup,
  ItemSeparator,
  ItemTitle,
  ItemDescription,
  ItemHeader,
  ItemFooter,
}
</file>

<file path="ui/src/components/ui/kbd.tsx">
import { cn } from "@/lib/utils"

function Kbd({ className, ...props }: React.ComponentProps<"kbd">) {
  return (
    <kbd
      data-slot="kbd"
      className={cn(
        "bg-muted text-muted-foreground pointer-events-none inline-flex h-5 w-fit min-w-5 items-center justify-center gap-1 rounded-sm px-1 font-sans text-xs font-medium select-none",
        "[&_svg:not([class*='size-'])]:size-3",
        "[[data-slot=tooltip-content]_&]:bg-background/20 [[data-slot=tooltip-content]_&]:text-background dark:[[data-slot=tooltip-content]_&]:bg-background/10",
        className
      )}
      {...props}
    />
  )
}

function KbdGroup({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <kbd
      data-slot="kbd-group"
      className={cn("inline-flex items-center gap-1", className)}
      {...props}
    />
  )
}

export { Kbd, KbdGroup }
</file>

<file path="ui/src/components/ui/label.tsx">
"use client"

import * as React from "react"
import * as LabelPrimitive from "@radix-ui/react-label"

import { cn } from "@/lib/utils"

function Label({ className, ...props }: React.ComponentProps<typeof LabelPrimitive.Root>) {
  return (
    <LabelPrimitive.Root
      data-slot="label"
      className={cn(
        "flex items-center gap-2 text-sm leading-none font-medium select-none group-data-[disabled=true]:pointer-events-none group-data-[disabled=true]:opacity-50 peer-disabled:cursor-not-allowed peer-disabled:opacity-50",
        className
      )}
      {...props}
    />
  )
}

export { Label }
</file>

<file path="ui/src/components/ui/menubar.tsx">
import * as React from "react"
import * as MenubarPrimitive from "@radix-ui/react-menubar"
import { CheckIcon, ChevronRightIcon, CircleIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function Menubar({ className, ...props }: React.ComponentProps<typeof MenubarPrimitive.Root>) {
  return (
    <MenubarPrimitive.Root
      data-slot="menubar"
      className={cn(
        "bg-background flex h-9 items-center gap-1 rounded-md border p-1 shadow-xs",
        className
      )}
      {...props}
    />
  )
}

function MenubarMenu({ ...props }: React.ComponentProps<typeof MenubarPrimitive.Menu>) {
  return <MenubarPrimitive.Menu data-slot="menubar-menu" {...props} />
}

function MenubarGroup({ ...props }: React.ComponentProps<typeof MenubarPrimitive.Group>) {
  return <MenubarPrimitive.Group data-slot="menubar-group" {...props} />
}

function MenubarPortal({ ...props }: React.ComponentProps<typeof MenubarPrimitive.Portal>) {
  return <MenubarPrimitive.Portal data-slot="menubar-portal" {...props} />
}

function MenubarRadioGroup({ ...props }: React.ComponentProps<typeof MenubarPrimitive.RadioGroup>) {
  return <MenubarPrimitive.RadioGroup data-slot="menubar-radio-group" {...props} />
}

function MenubarTrigger({
  className,
  ...props
}: React.ComponentProps<typeof MenubarPrimitive.Trigger>) {
  return (
    <MenubarPrimitive.Trigger
      data-slot="menubar-trigger"
      className={cn(
        "focus:bg-accent focus:text-accent-foreground data-[state=open]:bg-accent data-[state=open]:text-accent-foreground flex items-center rounded-sm px-2 py-1 text-sm font-medium outline-hidden select-none",
        className
      )}
      {...props}
    />
  )
}

function MenubarContent({
  className,
  align = "start",
  alignOffset = -4,
  sideOffset = 8,
  ...props
}: React.ComponentProps<typeof MenubarPrimitive.Content>) {
  return (
    <MenubarPortal>
      <MenubarPrimitive.Content
        data-slot="menubar-content"
        align={align}
        alignOffset={alignOffset}
        sideOffset={sideOffset}
        className={cn(
          "bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 min-w-[12rem] origin-(--radix-menubar-content-transform-origin) overflow-hidden rounded-md border p-1 shadow-md",
          className
        )}
        {...props}
      />
    </MenubarPortal>
  )
}

function MenubarItem({
  className,
  inset,
  variant = "default",
  ...props
}: React.ComponentProps<typeof MenubarPrimitive.Item> & {
  inset?: boolean
  variant?: "default" | "destructive"
}) {
  return (
    <MenubarPrimitive.Item
      data-slot="menubar-item"
      data-inset={inset}
      data-variant={variant}
      className={cn(
        "focus:bg-accent focus:text-accent-foreground data-[variant=destructive]:text-destructive data-[variant=destructive]:focus:bg-destructive/10 dark:data-[variant=destructive]:focus:bg-destructive/20 data-[variant=destructive]:focus:text-destructive data-[variant=destructive]:*:[svg]:!text-destructive [&_svg:not([class*='text-'])]:text-muted-foreground relative flex cursor-default items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-hidden select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 data-[inset]:pl-8 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    />
  )
}

function MenubarCheckboxItem({
  className,
  children,
  checked,
  ...props
}: React.ComponentProps<typeof MenubarPrimitive.CheckboxItem>) {
  return (
    <MenubarPrimitive.CheckboxItem
      data-slot="menubar-checkbox-item"
      className={cn(
        "focus:bg-accent focus:text-accent-foreground relative flex cursor-default items-center gap-2 rounded-xs py-1.5 pr-2 pl-8 text-sm outline-hidden select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      checked={checked}
      {...props}
    >
      <span className="pointer-events-none absolute left-2 flex size-3.5 items-center justify-center">
        <MenubarPrimitive.ItemIndicator>
          <CheckIcon className="size-4" />
        </MenubarPrimitive.ItemIndicator>
      </span>
      {children}
    </MenubarPrimitive.CheckboxItem>
  )
}

function MenubarRadioItem({
  className,
  children,
  ...props
}: React.ComponentProps<typeof MenubarPrimitive.RadioItem>) {
  return (
    <MenubarPrimitive.RadioItem
      data-slot="menubar-radio-item"
      className={cn(
        "focus:bg-accent focus:text-accent-foreground relative flex cursor-default items-center gap-2 rounded-xs py-1.5 pr-2 pl-8 text-sm outline-hidden select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    >
      <span className="pointer-events-none absolute left-2 flex size-3.5 items-center justify-center">
        <MenubarPrimitive.ItemIndicator>
          <CircleIcon className="size-2 fill-current" />
        </MenubarPrimitive.ItemIndicator>
      </span>
      {children}
    </MenubarPrimitive.RadioItem>
  )
}

function MenubarLabel({
  className,
  inset,
  ...props
}: React.ComponentProps<typeof MenubarPrimitive.Label> & {
  inset?: boolean
}) {
  return (
    <MenubarPrimitive.Label
      data-slot="menubar-label"
      data-inset={inset}
      className={cn("px-2 py-1.5 text-sm font-medium data-[inset]:pl-8", className)}
      {...props}
    />
  )
}

function MenubarSeparator({
  className,
  ...props
}: React.ComponentProps<typeof MenubarPrimitive.Separator>) {
  return (
    <MenubarPrimitive.Separator
      data-slot="menubar-separator"
      className={cn("bg-border -mx-1 my-1 h-px", className)}
      {...props}
    />
  )
}

function MenubarShortcut({ className, ...props }: React.ComponentProps<"span">) {
  return (
    <span
      data-slot="menubar-shortcut"
      className={cn("text-muted-foreground ml-auto text-xs tracking-widest", className)}
      {...props}
    />
  )
}

function MenubarSub({ ...props }: React.ComponentProps<typeof MenubarPrimitive.Sub>) {
  return <MenubarPrimitive.Sub data-slot="menubar-sub" {...props} />
}

function MenubarSubTrigger({
  className,
  inset,
  children,
  ...props
}: React.ComponentProps<typeof MenubarPrimitive.SubTrigger> & {
  inset?: boolean
}) {
  return (
    <MenubarPrimitive.SubTrigger
      data-slot="menubar-sub-trigger"
      data-inset={inset}
      className={cn(
        "focus:bg-accent focus:text-accent-foreground data-[state=open]:bg-accent data-[state=open]:text-accent-foreground flex cursor-default items-center rounded-sm px-2 py-1.5 text-sm outline-none select-none data-[inset]:pl-8",
        className
      )}
      {...props}
    >
      {children}
      <ChevronRightIcon className="ml-auto h-4 w-4" />
    </MenubarPrimitive.SubTrigger>
  )
}

function MenubarSubContent({
  className,
  ...props
}: React.ComponentProps<typeof MenubarPrimitive.SubContent>) {
  return (
    <MenubarPrimitive.SubContent
      data-slot="menubar-sub-content"
      className={cn(
        "bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 min-w-[8rem] origin-(--radix-menubar-content-transform-origin) overflow-hidden rounded-md border p-1 shadow-lg",
        className
      )}
      {...props}
    />
  )
}

export {
  Menubar,
  MenubarPortal,
  MenubarMenu,
  MenubarTrigger,
  MenubarContent,
  MenubarGroup,
  MenubarSeparator,
  MenubarLabel,
  MenubarItem,
  MenubarShortcut,
  MenubarCheckboxItem,
  MenubarRadioGroup,
  MenubarRadioItem,
  MenubarSub,
  MenubarSubTrigger,
  MenubarSubContent,
}
</file>

<file path="ui/src/components/ui/navigation-menu.tsx">
import * as React from "react"
import * as NavigationMenuPrimitive from "@radix-ui/react-navigation-menu"
import { cva } from "class-variance-authority"
import { ChevronDownIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function NavigationMenu({
  className,
  children,
  viewport = true,
  ...props
}: React.ComponentProps<typeof NavigationMenuPrimitive.Root> & {
  viewport?: boolean
}) {
  return (
    <NavigationMenuPrimitive.Root
      data-slot="navigation-menu"
      data-viewport={viewport}
      className={cn(
        "group/navigation-menu relative flex max-w-max flex-1 items-center justify-center",
        className
      )}
      {...props}
    >
      {children}
      {viewport && <NavigationMenuViewport />}
    </NavigationMenuPrimitive.Root>
  )
}

function NavigationMenuList({
  className,
  ...props
}: React.ComponentProps<typeof NavigationMenuPrimitive.List>) {
  return (
    <NavigationMenuPrimitive.List
      data-slot="navigation-menu-list"
      className={cn("group flex flex-1 list-none items-center justify-center gap-1", className)}
      {...props}
    />
  )
}

function NavigationMenuItem({
  className,
  ...props
}: React.ComponentProps<typeof NavigationMenuPrimitive.Item>) {
  return (
    <NavigationMenuPrimitive.Item
      data-slot="navigation-menu-item"
      className={cn("relative", className)}
      {...props}
    />
  )
}

const navigationMenuTriggerStyle = cva(
  "group inline-flex h-9 w-max items-center justify-center rounded-md bg-background px-4 py-2 text-sm font-medium hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground disabled:pointer-events-none disabled:opacity-50 data-[state=open]:hover:bg-accent data-[state=open]:text-accent-foreground data-[state=open]:focus:bg-accent data-[state=open]:bg-accent/50 focus-visible:ring-ring/50 outline-none transition-[color,box-shadow] focus-visible:ring-[3px] focus-visible:outline-1"
)

function NavigationMenuTrigger({
  className,
  children,
  ...props
}: React.ComponentProps<typeof NavigationMenuPrimitive.Trigger>) {
  return (
    <NavigationMenuPrimitive.Trigger
      data-slot="navigation-menu-trigger"
      className={cn(navigationMenuTriggerStyle(), "group", className)}
      {...props}
    >
      {children}{" "}
      <ChevronDownIcon
        className="relative top-[1px] ml-1 size-3 transition duration-300 group-data-[state=open]:rotate-180"
        aria-hidden="true"
      />
    </NavigationMenuPrimitive.Trigger>
  )
}

function NavigationMenuContent({
  className,
  ...props
}: React.ComponentProps<typeof NavigationMenuPrimitive.Content>) {
  return (
    <NavigationMenuPrimitive.Content
      data-slot="navigation-menu-content"
      className={cn(
        "data-[motion^=from-]:animate-in data-[motion^=to-]:animate-out data-[motion^=from-]:fade-in data-[motion^=to-]:fade-out data-[motion=from-end]:slide-in-from-right-52 data-[motion=from-start]:slide-in-from-left-52 data-[motion=to-end]:slide-out-to-right-52 data-[motion=to-start]:slide-out-to-left-52 top-0 left-0 w-full p-2 pr-2.5 md:absolute md:w-auto",
        "group-data-[viewport=false]/navigation-menu:bg-popover group-data-[viewport=false]/navigation-menu:text-popover-foreground group-data-[viewport=false]/navigation-menu:data-[state=open]:animate-in group-data-[viewport=false]/navigation-menu:data-[state=closed]:animate-out group-data-[viewport=false]/navigation-menu:data-[state=closed]:zoom-out-95 group-data-[viewport=false]/navigation-menu:data-[state=open]:zoom-in-95 group-data-[viewport=false]/navigation-menu:data-[state=open]:fade-in-0 group-data-[viewport=false]/navigation-menu:data-[state=closed]:fade-out-0 group-data-[viewport=false]/navigation-menu:top-full group-data-[viewport=false]/navigation-menu:mt-1.5 group-data-[viewport=false]/navigation-menu:overflow-hidden group-data-[viewport=false]/navigation-menu:rounded-md group-data-[viewport=false]/navigation-menu:border group-data-[viewport=false]/navigation-menu:shadow group-data-[viewport=false]/navigation-menu:duration-200 **:data-[slot=navigation-menu-link]:focus:ring-0 **:data-[slot=navigation-menu-link]:focus:outline-none",
        className
      )}
      {...props}
    />
  )
}

function NavigationMenuViewport({
  className,
  ...props
}: React.ComponentProps<typeof NavigationMenuPrimitive.Viewport>) {
  return (
    <div className={cn("absolute top-full left-0 isolate z-50 flex justify-center")}>
      <NavigationMenuPrimitive.Viewport
        data-slot="navigation-menu-viewport"
        className={cn(
          "origin-top-center bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-90 relative mt-1.5 h-[var(--radix-navigation-menu-viewport-height)] w-full overflow-hidden rounded-md border shadow md:w-[var(--radix-navigation-menu-viewport-width)]",
          className
        )}
        {...props}
      />
    </div>
  )
}

function NavigationMenuLink({
  className,
  ...props
}: React.ComponentProps<typeof NavigationMenuPrimitive.Link>) {
  return (
    <NavigationMenuPrimitive.Link
      data-slot="navigation-menu-link"
      className={cn(
        "data-[active=true]:focus:bg-accent data-[active=true]:hover:bg-accent data-[active=true]:bg-accent/50 data-[active=true]:text-accent-foreground hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground focus-visible:ring-ring/50 [&_svg:not([class*='text-'])]:text-muted-foreground flex flex-col gap-1 rounded-sm p-2 text-sm transition-all outline-none focus-visible:ring-[3px] focus-visible:outline-1 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    />
  )
}

function NavigationMenuIndicator({
  className,
  ...props
}: React.ComponentProps<typeof NavigationMenuPrimitive.Indicator>) {
  return (
    <NavigationMenuPrimitive.Indicator
      data-slot="navigation-menu-indicator"
      className={cn(
        "data-[state=visible]:animate-in data-[state=hidden]:animate-out data-[state=hidden]:fade-out data-[state=visible]:fade-in top-full z-[1] flex h-1.5 items-end justify-center overflow-hidden",
        className
      )}
      {...props}
    >
      <div className="bg-border relative top-[60%] h-2 w-2 rotate-45 rounded-tl-sm shadow-md" />
    </NavigationMenuPrimitive.Indicator>
  )
}

export {
  NavigationMenu,
  NavigationMenuList,
  NavigationMenuItem,
  NavigationMenuContent,
  NavigationMenuTrigger,
  NavigationMenuLink,
  NavigationMenuIndicator,
  NavigationMenuViewport,
  navigationMenuTriggerStyle,
}
</file>

<file path="ui/src/components/ui/pagination.tsx">
import * as React from "react"
import { ChevronLeftIcon, ChevronRightIcon, MoreHorizontalIcon } from "lucide-react"

import { cn } from "@/lib/utils"
import { Button, buttonVariants } from "@/components/ui/button"

function Pagination({ className, ...props }: React.ComponentProps<"nav">) {
  return (
    <nav
      role="navigation"
      aria-label="pagination"
      data-slot="pagination"
      className={cn("mx-auto flex w-full justify-center", className)}
      {...props}
    />
  )
}

function PaginationContent({ className, ...props }: React.ComponentProps<"ul">) {
  return (
    <ul
      data-slot="pagination-content"
      className={cn("flex flex-row items-center gap-1", className)}
      {...props}
    />
  )
}

function PaginationItem({ ...props }: React.ComponentProps<"li">) {
  return <li data-slot="pagination-item" {...props} />
}

type PaginationLinkProps = {
  isActive?: boolean
} & Pick<React.ComponentProps<typeof Button>, "size"> &
  React.ComponentProps<"a">

function PaginationLink({ className, isActive, size = "icon", ...props }: PaginationLinkProps) {
  return (
    <a
      aria-current={isActive ? "page" : undefined}
      data-slot="pagination-link"
      data-active={isActive}
      className={cn(
        buttonVariants({
          variant: isActive ? "outline" : "ghost",
          size,
        }),
        className
      )}
      {...props}
    />
  )
}

function PaginationPrevious({ className, ...props }: React.ComponentProps<typeof PaginationLink>) {
  return (
    <PaginationLink
      aria-label="Go to previous page"
      size="default"
      className={cn("gap-1 px-2.5 sm:pl-2.5", className)}
      {...props}
    >
      <ChevronLeftIcon />
      <span className="hidden sm:block">Previous</span>
    </PaginationLink>
  )
}

function PaginationNext({ className, ...props }: React.ComponentProps<typeof PaginationLink>) {
  return (
    <PaginationLink
      aria-label="Go to next page"
      size="default"
      className={cn("gap-1 px-2.5 sm:pr-2.5", className)}
      {...props}
    >
      <span className="hidden sm:block">Next</span>
      <ChevronRightIcon />
    </PaginationLink>
  )
}

function PaginationEllipsis({ className, ...props }: React.ComponentProps<"span">) {
  return (
    <span
      aria-hidden
      data-slot="pagination-ellipsis"
      className={cn("flex size-9 items-center justify-center", className)}
      {...props}
    >
      <MoreHorizontalIcon className="size-4" />
      <span className="sr-only">More pages</span>
    </span>
  )
}

export {
  Pagination,
  PaginationContent,
  PaginationLink,
  PaginationItem,
  PaginationPrevious,
  PaginationNext,
  PaginationEllipsis,
}
</file>

<file path="ui/src/components/ui/popover.tsx">
"use client"

import * as React from "react"
import * as PopoverPrimitive from "@radix-ui/react-popover"

import { cn } from "@/lib/utils"

function Popover({ ...props }: React.ComponentProps<typeof PopoverPrimitive.Root>) {
  return <PopoverPrimitive.Root data-slot="popover" {...props} />
}

function PopoverTrigger({ ...props }: React.ComponentProps<typeof PopoverPrimitive.Trigger>) {
  return <PopoverPrimitive.Trigger data-slot="popover-trigger" {...props} />
}

function PopoverContent({
  className,
  align = "center",
  sideOffset = 4,
  ...props
}: React.ComponentProps<typeof PopoverPrimitive.Content>) {
  return (
    <PopoverPrimitive.Portal>
      <PopoverPrimitive.Content
        data-slot="popover-content"
        align={align}
        sideOffset={sideOffset}
        className={cn(
          "bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-72 origin-(--radix-popover-content-transform-origin) rounded-md border p-4 shadow-md outline-hidden",
          className
        )}
        {...props}
      />
    </PopoverPrimitive.Portal>
  )
}

function PopoverAnchor({ ...props }: React.ComponentProps<typeof PopoverPrimitive.Anchor>) {
  return <PopoverPrimitive.Anchor data-slot="popover-anchor" {...props} />
}

export { Popover, PopoverTrigger, PopoverContent, PopoverAnchor }
</file>

<file path="ui/src/components/ui/progress.tsx">
import * as React from "react"
import * as ProgressPrimitive from "@radix-ui/react-progress"

import { cn } from "@/lib/utils"

function Progress({
  className,
  value,
  ...props
}: React.ComponentProps<typeof ProgressPrimitive.Root>) {
  return (
    <ProgressPrimitive.Root
      data-slot="progress"
      className={cn("bg-primary/20 relative h-2 w-full overflow-hidden rounded-full", className)}
      {...props}
    >
      <ProgressPrimitive.Indicator
        data-slot="progress-indicator"
        className="bg-primary h-full w-full flex-1 transition-all"
        style={{ transform: `translateX(-${100 - (value || 0)}%)` }}
      />
    </ProgressPrimitive.Root>
  )
}

export { Progress }
</file>

<file path="ui/src/components/ui/radio-group.tsx">
"use client"

import * as React from "react"
import * as RadioGroupPrimitive from "@radix-ui/react-radio-group"
import { CircleIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function RadioGroup({
  className,
  ...props
}: React.ComponentProps<typeof RadioGroupPrimitive.Root>) {
  return (
    <RadioGroupPrimitive.Root
      data-slot="radio-group"
      className={cn("grid gap-3", className)}
      {...props}
    />
  )
}

function RadioGroupItem({
  className,
  ...props
}: React.ComponentProps<typeof RadioGroupPrimitive.Item>) {
  return (
    <RadioGroupPrimitive.Item
      data-slot="radio-group-item"
      className={cn(
        "border-input text-primary focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:bg-input/30 aspect-square size-4 shrink-0 rounded-full border shadow-xs transition-[color,box-shadow] outline-none focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50",
        className
      )}
      {...props}
    >
      <RadioGroupPrimitive.Indicator
        data-slot="radio-group-indicator"
        className="relative flex items-center justify-center"
      >
        <CircleIcon className="fill-primary absolute top-1/2 left-1/2 size-2 -translate-x-1/2 -translate-y-1/2" />
      </RadioGroupPrimitive.Indicator>
    </RadioGroupPrimitive.Item>
  )
}

export { RadioGroup, RadioGroupItem }
</file>

<file path="ui/src/components/ui/resizable.tsx">
import * as React from "react"
import { GripVerticalIcon } from "lucide-react"
import * as ResizablePrimitive from "react-resizable-panels"

import { cn } from "@/lib/utils"

function ResizablePanelGroup({
  className,
  ...props
}: React.ComponentProps<typeof ResizablePrimitive.PanelGroup>) {
  return (
    <ResizablePrimitive.PanelGroup
      data-slot="resizable-panel-group"
      className={cn("flex h-full w-full data-[panel-group-direction=vertical]:flex-col", className)}
      {...props}
    />
  )
}

function ResizablePanel({ ...props }: React.ComponentProps<typeof ResizablePrimitive.Panel>) {
  return <ResizablePrimitive.Panel data-slot="resizable-panel" {...props} />
}

function ResizableHandle({
  withHandle,
  className,
  ...props
}: React.ComponentProps<typeof ResizablePrimitive.PanelResizeHandle> & {
  withHandle?: boolean
}) {
  return (
    <ResizablePrimitive.PanelResizeHandle
      data-slot="resizable-handle"
      className={cn(
        "bg-border focus-visible:ring-ring relative flex w-px items-center justify-center after:absolute after:inset-y-0 after:left-1/2 after:w-1 after:-translate-x-1/2 focus-visible:ring-1 focus-visible:ring-offset-1 focus-visible:outline-hidden data-[panel-group-direction=vertical]:h-px data-[panel-group-direction=vertical]:w-full data-[panel-group-direction=vertical]:after:left-0 data-[panel-group-direction=vertical]:after:h-1 data-[panel-group-direction=vertical]:after:w-full data-[panel-group-direction=vertical]:after:translate-x-0 data-[panel-group-direction=vertical]:after:-translate-y-1/2 [&[data-panel-group-direction=vertical]>div]:rotate-90",
        className
      )}
      {...props}
    >
      {withHandle && (
        <div className="bg-border z-10 flex h-4 w-3 items-center justify-center rounded-xs border">
          <GripVerticalIcon className="size-2.5" />
        </div>
      )}
    </ResizablePrimitive.PanelResizeHandle>
  )
}

export { ResizablePanelGroup, ResizablePanel, ResizableHandle }
</file>

<file path="ui/src/components/ui/scroll-area.tsx">
"use client"

import * as React from "react"
import * as ScrollAreaPrimitive from "@radix-ui/react-scroll-area"

import { cn } from "@/lib/utils"

function ScrollArea({
  className,
  children,
  ...props
}: React.ComponentProps<typeof ScrollAreaPrimitive.Root>) {
  return (
    <ScrollAreaPrimitive.Root
      data-slot="scroll-area"
      className={cn("relative", className)}
      {...props}
    >
      <ScrollAreaPrimitive.Viewport
        data-slot="scroll-area-viewport"
        className="focus-visible:ring-ring/50 size-full rounded-[inherit] transition-[color,box-shadow] outline-none focus-visible:ring-[3px] focus-visible:outline-1"
      >
        {children}
      </ScrollAreaPrimitive.Viewport>
      <ScrollBar />
      <ScrollAreaPrimitive.Corner />
    </ScrollAreaPrimitive.Root>
  )
}

function ScrollBar({
  className,
  orientation = "vertical",
  ...props
}: React.ComponentProps<typeof ScrollAreaPrimitive.ScrollAreaScrollbar>) {
  return (
    <ScrollAreaPrimitive.ScrollAreaScrollbar
      data-slot="scroll-area-scrollbar"
      orientation={orientation}
      className={cn(
        "flex touch-none p-px transition-colors select-none",
        orientation === "vertical" && "h-full w-2.5 border-l border-l-transparent",
        orientation === "horizontal" && "h-2.5 flex-col border-t border-t-transparent",
        className
      )}
      {...props}
    >
      <ScrollAreaPrimitive.ScrollAreaThumb
        data-slot="scroll-area-thumb"
        className="bg-border relative flex-1 rounded-full"
      />
    </ScrollAreaPrimitive.ScrollAreaScrollbar>
  )
}

export { ScrollArea, ScrollBar }
</file>

<file path="ui/src/components/ui/select.tsx">
import * as React from "react"
import * as SelectPrimitive from "@radix-ui/react-select"
import { CheckIcon, ChevronDownIcon, ChevronUpIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function Select({ ...props }: React.ComponentProps<typeof SelectPrimitive.Root>) {
  return <SelectPrimitive.Root data-slot="select" {...props} />
}

function SelectGroup({ ...props }: React.ComponentProps<typeof SelectPrimitive.Group>) {
  return <SelectPrimitive.Group data-slot="select-group" {...props} />
}

function SelectValue({ ...props }: React.ComponentProps<typeof SelectPrimitive.Value>) {
  return <SelectPrimitive.Value data-slot="select-value" {...props} />
}

function SelectTrigger({
  className,
  size = "default",
  children,
  ...props
}: React.ComponentProps<typeof SelectPrimitive.Trigger> & {
  size?: "sm" | "default"
}) {
  return (
    <SelectPrimitive.Trigger
      data-slot="select-trigger"
      data-size={size}
      className={cn(
        "border-input data-[placeholder]:text-muted-foreground [&_svg:not([class*='text-'])]:text-muted-foreground focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:bg-input/30 dark:hover:bg-input/50 flex w-fit items-center justify-between gap-2 rounded-md border bg-transparent px-3 py-2 text-sm whitespace-nowrap shadow-xs transition-[color,box-shadow] outline-none focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50 data-[size=default]:h-9 data-[size=sm]:h-8 *:data-[slot=select-value]:line-clamp-1 *:data-[slot=select-value]:flex *:data-[slot=select-value]:items-center *:data-[slot=select-value]:gap-2 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    >
      {children}
      <SelectPrimitive.Icon asChild>
        <ChevronDownIcon className="size-4 opacity-50" />
      </SelectPrimitive.Icon>
    </SelectPrimitive.Trigger>
  )
}

function SelectContent({
  className,
  children,
  position = "popper",
  align = "center",
  ...props
}: React.ComponentProps<typeof SelectPrimitive.Content>) {
  return (
    <SelectPrimitive.Portal>
      <SelectPrimitive.Content
        data-slot="select-content"
        className={cn(
          "bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 relative z-50 max-h-(--radix-select-content-available-height) min-w-[8rem] origin-(--radix-select-content-transform-origin) overflow-x-hidden overflow-y-auto rounded-md border shadow-md",
          position === "popper" &&
            "data-[side=bottom]:translate-y-1 data-[side=left]:-translate-x-1 data-[side=right]:translate-x-1 data-[side=top]:-translate-y-1",
          className
        )}
        position={position}
        align={align}
        {...props}
      >
        <SelectScrollUpButton />
        <SelectPrimitive.Viewport
          className={cn(
            "p-1",
            position === "popper" &&
              "h-[var(--radix-select-trigger-height)] w-full min-w-[var(--radix-select-trigger-width)] scroll-my-1"
          )}
        >
          {children}
        </SelectPrimitive.Viewport>
        <SelectScrollDownButton />
      </SelectPrimitive.Content>
    </SelectPrimitive.Portal>
  )
}

function SelectLabel({ className, ...props }: React.ComponentProps<typeof SelectPrimitive.Label>) {
  return (
    <SelectPrimitive.Label
      data-slot="select-label"
      className={cn("text-muted-foreground px-2 py-1.5 text-xs", className)}
      {...props}
    />
  )
}

function SelectItem({
  className,
  children,
  ...props
}: React.ComponentProps<typeof SelectPrimitive.Item>) {
  return (
    <SelectPrimitive.Item
      data-slot="select-item"
      className={cn(
        "focus:bg-accent focus:text-accent-foreground [&_svg:not([class*='text-'])]:text-muted-foreground relative flex w-full cursor-default items-center gap-2 rounded-sm py-1.5 pr-8 pl-2 text-sm outline-hidden select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 *:[span]:last:flex *:[span]:last:items-center *:[span]:last:gap-2",
        className
      )}
      {...props}
    >
      <span className="absolute right-2 flex size-3.5 items-center justify-center">
        <SelectPrimitive.ItemIndicator>
          <CheckIcon className="size-4" />
        </SelectPrimitive.ItemIndicator>
      </span>
      <SelectPrimitive.ItemText>{children}</SelectPrimitive.ItemText>
    </SelectPrimitive.Item>
  )
}

function SelectSeparator({
  className,
  ...props
}: React.ComponentProps<typeof SelectPrimitive.Separator>) {
  return (
    <SelectPrimitive.Separator
      data-slot="select-separator"
      className={cn("bg-border pointer-events-none -mx-1 my-1 h-px", className)}
      {...props}
    />
  )
}

function SelectScrollUpButton({
  className,
  ...props
}: React.ComponentProps<typeof SelectPrimitive.ScrollUpButton>) {
  return (
    <SelectPrimitive.ScrollUpButton
      data-slot="select-scroll-up-button"
      className={cn("flex cursor-default items-center justify-center py-1", className)}
      {...props}
    >
      <ChevronUpIcon className="size-4" />
    </SelectPrimitive.ScrollUpButton>
  )
}

function SelectScrollDownButton({
  className,
  ...props
}: React.ComponentProps<typeof SelectPrimitive.ScrollDownButton>) {
  return (
    <SelectPrimitive.ScrollDownButton
      data-slot="select-scroll-down-button"
      className={cn("flex cursor-default items-center justify-center py-1", className)}
      {...props}
    >
      <ChevronDownIcon className="size-4" />
    </SelectPrimitive.ScrollDownButton>
  )
}

export {
  Select,
  SelectContent,
  SelectGroup,
  SelectItem,
  SelectLabel,
  SelectScrollDownButton,
  SelectScrollUpButton,
  SelectSeparator,
  SelectTrigger,
  SelectValue,
}
</file>

<file path="ui/src/components/ui/separator.tsx">
"use client"

import * as React from "react"
import * as SeparatorPrimitive from "@radix-ui/react-separator"

import { cn } from "@/lib/utils"

function Separator({
  className,
  orientation = "horizontal",
  decorative = true,
  ...props
}: React.ComponentProps<typeof SeparatorPrimitive.Root>) {
  return (
    <SeparatorPrimitive.Root
      data-slot="separator"
      decorative={decorative}
      orientation={orientation}
      className={cn(
        "bg-border shrink-0 data-[orientation=horizontal]:h-px data-[orientation=horizontal]:w-full data-[orientation=vertical]:h-full data-[orientation=vertical]:w-px",
        className
      )}
      {...props}
    />
  )
}

export { Separator }
</file>

<file path="ui/src/components/ui/sheet.tsx">
import * as React from "react"
import * as SheetPrimitive from "@radix-ui/react-dialog"
import { XIcon } from "lucide-react"

import { cn } from "@/lib/utils"

function Sheet({ ...props }: React.ComponentProps<typeof SheetPrimitive.Root>) {
  return <SheetPrimitive.Root data-slot="sheet" {...props} />
}

function SheetTrigger({ ...props }: React.ComponentProps<typeof SheetPrimitive.Trigger>) {
  return <SheetPrimitive.Trigger data-slot="sheet-trigger" {...props} />
}

function SheetClose({ ...props }: React.ComponentProps<typeof SheetPrimitive.Close>) {
  return <SheetPrimitive.Close data-slot="sheet-close" {...props} />
}

function SheetPortal({ ...props }: React.ComponentProps<typeof SheetPrimitive.Portal>) {
  return <SheetPrimitive.Portal data-slot="sheet-portal" {...props} />
}

function SheetOverlay({
  className,
  ...props
}: React.ComponentProps<typeof SheetPrimitive.Overlay>) {
  return (
    <SheetPrimitive.Overlay
      data-slot="sheet-overlay"
      className={cn(
        "data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-50 bg-black/50",
        className
      )}
      {...props}
    />
  )
}

function SheetContent({
  className,
  children,
  side = "right",
  ...props
}: React.ComponentProps<typeof SheetPrimitive.Content> & {
  side?: "top" | "right" | "bottom" | "left"
}) {
  return (
    <SheetPortal>
      <SheetOverlay />
      <SheetPrimitive.Content
        data-slot="sheet-content"
        className={cn(
          "bg-background data-[state=open]:animate-in data-[state=closed]:animate-out fixed z-50 flex flex-col gap-4 shadow-lg transition ease-in-out data-[state=closed]:duration-300 data-[state=open]:duration-500",
          side === "right" &&
            "data-[state=closed]:slide-out-to-right data-[state=open]:slide-in-from-right inset-y-0 right-0 h-full w-3/4 border-l sm:max-w-sm",
          side === "left" &&
            "data-[state=closed]:slide-out-to-left data-[state=open]:slide-in-from-left inset-y-0 left-0 h-full w-3/4 border-r sm:max-w-sm",
          side === "top" &&
            "data-[state=closed]:slide-out-to-top data-[state=open]:slide-in-from-top inset-x-0 top-0 h-auto border-b",
          side === "bottom" &&
            "data-[state=closed]:slide-out-to-bottom data-[state=open]:slide-in-from-bottom inset-x-0 bottom-0 h-auto border-t",
          className
        )}
        {...props}
      >
        {children}
        <SheetPrimitive.Close className="ring-offset-background focus:ring-ring data-[state=open]:bg-secondary absolute top-4 right-4 rounded-xs opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-hidden disabled:pointer-events-none">
          <XIcon className="size-4" />
          <span className="sr-only">Close</span>
        </SheetPrimitive.Close>
      </SheetPrimitive.Content>
    </SheetPortal>
  )
}

function SheetHeader({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="sheet-header"
      className={cn("flex flex-col gap-1.5 p-4", className)}
      {...props}
    />
  )
}

function SheetFooter({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="sheet-footer"
      className={cn("mt-auto flex flex-col gap-2 p-4", className)}
      {...props}
    />
  )
}

function SheetTitle({ className, ...props }: React.ComponentProps<typeof SheetPrimitive.Title>) {
  return (
    <SheetPrimitive.Title
      data-slot="sheet-title"
      className={cn("text-foreground font-semibold", className)}
      {...props}
    />
  )
}

function SheetDescription({
  className,
  ...props
}: React.ComponentProps<typeof SheetPrimitive.Description>) {
  return (
    <SheetPrimitive.Description
      data-slot="sheet-description"
      className={cn("text-muted-foreground text-sm", className)}
      {...props}
    />
  )
}

export {
  Sheet,
  SheetTrigger,
  SheetClose,
  SheetContent,
  SheetHeader,
  SheetFooter,
  SheetTitle,
  SheetDescription,
}
</file>

<file path="ui/src/components/ui/sidebar.tsx">
"use client"

import * as React from "react"
import { Slot } from "@radix-ui/react-slot"
import { cva, type VariantProps } from "class-variance-authority"
import { PanelLeftIcon } from "lucide-react"

import { cn } from "@/lib/utils"
import { useIsMobile } from "@/hooks/use-mobile"
import { Button } from "@/components/ui/button"
import { Input } from "@/components/ui/input"
import { Separator } from "@/components/ui/separator"
import {
  Sheet,
  SheetContent,
  SheetDescription,
  SheetHeader,
  SheetTitle,
} from "@/components/ui/sheet"
import { Skeleton } from "@/components/ui/skeleton"
import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip"

const SIDEBAR_COOKIE_NAME = "sidebar_state"
const SIDEBAR_COOKIE_MAX_AGE = 60 * 60 * 24 * 7
const SIDEBAR_WIDTH = "16rem"
const SIDEBAR_WIDTH_MOBILE = "18rem"
const SIDEBAR_WIDTH_ICON = "3rem"
const SIDEBAR_KEYBOARD_SHORTCUT = "b"

type SidebarContextProps = {
  state: "expanded" | "collapsed"
  open: boolean
  setOpen: (open: boolean) => void
  openMobile: boolean
  setOpenMobile: (open: boolean) => void
  isMobile: boolean
  toggleSidebar: () => void
}

const SidebarContext = React.createContext<SidebarContextProps | null>(null)

function useSidebar() {
  const context = React.useContext(SidebarContext)
  if (!context) {
    throw new Error("useSidebar must be used within a SidebarProvider.")
  }

  return context
}

function SidebarProvider({
  defaultOpen = true,
  open: openProp,
  onOpenChange: setOpenProp,
  className,
  style,
  children,
  ...props
}: React.ComponentProps<"div"> & {
  defaultOpen?: boolean
  open?: boolean
  onOpenChange?: (open: boolean) => void
}) {
  const isMobile = useIsMobile()
  const [openMobile, setOpenMobile] = React.useState(false)

  // This is the internal state of the sidebar.
  // We use openProp and setOpenProp for control from outside the component.
  const [_open, _setOpen] = React.useState(defaultOpen)
  const open = openProp ?? _open
  const setOpen = React.useCallback(
    (value: boolean | ((value: boolean) => boolean)) => {
      const openState = typeof value === "function" ? value(open) : value
      if (setOpenProp) {
        setOpenProp(openState)
      } else {
        _setOpen(openState)
      }

      // This sets the cookie to keep the sidebar state.
      document.cookie = `${SIDEBAR_COOKIE_NAME}=${openState}; path=/; max-age=${SIDEBAR_COOKIE_MAX_AGE}`
    },
    [setOpenProp, open]
  )

  // Helper to toggle the sidebar.
  const toggleSidebar = React.useCallback(() => {
    return isMobile ? setOpenMobile((open) => !open) : setOpen((open) => !open)
  }, [isMobile, setOpen, setOpenMobile])

  // Adds a keyboard shortcut to toggle the sidebar.
  React.useEffect(() => {
    const handleKeyDown = (event: KeyboardEvent) => {
      if (event.key === SIDEBAR_KEYBOARD_SHORTCUT && (event.metaKey || event.ctrlKey)) {
        event.preventDefault()
        toggleSidebar()
      }
    }

    window.addEventListener("keydown", handleKeyDown)
    return () => window.removeEventListener("keydown", handleKeyDown)
  }, [toggleSidebar])

  // We add a state so that we can do data-state="expanded" or "collapsed".
  // This makes it easier to style the sidebar with Tailwind classes.
  const state = open ? "expanded" : "collapsed"

  const contextValue = React.useMemo<SidebarContextProps>(
    () => ({
      state,
      open,
      setOpen,
      isMobile,
      openMobile,
      setOpenMobile,
      toggleSidebar,
    }),
    [state, open, setOpen, isMobile, openMobile, setOpenMobile, toggleSidebar]
  )

  return (
    <SidebarContext.Provider value={contextValue}>
      <TooltipProvider delayDuration={0}>
        <div
          data-slot="sidebar-wrapper"
          style={
            {
              "--sidebar-width": SIDEBAR_WIDTH,
              "--sidebar-width-icon": SIDEBAR_WIDTH_ICON,
              ...style,
            } as React.CSSProperties
          }
          className={cn(
            "group/sidebar-wrapper has-data-[variant=inset]:bg-sidebar flex min-h-svh w-full",
            className
          )}
          {...props}
        >
          {children}
        </div>
      </TooltipProvider>
    </SidebarContext.Provider>
  )
}

function Sidebar({
  side = "left",
  variant = "sidebar",
  collapsible = "offcanvas",
  className,
  children,
  ...props
}: React.ComponentProps<"div"> & {
  side?: "left" | "right"
  variant?: "sidebar" | "floating" | "inset"
  collapsible?: "offcanvas" | "icon" | "none"
}) {
  const { isMobile, state, openMobile, setOpenMobile } = useSidebar()

  if (collapsible === "none") {
    return (
      <div
        data-slot="sidebar"
        className={cn(
          "bg-sidebar text-sidebar-foreground flex h-full w-(--sidebar-width) flex-col",
          className
        )}
        {...props}
      >
        {children}
      </div>
    )
  }

  if (isMobile) {
    return (
      <Sheet open={openMobile} onOpenChange={setOpenMobile} {...props}>
        <SheetContent
          data-sidebar="sidebar"
          data-slot="sidebar"
          data-mobile="true"
          className="bg-sidebar text-sidebar-foreground w-(--sidebar-width) p-0 [&>button]:hidden"
          style={
            {
              "--sidebar-width": SIDEBAR_WIDTH_MOBILE,
            } as React.CSSProperties
          }
          side={side}
        >
          <SheetHeader className="sr-only">
            <SheetTitle>Sidebar</SheetTitle>
            <SheetDescription>Displays the mobile sidebar.</SheetDescription>
          </SheetHeader>
          <div className="flex h-full w-full flex-col">{children}</div>
        </SheetContent>
      </Sheet>
    )
  }

  return (
    <div
      className="group peer text-sidebar-foreground hidden md:block"
      data-state={state}
      data-collapsible={state === "collapsed" ? collapsible : ""}
      data-variant={variant}
      data-side={side}
      data-slot="sidebar"
    >
      {/* This is what handles the sidebar gap on desktop */}
      <div
        data-slot="sidebar-gap"
        className={cn(
          "relative w-(--sidebar-width) bg-transparent transition-[width] duration-200 ease-linear",
          "group-data-[collapsible=offcanvas]:w-0",
          "group-data-[side=right]:rotate-180",
          variant === "floating" || variant === "inset"
            ? "group-data-[collapsible=icon]:w-[calc(var(--sidebar-width-icon)+(--spacing(4)))]"
            : "group-data-[collapsible=icon]:w-(--sidebar-width-icon)"
        )}
      />
      <div
        data-slot="sidebar-container"
        className={cn(
          "fixed inset-y-0 z-10 hidden h-svh w-(--sidebar-width) transition-[left,right,width] duration-200 ease-linear md:flex",
          side === "left"
            ? "left-0 group-data-[collapsible=offcanvas]:left-[calc(var(--sidebar-width)*-1)]"
            : "right-0 group-data-[collapsible=offcanvas]:right-[calc(var(--sidebar-width)*-1)]",
          // Adjust the padding for floating and inset variants.
          variant === "floating" || variant === "inset"
            ? "p-2 group-data-[collapsible=icon]:w-[calc(var(--sidebar-width-icon)+(--spacing(4))+2px)]"
            : "group-data-[collapsible=icon]:w-(--sidebar-width-icon) group-data-[side=left]:border-r group-data-[side=right]:border-l",
          className
        )}
        {...props}
      >
        <div
          data-sidebar="sidebar"
          data-slot="sidebar-inner"
          className="bg-sidebar group-data-[variant=floating]:border-sidebar-border flex h-full w-full flex-col group-data-[variant=floating]:rounded-lg group-data-[variant=floating]:border group-data-[variant=floating]:shadow-sm"
        >
          {children}
        </div>
      </div>
    </div>
  )
}

function SidebarTrigger({ className, onClick, ...props }: React.ComponentProps<typeof Button>) {
  const { toggleSidebar } = useSidebar()

  return (
    <Button
      data-sidebar="trigger"
      data-slot="sidebar-trigger"
      variant="ghost"
      size="icon"
      className={cn("size-7", className)}
      onClick={(event) => {
        onClick?.(event)
        toggleSidebar()
      }}
      {...props}
    >
      <PanelLeftIcon />
      <span className="sr-only">Toggle Sidebar</span>
    </Button>
  )
}

function SidebarRail({ className, ...props }: React.ComponentProps<"button">) {
  const { toggleSidebar } = useSidebar()

  return (
    <button
      data-sidebar="rail"
      data-slot="sidebar-rail"
      aria-label="Toggle Sidebar"
      tabIndex={-1}
      onClick={toggleSidebar}
      title="Toggle Sidebar"
      className={cn(
        "hover:after:bg-sidebar-border absolute inset-y-0 z-20 hidden w-4 -translate-x-1/2 transition-all ease-linear group-data-[side=left]:-right-4 group-data-[side=right]:left-0 after:absolute after:inset-y-0 after:left-1/2 after:w-[2px] sm:flex",
        "in-data-[side=left]:cursor-w-resize in-data-[side=right]:cursor-e-resize",
        "[[data-side=left][data-state=collapsed]_&]:cursor-e-resize [[data-side=right][data-state=collapsed]_&]:cursor-w-resize",
        "hover:group-data-[collapsible=offcanvas]:bg-sidebar group-data-[collapsible=offcanvas]:translate-x-0 group-data-[collapsible=offcanvas]:after:left-full",
        "[[data-side=left][data-collapsible=offcanvas]_&]:-right-2",
        "[[data-side=right][data-collapsible=offcanvas]_&]:-left-2",
        className
      )}
      {...props}
    />
  )
}

function SidebarInset({ className, ...props }: React.ComponentProps<"main">) {
  return (
    <main
      data-slot="sidebar-inset"
      className={cn(
        "bg-background relative flex w-full flex-1 flex-col",
        "md:peer-data-[variant=inset]:m-2 md:peer-data-[variant=inset]:ml-0 md:peer-data-[variant=inset]:rounded-xl md:peer-data-[variant=inset]:shadow-sm md:peer-data-[variant=inset]:peer-data-[state=collapsed]:ml-2",
        className
      )}
      {...props}
    />
  )
}

function SidebarInput({ className, ...props }: React.ComponentProps<typeof Input>) {
  return (
    <Input
      data-slot="sidebar-input"
      data-sidebar="input"
      className={cn("bg-background h-8 w-full shadow-none", className)}
      {...props}
    />
  )
}

function SidebarHeader({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="sidebar-header"
      data-sidebar="header"
      className={cn("flex flex-col gap-2 p-2", className)}
      {...props}
    />
  )
}

function SidebarFooter({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="sidebar-footer"
      data-sidebar="footer"
      className={cn("flex flex-col gap-2 p-2", className)}
      {...props}
    />
  )
}

function SidebarSeparator({ className, ...props }: React.ComponentProps<typeof Separator>) {
  return (
    <Separator
      data-slot="sidebar-separator"
      data-sidebar="separator"
      className={cn("bg-sidebar-border mx-2 w-auto", className)}
      {...props}
    />
  )
}

function SidebarContent({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="sidebar-content"
      data-sidebar="content"
      className={cn(
        "flex min-h-0 flex-1 flex-col gap-2 overflow-auto group-data-[collapsible=icon]:overflow-hidden",
        className
      )}
      {...props}
    />
  )
}

function SidebarGroup({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="sidebar-group"
      data-sidebar="group"
      className={cn("relative flex w-full min-w-0 flex-col p-2", className)}
      {...props}
    />
  )
}

function SidebarGroupLabel({
  className,
  asChild = false,
  ...props
}: React.ComponentProps<"div"> & { asChild?: boolean }) {
  const Comp = asChild ? Slot : "div"

  return (
    <Comp
      data-slot="sidebar-group-label"
      data-sidebar="group-label"
      className={cn(
        "text-sidebar-foreground/70 ring-sidebar-ring flex h-8 shrink-0 items-center rounded-md px-2 text-xs font-medium outline-hidden transition-[margin,opacity] duration-200 ease-linear focus-visible:ring-2 [&>svg]:size-4 [&>svg]:shrink-0",
        "group-data-[collapsible=icon]:-mt-8 group-data-[collapsible=icon]:opacity-0",
        className
      )}
      {...props}
    />
  )
}

function SidebarGroupAction({
  className,
  asChild = false,
  ...props
}: React.ComponentProps<"button"> & { asChild?: boolean }) {
  const Comp = asChild ? Slot : "button"

  return (
    <Comp
      data-slot="sidebar-group-action"
      data-sidebar="group-action"
      className={cn(
        "text-sidebar-foreground ring-sidebar-ring hover:bg-sidebar-accent hover:text-sidebar-accent-foreground absolute top-3.5 right-3 flex aspect-square w-5 items-center justify-center rounded-md p-0 outline-hidden transition-transform focus-visible:ring-2 [&>svg]:size-4 [&>svg]:shrink-0",
        // Increases the hit area of the button on mobile.
        "after:absolute after:-inset-2 md:after:hidden",
        "group-data-[collapsible=icon]:hidden",
        className
      )}
      {...props}
    />
  )
}

function SidebarGroupContent({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="sidebar-group-content"
      data-sidebar="group-content"
      className={cn("w-full text-sm", className)}
      {...props}
    />
  )
}

function SidebarMenu({ className, ...props }: React.ComponentProps<"ul">) {
  return (
    <ul
      data-slot="sidebar-menu"
      data-sidebar="menu"
      className={cn("flex w-full min-w-0 flex-col gap-1", className)}
      {...props}
    />
  )
}

function SidebarMenuItem({ className, ...props }: React.ComponentProps<"li">) {
  return (
    <li
      data-slot="sidebar-menu-item"
      data-sidebar="menu-item"
      className={cn("group/menu-item relative", className)}
      {...props}
    />
  )
}

const sidebarMenuButtonVariants = cva(
  "peer/menu-button flex w-full items-center gap-2 overflow-hidden rounded-md p-2 text-left text-sm outline-hidden ring-sidebar-ring transition-[width,height,padding] hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 group-has-data-[sidebar=menu-action]/menu-item:pr-8 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-[active=true]:bg-sidebar-accent data-[active=true]:font-medium data-[active=true]:text-sidebar-accent-foreground data-[state=open]:hover:bg-sidebar-accent data-[state=open]:hover:text-sidebar-accent-foreground group-data-[collapsible=icon]:size-8! group-data-[collapsible=icon]:p-2! [&>span:last-child]:truncate [&>svg]:size-4 [&>svg]:shrink-0",
  {
    variants: {
      variant: {
        default: "hover:bg-sidebar-accent hover:text-sidebar-accent-foreground",
        outline:
          "bg-background shadow-[0_0_0_1px_hsl(var(--sidebar-border))] hover:bg-sidebar-accent hover:text-sidebar-accent-foreground hover:shadow-[0_0_0_1px_hsl(var(--sidebar-accent))]",
      },
      size: {
        default: "h-8 text-sm",
        sm: "h-7 text-xs",
        lg: "h-12 text-sm group-data-[collapsible=icon]:p-0!",
      },
    },
    defaultVariants: {
      variant: "default",
      size: "default",
    },
  }
)

function SidebarMenuButton({
  asChild = false,
  isActive = false,
  variant = "default",
  size = "default",
  tooltip,
  className,
  ...props
}: React.ComponentProps<"button"> & {
  asChild?: boolean
  isActive?: boolean
  tooltip?: string | React.ComponentProps<typeof TooltipContent>
} & VariantProps<typeof sidebarMenuButtonVariants>) {
  const Comp = asChild ? Slot : "button"
  const { isMobile, state } = useSidebar()

  const button = (
    <Comp
      data-slot="sidebar-menu-button"
      data-sidebar="menu-button"
      data-size={size}
      data-active={isActive}
      className={cn(sidebarMenuButtonVariants({ variant, size }), className)}
      {...props}
    />
  )

  if (!tooltip) {
    return button
  }

  if (typeof tooltip === "string") {
    tooltip = {
      children: tooltip,
    }
  }

  return (
    <Tooltip>
      <TooltipTrigger asChild>{button}</TooltipTrigger>
      <TooltipContent
        side="right"
        align="center"
        hidden={state !== "collapsed" || isMobile}
        {...tooltip}
      />
    </Tooltip>
  )
}

function SidebarMenuAction({
  className,
  asChild = false,
  showOnHover = false,
  ...props
}: React.ComponentProps<"button"> & {
  asChild?: boolean
  showOnHover?: boolean
}) {
  const Comp = asChild ? Slot : "button"

  return (
    <Comp
      data-slot="sidebar-menu-action"
      data-sidebar="menu-action"
      className={cn(
        "text-sidebar-foreground ring-sidebar-ring hover:bg-sidebar-accent hover:text-sidebar-accent-foreground peer-hover/menu-button:text-sidebar-accent-foreground absolute top-1.5 right-1 flex aspect-square w-5 items-center justify-center rounded-md p-0 outline-hidden transition-transform focus-visible:ring-2 [&>svg]:size-4 [&>svg]:shrink-0",
        // Increases the hit area of the button on mobile.
        "after:absolute after:-inset-2 md:after:hidden",
        "peer-data-[size=sm]/menu-button:top-1",
        "peer-data-[size=default]/menu-button:top-1.5",
        "peer-data-[size=lg]/menu-button:top-2.5",
        "group-data-[collapsible=icon]:hidden",
        showOnHover &&
          "peer-data-[active=true]/menu-button:text-sidebar-accent-foreground group-focus-within/menu-item:opacity-100 group-hover/menu-item:opacity-100 data-[state=open]:opacity-100 md:opacity-0",
        className
      )}
      {...props}
    />
  )
}

function SidebarMenuBadge({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="sidebar-menu-badge"
      data-sidebar="menu-badge"
      className={cn(
        "text-sidebar-foreground pointer-events-none absolute right-1 flex h-5 min-w-5 items-center justify-center rounded-md px-1 text-xs font-medium tabular-nums select-none",
        "peer-hover/menu-button:text-sidebar-accent-foreground peer-data-[active=true]/menu-button:text-sidebar-accent-foreground",
        "peer-data-[size=sm]/menu-button:top-1",
        "peer-data-[size=default]/menu-button:top-1.5",
        "peer-data-[size=lg]/menu-button:top-2.5",
        "group-data-[collapsible=icon]:hidden",
        className
      )}
      {...props}
    />
  )
}

function SidebarMenuSkeleton({
  className,
  showIcon = false,
  ...props
}: React.ComponentProps<"div"> & {
  showIcon?: boolean
}) {
  // Random width between 50 to 90%.
  const width = React.useMemo(() => {
    return `${Math.floor(Math.random() * 40) + 50}%`
  }, [])

  return (
    <div
      data-slot="sidebar-menu-skeleton"
      data-sidebar="menu-skeleton"
      className={cn("flex h-8 items-center gap-2 rounded-md px-2", className)}
      {...props}
    >
      {showIcon && <Skeleton className="size-4 rounded-md" data-sidebar="menu-skeleton-icon" />}
      <Skeleton
        className="h-4 max-w-(--skeleton-width) flex-1"
        data-sidebar="menu-skeleton-text"
        style={
          {
            "--skeleton-width": width,
          } as React.CSSProperties
        }
      />
    </div>
  )
}

function SidebarMenuSub({ className, ...props }: React.ComponentProps<"ul">) {
  return (
    <ul
      data-slot="sidebar-menu-sub"
      data-sidebar="menu-sub"
      className={cn(
        "border-sidebar-border mx-3.5 flex min-w-0 translate-x-px flex-col gap-1 border-l px-2.5 py-0.5",
        "group-data-[collapsible=icon]:hidden",
        className
      )}
      {...props}
    />
  )
}

function SidebarMenuSubItem({ className, ...props }: React.ComponentProps<"li">) {
  return (
    <li
      data-slot="sidebar-menu-sub-item"
      data-sidebar="menu-sub-item"
      className={cn("group/menu-sub-item relative", className)}
      {...props}
    />
  )
}

function SidebarMenuSubButton({
  asChild = false,
  size = "md",
  isActive = false,
  className,
  ...props
}: React.ComponentProps<"a"> & {
  asChild?: boolean
  size?: "sm" | "md"
  isActive?: boolean
}) {
  const Comp = asChild ? Slot : "a"

  return (
    <Comp
      data-slot="sidebar-menu-sub-button"
      data-sidebar="menu-sub-button"
      data-size={size}
      data-active={isActive}
      className={cn(
        "text-sidebar-foreground ring-sidebar-ring hover:bg-sidebar-accent hover:text-sidebar-accent-foreground active:bg-sidebar-accent active:text-sidebar-accent-foreground [&>svg]:text-sidebar-accent-foreground flex h-7 min-w-0 -translate-x-px items-center gap-2 overflow-hidden rounded-md px-2 outline-hidden focus-visible:ring-2 disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 [&>span:last-child]:truncate [&>svg]:size-4 [&>svg]:shrink-0",
        "data-[active=true]:bg-sidebar-accent data-[active=true]:text-sidebar-accent-foreground",
        size === "sm" && "text-xs",
        size === "md" && "text-sm",
        "group-data-[collapsible=icon]:hidden",
        className
      )}
      {...props}
    />
  )
}

export {
  Sidebar,
  SidebarContent,
  SidebarFooter,
  SidebarGroup,
  SidebarGroupAction,
  SidebarGroupContent,
  SidebarGroupLabel,
  SidebarHeader,
  SidebarInput,
  SidebarInset,
  SidebarMenu,
  SidebarMenuAction,
  SidebarMenuBadge,
  SidebarMenuButton,
  SidebarMenuItem,
  SidebarMenuSkeleton,
  SidebarMenuSub,
  SidebarMenuSubButton,
  SidebarMenuSubItem,
  SidebarProvider,
  SidebarRail,
  SidebarSeparator,
  SidebarTrigger,
  useSidebar,
}
</file>

<file path="ui/src/components/ui/skeleton.tsx">
import { cn } from "@/lib/utils"

function Skeleton({ className, ...props }: React.ComponentProps<"div">) {
  return (
    <div
      data-slot="skeleton"
      className={cn("bg-accent animate-pulse rounded-md", className)}
      {...props}
    />
  )
}

export { Skeleton }
</file>

<file path="ui/src/components/ui/slider.tsx">
"use client"

import * as React from "react"
import * as SliderPrimitive from "@radix-ui/react-slider"

import { cn } from "@/lib/utils"

function Slider({
  className,
  defaultValue,
  value,
  min = 0,
  max = 100,
  ...props
}: React.ComponentProps<typeof SliderPrimitive.Root>) {
  const _values = React.useMemo(
    () => (Array.isArray(value) ? value : Array.isArray(defaultValue) ? defaultValue : [min, max]),
    [value, defaultValue, min, max]
  )

  return (
    <SliderPrimitive.Root
      data-slot="slider"
      defaultValue={defaultValue}
      value={value}
      min={min}
      max={max}
      className={cn(
        "relative flex w-full touch-none items-center select-none data-[disabled]:opacity-50 data-[orientation=vertical]:h-full data-[orientation=vertical]:min-h-44 data-[orientation=vertical]:w-auto data-[orientation=vertical]:flex-col",
        className
      )}
      {...props}
    >
      <SliderPrimitive.Track
        data-slot="slider-track"
        className={cn(
          "bg-muted relative grow overflow-hidden rounded-full data-[orientation=horizontal]:h-1.5 data-[orientation=horizontal]:w-full data-[orientation=vertical]:h-full data-[orientation=vertical]:w-1.5"
        )}
      >
        <SliderPrimitive.Range
          data-slot="slider-range"
          className={cn(
            "bg-primary absolute data-[orientation=horizontal]:h-full data-[orientation=vertical]:w-full"
          )}
        />
      </SliderPrimitive.Track>
      {Array.from({ length: _values.length }, (_, index) => (
        <SliderPrimitive.Thumb
          data-slot="slider-thumb"
          key={index}
          className="border-primary ring-ring/50 block size-4 shrink-0 rounded-full border bg-white shadow-sm transition-[color,box-shadow] hover:ring-4 focus-visible:ring-4 focus-visible:outline-hidden disabled:pointer-events-none disabled:opacity-50"
        />
      ))}
    </SliderPrimitive.Root>
  )
}

export { Slider }
</file>

<file path="ui/src/components/ui/sonner.tsx">
import {
  CircleCheckIcon,
  InfoIcon,
  Loader2Icon,
  OctagonXIcon,
  TriangleAlertIcon,
} from "lucide-react"
import { useTheme } from "next-themes"
import { Toaster as Sonner, type ToasterProps } from "sonner"

const Toaster = ({ ...props }: ToasterProps) => {
  const { theme = "system" } = useTheme()

  return (
    <Sonner
      theme={theme as ToasterProps["theme"]}
      className="toaster group"
      icons={{
        success: <CircleCheckIcon className="size-4" />,
        info: <InfoIcon className="size-4" />,
        warning: <TriangleAlertIcon className="size-4" />,
        error: <OctagonXIcon className="size-4" />,
        loading: <Loader2Icon className="size-4 animate-spin" />,
      }}
      style={
        {
          "--normal-bg": "var(--popover)",
          "--normal-text": "var(--popover-foreground)",
          "--normal-border": "var(--border)",
          "--border-radius": "var(--radius)",
        } as React.CSSProperties
      }
      {...props}
    />
  )
}

export { Toaster }
</file>

<file path="ui/src/components/ui/spinner.tsx">
import { Loader2Icon } from "lucide-react"

import { cn } from "@/lib/utils"

function Spinner({ className, ...props }: React.ComponentProps<"svg">) {
  return (
    <Loader2Icon
      role="status"
      aria-label="Loading"
      className={cn("size-4 animate-spin", className)}
      {...props}
    />
  )
}

export { Spinner }
</file>

<file path="ui/src/components/ui/switch.tsx">
"use client"

import * as React from "react"
import * as SwitchPrimitive from "@radix-ui/react-switch"

import { cn } from "@/lib/utils"

function Switch({ className, ...props }: React.ComponentProps<typeof SwitchPrimitive.Root>) {
  return (
    <SwitchPrimitive.Root
      data-slot="switch"
      className={cn(
        "peer data-[state=checked]:bg-primary data-[state=unchecked]:bg-input focus-visible:border-ring focus-visible:ring-ring/50 dark:data-[state=unchecked]:bg-input/80 inline-flex h-[1.15rem] w-8 shrink-0 items-center rounded-full border border-transparent shadow-xs transition-all outline-none focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50",
        className
      )}
      {...props}
    >
      <SwitchPrimitive.Thumb
        data-slot="switch-thumb"
        className={cn(
          "bg-background dark:data-[state=unchecked]:bg-foreground dark:data-[state=checked]:bg-primary-foreground pointer-events-none block size-4 rounded-full ring-0 transition-transform data-[state=checked]:translate-x-[calc(100%-2px)] data-[state=unchecked]:translate-x-0"
        )}
      />
    </SwitchPrimitive.Root>
  )
}

export { Switch }
</file>

<file path="ui/src/components/ui/table.tsx">
import * as React from "react"

import { cn } from "@/lib/utils"

function Table({ className, ...props }: React.ComponentProps<"table">) {
  return (
    <div data-slot="table-container" className="relative w-full overflow-x-auto">
      <table
        data-slot="table"
        className={cn("w-full caption-bottom text-sm", className)}
        {...props}
      />
    </div>
  )
}

function TableHeader({ className, ...props }: React.ComponentProps<"thead">) {
  return <thead data-slot="table-header" className={cn("[&_tr]:border-b", className)} {...props} />
}

function TableBody({ className, ...props }: React.ComponentProps<"tbody">) {
  return (
    <tbody
      data-slot="table-body"
      className={cn("[&_tr:last-child]:border-0", className)}
      {...props}
    />
  )
}

function TableFooter({ className, ...props }: React.ComponentProps<"tfoot">) {
  return (
    <tfoot
      data-slot="table-footer"
      className={cn("bg-muted/50 border-t font-medium [&>tr]:last:border-b-0", className)}
      {...props}
    />
  )
}

function TableRow({ className, ...props }: React.ComponentProps<"tr">) {
  return (
    <tr
      data-slot="table-row"
      className={cn(
        "hover:bg-muted/50 data-[state=selected]:bg-muted border-b transition-colors",
        className
      )}
      {...props}
    />
  )
}

function TableHead({ className, ...props }: React.ComponentProps<"th">) {
  return (
    <th
      data-slot="table-head"
      className={cn(
        "text-foreground h-10 px-2 text-left align-middle font-medium whitespace-nowrap [&:has([role=checkbox])]:pr-0 [&>[role=checkbox]]:translate-y-[2px]",
        className
      )}
      {...props}
    />
  )
}

function TableCell({ className, ...props }: React.ComponentProps<"td">) {
  return (
    <td
      data-slot="table-cell"
      className={cn(
        "p-2 align-middle whitespace-nowrap [&:has([role=checkbox])]:pr-0 [&>[role=checkbox]]:translate-y-[2px]",
        className
      )}
      {...props}
    />
  )
}

function TableCaption({ className, ...props }: React.ComponentProps<"caption">) {
  return (
    <caption
      data-slot="table-caption"
      className={cn("text-muted-foreground mt-4 text-sm", className)}
      {...props}
    />
  )
}

export { Table, TableHeader, TableBody, TableFooter, TableHead, TableRow, TableCell, TableCaption }
</file>

<file path="ui/src/components/ui/tabs.tsx">
"use client"

import * as React from "react"
import * as TabsPrimitive from "@radix-ui/react-tabs"

import { cn } from "@/lib/utils"

function Tabs({ className, ...props }: React.ComponentProps<typeof TabsPrimitive.Root>) {
  return (
    <TabsPrimitive.Root
      data-slot="tabs"
      className={cn("flex flex-col gap-2", className)}
      {...props}
    />
  )
}

function TabsList({ className, ...props }: React.ComponentProps<typeof TabsPrimitive.List>) {
  return (
    <TabsPrimitive.List
      data-slot="tabs-list"
      className={cn(
        "bg-muted text-muted-foreground inline-flex h-9 w-fit items-center justify-center rounded-lg p-[3px]",
        className
      )}
      {...props}
    />
  )
}

function TabsTrigger({ className, ...props }: React.ComponentProps<typeof TabsPrimitive.Trigger>) {
  return (
    <TabsPrimitive.Trigger
      data-slot="tabs-trigger"
      className={cn(
        "data-[state=active]:bg-background dark:data-[state=active]:text-foreground focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring dark:data-[state=active]:border-input dark:data-[state=active]:bg-input/30 text-foreground dark:text-muted-foreground inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 rounded-md border border-transparent px-2 py-1 text-sm font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:shadow-sm [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
        className
      )}
      {...props}
    />
  )
}

function TabsContent({ className, ...props }: React.ComponentProps<typeof TabsPrimitive.Content>) {
  return (
    <TabsPrimitive.Content
      data-slot="tabs-content"
      className={cn("flex-1 outline-none", className)}
      {...props}
    />
  )
}

export { Tabs, TabsList, TabsTrigger, TabsContent }
</file>

<file path="ui/src/components/ui/textarea.tsx">
import * as React from "react"

import { cn } from "@/lib/utils"

function Textarea({ className, ...props }: React.ComponentProps<"textarea">) {
  return (
    <textarea
      data-slot="textarea"
      className={cn(
        "border-input placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:bg-input/30 flex field-sizing-content min-h-16 w-full rounded-md border bg-transparent px-3 py-2 text-base shadow-xs transition-[color,box-shadow] outline-none focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
        className
      )}
      {...props}
    />
  )
}

export { Textarea }
</file>

<file path="ui/src/components/ui/toggle-group.tsx">
import * as React from "react"
import * as ToggleGroupPrimitive from "@radix-ui/react-toggle-group"
import { type VariantProps } from "class-variance-authority"

import { cn } from "@/lib/utils"
import { toggleVariants } from "@/components/ui/toggle"

const ToggleGroupContext = React.createContext<
  VariantProps<typeof toggleVariants> & {
    spacing?: number
  }
>({
  size: "default",
  variant: "default",
  spacing: 0,
})

function ToggleGroup({
  className,
  variant,
  size,
  spacing = 0,
  children,
  ...props
}: React.ComponentProps<typeof ToggleGroupPrimitive.Root> &
  VariantProps<typeof toggleVariants> & {
    spacing?: number
  }) {
  return (
    <ToggleGroupPrimitive.Root
      data-slot="toggle-group"
      data-variant={variant}
      data-size={size}
      data-spacing={spacing}
      style={{ "--gap": spacing } as React.CSSProperties}
      className={cn(
        "group/toggle-group flex w-fit items-center gap-[--spacing(var(--gap))] rounded-md data-[spacing=default]:data-[variant=outline]:shadow-xs",
        className
      )}
      {...props}
    >
      <ToggleGroupContext.Provider value={{ variant, size, spacing }}>
        {children}
      </ToggleGroupContext.Provider>
    </ToggleGroupPrimitive.Root>
  )
}

function ToggleGroupItem({
  className,
  children,
  variant,
  size,
  ...props
}: React.ComponentProps<typeof ToggleGroupPrimitive.Item> & VariantProps<typeof toggleVariants>) {
  const context = React.useContext(ToggleGroupContext)

  return (
    <ToggleGroupPrimitive.Item
      data-slot="toggle-group-item"
      data-variant={context.variant || variant}
      data-size={context.size || size}
      data-spacing={context.spacing}
      className={cn(
        toggleVariants({
          variant: context.variant || variant,
          size: context.size || size,
        }),
        "w-auto min-w-0 shrink-0 px-3 focus:z-10 focus-visible:z-10",
        "data-[spacing=0]:rounded-none data-[spacing=0]:shadow-none data-[spacing=0]:first:rounded-l-md data-[spacing=0]:last:rounded-r-md data-[spacing=0]:data-[variant=outline]:border-l-0 data-[spacing=0]:data-[variant=outline]:first:border-l",
        className
      )}
      {...props}
    >
      {children}
    </ToggleGroupPrimitive.Item>
  )
}

export { ToggleGroup, ToggleGroupItem }
</file>

<file path="ui/src/components/ui/toggle.tsx">
import * as React from "react"
import * as TogglePrimitive from "@radix-ui/react-toggle"
import { cva, type VariantProps } from "class-variance-authority"

import { cn } from "@/lib/utils"

const toggleVariants = cva(
  "inline-flex items-center justify-center gap-2 rounded-md text-sm font-medium hover:bg-muted hover:text-muted-foreground disabled:pointer-events-none disabled:opacity-50 data-[state=on]:bg-accent data-[state=on]:text-accent-foreground [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 [&_svg]:shrink-0 focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] outline-none transition-[color,box-shadow] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive whitespace-nowrap",
  {
    variants: {
      variant: {
        default: "bg-transparent",
        outline:
          "border border-input bg-transparent shadow-xs hover:bg-accent hover:text-accent-foreground",
      },
      size: {
        default: "h-9 px-2 min-w-9",
        sm: "h-8 px-1.5 min-w-8",
        lg: "h-10 px-2.5 min-w-10",
      },
    },
    defaultVariants: {
      variant: "default",
      size: "default",
    },
  }
)

function Toggle({
  className,
  variant,
  size,
  ...props
}: React.ComponentProps<typeof TogglePrimitive.Root> & VariantProps<typeof toggleVariants>) {
  return (
    <TogglePrimitive.Root
      data-slot="toggle"
      className={cn(toggleVariants({ variant, size, className }))}
      {...props}
    />
  )
}

export { Toggle, toggleVariants }
</file>

<file path="ui/src/components/ui/tooltip.tsx">
"use client"

import * as React from "react"
import * as TooltipPrimitive from "@radix-ui/react-tooltip"

import { cn } from "@/lib/utils"

function TooltipProvider({
  delayDuration = 0,
  ...props
}: React.ComponentProps<typeof TooltipPrimitive.Provider>) {
  return (
    <TooltipPrimitive.Provider
      data-slot="tooltip-provider"
      delayDuration={delayDuration}
      {...props}
    />
  )
}

function Tooltip({ ...props }: React.ComponentProps<typeof TooltipPrimitive.Root>) {
  return (
    <TooltipProvider>
      <TooltipPrimitive.Root data-slot="tooltip" {...props} />
    </TooltipProvider>
  )
}

function TooltipTrigger({ ...props }: React.ComponentProps<typeof TooltipPrimitive.Trigger>) {
  return <TooltipPrimitive.Trigger data-slot="tooltip-trigger" {...props} />
}

function TooltipContent({
  className,
  sideOffset = 0,
  children,
  ...props
}: React.ComponentProps<typeof TooltipPrimitive.Content>) {
  return (
    <TooltipPrimitive.Portal>
      <TooltipPrimitive.Content
        data-slot="tooltip-content"
        sideOffset={sideOffset}
        className={cn(
          "bg-foreground text-background animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit origin-(--radix-tooltip-content-transform-origin) rounded-md px-3 py-1.5 text-xs text-balance",
          className
        )}
        {...props}
      >
        {children}
        <TooltipPrimitive.Arrow className="bg-foreground fill-foreground z-50 size-2.5 translate-y-[calc(-50%_-_2px)] rotate-45 rounded-[2px]" />
      </TooltipPrimitive.Content>
    </TooltipPrimitive.Portal>
  )
}

export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider }
</file>

<file path="ui/src/components/protected-route.tsx">
import { Navigate, Outlet, useLocation } from "react-router-dom"

import { useAuth } from "@/hooks/use-auth.ts"

export const ProtectedRoute = () => {
  const { authed } = useAuth()
  const loc = useLocation()

  if (!authed) {
    return <Navigate to={`/login?to=${encodeURIComponent(loc.pathname + loc.search)}`} replace />
  }
  return <Outlet />
}
</file>

<file path="ui/src/hooks/use-auth-actions.ts">
import { useCallback } from "react"
import { logoutEverywhere } from "@/auth/logout.ts"

export function useAuthActions() {
  const logout = useCallback(() => {
    return logoutEverywhere()
  }, [])

  return { logout }
}
</file>

<file path="ui/src/hooks/use-auth.ts">
import { useSyncExternalStore } from "react"
import { authStore, type TokenPair } from "@/auth/store.ts"

export const useAuth = () => {
  const tokens = useSyncExternalStore<TokenPair | null>(
    (cb) => authStore.subscribe(cb),
    () => authStore.get(),
    () => authStore.get() // server snapshot (SSR)
  )

  return {
    tokens,
    authed: !!tokens?.access_token,
    isExpired: authStore.isExpired(),
    willExpireSoon: authStore.willExpireSoon(),
  }
}
</file>

<file path="ui/src/hooks/use-me.ts">
import { meApi } from "@/api/me.ts"
import { useQuery } from "@tanstack/react-query"

export function useMe() {
  return useQuery({
    queryKey: ["me"],
    queryFn: () => meApi.getMe(),
    staleTime: 5 * 60 * 1000, // cache a bit
  })
}
</file>

<file path="ui/src/hooks/use-mobile.ts">
import * as React from "react"

const MOBILE_BREAKPOINT = 768

export function useIsMobile() {
  const [isMobile, setIsMobile] = React.useState<boolean | undefined>(undefined)

  React.useEffect(() => {
    const mql = window.matchMedia(`(max-width: ${MOBILE_BREAKPOINT - 1}px)`)
    const onChange = () => {
      setIsMobile(window.innerWidth < MOBILE_BREAKPOINT)
    }
    mql.addEventListener("change", onChange)
    setIsMobile(window.innerWidth < MOBILE_BREAKPOINT)
    return () => mql.removeEventListener("change", onChange)
  }, [])

  return !!isMobile
}
</file>

<file path="ui/src/layouts/app-shell.tsx">
import { useEffect, useState } from "react"
import { meApi } from "@/api/me.ts"
import { orgStore } from "@/auth/org.ts"
import { Footer } from "@/layouts/footer.tsx"
import { adminNav, mainNav, orgNav, userNav } from "@/layouts/nav-config.ts"
import { OrgSwitcher } from "@/layouts/org-switcher.tsx"
import { ThemePillSwitcher } from "@/layouts/theme-switcher"
import { Topbar } from "@/layouts/topbar.tsx"
import { NavLink, Outlet } from "react-router-dom"

import { cn } from "@/lib/utils.ts"
import { useAuthActions } from "@/hooks/use-auth-actions.ts"
import { Button } from "@/components/ui/button.tsx"
import {
  Sidebar,
  SidebarContent,
  SidebarFooter,
  SidebarGroup,
  SidebarGroupContent,
  SidebarGroupLabel,
  SidebarHeader,
  SidebarInset,
  SidebarMenu,
  SidebarMenuButton,
  SidebarMenuItem,
  SidebarProvider,
} from "@/components/ui/sidebar.tsx"

type Org = {
  id: string
  name: string
}

export const AppShell = () => {
  const [orgs, setOrgs] = useState<Org[]>([])
  const { logout } = useAuthActions()

  useEffect(() => {
    let alive = true
    ;(async () => {
      try {
        const me = await meApi.getMe() // HandlersMeResponse
        const list = (me.organizations ?? []).map((o) => ({
          id: o.id,
          name: o.name ?? o.id,
        }))
        if (!alive) return
        setOrgs(list as Org[])

        // default selection if none
        if (!orgStore.get() && list.length > 0) {
          orgStore.set(list[0].id!)
        }
      } catch {
        // ignore; ProtectedRoute will handle auth
      }
    })()
    return () => {
      alive = false
    }
  }, [])

  return (
    <SidebarProvider defaultOpen>
      <Sidebar collapsible="icon" variant="floating">
        <SidebarHeader>
          <div className="px-2 py-2">
            <OrgSwitcher orgs={orgs} />
          </div>
        </SidebarHeader>

        <SidebarContent>
          <SidebarGroup>
            <SidebarGroupLabel>Navigation</SidebarGroupLabel>
            <SidebarGroupContent>
              <SidebarMenu>
                {mainNav.map((n) => (
                  <SidebarMenuItem key={n.to}>
                    <SidebarMenuButton asChild tooltip={n.label}>
                      <NavLink
                        to={n.to}
                        className={({ isActive }) =>
                          cn("flex items-center gap-2", isActive && "text-primary")
                        }
                      >
                        <n.icon className="h-4 w-4" />
                        <span>{n.label}</span>
                      </NavLink>
                    </SidebarMenuButton>
                  </SidebarMenuItem>
                ))}
              </SidebarMenu>
            </SidebarGroupContent>
          </SidebarGroup>

          <SidebarGroup>
            <SidebarGroupLabel>Organization</SidebarGroupLabel>
            <SidebarGroupContent>
              <SidebarMenu>
                {orgNav.map((n) => (
                  <SidebarMenuItem key={n.to}>
                    <SidebarMenuButton asChild tooltip={n.label}>
                      <NavLink
                        to={n.to}
                        className={({ isActive }) =>
                          cn("flex items-center gap-2", isActive && "text-primary")
                        }
                      >
                        <n.icon className="h-4 w-4" />
                        <span>{n.label}</span>
                      </NavLink>
                    </SidebarMenuButton>
                  </SidebarMenuItem>
                ))}
              </SidebarMenu>
            </SidebarGroupContent>
          </SidebarGroup>

          <SidebarGroup>
            <SidebarGroupLabel>User</SidebarGroupLabel>
            <SidebarGroupContent>
              <SidebarMenu>
                {userNav.map((n) => (
                  <SidebarMenuItem key={n.to}>
                    <SidebarMenuButton asChild tooltip={n.label}>
                      <NavLink
                        to={n.to}
                        className={({ isActive }) =>
                          cn("flex items-center gap-2", isActive && "text-primary")
                        }
                      >
                        <n.icon className="h-4 w-4" />
                        <span>{n.label}</span>
                      </NavLink>
                    </SidebarMenuButton>
                  </SidebarMenuItem>
                ))}
              </SidebarMenu>
            </SidebarGroupContent>
          </SidebarGroup>

          <SidebarGroup>
            <SidebarGroupLabel>Admin</SidebarGroupLabel>
            <SidebarGroupContent>
              <SidebarMenu>
                {adminNav.map((n) => (
                  <SidebarMenuItem key={n.to}>
                    <SidebarMenuButton asChild tooltip={n.label}>
                      <NavLink
                        to={n.to}
                        target={n.target ? n.target : "_self"}
                        className={({ isActive }) =>
                          cn("flex items-center gap-2", isActive && "text-primary")
                        }
                      >
                        <n.icon className="h-4 w-4" />
                        <span>{n.label}</span>
                      </NavLink>
                    </SidebarMenuButton>
                  </SidebarMenuItem>
                ))}
              </SidebarMenu>
            </SidebarGroupContent>
          </SidebarGroup>
          <div className="mt-auto flex items-center justify-center p-3">
            <ThemePillSwitcher />
          </div>
        </SidebarContent>

        <SidebarFooter>
          <div className="px-2 py-2">
            <Button variant="ghost" size="sm" className="w-full" onClick={() => void logout()}>
              Sign out
            </Button>
          </div>
        </SidebarFooter>
      </Sidebar>

      <SidebarInset className="flex min-h-screen flex-col">
        <Topbar />
        <main className="p-4">
          <Outlet />
        </main>
        <Footer />
      </SidebarInset>
    </SidebarProvider>
  )
}
</file>

<file path="ui/src/layouts/footer.tsx">
import { memo, useMemo } from "react"
import { metaApi } from "@/api/footer"
import { useQuery } from "@tanstack/react-query"
import { Clipboard, ExternalLink, GitCommit, Info } from "lucide-react"

import { Badge } from "@/components/ui/badge"
import { Button } from "@/components/ui/button"
import { Separator } from "@/components/ui/separator"
import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip"

type VersionInfo = {
  built: string // ISO string or "unknown"
  builtBy: string
  commit: string
  go: string
  goArch: string
  goOS: string
  version: string
}

function shortCommit(c?: string) {
  return c && c !== "none" ? c.slice(0, 7) : "none"
}

function formatBuilt(built: string) {
  if (!built || built === "unknown") return "unknown"
  const d = new Date(built)
  return isNaN(+d) ? built : d.toLocaleString()
}

function asClipboardText(v?: VersionInfo) {
  if (!v) return ""
  return `v${v.version} (${shortCommit(v.commit)}) • built ${v.built} • ${v.go} ${v.goOS}/${v.goArch}`
}

export const Footer = memo(function Footer() {
  const footerQ = useQuery({
    queryKey: ["footer"],
    queryFn: () => metaApi.footer() as Promise<VersionInfo>,
    staleTime: 60_000,
    refetchOnWindowFocus: false,
  })

  const data = footerQ.data

  const copyText = useMemo(() => asClipboardText(data), [data])

  return (
    <footer className="bg-background text-muted-foreground w-full border-t px-3 py-2 text-xs sm:text-sm">
      <div className="mx-auto flex max-w-screen-2xl items-center justify-between">
        {/* Left: brand / copyright */}
        <div className="flex items-center gap-2 text-xs sm:text-sm">
          <span>© {new Date().getFullYear()} GlueOps</span>
          <Separator orientation="vertical" className="hidden h-4 sm:block" />
          <span className="hidden sm:block">All systems nominal.</span>
        </div>

        {/* Right: version/meta */}
        <div className="flex flex-wrap items-center gap-2 text-xs sm:text-sm">
          {footerQ.isLoading ? (
            <span className="animate-pulse">loading version…</span>
          ) : footerQ.isError ? (
            <span className="text-destructive">version unavailable</span>
          ) : data ? (
            <TooltipProvider>
              <div className="flex flex-wrap items-center gap-2">
                <Badge variant="secondary" className="font-mono">
                  {data.version}
                </Badge>

                <Tooltip>
                  <TooltipTrigger asChild>
                    <span className="inline-flex items-center gap-1">
                      <GitCommit className="h-3.5 w-3.5" />
                      <span className="font-mono">{shortCommit(data.commit)}</span>
                    </span>
                  </TooltipTrigger>
                  <TooltipContent side="top">
                    <div className="font-mono text-xs">{data.commit}</div>
                  </TooltipContent>
                </Tooltip>

                <Separator orientation="vertical" className="h-4" />

                <Tooltip>
                  <TooltipTrigger asChild>
                    <span className="inline-flex items-center gap-1">
                      <Info className="h-3.5 w-3.5" />
                      <span>{data.go}</span>
                    </span>
                  </TooltipTrigger>
                  <TooltipContent side="top">
                    <div className="font-mono text-xs">
                      {data.goOS}/{data.goArch}
                    </div>
                  </TooltipContent>
                </Tooltip>

                <Separator orientation="vertical" className="hidden h-4 sm:block" />

                <span className="hidden sm:inline">
                  built <span className="font-mono">{formatBuilt(data.built)}</span>
                </span>

                <Separator orientation="vertical" className="hidden h-4 sm:block" />

                <Button
                  variant="ghost"
                  size="icon"
                  className="h-7 w-7"
                  onClick={() => {
                    navigator.clipboard?.writeText(copyText).catch(() => {})
                  }}
                  title="Copy version details"
                >
                  <Clipboard className="h-4 w-4" />
                </Button>

                <a
                  href="/api/v1/version"
                  target="_blank"
                  rel="noreferrer"
                  className="inline-flex items-center gap-1 text-xs underline-offset-4 hover:underline"
                  title="Open raw version JSON"
                >
                  JSON <ExternalLink className="h-3.5 w-3.5" />
                </a>
              </div>
            </TooltipProvider>
          ) : null}
        </div>
      </div>
    </footer>
  )
})
</file>

<file path="ui/src/layouts/nav-config.ts">
import type { ComponentType } from "react"
import {
  BoxesIcon,
  Building2,
  ComponentIcon,
  FileKey2Icon,
  KeyRound,
  LockKeyholeIcon,
  PickaxeIcon,
  ServerIcon,
  SprayCanIcon,
  TagsIcon,
  User2,
  Users,
} from "lucide-react"
import { AiOutlineCluster } from "react-icons/ai"
import { GrUserWorker } from "react-icons/gr"
import { MdOutlineDns } from "react-icons/md"
import { SiSwagger } from "react-icons/si"
import { TbLoadBalancer } from "react-icons/tb"

export type NavItem = {
  to: string
  label: string
  icon: ComponentType<{ className?: string }>
  target?: string
}

export const mainNav: NavItem[] = [
  { to: "/clusters", label: "Clusters", icon: AiOutlineCluster },
  { to: "/load-balancers", label: "Load Balancers", icon: TbLoadBalancer },
  { to: "/dns", label: "DNS", icon: MdOutlineDns },
  { to: "/node-pools", label: "Node Pools", icon: BoxesIcon },
  { to: "/annotations", label: "Annotations", icon: ComponentIcon },
  { to: "/labels", label: "Labels", icon: TagsIcon },
  { to: "/taints", label: "Taints", icon: SprayCanIcon },
  { to: "/servers", label: "Servers", icon: ServerIcon },
  { to: "/ssh", label: "SSH Keys", icon: FileKey2Icon },
  { to: "/credentials", label: "Credentials", icon: LockKeyholeIcon },
]

export const orgNav: NavItem[] = [
  { to: "/org/members", label: "Members", icon: Users },
  { to: "/org/api-keys", label: "Org API Keys", icon: KeyRound },
  { to: "/org/settings", label: "Org Settings", icon: Building2 },
]

export const userNav: NavItem[] = [{ to: "/me", label: "Profile", icon: User2 }]

export const adminNav: NavItem[] = [
  { to: "/admin/users", label: "Users Admin", icon: Users },
  { to: "/admin/jobs", label: "Jobs Admin", icon: GrUserWorker },
  { to: "/admin/actions", label: "Actions Admin", icon: PickaxeIcon},
  { to: "/docs", label: "API Docs ", icon: SiSwagger, target: "_blank" },
]
</file>

<file path="ui/src/layouts/theme-switcher.tsx">
import { type ComponentType } from "react"
import { motion } from "framer-motion"
import { Monitor, Moon, Sun } from "lucide-react"
import { useTheme } from "next-themes"

import { cn } from "@/lib/utils"

type ThemeValue = "light" | "dark" | "system"

const options: { id: ThemeValue; icon: ComponentType<{ className?: string }>; label: string }[] = [
  { id: "light", icon: Sun, label: "Light" },
  { id: "dark", icon: Moon, label: "Dark" },
  { id: "system", icon: Monitor, label: "System" },
]

interface ThemePillSwitcherProps {
  className?: string
  variant?: "pill" | "wide"
  ariaLabel?: string
}

export const ThemePillSwitcher = ({
  className = "",
  variant = "pill",
  ariaLabel = "Toggle theme",
}: ThemePillSwitcherProps) => {
  const { theme, setTheme } = useTheme()

  const currentTheme = (theme ?? "system") as ThemeValue
  const isPill = variant === "pill"
  return (
    <div
      className={cn(
        "inline-flex items-center",
        isPill && "bg-muted/70 rounded-full p-1 text-xs shadow-sm",
        !isPill && "gap-2",
        className
      )}
      aria-label={ariaLabel}
      role="radiogroup"
    >
      {options.map(({ id, icon: Icon, label }) => {
        const isActive = currentTheme === id

        return (
          <button
            key={id}
            type="button"
            role="radio"
            aria-checked={isActive}
            onClick={() => setTheme(id)}
            aria-label={isPill ? label : undefined}
            className={cn(
              "focus-visible:ring-ring focus-visible:ring-offset-background relative flex items-center justify-center rounded-full transition-colors focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:outline-none",
              isActive ? "text-foreground border" : "text-muted-foreground hover:text-foreground",

              // --- Conditional Classes ---
              // "pill" variant is a fixed 8x8 square
              isPill && "h-8 w-8",
              // "wide" variant has padding, a gap, and auto width
              !isPill && "h-8 gap-2 px-3 text-sm font-medium"
            )}
          >
            {isActive && (
              <motion.span
                layoutId="theme-switcher-pill"
                className="bg-background absolute inset-0 rounded-full shadow-sm"
                transition={{ type: "spring", stiffness: 350, damping: 26 }}
              />
            )}
            <Icon className="relative z-10 h-4 w-4" />
            {!isPill && <span className="relative z-10">{label}</span>}
          </button>
        )
      })}
    </div>
  )
}
</file>

<file path="ui/src/lib/utils.ts">
import { clsx, type ClassValue } from "clsx"
import { twMerge } from "tailwind-merge"

export function cn(...inputs: ClassValue[]) {
  return twMerge(clsx(inputs))
}

export function truncateMiddle(str: string, keep = 24) {
  if (!str || str.length <= keep * 2 + 3) return str
  return `${str.slice(0, keep)}…${str.slice(-keep)}`
}
</file>

<file path="ui/src/pages/actions-page.tsx">
import { useMemo, useState } from "react"
import { actionsApi } from "@/api/actions.ts"
import type { DtoActionResponse } from "@/sdk"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { AlertCircle, CircleSlash2, Loader2, Pencil, Plus, Search, Trash2 } from "lucide-react"
import { useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import { Badge } from "@/components/ui/badge.tsx"
import { Button } from "@/components/ui/button.tsx"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog.tsx"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form.tsx"
import { Input } from "@/components/ui/input.tsx"
import {
  Table,
  TableBody,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table.tsx"
import { Textarea } from "@/components/ui/textarea.tsx"

const createActionSchema = z.object({
  label: z.string().trim().min(1, "Label is required").max(255, "Max 255 chars"),
  description: z.string().trim().min(1, "Description is required"),
  make_target: z
    .string()
    .trim()
    .min(1, "Make target is required")
    .max(255, "Max 255 chars")
    // keep client-side fairly strict to avoid surprises; server should also validate
    .regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/, "Invalid make target (allowed: a-z A-Z 0-9 . _ -)"),
})
type CreateActionInput = z.input<typeof createActionSchema>

const updateActionSchema = createActionSchema.partial()
type UpdateActionInput = z.input<typeof updateActionSchema>

function TargetBadge({ target }: { target?: string | null }) {
  if (!target) {
    return (
      <Badge variant="outline" className="text-xs">
        —
      </Badge>
    )
  }
  return (
    <Badge variant="secondary" className="font-mono text-xs">
      {target}
    </Badge>
  )
}

export const ActionsPage = () => {
  const qc = useQueryClient()

  const [filter, setFilter] = useState("")
  const [createOpen, setCreateOpen] = useState(false)
  const [updateOpen, setUpdateOpen] = useState(false)
  const [deleteId, setDeleteId] = useState<string | null>(null)
  const [editing, setEditing] = useState<DtoActionResponse | null>(null)

  const actionsQ = useQuery({
    queryKey: ["admin-actions"],
    queryFn: () => actionsApi.listActions(),
  })

  const filtered = useMemo(() => {
    const data: DtoActionResponse[] = actionsQ.data ?? []
    const q = filter.trim().toLowerCase()
    if (!q) return data

    return data.filter((a) => {
      return (
        (a.label ?? "").toLowerCase().includes(q) ||
        (a.description ?? "").toLowerCase().includes(q) ||
        (a.make_target ?? "").toLowerCase().includes(q)
      )
    })
  }, [filter, actionsQ.data])

  const createForm = useForm<CreateActionInput>({
    resolver: zodResolver(createActionSchema),
    defaultValues: {
      label: "",
      description: "",
      make_target: "",
    },
  })

  const createMut = useMutation({
    mutationFn: (values: CreateActionInput) => actionsApi.createAction(values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["admin-actions"] })
      createForm.reset()
      setCreateOpen(false)
      toast.success("Action created.")
    },
    onError: (err: any) => {
      toast.error(err?.message ?? "Failed to create action.")
    },
  })

  const updateForm = useForm<UpdateActionInput>({
    resolver: zodResolver(updateActionSchema),
    defaultValues: {},
  })

  const updateMut = useMutation({
    mutationFn: ({ id, values }: { id: string; values: UpdateActionInput }) =>
      actionsApi.updateAction(id, values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["admin-actions"] })
      updateForm.reset()
      setUpdateOpen(false)
      setEditing(null)
      toast.success("Action updated.")
    },
    onError: (err: any) => {
      toast.error(err?.message ?? "Failed to update action.")
    },
  })

  const openEdit = (a: DtoActionResponse) => {
    if (!a.id) return
    setEditing(a)
    updateForm.reset({
      label: a.label ?? "",
      description: a.description ?? "",
      make_target: a.make_target ?? "",
    })
    setUpdateOpen(true)
  }

  const deleteMut = useMutation({
    mutationFn: (id: string) => actionsApi.deleteAction(id),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["admin-actions"] })
      setDeleteId(null)
      toast.success("Action deleted.")
    },
    onError: (err: any) => {
      toast.error(err?.message ?? "Failed to delete action.")
    },
  })

  if (actionsQ.isLoading) return <div className="p-6">Loading actions…</div>
  if (actionsQ.error) return <div className="p-6 text-red-500">Error loading actions.</div>

  return (
    <div className="space-y-4 p-6">
      <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
        <h1 className="text-2xl font-bold">Admin Actions</h1>

        <div className="flex flex-wrap items-center gap-2">
          <div className="relative">
            <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
            <Input
              value={filter}
              onChange={(e) => setFilter(e.target.value)}
              placeholder="Search actions"
              className="w-72 pl-8"
            />
          </div>

          <Dialog open={createOpen} onOpenChange={setCreateOpen}>
            <DialogTrigger asChild>
              <Button onClick={() => setCreateOpen(true)}>
                <Plus className="mr-2 h-4 w-4" />
                Create Action
              </Button>
            </DialogTrigger>

            <DialogContent className="sm:max-w-lg">
              <DialogHeader>
                <DialogTitle>Create Action</DialogTitle>
              </DialogHeader>

              <Form {...createForm}>
                <form
                  className="space-y-4"
                  onSubmit={createForm.handleSubmit((v) => createMut.mutate(v))}
                >
                  <FormField
                    control={createForm.control}
                    name="label"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Label</FormLabel>
                        <FormControl>
                          <Input placeholder="Setup" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="make_target"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Make Target</FormLabel>
                        <FormControl>
                          <Input placeholder="setup" className="font-mono" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="description"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Description</FormLabel>
                        <FormControl>
                          <Textarea
                            rows={4}
                            placeholder="Runs prepare, ping-servers, then make setup on the bastion."
                            {...field}
                          />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <DialogFooter className="gap-2">
                    <Button type="button" variant="outline" onClick={() => setCreateOpen(false)}>
                      Cancel
                    </Button>
                    <Button type="submit" disabled={createMut.isPending}>
                      {createMut.isPending ? "Creating…" : "Create"}
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </div>
      </div>

      <div className="bg-background overflow-hidden rounded-2xl border shadow-sm">
        <div className="overflow-x-auto">
          <Table>
            <TableHeader>
              <TableRow>
                <TableHead>Label</TableHead>
                <TableHead>Make Target</TableHead>
                <TableHead>Description</TableHead>
                <TableHead className="w-[260px] text-right">Actions</TableHead>
              </TableRow>
            </TableHeader>
            <TableBody>
              {filtered.map((a) => (
                <TableRow key={a.id}>
                  <TableCell className="font-medium">{a.label}</TableCell>
                  <TableCell>
                    <TargetBadge target={a.make_target} />
                  </TableCell>
                  <TableCell className="text-muted-foreground max-w-[680px] truncate">
                    {a.description}
                  </TableCell>
                  <TableCell>
                    <div className="flex justify-end gap-2">
                      <Button variant="outline" size="sm" onClick={() => openEdit(a)}>
                        <Pencil className="mr-2 h-4 w-4" />
                        Edit
                      </Button>
                      <Button
                        variant="destructive"
                        size="sm"
                        onClick={() => a.id && setDeleteId(a.id)}
                        disabled={deleteMut.isPending && deleteId === a.id}
                      >
                        <Trash2 className="mr-2 h-4 w-4" />
                        {deleteMut.isPending && deleteId === a.id ? "Deleting…" : "Delete"}
                      </Button>
                    </div>
                  </TableCell>
                </TableRow>
              ))}

              {filtered.length === 0 && (
                <TableRow>
                  <TableCell colSpan={4} className="text-muted-foreground py-10 text-center">
                    <CircleSlash2 className="mx-auto mb-2 h-6 w-6 opacity-60" />
                    No actions match your search.
                  </TableCell>
                </TableRow>
              )}
            </TableBody>
          </Table>
        </div>
      </div>

      {/* Update dialog */}
      <Dialog
        open={updateOpen}
        onOpenChange={(open) => {
          setUpdateOpen(open)
          if (!open) setEditing(null)
        }}
      >
        <DialogContent className="sm:max-w-lg">
          <DialogHeader>
            <DialogTitle>Edit Action</DialogTitle>
          </DialogHeader>

          {editing ? (
            <Form {...updateForm}>
              <form
                className="space-y-4"
                onSubmit={updateForm.handleSubmit((values) => {
                  if (!editing.id) return
                  updateMut.mutate({ id: editing.id, values })
                })}
              >
                <FormField
                  control={updateForm.control}
                  name="label"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Label</FormLabel>
                      <FormControl>
                        <Input {...field} />
                      </FormControl>
                      <FormMessage />
                    </FormItem>
                  )}
                />

                <FormField
                  control={updateForm.control}
                  name="make_target"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Make Target</FormLabel>
                      <FormControl>
                        <Input className="font-mono" {...field} />
                      </FormControl>
                      <FormMessage />
                    </FormItem>
                  )}
                />

                <FormField
                  control={updateForm.control}
                  name="description"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Description</FormLabel>
                      <FormControl>
                        <Textarea rows={4} {...field} />
                      </FormControl>
                      <FormMessage />
                    </FormItem>
                  )}
                />

                <DialogFooter className="gap-2">
                  <Button type="button" variant="outline" onClick={() => setUpdateOpen(false)}>
                    Cancel
                  </Button>
                  <Button type="submit" disabled={updateMut.isPending}>
                    {updateMut.isPending ? (
                      <span className="inline-flex items-center gap-2">
                        <Loader2 className="h-4 w-4 animate-spin" />
                        Saving…
                      </span>
                    ) : (
                      "Save changes"
                    )}
                  </Button>
                </DialogFooter>
              </form>
            </Form>
          ) : (
            <div className="text-muted-foreground text-sm">No action selected.</div>
          )}
        </DialogContent>
      </Dialog>

      {/* Delete confirm dialog */}
      <Dialog open={!!deleteId} onOpenChange={(open) => !open && setDeleteId(null)}>
        <DialogContent className="sm:max-w-md">
          <DialogHeader>
            <DialogTitle>Delete action</DialogTitle>
          </DialogHeader>

          <div className="flex items-start gap-3">
            <AlertCircle className="mt-0.5 h-5 w-5 text-red-500" />
            <p className="text-muted-foreground text-sm">
              This action cannot be undone. Are you sure you want to delete it?
            </p>
          </div>

          <DialogFooter className="gap-2">
            <Button variant="outline" onClick={() => setDeleteId(null)}>
              Cancel
            </Button>
            <Button
              variant="destructive"
              onClick={() => deleteId && deleteMut.mutate(deleteId)}
              disabled={deleteMut.isPending}
            >
              {deleteMut.isPending ? "Deleting…" : "Delete"}
            </Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>
    </div>
  )
}
</file>

<file path="ui/src/pages/annotation-page.tsx">
import { useMemo, useState } from "react"
import { annotationsApi } from "@/api/annotations.ts"
import type { DtoLabelResponse } from "@/sdk"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { CircleSlash2, Pencil, Plus, Search, Tags } from "lucide-react"
import { useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import { truncateMiddle } from "@/lib/utils.ts"
import { Badge } from "@/components/ui/badge.tsx"
import { Button } from "@/components/ui/button.tsx"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog.tsx"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form.tsx"
import { Input } from "@/components/ui/input.tsx"
import {
  Table,
  TableBody,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table.tsx"

const createAnnotationSchema = z.object({
  key: z.string().trim().min(1, "Key is required").max(120, "Max 120 chars"),
  value: z.string().trim().optional(),
})
type CreateAnnotationInput = z.input<typeof createAnnotationSchema>

const updateAnnotationSchema = createAnnotationSchema.partial()
type UpdateAnnotationValues = z.infer<typeof updateAnnotationSchema>

function AnnotationBadge({ t }: { t: Pick<DtoLabelResponse, "key" | "value"> }) {
  const label = `${t.key}${t.value ? `=${t.value}` : ""}`
  return (
    <Badge variant="secondary" className="font-mono text-xs">
      <Tags className="mr-1 h-3 w-3" />
      {label}
    </Badge>
  )
}

export const AnnotationPage = () => {
  const [filter, setFilter] = useState<string>("")
  const [createOpen, setCreateOpen] = useState<boolean>(false)
  const [updateOpen, setUpdateOpen] = useState<boolean>(false)
  const [deleteId, setDeleteId] = useState<string | null>(null)
  const [editingId, setEditingId] = useState<string | null>(null)

  const qc = useQueryClient()

  const annotationQ = useQuery({
    queryKey: ["annotations"],
    queryFn: () => annotationsApi.listAnnotations(),
  })

  // --- Create

  const createForm = useForm<CreateAnnotationInput>({
    resolver: zodResolver(createAnnotationSchema),
    defaultValues: {
      key: "",
      value: "",
    },
  })

  const createMut = useMutation({
    mutationFn: (values: CreateAnnotationInput) => annotationsApi.createAnnotation(values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["annotations"] })
      createForm.reset()
      setCreateOpen(false)
      toast.success("Annotation Created Successfully.")
    },
    onError: (err) => {
      toast.error(err.message ?? "There was an error while creating Annotation")
    },
  })

  const onCreateSubmit = (values: CreateAnnotationInput) => {
    createMut.mutate(values)
  }

  // --- Update
  const updateForm = useForm<UpdateAnnotationValues>({
    resolver: zodResolver(updateAnnotationSchema),
    defaultValues: {},
  })

  const updateMut = useMutation({
    mutationFn: ({ id, values }: { id: string; values: UpdateAnnotationValues }) =>
      annotationsApi.updateAnnotation(id, values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["annotations"] })
      updateForm.reset()
      setUpdateOpen(false)
      toast.success("Annotation Updated Successfully.")
    },
    onError: (err) => {
      toast.error(err.message ?? "There was an error while updating Annotation")
    },
  })

  const openEdit = (label: any) => {
    setEditingId(label.id)
    updateForm.reset({
      key: label.key,
      value: label.value,
    })
    setUpdateOpen(true)
  }

  // --- Delete ---

  const deleteMut = useMutation({
    mutationFn: (id: string) => annotationsApi.deleteAnnotation(id),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["annotations"] })
      setDeleteId(null)
      toast.success("Annotation Deleted Successfully.")
    },
    onError: (err) => {
      toast.error(err.message ?? "There was an error while deleting Annotation")
    },
  })

  // --- Filter ---
  const filtered = useMemo(() => {
    const data = annotationQ.data ?? []
    const q = filter.trim().toLowerCase()

    return q
      ? data.filter((k: any) => {
          return k.key?.toLowerCase().includes(q) || k.value?.toLowerCase().includes(q)
        })
      : data
  }, [filter, annotationQ.data])

  if (annotationQ.isLoading) return <div className="p-6">Loading annotations…</div>
  if (annotationQ.error)
    return (
      <div className="p-6 text-red-500">
        Error loading annotations.<pre>{JSON.stringify(annotationQ, null, 2)}</pre>
      </div>
    )
  return (
    <div className="space-y-4 p-6">
      <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
        <h1 className="mb-4 text-2xl font-bold">Annotations</h1>

        <div className="flex flex-wrap items-center gap-2">
          <div className="relative">
            <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
            <Input
              value={filter}
              onChange={(e) => setFilter(e.target.value)}
              placeholder="Search annotations"
              className="w-64 pl-8"
            />
          </div>

          <Dialog open={createOpen} onOpenChange={setCreateOpen}>
            <DialogTrigger asChild>
              <Button onClick={() => setCreateOpen(true)}>
                <Plus className="mr-2 h-4 w-4" />
                Create Annotation
              </Button>
            </DialogTrigger>
            <DialogContent className="sm:max-w-lg">
              <DialogHeader>
                <DialogTitle>Create Label</DialogTitle>
              </DialogHeader>

              <Form {...createForm}>
                <form className="space-y-4" onSubmit={createForm.handleSubmit(onCreateSubmit)}>
                  <FormField
                    control={createForm.control}
                    name="key"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Key</FormLabel>
                        <FormControl>
                          <Input placeholder="environment" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="value"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Value</FormLabel>
                        <FormControl>
                          <Input placeholder="dev" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <DialogFooter className="gap-2">
                    <Button type="button" variant="outline" onClick={() => setCreateOpen(false)}>
                      Cancel
                    </Button>
                    <Button type="submit" disabled={createForm.formState.isSubmitting}>
                      {createForm.formState.isSubmitting ? "Creating…" : "Create"}
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </div>
      </div>

      <div className="bg-background overflow-hidden rounded-2xl border shadow-sm">
        <div className="overflow-x-auto">
          <Table>
            <TableHeader>
              <TableRow>
                <TableHead>Key</TableHead>
                <TableHead>Value</TableHead>
                <TableHead>Annotation</TableHead>
                <TableHead className="w-[180px] text-right">Actions</TableHead>
              </TableRow>
            </TableHeader>
            <TableBody>
              {filtered.map((t) => (
                <TableRow key={t.id}>
                  <TableCell>{t.key}</TableCell>
                  <TableCell>{t.value}</TableCell>
                  <TableCell>
                    <div className="flex items-center gap-2">
                      <AnnotationBadge t={t} />
                      <code className="text-muted-foreground text-xs">
                        {truncateMiddle(t.id!, 6)}
                      </code>
                    </div>
                  </TableCell>

                  <TableCell>
                    <div className="flex justify-end gap-2">
                      <Button variant="outline" size="sm" onClick={() => openEdit(t)}>
                        <Pencil className="mr-2 h-4 w-4" /> Edit
                      </Button>
                      <Button
                        variant="destructive"
                        size="sm"
                        onClick={() => setDeleteId(t.id!)}
                        disabled={deleteMut.isPending && deleteId === t.id}
                      >
                        {deleteMut.isPending && deleteId === t.id ? "Deleting…" : "Delete"}
                      </Button>
                    </div>
                  </TableCell>
                </TableRow>
              ))}

              {filtered.length === 0 && (
                <TableRow>
                  <TableCell colSpan={4} className="text-muted-foreground py-10 text-center">
                    <CircleSlash2 className="mx-auto mb-2 h-6 w-6 opacity-60" />
                    No labels match your search.
                  </TableCell>
                </TableRow>
              )}
            </TableBody>
          </Table>
        </div>
      </div>

      {/* Update dialog */}
      <Dialog open={updateOpen} onOpenChange={setUpdateOpen}>
        <DialogContent className="sm:max-w-lg">
          <DialogHeader>
            <DialogTitle>Edit Annotation</DialogTitle>
          </DialogHeader>
          <Form {...updateForm}>
            <form
              className="space-y-4"
              onSubmit={updateForm.handleSubmit((values) => {
                if (!editingId) return
                updateMut.mutate({ id: editingId, values })
              })}
            >
              <FormField
                control={updateForm.control}
                name="key"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Key</FormLabel>
                    <FormControl>
                      <Input placeholder="dedicated" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="value"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Value (optional)</FormLabel>
                    <FormControl>
                      <Input placeholder="gpu" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <DialogFooter className="gap-2">
                <Button type="button" variant="outline" onClick={() => setUpdateOpen(false)}>
                  Cancel
                </Button>
                <Button type="submit" disabled={updateMut.isPending}>
                  {updateMut.isPending ? "Saving…" : "Save changes"}
                </Button>
              </DialogFooter>
            </form>
          </Form>
        </DialogContent>
      </Dialog>

      {/* Delete confirm dialog */}
      <Dialog open={!!deleteId} onOpenChange={(open) => !open && setDeleteId(null)}>
        <DialogContent className="sm:max-w-md">
          <DialogHeader>
            <DialogTitle>Delete annotation</DialogTitle>
          </DialogHeader>
          <p className="text-muted-foreground text-sm">
            This action cannot be undone. Are you sure you want to delete this annotation?
          </p>
          <DialogFooter className="gap-2">
            <Button variant="outline" onClick={() => setDeleteId(null)}>
              Cancel
            </Button>
            <Button
              variant="destructive"
              onClick={() => deleteId && deleteMut.mutate(deleteId)}
              disabled={deleteMut.isPending}
            >
              {deleteMut.isPending ? "Deleting…" : "Delete"}
            </Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>
    </div>
  )
}
</file>

<file path="ui/src/pages/cluster-page.tsx">
import { useEffect, useMemo, useState } from "react";
import { actionsApi } from "@/api/actions";
import { clustersApi } from "@/api/clusters";
import { dnsApi } from "@/api/dns";
import { loadBalancersApi } from "@/api/loadbalancers";
import { nodePoolsApi } from "@/api/node_pools";
import { serversApi } from "@/api/servers";
import type { DtoActionResponse, DtoClusterResponse, DtoClusterRunResponse, DtoDomainResponse, DtoLoadBalancerResponse, DtoNodePoolResponse, DtoRecordSetResponse, DtoServerResponse } from "@/sdk";
import { zodResolver } from "@hookform/resolvers/zod";
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
import { AlertCircle, CheckCircle2, CircleSlash2, FileCode2, Globe2, Loader2, MapPin, Pencil, Plus, Search, Server, Wrench } from "lucide-react";
import { useForm } from "react-hook-form";
import { toast } from "sonner";
import { z } from "zod";



import { truncateMiddle } from "@/lib/utils";
import { Badge } from "@/components/ui/badge";
import { Button } from "@/components/ui/button";
import { Dialog, DialogContent, DialogFooter, DialogHeader, DialogTitle, DialogTrigger } from "@/components/ui/dialog";
import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from "@/components/ui/form";
import { Input } from "@/components/ui/input";
import { Label } from "@/components/ui/label";
import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
import { Textarea } from "@/components/ui/textarea";





// --- Schemas ---

const createClusterSchema = z.object({
  name: z.string().trim().min(1, "Name is required").max(120, "Max 120 chars"),
  cluster_provider: z.string().trim().min(1, "Provider is required").max(120, "Max 120 chars"),
  region: z.string().trim().min(1, "Region is required").max(120, "Max 120 chars"),
  docker_image: z.string().trim().min(1, "Docker Image is required"),
  docker_tag: z.string().trim().min(1, "Docker Tag is required"),
})
type CreateClusterInput = z.input<typeof createClusterSchema>

const updateClusterSchema = createClusterSchema.partial()
type UpdateClusterValues = z.infer<typeof updateClusterSchema>

// --- Data normalization helpers (fixes rows.some is not a function) ---

function asArray<T>(res: any): T[] {
  if (Array.isArray(res)) return res as T[]
  if (Array.isArray(res?.data)) return res.data as T[]
  if (Array.isArray(res?.body)) return res.body as T[]
  if (Array.isArray(res?.result)) return res.result as T[]
  return []
}

function asObject<T>(res: any): T {
  // for get endpoints that might return {data: {...}}
  if (res?.data && typeof res.data === "object") return res.data as T
  return res as T
}

// --- UI helpers ---

function StatusBadge({ status }: { status?: string | null }) {
  const value = (status ?? "").toLowerCase()

  if (!value) {
    return (
      <Badge variant="outline" className="text-xs">
        unknown
      </Badge>
    )
  }

  if (value === "ready") {
    return (
      <Badge variant="default" className="flex items-center gap-1 text-xs">
        <CheckCircle2 className="h-3 w-3" />
        ready
      </Badge>
    )
  }

  if (value === "failed") {
    return (
      <Badge variant="destructive" className="flex items-center gap-1 text-xs">
        <AlertCircle className="h-3 w-3" />
        failed
      </Badge>
    )
  }

  if (value === "provisioning" || value === "pending" || value === "pre_pending") {
    return (
      <Badge variant="secondary" className="flex items-center gap-1 text-xs">
        <Loader2 className="h-3 w-3 animate-spin" />
        {value.replace("_", " ")}
      </Badge>
    )
  }

  if (value === "incomplete") {
    return (
      <Badge variant="outline" className="flex items-center gap-1 text-xs">
        <AlertCircle className="h-3 w-3" />
        incomplete
      </Badge>
    )
  }

  return (
    <Badge variant="outline" className="text-xs">
      {value}
    </Badge>
  )
}

function RunStatusBadge({ status }: { status?: string | null }) {
  const s = (status ?? "").toLowerCase()

  if (!s)
    return (
      <Badge variant="outline" className="text-xs">
        unknown
      </Badge>
    )

  if (s === "succeeded" || s === "success") {
    return (
      <Badge variant="default" className="flex items-center gap-1 text-xs">
        <CheckCircle2 className="h-3 w-3" />
        succeeded
      </Badge>
    )
  }

  if (s === "failed" || s === "error") {
    return (
      <Badge variant="destructive" className="flex items-center gap-1 text-xs">
        <AlertCircle className="h-3 w-3" />
        failed
      </Badge>
    )
  }

  if (s === "queued" || s === "running") {
    return (
      <Badge variant="secondary" className="flex items-center gap-1 text-xs">
        <Loader2 className="h-3 w-3 animate-spin" />
        {s}
      </Badge>
    )
  }

  return (
    <Badge variant="outline" className="text-xs">
      {s}
    </Badge>
  )
}

function fmtTime(v: any): string {
  if (!v) return "-"
  try {
    const d = v instanceof Date ? v : new Date(v)
    if (Number.isNaN(d.getTime())) return "-"
    return d.toLocaleString()
  } catch {
    return "-"
  }
}

function ClusterSummary({ c }: { c: DtoClusterResponse }) {
  return (
    <div className="text-muted-foreground flex flex-col gap-1 text-xs">
      <div className="flex flex-wrap items-center gap-2">
        {c.cluster_provider && (
          <span className="inline-flex items-center gap-1">
            <Globe2 className="h-3 w-3" />
            {c.cluster_provider}
          </span>
        )}
        {c.region && (
          <span className="inline-flex items-center gap-1">
            <MapPin className="h-3 w-3" />
            {c.region}
          </span>
        )}
      </div>
      <div className="flex flex-wrap items-center gap-2 font-mono">
        {c.random_token && (
          <span>
            token: <span className="ml-1">{truncateMiddle(c.random_token, 8)}</span>
          </span>
        )}
        {c.certificate_key && (
          <span>
            cert: <span className="ml-1">{truncateMiddle(c.certificate_key, 8)}</span>
          </span>
        )}
      </div>
    </div>
  )
}

export const ClustersPage = () => {
  const [filter, setFilter] = useState<string>("")
  const [createOpen, setCreateOpen] = useState<boolean>(false)
  const [updateOpen, setUpdateOpen] = useState<boolean>(false)
  const [deleteId, setDeleteId] = useState<string | null>(null)
  const [editingId, setEditingId] = useState<string | null>(null)

  // Configure dialog state
  const [configCluster, setConfigCluster] = useState<DtoClusterResponse | null>(null)

  const [captainDomainId, setCaptainDomainId] = useState("")
  const [recordSetId, setRecordSetId] = useState("")
  const [appsLbId, setAppsLbId] = useState("")
  const [glueopsLbId, setGlueopsLbId] = useState("")
  const [bastionId, setBastionId] = useState("")
  const [nodePoolId, setNodePoolId] = useState("")
  const [kubeconfigText, setKubeconfigText] = useState("")
  const [busyKey, setBusyKey] = useState<string | null>(null)

  const isBusy = (k: string) => busyKey === k

  const qc = useQueryClient()

  // --- Queries ---

  const clustersQ = useQuery({
    queryKey: ["clusters"],
    queryFn: async () => asArray<DtoClusterResponse>(await clustersApi.listClusters()),
  })

  const lbsQ = useQuery({
    queryKey: ["load-balancers"],
    queryFn: async () =>
      asArray<DtoLoadBalancerResponse>(await loadBalancersApi.listLoadBalancers()),
  })

  const domainsQ = useQuery({
    queryKey: ["domains"],
    queryFn: async () => asArray<DtoDomainResponse>(await dnsApi.listDomains()),
  })

  const recordSetsQ = useQuery({
    queryKey: ["record-sets", captainDomainId],
    enabled: !!captainDomainId,
    queryFn: async () =>
      asArray<DtoRecordSetResponse>(await dnsApi.listRecordSetsByDomain(captainDomainId)),
  })

  const serversQ = useQuery({
    queryKey: ["servers"],
    queryFn: async () => asArray<DtoServerResponse>(await serversApi.listServers()),
  })

  const npQ = useQuery({
    queryKey: ["node-pools"],
    queryFn: async () => asArray<DtoNodePoolResponse>(await nodePoolsApi.listNodePools()),
  })

  const actionsQ = useQuery({
    queryKey: ["actions"],
    queryFn: async () => asArray<DtoActionResponse>(await actionsApi.listActions()),
  })

  const runsQ = useQuery({
    queryKey: ["cluster-runs", configCluster?.id],
    enabled: !!configCluster?.id,
    queryFn: async () =>
      asArray<DtoClusterRunResponse>(await clustersApi.listClusterRuns(configCluster!.id!)),
    refetchInterval: (data) => {
      // IMPORTANT: data might not be array if queryFn isn't normalizing. But it is here anyway.
      const rows = Array.isArray(data) ? data : []
      const active = rows.some((r: any) => {
        const s = String(r?.status ?? "").toLowerCase()
        return s === "queued" || s === "running"
      })
      return active ? 2000 : false
    },
  })

  const actionLabelByTarget = useMemo(() => {
    const m = new Map<string, string>()
    ;(actionsQ.data ?? []).forEach((a) => {
      if (a.make_target) m.set(a.make_target, a.label ?? a.make_target)
    })
    return m
  }, [actionsQ.data])

  const runDisplayName = (r: DtoClusterRunResponse) =>
    actionLabelByTarget.get(r.action ?? "") ?? r.action ?? "unknown"

  // --- Create ---

  const createForm = useForm<CreateClusterInput>({
    resolver: zodResolver(createClusterSchema),
    defaultValues: {
      name: "",
      cluster_provider: "",
      region: "",
      docker_image: "",
      docker_tag: "",
    },
  })

  const createMut = useMutation({
    mutationFn: (values: CreateClusterInput) => clustersApi.createCluster(values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["clusters"] })
      createForm.reset()
      setCreateOpen(false)
      toast.success("Cluster created successfully.")
    },
    onError: (err: any) =>
      toast.error(err?.message ?? "There was an error while creating the cluster"),
  })

  // --- Update basic details ---

  const updateForm = useForm<UpdateClusterValues>({
    resolver: zodResolver(updateClusterSchema),
    defaultValues: {},
  })

  const updateMut = useMutation({
    mutationFn: ({ id, values }: { id: string; values: UpdateClusterValues }) =>
      clustersApi.updateCluster(id, values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["clusters"] })
      updateForm.reset()
      setUpdateOpen(false)
      toast.success("Cluster updated successfully.")
    },
    onError: (err: any) =>
      toast.error(err?.message ?? "There was an error while updating the cluster"),
  })

  const openEdit = (cluster: DtoClusterResponse) => {
    if (!cluster.id) return
    setEditingId(cluster.id)
    updateForm.reset({
      name: cluster.name ?? "",
      cluster_provider: cluster.cluster_provider ?? "",
      region: cluster.region ?? "",
      docker_image: cluster.docker_image ?? "",
      docker_tag: cluster.docker_tag ?? "",
    })
    setUpdateOpen(true)
  }

  // --- Delete ---

  const deleteMut = useMutation({
    mutationFn: (id: string) => clustersApi.deleteCluster(id),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["clusters"] })
      setDeleteId(null)
      toast.success("Cluster deleted successfully.")
    },
    onError: (err: any) =>
      toast.error(err?.message ?? "There was an error while deleting the cluster"),
  })

  // --- Run Action ---

  const runActionMut = useMutation({
    mutationFn: ({ clusterID, actionID }: { clusterID: string; actionID: string }) =>
      clustersApi.runClusterAction(clusterID, actionID),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["cluster-runs", configCluster?.id] })
      toast.success("Action enqueued.")
    },
    onError: (err: any) => toast.error(err?.message ?? "Failed to enqueue action."),
  })

  async function handleRunAction(actionID: string) {
    if (!configCluster?.id) return
    setBusyKey(`run:${actionID}`)
    try {
      await runActionMut.mutateAsync({ clusterID: configCluster.id, actionID })
    } finally {
      setBusyKey(null)
    }
  }

  // --- Filter ---

  const filtered = useMemo(() => {
    const data: DtoClusterResponse[] = clustersQ.data ?? []
    const q = filter.trim().toLowerCase()

    return q
      ? data.filter((c) => {
          return (
            c.name?.toLowerCase().includes(q) ||
            c.cluster_provider?.toLowerCase().includes(q) ||
            c.region?.toLowerCase().includes(q) ||
            c.status?.toLowerCase().includes(q)
          )
        })
      : data
  }, [filter, clustersQ.data])

  // --- Config dialog helpers ---

  useEffect(() => {
    if (!configCluster) {
      setCaptainDomainId("")
      setRecordSetId("")
      setAppsLbId("")
      setGlueopsLbId("")
      setBastionId("")
      setNodePoolId("")
      setKubeconfigText("")
      return
    }

    if (configCluster.captain_domain?.id) setCaptainDomainId(configCluster.captain_domain.id)
    if (configCluster.control_plane_record_set?.id)
      setRecordSetId(configCluster.control_plane_record_set.id)
    if (configCluster.apps_load_balancer?.id) setAppsLbId(configCluster.apps_load_balancer.id)
    if (configCluster.glueops_load_balancer?.id)
      setGlueopsLbId(configCluster.glueops_load_balancer.id)
    if (configCluster.bastion_server?.id) setBastionId(configCluster.bastion_server.id)
  }, [configCluster])

  async function refreshConfigCluster() {
    if (!configCluster?.id) return
    try {
      const updatedRaw = await clustersApi.getCluster(configCluster.id)
      const updated = asObject<DtoClusterResponse>(updatedRaw)
      setConfigCluster(updated)
      await qc.invalidateQueries({ queryKey: ["clusters"] })
      await qc.invalidateQueries({ queryKey: ["cluster-runs", configCluster.id] })
    } catch {
      // ignore
    }
  }

  async function handleAttachCaptain() {
    if (!configCluster?.id) return
    if (!captainDomainId) return toast.error("Domain is required")
    setBusyKey("captain")
    try {
      await clustersApi.attachCaptainDomain(configCluster.id, { domain_id: captainDomainId })
      toast.success("Captain domain attached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to attach captain domain.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleDetachCaptain() {
    if (!configCluster?.id) return
    setBusyKey("captain")
    try {
      await clustersApi.detachCaptainDomain(configCluster.id)
      toast.success("Captain domain detached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to detach captain domain.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleAttachRecordSet() {
    if (!configCluster?.id) return
    if (!recordSetId) return toast.error("Record set is required")
    setBusyKey("recordset")
    try {
      await clustersApi.attachControlPlaneRecordSet(configCluster.id, {
        record_set_id: recordSetId,
      })
      toast.success("Control plane record set attached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to attach record set.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleDetachRecordSet() {
    if (!configCluster?.id) return
    setBusyKey("recordset")
    try {
      await clustersApi.detachControlPlaneRecordSet(configCluster.id)
      toast.success("Control plane record set detached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to detach record set.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleAttachAppsLb() {
    if (!configCluster?.id) return
    if (!appsLbId) return toast.error("Load balancer is required")
    setBusyKey("apps-lb")
    try {
      await clustersApi.attachAppsLoadBalancer(configCluster.id, { load_balancer_id: appsLbId })
      toast.success("Apps load balancer attached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to attach apps load balancer.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleDetachAppsLb() {
    if (!configCluster?.id) return
    setBusyKey("apps-lb")
    try {
      await clustersApi.detachAppsLoadBalancer(configCluster.id)
      toast.success("Apps load balancer detached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to detach apps load balancer.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleAttachGlueopsLb() {
    if (!configCluster?.id) return
    if (!glueopsLbId) return toast.error("Load balancer is required")
    setBusyKey("glueops-lb")
    try {
      await clustersApi.attachGlueOpsLoadBalancer(configCluster.id, {
        load_balancer_id: glueopsLbId,
      })
      toast.success("GlueOps load balancer attached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to attach GlueOps load balancer.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleDetachGlueopsLb() {
    if (!configCluster?.id) return
    setBusyKey("glueops-lb")
    try {
      await clustersApi.detachGlueOpsLoadBalancer(configCluster.id)
      toast.success("GlueOps load balancer detached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to detach GlueOps load balancer.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleAttachBastion() {
    if (!configCluster?.id) return
    if (!bastionId) return toast.error("Server is required")
    setBusyKey("bastion")
    try {
      await clustersApi.attachBastion(configCluster.id, { server_id: bastionId })
      toast.success("Bastion server attached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to attach bastion server.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleDetachBastion() {
    if (!configCluster?.id) return
    setBusyKey("bastion")
    try {
      await clustersApi.detachBastion(configCluster.id)
      toast.success("Bastion server detached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to detach bastion server.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleAttachNodePool() {
    if (!configCluster?.id) return
    if (!nodePoolId) return toast.error("Node pool is required")
    setBusyKey("nodepool")
    try {
      await clustersApi.attachNodePool(configCluster.id, nodePoolId)
      toast.success("Node pool attached.")
      setNodePoolId("")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to attach node pool.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleDetachNodePool(npId: string) {
    if (!configCluster?.id) return
    setBusyKey("nodepool")
    try {
      await clustersApi.detachNodePool(configCluster.id, npId)
      toast.success("Node pool detached.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to detach node pool.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleSetKubeconfig() {
    if (!configCluster?.id) return
    if (!kubeconfigText.trim()) return toast.error("Kubeconfig is required")
    setBusyKey("kubeconfig")
    try {
      await clustersApi.setKubeconfig(configCluster.id, { kubeconfig: kubeconfigText })
      toast.success("Kubeconfig updated.")
      setKubeconfigText("")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to set kubeconfig.")
    } finally {
      setBusyKey(null)
    }
  }

  async function handleClearKubeconfig() {
    if (!configCluster?.id) return
    setBusyKey("kubeconfig")
    try {
      await clustersApi.clearKubeconfig(configCluster.id)
      toast.success("Kubeconfig cleared.")
      await refreshConfigCluster()
    } catch (err: any) {
      toast.error(err?.message ?? "Failed to clear kubeconfig.")
    } finally {
      setBusyKey(null)
    }
  }

  if (clustersQ.isLoading) return <div className="p-6">Loading clusters…</div>
  if (clustersQ.error) return <div className="p-6 text-red-500">Error loading clusters.</div>

  const allLbs: DtoLoadBalancerResponse[] = lbsQ.data ?? []
  const appsLbs = allLbs.filter((lb) => lb.kind === "public")
  const glueopsLbs = allLbs.filter((lb) => lb.kind === "glueops")

  return (
    <div className="space-y-4 p-6">
      <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
        <h1 className="mb-4 text-2xl font-bold">Clusters</h1>

        <div className="flex flex-wrap items-center gap-2">
          <div className="relative">
            <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
            <Input
              value={filter}
              onChange={(e) => setFilter(e.target.value)}
              placeholder="Search clusters"
              className="w-64 pl-8"
            />
          </div>

          <Dialog open={createOpen} onOpenChange={setCreateOpen}>
            <DialogTrigger asChild>
              <Button onClick={() => setCreateOpen(true)}>
                <Plus className="mr-2 h-4 w-4" />
                Create Cluster
              </Button>
            </DialogTrigger>
            <DialogContent className="sm:max-w-lg">
              <DialogHeader>
                <DialogTitle>Create Cluster</DialogTitle>
              </DialogHeader>

              <Form {...createForm}>
                <form
                  className="space-y-4"
                  onSubmit={createForm.handleSubmit((v) => createMut.mutate(v))}
                >
                  <FormField
                    control={createForm.control}
                    name="name"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Name</FormLabel>
                        <FormControl>
                          <Input placeholder="prod-cluster-eu-west-1" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="cluster_provider"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Provider</FormLabel>
                        <FormControl>
                          <Input placeholder="aws / hetzner / baremetal" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="region"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Region</FormLabel>
                        <FormControl>
                          <Input placeholder="eu-west-1" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="docker_image"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Docker Image</FormLabel>
                        <FormControl>
                          <Input placeholder="ghcr.io/glueops/gluekube" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="docker_tag"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Docker Tag</FormLabel>
                        <FormControl>
                          <Input placeholder="v1.33" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <DialogFooter className="gap-2">
                    <Button type="button" variant="outline" onClick={() => setCreateOpen(false)}>
                      Cancel
                    </Button>
                    <Button type="submit" disabled={createMut.isPending}>
                      {createMut.isPending ? "Creating…" : "Create"}
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </div>
      </div>

      <div className="bg-background overflow-hidden rounded-2xl border shadow-sm">
        <div className="overflow-x-auto">
          <Table>
            <TableHeader>
              <TableRow>
                <TableHead>Name</TableHead>
                <TableHead>Provider</TableHead>
                <TableHead>Region</TableHead>
                <TableHead>Status</TableHead>
                <TableHead>Docker</TableHead>
                <TableHead>Summary</TableHead>
                <TableHead className="w-[320px] text-right">Actions</TableHead>
              </TableRow>
            </TableHeader>
            <TableBody>
              {filtered.map((c: DtoClusterResponse) => (
                <TableRow key={c.id}>
                  <TableCell className="font-medium">{c.name}</TableCell>
                  <TableCell>{c.cluster_provider}</TableCell>
                  <TableCell>{c.region}</TableCell>
                  <TableCell>
                    <StatusBadge status={c.status} />
                    {c.last_error && (
                      <div className="mt-1 text-xs text-red-500">
                        {truncateMiddle(c.last_error, 80)}
                      </div>
                    )}
                  </TableCell>
                  <TableCell>{(c.docker_image ?? "") + ":" + (c.docker_tag ?? "")}</TableCell>
                  <TableCell>
                    <ClusterSummary c={c} />
                    {c.id && (
                      <code className="text-muted-foreground mt-1 block text-xs">
                        {truncateMiddle(c.id, 6)}
                      </code>
                    )}
                  </TableCell>
                  <TableCell>
                    <div className="flex flex-wrap justify-end gap-2">
                      <Button variant="ghost" size="sm" onClick={() => setConfigCluster(c)}>
                        <Wrench className="mr-1 h-4 w-4" /> Configure
                      </Button>
                      <Button variant="outline" size="sm" onClick={() => openEdit(c)}>
                        <Pencil className="mr-2 h-4 w-4" /> Edit
                      </Button>
                      <Button
                        variant="destructive"
                        size="sm"
                        onClick={() => c.id && setDeleteId(c.id)}
                        disabled={deleteMut.isPending && deleteId === c.id}
                      >
                        {deleteMut.isPending && deleteId === c.id ? "Deleting…" : "Delete"}
                      </Button>
                    </div>
                  </TableCell>
                </TableRow>
              ))}

              {filtered.length === 0 && (
                <TableRow>
                  <TableCell colSpan={7} className="text-muted-foreground py-10 text-center">
                    <CircleSlash2 className="mx-auto mb-2 h-6 w-6 opacity-60" />
                    No clusters match your search.
                  </TableCell>
                </TableRow>
              )}
            </TableBody>
          </Table>
        </div>
      </div>

      {/* Update dialog */}
      <Dialog open={updateOpen} onOpenChange={setUpdateOpen}>
        <DialogContent className="sm:max-w-lg">
          <DialogHeader>
            <DialogTitle>Edit Cluster</DialogTitle>
          </DialogHeader>

          <Form {...updateForm}>
            <form
              className="space-y-4"
              onSubmit={updateForm.handleSubmit((values) => {
                if (!editingId) return
                updateMut.mutate({ id: editingId, values })
              })}
            >
              <FormField
                control={updateForm.control}
                name="name"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Name</FormLabel>
                    <FormControl>
                      <Input placeholder="prod-cluster-eu-west-1" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="cluster_provider"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Provider</FormLabel>
                    <FormControl>
                      <Input placeholder="aws / hetzner / baremetal" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="region"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Region</FormLabel>
                    <FormControl>
                      <Input placeholder="eu-west-1" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="docker_image"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Docker Image</FormLabel>
                    <FormControl>
                      <Input placeholder="ghcr.io/glueops/gluekube" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="docker_tag"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Docker Tag</FormLabel>
                    <FormControl>
                      <Input placeholder="v1.33" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <DialogFooter className="gap-2">
                <Button type="button" variant="outline" onClick={() => setUpdateOpen(false)}>
                  Cancel
                </Button>
                <Button type="submit" disabled={updateMut.isPending}>
                  {updateMut.isPending ? "Saving…" : "Save changes"}
                </Button>
              </DialogFooter>
            </form>
          </Form>
        </DialogContent>
      </Dialog>

      {/* Configure dialog (attachments + kubeconfig + node pools + actions/runs) */}
      <Dialog open={!!configCluster} onOpenChange={(open) => !open && setConfigCluster(null)}>
        <DialogContent className="max-h-[90vh] overflow-y-auto sm:max-w-2xl lg:max-w-250 ">
          <DialogHeader>
            <DialogTitle>
              Configure Cluster{configCluster?.name ? `: ${configCluster.name}` : ""}
            </DialogTitle>
          </DialogHeader>
          {configCluster && (
            <div className="space-y-6 py-2">
              {/* Cluster Actions */}
              <section className="space-y-2 rounded-xl border p-4">
                <div className="flex items-center justify-between gap-2">
                  <div>
                    <div className="flex items-center gap-2">
                      <Wrench className="h-4 w-4" />
                      <h3 className="text-sm font-semibold">Cluster Actions</h3>
                    </div>
                    <p className="text-muted-foreground text-xs">
                      Run admin-configured actions on this cluster. Actions are executed
                      asynchronously.
                    </p>
                  </div>

                  <Button
                    size="sm"
                    variant="outline"
                    onClick={() => runsQ.refetch()}
                    disabled={runsQ.isFetching || !configCluster?.id}
                  >
                    {runsQ.isFetching ? "Refreshing…" : "Refresh runs"}
                  </Button>
                </div>

                <div className="space-y-2">
                  {actionsQ.isLoading ? (
                    <p className="text-muted-foreground text-xs">Loading actions…</p>
                  ) : (actionsQ.data ?? []).length === 0 ? (
                    <p className="text-muted-foreground text-xs">
                      No actions configured yet. Create actions in Admin → Actions.
                    </p>
                  ) : (
                    <div className="divide-border rounded-md border">
                      {(actionsQ.data ?? []).map((a: DtoActionResponse) => (
                        <div
                          key={a.id}
                          className="flex items-center justify-between gap-3 px-3 py-2"
                        >
                          <div className="flex min-w-0 flex-col">
                            <div className="flex items-center gap-2">
                              <span className="text-sm font-medium">{a.label}</span>
                              {a.make_target && (
                                <code className="text-muted-foreground text-xs">
                                  {a.make_target}
                                </code>
                              )}
                            </div>
                            {a.description && (
                              <p className="text-muted-foreground line-clamp-2 text-xs">
                                {a.description}
                              </p>
                            )}
                          </div>

                          <Button
                            size="sm"
                            onClick={() => a.id && handleRunAction(a.id)}
                            disabled={!a.id || isBusy(`run:${a.id}`)}
                          >
                            {a.id && isBusy(`run:${a.id}`) ? "Enqueueing…" : "Run"}
                          </Button>
                        </div>
                      ))}
                    </div>
                  )}
                </div>

                <div className="mt-3 space-y-1">
                  <Label className="text-xs">Recent Runs</Label>

                  {runsQ.isLoading ? (
                    <p className="text-muted-foreground text-xs">Loading runs…</p>
                  ) : (runsQ.data ?? []).length === 0 ? (
                    <p className="text-muted-foreground text-xs">No runs yet for this cluster.</p>
                  ) : (
                    <div className="overflow-x-auto rounded-md border">
                      <Table>
                        <TableHeader>
                          <TableRow>
                            <TableHead>Action</TableHead>
                            <TableHead>Status</TableHead>
                            <TableHead>Created</TableHead>
                            <TableHead>Finished</TableHead>
                            <TableHead>Error</TableHead>
                          </TableRow>
                        </TableHeader>
                        <TableBody>
                          {(runsQ.data ?? []).slice(0, 20).map((r) => (
                            <TableRow key={r.id}>
                              <TableCell className="min-w-[220px]">
                                <div className="flex flex-col">
                                  <span className="text-sm font-medium">{runDisplayName(r)}</span>
                                  {r.id && (
                                    <code className="text-muted-foreground text-xs">
                                      {truncateMiddle(r.id, 8)}
                                    </code>
                                  )}
                                </div>
                              </TableCell>
                              <TableCell>
                                <RunStatusBadge status={r.status} />
                              </TableCell>
                              <TableCell className="text-xs">
                                {fmtTime((r as any).created_at)}
                              </TableCell>
                              <TableCell className="text-xs">
                                {fmtTime((r as any).finished_at)}
                              </TableCell>
                              <TableCell className="text-xs">
                                {r.error ? truncateMiddle(r.error, 80) : "-"}
                              </TableCell>
                            </TableRow>
                          ))}
                        </TableBody>
                      </Table>
                    </div>
                  )}
                </div>
              </section>

              {/* Kubeconfig */}
              <section className="space-y-2 rounded-xl border p-4">
                <div>
                  <div className="flex items-center gap-2">
                    <FileCode2 className="h-4 w-4" />
                    <h3 className="text-sm font-semibold">Kubeconfig</h3>
                  </div>
                  <p className="text-muted-foreground text-xs">
                    Paste the kubeconfig for this cluster. It will be stored encrypted and never
                    returned by the API.
                  </p>
                </div>

                <Textarea
                  value={kubeconfigText}
                  onChange={(e) => setKubeconfigText(e.target.value)}
                  rows={6}
                  placeholder={"apiVersion: v1\nclusters:\n  - cluster: ..."}
                  className="font-mono text-xs"
                />

                <div className="flex flex-wrap gap-2">
                  <Button size="sm" onClick={handleSetKubeconfig} disabled={isBusy("kubeconfig")}>
                    {isBusy("kubeconfig") ? "Saving…" : "Save kubeconfig"}
                  </Button>
                  <Button
                    size="sm"
                    variant="outline"
                    onClick={handleClearKubeconfig}
                    disabled={isBusy("kubeconfig")}
                  >
                    Clear kubeconfig
                  </Button>
                </div>
              </section>

              {/* Captain Domain */}
              <section className="space-y-2 rounded-xl border p-4">
                <div className="flex items-center justify-between gap-2">
                  <div>
                    <h3 className="text-sm font-semibold">Captain Domain</h3>
                    <p className="text-muted-foreground text-xs">
                      Domain used for the AutoGlue captain endpoint.
                    </p>
                  </div>
                  <div className="text-right text-xs">
                    <div className="font-mono">
                      {configCluster.captain_domain
                        ? configCluster.captain_domain.domain_name
                        : "Not attached"}
                    </div>
                  </div>
                </div>

                <div className="flex flex-col gap-2 md:flex-row md:items-end">
                  <div className="flex-1">
                    <Label className="text-xs">Domain</Label>
                    <Select
                      value={captainDomainId}
                      onValueChange={(val) => {
                        setCaptainDomainId(val)
                        setRecordSetId("")
                      }}
                    >
                      <SelectTrigger className="w-full">
                        <SelectValue
                          placeholder={domainsQ.isLoading ? "Loading domains…" : "Select domain"}
                        />
                      </SelectTrigger>
                      <SelectContent>
                        {(domainsQ.data ?? []).map((d: DtoDomainResponse) => (
                          <SelectItem key={d.id!} value={d.id!}>
                            {d.domain_name}
                          </SelectItem>
                        ))}
                      </SelectContent>
                    </Select>
                    <p className="text-muted-foreground mt-1 text-[11px]">
                      Once a domain is attached, control plane record sets for that domain will be
                      available below.
                    </p>
                  </div>
                  <div className="flex gap-2">
                    <Button
                      size="sm"
                      onClick={handleAttachCaptain}
                      disabled={isBusy("captain") || domainsQ.isLoading}
                    >
                      {isBusy("captain") ? "Attaching…" : "Attach"}
                    </Button>
                    <Button
                      size="sm"
                      variant="outline"
                      onClick={handleDetachCaptain}
                      disabled={isBusy("captain") || !configCluster.captain_domain}
                    >
                      Detach
                    </Button>
                  </div>
                </div>
              </section>

              {/* Control Plane Record Set */}
              {captainDomainId && (
                <section className="space-y-2 rounded-xl border p-4">
                  <div className="flex items-center justify-between gap-2">
                    <div>
                      <h3 className="text-sm font-semibold">Control Plane Record Set</h3>
                      <p className="text-muted-foreground text-xs">
                        DNS record set used for the cluster control plane endpoint.
                      </p>
                    </div>
                    <div className="text-right text-xs">
                      <div className="font-mono">
                        {configCluster.control_plane_record_set
                          ? configCluster.control_plane_record_set.name
                          : "Not attached"}
                      </div>
                    </div>
                  </div>

                  <div className="flex flex-col gap-2 md:flex-row md:items-end">
                    <div className="flex-1">
                      <Label className="text-xs">Record Set</Label>
                      <Select value={recordSetId} onValueChange={(val) => setRecordSetId(val)}>
                        <SelectTrigger className="w-full">
                          <SelectValue
                            placeholder={
                              recordSetsQ.isLoading ? "Loading record sets…" : "Select record set"
                            }
                          />
                        </SelectTrigger>
                        <SelectContent>
                          {(recordSetsQ.data ?? []).map((rs: DtoRecordSetResponse) => (
                            <SelectItem key={rs.id!} value={rs.id!}>
                              {rs.name} · {rs.type}
                            </SelectItem>
                          ))}
                        </SelectContent>
                      </Select>
                    </div>
                    <div className="flex gap-2">
                      <Button
                        size="sm"
                        onClick={handleAttachRecordSet}
                        disabled={isBusy("recordset") || recordSetsQ.isLoading}
                      >
                        {isBusy("recordset") ? "Attaching…" : "Attach"}
                      </Button>
                      <Button
                        size="sm"
                        variant="outline"
                        onClick={handleDetachRecordSet}
                        disabled={isBusy("recordset") || !configCluster.control_plane_record_set}
                      >
                        Detach
                      </Button>
                    </div>
                  </div>
                </section>
              )}

              {/* Apps Load Balancer */}
              <section className="space-y-2 rounded-xl border p-4">
                <div className="flex items-center justify-between gap-2">
                  <div>
                    <h3 className="text-sm font-semibold">Apps Load Balancer</h3>
                    <p className="text-muted-foreground text-xs">
                      Frontend load balancer for application traffic.
                    </p>
                  </div>
                  <div className="text-right text-xs">
                    <div className="font-mono">
                      {configCluster.apps_load_balancer
                        ? configCluster.apps_load_balancer.name
                        : "Not attached"}
                    </div>
                  </div>
                </div>

                <div className="flex flex-col gap-2 md:flex-row md:items-end">
                  <div className="flex-1">
                    <Label className="text-xs">Apps Load Balancer</Label>
                    <Select value={appsLbId} onValueChange={(val) => setAppsLbId(val)}>
                      <SelectTrigger className="w-full">
                        <SelectValue
                          placeholder={
                            lbsQ.isLoading ? "Loading load balancers…" : "Select apps LB"
                          }
                        />
                      </SelectTrigger>
                      <SelectContent>
                        {appsLbs.map((lb) => (
                          <SelectItem key={lb.id!} value={lb.id!}>
                            {lb.name} · {lb.public_ip_address}
                          </SelectItem>
                        ))}
                      </SelectContent>
                    </Select>
                  </div>
                  <div className="flex gap-2">
                    <Button
                      size="sm"
                      onClick={handleAttachAppsLb}
                      disabled={isBusy("apps-lb") || lbsQ.isLoading}
                    >
                      {isBusy("apps-lb") ? "Attaching…" : "Attach"}
                    </Button>
                    <Button
                      size="sm"
                      variant="outline"
                      onClick={handleDetachAppsLb}
                      disabled={isBusy("apps-lb") || !configCluster.apps_load_balancer}
                    >
                      Detach
                    </Button>
                  </div>
                </div>
              </section>

              {/* GlueOps Load Balancer */}
              <section className="space-y-2 rounded-xl border p-4">
                <div className="flex items-center justify-between gap-2">
                  <div>
                    <h3 className="text-sm font-semibold">GlueOps / Control-plane Load Balancer</h3>
                    <p className="text-muted-foreground text-xs">
                      Load balancer for GlueOps/control-plane traffic.
                    </p>
                  </div>
                  <div className="text-right text-xs">
                    <div className="font-mono">
                      {configCluster.glueops_load_balancer
                        ? configCluster.glueops_load_balancer.name
                        : "Not attached"}
                    </div>
                  </div>
                </div>

                <div className="flex flex-col gap-2 md:flex-row md:items-end">
                  <div className="flex-1">
                    <Label className="text-xs">GlueOps Load Balancer</Label>
                    <Select value={glueopsLbId} onValueChange={(val) => setGlueopsLbId(val)}>
                      <SelectTrigger className="w-full">
                        <SelectValue
                          placeholder={
                            lbsQ.isLoading ? "Loading load balancers…" : "Select GlueOps LB"
                          }
                        />
                      </SelectTrigger>
                      <SelectContent>
                        {glueopsLbs.map((lb) => (
                          <SelectItem key={lb.id!} value={lb.id!}>
                            {lb.name} · {lb.private_ip_address}
                          </SelectItem>
                        ))}
                      </SelectContent>
                    </Select>
                  </div>
                  <div className="flex gap-2">
                    <Button
                      size="sm"
                      onClick={handleAttachGlueopsLb}
                      disabled={isBusy("glueops-lb") || lbsQ.isLoading}
                    >
                      {isBusy("glueops-lb") ? "Attaching…" : "Attach"}
                    </Button>
                    <Button
                      size="sm"
                      variant="outline"
                      onClick={handleDetachGlueopsLb}
                      disabled={isBusy("glueops-lb") || !configCluster.glueops_load_balancer}
                    >
                      Detach
                    </Button>
                  </div>
                </div>
              </section>

              {/* Bastion Server */}
              <section className="space-y-2 rounded-xl border p-4">
                <div className="flex items-center justify-between gap-2">
                  <div>
                    <div className="flex items-center gap-2">
                      <Server className="h-4 w-4" />
                      <h3 className="text-sm font-semibold">Bastion Server</h3>
                    </div>
                    <p className="text-muted-foreground text-xs">
                      SSH bastion used to reach the cluster nodes.
                    </p>
                  </div>
                  <div className="text-right text-xs">
                    <div className="font-mono">
                      {configCluster.bastion_server
                        ? (configCluster.bastion_server.hostname ?? configCluster.bastion_server.id)
                        : "Not attached"}
                    </div>
                  </div>
                </div>

                <div className="flex flex-col gap-2 md:flex-row md:items-end">
                  <div className="flex-1">
                    <Label className="text-xs">Bastion Server</Label>
                    <Select value={bastionId} onValueChange={(val) => setBastionId(val)}>
                      <SelectTrigger className="w-full">
                        <SelectValue
                          placeholder={serversQ.isLoading ? "Loading servers…" : "Select server"}
                        />
                      </SelectTrigger>
                      <SelectContent>
                        {(serversQ.data ?? []).map((s: DtoServerResponse) => (
                          <SelectItem key={s.id!} value={s.id!}>
                            {s.hostname ?? s.id} · {s.private_ip_address}
                          </SelectItem>
                        ))}
                      </SelectContent>
                    </Select>
                  </div>
                  <div className="flex gap-2">
                    <Button
                      size="sm"
                      onClick={handleAttachBastion}
                      disabled={isBusy("bastion") || serversQ.isLoading}
                    >
                      {isBusy("bastion") ? "Attaching…" : "Attach"}
                    </Button>
                    <Button
                      size="sm"
                      variant="outline"
                      onClick={handleDetachBastion}
                      disabled={isBusy("bastion") || !configCluster.bastion_server}
                    >
                      Detach
                    </Button>
                  </div>
                </div>
              </section>

              {/* Node Pools */}
              <section className="space-y-2 rounded-xl border p-4">
                <div>
                  <h3 className="text-sm font-semibold">Node Pools</h3>
                  <p className="text-muted-foreground text-xs">
                    Attach node pools to this cluster. Each node pool may have its own labels,
                    taints, and backing servers.
                  </p>
                </div>

                <div className="flex flex-col gap-2 md:flex-row md:items-end">
                  <div className="flex-1">
                    <Label className="text-xs">Available Node Pools</Label>
                    <Select value={nodePoolId} onValueChange={(val) => setNodePoolId(val)}>
                      <SelectTrigger className="w-full">
                        <SelectValue
                          placeholder={npQ.isLoading ? "Loading node pools…" : "Select node pool"}
                        />
                      </SelectTrigger>
                      <SelectContent>
                        {(npQ.data ?? []).map((np: DtoNodePoolResponse) => (
                          <SelectItem key={np.id!} value={np.id!}>
                            {np.name} · {np.role}
                          </SelectItem>
                        ))}
                      </SelectContent>
                    </Select>
                  </div>
                  <div className="flex gap-2">
                    <Button
                      size="sm"
                      onClick={handleAttachNodePool}
                      disabled={isBusy("nodepool") || npQ.isLoading}
                    >
                      {isBusy("nodepool") ? "Attaching…" : "Attach"}
                    </Button>
                  </div>
                </div>

                <div className="mt-3 space-y-1">
                  <Label className="text-xs">Attached Node Pools</Label>
                  {configCluster.node_pools && configCluster.node_pools.length > 0 ? (
                    <div className="divide-border mt-1 rounded-md border">
                      {configCluster.node_pools.map((np: DtoNodePoolResponse) => (
                        <div
                          key={np.id}
                          className="flex items-center justify-between gap-3 px-3 py-2 text-xs"
                        >
                          <div className="flex flex-col">
                            <span className="font-medium">{np.name}</span>
                            <span className="text-muted-foreground">
                              role: {np.role} · servers: {np.servers?.length ?? 0}
                            </span>
                          </div>
                          <Button
                            size="sm"
                            variant="outline"
                            onClick={() => np.id && handleDetachNodePool(np.id)}
                            disabled={isBusy("nodepool")}
                          >
                            Detach
                          </Button>
                        </div>
                      ))}
                    </div>
                  ) : (
                    <p className="text-muted-foreground mt-1 text-xs">
                      No node pools attached to this cluster yet.
                    </p>
                  )}
                </div>
              </section>

              <DialogFooter className="mt-2">
                <Button variant="outline" onClick={() => setConfigCluster(null)}>
                  Close
                </Button>
              </DialogFooter>
            </div>
          )}
        </DialogContent>
      </Dialog>

      {/* Delete confirm dialog */}
      <Dialog open={!!deleteId} onOpenChange={(open) => !open && setDeleteId(null)}>
        <DialogContent className="sm:max-w-md">
          <DialogHeader>
            <DialogTitle>Delete cluster</DialogTitle>
          </DialogHeader>
          <p className="text-muted-foreground text-sm">
            This action cannot be undone. Are you sure you want to delete this cluster?
          </p>
          <DialogFooter className="gap-2">
            <Button variant="outline" onClick={() => setDeleteId(null)}>
              Cancel
            </Button>
            <Button
              variant="destructive"
              onClick={() => deleteId && deleteMut.mutate(deleteId)}
              disabled={deleteMut.isPending}
            >
              {deleteMut.isPending ? "Deleting…" : "Delete"}
            </Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>
    </div>
  )
}
</file>

<file path="ui/src/pages/credential-page.tsx">
import { useMemo, useState } from "react"
import { credentialsApi } from "@/api/credentials"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import {
  AlertTriangle,
  Eye,
  Loader2,
  MoreHorizontal,
  Pencil,
  Plus,
  Search,
  Trash2,
} from "lucide-react"
import { Controller, useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import {
  AlertDialog,
  AlertDialogAction,
  AlertDialogCancel,
  AlertDialogContent,
  AlertDialogDescription,
  AlertDialogFooter,
  AlertDialogHeader,
  AlertDialogTitle,
  AlertDialogTrigger,
} from "@/components/ui/alert-dialog"
import { Badge } from "@/components/ui/badge"
import { Button } from "@/components/ui/button"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog"
import {
  DropdownMenu,
  DropdownMenuContent,
  DropdownMenuItem,
  DropdownMenuTrigger,
} from "@/components/ui/dropdown-menu"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form"
import { Input } from "@/components/ui/input"
import {
  Select,
  SelectContent,
  SelectItem,
  SelectTrigger,
  SelectValue,
} from "@/components/ui/select"
import { Switch } from "@/components/ui/switch"
import { Textarea } from "@/components/ui/textarea"

// -------------------- Constants --------------------

const AWS_ALLOWED_SERVICES = ["route53", "s3", "ec2", "iam", "rds", "dynamodb"] as const
type AwsSvc = (typeof AWS_ALLOWED_SERVICES)[number]

// -------------------- Schemas --------------------
// Zod v4 gotchas you hit:
// - .partial() cannot be used if the object contains refinements/effects (often true once you have transforms/refines).
// - .extend() cannot overwrite keys after refinements (requires .safeExtend()).
// Easiest fix: define CREATE and UPDATE schemas separately (no .partial(), no post-refinement .extend()).

const createCredentialSchema = z
  .object({
    credential_provider: z.enum(["aws", "cloudflare", "hetzner", "digitalocean", "generic"]),
    kind: z.enum(["aws_access_key", "api_token", "basic_auth", "oauth2"]),
    schema_version: z.number().default(1),
    name: z.string().min(1, "Name is required").max(100),
    scope_kind: z.enum(["provider", "service", "resource"]),
    scope_version: z.number().default(1),
    scope: z.any(),
    account_id: z
      .string()
      .optional()
      .or(z.literal(""))
      .transform((v) => (v ? v : undefined)),
    region: z
      .string()
      .optional()
      .or(z.literal(""))
      .transform((v) => (v ? v : undefined)),
    secret: z.any(),
  })
  .superRefine((val, ctx) => {
    // scope required unless provider scope
    if (val.scope_kind !== "provider" && !val.scope) {
      ctx.addIssue({
        code: z.ZodIssueCode.custom,
        path: ["scope"],
        message: `scope is required`,
      })
    }

    // AWS scope checks
    if (val.credential_provider === "aws") {
      if (val.scope_kind === "service") {
        const svc = (val.scope as any)?.service
        if (!AWS_ALLOWED_SERVICES.includes(svc)) {
          ctx.addIssue({
            code: z.ZodIssueCode.custom,
            path: ["scope"],
            message: `For AWS service scope, "service" must be one of: ${AWS_ALLOWED_SERVICES.join(", ")}`,
          })
        }
      }
      if (val.scope_kind === "resource") {
        const arn = (val.scope as any)?.arn
        if (typeof arn !== "string" || !arn.startsWith("arn:")) {
          ctx.addIssue({
            code: z.ZodIssueCode.custom,
            path: ["scope"],
            message: `For AWS resource scope, "arn" must start with "arn:"`,
          })
        }
      }
    }

    // secret requiredness by kind (create always validates)
    if (val.kind === "aws_access_key") {
      const sk = val.secret ?? {}
      const id = sk.access_key_id
      if (typeof id !== "string" || !/^[A-Z0-9]{20}$/.test(id)) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["secret"],
          message: `access_key_id must be 20 chars (A-Z0-9)`,
        })
      }
      if (typeof sk.secret_access_key !== "string" || sk.secret_access_key.length < 10) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["secret"],
          message: `secret_access_key is required`,
        })
      }
    }

    if (val.kind === "api_token") {
      const token = (val.secret ?? {}).token
      if (!token) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["secret"],
          message: `token is required`,
        })
      }
    }

    if (val.kind === "basic_auth") {
      const s = val.secret ?? {}
      if (!s.username || !s.password) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["secret"],
          message: `username and password are required`,
        })
      }
    }

    if (val.kind === "oauth2") {
      const s = val.secret ?? {}
      if (!s.client_id || !s.client_secret || !s.refresh_token) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["secret"],
          message: `client_id, client_secret, and refresh_token are required`,
        })
      }
    }
  })

type CreateCredentialValues = z.input<typeof createCredentialSchema>

// UPDATE schema: all fields optional, and validations are "patch-friendly".
const updateCredentialSchema = z
  .object({
    credential_provider: z
      .enum(["aws", "cloudflare", "hetzner", "digitalocean", "generic"])
      .optional(),
    kind: z.enum(["aws_access_key", "api_token", "basic_auth", "oauth2"]).optional(),
    schema_version: z.number().optional(),
    name: z.string().min(1, "Name is required").max(100).optional(),
    scope_kind: z.enum(["provider", "service", "resource"]).optional(),
    scope_version: z.number().optional(),
    scope: z.any().optional(),
    // allow "" so your form can keep empty strings; buildUpdateBody will drop them
    account_id: z.string().optional().or(z.literal("")),
    region: z.string().optional().or(z.literal("")),
    secret: z.any().optional(),
  })
  .superRefine((val, ctx) => {
    // If scope_kind is being changed to non-provider, require scope in the patch
    if (typeof val.scope_kind !== "undefined") {
      if (val.scope_kind !== "provider" && !val.scope) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["scope"],
          message: `scope is required`,
        })
      }
    }

    // AWS scope checks only if we have enough info
    if (val.credential_provider === "aws") {
      if (val.scope_kind === "service" && typeof val.scope !== "undefined") {
        const svc = (val.scope as any)?.service
        if (!AWS_ALLOWED_SERVICES.includes(svc)) {
          ctx.addIssue({
            code: z.ZodIssueCode.custom,
            path: ["scope"],
            message: `For AWS service scope, "service" must be one of: ${AWS_ALLOWED_SERVICES.join(", ")}`,
          })
        }
      }
      if (val.scope_kind === "resource" && typeof val.scope !== "undefined") {
        const arn = (val.scope as any)?.arn
        if (typeof arn !== "string" || !arn.startsWith("arn:")) {
          ctx.addIssue({
            code: z.ZodIssueCode.custom,
            path: ["scope"],
            message: `For AWS resource scope, "arn" must start with "arn:"`,
          })
        }
      }
    }

    // Secret validation on update:
    // - only validate if rotating secret OR changing kind
    // - if rotating secret but kind is NOT provided, skip kind-specific checks (backend can validate)
    const rotatingSecret = typeof val.secret !== "undefined"
    const changingKind = typeof val.kind !== "undefined"
    if (!rotatingSecret && !changingKind) return
    if (!val.kind) return

    if (val.kind === "aws_access_key") {
      const sk = val.secret ?? {}
      const id = sk.access_key_id
      if (typeof id !== "string" || !/^[A-Z0-9]{20}$/.test(id)) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["secret"],
          message: `access_key_id must be 20 chars (A-Z0-9)`,
        })
      }
      if (typeof sk.secret_access_key !== "string" || sk.secret_access_key.length < 10) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["secret"],
          message: `secret_access_key is required`,
        })
      }
    }

    if (val.kind === "api_token") {
      const token = (val.secret ?? {}).token
      if (!token) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["secret"],
          message: `token is required`,
        })
      }
    }

    if (val.kind === "basic_auth") {
      const s = val.secret ?? {}
      if (!s.username || !s.password) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["secret"],
          message: `username and password are required`,
        })
      }
    }

    if (val.kind === "oauth2") {
      const s = val.secret ?? {}
      if (!s.client_id || !s.client_secret || !s.refresh_token) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["secret"],
          message: `client_id, client_secret, and refresh_token are required`,
        })
      }
    }
  })

type UpdateCredentialValues = z.input<typeof updateCredentialSchema>

// -------------------- Helpers --------------------

function pretty(obj: unknown) {
  try {
    if (obj == null) return ""
    if (typeof obj === "string") {
      try {
        return JSON.stringify(JSON.parse(obj), null, 2)
      } catch {
        return obj
      }
    }
    return JSON.stringify(obj, null, 2)
  } catch {
    return ""
  }
}

function extractErr(e: any): string {
  const raw = (e as any)?.body ?? (e as any)?.response ?? (e as any)?.message
  if (typeof raw === "string") return raw
  try {
    const msg = (e as any)?.response?.data?.message || (e as any)?.message
    if (msg) return String(msg)
  } catch {
    return "Unknown error"
  }
  return "Unknown error"
}

function isAwsServiceScope({
  credential_provider,
  scope_kind,
}: {
  credential_provider?: string
  scope_kind?: string
}) {
  return credential_provider === "aws" && scope_kind === "service"
}
function isAwsResourceScope({
  credential_provider,
  scope_kind,
}: {
  credential_provider?: string
  scope_kind?: string
}) {
  return credential_provider === "aws" && scope_kind === "resource"
}
function isProviderScope({ scope_kind }: { scope_kind?: string }) {
  return scope_kind === "provider"
}

function defaultCreateValues(): CreateCredentialValues {
  return {
    credential_provider: "aws",
    kind: "aws_access_key",
    schema_version: 1,
    name: "",
    scope_kind: "provider",
    scope_version: 1,
    scope: {},
    account_id: "",
    region: "",
    secret: {},
  }
}

// Build exact POST body as the SDK sends it
function buildCreateBody(v: CreateCredentialValues) {
  return {
    credential_provider: v.credential_provider,
    kind: v.kind,
    schema_version: v.schema_version ?? 1,
    name: v.name,
    scope_kind: v.scope_kind,
    scope_version: v.scope_version ?? 1,
    scope: v.scope ?? {},
    account_id: v.account_id,
    region: v.region,
    secret: v.secret ?? {},
  }
}

// Build exact PATCH body (only provided fields)
function buildUpdateBody(v: UpdateCredentialValues) {
  const body: any = {}
  const keys: (keyof UpdateCredentialValues)[] = [
    "name",
    "account_id",
    "region",
    "scope_kind",
    "scope_version",
    "scope",
    "secret",
    "credential_provider",
    "kind",
    "schema_version",
  ]
  for (const k of keys) {
    if (typeof v[k] !== "undefined" && v[k] !== "") body[k] = v[k]
  }
  return body
}

// -------------------- Page --------------------

export const CredentialPage = () => {
  const [filter, setFilter] = useState<string>("")
  const [createOpen, setCreateOpen] = useState<boolean>(false)
  const [editOpen, setEditOpen] = useState<boolean>(false)
  const [revealOpen, setRevealOpen] = useState<boolean>(false)
  const [revealJson, setRevealJson] = useState<object | null>(null)
  const [editingId, setEditingId] = useState<string | null>(null)
  const [useRawSecretJSON, setUseRawSecretJSON] = useState<boolean>(false)
  const [useRawEditSecretJSON, setUseRawEditSecretJSON] = useState<boolean>(false)

  // Preview modals
  const [previewCreateOpen, setPreviewCreateOpen] = useState(false)
  const [previewCreateBody, setPreviewCreateBody] = useState<object | null>(null)
  const [previewUpdateOpen, setPreviewUpdateOpen] = useState(false)
  const [previewUpdateBody, setPreviewUpdateBody] = useState<object | null>(null)

  const qc = useQueryClient()

  // List
  const credentialQ = useQuery({
    queryKey: ["credentials"],
    queryFn: () => credentialsApi.listCredentials(),
  })

  // Create
  const createMutation = useMutation({
    mutationFn: (body: CreateCredentialValues) =>
      credentialsApi.createCredential(buildCreateBody(body) as any),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["credentials"] })
      toast.success("Credential created")
      setCreateOpen(false)
      createForm.reset(defaultCreateValues())
      setUseRawSecretJSON(false)
    },
    onError: (err: any) => {
      toast.error("Failed to create credential", { description: extractErr(err) })
    },
  })

  // Update
  const updateMutation = useMutation({
    mutationFn: (payload: { id: string; body: UpdateCredentialValues }) =>
      credentialsApi.updateCredential(payload.id, buildUpdateBody(payload.body)),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["credentials"] })
      toast.success("Credential updated")
      setEditOpen(false)
      setEditingId(null)
      setUseRawEditSecretJSON(false)
    },
    onError: (err: any) => {
      toast.error("Failed to update credential", { description: extractErr(err) })
    },
  })

  // Delete
  const deleteMutation = useMutation({
    mutationFn: (id: string) => credentialsApi.deleteCredential(id),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["credentials"] })
      toast.success("Credential deleted")
    },
    onError: (err: any) => {
      toast.error("Failed to delete credential", { description: extractErr(err) })
    },
  })

  // Reveal
  const revealMutation = useMutation({
    mutationFn: (id: string) => credentialsApi.revealCredential(id),
    onSuccess: (data) => {
      setRevealJson(data)
      setRevealOpen(true)
    },
    onError: (err: any) => {
      toast.error("Failed to reveal secret", { description: extractErr(err) })
    },
  })

  // ---------- Forms ----------

  const createForm = useForm<CreateCredentialValues>({
    resolver: zodResolver(createCredentialSchema),
    defaultValues: defaultCreateValues(),
    mode: "onBlur",
  })

  const editForm = useForm<UpdateCredentialValues>({
    resolver: zodResolver(updateCredentialSchema),
    defaultValues: {},
    mode: "onBlur",
  })

  function openEdit(row: any) {
    setEditingId(row.id)
    editForm.reset({
      // FIX: correct key (was "provider" in your original)
      credential_provider: row.credential_provider,
      kind: row.kind,
      schema_version: row.schema_version ?? 1,
      name: row.name,
      scope_kind: row.scope_kind,
      scope_version: row.scope_version ?? 1,
      account_id: row.account_id ?? "",
      region: row.region ?? "",
      scope: row.scope ?? (row.scope_kind === "provider" ? {} : undefined),
      secret: undefined, // keep existing unless user rotates
    } as any)
    setUseRawEditSecretJSON(false)
    setEditOpen(true)
  }

  // Derived lists
  const filtered = useMemo(() => {
    const items = credentialQ.data ?? []
    if (!filter.trim()) return items
    const f = filter.toLowerCase()
    return items.filter((c: any) =>
      [
        c.name,
        c.credential_provider,
        c.kind,
        c.scope_kind,
        c.account_id,
        c.region,
        JSON.stringify(c.scope ?? {}),
      ]
        .filter(Boolean)
        .map((x: any) => String(x).toLowerCase())
        .some((s: string) => s.includes(f))
    )
  }, [credentialQ.data, filter])

  // -------------------- UI --------------------

  if (credentialQ.isLoading)
    return (
      <div className="flex items-center gap-2 p-6">
        <Loader2 className="h-4 w-4 animate-spin" /> Loading credentials…
      </div>
    )

  if (credentialQ.error)
    return (
      <div className="p-6 text-red-500">
        Error loading credentials.
        <pre className="mt-2 text-xs opacity-80">{JSON.stringify(credentialQ.error, null, 2)}</pre>
      </div>
    )

  // Create form watchers
  const credential_provider = createForm.watch("credential_provider")
  const kind = createForm.watch("kind")
  const scopeKind = createForm.watch("scope_kind")

  const setCreateScope = (obj: any) =>
    createForm.setValue("scope", obj, { shouldDirty: true, shouldValidate: true })
  const setCreateSecret = (obj: any) =>
    createForm.setValue("secret", obj, { shouldDirty: true, shouldValidate: true })

  function ensureCreateDefaultsForSecret() {
    if (useRawSecretJSON) return

    if (credential_provider === "aws" && kind === "aws_access_key") {
      const s = createForm.getValues("secret") ?? {}
      setCreateSecret({
        access_key_id: s.access_key_id ?? "",
        secret_access_key: s.secret_access_key ?? "",
      })
    } else if (kind === "api_token") {
      const s = createForm.getValues("secret") ?? {}
      setCreateSecret({ token: s.token ?? "" })
    } else if (kind === "basic_auth") {
      const s = createForm.getValues("secret") ?? {}
      setCreateSecret({ username: s.username ?? "", password: s.password ?? "" })
    } else if (kind === "oauth2") {
      const s = createForm.getValues("secret") ?? {}
      setCreateSecret({
        client_id: s.client_id ?? "",
        client_secret: s.client_secret ?? "",
        refresh_token: s.refresh_token ?? "",
      })
    }
  }

  function onChangeCreateScopeKind(next: "provider" | "service" | "resource") {
    createForm.setValue("scope_kind", next, { shouldDirty: true, shouldValidate: true })
    if (next === "provider") setCreateScope({})
    if (next === "service") setCreateScope({ service: "route53" as AwsSvc })
    if (next === "resource") setCreateScope({ arn: "" })
  }

  return (
    <div className="space-y-4 p-6">
      <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
        <div>
          <h1 className="mb-1 text-2xl font-bold">Credentials</h1>
          <p className="text-muted-foreground text-sm">
            Store provider credentials. Secrets are encrypted server-side; revealing is a one-time
            read.
          </p>
        </div>

        <div className="flex flex-wrap items-center gap-2">
          <div className="relative">
            <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
            <Input
              value={filter}
              onChange={(e) => setFilter(e.target.value)}
              placeholder="Search by name, provider, kind, scope…"
              className="w-64 pl-8"
            />
          </div>

          <Dialog open={createOpen} onOpenChange={setCreateOpen}>
            <DialogTrigger asChild>
              <Button onClick={() => setCreateOpen(true)}>
                <Plus className="mr-2 h-4 w-4" />
                Create Credential
              </Button>
            </DialogTrigger>
            <DialogContent className="sm:max-w-2xl">
              <DialogHeader>
                <DialogTitle>Create Credential</DialogTitle>
              </DialogHeader>

              <Form {...createForm}>
                <form
                  onSubmit={createForm.handleSubmit((values) => {
                    const parsed = createCredentialSchema.safeParse(values)
                    if (!parsed.success) {
                      toast.error("Please fix validation errors")
                      return
                    }
                    createMutation.mutate(parsed.data)
                  })}
                  className="space-y-5 pt-2"
                >
                  <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
                    <FormField
                      control={createForm.control}
                      name="credential_provider"
                      render={({ field }) => (
                        <FormItem>
                          <FormLabel>Provider</FormLabel>
                          <Select
                            onValueChange={(v) => {
                              field.onChange(v)
                              ensureCreateDefaultsForSecret()
                            }}
                            defaultValue={field.value}
                          >
                            <FormControl>
                              <SelectTrigger>
                                <SelectValue />
                              </SelectTrigger>
                            </FormControl>
                            <SelectContent>
                              <SelectItem value="aws">AWS</SelectItem>
                              <SelectItem value="cloudflare">Cloudflare</SelectItem>
                              <SelectItem value="hetzner">Hetzner</SelectItem>
                              <SelectItem value="digitalocean">DigitalOcean</SelectItem>
                              <SelectItem value="generic">Generic</SelectItem>
                            </SelectContent>
                          </Select>
                          <FormMessage />
                        </FormItem>
                      )}
                    />

                    <FormField
                      control={createForm.control}
                      name="kind"
                      render={({ field }) => (
                        <FormItem>
                          <FormLabel>Kind</FormLabel>
                          <Select
                            onValueChange={(v) => {
                              field.onChange(v)
                              ensureCreateDefaultsForSecret()
                            }}
                            defaultValue={field.value}
                          >
                            <FormControl>
                              <SelectTrigger>
                                <SelectValue />
                              </SelectTrigger>
                            </FormControl>
                            <SelectContent>
                              <SelectItem value="aws_access_key">AWS Access Key</SelectItem>
                              <SelectItem value="api_token">API Token</SelectItem>
                              <SelectItem value="basic_auth">Basic Auth</SelectItem>
                              <SelectItem value="oauth2">OAuth2</SelectItem>
                            </SelectContent>
                          </Select>
                          <FormMessage />
                        </FormItem>
                      )}
                    />

                    <FormField
                      control={createForm.control}
                      name="scope_kind"
                      render={({ field }) => (
                        <FormItem>
                          <FormLabel>Scope Kind</FormLabel>
                          <Select
                            onValueChange={(v: "provider" | "service" | "resource") => {
                              onChangeCreateScopeKind(v)
                            }}
                            defaultValue={field.value}
                          >
                            <FormControl>
                              <SelectTrigger>
                                <SelectValue />
                              </SelectTrigger>
                            </FormControl>
                            <SelectContent>
                              <SelectItem value="provider">Provider</SelectItem>
                              <SelectItem value="service">Service</SelectItem>
                              <SelectItem value="resource">Resource</SelectItem>
                            </SelectContent>
                          </Select>
                          <FormMessage />
                        </FormItem>
                      )}
                    />

                    <FormField
                      control={createForm.control}
                      name="name"
                      render={({ field }) => (
                        <FormItem>
                          <FormLabel>Name</FormLabel>
                          <Input {...field} placeholder="My AWS Key" />
                          <FormMessage />
                        </FormItem>
                      )}
                    />

                    <FormField
                      control={createForm.control}
                      name="account_id"
                      render={({ field }) => (
                        <FormItem>
                          <FormLabel>Account ID (optional)</FormLabel>
                          <Input {...field} placeholder="e.g. 123456789012" />
                          <FormMessage />
                        </FormItem>
                      )}
                    />

                    <FormField
                      control={createForm.control}
                      name="region"
                      render={({ field }) => (
                        <FormItem>
                          <FormLabel>Region (optional)</FormLabel>
                          <Input {...field} placeholder="e.g. us-east-1" />
                          <FormMessage />
                        </FormItem>
                      )}
                    />
                  </div>

                  {/* Scope UI (create) */}
                  {!isProviderScope({ scope_kind: scopeKind }) && (
                    <>
                      {isAwsServiceScope({ credential_provider, scope_kind: scopeKind }) ? (
                        <FormItem>
                          <FormLabel>Service</FormLabel>
                          <Controller
                            control={createForm.control}
                            name="scope"
                            render={({ field }) => (
                              <Select
                                onValueChange={(svc) => field.onChange({ service: svc })}
                                value={(field.value as any)?.service ?? "route53"}
                              >
                                <FormControl>
                                  <SelectTrigger>
                                    <SelectValue placeholder="Select an AWS service" />
                                  </SelectTrigger>
                                </FormControl>
                                <SelectContent>
                                  {AWS_ALLOWED_SERVICES.map((s) => (
                                    <SelectItem key={s} value={s}>
                                      {s.toUpperCase()}
                                    </SelectItem>
                                  ))}
                                </SelectContent>
                              </Select>
                            )}
                          />
                          <p className="text-muted-foreground mt-1 text-xs">
                            Must be one of: {AWS_ALLOWED_SERVICES.join(", ")}.
                          </p>
                        </FormItem>
                      ) : isAwsResourceScope({ credential_provider, scope_kind: scopeKind }) ? (
                        <FormItem>
                          <FormLabel>Resource ARN</FormLabel>
                          <Controller
                            control={createForm.control}
                            name="scope"
                            render={({ field }) => (
                              <Input
                                value={(field.value as any)?.arn ?? ""}
                                onChange={(e) => field.onChange({ arn: e.target.value })}
                                placeholder="arn:aws:service:region:account:resource"
                              />
                            )}
                          />
                          <FormMessage />
                        </FormItem>
                      ) : (
                        <FormField
                          control={createForm.control}
                          name="scope"
                          render={({ field }) => (
                            <FormItem>
                              <FormLabel>Scope (JSON)</FormLabel>
                              <Textarea
                                value={pretty(field.value ?? {})}
                                onChange={(e) => {
                                  try {
                                    const obj = JSON.parse(e.target.value)
                                    field.onChange(obj)
                                  } catch {
                                    field.onChange(e.target.value)
                                  }
                                }}
                                rows={3}
                                placeholder='{"service":"route53"} or {"arn":"arn:aws:..."}'
                                className="font-mono"
                              />
                              <FormMessage />
                            </FormItem>
                          )}
                        />
                      )}
                    </>
                  )}

                  {/* Secret UI (create) */}
                  <div className="flex items-center gap-2">
                    <Switch
                      checked={useRawSecretJSON}
                      onCheckedChange={(v) => {
                        setUseRawSecretJSON(v)
                        ensureCreateDefaultsForSecret()
                      }}
                      id="raw-secret-toggle"
                    />
                    <label htmlFor="raw-secret-toggle" className="text-sm">
                      Edit secret as raw JSON
                    </label>
                  </div>

                  {useRawSecretJSON ? (
                    <FormField
                      control={createForm.control}
                      name="secret"
                      render={({ field }) => (
                        <FormItem>
                          <FormLabel>Secret (JSON)</FormLabel>
                          <Textarea
                            value={pretty(field.value ?? {})}
                            onChange={(e) => {
                              try {
                                field.onChange(JSON.parse(e.target.value))
                              } catch {
                                field.onChange(e.target.value)
                              }
                            }}
                            rows={6}
                            placeholder={
                              kind === "aws_access_key"
                                ? '{"access_key_id":"...","secret_access_key":"..."}'
                                : kind === "api_token"
                                  ? '{"token":"..."}'
                                  : kind === "basic_auth"
                                    ? '{"username":"...","password":"..."}'
                                    : '{"client_id":"...","client_secret":"...","refresh_token":"..."}'
                            }
                            className="font-mono"
                          />
                          <FormMessage />
                        </FormItem>
                      )}
                    />
                  ) : (
                    <>
                      {credential_provider === "aws" && kind === "aws_access_key" && (
                        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
                          <FormItem>
                            <FormLabel>Access Key ID</FormLabel>
                            <Controller
                              control={createForm.control}
                              name="secret"
                              render={({ field }) => (
                                <Input
                                  value={(field.value ?? {}).access_key_id ?? ""}
                                  onChange={(e) =>
                                    setCreateSecret({
                                      ...(field.value ?? {}),
                                      access_key_id: e.target.value.trim(),
                                    })
                                  }
                                  placeholder="AKIA..."
                                />
                              )}
                            />
                          </FormItem>
                          <FormItem>
                            <FormLabel>Secret Access Key</FormLabel>
                            <Controller
                              control={createForm.control}
                              name="secret"
                              render={({ field }) => (
                                <Input
                                  type="password"
                                  value={(field.value ?? {}).secret_access_key ?? ""}
                                  onChange={(e) =>
                                    setCreateSecret({
                                      ...(field.value ?? {}),
                                      secret_access_key: e.target.value,
                                    })
                                  }
                                  placeholder="•••••••••••••••"
                                />
                              )}
                            />
                          </FormItem>
                        </div>
                      )}

                      {kind === "api_token" && (
                        <FormItem>
                          <FormLabel>API Token</FormLabel>
                          <Controller
                            control={createForm.control}
                            name="secret"
                            render={({ field }) => (
                              <Input
                                value={(field.value ?? {}).token ?? ""}
                                onChange={(e) =>
                                  setCreateSecret({ ...(field.value ?? {}), token: e.target.value })
                                }
                                placeholder="token..."
                              />
                            )}
                          />
                        </FormItem>
                      )}

                      {kind === "basic_auth" && (
                        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
                          <FormItem>
                            <FormLabel>Username</FormLabel>
                            <Controller
                              control={createForm.control}
                              name="secret"
                              render={({ field }) => (
                                <Input
                                  value={(field.value ?? {}).username ?? ""}
                                  onChange={(e) =>
                                    setCreateSecret({
                                      ...(field.value ?? {}),
                                      username: e.target.value,
                                    })
                                  }
                                />
                              )}
                            />
                          </FormItem>
                          <FormItem>
                            <FormLabel>Password</FormLabel>
                            <Controller
                              control={createForm.control}
                              name="secret"
                              render={({ field }) => (
                                <Input
                                  type="password"
                                  value={(field.value ?? {}).password ?? ""}
                                  onChange={(e) =>
                                    setCreateSecret({
                                      ...(field.value ?? {}),
                                      password: e.target.value,
                                    })
                                  }
                                />
                              )}
                            />
                          </FormItem>
                        </div>
                      )}

                      {kind === "oauth2" && (
                        <div className="grid grid-cols-1 gap-4 md:grid-cols-3">
                          <FormItem>
                            <FormLabel>Client ID</FormLabel>
                            <Controller
                              control={createForm.control}
                              name="secret"
                              render={({ field }) => (
                                <Input
                                  value={(field.value ?? {}).client_id ?? ""}
                                  onChange={(e) =>
                                    setCreateSecret({
                                      ...(field.value ?? {}),
                                      client_id: e.target.value,
                                    })
                                  }
                                />
                              )}
                            />
                          </FormItem>
                          <FormItem>
                            <FormLabel>Client Secret</FormLabel>
                            <Controller
                              control={createForm.control}
                              name="secret"
                              render={({ field }) => (
                                <Input
                                  type="password"
                                  value={(field.value ?? {}).client_secret ?? ""}
                                  onChange={(e) =>
                                    setCreateSecret({
                                      ...(field.value ?? {}),
                                      client_secret: e.target.value,
                                    })
                                  }
                                  placeholder="••••••••••"
                                />
                              )}
                            />
                          </FormItem>
                          <FormItem>
                            <FormLabel>Refresh Token</FormLabel>
                            <Controller
                              control={createForm.control}
                              name="secret"
                              render={({ field }) => (
                                <Input
                                  value={(field.value ?? {}).refresh_token ?? ""}
                                  onChange={(e) =>
                                    setCreateSecret({
                                      ...(field.value ?? {}),
                                      refresh_token: e.target.value,
                                    })
                                  }
                                />
                              )}
                            />
                          </FormItem>
                        </div>
                      )}
                    </>
                  )}

                  <DialogFooter className="gap-2">
                    <Button
                      type="button"
                      variant="secondary"
                      onClick={() => {
                        const parsed = createCredentialSchema.safeParse(createForm.getValues())
                        if (!parsed.success) {
                          toast.error("Fix validation errors before previewing")
                          return
                        }
                        const body = buildCreateBody(parsed.data)
                        setPreviewCreateBody(body)
                        setPreviewCreateOpen(true)
                      }}
                    >
                      Preview request
                    </Button>

                    <Button variant="outline" type="button" onClick={() => setCreateOpen(false)}>
                      Cancel
                    </Button>
                    <Button type="submit" disabled={createMutation.isPending}>
                      {createMutation.isPending && (
                        <Loader2 className="mr-2 h-4 w-4 animate-spin" />
                      )}
                      Create
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </div>
      </div>

      {/* Table */}
      <div className="overflow-x-auto rounded-xl border">
        <table className="min-w-full text-sm">
          <thead className="bg-muted/40 text-xs tracking-wide uppercase">
            <tr>
              <th className="w-[26%] px-4 py-2 text-left">Name</th>
              <th className="px-4 py-2 text-left">Provider</th>
              <th className="px-4 py-2 text-left">Kind</th>
              <th className="px-4 py-2 text-left">Scope</th>
              <th className="px-4 py-2 text-left">Account</th>
              <th className="px-4 py-2 text-left">Region</th>
              <th className="px-4 py-2 text-right">Actions</th>
            </tr>
          </thead>
          <tbody>
            {filtered.map((row: any) => (
              <tr key={row.id} className="border-t">
                <td className="px-4 py-2">
                  <div className="font-medium">{row.name}</div>
                  <div className="text-muted-foreground text-xs">
                    <span className="mr-1">id:</span>
                    <code className="bg-muted rounded px-1">{row.id.slice(0, 8)}…</code>
                  </div>
                </td>
                <td className="px-4 py-2">{row.credential_provider}</td>
                <td className="px-4 py-2">{row.kind}</td>
                <td className="px-4 py-2">
                  <Badge variant="secondary">{row.scope_kind}</Badge>
                </td>
                <td className="px-4 py-2">{row.account_id ?? "—"}</td>
                <td className="px-4 py-2">{row.region ?? "—"}</td>
                <td className="px-4 py-2">
                  <div className="flex items-center justify-end gap-2">
                    <Button
                      size="icon"
                      variant="ghost"
                      title="Reveal secret (one-time read)"
                      onClick={() => revealMutation.mutate(row.id)}
                    >
                      <Eye className="h-4 w-4" />
                    </Button>
                    <Button size="icon" variant="ghost" title="Edit" onClick={() => openEdit(row)}>
                      <Pencil className="h-4 w-4" />
                    </Button>

                    <AlertDialog>
                      <AlertDialogTrigger asChild>
                        <Button size="icon" variant="ghost" title="Delete">
                          <Trash2 className="h-4 w-4" />
                        </Button>
                      </AlertDialogTrigger>
                      <AlertDialogContent>
                        <AlertDialogHeader>
                          <AlertDialogTitle>Delete “{row.name}”?</AlertDialogTitle>
                          <AlertDialogDescription>
                            This will permanently remove the credential metadata. Secrets are not
                            recoverable.
                          </AlertDialogDescription>
                        </AlertDialogHeader>
                        <AlertDialogFooter>
                          <AlertDialogCancel disabled={deleteMutation.isPending}>
                            Cancel
                          </AlertDialogCancel>
                          <AlertDialogAction
                            className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
                            onClick={() => deleteMutation.mutate(row.id)}
                            disabled={deleteMutation.isPending}
                          >
                            {deleteMutation.isPending && (
                              <Loader2 className="mr-2 inline h-4 w-4 animate-spin" />
                            )}
                            Delete
                          </AlertDialogAction>
                        </AlertDialogFooter>
                      </AlertDialogContent>
                    </AlertDialog>

                    <DropdownMenu>
                      <DropdownMenuTrigger asChild>
                        <Button size="icon" variant="ghost">
                          <MoreHorizontal className="h-4 w-4" />
                        </Button>
                      </DropdownMenuTrigger>
                      <DropdownMenuContent align="end">
                        <DropdownMenuItem onClick={() => openEdit(row)}>Edit</DropdownMenuItem>
                        <DropdownMenuItem onClick={() => revealMutation.mutate(row.id)}>
                          Reveal secret
                        </DropdownMenuItem>
                        <DropdownMenuItem
                          className="text-destructive"
                          onClick={() => deleteMutation.mutate(row.id)}
                        >
                          Delete
                        </DropdownMenuItem>
                      </DropdownMenuContent>
                    </DropdownMenu>
                  </div>
                </td>
              </tr>
            ))}
            {filtered.length === 0 && (
              <tr>
                <td colSpan={7} className="px-4 py-12 text-center">
                  <div className="mx-auto max-w-md">
                    <div className="mb-2 flex items-center justify-center">
                      <AlertTriangle className="text-muted-foreground h-5 w-5" />
                    </div>
                    <p className="text-muted-foreground">No credentials match your search.</p>
                  </div>
                </td>
              </tr>
            )}
          </tbody>
        </table>
      </div>

      {/* Edit dialog */}
      <Dialog open={editOpen} onOpenChange={setEditOpen}>
        <DialogContent className="sm:max-w-2xl">
          <DialogHeader>
            <DialogTitle>Edit Credential</DialogTitle>
          </DialogHeader>

          <Form {...editForm}>
            <form
              onSubmit={editForm.handleSubmit((values) => {
                if (!editingId) return
                const parsed = updateCredentialSchema.safeParse(values)
                if (!parsed.success) {
                  toast.error("Please fix validation errors")
                  return
                }
                updateMutation.mutate({ id: editingId, body: parsed.data })
              })}
              className="space-y-5 pt-2"
            >
              <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
                <FormField
                  control={editForm.control}
                  name="credential_provider"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Provider</FormLabel>
                      <Select onValueChange={field.onChange} value={field.value}>
                        <FormControl>
                          <SelectTrigger>
                            <SelectValue />
                          </SelectTrigger>
                        </FormControl>
                        <SelectContent>
                          <SelectItem value="aws">AWS</SelectItem>
                          <SelectItem value="cloudflare">Cloudflare</SelectItem>
                          <SelectItem value="hetzner">Hetzner</SelectItem>
                          <SelectItem value="digitalocean">DigitalOcean</SelectItem>
                          <SelectItem value="generic">Generic</SelectItem>
                        </SelectContent>
                      </Select>
                      <FormMessage />
                    </FormItem>
                  )}
                />

                <FormField
                  control={editForm.control}
                  name="kind"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Kind</FormLabel>
                      <Select onValueChange={field.onChange} value={field.value}>
                        <FormControl>
                          <SelectTrigger>
                            <SelectValue />
                          </SelectTrigger>
                        </FormControl>
                        <SelectContent>
                          <SelectItem value="aws_access_key">AWS Access Key</SelectItem>
                          <SelectItem value="api_token">API Token</SelectItem>
                          <SelectItem value="basic_auth">Basic Auth</SelectItem>
                          <SelectItem value="oauth2">OAuth2</SelectItem>
                        </SelectContent>
                      </Select>
                      <FormMessage />
                    </FormItem>
                  )}
                />

                <FormField
                  control={editForm.control}
                  name="scope_kind"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Scope Kind</FormLabel>
                      <Select onValueChange={field.onChange} value={field.value}>
                        <FormControl>
                          <SelectTrigger>
                            <SelectValue />
                          </SelectTrigger>
                        </FormControl>
                        <SelectContent>
                          <SelectItem value="provider">Provider</SelectItem>
                          <SelectItem value="service">Service</SelectItem>
                          <SelectItem value="resource">Resource</SelectItem>
                        </SelectContent>
                      </Select>
                      <FormMessage />
                    </FormItem>
                  )}
                />

                <FormField
                  control={editForm.control}
                  name="name"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Name</FormLabel>
                      <Input {...field} />
                      <FormMessage />
                    </FormItem>
                  )}
                />

                <FormField
                  control={editForm.control}
                  name="account_id"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Account ID</FormLabel>
                      <Input {...field} placeholder="optional" />
                      <FormMessage />
                    </FormItem>
                  )}
                />

                <FormField
                  control={editForm.control}
                  name="region"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Region</FormLabel>
                      <Input {...field} placeholder="optional" />
                      <FormMessage />
                    </FormItem>
                  )}
                />
              </div>

              <FormField
                control={editForm.control}
                name="scope"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Scope (JSON)</FormLabel>
                    <Textarea
                      value={pretty(
                        field.value ??
                          (editForm.getValues("scope_kind") === "provider" ? {} : undefined)
                      )}
                      onChange={(e) => {
                        try {
                          field.onChange(JSON.parse(e.target.value))
                        } catch {
                          field.onChange(e.target.value)
                        }
                      }}
                      rows={3}
                      className="font-mono"
                    />
                    <FormMessage />
                  </FormItem>
                )}
              />

              {/* Rotate secret */}
              <div className="flex items-center gap-2">
                <Switch
                  checked={useRawEditSecretJSON}
                  onCheckedChange={setUseRawEditSecretJSON}
                  id="raw-edit-secret-toggle"
                />
                <label htmlFor="raw-edit-secret-toggle" className="text-sm">
                  Rotate secret with raw JSON (leave empty to keep existing)
                </label>
              </div>

              {useRawEditSecretJSON && (
                <FormField
                  control={editForm.control}
                  name="secret"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Rotate Secret (JSON)</FormLabel>
                      <Textarea
                        value={typeof field.value === "string" ? field.value : pretty(field.value)}
                        onChange={(e) => {
                          try {
                            field.onChange(JSON.parse(e.target.value))
                          } catch {
                            field.onChange(e.target.value)
                          }
                        }}
                        rows={6}
                        className="font-mono"
                        placeholder='{"access_key_id":"...","secret_access_key":"..."}'
                      />
                      <FormMessage />
                    </FormItem>
                  )}
                />
              )}

              <DialogFooter className="gap-2">
                <Button
                  type="button"
                  variant="secondary"
                  onClick={() => {
                    const parsed = updateCredentialSchema.safeParse(editForm.getValues())
                    if (!parsed.success) {
                      toast.error("Fix validation errors before previewing")
                      return
                    }
                    const body = buildUpdateBody(parsed.data)
                    setPreviewUpdateBody(body)
                    setPreviewUpdateOpen(true)
                  }}
                >
                  Preview request
                </Button>

                <Button variant="outline" type="button" onClick={() => setEditOpen(false)}>
                  Cancel
                </Button>
                <Button type="submit" disabled={updateMutation.isPending}>
                  {updateMutation.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
                  Save changes
                </Button>
              </DialogFooter>
            </form>
          </Form>
        </DialogContent>
      </Dialog>

      {/* Reveal modal */}
      <Dialog open={revealOpen} onOpenChange={setRevealOpen}>
        <DialogContent className="sm:max-w-xl">
          <DialogHeader>
            <DialogTitle className="flex items-center gap-2">
              <Eye className="h-4 w-4" /> Decrypted Secret
            </DialogTitle>
          </DialogHeader>
          <div className="bg-muted/40 rounded-lg border p-3">
            <pre className="max-h-[50vh] overflow-auto text-xs leading-relaxed">
              {pretty(revealJson ?? {})}
            </pre>
          </div>
          <div className="text-muted-foreground flex items-center gap-2 text-xs">
            <AlertTriangle className="h-3.5 w-3.5" />
            One-time read. Close this dialog to hide the secret.
          </div>
          <DialogFooter>
            <Button
              variant="outline"
              onClick={() => {
                navigator.clipboard.writeText(pretty(revealJson ?? {}))
                toast.success("Copied to clipboard")
              }}
            >
              Copy
            </Button>
            <Button onClick={() => setRevealOpen(false)}>Close</Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>

      {/* Preview CREATE modal */}
      <Dialog open={previewCreateOpen} onOpenChange={setPreviewCreateOpen}>
        <DialogContent className="sm:max-w-2xl">
          <DialogHeader>
            <DialogTitle>Preview: POST /api/v1/credentials</DialogTitle>
          </DialogHeader>
          <div className="bg-muted/40 rounded-lg border p-3">
            <pre className="max-h-[50vh] overflow-auto text-xs leading-relaxed">
              {pretty(previewCreateBody ?? {})}
            </pre>
          </div>
          <DialogFooter>
            <Button
              variant="outline"
              onClick={() => {
                navigator.clipboard.writeText(pretty(previewCreateBody ?? {}))
                toast.success("Copied body")
              }}
            >
              Copy body
            </Button>
            <Button onClick={() => setPreviewCreateOpen(false)}>Close</Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>

      {/* Preview UPDATE modal */}
      <Dialog open={previewUpdateOpen} onOpenChange={setPreviewUpdateOpen}>
        <DialogContent className="sm:max-w-2xl">
          <DialogHeader>
            <DialogTitle>Preview: PATCH /api/v1/credentials/:id</DialogTitle>
          </DialogHeader>
          <div className="bg-muted/40 rounded-lg border p-3">
            <pre className="max-h-[50vh] overflow-auto text-xs leading-relaxed">
              {pretty(previewUpdateBody ?? {})}
            </pre>
          </div>
          <DialogFooter>
            <Button
              variant="outline"
              onClick={() => {
                navigator.clipboard.writeText(pretty(previewUpdateBody ?? {}))
                toast.success("Copied body")
              }}
            >
              Copy body
            </Button>
            <Button onClick={() => setPreviewUpdateOpen(false)}>Close</Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>
    </div>
  )
}
</file>

<file path="ui/src/pages/dns-page.tsx">
import { useEffect, useMemo, useState } from "react"
import { credentialsApi } from "@/api/credentials"
import { dnsApi } from "@/api/dns"
import type {
  DtoCreateDomainRequest,
  DtoCreateRecordSetRequest,
  DtoCredentialOut,
  DtoDomainResponse,
  DtoRecordSetResponse,
  DtoUpdateDomainRequest,
  DtoUpdateRecordSetRequest,
} from "@/sdk"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import {
  AlertTriangle,
  CheckCircle2,
  Circle,
  Loader2,
  MoreHorizontal,
  Pencil,
  Plus,
  Search,
  Trash2,
} from "lucide-react"
import { useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import {
  AlertDialog,
  AlertDialogAction,
  AlertDialogCancel,
  AlertDialogContent,
  AlertDialogDescription,
  AlertDialogFooter,
  AlertDialogHeader,
  AlertDialogTitle,
  AlertDialogTrigger,
} from "@/components/ui/alert-dialog"
import { Badge } from "@/components/ui/badge"
import { Button } from "@/components/ui/button"
import { Card } from "@/components/ui/card"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog"
import {
  DropdownMenu,
  DropdownMenuContent,
  DropdownMenuItem,
  DropdownMenuTrigger,
} from "@/components/ui/dropdown-menu"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form"
import { Input } from "@/components/ui/input"
import {
  Select,
  SelectContent,
  SelectItem,
  SelectTrigger,
  SelectValue,
} from "@/components/ui/select"
import { Textarea } from "@/components/ui/textarea"

// ---------- helpers ----------

const statusIcon = (s?: string) => {
  switch (s) {
    case "ready":
      return <CheckCircle2 className="h-4 w-4 text-emerald-600" />
    case "provisioning":
      return <Loader2 className="h-4 w-4 animate-spin text-blue-600" />
    case "failed":
      return <AlertTriangle className="h-4 w-4 text-red-600" />
    default:
      return <Circle className="text-muted-foreground h-4 w-4" />
  }
}

const StatusBadge = ({ s }: { s?: string }) => (
  <Badge
    variant={s === "failed" ? "destructive" : s === "ready" ? "default" : "secondary"}
    className="gap-1"
    title={s}
  >
    {statusIcon(s)}
    <span className="capitalize">{s ?? "pending"}</span>
  </Badge>
)

const parseCommaList = (v: string) =>
  v
    .split(",")
    .map((s) => s.trim())
    .filter(Boolean)

const joinCommaList = (arr?: string[] | null) => (arr && arr.length ? arr.join(",") : "")

const rrtypes = ["A", "AAAA", "CNAME", "TXT", "MX", "NS", "SRV", "CAA"]

const isR53 = (c: DtoCredentialOut) =>
  c.credential_provider === "aws" &&
  c.scope_kind === "service" &&
  (() => {
    const s = (c as any).scope
    try {
      const obj = typeof s === "string" ? JSON.parse(s) : s || {}
      return obj?.service === "route53"
    } catch {
      return false
    }
  })()

const credLabel = (c: DtoCredentialOut) => {
  const bits = [c.name || "Unnamed", c.account_id, c.region].filter(Boolean)
  return bits.join(" · ")
}

// ---------- zod schemas ----------
// IMPORTANT (Zod v4):
// - `.partial()` cannot be used on object schemas containing refinements/effects.
// Your schemas contain effects via `.transform(...)` and refinements via `.superRefine(...)` / `.refine(...)`,
// so we define UPDATE schemas explicitly instead of using `.partial()`.

const createDomainSchema = z.object({
  domain_name: z
    .string()
    .min(1, "Domain is required")
    .max(253)
    .transform((s) => s.trim().replace(/\.$/, "").toLowerCase()),
  credential_id: z.string().uuid("Pick a credential"),
  zone_id: z
    .string()
    .optional()
    .or(z.literal(""))
    .transform((v) => (v ? v.trim() : undefined)),
})
type CreateDomainValues = z.input<typeof createDomainSchema>

// Update: all optional; replicate the normalization safely
const updateDomainSchema = z.object({
  domain_name: z
    .string()
    .min(1, "Domain is required")
    .max(253)
    .transform((s) => s.trim().replace(/\.$/, "").toLowerCase())
    .optional(),
  credential_id: z.string().uuid("Pick a credential").optional(),
  zone_id: z
    .string()
    .optional()
    .or(z.literal(""))
    .transform((v) => (v ? v.trim() : undefined)),
})
type UpdateDomainValues = z.input<typeof updateDomainSchema>

const ttlSchema = z
  .union([
    z.number(),
    z
      .string()
      .regex(/^\d+$/)
      .transform((s) => Number(s)),
  ])
  .optional()
  .refine((v) => v === undefined || (v >= 1 && v <= 86400), {
    message: "TTL must be between 1 and 86400",
  })

const createRecordSchema = z
  .object({
    name: z
      .string()
      .min(1, "Name required")
      .max(253)
      .transform((s) => s.trim().replace(/\.$/, "").toLowerCase()),
    type: z.enum(rrtypes as [string, ...string[]]),
    ttl: ttlSchema,
    valuesCsv: z.string().optional(),
  })
  .superRefine((vals, ctx) => {
    const arr = parseCommaList(vals.valuesCsv ?? "")
    if (arr.length === 0) {
      ctx.addIssue({ code: "custom", message: "At least one value is required" })
    }
    if (vals.type === "CNAME" && arr.length !== 1) {
      ctx.addIssue({ code: "custom", message: "CNAME requires exactly one value" })
    }
  })
type CreateRecordValues = z.input<typeof createRecordSchema>

// Update: all optional. Only enforce "values required"/"CNAME exactly one" if valuesCsv is present.
// Only validate ttl if present (ttlSchema already optional).
const updateRecordSchema = z
  .object({
    name: z
      .string()
      .min(1, "Name required")
      .max(253)
      .transform((s) => s.trim().replace(/\.$/, "").toLowerCase())
      .optional(),
    type: z.enum(rrtypes as [string, ...string[]]).optional(),
    ttl: ttlSchema,
    valuesCsv: z.string().optional(),
  })
  .superRefine((vals, ctx) => {
    const hasValues = typeof vals.valuesCsv !== "undefined"
    if (!hasValues) return

    const arr = parseCommaList(vals.valuesCsv ?? "")
    if (arr.length === 0) {
      ctx.addIssue({
        code: "custom",
        path: ["valuesCsv"],
        message: "At least one value is required",
      })
    }

    // We can only enforce CNAME rule if `type` is provided in patch (or you can enforce always if you want).
    if (vals.type === "CNAME" && arr.length !== 1) {
      ctx.addIssue({
        code: "custom",
        path: ["valuesCsv"],
        message: "CNAME requires exactly one value",
      })
    }
  })
type UpdateRecordValues = z.input<typeof updateRecordSchema>

// ---------- main ----------

export const DnsPage = () => {
  const [filter, setFilter] = useState("")
  const [selected, setSelected] = useState<DtoDomainResponse | null>(null)

  const [createDomOpen, setCreateDomOpen] = useState(false)
  const [editDomOpen, setEditDomOpen] = useState(false)

  const [createRecOpen, setCreateRecOpen] = useState(false)
  const [editRecOpen, setEditRecOpen] = useState(false)
  const [editingRecord, setEditingRecord] = useState<DtoRecordSetResponse | null>(null)

  const qc = useQueryClient()

  // ---- queries ----

  const domainsQ = useQuery({
    queryKey: ["dns", "domains"],
    queryFn: () => dnsApi.listDomains(),
  })

  const recordsQ = useQuery({
    queryKey: ["dns", "records", selected?.id],
    queryFn: async () => {
      if (!selected) return []
      return await dnsApi.listRecordSetsByDomain(selected.id as string)
    },
    enabled: !!selected?.id,
  })

  const credentialQ = useQuery({
    queryKey: ["credentials", "r53"],
    queryFn: () => credentialsApi.listCredentials(),
  })

  const r53Credentials = useMemo(() => (credentialQ.data ?? []).filter(isR53), [credentialQ.data])

  useEffect(() => {
    if (!selected && domainsQ.data && domainsQ.data.length) {
      setSelected(domainsQ.data[0]!)
    }
  }, [domainsQ.data, selected])

  const filteredDomains = useMemo(() => {
    const list: DtoDomainResponse[] = domainsQ.data ?? []
    if (!filter.trim()) return list
    const f = filter.toLowerCase()
    return list.filter((d) =>
      [d.domain_name, d.zone_id, d.status]
        .filter(Boolean)
        .map((x) => String(x).toLowerCase())
        .some((s) => s.includes(f))
    )
  }, [domainsQ.data, filter])

  // ---- mutations: domains ----

  const createDomainForm = useForm<CreateDomainValues>({
    resolver: zodResolver(createDomainSchema),
    defaultValues: {
      domain_name: "",
      credential_id: "",
      zone_id: "",
    },
  })

  const createDomainMut = useMutation({
    mutationFn: (v: CreateDomainValues) =>
      dnsApi.createDomain(v as unknown as DtoCreateDomainRequest),
    onSuccess: async (d) => {
      toast.success("Domain created")
      setCreateDomOpen(false)
      createDomainForm.reset()
      await qc.invalidateQueries({ queryKey: ["dns", "domains"] })
      setSelected(d as DtoDomainResponse)
    },
    onError: (e: any) =>
      toast.error("Failed to create domain", { description: e?.message ?? "Unknown error" }),
  })

  const editDomainForm = useForm<UpdateDomainValues>({
    resolver: zodResolver(updateDomainSchema),
    defaultValues: {},
  })

  const openEditDomain = (d: DtoDomainResponse) => {
    setSelected(d)
    editDomainForm.reset({
      domain_name: d.domain_name,
      credential_id: d.credential_id,
      zone_id: d.zone_id || "",
    })
    setEditDomOpen(true)
  }

  // Build PATCH body (don’t send empty strings)
  const buildUpdateDomainBody = (vals: UpdateDomainValues): DtoUpdateDomainRequest => {
    const body: any = {}
    if (typeof vals.domain_name !== "undefined") body.domain_name = vals.domain_name
    if (typeof vals.credential_id !== "undefined" && vals.credential_id !== "")
      body.credential_id = vals.credential_id
    if (typeof vals.zone_id !== "undefined" && vals.zone_id !== "") body.zone_id = vals.zone_id
    return body as DtoUpdateDomainRequest
  }

  const updateDomainMut = useMutation({
    mutationFn: (vals: UpdateDomainValues) => {
      if (!selected) throw new Error("No domain selected")
      return dnsApi.updateDomain(selected.id!, buildUpdateDomainBody(vals))
    },
    onSuccess: async () => {
      toast.success("Domain updated")
      setEditDomOpen(false)
      await qc.invalidateQueries({ queryKey: ["dns", "domains"] })
      await qc.invalidateQueries({ queryKey: ["dns", "records", selected?.id] })
    },
    onError: (e: any) =>
      toast.error("Failed to update domain", { description: e?.message ?? "Unknown error" }),
  })

  const deleteDomainMut = useMutation({
    mutationFn: (id: string) => dnsApi.deleteDomain(id),
    onSuccess: async () => {
      toast.success("Domain deleted")
      await qc.invalidateQueries({ queryKey: ["dns", "domains"] })
      setSelected(null)
    },
    onError: (e: any) =>
      toast.error("Failed to delete domain", { description: e?.message ?? "Unknown error" }),
  })

  // ---- mutations: record sets ----

  const createRecForm = useForm<CreateRecordValues>({
    resolver: zodResolver(createRecordSchema),
    defaultValues: {
      name: "",
      type: "A",
      ttl: 300,
      valuesCsv: "",
    },
  })

  const explainError = (e: any) => {
    const msg: string = e?.response?.data?.error || e?.message || "Unknown error"
    if (msg.includes("ownership_conflict")) {
      return "Ownership conflict: this (name,type) exists but isn’t owned by autoglue."
    }
    if (msg.includes("already_exists")) {
      return "A record with this (name,type) already exists. Use Edit instead."
    }
    return msg
  }

  const createRecordMut = useMutation({
    mutationFn: async (vals: CreateRecordValues) => {
      if (!selected) throw new Error("No domain selected")
      const body: DtoCreateRecordSetRequest = {
        name: vals.name,
        type: vals.type,
        ...(vals.ttl ? { ttl: vals.ttl as unknown as number } : {}),
        values: parseCommaList(vals.valuesCsv ?? ""),
      }
      return dnsApi.createRecordSetsByDomain(selected.id!, body)
    },
    onSuccess: async () => {
      toast.success("Record set created")
      setCreateRecOpen(false)
      createRecForm.reset()
      await qc.invalidateQueries({ queryKey: ["dns", "records", selected?.id] })
    },
    onError: (e: any) =>
      toast.error("Failed to create record set", { description: explainError(e) }),
  })

  const editRecForm = useForm<UpdateRecordValues>({
    resolver: zodResolver(updateRecordSchema),
    defaultValues: {},
  })

  const openEditRecord = (r: DtoRecordSetResponse) => {
    setEditingRecord(r)
    const values = (r.values as any) || []
    editRecForm.reset({
      name: r.name,
      type: r.type,
      ttl: r.ttl ? Number(r.ttl) : undefined,
      valuesCsv: joinCommaList(values),
    })
    setEditRecOpen(true)
  }

  const updateRecordMut = useMutation({
    mutationFn: async (vals: UpdateRecordValues) => {
      if (!editingRecord) throw new Error("No record selected")
      const body: DtoUpdateRecordSetRequest = {}

      if (typeof vals.name !== "undefined") body.name = vals.name
      if (typeof vals.type !== "undefined") body.type = vals.type
      if (typeof vals.ttl !== "undefined") body.ttl = vals.ttl as unknown as number | undefined
      if (typeof vals.valuesCsv !== "undefined") body.values = parseCommaList(vals.valuesCsv)

      return dnsApi.updateRecordSetsByDomain(editingRecord.id!, body)
    },
    onSuccess: async () => {
      toast.success("Record set updated")
      setEditRecOpen(false)
      setEditingRecord(null)
      await qc.invalidateQueries({ queryKey: ["dns", "records", selected?.id] })
    },
    onError: (e: any) =>
      toast.error("Failed to update record set", { description: explainError(e) }),
  })

  const deleteRecordMut = useMutation({
    mutationFn: (id: string) => dnsApi.deleteRecordSetsByDomain(id),
    onSuccess: async () => {
      toast.success("Record set deleted")
      await qc.invalidateQueries({ queryKey: ["dns", "records", selected?.id] })
    },
    onError: (e: any) =>
      toast.error("Failed to delete record set", { description: e?.message ?? "Unknown error" }),
  })

  // ---------- UI ----------

  return (
    <div className="space-y-5 p-6">
      <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
        <h1 className="text-2xl font-bold">DNS</h1>
        <div className="flex items-center gap-2">
          <div className="relative">
            <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
            <Input
              value={filter}
              onChange={(e) => setFilter(e.target.value)}
              placeholder="Search domains…"
              className="w-64 pl-8"
            />
          </div>
          <Dialog open={createDomOpen} onOpenChange={setCreateDomOpen}>
            <DialogTrigger asChild>
              <Button onClick={() => setCreateDomOpen(true)}>
                <Plus className="mr-2 h-4 w-4" />
                Add Domain
              </Button>
            </DialogTrigger>
            <DialogContent className="sm:max-w-lg">
              <DialogHeader>
                <DialogTitle>Add Domain</DialogTitle>
              </DialogHeader>
              <Form {...createDomainForm}>
                <form
                  className="space-y-4 pt-2"
                  onSubmit={createDomainForm.handleSubmit((v) => createDomainMut.mutate(v))}
                >
                  <FormField
                    control={createDomainForm.control}
                    name="domain_name"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Domain</FormLabel>
                        <FormControl>
                          <Input {...field} placeholder="example.com" />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  {/* CREDENTIAL SELECT (Create) */}
                  <FormField
                    control={createDomainForm.control}
                    name="credential_id"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Route53 Credential</FormLabel>
                        <Select
                          onValueChange={field.onChange}
                          value={field.value}
                          disabled={credentialQ.isLoading || (r53Credentials?.length ?? 0) === 0}
                        >
                          <FormControl>
                            <SelectTrigger>
                              <SelectValue
                                placeholder={
                                  credentialQ.isLoading
                                    ? "Loading…"
                                    : (r53Credentials?.length ?? 0) === 0
                                      ? "No Route53 credentials found"
                                      : "Select credential"
                                }
                              />
                            </SelectTrigger>
                          </FormControl>
                          <SelectContent>
                            {(r53Credentials ?? []).map((c) => (
                              <SelectItem key={c.id} value={c.id!}>
                                {credLabel(c)}
                              </SelectItem>
                            ))}
                          </SelectContent>
                        </Select>
                        {credentialQ.error && (
                          <p className="text-destructive text-xs">Failed to load credentials.</p>
                        )}
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createDomainForm.control}
                    name="zone_id"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Zone ID (optional)</FormLabel>
                        <FormControl>
                          <Input {...field} placeholder="/hostedzone/Z123…" />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />
                  <DialogFooter className="gap-2">
                    <Button type="button" variant="outline" onClick={() => setCreateDomOpen(false)}>
                      Cancel
                    </Button>
                    <Button type="submit" disabled={createDomainMut.isPending}>
                      {createDomainMut.isPending && (
                        <Loader2 className="mr-2 h-4 w-4 animate-spin" />
                      )}
                      Create
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </div>
      </div>

      {/* domains panel */}
      <div>
        <Card className="p-3 md:col-span-5">
          <div className="mb-2 flex items-center justify-between">
            <div className="text-sm font-semibold">Domains</div>
            {domainsQ.isFetching && <Loader2 className="h-4 w-4 animate-spin" />}
          </div>
          <div className="max-h-[60vh] overflow-auto rounded-md border">
            <table className="min-w-full text-sm">
              <thead className="bg-muted/40 text-xs tracking-wide uppercase">
                <tr>
                  <th className="px-3 py-2 text-left">Domain</th>
                  <th className="px-3 py-2 text-left">Zone</th>
                  <th className="px-3 py-2 text-left">Status</th>
                  <th className="px-3 py-2 text-right">Actions</th>
                </tr>
              </thead>
              <tbody>
                {(filteredDomains ?? []).map((d) => (
                  <tr
                    key={d.id}
                    className={`hover:bg-muted/30 border-t ${
                      selected?.id === d.id ? "bg-muted/40" : ""
                    }`}
                    onClick={() => setSelected(d)}
                  >
                    <td className="cursor-pointer px-3 py-2 font-medium">{d.domain_name}</td>
                    <td className="px-3 py-2">{d.zone_id || "—"}</td>
                    <td className="px-3 py-2">
                      <StatusBadge s={d.status} />
                    </td>
                    <td className="px-3 py-2">
                      <div className="flex items-center justify-end gap-2">
                        <Button
                          size="icon"
                          variant="ghost"
                          onClick={(e) => {
                            e.stopPropagation()
                            openEditDomain(d)
                          }}
                        >
                          <Pencil className="h-4 w-4" />
                        </Button>
                        <AlertDialog>
                          <AlertDialogTrigger asChild>
                            <Button
                              size="icon"
                              variant="ghost"
                              onClick={(e) => e.stopPropagation()}
                            >
                              <Trash2 className="h-4 w-4" />
                            </Button>
                          </AlertDialogTrigger>
                          <AlertDialogContent>
                            <AlertDialogHeader>
                              <AlertDialogTitle>Delete “{d.domain_name}”?</AlertDialogTitle>
                              <AlertDialogDescription>
                                This deletes the domain metadata. External DNS records are not
                                touched.
                              </AlertDialogDescription>
                            </AlertDialogHeader>
                            <AlertDialogFooter>
                              <AlertDialogCancel>Cancel</AlertDialogCancel>
                              <AlertDialogAction
                                className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
                                onClick={() => deleteDomainMut.mutate(d.id!)}
                              >
                                Delete
                              </AlertDialogAction>
                            </AlertDialogFooter>
                          </AlertDialogContent>
                        </AlertDialog>
                      </div>
                    </td>
                  </tr>
                ))}
                {(!filteredDomains || filteredDomains.length === 0) && (
                  <tr>
                    <td colSpan={4} className="text-muted-foreground px-3 py-8 text-center">
                      No domains yet.
                    </td>
                  </tr>
                )}
              </tbody>
            </table>
          </div>
        </Card>
      </div>

      <div>
        {/* records panel */}
        <Card className="p-3 md:col-span-7">
          <div className="mb-2 flex items-center justify-between">
            <div className="text-sm font-semibold">
              Records {selected ? `— ${selected.domain_name}` : ""}
            </div>
            <div className="flex items-center gap-2">
              <StatusBadge s={selected?.status} />
              <Dialog open={createRecOpen} onOpenChange={setCreateRecOpen}>
                <DialogTrigger asChild>
                  <Button disabled={!selected}>
                    <Plus className="mr-2 h-4 w-4" />
                    Add Record
                  </Button>
                </DialogTrigger>
                <DialogContent className="sm:max-w-xl">
                  <DialogHeader>
                    <DialogTitle>Add Record</DialogTitle>
                  </DialogHeader>
                  <Form {...createRecForm}>
                    <form
                      className="space-y-4 pt-2"
                      onSubmit={createRecForm.handleSubmit((v) => createRecordMut.mutate(v))}
                    >
                      <div className="grid grid-cols-1 gap-4 md:grid-cols-3">
                        <FormField
                          control={createRecForm.control}
                          name="name"
                          render={({ field }) => (
                            <FormItem className="md:col-span-1">
                              <FormLabel>Name</FormLabel>
                              <FormControl>
                                <Input {...field} placeholder="endpoint (or @)" />
                              </FormControl>
                              <FormMessage />
                            </FormItem>
                          )}
                        />
                        <FormField
                          control={createRecForm.control}
                          name="type"
                          render={({ field }) => (
                            <FormItem>
                              <FormLabel>Type</FormLabel>
                              <Select onValueChange={field.onChange} value={field.value as string}>
                                <FormControl>
                                  <SelectTrigger>
                                    <SelectValue />
                                  </SelectTrigger>
                                </FormControl>
                                <SelectContent>
                                  {rrtypes.map((t) => (
                                    <SelectItem key={t} value={t}>
                                      {t}
                                    </SelectItem>
                                  ))}
                                </SelectContent>
                              </Select>
                              <FormMessage />
                            </FormItem>
                          )}
                        />
                        <FormField
                          control={createRecForm.control}
                          name="ttl"
                          render={({ field }) => (
                            <FormItem>
                              <FormLabel>TTL (sec, optional)</FormLabel>
                              <FormControl>
                                <Input
                                  type="number"
                                  value={field.value as number | undefined}
                                  onChange={(e) =>
                                    field.onChange(
                                      e.target.value === "" ? undefined : Number(e.target.value)
                                    )
                                  }
                                  placeholder="300"
                                />
                              </FormControl>
                              <FormMessage />
                            </FormItem>
                          )}
                        />
                      </div>

                      <FormField
                        control={createRecForm.control}
                        name="valuesCsv"
                        render={({ field }) => (
                          <FormItem>
                            <FormLabel>Values (comma-separated)</FormLabel>
                            <FormControl>
                              <Textarea
                                {...field}
                                rows={3}
                                placeholder='e.g. 10.0.30.1, 10.0.30.2 or "v=spf1 ~all"'
                                className="font-mono"
                              />
                            </FormControl>
                            <FormMessage />
                          </FormItem>
                        )}
                      />

                      <DialogFooter className="gap-2">
                        <Button
                          variant="outline"
                          type="button"
                          onClick={() => setCreateRecOpen(false)}
                        >
                          Cancel
                        </Button>
                        <Button type="submit" disabled={createRecordMut.isPending}>
                          {createRecordMut.isPending && (
                            <Loader2 className="mr-2 h-4 w-4 animate-spin" />
                          )}
                          Create
                        </Button>
                      </DialogFooter>
                    </form>
                  </Form>
                </DialogContent>
              </Dialog>
            </div>
          </div>

          <div className="overflow-x-auto rounded-md border">
            {recordsQ.isLoading && (
              <div className="flex items-center gap-2 p-4">
                <Loader2 className="h-4 w-4 animate-spin" /> Loading records…
              </div>
            )}
            {!recordsQ.isLoading && (
              <table className="min-w-full text-sm">
                <thead className="bg-muted/40 text-xs tracking-wide uppercase">
                  <tr>
                    <th className="px-3 py-2 text-left">Name</th>
                    <th className="px-3 py-2 text-left">Type</th>
                    <th className="px-3 py-2 text-left">TTL</th>
                    <th className="px-3 py-2 text-left">Values</th>
                    <th className="px-3 py-2 text-left">Status</th>
                    <th className="px-3 py-2 text-left">Owner</th>
                    <th className="px-3 py-2 text-right">Actions</th>
                  </tr>
                </thead>
                <tbody>
                  {(recordsQ.data ?? []).map((r) => {
                    const values = (r.values as any) || []
                    return (
                      <tr key={r.id} className="border-t">
                        <td className="px-3 py-2 font-medium">{r.name || "@"}</td>
                        <td className="px-3 py-2">{r.type}</td>
                        <td className="px-3 py-2">{r.ttl ?? "—"}</td>
                        <td className="px-3 py-2">
                          <div className="max-w-[420px] truncate" title={(values || []).join(", ")}>
                            {(values || []).join(", ")}
                          </div>
                        </td>
                        <td className="px-3 py-2">
                          <StatusBadge s={r.status} />
                        </td>
                        <td className="px-3 py-2">{r.owner}</td>
                        <td className="px-3 py-2">
                          <div className="flex items-center justify-end gap-2">
                            <Button size="icon" variant="ghost" onClick={() => openEditRecord(r)}>
                              <Pencil className="h-4 w-4" />
                            </Button>

                            <AlertDialog>
                              <AlertDialogTrigger asChild>
                                <Button size="icon" variant="ghost">
                                  <Trash2 className="h-4 w-4" />
                                </Button>
                              </AlertDialogTrigger>
                              <AlertDialogContent>
                                <AlertDialogHeader>
                                  <AlertDialogTitle>
                                    Delete “{r.name || "@"} {r.type}”?
                                  </AlertDialogTitle>
                                  <AlertDialogDescription>
                                    This removes the record set from your project. Your worker does
                                    not delete it from the DNS provider right now.
                                  </AlertDialogDescription>
                                </AlertDialogHeader>
                                <AlertDialogFooter>
                                  <AlertDialogCancel>Cancel</AlertDialogCancel>
                                  <AlertDialogAction
                                    className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
                                    onClick={() => deleteRecordMut.mutate(r.id!)}
                                  >
                                    Delete
                                  </AlertDialogAction>
                                </AlertDialogFooter>
                              </AlertDialogContent>
                            </AlertDialog>

                            <DropdownMenu>
                              <DropdownMenuTrigger asChild>
                                <Button variant="ghost" size="icon">
                                  <MoreHorizontal className="h-4 w-4" />
                                </Button>
                              </DropdownMenuTrigger>
                              <DropdownMenuContent align="end">
                                <DropdownMenuItem onClick={() => openEditRecord(r)}>
                                  Edit
                                </DropdownMenuItem>
                                <DropdownMenuItem
                                  className="text-destructive"
                                  onClick={() => deleteRecordMut.mutate(r.id!)}
                                >
                                  Delete
                                </DropdownMenuItem>
                              </DropdownMenuContent>
                            </DropdownMenu>
                          </div>
                        </td>
                      </tr>
                    )
                  })}
                  {(!recordsQ.data || recordsQ.data.length === 0) && (
                    <tr>
                      <td colSpan={7} className="text-muted-foreground px-3 py-8 text-center">
                        {selected
                          ? "No records yet — add one."
                          : "Select a domain to view records."}
                      </td>
                    </tr>
                  )}
                </tbody>
              </table>
            )}
          </div>
        </Card>
      </div>

      {/* Edit Domain Dialog */}
      <Dialog open={editDomOpen} onOpenChange={setEditDomOpen}>
        <DialogContent className="sm:max-w-lg">
          <DialogHeader>
            <DialogTitle>Edit Domain</DialogTitle>
          </DialogHeader>
          <Form {...editDomainForm}>
            <form
              className="space-y-4 pt-2"
              onSubmit={editDomainForm.handleSubmit((v) => updateDomainMut.mutate(v))}
            >
              <FormField
                control={editDomainForm.control}
                name="domain_name"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Domain</FormLabel>
                    <FormControl>
                      <Input {...field} placeholder="example.com" />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              {/* CREDENTIAL SELECT (Edit) */}
              <FormField
                control={editDomainForm.control}
                name="credential_id"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Route53 Credential</FormLabel>
                    <Select
                      onValueChange={field.onChange}
                      value={field.value ?? ""}
                      disabled={credentialQ.isLoading || (r53Credentials?.length ?? 0) === 0}
                    >
                      <FormControl>
                        <SelectTrigger>
                          <SelectValue
                            placeholder={
                              credentialQ.isLoading
                                ? "Loading…"
                                : (r53Credentials?.length ?? 0) === 0
                                  ? "No Route53 credentials found"
                                  : "Select credential"
                            }
                          />
                        </SelectTrigger>
                      </FormControl>
                      <SelectContent>
                        {(r53Credentials ?? []).map((c) => (
                          <SelectItem key={c.id} value={c.id!}>
                            {credLabel(c)}
                          </SelectItem>
                        ))}
                      </SelectContent>
                    </Select>
                    {credentialQ.error && (
                      <p className="text-destructive text-xs">Failed to load credentials.</p>
                    )}
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={editDomainForm.control}
                name="zone_id"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Zone ID</FormLabel>
                    <FormControl>
                      <Input {...field} placeholder="/hostedzone/Z123…" />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />
              <DialogFooter className="gap-2">
                <Button variant="outline" type="button" onClick={() => setEditDomOpen(false)}>
                  Cancel
                </Button>
                <Button type="submit" disabled={updateDomainMut.isPending}>
                  {updateDomainMut.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
                  Save Changes
                </Button>
              </DialogFooter>
            </form>
          </Form>
        </DialogContent>
      </Dialog>

      {/* Edit Record Dialog */}
      <Dialog open={editRecOpen} onOpenChange={setEditRecOpen}>
        <DialogContent className="sm:max-w-xl">
          <DialogHeader>
            <DialogTitle>Edit Record</DialogTitle>
          </DialogHeader>
          <Form {...editRecForm}>
            <form
              className="space-y-4 pt-2"
              onSubmit={editRecForm.handleSubmit((v) => updateRecordMut.mutate(v))}
            >
              <div className="grid grid-cols-1 gap-4 md:grid-cols-3">
                <FormField
                  control={editRecForm.control}
                  name="name"
                  render={({ field }) => (
                    <FormItem className="md:col-span-1">
                      <FormLabel>Name</FormLabel>
                      <FormControl>
                        <Input {...field} />
                      </FormControl>
                      <FormMessage />
                    </FormItem>
                  )}
                />
                <FormField
                  control={editRecForm.control}
                  name="type"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Type</FormLabel>
                      <Select onValueChange={field.onChange} value={field.value as string}>
                        <FormControl>
                          <SelectTrigger>
                            <SelectValue />
                          </SelectTrigger>
                        </FormControl>
                        <SelectContent>
                          {rrtypes.map((t) => (
                            <SelectItem key={t} value={t}>
                              {t}
                            </SelectItem>
                          ))}
                        </SelectContent>
                      </Select>
                      <FormMessage />
                    </FormItem>
                  )}
                />
                <FormField
                  control={editRecForm.control}
                  name="ttl"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>TTL (sec, optional)</FormLabel>
                      <FormControl>
                        <Input
                          type="number"
                          value={field.value as number | undefined}
                          onChange={(e) =>
                            field.onChange(
                              e.target.value === "" ? undefined : Number(e.target.value)
                            )
                          }
                          placeholder="300"
                        />
                      </FormControl>
                      <FormMessage />
                    </FormItem>
                  )}
                />
              </div>

              <FormField
                control={editRecForm.control}
                name="valuesCsv"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Values (comma-separated)</FormLabel>
                    <FormControl>
                      <Textarea {...field} rows={3} className="font-mono" />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <DialogFooter className="gap-2">
                <Button variant="outline" type="button" onClick={() => setEditRecOpen(false)}>
                  Cancel
                </Button>
                <Button type="submit" disabled={updateRecordMut.isPending}>
                  {updateRecordMut.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
                  Save Changes
                </Button>
              </DialogFooter>
            </form>
          </Form>
        </DialogContent>
      </Dialog>
    </div>
  )
}
</file>

<file path="ui/src/pages/docs-page.tsx">
import { useEffect, useRef, useState, type FC } from "react"
import { useTheme } from "next-themes"

import { Button } from "@/components/ui/button"
import { Input } from "@/components/ui/input"

import "rapidoc"

import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card.tsx"
import {
  Select,
  SelectContent,
  SelectItem,
  SelectTrigger,
  SelectValue,
} from "@/components/ui/select.tsx"

type RdThemeMode = "auto" | "light" | "dark"

export const DocsPage: FC = () => {
  const rdRef = useRef<any>(null)
  const { theme, systemTheme, setTheme } = useTheme()

  const [orgId, setOrgId] = useState("")
  const [rdThemeMode, setRdThemeMode] = useState<RdThemeMode>("auto")

  useEffect(() => {
    const stateSetter = () => {
      const stored = localStorage.getItem("autoglue.org")
      if (stored) setOrgId(stored)
    }

    stateSetter()
  }, [])

  useEffect(() => {
    const rd = rdRef.current
    if (!rd) return

    let effectiveTheme: "light" | "dark" = "light"
    if (rdThemeMode === "light") {
      effectiveTheme = "light"
    } else if (rdThemeMode === "dark") {
      effectiveTheme = "dark"
    } else {
      const appTheme = theme === "system" ? systemTheme : theme
      effectiveTheme = appTheme === "dark" ? "dark" : "light"
    }

    rd.setAttribute("theme", effectiveTheme)

    if (typeof window !== "undefined") {
      const defaultServer = `${window.location.origin}/api/v1`
      rd.setAttribute("default-api-server", defaultServer)
    }

    if (orgId) {
      rd.setAttribute("api-key-name", "X-ORG-ID")
      rd.setAttribute("api-key-location", "header")
      rd.setAttribute("api-key-value", orgId)
    } else {
      rd.removeAttribute("api-key-value")
    }
  }, [theme, systemTheme, rdThemeMode, orgId])

  const handleSaveOrg = () => {
    const trimmed = orgId.trim()
    localStorage.setItem("autoglue.org", trimmed)
    const rd = rdRef.current
    if (!rd) return

    if (trimmed) {
      rd.setAttribute("api-key-value", trimmed)
    } else {
      rd.removeAttribute("api-key-value")
    }
  }

  const handleResetOrg = () => {
    localStorage.removeItem("autoglue.org")
    setOrgId("")
    const rd = rdRef.current
    if (!rd) return
    rd.removeAttribute("api-key-value")
  }

  return (
    <div className="flex h-[100svh] flex-col">
      {/* Control bar */}
      <Card className="rounded-none border-b">
        <CardHeader className="py-3">
          <CardTitle className="flex flex-wrap items-center justify-between gap-4 text-base">
            <span>AutoGlue API Docs</span>
            <div className="flex items-center gap-2 text-xs">
              <div className="flex flex-wrap items-center gap-3 text-xs">
                {/* Theme selector */}
                <div className="flex items-center gap-2">
                  <span className="text-muted-foreground">Docs theme</span>
                  <Select
                    value={rdThemeMode}
                    onValueChange={(v) => {
                      const mode = v as RdThemeMode
                      setRdThemeMode(mode)

                      if (mode === "auto") {
                        setTheme("system")
                      } else {
                        setTheme(v)
                      }
                    }}
                  >
                    <SelectTrigger className="h-8 w-[120px]">
                      <SelectValue />
                    </SelectTrigger>
                    <SelectContent>
                      <SelectItem value="auto">Auto (match app)</SelectItem>
                      <SelectItem value="light">Light</SelectItem>
                      <SelectItem value="dark">Dark</SelectItem>
                    </SelectContent>
                  </Select>
                </div>

                {/* Org ID controls */}
                <div className="flex items-center gap-2">
                  <span className="text-muted-foreground">Org ID (X-ORG-ID)</span>
                  <Input
                    className="h-8 w-80"
                    value={orgId}
                    onChange={(e) => setOrgId(e.target.value)}
                    placeholder="org_..."
                  />
                  <Button size="sm" onClick={handleSaveOrg}>
                    Save
                  </Button>
                  <Button size="sm" variant="outline" onClick={handleResetOrg}>
                    Reset
                  </Button>
                </div>
              </div>
            </div>
          </CardTitle>
        </CardHeader>
        <CardContent className="text-muted-foreground py-0 pb-2 text-xs">
          Requests from <code>&lt;rapi-doc&gt;</code> will include:
          <code className="ml-1">Cookie: ag_jwt=…</code> and{" "}
          <code className="ml-1">X-ORG-ID={orgId}</code>
          {!orgId && <> (set an Org ID above to send an X-ORG-ID header)</>}
        </CardContent>
      </Card>

      {/* @ts-expect-error ts-2339 */}
      <rapi-doc
        ref={rdRef}
        id="autoglue-docs"
        spec-url="/swagger/openapi.json"
        render-style="read"
        show-header="false"
        persist-auth="true"
        allow-advanced-search="true"
        schema-description-expanded="true"
        allow-schema-description-expand-toggle="false"
        allow-spec-file-download="true"
        allow-spec-file-load="false"
        allow-spec-url-load="false"
        allow-try="true"
        schema-style="tree"
        fetch-credentials="include"
      />
    </div>
  )
}
</file>

<file path="ui/src/pages/jobs-page.tsx">
import { useEffect, useState, type FC } from "react"
import { archerAdminApi } from "@/api/archer_admin"
import {
  AdminListArcherJobsStatusEnum,
  type AdminListArcherJobsRequest,
  type DtoJob,
  type DtoPageJob,
  type DtoQueueInfo,
} from "@/sdk"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { Loader2, Plus, RefreshCw, Search, X } from "lucide-react"

import { cn } from "@/lib/utils"
import { Badge } from "@/components/ui/badge"
import { Button } from "@/components/ui/button"
import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card"
import {
  Dialog,
  DialogClose,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog"
import { Input } from "@/components/ui/input"
import { Label } from "@/components/ui/label"
import {
  Select,
  SelectContent,
  SelectItem,
  SelectTrigger,
  SelectValue,
} from "@/components/ui/select"
import {
  Table,
  TableBody,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table"
import { Textarea } from "@/components/ui/textarea"

type JobStatus = AdminListArcherJobsStatusEnum

const STATUS: JobStatus[] = [
  AdminListArcherJobsStatusEnum.queued,
  AdminListArcherJobsStatusEnum.running,
  AdminListArcherJobsStatusEnum.succeeded,
  AdminListArcherJobsStatusEnum.failed,
  AdminListArcherJobsStatusEnum.canceled,
  AdminListArcherJobsStatusEnum.retrying,
  AdminListArcherJobsStatusEnum.scheduled,
]

const statusClass: Record<JobStatus, string> = {
  queued: "bg-amber-100 text-amber-800",
  running: "bg-sky-100 text-sky-800",
  succeeded: "bg-emerald-100 text-emerald-800",
  failed: "bg-red-100 text-red-800",
  canceled: "bg-zinc-200 text-zinc-700",
  retrying: "bg-orange-100 text-orange-800",
  scheduled: "bg-violet-100 text-violet-800",
}

function fmt(dt?: string | null) {
  if (!dt) return "—"
  const d = new Date(dt)
  return new Intl.DateTimeFormat(undefined, {
    dateStyle: "medium",
    timeStyle: "short",
  }).format(d)
}

// Small debounce hook for search input
function useDebounced<T>(value: T, ms = 300) {
  const [v, setV] = useState(value)
  useEffect(() => {
    const t = setTimeout(() => setV(value), ms)
    return () => clearTimeout(t)
  }, [value, ms])
  return v
}

export const JobsPage: FC = () => {
  const qc = useQueryClient()

  // Filters
  const [status, setStatus] = useState<string>("")
  const [queue, setQueue] = useState<string>("")
  const [q, setQ] = useState<string>("")
  const debouncedQ = useDebounced(q, 300)
  const [page, setPage] = useState(1)
  const [pageSize, setPageSize] = useState(25)

  const key = ["archer", "jobs", { status, queue, q: debouncedQ, page, pageSize }]

  // Jobs query
  const jobsQ = useQuery({
    queryKey: key,
    queryFn: () =>
      archerAdminApi.listJobs({
        status: status ? (status as JobStatus) : undefined,
        queue: queue || undefined,
        q: debouncedQ || undefined,
        page,
        pageSize,
      } as AdminListArcherJobsRequest),
    placeholderData: (prev) => prev,
    staleTime: 10_000,
  })

  // Queues summary (optional header)
  const queuesQ = useQuery({
    queryKey: ["archer", "queues"],
    queryFn: () => archerAdminApi.listQueues() as Promise<DtoQueueInfo[]>,
    staleTime: 30_000,
  })

  // Mutations
  const enqueueM = useMutation({
    mutationFn: (body: {
      queue: string
      type: string
      payload?: object | undefined
      run_at?: string
    }) => archerAdminApi.enqueue(body),
    onSuccess: () => qc.invalidateQueries({ queryKey: ["archer", "jobs"] }),
  })

  const retryM = useMutation({
    mutationFn: (id: string) => archerAdminApi.retryJob(id),
    onSuccess: () => qc.invalidateQueries({ queryKey: ["archer", "jobs"] }),
  })

  const cancelM = useMutation({
    mutationFn: (id: string) => archerAdminApi.cancelJob(id),
    onSuccess: () => qc.invalidateQueries({ queryKey: ["archer", "jobs"] }),
  })

  const busy = jobsQ.isFetching

  const data = jobsQ.data as DtoPageJob | undefined
  const items: DtoJob[] = data?.items ?? []
  const total = data?.total ?? 0
  const totalPages = Math.max(1, Math.ceil(total / pageSize))

  return (
    <div className="container mx-auto space-y-6 p-6">
      <div className="flex items-start justify-between gap-4">
        <div>
          <h1 className="text-2xl font-semibold">Archer Jobs</h1>
          <p className="text-muted-foreground text-sm">
            Inspect, enqueue, retry and cancel background jobs.
          </p>
        </div>
        <div className="flex gap-2">
          <EnqueueDialog
            onSubmit={(payload) => enqueueM.mutateAsync(payload)}
            submitting={enqueueM.isPending}
          />
          <Button
            variant="secondary"
            onClick={() => qc.invalidateQueries({ queryKey: ["archer", "jobs"] })}
            disabled={busy}
          >
            {busy ? (
              <Loader2 className="mr-2 h-4 w-4 animate-spin" />
            ) : (
              <RefreshCw className="mr-2 h-4 w-4" />
            )}
            Refresh
          </Button>
        </div>
      </div>

      {/* Queue metrics (optional) */}
      <div className="grid gap-4 md:grid-cols-2 lg:grid-cols-4">
        {queuesQ.data?.map((q) => (
          <Card key={q.name}>
            <CardHeader>
              <CardTitle className="text-base">{q.name}</CardTitle>
            </CardHeader>
            <CardContent className="grid grid-cols-2 gap-2 text-sm">
              <Metric label="Pending" value={q.pending ?? 0} />
              <Metric label="Running" value={q.running ?? 0} />
              <Metric label="Failed" value={q.failed ?? 0} />
              <Metric label="Scheduled" value={q.scheduled ?? 0} />
            </CardContent>
          </Card>
        ))}
      </div>

      {/* Filters */}
      <Card>
        <CardHeader>
          <CardTitle>Filters</CardTitle>
        </CardHeader>
        <CardContent className="grid gap-3 md:grid-cols-4">
          <div className="col-span-2 flex items-center gap-2">
            <Input
              placeholder="Search id, queue, error, payload…"
              value={q}
              onChange={(e) => {
                setQ(e.target.value)
                setPage(1)
              }}
              onKeyDown={(e) =>
                e.key === "Enter" && qc.invalidateQueries({ queryKey: ["archer", "jobs"] })
              }
            />
            {q && (
              <Button variant="ghost" size="icon" onClick={() => setQ("")}>
                <X className="h-4 w-4" />
              </Button>
            )}
            <Button onClick={() => qc.invalidateQueries({ queryKey: ["archer", "jobs"] })}>
              <Search className="mr-2 h-4 w-4" /> Search
            </Button>
          </div>
          <Select
            value={status || "all"}
            onValueChange={(v) => {
              setStatus(v === "all" ? "" : v)
              setPage(1)
            }}
          >
            <SelectTrigger>
              <SelectValue placeholder="All statuses" />
            </SelectTrigger>
            <SelectContent>
              <SelectItem value="all">All statuses</SelectItem>
              {STATUS.map((s) => (
                <SelectItem key={s} value={s}>
                  {s}
                </SelectItem>
              ))}
            </SelectContent>
          </Select>
          <Input
            placeholder="Queue (optional)"
            value={queue}
            onChange={(e) => {
              setQueue(e.target.value)
              setPage(1)
            }}
          />
          <div className="flex items-center gap-2">
            <Label className="whitespace-nowrap">Page size</Label>
            <Select
              value={String(pageSize)}
              onValueChange={(v) => {
                setPageSize(Number(v))
                setPage(1)
              }}
            >
              <SelectTrigger className="w-[120px]">
                <SelectValue />
              </SelectTrigger>
              <SelectContent>
                {[10, 25, 50, 100].map((n) => (
                  <SelectItem key={n} value={String(n)}>
                    {n}
                  </SelectItem>
                ))}
              </SelectContent>
            </Select>
          </div>
        </CardContent>
      </Card>

      {/* Table */}
      <Card>
        <CardContent className="p-0">
          <Table>
            <TableHeader>
              <TableRow>
                <TableHead>ID</TableHead>
                <TableHead>Queue</TableHead>
                <TableHead>Status</TableHead>
                <TableHead>Attempts</TableHead>
                <TableHead>Run At</TableHead>
                <TableHead>Updated</TableHead>
                <TableHead className="pr-4 text-right">Actions</TableHead>
              </TableRow>
            </TableHeader>
            <TableBody>
              {jobsQ.isLoading && (
                <TableRow>
                  <TableCell colSpan={7} className="text-muted-foreground py-8 text-center">
                    Loading…
                  </TableCell>
                </TableRow>
              )}
              {jobsQ.isError && (
                <TableRow>
                  <TableCell colSpan={7} className="py-8 text-center text-red-600">
                    Failed to load jobs
                  </TableCell>
                </TableRow>
              )}
              {!jobsQ.isLoading && items.length === 0 && (
                <TableRow>
                  <TableCell colSpan={7} className="text-muted-foreground py-8 text-center">
                    No jobs match your filters.
                  </TableCell>
                </TableRow>
              )}
              {items.map((j) => {
                const jobStatus: JobStatus =
                  (j.status as JobStatus | undefined) ?? AdminListArcherJobsStatusEnum.queued

                return (
                  <TableRow key={j.id}>
                    <TableCell>
                      <code className="text-xs">{j.id}</code>
                    </TableCell>
                    <TableCell>
                      <Badge variant="secondary">{j.queue}</Badge>
                    </TableCell>
                    <TableCell>
                      <span
                        className={cn("rounded-md px-2 py-0.5 text-xs", statusClass[jobStatus])}
                      >
                        {jobStatus}
                      </span>
                    </TableCell>
                    <TableCell>
                      {j.max_attempts ? `${j.attempts}/${j.max_attempts}` : j.attempts}
                    </TableCell>
                    <TableCell>{fmt(j.run_at)}</TableCell>
                    <TableCell>{fmt(j.updated_at ?? j.created_at)}</TableCell>
                    <TableCell className="text-right">
                      <div className="flex justify-end gap-2">
                        {(jobStatus === AdminListArcherJobsStatusEnum.failed ||
                          jobStatus === AdminListArcherJobsStatusEnum.canceled) && (
                          <Button
                            size="sm"
                            variant="outline"
                            disabled={retryM.isPending || !j.id}
                            onClick={() => {
                              if (!j.id) return
                              retryM.mutate(j.id)
                            }}
                          >
                            Retry
                          </Button>
                        )}
                        {(jobStatus === AdminListArcherJobsStatusEnum.queued ||
                          jobStatus === AdminListArcherJobsStatusEnum.running ||
                          jobStatus === AdminListArcherJobsStatusEnum.scheduled) && (
                          <Button
                            size="sm"
                            variant="outline"
                            disabled={cancelM.isPending || !j.id}
                            onClick={() => {
                              if (!j.id) return
                              cancelM.mutate(j.id)
                            }}
                          >
                            Cancel
                          </Button>
                        )}
                        <DetailsButton job={j} />
                      </div>
                    </TableCell>
                  </TableRow>
                )
              })}
            </TableBody>
          </Table>

          {/* Pagination */}
          <div className="flex items-center justify-between border-t p-3 text-sm">
            <div>
              Page {page} of {totalPages} • {total} total
            </div>
            <div className="flex gap-2">
              <Button
                variant="outline"
                disabled={page <= 1 || jobsQ.isFetching}
                onClick={() => setPage((p) => Math.max(1, p - 1))}
              >
                Prev
              </Button>
              <Button
                variant="outline"
                disabled={page >= totalPages || jobsQ.isFetching}
                onClick={() => setPage((p) => p + 1)}
              >
                Next
              </Button>
            </div>
          </div>
        </CardContent>
      </Card>
    </div>
  )
}

function Metric({ label, value }: { label: string; value: number }) {
  return (
    <div className="bg-muted/30 rounded-lg border p-3">
      <div className="text-muted-foreground text-xs">{label}</div>
      <div className="text-lg font-semibold">{value}</div>
    </div>
  )
}

function DetailsButton({ job }: { job: DtoJob }) {
  return (
    <Dialog>
      <DialogTrigger asChild>
        <Button size="sm" variant="ghost">
          Details
        </Button>
      </DialogTrigger>
      <DialogContent className="max-w-2xl">
        <DialogHeader>
          <DialogTitle>Job {job.id}</DialogTitle>
        </DialogHeader>
        <div className="grid gap-3">
          {job.last_error && (
            <Card>
              <CardHeader>
                <CardTitle className="text-sm">Last error</CardTitle>
              </CardHeader>
              <CardContent>
                <pre className="overflow-auto text-xs whitespace-pre-wrap">{job.last_error}</pre>
              </CardContent>
            </Card>
          )}
          <Card>
            <CardHeader>
              <CardTitle className="text-sm">Payload</CardTitle>
            </CardHeader>
            <CardContent>
              <pre className="overflow-auto text-xs whitespace-pre-wrap">
                {JSON.stringify(job.payload, null, 2)}
              </pre>
            </CardContent>
          </Card>
        </div>
        <DialogFooter>
          <DialogClose asChild>
            <Button variant="secondary">Close</Button>
          </DialogClose>
        </DialogFooter>
      </DialogContent>
    </Dialog>
  )
}

function EnqueueDialog({
  onSubmit,
  submitting,
}: {
  onSubmit: (body: {
    queue: string
    type: string
    payload?: object | undefined
    run_at?: string
  }) => Promise<unknown>
  submitting?: boolean
}) {
  const [open, setOpen] = useState(false)
  const [queue, setQueue] = useState("")
  const [type, setType] = useState("")
  const [payload, setPayload] = useState("{}")
  const [runAt, setRunAt] = useState("")

  const canSubmit = queue && type && !submitting

  async function handleSubmit() {
    const parsed = payload ? JSON.parse(payload) : undefined
    await onSubmit({ queue, type, payload: parsed, run_at: runAt || undefined })
    setOpen(false)
    setQueue("")
    setType("")
    setPayload("{}")
    setRunAt("")
  }

  return (
    <Dialog open={open} onOpenChange={setOpen}>
      <DialogTrigger asChild>
        <Button>
          <Plus className="mr-2 h-4 w-4" /> Enqueue
        </Button>
      </DialogTrigger>
      <DialogContent>
        <DialogHeader>
          <DialogTitle>Enqueue Job</DialogTitle>
        </DialogHeader>
        <div className="grid gap-3">
          <div className="grid gap-2">
            <Label>Queue</Label>
            <Input
              value={queue}
              onChange={(e) => setQueue(e.target.value)}
              placeholder="e.g. bootstrap_bastion"
            />
          </div>
          <div className="grid gap-2">
            <Label>Type</Label>
            <Input
              value={type}
              onChange={(e) => setType(e.target.value)}
              placeholder="e.g. bootstrap_bastion"
            />
          </div>
          <div className="grid gap-2">
            <Label>Payload (JSON)</Label>
            <Textarea
              value={payload}
              onChange={(e) => setPayload(e.target.value)}
              className="min-h-[120px] font-mono text-xs"
            />
          </div>
          <div className="grid gap-2">
            <Label>Run at (optional)</Label>
            <Input type="datetime-local" value={runAt} onChange={(e) => setRunAt(e.target.value)} />
          </div>
        </div>
        <DialogFooter>
          <DialogClose asChild>
            <Button variant="secondary">Cancel</Button>
          </DialogClose>
          <Button onClick={handleSubmit} disabled={!canSubmit}>
            {submitting ? <Loader2 className="mr-2 h-4 w-4 animate-spin" /> : null}
            Enqueue
          </Button>
        </DialogFooter>
      </DialogContent>
    </Dialog>
  )
}
</file>

<file path="ui/src/pages/labels-page.tsx">
import { useMemo, useState } from "react"
import { labelsApi } from "@/api/labels.ts"
import type { DtoLabelResponse } from "@/sdk"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { CircleSlash2, Pencil, Plus, Search, Tags } from "lucide-react"
import { useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import { truncateMiddle } from "@/lib/utils.ts"
import { Badge } from "@/components/ui/badge.tsx"
import { Button } from "@/components/ui/button.tsx"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog.tsx"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form.tsx"
import { Input } from "@/components/ui/input.tsx"
import {
  Table,
  TableBody,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table.tsx"

const createLabelSchema = z.object({
  key: z.string().trim().min(1, "Key is required").max(120, "Max 120 chars"),
  value: z.string().trim().optional(),
})
type CreateLabelInput = z.input<typeof createLabelSchema>

const updateLabelSchema = createLabelSchema.partial()
type UpdateLabelValues = z.infer<typeof updateLabelSchema>

function LabelBadge({ t }: { t: Pick<DtoLabelResponse, "key" | "value"> }) {
  const label = `${t.key}${t.value ? `=${t.value}` : ""}`
  return (
    <Badge variant="secondary" className="font-mono text-xs">
      <Tags className="mr-1 h-3 w-3" />
      {label}
    </Badge>
  )
}

export const LabelsPage = () => {
  const [filter, setFilter] = useState<string>("")
  const [createOpen, setCreateOpen] = useState<boolean>(false)
  const [updateOpen, setUpdateOpen] = useState<boolean>(false)
  const [deleteId, setDeleteId] = useState<string | null>(null)
  const [editingId, setEditingId] = useState<string | null>(null)

  const qc = useQueryClient()

  const labelsQ = useQuery({
    queryKey: ["labels"],
    queryFn: () => labelsApi.listLabels(),
  })

  // --- Create
  const createForm = useForm<CreateLabelInput>({
    resolver: zodResolver(createLabelSchema),
    defaultValues: {
      key: "",
      value: "",
    },
  })

  const createMut = useMutation({
    mutationFn: (values: CreateLabelInput) => labelsApi.createLabel(values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["labels"] })
      createForm.reset()
      setCreateOpen(false)
      toast.success("Label Created Successfully.")
    },
    onError: (err) => {
      toast.error(err.message ?? "There was an error while creating Label")
    },
  })

  const onCreateSubmit = (values: CreateLabelInput) => {
    createMut.mutate(values)
  }

  // --- Update
  const updateForm = useForm<UpdateLabelValues>({
    resolver: zodResolver(updateLabelSchema),
    defaultValues: {},
  })

  const updateMut = useMutation({
    mutationFn: ({ id, values }: { id: string; values: UpdateLabelValues }) =>
      labelsApi.updateLabel(id, values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["labels"] })
      updateForm.reset()
      setUpdateOpen(false)
      toast.success("Label Updated Successfully.")
    },
    onError: (err) => {
      toast.error(err.message ?? "There was an error while updating Label")
    },
  })

  const openEdit = (label: any) => {
    setEditingId(label.id)
    updateForm.reset({
      key: label.key,
      value: label.value,
    })
    setUpdateOpen(true)
  }

  // --- Delete ---

  const deleteMut = useMutation({
    mutationFn: (id: string) => labelsApi.deleteLabel(id),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["labels"] })
      setDeleteId(null)
      toast.success("Label Deleted Successfully.")
    },
    onError: (err) => {
      toast.error(err.message ?? "There was an error while deleting Label")
    },
  })

  // --- Filter ---
  const filtered = useMemo(() => {
    const data = labelsQ.data ?? []
    const q = filter.trim().toLowerCase()

    return q
      ? data.filter((k: any) => {
          return k.key?.toLowerCase().includes(q) || k.value?.toLowerCase().includes(q)
        })
      : data
  }, [filter, labelsQ.data])

  if (labelsQ.isLoading) return <div className="p-6">Loading labels…</div>
  if (labelsQ.error) return <div className="p-6 text-red-500">Error loading labels.</div>

  return (
    <div className="space-y-4 p-6">
      <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
        <h1 className="mb-4 text-2xl font-bold">Labels</h1>

        <div className="flex flex-wrap items-center gap-2">
          <div className="relative">
            <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
            <Input
              value={filter}
              onChange={(e) => setFilter(e.target.value)}
              placeholder="Search labels"
              className="w-64 pl-8"
            />
          </div>

          <Dialog open={createOpen} onOpenChange={setCreateOpen}>
            <DialogTrigger asChild>
              <Button onClick={() => setCreateOpen(true)}>
                <Plus className="mr-2 h-4 w-4" />
                Create Label
              </Button>
            </DialogTrigger>
            <DialogContent className="sm:max-w-lg">
              <DialogHeader>
                <DialogTitle>Create Label</DialogTitle>
              </DialogHeader>

              <Form {...createForm}>
                <form className="space-y-4" onSubmit={createForm.handleSubmit(onCreateSubmit)}>
                  <FormField
                    control={createForm.control}
                    name="key"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Key</FormLabel>
                        <FormControl>
                          <Input placeholder="environment" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="value"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Value</FormLabel>
                        <FormControl>
                          <Input placeholder="dev" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <DialogFooter className="gap-2">
                    <Button type="button" variant="outline" onClick={() => setCreateOpen(false)}>
                      Cancel
                    </Button>
                    <Button type="submit" disabled={createForm.formState.isSubmitting}>
                      {createForm.formState.isSubmitting ? "Creating…" : "Create"}
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </div>
      </div>

      <div className="bg-background overflow-hidden rounded-2xl border shadow-sm">
        <div className="overflow-x-auto">
          <Table>
            <TableHeader>
              <TableRow>
                <TableHead>Key</TableHead>
                <TableHead>Value</TableHead>
                <TableHead>Label</TableHead>
                <TableHead className="w-[180px] text-right">Actions</TableHead>
              </TableRow>
            </TableHeader>
            <TableBody>
              {filtered.map((t) => (
                <TableRow key={t.id}>
                  <TableCell>{t.key}</TableCell>
                  <TableCell>{t.value}</TableCell>
                  <TableCell>
                    <div className="flex items-center gap-2">
                      <LabelBadge t={t} />
                      <code className="text-muted-foreground text-xs">
                        {truncateMiddle(t.id!, 6)}
                      </code>
                    </div>
                  </TableCell>

                  <TableCell>
                    <div className="flex justify-end gap-2">
                      <Button variant="outline" size="sm" onClick={() => openEdit(t)}>
                        <Pencil className="mr-2 h-4 w-4" /> Edit
                      </Button>
                      <Button
                        variant="destructive"
                        size="sm"
                        onClick={() => setDeleteId(t.id!)}
                        disabled={deleteMut.isPending && deleteId === t.id}
                      >
                        {deleteMut.isPending && deleteId === t.id ? "Deleting…" : "Delete"}
                      </Button>
                    </div>
                  </TableCell>
                </TableRow>
              ))}

              {filtered.length === 0 && (
                <TableRow>
                  <TableCell colSpan={4} className="text-muted-foreground py-10 text-center">
                    <CircleSlash2 className="mx-auto mb-2 h-6 w-6 opacity-60" />
                    No labels match your search.
                  </TableCell>
                </TableRow>
              )}
            </TableBody>
          </Table>
        </div>
      </div>

      {/* Update dialog */}
      <Dialog open={updateOpen} onOpenChange={setUpdateOpen}>
        <DialogContent className="sm:max-w-lg">
          <DialogHeader>
            <DialogTitle>Edit Label</DialogTitle>
          </DialogHeader>
          <Form {...updateForm}>
            <form
              className="space-y-4"
              onSubmit={updateForm.handleSubmit((values) => {
                if (!editingId) return
                updateMut.mutate({ id: editingId, values })
              })}
            >
              <FormField
                control={updateForm.control}
                name="key"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Key</FormLabel>
                    <FormControl>
                      <Input placeholder="dedicated" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="value"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Value (optional)</FormLabel>
                    <FormControl>
                      <Input placeholder="gpu" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <DialogFooter className="gap-2">
                <Button type="button" variant="outline" onClick={() => setUpdateOpen(false)}>
                  Cancel
                </Button>
                <Button type="submit" disabled={updateMut.isPending}>
                  {updateMut.isPending ? "Saving…" : "Save changes"}
                </Button>
              </DialogFooter>
            </form>
          </Form>
        </DialogContent>
      </Dialog>

      {/* Delete confirm dialog */}
      <Dialog open={!!deleteId} onOpenChange={(open) => !open && setDeleteId(null)}>
        <DialogContent className="sm:max-w-md">
          <DialogHeader>
            <DialogTitle>Delete label</DialogTitle>
          </DialogHeader>
          <p className="text-muted-foreground text-sm">
            This action cannot be undone. Are you sure you want to delete this label?
          </p>
          <DialogFooter className="gap-2">
            <Button variant="outline" onClick={() => setDeleteId(null)}>
              Cancel
            </Button>
            <Button
              variant="destructive"
              onClick={() => deleteId && deleteMut.mutate(deleteId)}
              disabled={deleteMut.isPending}
            >
              {deleteMut.isPending ? "Deleting…" : "Delete"}
            </Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>
    </div>
  )
}
</file>

<file path="ui/src/pages/load-balancers-page.tsx">
import { useMemo, useState } from "react"
import { loadBalancersApi } from "@/api/loadbalancers"
import type { DtoLoadBalancerResponse } from "@/sdk"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { CircleSlash2, Network, Pencil, Plus, Search } from "lucide-react"
import { useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import { truncateMiddle } from "@/lib/utils"
import { Badge } from "@/components/ui/badge"
import { Button } from "@/components/ui/button"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form"
import { Input } from "@/components/ui/input"
import {
  Select,
  SelectContent,
  SelectItem,
  SelectTrigger,
  SelectValue,
} from "@/components/ui/select"
import {
  Table,
  TableBody,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table"

// --- schemas ---

const createLoadBalancerSchema = z.object({
  name: z.string().trim().min(1, "Name is required").max(120, "Max 120 chars"),
  kind: z.enum(["glueops", "public"]).default("public"),
  public_ip_address: z
    .string()
    .trim()
    .min(1, "Public IP/hostname is required")
    .max(255, "Max 255 chars"),
  private_ip_address: z
    .string()
    .trim()
    .min(1, "Private IP/hostname is required")
    .max(255, "Max 255 chars"),
})
type CreateLoadBalancerInput = z.input<typeof createLoadBalancerSchema>

const updateLoadBalancerSchema = createLoadBalancerSchema.partial()
type UpdateLoadBalancerValues = z.infer<typeof updateLoadBalancerSchema>

// --- badge ---

function LoadBalancerBadge({
  lb,
}: {
  lb: Pick<DtoLoadBalancerResponse, "name" | "kind" | "public_ip_address" | "private_ip_address">
}) {
  return (
    <Badge variant="secondary" className="font-mono text-xs">
      <Network className="mr-1 h-3 w-3" />
      {lb.name} · {lb.kind} · {lb.public_ip_address} → {lb.private_ip_address}
    </Badge>
  )
}

export const LoadBalancersPage = () => {
  const [filter, setFilter] = useState<string>("")
  const [createOpen, setCreateOpen] = useState<boolean>(false)
  const [updateOpen, setUpdateOpen] = useState<boolean>(false)
  const [deleteId, setDeleteId] = useState<string | null>(null)
  const [editingId, setEditingId] = useState<string | null>(null)

  const qc = useQueryClient()

  const lbsQ = useQuery({
    queryKey: ["loadBalancers"],
    queryFn: () => loadBalancersApi.listLoadBalancers(),
  })

  // --- Create ---

  const createForm = useForm<CreateLoadBalancerInput>({
    resolver: zodResolver(createLoadBalancerSchema),
    defaultValues: {
      name: "",
      kind: "public",
      public_ip_address: "",
      private_ip_address: "",
    },
  })

  const createMut = useMutation({
    mutationFn: (values: CreateLoadBalancerInput) => loadBalancersApi.createLoadBalancer(values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["loadBalancers"] })
      createForm.reset()
      setCreateOpen(false)
      toast.success("Load balancer created successfully.")
    },
    onError: (err: any) => {
      toast.error(err?.message ?? "There was an error while creating the load balancer")
    },
  })

  const onCreateSubmit = (values: CreateLoadBalancerInput) => {
    createMut.mutate(values)
  }

  // --- Update ---

  const updateForm = useForm<UpdateLoadBalancerValues>({
    resolver: zodResolver(updateLoadBalancerSchema),
    defaultValues: {},
  })

  const updateMut = useMutation({
    mutationFn: ({ id, values }: { id: string; values: UpdateLoadBalancerValues }) =>
      loadBalancersApi.updateLoadBalancer(id, values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["loadBalancers"] })
      updateForm.reset()
      setUpdateOpen(false)
      toast.success("Load balancer updated successfully.")
    },
    onError: (err: any) => {
      toast.error(err?.message ?? "There was an error while updating the load balancer")
    },
  })

  const openEdit = (lb: DtoLoadBalancerResponse) => {
    setEditingId(lb.id!)
    updateForm.reset({
      name: lb.name ?? "",
      kind: (lb.kind as "public" | "glueops") ?? "public",
      public_ip_address: lb.public_ip_address ?? "",
      private_ip_address: lb.private_ip_address ?? "",
    })
    setUpdateOpen(true)
  }

  // --- Delete ---

  const deleteMut = useMutation({
    mutationFn: (id: string) => loadBalancersApi.deleteLoadBalancer(id),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["loadBalancers"] })
      setDeleteId(null)
      toast.success("Load balancer deleted successfully.")
    },
    onError: (err: any) => {
      toast.error(err?.message ?? "There was an error while deleting the load balancer")
    },
  })

  // --- Filter ---

  const filtered = useMemo(() => {
    const data = lbsQ.data ?? []
    const q = filter.trim().toLowerCase()

    return q
      ? data.filter((lb: any) => {
          return (
            lb.name?.toLowerCase().includes(q) ||
            lb.kind?.toLowerCase().includes(q) ||
            lb.public_ip_address?.toLowerCase().includes(q) ||
            lb.private_ip_address?.toLowerCase().includes(q)
          )
        })
      : data
  }, [filter, lbsQ.data])

  if (lbsQ.isLoading) return <div className="p-6">Loading load balancers…</div>
  if (lbsQ.error) return <div className="p-6 text-red-500">Error loading load balancers.</div>

  return (
    <div className="space-y-4 p-6">
      <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
        <h1 className="mb-4 text-2xl font-bold">Load Balancers</h1>

        <div className="flex flex-wrap items-center gap-2">
          <div className="relative">
            <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
            <Input
              value={filter}
              onChange={(e) => setFilter(e.target.value)}
              placeholder="Search load balancers"
              className="w-64 pl-8"
            />
          </div>

          <Dialog open={createOpen} onOpenChange={setCreateOpen}>
            <DialogTrigger asChild>
              <Button onClick={() => setCreateOpen(true)}>
                <Plus className="mr-2 h-4 w-4" />
                Create Load Balancer
              </Button>
            </DialogTrigger>
            <DialogContent className="sm:max-w-lg">
              <DialogHeader>
                <DialogTitle>Create Load Balancer</DialogTitle>
              </DialogHeader>

              <Form {...createForm}>
                <form className="space-y-4" onSubmit={createForm.handleSubmit(onCreateSubmit)}>
                  <FormField
                    control={createForm.control}
                    name="name"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Name</FormLabel>
                        <FormControl>
                          <Input placeholder="apps-lb-01" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="kind"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Kind</FormLabel>
                        <FormControl>
                          <Select onValueChange={field.onChange} value={field.value ?? "public"}>
                            <SelectTrigger>
                              <SelectValue placeholder="Select kind" />
                            </SelectTrigger>
                            <SelectContent>
                              <SelectItem value="public">Public</SelectItem>
                              <SelectItem value="glueops">GlueOps</SelectItem>
                            </SelectContent>
                          </Select>
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="public_ip_address"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Public IP</FormLabel>
                        <FormControl>
                          <Input placeholder="1.2.3.4" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="private_ip_address"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Private IP</FormLabel>
                        <FormControl>
                          <Input placeholder="10.0.30.10" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <DialogFooter className="gap-2">
                    <Button type="button" variant="outline" onClick={() => setCreateOpen(false)}>
                      Cancel
                    </Button>
                    <Button type="submit" disabled={createMut.isPending}>
                      {createMut.isPending ? "Creating…" : "Create"}
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </div>
      </div>

      <div className="bg-background overflow-hidden rounded-2xl border shadow-sm">
        <div className="overflow-x-auto">
          <Table>
            <TableHeader>
              <TableRow>
                <TableHead>Name</TableHead>
                <TableHead>Kind</TableHead>
                <TableHead>Public IP / Hostname</TableHead>
                <TableHead>Private IP / Hostname</TableHead>
                <TableHead>Summary</TableHead>
                <TableHead className="w-[220px] text-right">Actions</TableHead>
              </TableRow>
            </TableHeader>
            <TableBody>
              {filtered.map((lb: DtoLoadBalancerResponse) => (
                <TableRow key={lb.id}>
                  <TableCell>{lb.name}</TableCell>
                  <TableCell>{lb.kind}</TableCell>
                  <TableCell>{lb.public_ip_address}</TableCell>
                  <TableCell>{lb.private_ip_address}</TableCell>
                  <TableCell>
                    <div className="flex items-center gap-2">
                      <LoadBalancerBadge lb={lb} />
                      {lb.id && (
                        <code className="text-muted-foreground text-xs">
                          {truncateMiddle(lb.id, 6)}
                        </code>
                      )}
                    </div>
                  </TableCell>
                  <TableCell>
                    <div className="flex justify-end gap-2">
                      <Button variant="outline" size="sm" onClick={() => openEdit(lb)}>
                        <Pencil className="mr-2 h-4 w-4" /> Edit
                      </Button>
                      <Button
                        variant="destructive"
                        size="sm"
                        onClick={() => setDeleteId(lb.id!)}
                        disabled={deleteMut.isPending && deleteId === lb.id}
                      >
                        {deleteMut.isPending && deleteId === lb.id ? "Deleting…" : "Delete"}
                      </Button>
                    </div>
                  </TableCell>
                </TableRow>
              ))}

              {filtered.length === 0 && (
                <TableRow>
                  <TableCell colSpan={6} className="text-muted-foreground py-10 text-center">
                    <CircleSlash2 className="mx-auto mb-2 h-6 w-6 opacity-60" />
                    No load balancers match your search.
                  </TableCell>
                </TableRow>
              )}
            </TableBody>
          </Table>
        </div>
      </div>

      {/* Update dialog */}
      <Dialog open={updateOpen} onOpenChange={setUpdateOpen}>
        <DialogContent className="sm:max-w-lg">
          <DialogHeader>
            <DialogTitle>Edit Load Balancer</DialogTitle>
          </DialogHeader>
          <Form {...updateForm}>
            <form
              className="space-y-4"
              onSubmit={updateForm.handleSubmit((values) => {
                if (!editingId) return
                updateMut.mutate({ id: editingId, values })
              })}
            >
              <FormField
                control={updateForm.control}
                name="name"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Name</FormLabel>
                    <FormControl>
                      <Input placeholder="apps-lb-01" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="kind"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Kind</FormLabel>
                    <FormControl>
                      <Select onValueChange={field.onChange} value={field.value ?? "public"}>
                        <SelectTrigger>
                          <SelectValue placeholder="Select kind" />
                        </SelectTrigger>
                        <SelectContent>
                          <SelectItem value="public">Public</SelectItem>
                          <SelectItem value="glueops">GlueOps</SelectItem>
                        </SelectContent>
                      </Select>
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="public_ip_address"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Public IP / Hostname</FormLabel>
                    <FormControl>
                      <Input placeholder="1.2.3.4 or apps.example.com" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="private_ip_address"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Private IP / Hostname</FormLabel>
                    <FormControl>
                      <Input placeholder="10.0.30.10" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <DialogFooter className="gap-2">
                <Button type="button" variant="outline" onClick={() => setUpdateOpen(false)}>
                  Cancel
                </Button>
                <Button type="submit" disabled={updateMut.isPending}>
                  {updateMut.isPending ? "Saving…" : "Save changes"}
                </Button>
              </DialogFooter>
            </form>
          </Form>
        </DialogContent>
      </Dialog>

      {/* Delete confirm dialog */}
      <Dialog open={!!deleteId} onOpenChange={(open) => !open && setDeleteId(null)}>
        <DialogContent className="sm:max-w-md">
          <DialogHeader>
            <DialogTitle>Delete load balancer</DialogTitle>
          </DialogHeader>
          <p className="text-muted-foreground text-sm">
            This action cannot be undone. Are you sure you want to delete this load balancer?
          </p>
          <DialogFooter className="gap-2">
            <Button variant="outline" onClick={() => setDeleteId(null)}>
              Cancel
            </Button>
            <Button
              variant="destructive"
              onClick={() => deleteId && deleteMut.mutate(deleteId)}
              disabled={deleteMut.isPending}
            >
              {deleteMut.isPending ? "Deleting…" : "Delete"}
            </Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>
    </div>
  )
}
</file>

<file path="ui/src/pages/login.tsx">
import { useEffect, useMemo } from "react"
import { authStore, type TokenPair } from "@/auth/store.ts"
import { API_BASE } from "@/sdkClient.ts"
import { useLocation, useNavigate } from "react-router-dom"

import { cn } from "@/lib/utils.ts"
import { Button } from "@/components/ui/button.tsx"
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card.tsx"

function openPopup(url: string, name = "gsot-auth", w = 520, h = 640) {
  const y = window.top!.outerHeight / 2 + window.top!.screenY - h / 2
  const x = window.top!.outerWidth / 2 + window.top!.screenX - w / 2
  return window.open(
    url,
    name,
    `toolbar=no,location=no,status=no,menubar=no,scrollbars=yes,resizable=yes,width=${w},height=${h},top=${y},left=${x}`
  )
}

async function startAuth(provider: "google" | "github") {
  const params = new URLSearchParams({
    mode: "spa",
    origin: window.location.origin,
  })
  const res = await fetch(`${API_BASE}/auth/${provider}/start?` + params, {
    method: "POST",
  })
  if (!res.ok) throw new Error("Failed to start auth")
  const data = await res.json()
  return data.auth_url as string
}

export const Login = () => {
  const navigate = useNavigate()
  const loc = useLocation()

  const to = useMemo(() => {
    const p = new URLSearchParams(loc.search).get("to") || "/me"
    try {
      // prevent absolute URLs & open redirects
      const url = new URL(p, window.location.origin)
      return url.origin === window.location.origin ? url.pathname + url.search : "/me"
    } catch {
      return "/me"
    }
  }, [loc.search])

  useEffect(() => {
    if (authStore.get()?.access_token) {
      navigate(to, { replace: true })
    }
  }, [navigate, to])

  useEffect(() => {
    const onMsg = (ev: MessageEvent) => {
      const okType = typeof ev.data === "object" && ev.data?.type === "autoglue:auth"
      if (!okType) return
      const tokens: TokenPair = ev.data.payload
      authStore.set(tokens)
      navigate(to, { replace: true })
    }
    window.addEventListener("message", onMsg)
    return () => window.removeEventListener("message", onMsg)
  }, [navigate, to])

  const login = async (provider: "google" | "github") => {
    const url = await startAuth(provider)
    const win = openPopup(url)
    if (!win) alert("Please allow popups to sign in.")
  }

  return (
    <div className="mx-auto flex items-center justify-center p-4">
      <Card className="w-full max-w-md">
        <CardHeader>
          <CardTitle className="text-lg md:text-xl">Sign In</CardTitle>
          <CardDescription className="text-xs md:text-sm">
            Continue with a provider below to access your account.
          </CardDescription>
        </CardHeader>

        <CardContent>
          <div className="grid gap-4">
            <div className={cn("flex w-full items-center gap-2", "flex-col justify-between")}>
              <Button variant="outline" className="w-full gap-2" onClick={() => login("google")}>
                <svg
                  xmlns="http://www.w3.org/2000/svg"
                  width="0.98em"
                  height="1em"
                  viewBox="0 0 256 262"
                  aria-hidden="true"
                  focusable="false"
                >
                  <path
                    fill="#4285F4"
                    d="M255.878 133.451c0-10.734-.871-18.567-2.756-26.69H130.55v48.448h71.947c-1.45 12.04-9.283 30.172-26.69 42.356l-.244 1.622l38.755 30.023l2.685.268c24.659-22.774 38.875-56.282 38.875-96.027"
                  ></path>
                  <path
                    fill="#34A853"
                    d="M130.55 261.1c35.248 0 64.839-11.605 86.453-31.622l-41.196-31.913c-11.024 7.688-25.82 13.055-45.257 13.055c-34.523 0-63.824-22.773-74.269-54.25l-1.531.13l-40.298 31.187l-.527 1.465C35.393 231.798 79.49 261.1 130.55 261.1"
                  ></path>
                  <path
                    fill="#FBBC05"
                    d="M56.281 156.37c-2.756-8.123-4.351-16.827-4.351-25.82c0-8.994 1.595-17.697 4.206-25.82l-.073-1.73L15.26 71.312l-1.335.635C5.077 89.644 0 109.517 0 130.55s5.077 40.905 13.925 58.602z"
                  ></path>
                  <path
                    fill="#EB4335"
                    d="M130.55 50.479c24.514 0 41.05 10.589 50.479 19.438l36.844-35.974C195.245 12.91 165.798 0 130.55 0C79.49 0 35.393 29.301 13.925 71.947l42.211 32.783c10.59-31.477 39.891-54.251 74.414-54.251"
                  ></path>
                </svg>
                Sign in with Google
              </Button>
            </div>
          </div>
        </CardContent>
      </Card>
    </div>
  )
}
</file>

<file path="ui/src/pages/node-pools-page.tsx">
import { useEffect, useMemo, useState } from "react"
import { annotationsApi } from "@/api/annotations"
import { labelsApi } from "@/api/labels"
import { canAttachToPool, nodePoolsApi } from "@/api/node_pools"
import { serversApi } from "@/api/servers"
import { taintsApi } from "@/api/taints"
import type { DtoNodePoolResponse } from "@/sdk"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { Ellipsis, LinkIcon, Pencil, Plus, Search, ServerIcon, Trash2 } from "lucide-react"
import { useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import { Badge } from "@/components/ui/badge"
import { Button } from "@/components/ui/button"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog"
import {
  DropdownMenu,
  DropdownMenuContent,
  DropdownMenuItem,
  DropdownMenuTrigger,
} from "@/components/ui/dropdown-menu"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form"
import { Input } from "@/components/ui/input"
import {
  Select,
  SelectContent,
  SelectItem,
  SelectTrigger,
  SelectValue,
} from "@/components/ui/select"
import {
  Table,
  TableBody,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table"

// ---------------------------------------------
// Helpers & shared UI
// ---------------------------------------------

const ROLE_OPTIONS = ["master", "worker"] as const
type Role = (typeof ROLE_OPTIONS)[number]

function StatusBadge({ status }: { status?: string }) {
  const v =
    status === "ready"
      ? "default"
      : status === "provisioning"
        ? "secondary"
        : status === "failed"
          ? "destructive"
          : "outline"
  return (
    <Badge variant={v as any} className="capitalize">
      {status || "unknown"}
    </Badge>
  )
}

// ---------------------------------------------
// Reusable manage-many dialog
// ---------------------------------------------

type AssocItem = {
  id: string
  // common searchable/display fields
  name?: string
  key?: string
  value?: string
  effect?: string
  role?: string
  status?: string
  hostname?: string
  private_ip_address?: string
  public_ip_address?: string
}

function fuzzyIncludes(hay: string | undefined, q: string) {
  return (hay ?? "").toLowerCase().includes(q)
}

function ManageManyDialog(props: {
  open: boolean
  title: string
  onOpenChange: (v: boolean) => void
  items: AssocItem[]
  initialSelectedIds: Set<string>
  onSave: (diff: { toAttach: string[]; toDetach: string[] }) => Promise<void> | void
  columns: { header: string; render: (item: AssocItem) => React.ReactNode }[]
  allowItem?: (item: AssocItem) => boolean
}) {
  const { open, title, onOpenChange, items, initialSelectedIds, onSave, columns, allowItem } = props
  const [q, setQ] = useState("")
  const [selected, setSelected] = useState<Set<string>>(new Set(initialSelectedIds))
  const [saving, setSaving] = useState(false)

  useEffect(() => {
    setSelected(new Set(initialSelectedIds))
    setQ("")
  }, [initialSelectedIds, open])

  const filtered = useMemo(() => {
    const qq = q.trim().toLowerCase()
    return items.filter((it) => {
      if (allowItem && !allowItem(it)) return false
      if (!qq) return true
      return (
        fuzzyIncludes(it.name, qq) ||
        fuzzyIncludes(it.key, qq) ||
        fuzzyIncludes(it.value, qq) ||
        fuzzyIncludes(it.effect, qq) ||
        fuzzyIncludes(it.hostname, qq) ||
        fuzzyIncludes(it.private_ip_address, qq) ||
        fuzzyIncludes(it.public_ip_address, qq) ||
        fuzzyIncludes(it.role, qq) ||
        fuzzyIncludes(it.status, qq)
      )
    })
  }, [items, q, allowItem])

  const initial = initialSelectedIds
  const changed =
    Array.from(selected).some((id) => !initial.has(id)) ||
    Array.from(initial).some((id) => !selected.has(id))

  return (
    <Dialog open={open} onOpenChange={onOpenChange}>
      <DialogContent className="sm:max-w-3xl">
        <DialogHeader>
          <DialogTitle>{title}</DialogTitle>
        </DialogHeader>

        <div className="space-y-3">
          <div className="relative">
            <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
            <Input
              value={q}
              onChange={(e) => setQ(e.target.value)}
              placeholder="Search…"
              className="pl-8"
            />
          </div>

          <div className="max-h-[50vh] overflow-auto rounded border">
            <Table>
              <TableHeader>
                <TableRow>
                  <TableHead className="w-[48px]"></TableHead>
                  {columns.map((c, i) => (
                    <TableHead key={i}>{c.header}</TableHead>
                  ))}
                </TableRow>
              </TableHeader>
              <TableBody>
                {filtered.map((it) => {
                  const id = it.id
                  const checked = selected.has(id)
                  return (
                    <TableRow key={id}>
                      <TableCell className="text-center align-middle">
                        <input
                          type="checkbox"
                          className="h-4 w-4"
                          checked={checked}
                          onChange={(e) => {
                            const next = new Set(selected)
                            if (e.target.checked) next.add(id)
                            else next.delete(id)
                            setSelected(next)
                          }}
                        />
                      </TableCell>
                      {columns.map((c, i) => (
                        <TableCell key={i}>{c.render(it)}</TableCell>
                      ))}
                    </TableRow>
                  )
                })}
                {filtered.length === 0 && (
                  <TableRow>
                    <TableCell
                      colSpan={1 + columns.length}
                      className="text-muted-foreground py-8 text-center"
                    >
                      No items found.
                    </TableCell>
                  </TableRow>
                )}
              </TableBody>
            </Table>
          </div>

          <div className="text-muted-foreground text-sm">
            Selected: <span className="text-foreground font-medium">{selected.size}</span>
          </div>
        </div>

        <DialogFooter className="gap-2">
          <Button
            type="button"
            variant="outline"
            onClick={() => onOpenChange(false)}
            disabled={saving}
          >
            Close
          </Button>
          <Button
            onClick={async () => {
              const toAttach: string[] = []
              const toDetach: string[] = []
              for (const id of selected) if (!initial.has(id)) toAttach.push(id)
              for (const id of initial) if (!selected.has(id)) toDetach.push(id)
              try {
                setSaving(true)
                await onSave({ toAttach, toDetach })
                onOpenChange(false)
              } finally {
                setSaving(false)
              }
            }}
            disabled={saving || !changed}
          >
            {saving ? "Saving…" : "Save changes"}
          </Button>
        </DialogFooter>
      </DialogContent>
    </Dialog>
  )
}

// ---------------------------------------------
// Page
// ---------------------------------------------

const createNodePoolSchema = z.object({
  name: z.string().trim().min(1, "Name is required").max(120, "Max 120 chars"),
  role: z.enum(ROLE_OPTIONS),
})
type CreateNodePoolValues = z.infer<typeof createNodePoolSchema>

const updateNodePoolSchema = createNodePoolSchema.partial()
type UpdateNodePoolValues = z.infer<typeof updateNodePoolSchema>

export function NodePoolsPage() {
  const [filter, setFilter] = useState("")
  const [createOpen, setCreateOpen] = useState(false)
  const [updateOpen, setUpdateOpen] = useState(false)
  const [deleteOpen, setDeleteOpen] = useState(false)
  const [editing, setEditing] = useState<DtoNodePoolResponse | null>(null)
  const [deleting, setDeleting] = useState<DtoNodePoolResponse | null>(null)

  // Manage Servers dialog state
  const [manageOpen, setManageOpen] = useState(false)
  const [managePool, setManagePool] = useState<DtoNodePoolResponse | null>(null)
  const [selected, setSelected] = useState<Set<string>>(new Set())
  const [initialSelected, setInitialSelected] = useState<Set<string>>(new Set())
  const [serverFilter, setServerFilter] = useState("")

  // Manage Labels / Annotations / Taints dialog state
  const [manageLabelsOpen, setManageLabelsOpen] = useState(false)
  const [manageAnnotationsOpen, setManageAnnotationsOpen] = useState(false)
  const [manageTaintsOpen, setManageTaintsOpen] = useState(false)
  const [manageLATPool, setManageLATPool] = useState<DtoNodePoolResponse | null>(null)

  const [labelsInitial, setLabelsInitial] = useState<Set<string>>(new Set())
  const [annotationsInitial, setAnnotationsInitial] = useState<Set<string>>(new Set())
  const [taintsInitial, setTaintsInitial] = useState<Set<string>>(new Set())

  const qc = useQueryClient()

  // Queries
  const nodePoolQ = useQuery({
    queryKey: ["node-pools"],
    queryFn: () => nodePoolsApi.listNodePools(),
  })

  const serverQ = useQuery({
    queryKey: ["servers"],
    queryFn: () => serversApi.listServers(),
  })

  const annotationQ = useQuery({
    queryKey: ["annotations"],
    queryFn: () => annotationsApi.listAnnotations(),
  })

  const labelQ = useQuery({
    queryKey: ["labels"],
    queryFn: () => labelsApi.listLabels(),
  })

  const taintQ = useQuery({
    queryKey: ["taints"],
    queryFn: () => taintsApi.listTaints(),
  })

  // --- Create
  const createForm = useForm<CreateNodePoolValues>({
    resolver: zodResolver(createNodePoolSchema),
    defaultValues: { name: "", role: "worker" },
  })

  const createMut = useMutation({
    mutationFn: (values: CreateNodePoolValues) => nodePoolsApi.createNodePool(values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["node-pools"] })
      createForm.reset({ name: "", role: "worker" })
      setCreateOpen(false)
      toast.success("Node pool created.")
    },
    onError: (err: any) => toast.error(err?.message ?? "Unable to create node pool."),
  })

  const onCreateSubmit = (values: CreateNodePoolValues) => createMut.mutate(values)

  // --- Update
  const updateForm = useForm<UpdateNodePoolValues>({
    resolver: zodResolver(updateNodePoolSchema),
    defaultValues: { name: undefined, role: undefined },
  })

  useEffect(() => {
    if (editing) {
      updateForm.reset({ name: editing.name, role: editing.role as Role })
    } else {
      updateForm.reset({ name: undefined, role: undefined })
    }
    // eslint-disable-next-line react-hooks/exhaustive-deps
  }, [editing])

  const updateMut = useMutation({
    mutationFn: async (values: UpdateNodePoolValues) => {
      if (!editing) return
      const body: UpdateNodePoolValues = {}
      if (values.name !== editing.name) body.name = values.name
      if ((values.role as string) !== editing.role) body.role = values.role
      return await nodePoolsApi.updateNodePool(editing.id as unknown as string, body)
    },
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["node-pools"] })
      setUpdateOpen(false)
      setEditing(null)
      toast.success("Node pool updated.")
    },
    onError: (err: any) => toast.error(err?.message ?? "Unable to update node pool."),
  })

  const onUpdateSubmit = (values: UpdateNodePoolValues) => updateMut.mutate(values)

  // --- Delete
  const deleteMut = useMutation({
    mutationFn: async () => {
      if (!deleting) return
      await nodePoolsApi.deleteNodePool(deleting.id as unknown as string)
    },
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["node-pools"] })
      setDeleteOpen(false)
      setDeleting(null)
      toast.success("Node pool deleted.")
    },
    onError: (err: any) => toast.error(err?.message ?? "Unable to delete node pool."),
  })

  // --- Filter table
  const filtered = useMemo(() => {
    const data = (nodePoolQ.data ?? []) as DtoNodePoolResponse[]
    const q = filter.trim().toLowerCase()
    return q
      ? data.filter(
          (p) => p.name?.toLowerCase().includes(q) || (p.role as string)?.toLowerCase().includes(q)
        )
      : data
  }, [filter, nodePoolQ.data])

  if (nodePoolQ.isLoading) return <div className="p-6">Loading node pools…</div>
  if (nodePoolQ.error)
    return (
      <div className="p-6 text-red-500">
        Error loading node pools.
        <pre className="bg-muted mt-3 rounded p-3 text-xs">
          {JSON.stringify(nodePoolQ.error, null, 2)}
        </pre>
      </div>
    )

  return (
    <div className="space-y-4 p-6">
      <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
        <h1 className="mb-4 text-2xl font-bold">Node Pools</h1>

        <div className="flex flex-wrap items-center gap-2">
          <div className="relative">
            <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
            <Input
              value={filter}
              onChange={(e) => setFilter(e.target.value)}
              placeholder="Search node pools"
              className="w-64 pl-8"
            />
          </div>

          <Dialog open={createOpen} onOpenChange={setCreateOpen}>
            <DialogTrigger asChild>
              <Button onClick={() => setCreateOpen(true)}>
                <Plus className="mr-2 h-4 w-4" />
                Create Node Pool
              </Button>
            </DialogTrigger>
            <DialogContent className="sm:max-w-lg">
              <DialogHeader>
                <DialogTitle>Create Node Pool</DialogTitle>
              </DialogHeader>

              <Form {...createForm}>
                <form className="space-y-4" onSubmit={createForm.handleSubmit(onCreateSubmit)}>
                  <FormField
                    control={createForm.control}
                    name="name"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Name</FormLabel>
                        <FormControl>
                          <Input placeholder="master-pool" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="role"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Role</FormLabel>
                        <Select
                          onValueChange={(v) =>
                            createForm.setValue("role", v as Role, {
                              shouldDirty: true,
                              shouldValidate: true,
                            })
                          }
                          value={field.value}
                        >
                          <FormControl>
                            <SelectTrigger>
                              <SelectValue placeholder="Select role" />
                            </SelectTrigger>
                          </FormControl>
                          <SelectContent>
                            <SelectItem value="master">master</SelectItem>
                            <SelectItem value="worker">worker</SelectItem>
                          </SelectContent>
                        </Select>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <DialogFooter className="gap-2">
                    <Button type="button" variant="outline" onClick={() => setCreateOpen(false)}>
                      Cancel
                    </Button>
                    <Button type="submit" disabled={createForm.formState.isSubmitting}>
                      {createForm.formState.isSubmitting ? "Creating…" : "Create"}
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </div>
      </div>

      <div className="bg-background overflow-hidden rounded-2xl border shadow-sm">
        <div className="overflow-x-auto">
          <Table>
            <TableHeader>
              <TableRow>
                <TableHead>Name</TableHead>
                <TableHead>Role</TableHead>
                <TableHead>Servers</TableHead>
                <TableHead>Annotations</TableHead>
                <TableHead>Labels</TableHead>
                <TableHead>Taints</TableHead>
                <TableHead className="w-[180px] text-right">Actions</TableHead>
              </TableRow>
            </TableHeader>
            <TableBody>
              {filtered.map((p) => {
                const serverCount = Array.isArray(p.servers) ? p.servers.length : 0
                return (
                  <TableRow key={p.id}>
                    <TableCell className="font-medium">{p.name}</TableCell>
                    <TableCell className="font-medium">{p.role}</TableCell>

                    {/* Servers cell */}
                    <TableCell>
                      <div className="flex flex-wrap items-center gap-2">
                        {(p.servers || []).slice(0, 6).map((s) => (
                          <Badge key={s.id} variant="secondary" className="gap-1">
                            <ServerIcon className="h-3 w-3" />
                            {s.hostname || s.private_ip_address}
                            <span className="ml-1">{s.role}</span>
                            {s.status && (
                              <span className="ml-1">
                                <StatusBadge status={s.status} />
                              </span>
                            )}
                          </Badge>
                        ))}
                        {serverCount === 0 && (
                          <span className="text-muted-foreground">No servers</span>
                        )}
                        {serverCount > 6 && (
                          <span className="text-muted-foreground">+{serverCount - 6} more</span>
                        )}

                        <Button
                          variant="outline"
                          size="sm"
                          onClick={() => {
                            setManagePool(p)
                            const ids = new Set((p.servers || []).map((s) => s.id as string))
                            setSelected(new Set(ids))
                            setInitialSelected(new Set(ids))
                            setServerFilter("")
                            setManageOpen(true)
                          }}
                        >
                          <LinkIcon className="mr-2 h-4 w-4" />
                          Manage Servers
                        </Button>
                      </div>
                    </TableCell>

                    {/* Annotations */}
                    <TableCell>
                      <div className="flex flex-wrap items-center gap-2">
                        {(p.annotations || []).slice(0, 6).map((a: any) => (
                          <Badge key={a.id} variant="outline" className="gap-1">
                            {a.key}:{a.value}
                          </Badge>
                        ))}
                        {(p.annotations || []).length === 0 && (
                          <span className="text-muted-foreground">No annotations</span>
                        )}
                        {(p.annotations || []).length > 6 && (
                          <span className="text-muted-foreground">
                            +{(p.annotations || []).length - 6} more
                          </span>
                        )}
                        <Button
                          variant="outline"
                          size="sm"
                          onClick={() => {
                            setManageLATPool(p)
                            setAnnotationsInitial(
                              new Set((p.annotations || []).map((x: any) => x.id as string))
                            )
                            setManageAnnotationsOpen(true)
                          }}
                        >
                          <LinkIcon className="mr-2 h-4 w-4" />
                          Manage
                        </Button>
                      </div>
                    </TableCell>

                    {/* Labels */}
                    <TableCell>
                      <div className="flex flex-wrap items-center gap-2">
                        {(p.labels || []).slice(0, 6).map((l: any) => (
                          <Badge key={l.id} variant="secondary" className="gap-1">
                            {l.key}:{l.value}
                          </Badge>
                        ))}
                        {(p.labels || []).length === 0 && (
                          <span className="text-muted-foreground">No labels</span>
                        )}
                        {(p.labels || []).length > 6 && (
                          <span className="text-muted-foreground">
                            +{(p.labels || []).length - 6} more
                          </span>
                        )}
                        <Button
                          variant="outline"
                          size="sm"
                          onClick={() => {
                            setManageLATPool(p)
                            setLabelsInitial(
                              new Set((p.labels || []).map((x: any) => x.id as string))
                            )
                            setManageLabelsOpen(true)
                          }}
                        >
                          <LinkIcon className="mr-2 h-4 w-4" />
                          Manage
                        </Button>
                      </div>
                    </TableCell>

                    {/* Taints */}
                    <TableCell>
                      <div className="flex flex-wrap items-center gap-2">
                        {(p.taints || []).slice(0, 6).map((t: any) => (
                          <Badge key={t.id} variant="outline" className="gap-1">
                            {t.key}:{t.value}
                            {t.effect ? <span className="ml-1">({t.effect})</span> : null}
                          </Badge>
                        ))}
                        {(p.taints || []).length === 0 && (
                          <span className="text-muted-foreground">No taints</span>
                        )}
                        {(p.taints || []).length > 6 && (
                          <span className="text-muted-foreground">
                            +{(p.taints || []).length - 6} more
                          </span>
                        )}
                        <Button
                          variant="outline"
                          size="sm"
                          onClick={() => {
                            setManageLATPool(p)
                            setTaintsInitial(
                              new Set((p.taints || []).map((x: any) => x.id as string))
                            )
                            setManageTaintsOpen(true)
                          }}
                        >
                          <LinkIcon className="mr-2 h-4 w-4" />
                          Manage
                        </Button>
                      </div>
                    </TableCell>

                    <TableCell className="text-right">
                      <DropdownMenu>
                        <DropdownMenuTrigger asChild>
                          <Button size="icon" variant="ghost" className="h-8 w-8">
                            <Ellipsis className="h-4 w-4" />
                          </Button>
                        </DropdownMenuTrigger>
                        <DropdownMenuContent align="end">
                          <DropdownMenuItem
                            onClick={() => {
                              setEditing(p)
                              setUpdateOpen(true)
                            }}
                          >
                            <Pencil className="mr-2 h-4 w-4" /> Edit
                          </DropdownMenuItem>
                          <DropdownMenuItem
                            className="text-red-600 focus:text-red-600"
                            onClick={() => {
                              setDeleting(p)
                              setDeleteOpen(true)
                            }}
                          >
                            <Trash2 className="mr-2 h-4 w-4" /> Delete
                          </DropdownMenuItem>
                        </DropdownMenuContent>
                      </DropdownMenu>
                    </TableCell>
                  </TableRow>
                )
              })}
              {filtered.length === 0 && (
                <TableRow>
                  <TableCell colSpan={7} className="text-muted-foreground py-10 text-center">
                    No node pools found.
                  </TableCell>
                </TableRow>
              )}
            </TableBody>
          </Table>
        </div>
      </div>

      {/* Edit dialog */}
      <Dialog open={updateOpen} onOpenChange={setUpdateOpen}>
        <DialogContent className="sm:max-w-lg">
          <DialogHeader>
            <DialogTitle>Edit Node Pool</DialogTitle>
          </DialogHeader>

          <Form {...updateForm}>
            <form className="space-y-4" onSubmit={updateForm.handleSubmit(onUpdateSubmit)}>
              <FormField
                control={updateForm.control}
                name="name"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Name</FormLabel>
                    <FormControl>
                      <Input placeholder="pool-name" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="role"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Role</FormLabel>
                    <Select
                      onValueChange={(v) =>
                        updateForm.setValue("role", v as Role, {
                          shouldDirty: true,
                          shouldValidate: true,
                        })
                      }
                      value={field.value}
                    >
                      <FormControl>
                        <SelectTrigger>
                          <SelectValue placeholder="Select role" />
                        </SelectTrigger>
                      </FormControl>
                      <SelectContent>
                        <SelectItem value="master">master</SelectItem>
                        <SelectItem value="worker">worker</SelectItem>
                      </SelectContent>
                    </Select>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <DialogFooter className="gap-2">
                <Button
                  type="button"
                  variant="outline"
                  onClick={() => {
                    setUpdateOpen(false)
                    setEditing(null)
                  }}
                >
                  Cancel
                </Button>
                <Button type="submit" disabled={updateForm.formState.isSubmitting}>
                  {updateForm.formState.isSubmitting ? "Saving…" : "Save changes"}
                </Button>
              </DialogFooter>
            </form>
          </Form>
        </DialogContent>
      </Dialog>

      {/* Delete confirm */}
      <Dialog open={deleteOpen} onOpenChange={setDeleteOpen}>
        <DialogContent className="sm:max-w-md">
          <DialogHeader>
            <DialogTitle>Delete node pool</DialogTitle>
          </DialogHeader>
          <p className="text-muted-foreground text-sm">
            This will permanently delete{" "}
            <span className="text-foreground font-medium">{deleting?.name}</span>.
          </p>
          <DialogFooter className="gap-2">
            <Button
              type="button"
              variant="outline"
              onClick={() => {
                setDeleteOpen(false)
                setDeleting(null)
              }}
            >
              Cancel
            </Button>
            <Button
              variant="destructive"
              onClick={() => deleteMut.mutate()}
              disabled={deleteMut.isPending}
            >
              {deleteMut.isPending ? "Deleting…" : "Delete"}
            </Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>

      {/* Manage Servers dialog */}
      <Dialog open={manageOpen} onOpenChange={setManageOpen}>
        <DialogContent className="sm:max-w-3xl">
          <DialogHeader>
            <DialogTitle>Manage Servers{managePool ? ` — ${managePool.name}` : ""}</DialogTitle>
          </DialogHeader>

          <div className="space-y-3">
            <div className="relative">
              <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
              <Input
                value={serverFilter}
                onChange={(e) => setServerFilter(e.target.value)}
                placeholder="Search by hostname, IP or role…"
                className="pl-8"
              />
            </div>

            <div className="max-h-[50vh] overflow-auto rounded border">
              <Table>
                <TableHeader>
                  <TableRow>
                    <TableHead className="w-[48px]"></TableHead>
                    <TableHead>Hostname</TableHead>
                    <TableHead>Private IP</TableHead>
                    <TableHead>Public IP</TableHead>
                    <TableHead>Role</TableHead>
                    <TableHead>Status</TableHead>
                  </TableRow>
                </TableHeader>
                <TableBody>
                  {(serverQ.data ?? [])
                    .filter((s: any) => {
                      if (managePool?.role && !canAttachToPool(managePool.role as string, s.role)) {
                        return false
                      }
                      const q = serverFilter.trim().toLowerCase()
                      if (!q) return true
                      return (
                        (s.hostname ?? "").toLowerCase().includes(q) ||
                        (s.private_ip_address ?? "").toLowerCase().includes(q) ||
                        (s.public_ip_address ?? "").toLowerCase().includes(q) ||
                        (s.role ?? "").toLowerCase().includes(q)
                      )
                    })
                    .map((s: any) => {
                      const id = s.id as string
                      const checked = selected.has(id)
                      return (
                        <TableRow key={id}>
                          <TableCell className="text-center align-middle">
                            <input
                              type="checkbox"
                              className="h-4 w-4"
                              checked={checked}
                              onChange={(e) => {
                                const next = new Set(selected)
                                if (e.target.checked) next.add(id)
                                else next.delete(id)
                                setSelected(next)
                              }}
                            />
                          </TableCell>
                          <TableCell className="font-medium">{s.hostname || "—"}</TableCell>
                          <TableCell>{s.private_ip_address || "—"}</TableCell>
                          <TableCell>{s.public_ip_address || "—"}</TableCell>
                          <TableCell className="capitalize">{s.role || "—"}</TableCell>
                          <TableCell>
                            <StatusBadge status={s.status} />
                          </TableCell>
                        </TableRow>
                      )
                    })}
                  {(serverQ.data ?? []).length === 0 && (
                    <TableRow>
                      <TableCell colSpan={6} className="text-muted-foreground py-8 text-center">
                        {serverQ.isLoading ? "Loading servers…" : "No servers found."}
                      </TableCell>
                    </TableRow>
                  )}
                </TableBody>
              </Table>
            </div>

            <div className="text-muted-foreground text-sm">
              Selected: <span className="text-foreground font-medium">{selected.size}</span>
            </div>
          </div>

          <DialogFooter className="gap-2">
            <Button
              type="button"
              variant="outline"
              onClick={() => {
                setManageOpen(false)
                setManagePool(null)
                setSelected(new Set())
                setInitialSelected(new Set())
                setServerFilter("")
              }}
            >
              Close
            </Button>
            <Button
              onClick={async () => {
                if (!managePool) return
                const poolId = managePool.id as unknown as string

                // Compute diff
                const toAttach: string[] = []
                const toDetach: string[] = []
                for (const id of selected) if (!initialSelected.has(id)) toAttach.push(id)
                for (const id of initialSelected) if (!selected.has(id)) toDetach.push(id)

                try {
                  if (toAttach.length > 0) {
                    await nodePoolsApi.attachNodePoolServer(poolId, { server_ids: toAttach })
                  }
                  for (const id of toDetach) {
                    await nodePoolsApi.detachNodePoolServers(poolId, id)
                  }

                  await qc.invalidateQueries({ queryKey: ["node-pools"] })
                  await qc.invalidateQueries({ queryKey: ["servers"] })

                  toast.success("Servers updated for node pool.")
                  setManageOpen(false)
                  setManagePool(null)
                  setSelected(new Set())
                  setInitialSelected(new Set())
                  setServerFilter("")
                } catch (err: any) {
                  toast.error(err?.message ?? "Failed to update servers.")
                }
              }}
              disabled={serverQ.isLoading}
            >
              Save changes
            </Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>

      {/* Manage Labels */}
      <ManageManyDialog
        open={manageLabelsOpen}
        onOpenChange={(o) => {
          setManageLabelsOpen(o)
          if (!o) setManageLATPool(null)
        }}
        title={`Manage Labels${manageLATPool ? ` — ${manageLATPool.name}` : ""}`}
        items={(labelQ.data ?? []).map((l: any) => ({
          id: l.id as string,
          key: l.key,
          value: l.value,
          name: `${l.key}:${l.value}`,
        }))}
        initialSelectedIds={labelsInitial}
        columns={[
          { header: "Key", render: (it) => <span className="font-medium">{it.key}</span> },
          { header: "Value", render: (it) => it.value ?? "—" },
        ]}
        onSave={async ({ toAttach, toDetach }) => {
          if (!manageLATPool) return
          const poolId = manageLATPool.id as unknown as string
          try {
            if (toAttach.length > 0) {
              await nodePoolsApi.attachNodePoolLabels(poolId, { label_ids: toAttach })
            }
            for (const id of toDetach) {
              await nodePoolsApi.detachNodePoolLabels(poolId, id)
            }
            await qc.invalidateQueries({ queryKey: ["node-pools"] })
            toast.success("Labels updated for node pool.")
          } catch (err: any) {
            toast.error(err?.message ?? "Failed to update labels.")
            throw err
          }
        }}
      />

      {/* Manage Annotations */}
      <ManageManyDialog
        open={manageAnnotationsOpen}
        onOpenChange={(o) => {
          setManageAnnotationsOpen(o)
          if (!o) setManageLATPool(null)
        }}
        title={`Manage Annotations${manageLATPool ? ` — ${manageLATPool.name}` : ""}`}
        items={(annotationQ.data ?? []).map((a: any) => ({
          id: a.id as string,
          key: a.key,
          value: a.value,
          name: `${a.key}:${a.value}`,
        }))}
        initialSelectedIds={annotationsInitial}
        columns={[
          { header: "Key", render: (it) => <span className="font-medium">{it.key}</span> },
          { header: "Value", render: (it) => it.value ?? "—" },
        ]}
        onSave={async ({ toAttach, toDetach }) => {
          if (!manageLATPool) return
          const poolId = manageLATPool.id as unknown as string
          try {
            if (toAttach.length > 0) {
              await nodePoolsApi.attachNodePoolAnnotations(poolId, { annotation_ids: toAttach })
            }
            for (const id of toDetach) {
              await nodePoolsApi.detachNodePoolAnnotations(poolId, id)
            }
            await qc.invalidateQueries({ queryKey: ["node-pools"] })
            toast.success("Annotations updated for node pool.")
          } catch (err: any) {
            toast.error(err?.message ?? "Failed to update annotations.")
            throw err
          }
        }}
      />

      {/* Manage Taints */}
      <ManageManyDialog
        open={manageTaintsOpen}
        onOpenChange={(o) => {
          setManageTaintsOpen(o)
          if (!o) setManageLATPool(null)
        }}
        title={`Manage Taints${manageLATPool ? ` — ${manageLATPool.name}` : ""}`}
        items={(taintQ.data ?? []).map((t: any) => ({
          id: t.id as string,
          key: t.key,
          value: t.value,
          effect: t.effect,
          name: `${t.key}:${t.value}`,
        }))}
        initialSelectedIds={taintsInitial}
        columns={[
          { header: "Key", render: (it) => <span className="font-medium">{it.key}</span> },
          { header: "Value", render: (it) => it.value ?? "—" },
          { header: "Effect", render: (it) => it.effect ?? "—" },
        ]}
        onSave={async ({ toAttach, toDetach }) => {
          if (!manageLATPool) return
          const poolId = manageLATPool.id as unknown as string
          try {
            if (toAttach.length > 0) {
              await nodePoolsApi.attachNodePoolTaints(poolId, { taint_ids: toAttach })
            }
            for (const id of toDetach) {
              await nodePoolsApi.detachNodePoolTaints(poolId, id)
            }
            await qc.invalidateQueries({ queryKey: ["node-pools"] })
            toast.success("Taints updated for node pool.")
          } catch (err: any) {
            toast.error(err?.message ?? "Failed to update taints.")
            throw err
          }
        }}
      />
    </div>
  )
}
</file>

<file path="ui/src/pages/server-page.tsx">
import { useMemo, useState } from "react"
import { serversApi } from "@/api/servers.ts"
import { sshApi } from "@/api/ssh.ts"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { formatDistanceToNow } from "date-fns"
import { Plus, Search } from "lucide-react"
import { useForm, useWatch } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import { cn } from "@/lib/utils"
import { truncateMiddle } from "@/lib/utils.ts"
import { Badge } from "@/components/ui/badge.tsx"
import { Button } from "@/components/ui/button.tsx"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog.tsx"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form.tsx"
import { Input } from "@/components/ui/input.tsx"
import {
  Select,
  SelectContent,
  SelectItem,
  SelectTrigger,
  SelectValue,
} from "@/components/ui/select.tsx"
import {
  Table,
  TableBody,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table.tsx"
import { TooltipProvider } from "@/components/ui/tooltip.tsx"

const ROLE_OPTIONS = ["master", "worker", "bastion"] as const
type Role = (typeof ROLE_OPTIONS)[number]

const STATUS = ["pending", "provisioning", "ready", "failed"] as const
type Status = (typeof STATUS)[number]

// ---------- Zod schemas ----------
// Zod v4: `.partial()` cannot be used on schemas with refinements/effects.
// createServerSchema has a refinement, so define updateServerSchema explicitly.

const createServerSchema = z
  .object({
    hostname: z.string().trim().max(60, "Max 60 chars"),
    public_ip_address: z.string().trim().optional().or(z.literal("")),
    private_ip_address: z.string().trim().min(1, "Private IP address required"),
    role: z.enum(ROLE_OPTIONS),
    ssh_key_id: z.string().uuid("Pick a valid SSH key"),
    ssh_user: z.string().trim().min(1, "SSH user is required"),
    status: z.enum(STATUS).default("pending"),
  })
  .refine(
    (v) => v.role !== "bastion" || (v.public_ip_address && v.public_ip_address.trim() !== ""),
    { message: "Public IP required for bastion", path: ["public_ip_address"] }
  )
type CreateServerInput = z.input<typeof createServerSchema>

// Patch-friendly update schema:
// - all fields optional
// - only enforce "public ip required" if role is being set to bastion in the patch
const updateServerSchema = z
  .object({
    hostname: z.string().trim().max(60, "Max 60 chars").optional(),
    public_ip_address: z.string().trim().optional().or(z.literal("")),
    private_ip_address: z.string().trim().min(1, "Private IP address required").optional(),
    role: z.enum(ROLE_OPTIONS).optional(),
    ssh_key_id: z.string().uuid("Pick a valid SSH key").optional(),
    ssh_user: z.string().trim().min(1, "SSH user is required").optional(),
    status: z.enum(STATUS).optional(),
  })
  .superRefine((v, ctx) => {
    // If updating role to bastion, require public_ip_address in the patch
    if (v.role === "bastion") {
      const pub = typeof v.public_ip_address === "string" ? v.public_ip_address.trim() : ""
      if (!pub) {
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          path: ["public_ip_address"],
          message: "Public IP required for bastion",
        })
      }
    }
  })
type UpdateServerValues = z.input<typeof updateServerSchema>

function StatusBadge({ status }: { status: Status }) {
  const v =
    status === "ready"
      ? "default"
      : status === "provisioning"
        ? "secondary"
        : status === "failed"
          ? "destructive"
          : "outline"
  return (
    <Badge variant={v as any} className="capitalize">
      {status}
    </Badge>
  )
}

// Build PATCH body: omit undefined and empty strings (so optional inputs can be cleared in UI without sending "")
function buildUpdateBody(values: UpdateServerValues) {
  const body: any = {}
  const keys: (keyof UpdateServerValues)[] = [
    "hostname",
    "public_ip_address",
    "private_ip_address",
    "role",
    "ssh_key_id",
    "ssh_user",
    "status",
  ]
  for (const k of keys) {
    const v = values[k]
    if (typeof v === "undefined") continue
    if (v === "") continue
    body[k] = v
  }
  return body
}

export const ServerPage = () => {
  const [filter, setFilter] = useState<string>("")
  const [createOpen, setCreateOpen] = useState<boolean>(false)
  const [updateOpen, setUpdateOpen] = useState<boolean>(false)
  const [deleteId, setDeleteId] = useState<string | null>(null)

  const [statusFilter, setStatusFilter] = useState<Status | "">("")
  const [roleFilter, setRoleFilter] = useState<Role | "">("")
  const [editingId, setEditingId] = useState<string | null>(null)

  const qc = useQueryClient()

  const serverQ = useQuery({
    queryKey: ["servers"],
    queryFn: () => serversApi.listServers(),
  })

  const sshQ = useQuery({
    queryKey: ["ssh_keys"],
    queryFn: () => sshApi.listSshKeys(),
  })

  // Map of ssh_key_id -> label
  const sshLabelById = useMemo(() => {
    const m = new Map<string, string>()
    for (const k of sshQ.data ?? []) {
      const name = k.name ? k.name : "Unnamed key"
      const fp = k.fingerprint ? truncateMiddle(k.fingerprint, 8) : ""
      m.set(k.id!, fp ? `${name} — ${fp}` : name)
    }
    return m
  }, [sshQ.data])

  // --- Create ---
  const createForm = useForm<CreateServerInput>({
    resolver: zodResolver(createServerSchema),
    defaultValues: {
      hostname: "",
      private_ip_address: "",
      public_ip_address: "",
      role: "worker",
      ssh_key_id: "" as unknown as string,
      ssh_user: "",
      status: "pending",
    },
    mode: "onChange",
  })

  const watchedRoleCreate = useWatch({
    control: createForm.control,
    name: "role",
  })
  const roleIsBastion = watchedRoleCreate === "bastion"

  const watchedPublicIpCreate = useWatch({
    control: createForm.control,
    name: "public_ip_address",
  })
  const pubCreate = watchedPublicIpCreate?.trim() ?? ""
  const needPubCreate = roleIsBastion && pubCreate === ""

  const createMut = useMutation({
    mutationFn: (values: CreateServerInput) => serversApi.createServer(values as any),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["servers"] })
      createForm.reset()
      setCreateOpen(false)
      toast.success("Server created successfully")
    },
    onError: (err: any) => {
      toast.error(err?.message ?? "Failed to create server")
    },
  })

  // --- Update ---
  const updateForm = useForm<UpdateServerValues>({
    resolver: zodResolver(updateServerSchema),
    defaultValues: {},
    mode: "onChange",
  })

  const watchedRoleUpdate = useWatch({
    control: updateForm.control,
    name: "role",
  })

  const watchedPublicIpAddressUpdate = useWatch({
    control: updateForm.control,
    name: "public_ip_address",
  })

  const roleIsBastionU = watchedRoleUpdate === "bastion"
  const pubUpdate = watchedPublicIpAddressUpdate?.trim() ?? ""
  const needPubUpdate = roleIsBastionU && pubUpdate === ""

  const updateMut = useMutation({
    mutationFn: ({ id, values }: { id: string; values: UpdateServerValues }) =>
      serversApi.updateServer(id, buildUpdateBody(values) as any),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["servers"] })
      setUpdateOpen(false)
      setEditingId(null)
      toast.success("Server updated successfully")
    },
    onError: (err: any) => {
      toast.error(err?.message ?? "Failed to update server")
    },
  })

  // --- Delete ---
  const deleteMut = useMutation({
    mutationFn: (id: string) => serversApi.deleteServer(id),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["servers"] })
      setDeleteId(null)
      toast.success("Server deleted successfully")
    },
    onError: (err: any) => {
      toast.error(err?.message ?? "Failed to delete server")
    },
  })

  const filtered = useMemo(() => {
    const data = serverQ.data ?? []
    const q = filter.trim().toLowerCase()

    const textFiltered = q
      ? data.filter((k: any) => {
          return (
            k.hostname?.toLowerCase().includes(q) ||
            k.public_ip_address?.toLowerCase().includes(q) ||
            k.private_ip_address?.toLowerCase().includes(q) ||
            k.role?.toLowerCase().includes(q) ||
            k.ssh_user?.toLowerCase().includes(q)
          )
        })
      : data

    const roleFiltered = roleFilter
      ? textFiltered.filter((k: any) => k.role === roleFilter)
      : textFiltered

    const statusFiltered = statusFilter
      ? roleFiltered.filter((k: any) => k.status === statusFilter)
      : roleFiltered

    return statusFiltered
  }, [filter, roleFilter, statusFilter, serverQ.data])

  const onCreateSubmit = (values: CreateServerInput) => {
    createMut.mutate(values)
  }

  const openEdit = (srv: any) => {
    setEditingId(srv.id)
    updateForm.reset({
      hostname: srv.hostname ?? "",
      public_ip_address: srv.public_ip_address ?? "",
      private_ip_address: srv.private_ip_address ?? "",
      role: (srv.role as Role) ?? "worker",
      ssh_key_id: srv.ssh_key_id ?? "",
      ssh_user: srv.ssh_user ?? "",
      status: (srv.status as Status) ?? "pending",
    })
    setUpdateOpen(true)
  }

  if (sshQ.data?.length === 0)
    return <div className="p-6">Please create an SSH key for your organization first.</div>
  if (serverQ.isLoading) return <div className="p-6">Loading servers…</div>
  if (serverQ.error) return <div className="p-6 text-red-500">Error loading servers.</div>

  return (
    <TooltipProvider>
      <div className="space-y-4 p-6">
        <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
          <h1 className="mb-4 text-2xl font-bold">Servers</h1>

          <div className="flex flex-wrap items-center gap-2">
            <div className="relative">
              <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
              <Input
                value={filter}
                onChange={(e) => setFilter(e.target.value)}
                placeholder="Search hostname, Public IP, Private IP, role, user…"
                className="w-64 pl-8"
              />
            </div>

            <Select
              value={roleFilter || "all"}
              onValueChange={(v) => setRoleFilter(v === "all" ? "" : (v as Role))}
            >
              <SelectTrigger className="w-36">
                <SelectValue placeholder="Role (all)" />
              </SelectTrigger>
              <SelectContent>
                <SelectItem value="all">All roles</SelectItem>
                {ROLE_OPTIONS.map((r) => (
                  <SelectItem key={r} value={r}>
                    {r}
                  </SelectItem>
                ))}
              </SelectContent>
            </Select>

            <Select
              value={statusFilter || "all"}
              onValueChange={(v) => setStatusFilter(v === "all" ? "" : (v as Status))}
            >
              <SelectTrigger className="w-40">
                <SelectValue placeholder="Status (all)" />
              </SelectTrigger>
              <SelectContent>
                <SelectItem value="all">All statuses</SelectItem>
                {STATUS.map((s) => (
                  <SelectItem key={s} value={s}>
                    {s}
                  </SelectItem>
                ))}
              </SelectContent>
            </Select>

            <Dialog open={createOpen} onOpenChange={setCreateOpen}>
              <DialogTrigger asChild>
                <Button onClick={() => setCreateOpen(true)}>
                  <Plus className="mr-2 h-4 w-4" />
                  Create Server
                </Button>
              </DialogTrigger>
              <DialogContent className="sm:max-w-lg">
                <DialogHeader>
                  <DialogTitle>Create server</DialogTitle>
                </DialogHeader>

                <Form {...createForm}>
                  <form className="space-y-4" onSubmit={createForm.handleSubmit(onCreateSubmit)}>
                    <FormField
                      control={createForm.control}
                      name="hostname"
                      render={({ field }) => (
                        <FormItem>
                          <FormLabel>Hostname</FormLabel>
                          <FormControl>
                            <Input placeholder="worker-01" {...field} />
                          </FormControl>
                          <FormMessage />
                        </FormItem>
                      )}
                    />

                    <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
                      <FormField
                        control={createForm.control}
                        name="public_ip_address"
                        render={({ field }) => (
                          <FormItem>
                            <FormLabel className="flex items-center justify-between">
                              <span>Public IP Address</span>
                              <span
                                className={cn(
                                  "rounded-full px-2 py-0.5 text-xs",
                                  roleIsBastion
                                    ? "bg-amber-100 text-amber-900"
                                    : "bg-muted text-muted-foreground"
                                )}
                              >
                                {roleIsBastion ? "Required for bastion" : "Optional"}
                              </span>
                            </FormLabel>
                            <FormControl>
                              <Input
                                placeholder={
                                  roleIsBastion
                                    ? "Required for bastion (e.g. 34.12.56.78)"
                                    : "34.12.56.78"
                                }
                                aria-required={roleIsBastion}
                                aria-invalid={
                                  needPubCreate || !!createForm.formState.errors.public_ip_address
                                }
                                required={roleIsBastion}
                                {...field}
                                className={cn(
                                  needPubCreate &&
                                    "border-destructive focus-visible:ring-destructive"
                                )}
                              />
                            </FormControl>
                            {roleIsBastion && (
                              <div className="rounded-md border border-amber-200 bg-amber-50 p-2 text-xs text-amber-900">
                                Bastion nodes must have a{" "}
                                <span className="font-medium">Public IP</span>.
                              </div>
                            )}
                            <FormMessage />
                          </FormItem>
                        )}
                      />
                      <FormField
                        control={createForm.control}
                        name="private_ip_address"
                        render={({ field }) => (
                          <FormItem>
                            <FormLabel>Private IP Address</FormLabel>
                            <FormControl>
                              <Input placeholder="192.168.10.1" {...field} />
                            </FormControl>
                            <FormMessage />
                          </FormItem>
                        )}
                      />
                    </div>

                    <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
                      <FormField
                        control={createForm.control}
                        name="role"
                        render={({ field }) => (
                          <FormItem>
                            <FormLabel>Role</FormLabel>
                            <Select
                              onValueChange={(v) =>
                                createForm.setValue("role", v as Role, {
                                  shouldDirty: true,
                                  shouldValidate: true,
                                })
                              }
                              value={field.value}
                            >
                              <FormControl>
                                <SelectTrigger>
                                  <SelectValue placeholder="Select role" />
                                </SelectTrigger>
                              </FormControl>
                              <SelectContent>
                                <SelectItem value="master">master</SelectItem>
                                <SelectItem value="worker">worker</SelectItem>
                                <SelectItem value="bastion">
                                  bastion — requires Public IP
                                </SelectItem>
                              </SelectContent>
                            </Select>
                            <FormMessage />
                          </FormItem>
                        )}
                      />
                      <FormField
                        control={createForm.control}
                        name="ssh_user"
                        render={({ field }) => (
                          <FormItem>
                            <FormLabel>SSH user</FormLabel>
                            <FormControl>
                              <Input placeholder="ubuntu" {...field} />
                            </FormControl>
                            <FormMessage />
                          </FormItem>
                        )}
                      />
                    </div>

                    <FormField
                      control={createForm.control}
                      name="ssh_key_id"
                      render={({ field }) => (
                        <FormItem>
                          <FormLabel>SSH key</FormLabel>
                          <Select onValueChange={field.onChange} value={field.value}>
                            <FormControl>
                              <SelectTrigger>
                                <SelectValue
                                  placeholder={
                                    sshQ.data?.length ? "Select SSH key" : "No SSH keys found"
                                  }
                                />
                              </SelectTrigger>
                            </FormControl>
                            <SelectContent>
                              {sshQ.data!.map((k) => (
                                <SelectItem key={k.id} value={k.id!}>
                                  {k.name ? k.name : "Unnamed key"} —{" "}
                                  {truncateMiddle(k.fingerprint!, 8)}
                                </SelectItem>
                              ))}
                            </SelectContent>
                          </Select>
                          <FormMessage />
                        </FormItem>
                      )}
                    />
                    <FormField
                      control={createForm.control}
                      name="status"
                      render={({ field }) => (
                        <FormItem>
                          <FormLabel>Initial status</FormLabel>
                          <Select onValueChange={field.onChange} value={field.value}>
                            <FormControl>
                              <SelectTrigger>
                                <SelectValue placeholder="pending" />
                              </SelectTrigger>
                            </FormControl>
                            <SelectContent>
                              {STATUS.map((s) => (
                                <SelectItem key={s} value={s}>
                                  {s}
                                </SelectItem>
                              ))}
                            </SelectContent>
                          </Select>
                          <FormMessage />
                        </FormItem>
                      )}
                    />

                    <DialogFooter className="gap-2">
                      <Button type="button" variant="outline" onClick={() => setCreateOpen(false)}>
                        Cancel
                      </Button>
                      <Button
                        type="submit"
                        disabled={
                          createMut.isPending ||
                          createForm.formState.isSubmitting ||
                          !createForm.formState.isValid
                        }
                      >
                        {createMut.isPending ? "Creating…" : "Create"}
                      </Button>
                    </DialogFooter>
                  </form>
                </Form>
              </DialogContent>
            </Dialog>
          </div>
        </div>

        <div className="bg-background overflow-hidden rounded-2xl border shadow-sm">
          <div className="overflow-x-auto">
            <Table>
              <TableHeader>
                <TableRow>
                  <TableHead>Hostname</TableHead>
                  <TableHead>IP address</TableHead>
                  <TableHead>Role</TableHead>
                  <TableHead>SSH user</TableHead>
                  <TableHead>SSH key</TableHead>
                  <TableHead>Status</TableHead>
                  <TableHead>Created</TableHead>
                  <TableHead className="w-[220px] text-right">Actions</TableHead>
                </TableRow>
              </TableHeader>

              <TableBody>
                {filtered.length === 0 ? (
                  <TableRow>
                    <TableCell
                      colSpan={8}
                      className="text-muted-foreground py-10 text-center text-sm"
                    >
                      No servers found.
                    </TableCell>
                  </TableRow>
                ) : (
                  filtered.map((k: any) => (
                    <TableRow key={k.id}>
                      <TableCell className="font-medium">{k.hostname}</TableCell>
                      <TableCell>
                        <div className="flex flex-col">
                          <span
                            className={cn(
                              "tabular-nums",
                              !k.public_ip_address && "text-muted-foreground"
                            )}
                          >
                            {k.public_ip_address || "—"}
                          </span>
                          <span className="text-muted-foreground tabular-nums">
                            {k.private_ip_address}
                          </span>
                        </div>
                      </TableCell>
                      <TableCell className="capitalize">
                        <span
                          className={cn(
                            k.role === "bastion" &&
                              "rounded bg-amber-50 px-2 py-0.5 dark:bg-amber-900"
                          )}
                        >
                          {k.role}
                        </span>
                      </TableCell>
                      <TableCell className="tabular-nums">{k.ssh_user}</TableCell>
                      <TableCell className="truncate">
                        {sshLabelById.get(k.ssh_key_id) ?? "—"}
                      </TableCell>
                      <TableCell>
                        <StatusBadge status={(k.status ?? "pending") as Status} />
                      </TableCell>
                      <TableCell title={k.created_at}>
                        {k.created_at
                          ? `${formatDistanceToNow(new Date(k.created_at), { addSuffix: true })}`
                          : "—"}
                      </TableCell>
                      <TableCell className="text-right">
                        <div className="flex justify-end gap-2">
                          <Button variant="outline" size="sm" onClick={() => openEdit(k)}>
                            Edit
                          </Button>
                          <Button
                            variant="destructive"
                            size="sm"
                            onClick={() => setDeleteId(k.id)}
                            disabled={deleteMut.isPending && deleteId === k.id}
                          >
                            {deleteMut.isPending && deleteId === k.id ? "Deleting…" : "Delete"}
                          </Button>
                        </div>
                      </TableCell>
                    </TableRow>
                  ))
                )}
              </TableBody>
            </Table>
          </div>
        </div>
      </div>

      {/* Update dialog */}
      <Dialog open={updateOpen} onOpenChange={setUpdateOpen}>
        <DialogContent className="sm:max-w-lg">
          <DialogHeader>
            <DialogTitle>Edit server</DialogTitle>
          </DialogHeader>

          <Form {...updateForm}>
            <form
              className="space-y-4"
              onSubmit={updateForm.handleSubmit((values) => {
                if (!editingId) return
                updateMut.mutate({ id: editingId, values })
              })}
            >
              <FormField
                control={updateForm.control}
                name="hostname"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Hostname</FormLabel>
                    <FormControl>
                      <Input placeholder="worker-01" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
                <FormField
                  control={updateForm.control}
                  name="public_ip_address"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel className="flex items-center justify-between">
                        <span>Public IP Address</span>
                        <span
                          className={cn(
                            "rounded-full px-2 py-0.5 text-xs",
                            roleIsBastionU
                              ? "bg-amber-100 text-amber-900"
                              : "bg-muted text-muted-foreground"
                          )}
                        >
                          {roleIsBastionU ? "Required for bastion" : "Optional"}
                        </span>
                      </FormLabel>
                      <FormControl>
                        <Input
                          placeholder={
                            roleIsBastionU
                              ? "Required for bastion (e.g. 34.12.56.78)"
                              : "34.12.56.78"
                          }
                          aria-required={roleIsBastionU}
                          aria-invalid={
                            needPubUpdate || !!updateForm.formState.errors.public_ip_address
                          }
                          required={roleIsBastionU}
                          {...field}
                          className={cn(
                            needPubUpdate && "border-destructive focus-visible:ring-destructive"
                          )}
                        />
                      </FormControl>
                      {roleIsBastionU && (
                        <div className="rounded-md border border-amber-200 bg-amber-50 p-2 text-xs text-amber-900">
                          Bastion nodes must have a <span className="font-medium">Public IP</span>.
                        </div>
                      )}
                      <FormMessage />
                    </FormItem>
                  )}
                />
                <FormField
                  control={updateForm.control}
                  name="private_ip_address"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Private IP Address</FormLabel>
                      <FormControl>
                        <Input placeholder="192.168.10.1" {...field} />
                      </FormControl>
                      <FormMessage />
                    </FormItem>
                  )}
                />
              </div>

              <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
                <FormField
                  control={updateForm.control}
                  name="role"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>Role</FormLabel>
                      <Select
                        onValueChange={(v) =>
                          updateForm.setValue("role", v as Role, {
                            shouldDirty: true,
                            shouldValidate: true,
                          })
                        }
                        value={field.value}
                      >
                        <FormControl>
                          <SelectTrigger>
                            <SelectValue placeholder="Select role" />
                          </SelectTrigger>
                        </FormControl>
                        <SelectContent>
                          <SelectItem value="master">master</SelectItem>
                          <SelectItem value="worker">worker</SelectItem>
                          <SelectItem value="bastion">bastion — requires Public IP</SelectItem>
                        </SelectContent>
                      </Select>
                      <FormMessage />
                    </FormItem>
                  )}
                />
                <FormField
                  control={updateForm.control}
                  name="ssh_user"
                  render={({ field }) => (
                    <FormItem>
                      <FormLabel>SSH user</FormLabel>
                      <FormControl>
                        <Input placeholder="ubuntu" {...field} />
                      </FormControl>
                      <FormMessage />
                    </FormItem>
                  )}
                />
              </div>

              <FormField
                control={updateForm.control}
                name="ssh_key_id"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>SSH key</FormLabel>
                    <Select onValueChange={field.onChange} value={field.value}>
                      <FormControl>
                        <SelectTrigger>
                          <SelectValue placeholder="Select SSH key" />
                        </SelectTrigger>
                      </FormControl>
                      <SelectContent>
                        {sshQ.data!.map((k) => (
                          <SelectItem key={k.id} value={k.id!}>
                            {k.name ? k.name : "Unnamed key"} — {truncateMiddle(k.fingerprint!, 8)}
                          </SelectItem>
                        ))}
                      </SelectContent>
                    </Select>
                    <FormMessage />
                  </FormItem>
                )}
              />
              <FormField
                control={updateForm.control}
                name="status"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Status</FormLabel>
                    <Select onValueChange={field.onChange} value={field.value}>
                      <FormControl>
                        <SelectTrigger>
                          <SelectValue placeholder="pending" />
                        </SelectTrigger>
                      </FormControl>
                      <SelectContent>
                        {STATUS.map((s) => (
                          <SelectItem key={s} value={s}>
                            {s}
                          </SelectItem>
                        ))}
                      </SelectContent>
                    </Select>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <DialogFooter className="gap-2">
                <Button type="button" variant="outline" onClick={() => setUpdateOpen(false)}>
                  Cancel
                </Button>
                <Button type="submit" disabled={updateMut.isPending}>
                  {updateMut.isPending ? "Saving…" : "Save changes"}
                </Button>
              </DialogFooter>
            </form>
          </Form>
        </DialogContent>
      </Dialog>

      {/* Delete confirm dialog */}
      <Dialog open={!!deleteId} onOpenChange={(open) => !open && setDeleteId(null)}>
        <DialogContent className="sm:max-w-md">
          <DialogHeader>
            <DialogTitle>Delete server</DialogTitle>
          </DialogHeader>
          <p className="text-muted-foreground text-sm">
            This action cannot be undone. Are you sure you want to delete this server?
          </p>
          <DialogFooter className="gap-2">
            <Button variant="outline" onClick={() => setDeleteId(null)}>
              Cancel
            </Button>
            <Button
              variant="destructive"
              onClick={() => deleteId && deleteMut.mutate(deleteId)}
              disabled={deleteMut.isPending}
            >
              {deleteMut.isPending ? "Deleting…" : "Delete"}
            </Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>
    </TooltipProvider>
  )
}
</file>

<file path="ui/src/pages/ssh-page.tsx">
import { useMemo, useState } from "react"
import { sshApi } from "@/api/ssh.ts"
import type { DtoCreateSSHRequest, DtoSshRevealResponse } from "@/sdk"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { Download, Eye, Loader2, Plus, Trash2 } from "lucide-react"
import { useForm, useWatch } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import { Badge } from "@/components/ui/badge.tsx"
import { Button } from "@/components/ui/button.tsx"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog.tsx"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form.tsx"
import { Input } from "@/components/ui/input.tsx"
import {
  Select,
  SelectContent,
  SelectItem,
  SelectTrigger,
  SelectValue,
} from "@/components/ui/select.tsx"
import {
  Table,
  TableBody,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table.tsx"
import { Textarea } from "@/components/ui/textarea.tsx"
import {
  Tooltip,
  TooltipContent,
  TooltipProvider,
  TooltipTrigger,
} from "@/components/ui/tooltip.tsx"

const createKeySchema = z.object({
  name: z.string().trim().min(1, "Name is required").max(100, "Max 100 characters"),
  comment: z.string().trim().min(1, "Comment is required").max(100, "Max 100 characters"),
  bits: z.enum(["2048", "3072", "4096"]).optional(),
  type: z.enum(["rsa", "ed25519"]).optional(),
})

type CreateKeyInput = z.input<typeof createKeySchema>

function saveBlob(blob: Blob, filename: string) {
  const url = URL.createObjectURL(blob)
  const a = document.createElement("a")
  a.href = url
  a.download = filename
  document.body.appendChild(a)
  a.click()
  a.remove()
  URL.revokeObjectURL(url)
}

function copy(text: string, label = "Copied") {
  navigator.clipboard
    .writeText(text)
    .then(() => toast.success(label))
    .catch(() => toast.error("Copy failed"))
}

function getKeyType(publicKey: string) {
  return publicKey?.split(/\s+/)?.[0] ?? "ssh-key"
}

export const SshPage = () => {
  const [filter, setFilter] = useState<string>("")
  const [createOpen, setCreateOpen] = useState<boolean>(false)
  const [revealFor, setRevealFor] = useState<DtoSshRevealResponse | null>(null)
  const [deleteId, setDeleteId] = useState<string | null>(null)

  const qc = useQueryClient()

  const sshQ = useQuery({
    queryKey: ["ssh"],
    queryFn: () => sshApi.listSshKeys(),
  })

  const form = useForm<CreateKeyInput>({
    resolver: zodResolver(createKeySchema),
    defaultValues: {
      name: "",
      comment: "",
      type: "rsa",
      bits: "4096",
    },
  })

  const watchedType = useWatch({
    control: form.control,
    name: "type",
  })

  const createMutation = useMutation({
    mutationFn: async (values: CreateKeyInput) => {
      const payload: DtoCreateSSHRequest = {
        name: values.name,
        comment: values.comment,
        // Only send bits for RSA
        bits: values.type === "rsa" && values.bits ? Number(values.bits) : undefined,
        // Only send type if present
        type: values.type,
      }
      return await sshApi.createSshKey(payload)
    },
    onSuccess: () => {
      void qc.invalidateQueries({ queryKey: ["ssh"] })
      setCreateOpen(false)
      form.reset({ name: "", comment: "", type: "rsa", bits: "4096" })
      toast.success("SSH Key created")
    },
    onError: (e: any) => toast.error(e?.message ?? "SSH Key creation failed"),
  })

  const revealMutation = useMutation({
    mutationFn: (id: string) => sshApi.revealSshKeyById(id),
    onSuccess: (data) => setRevealFor(data),
    onError: (e: any) => toast.error(e?.message ?? "Failed to reveal key"),
  })

  const deleteMutation = useMutation({
    mutationFn: (id: string) => sshApi.deleteSshKey(id),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["ssh"] })
      setDeleteId(null)
      toast.success("SSH Key deleted")
    },
    onError: (e: any) => toast.error(e?.message ?? "Delete failed"),
  })

  const filtered = useMemo(() => {
    const q = filter.trim().toLowerCase()
    if (!q) return sshQ.data ?? []
    return (sshQ.data ?? []).filter((k) => {
      return (
        k.name?.toLowerCase().includes(q) ||
        k.fingerprint?.toLowerCase().includes(q) ||
        k.public_key?.toLowerCase().includes(q)
      )
    })
  }, [filter, sshQ.data])

  if (sshQ.isLoading) return <div className="p-6">Loading SSH Keys…</div>
  if (sshQ.error) return <div className="p-6 text-red-500">Error Loading SSH Keys</div>

  return (
    <TooltipProvider>
      <div className="space-y-4">
        <div className="flex items-center justify-between gap-3">
          <h1 className="text-2xl font-bold">SSH Keys</h1>

          <div className="w-full max-w-sm">
            <Input
              value={filter}
              onChange={(e) => setFilter(e.target.value)}
              placeholder="Search by name, fingerprint or key"
            />
          </div>

          <Dialog open={createOpen} onOpenChange={setCreateOpen}>
            <DialogTrigger asChild>
              <Button onClick={() => setCreateOpen(true)}>
                <Plus className="mr-2 h-4 w-4" />
                Create New Keypair
              </Button>
            </DialogTrigger>
            <DialogContent className="sm:max-w-lg">
              <DialogHeader>
                <DialogTitle>Create SSH Keypair</DialogTitle>
              </DialogHeader>
              <Form {...form}>
                <form
                  onSubmit={form.handleSubmit((values) => createMutation.mutate(values))}
                  className="space-y-4"
                >
                  <FormField
                    control={form.control}
                    name="name"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Name</FormLabel>
                        <FormControl>
                          <Input placeholder="e.g., CI deploy key" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={form.control}
                    name="comment"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Comment</FormLabel>
                        <FormControl>
                          <Input placeholder="e.g., deploy@autoglue" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={form.control}
                    name="type"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Type</FormLabel>
                        <FormControl>
                          <Select
                            value={field.value}
                            onValueChange={(v) => {
                              field.onChange(v)
                              if (v === "ed25519") {
                                // bits not applicable
                                form.setValue("bits", undefined)
                              } else {
                                form.setValue("bits", "4096")
                              }
                            }}
                          >
                            <SelectTrigger className="w-[180px]">
                              <SelectValue placeholder="Select a ssh key type" />
                            </SelectTrigger>
                            <SelectContent>
                              <SelectItem value="rsa">RSA</SelectItem>
                              <SelectItem value="ed25519">ED25519</SelectItem>
                            </SelectContent>
                          </Select>
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={form.control}
                    name="bits"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Key size</FormLabel>
                        <FormControl>
                          <Select
                            value={field.value}
                            disabled={watchedType === "ed25519"}
                            onValueChange={field.onChange}
                          >
                            <SelectTrigger className="w-[180px]">
                              <SelectValue placeholder="RSA only" />
                            </SelectTrigger>
                            <SelectContent>
                              <SelectItem value="2048">2048</SelectItem>
                              <SelectItem value="3072">3072</SelectItem>
                              <SelectItem value="4096">4096</SelectItem>
                            </SelectContent>
                          </Select>
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <DialogFooter className="gap-2">
                    <Button
                      type="button"
                      variant="outline"
                      onClick={() => setCreateOpen(false)}
                      disabled={createMutation.isPending}
                    >
                      Cancel
                    </Button>
                    <Button type="submit" disabled={createMutation.isPending}>
                      {createMutation.isPending ? (
                        <>
                          <Loader2 className="mr-2 h-4 w-4 animate-spin" />
                          Creating…
                        </>
                      ) : (
                        "Create"
                      )}
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </div>

        <div className="bg-background overflow-hidden rounded-2xl border shadow-sm">
          <div className="overflow-x-auto">
            <Table>
              <TableHeader>
                <TableRow>
                  <TableHead>Name</TableHead>
                  <TableHead>Public Key</TableHead>
                  <TableHead>Fingerprint</TableHead>
                  <TableHead>Created</TableHead>
                  <TableHead className="w-[160px] text-right">Actions</TableHead>
                </TableRow>
              </TableHeader>
              <TableBody>
                {filtered.map((k) => {
                  const keyType = getKeyType(k.public_key!)
                  return (
                    <TableRow key={k.id}>
                      <TableCell className="font-medium">{k.name || "—"}</TableCell>
                      <TableCell>
                        <Tooltip>
                          <TooltipTrigger asChild>
                            <Badge variant="secondary" className="whitespace-nowrap">
                              {keyType}
                            </Badge>
                          </TooltipTrigger>
                          <TooltipContent className="max-w-[70vw]">
                            <div className="max-w-full">
                              <p className="font-mono text-xs break-all">{k.public_key}</p>
                            </div>
                          </TooltipContent>
                        </Tooltip>
                      </TableCell>
                      <TableCell className="font-mono text-xs">{k.fingerprint}</TableCell>
                      <TableCell>
                        {k.created_at
                          ? new Date(k.created_at).toLocaleString(undefined, {
                              year: "numeric",
                              month: "short",
                              day: "2-digit",
                              hour: "2-digit",
                              minute: "2-digit",
                            })
                          : "—"}
                      </TableCell>
                      <TableCell className="space-x-2 text-right">
                        <Button
                          size="sm"
                          variant="outline"
                          onClick={() => copy(k.public_key ?? "", "Public key copied")}
                        >
                          Copy Pub
                        </Button>
                        <Button
                          size="sm"
                          variant="outline"
                          onClick={() => copy(k.fingerprint ?? "", "Fingerprint copied")}
                        >
                          Copy FP
                        </Button>
                        <Button
                          size="sm"
                          variant="outline"
                          onClick={() => revealMutation.mutate(k.id!)}
                        >
                          <Eye className="mr-1 h-4 w-4" />
                          Reveal
                        </Button>
                        <Button
                          size="sm"
                          variant="outline"
                          onClick={async () => {
                            try {
                              const { filename, blob } = await sshApi.downloadBlob(k.id!, "both")
                              saveBlob(blob, filename)
                            } catch (e: any) {
                              toast.error(e?.message ?? "Download failed")
                            }
                          }}
                        >
                          <Download className="mr-1 h-4 w-4" />
                          Download
                        </Button>

                        <Button size="sm" variant="destructive" onClick={() => setDeleteId(k.id!)}>
                          <Trash2 className="mr-1 h-4 w-4" />
                          Delete
                        </Button>
                      </TableCell>
                    </TableRow>
                  )
                })}
                {filtered.length === 0 && (
                  <TableRow>
                    <TableCell colSpan={5} className="text-muted-foreground py-10 text-center">
                      No SSH Keys
                    </TableCell>
                  </TableRow>
                )}
              </TableBody>
            </Table>
          </div>
        </div>

        {/* Reveal modal */}
        <Dialog open={!!revealFor} onOpenChange={(o) => !o && setRevealFor(null)}>
          <DialogContent className="sm:max-w-2xl">
            <DialogHeader>
              <DialogTitle>Private Key (read-only)</DialogTitle>
            </DialogHeader>
            <div className="space-y-3">
              <div className="text-sm">
                <div className="font-medium">{revealFor?.name ?? "SSH key"}</div>
                <div className="text-muted-foreground font-mono text-xs">
                  {revealFor?.fingerprint}
                </div>
                <Textarea
                  readOnly
                  className="h-64 w-full rounded-md border p-3 font-mono text-xs"
                  value={revealFor?.private_key ?? ""}
                />
                <div className="flex justify-end">
                  <Button
                    onClick={() =>
                      revealFor?.private_key && copy(revealFor.private_key, "Private key copied")
                    }
                  >
                    Copy
                  </Button>
                </div>
              </div>
            </div>
          </DialogContent>
        </Dialog>

        {/* Delete confirm */}
        <Dialog open={!!deleteId} onOpenChange={(o) => !o && setDeleteId(null)}>
          <DialogContent className="sm:max-w-md">
            <DialogHeader>
              <DialogTitle>Delete SSH Key</DialogTitle>
            </DialogHeader>
            <p className="text-muted-foreground text-sm">
              This will permanently delete the keypair. This action cannot be undone.
            </p>
            <DialogFooter className="gap-2">
              <Button variant="outline" onClick={() => setDeleteId(null)}>
                Cancel
              </Button>
              <Button
                variant="destructive"
                onClick={() => deleteId && deleteMutation.mutate(deleteId)}
                disabled={deleteMutation.isPending}
              >
                {deleteMutation.isPending ? (
                  <>
                    <Loader2 className="mr-2 h-4 w-4 animate-spin" />
                    Deleting…
                  </>
                ) : (
                  "Delete"
                )}
              </Button>
            </DialogFooter>
          </DialogContent>
        </Dialog>
      </div>
    </TooltipProvider>
  )
}
</file>

<file path="ui/src/pages/taints-page.tsx">
import { useMemo, useState } from "react"
import { taintsApi } from "@/api/taints.ts"
import type { DtoTaintResponse } from "@/sdk"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { CircleSlash2, Pencil, Plus, Search, Tags } from "lucide-react"
import { useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import { truncateMiddle } from "@/lib/utils.ts"
import { Badge } from "@/components/ui/badge.tsx"
import { Button } from "@/components/ui/button.tsx"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog.tsx"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form.tsx"
import { Input } from "@/components/ui/input.tsx"
import {
  Select,
  SelectContent,
  SelectItem,
  SelectTrigger,
  SelectValue,
} from "@/components/ui/select.tsx"
import {
  Table,
  TableBody,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table.tsx"

const EFFECTS = ["NoSchedule", "PreferNoSchedule", "NoExecute"] as const

const createTaintSchema = z.object({
  key: z.string().trim().min(1, "Key is required").max(120, "Max 120 chars"),
  value: z.string().trim().optional(),
  effect: z.enum(EFFECTS),
})

type CreateTaintInput = z.input<typeof createTaintSchema>

const updateTaintSchema = createTaintSchema.partial()
type UpdateTaintValues = z.infer<typeof updateTaintSchema>

function TaintBadge({ t }: { t: Pick<DtoTaintResponse, "key" | "value" | "effect"> }) {
  const label = `${t.key}${t.value ? `=${t.value}` : ""}${t.effect ? `:${t.effect}` : ""}`
  return (
    <Badge variant="secondary" className="font-mono text-xs">
      <Tags className="mr-1 h-3 w-3" />
      {label}
    </Badge>
  )
}

export const TaintsPage = () => {
  const [filter, setFilter] = useState<string>("")
  const [createOpen, setCreateOpen] = useState<boolean>(false)
  const [updateOpen, setUpdateOpen] = useState<boolean>(false)
  const [deleteId, setDeleteId] = useState<string | null>(null)
  const [editingId, setEditingId] = useState<string | null>(null)

  const qc = useQueryClient()

  const taintsQ = useQuery({
    queryKey: ["taints"],
    queryFn: () => taintsApi.listTaints(),
  })

  // --- Create
  const createForm = useForm<CreateTaintInput>({
    resolver: zodResolver(createTaintSchema),
    defaultValues: {
      key: "",
      value: "",
      effect: undefined,
    },
  })

  const createMut = useMutation({
    mutationFn: (values: CreateTaintInput) => taintsApi.createTaint(values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["taints"] })
      createForm.reset()
      setCreateOpen(false)
      toast.success("Taint Created Successfully.")
    },
    onError: (err) => {
      toast.error(err.message ?? "There was an error while creating Taint")
    },
  })

  const onCreateSubmit = (values: CreateTaintInput) => {
    createMut.mutate(values)
  }

  // --- Update
  const updateForm = useForm<UpdateTaintValues>({
    resolver: zodResolver(updateTaintSchema),
    defaultValues: {},
  })

  const updateMut = useMutation({
    mutationFn: ({ id, values }: { id: string; values: UpdateTaintValues }) =>
      taintsApi.updateTaint(id, values),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["taints"] })
      updateForm.reset()
      setUpdateOpen(false)
      toast.success("Taint Updated Successfully.")
    },
    onError: (err) => {
      toast.error(err.message ?? "There was an error while updating Taint")
    },
  })

  const openEdit = (taint: any) => {
    setEditingId(taint.id)
    updateForm.reset({
      key: taint.key,
      value: taint.value,
      effect: taint.effect,
    })
    setUpdateOpen(true)
  }

  // --- Delete ---

  const deleteMut = useMutation({
    mutationFn: (id: string) => taintsApi.deleteTaint(id),
    onSuccess: async () => {
      await qc.invalidateQueries({ queryKey: ["taints"] })
      setDeleteId(null)
      toast.success("Taint Deleted Successfully.")
    },
    onError: (err) => {
      toast.error(err.message ?? "There was an error while deleting Taint")
    },
  })

  const filtered = useMemo(() => {
    const data = taintsQ.data ?? []
    const q = filter.trim().toLowerCase()

    return q
      ? data.filter((k: any) => {
          return (
            k.key?.toLowerCase().includes(q) ||
            k.value?.toLowerCase().includes(q) ||
            k.effect?.toLowerCase().includes(q)
          )
        })
      : data
  }, [filter, taintsQ.data])

  if (taintsQ.isLoading) return <div className="p-6">Loading taints…</div>
  if (taintsQ.error) return <div className="p-6 text-red-500">Error loading taints.</div>

  return (
    <div className="space-y-4 p-6">
      <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
        <h1 className="mb-4 text-2xl font-bold">Taints</h1>

        <div className="flex flex-wrap items-center gap-2">
          <div className="relative">
            <Search className="absolute top-2.5 left-2 h-4 w-4 opacity-60" />
            <Input
              value={filter}
              onChange={(e) => setFilter(e.target.value)}
              placeholder="Search taints"
              className="w-64 pl-8"
            />
          </div>

          <Dialog open={createOpen} onOpenChange={setCreateOpen}>
            <DialogTrigger asChild>
              <Button onClick={() => setCreateOpen(true)}>
                <Plus className="mr-2 h-4 w-4" /> Create Taint
              </Button>
            </DialogTrigger>
            <DialogContent className="sm:max-w-lg">
              <DialogHeader>
                <DialogTitle>Create taint</DialogTitle>
              </DialogHeader>

              <Form {...createForm}>
                <form className="space-y-4" onSubmit={createForm.handleSubmit(onCreateSubmit)}>
                  <FormField
                    control={createForm.control}
                    name="key"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Key</FormLabel>
                        <FormControl>
                          <Input placeholder="dedicated" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="value"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Value (optional)</FormLabel>
                        <FormControl>
                          <Input placeholder="gpu" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="effect"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Effect</FormLabel>
                        <Select onValueChange={field.onChange} value={field.value}>
                          <FormControl>
                            <SelectTrigger>
                              <SelectValue placeholder="Select effect" />
                            </SelectTrigger>
                          </FormControl>
                          <SelectContent>
                            {EFFECTS.map((e) => (
                              <SelectItem key={e} value={e}>
                                {e}
                              </SelectItem>
                            ))}
                          </SelectContent>
                        </Select>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <DialogFooter className="gap-2">
                    <Button type="button" variant="outline" onClick={() => setCreateOpen(false)}>
                      Cancel
                    </Button>
                    <Button type="submit" disabled={createForm.formState.isSubmitting}>
                      {createForm.formState.isSubmitting ? "Creating…" : "Create"}
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </div>
      </div>

      <div className="bg-background overflow-hidden rounded-2xl border shadow-sm">
        <div className="overflow-x-auto">
          <Table>
            <TableHeader>
              <TableRow>
                <TableHead>Taint</TableHead>
                <TableHead className="w-[180px] text-right">Actions</TableHead>
              </TableRow>
            </TableHeader>
            <TableBody>
              {filtered.map((t) => (
                <TableRow key={t.id}>
                  <TableCell>
                    <div className="flex items-center gap-2">
                      <TaintBadge t={t} />
                      <code className="text-muted-foreground text-xs">
                        {truncateMiddle(t.id!, 6)}
                      </code>
                    </div>
                  </TableCell>

                  <TableCell>
                    <div className="flex justify-end gap-2">
                      <Button variant="outline" size="sm" onClick={() => openEdit(t)}>
                        <Pencil className="mr-2 h-4 w-4" /> Edit
                      </Button>
                      <Button
                        variant="destructive"
                        size="sm"
                        onClick={() => setDeleteId(t.id!)}
                        disabled={deleteMut.isPending && deleteId === t.id}
                      >
                        {deleteMut.isPending && deleteId === t.id ? "Deleting…" : "Delete"}
                      </Button>
                    </div>
                  </TableCell>
                </TableRow>
              ))}

              {filtered.length === 0 && (
                <TableRow>
                  <TableCell colSpan={3} className="text-muted-foreground py-10 text-center">
                    <CircleSlash2 className="mx-auto mb-2 h-6 w-6 opacity-60" />
                    No taints match your search.
                  </TableCell>
                </TableRow>
              )}
            </TableBody>
          </Table>
        </div>
      </div>

      {/* Update dialog */}
      <Dialog open={updateOpen} onOpenChange={setUpdateOpen}>
        <DialogContent className="sm:max-w-lg">
          <DialogHeader>
            <DialogTitle>Edit taint</DialogTitle>
          </DialogHeader>
          <Form {...updateForm}>
            <form
              className="space-y-4"
              onSubmit={updateForm.handleSubmit((values) => {
                if (!editingId) return
                updateMut.mutate({ id: editingId, values })
              })}
            >
              <FormField
                control={updateForm.control}
                name="key"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Key</FormLabel>
                    <FormControl>
                      <Input placeholder="dedicated" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="value"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Value (optional)</FormLabel>
                    <FormControl>
                      <Input placeholder="gpu" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <FormField
                control={updateForm.control}
                name="effect"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Effect</FormLabel>
                    <Select onValueChange={field.onChange} value={field.value}>
                      <FormControl>
                        <SelectTrigger>
                          <SelectValue placeholder="Select effect" />
                        </SelectTrigger>
                      </FormControl>
                      <SelectContent>
                        {EFFECTS.map((e) => (
                          <SelectItem key={e} value={e}>
                            {e}
                          </SelectItem>
                        ))}
                      </SelectContent>
                    </Select>
                    <FormMessage />
                  </FormItem>
                )}
              />

              <DialogFooter className="gap-2">
                <Button type="button" variant="outline" onClick={() => setUpdateOpen(false)}>
                  Cancel
                </Button>
                <Button type="submit" disabled={updateMut.isPending}>
                  {updateMut.isPending ? "Saving…" : "Save changes"}
                </Button>
              </DialogFooter>
            </form>
          </Form>
        </DialogContent>
      </Dialog>

      {/* Delete confirm dialog */}
      <Dialog open={!!deleteId} onOpenChange={(open) => !open && setDeleteId(null)}>
        <DialogContent className="sm:max-w-md">
          <DialogHeader>
            <DialogTitle>Delete taint</DialogTitle>
          </DialogHeader>
          <p className="text-muted-foreground text-sm">
            This action cannot be undone. Are you sure you want to delete this taint?
          </p>
          <DialogFooter className="gap-2">
            <Button variant="outline" onClick={() => setDeleteId(null)}>
              Cancel
            </Button>
            <Button
              variant="destructive"
              onClick={() => deleteId && deleteMut.mutate(deleteId)}
              disabled={deleteMut.isPending}
            >
              {deleteMut.isPending ? "Deleting…" : "Delete"}
            </Button>
          </DialogFooter>
        </DialogContent>
      </Dialog>
    </div>
  )
}
</file>

<file path="ui/src/providers/index.tsx">
import type { ReactNode } from "react"
import { ThemeProvider } from "@/providers/theme-provider.tsx"
import { QueryClient, QueryClientProvider } from "@tanstack/react-query"

import { Toaster } from "@/components/ui/sonner.tsx"

const queryClient = new QueryClient()

export const Providers = ({ children }: { children: ReactNode }) => {
  return (
    <QueryClientProvider client={queryClient}>
      <ThemeProvider defaultTheme="system" storageKey="dragon-theme">
        {children}
        <Toaster richColors expand position="top-center" />
      </ThemeProvider>
    </QueryClientProvider>
  )
}
</file>

<file path="ui/src/providers/theme-provider.tsx">
import { type ReactNode } from "react"
import { ThemeProvider as NextThemesProvider } from "next-themes"

export type Theme = "light" | "dark" | "system"

export function ThemeProvider({
  children,
  defaultTheme = "system",
  storageKey = "vite-ui-theme",
}: {
  children: ReactNode
  defaultTheme?: Theme
  storageKey?: string
}) {
  return (
    <NextThemesProvider
      attribute="class"
      defaultTheme={defaultTheme}
      enableSystem
      storageKey={storageKey}
      disableTransitionOnChange
    >
      {children}
    </NextThemesProvider>
  )
}
</file>

<file path="ui/src/types/rapidoc.d.ts">
import type React from "react"

declare global {
  namespace JSX {
    interface IntrinsicElements {
      "rapi-doc": React.DetailedHTMLProps<React.HTMLAttributes<HTMLElement>, HTMLElement> & {
        "spec-url"?: string
        "render-style"?: string
        theme?: string
        "show-header"?: string | boolean
        "persist-auth"?: string | boolean
        "allow-advanced-search"?: string | boolean
        "schema-description-expanded"?: string | boolean
        "allow-schema-description-expand-toggle"?: string | boolean
        "allow-spec-file-download"?: string | boolean
        "allow-spec-file-load"?: string | boolean
        "allow-spec-url-load"?: string | boolean
        "allow-try"?: string | boolean
        "schema-style"?: string
        "fetch-credentials"?: string
        "default-api-server"?: string
        "api-key-name"?: string
        "api-key-location"?: string
        "api-key-value"?: string
      }
    }
  }
}

export {}
</file>

<file path="ui/src/App.tsx">
import { AppShell } from "@/layouts/app-shell.tsx"
import { Route, Routes } from "react-router-dom"

import { ProtectedRoute } from "@/components/protected-route.tsx"
import { ActionsPage } from "@/pages/actions-page.tsx"
import { AnnotationPage } from "@/pages/annotation-page.tsx"
import { ClustersPage } from "@/pages/cluster-page"
import { CredentialPage } from "@/pages/credential-page.tsx"
import { DnsPage } from "@/pages/dns-page.tsx"
import { DocsPage } from "@/pages/docs-page.tsx"
import { JobsPage } from "@/pages/jobs-page.tsx"
import { LabelsPage } from "@/pages/labels-page.tsx"
import { LoadBalancersPage } from "@/pages/load-balancers-page"
import { Login } from "@/pages/login.tsx"
import { MePage } from "@/pages/me-page.tsx"
import { NodePoolsPage } from "@/pages/node-pools-page.tsx"
import { OrgApiKeys } from "@/pages/org/api-keys.tsx"
import { OrgMembers } from "@/pages/org/members.tsx"
import { OrgSettings } from "@/pages/org/settings.tsx"
import { ServerPage } from "@/pages/server-page.tsx"
import { SshPage } from "@/pages/ssh-page.tsx"
import { TaintsPage } from "@/pages/taints-page.tsx"

export default function App() {
  return (
    <Routes>
      <Route path="/login" element={<Login />} />
      <Route path="/docs" element={<DocsPage />} />

      <Route element={<ProtectedRoute />}>
        <Route element={<AppShell />}>
          <Route path="/me" element={<MePage />} />

          <Route path="/org/settings" element={<OrgSettings />} />
          <Route path="/org/members" element={<OrgMembers />} />
          <Route path="/org/api-keys" element={<OrgApiKeys />} />

          <Route path="/ssh" element={<SshPage />} />
          <Route path="/servers" element={<ServerPage />} />
          <Route path="/taints" element={<TaintsPage />} />
          <Route path="/labels" element={<LabelsPage />} />
          <Route path="/annotations" element={<AnnotationPage />} />
          <Route path="/node-pools" element={<NodePoolsPage />} />
          <Route path="/credentials" element={<CredentialPage />} />
          <Route path="/dns" element={<DnsPage />} />
          <Route path="/load-balancers" element={<LoadBalancersPage />} />
          <Route path="/clusters" element={<ClustersPage />} />

          <Route path="/admin/jobs" element={<JobsPage />} />
          <Route path="/admin/actions" element={<ActionsPage />} />
        </Route>
      </Route>
      <Route path="*" element={<Login />} />
    </Routes>
  )
}
</file>

<file path="ui/src/index.css">
@import "tailwindcss";
@import "tw-animate-css";

@custom-variant dark (&:is(.dark *));

@theme inline {
  --radius-sm: calc(var(--radius) - 4px);
  --radius-md: calc(var(--radius) - 2px);
  --radius-lg: var(--radius);
  --radius-xl: calc(var(--radius) + 4px);
  --color-background: var(--background);
  --color-foreground: var(--foreground);
  --color-card: var(--card);
  --color-card-foreground: var(--card-foreground);
  --color-popover: var(--popover);
  --color-popover-foreground: var(--popover-foreground);
  --color-primary: var(--primary);
  --color-primary-foreground: var(--primary-foreground);
  --color-secondary: var(--secondary);
  --color-secondary-foreground: var(--secondary-foreground);
  --color-muted: var(--muted);
  --color-muted-foreground: var(--muted-foreground);
  --color-accent: var(--accent);
  --color-accent-foreground: var(--accent-foreground);
  --color-destructive: var(--destructive);
  --color-border: var(--border);
  --color-input: var(--input);
  --color-ring: var(--ring);
  --color-chart-1: var(--chart-1);
  --color-chart-2: var(--chart-2);
  --color-chart-3: var(--chart-3);
  --color-chart-4: var(--chart-4);
  --color-chart-5: var(--chart-5);
  --color-sidebar: var(--sidebar);
  --color-sidebar-foreground: var(--sidebar-foreground);
  --color-sidebar-primary: var(--sidebar-primary);
  --color-sidebar-primary-foreground: var(--sidebar-primary-foreground);
  --color-sidebar-accent: var(--sidebar-accent);
  --color-sidebar-accent-foreground: var(--sidebar-accent-foreground);
  --color-sidebar-border: var(--sidebar-border);
  --color-sidebar-ring: var(--sidebar-ring);
}

:root {
  --radius: 0.625rem;
  --background: oklch(1 0 0);
  --foreground: oklch(0.141 0.005 285.823);
  --card: oklch(1 0 0);
  --card-foreground: oklch(0.141 0.005 285.823);
  --popover: oklch(1 0 0);
  --popover-foreground: oklch(0.141 0.005 285.823);
  --primary: oklch(0.21 0.006 285.885);
  --primary-foreground: oklch(0.985 0 0);
  --secondary: oklch(0.967 0.001 286.375);
  --secondary-foreground: oklch(0.21 0.006 285.885);
  --muted: oklch(0.967 0.001 286.375);
  --muted-foreground: oklch(0.552 0.016 285.938);
  --accent: oklch(0.967 0.001 286.375);
  --accent-foreground: oklch(0.21 0.006 285.885);
  --destructive: oklch(0.577 0.245 27.325);
  --border: oklch(0.92 0.004 286.32);
  --input: oklch(0.92 0.004 286.32);
  --ring: oklch(0.705 0.015 286.067);
  --chart-1: oklch(0.646 0.222 41.116);
  --chart-2: oklch(0.6 0.118 184.704);
  --chart-3: oklch(0.398 0.07 227.392);
  --chart-4: oklch(0.828 0.189 84.429);
  --chart-5: oklch(0.769 0.188 70.08);
  --sidebar: oklch(0.985 0 0);
  --sidebar-foreground: oklch(0.141 0.005 285.823);
  --sidebar-primary: oklch(0.21 0.006 285.885);
  --sidebar-primary-foreground: oklch(0.985 0 0);
  --sidebar-accent: oklch(0.967 0.001 286.375);
  --sidebar-accent-foreground: oklch(0.21 0.006 285.885);
  --sidebar-border: oklch(0.92 0.004 286.32);
  --sidebar-ring: oklch(0.705 0.015 286.067);
}

.dark {
  --background: oklch(0.141 0.005 285.823);
  --foreground: oklch(0.985 0 0);
  --card: oklch(0.21 0.006 285.885);
  --card-foreground: oklch(0.985 0 0);
  --popover: oklch(0.21 0.006 285.885);
  --popover-foreground: oklch(0.985 0 0);
  --primary: oklch(0.92 0.004 286.32);
  --primary-foreground: oklch(0.21 0.006 285.885);
  --secondary: oklch(0.274 0.006 286.033);
  --secondary-foreground: oklch(0.985 0 0);
  --muted: oklch(0.274 0.006 286.033);
  --muted-foreground: oklch(0.705 0.015 286.067);
  --accent: oklch(0.274 0.006 286.033);
  --accent-foreground: oklch(0.985 0 0);
  --destructive: oklch(0.704 0.191 22.216);
  --border: oklch(1 0 0 / 10%);
  --input: oklch(1 0 0 / 15%);
  --ring: oklch(0.552 0.016 285.938);
  --chart-1: oklch(0.488 0.243 264.376);
  --chart-2: oklch(0.696 0.17 162.48);
  --chart-3: oklch(0.769 0.188 70.08);
  --chart-4: oklch(0.627 0.265 303.9);
  --chart-5: oklch(0.645 0.246 16.439);
  --sidebar: oklch(0.21 0.006 285.885);
  --sidebar-foreground: oklch(0.985 0 0);
  --sidebar-primary: oklch(0.488 0.243 264.376);
  --sidebar-primary-foreground: oklch(0.985 0 0);
  --sidebar-accent: oklch(0.274 0.006 286.033);
  --sidebar-accent-foreground: oklch(0.985 0 0);
  --sidebar-border: oklch(1 0 0 / 10%);
  --sidebar-ring: oklch(0.552 0.016 285.938);
}

@layer base {
  * {
    @apply border-border outline-ring/50;
  }
  body {
    @apply bg-background text-foreground;
  }
}
</file>

<file path="ui/src/main.tsx">
import "./index.css"

import { StrictMode } from "react"
import { Providers } from "@/providers"
import { createRoot } from "react-dom/client"
import { BrowserRouter } from "react-router-dom"

import App from "./App.tsx"

createRoot(document.getElementById("root")!).render(
  <StrictMode>
    <BrowserRouter>
      <Providers>
        <App />
      </Providers>
    </BrowserRouter>
  </StrictMode>
)
</file>

<file path="ui/src/sdkClient.ts">
import { orgStore } from "@/auth/org.ts"
import { authStore } from "@/auth/store.ts"
import {
  ActionsApi,
  AnnotationsApi,
  ArcherAdminApi,
  AuthApi,
  ClusterRunsApi,
  ClustersApi,
  Configuration,
  CredentialsApi,
  DNSApi,
  LabelsApi,
  LoadBalancersApi,
  MeApi,
  MeAPIKeysApi,
  MetaApi,
  NodePoolsApi,
  OrgsApi,
  ServersApi,
  SshApi,
  TaintsApi,
} from "@/sdk"

export const API_BASE = "/api/v1"

export function makeConfig() {
  return new Configuration({
    basePath: API_BASE,
    accessToken: async () => authStore.getAccessToken() ?? "",
    middleware: [
      {
        async pre(ctx) {
          const headers = new Headers(ctx.init?.headers ?? {})

          const hasBody =
            ctx.init?.body != null &&
            !(ctx.init.body instanceof FormData) &&
            !(ctx.init.body instanceof Blob)

          if (hasBody && !headers.has("Content-Type")) {
            headers.set("Content-Type", "application/json")
          }

          const token = authStore.getAccessToken()
          if (token) {
            headers.set("Authorization", `Bearer ${token}`)
          }

          const org = orgStore.get()
          if (org) {
            headers.set("X-Org-ID", org)
          }

          return {
            ...ctx,
            init: {
              ...ctx.init,
              headers,
            },
          }
        },
        async post(ctx) {
          return ctx.response
        },
      },
    ],
  })
}

function makeApiClient<T>(Ctor: new (cfg: Configuration) => T): T {
  return new Ctor(makeConfig())
}

export function makeAuthApi() {
  return makeApiClient(AuthApi)
}

export function makeMeApi() {
  return makeApiClient(MeApi)
}

export function makeMeKeysApi() {
  return makeApiClient(MeAPIKeysApi)
}

export function makeOrgsApi() {
  return makeApiClient(OrgsApi)
}

export function makeSshApi() {
  return makeApiClient(SshApi)
}

export function makeServersApi() {
  return makeApiClient(ServersApi)
}

export function makeTaintsApi() {
  return makeApiClient(TaintsApi)
}

export function makeLabelsApi() {
  return makeApiClient(LabelsApi)
}

export function makeAnnotationsApi() {
  return makeApiClient(AnnotationsApi)
}

export function makeArcherAdminApi() {
  return makeApiClient(ArcherAdminApi)
}

export function makeNodePoolApi() {
  return makeApiClient(NodePoolsApi)
}

export function makeMetaApi() {
  return makeApiClient(MetaApi)
}

export function makeCredentialsApi() {
  return makeApiClient(CredentialsApi)
}

export function makeDnsApi() {
  return makeApiClient(DNSApi)
}

export function makeLoadBalancerApi() {
  return makeApiClient(LoadBalancersApi)
}

export function makeClusterApi() {
  return makeApiClient(ClustersApi)
}

export function makeActionsApi() {
  return makeApiClient(ActionsApi)
}

export function makeClusterRunsApi() {
  return makeApiClient(ClusterRunsApi)
}
</file>

<file path="ui/.gitignore">
# Logs
logs
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*
lerna-debug.log*

node_modules
dist
dist-ssr
*.local

# Editor directories and files
.vscode/*
!.vscode/extensions.json
.idea
.DS_Store
*.suo
*.ntvs*
*.njsproj
*.sln
*.sw?
</file>

<file path="ui/.prettierignore">
src/sdk
</file>

<file path="ui/.prettierrc.json">
{
  "endOfLine": "lf",
  "semi": false,
  "singleQuote": false,
  "tabWidth": 2,
  "printWidth": 100,
  "trailingComma": "es5",
  "importOrder": [
    "^(react/(.*)$)|^(react$)",
    "^(next/(.*)$)|^(next$)",
    "<THIRD_PARTY_MODULES>",
    "",
    "^@workspace/(.*)$",
    "",
    "^types$",
    "^@/types/(.*)$",
    "^@/config/(.*)$",
    "^@/lib/(.*)$",
    "^@/hooks/(.*)$",
    "^@/components/ui/(.*)$",
    "^@/components/(.*)$",
    "^@/pages/(.*)$",
    "^@/registry/(.*)$",
    "^@/styles/(.*)$",
    "^@/app/(.*)$",
    "^@/www/(.*)$",
    "",
    "^[./]"
  ],
  "importOrderSeparation": false,
  "importOrderSortSpecifiers": true,
  "importOrderBuiltinModulesToTop": true,
  "importOrderParserPlugins": ["typescript", "jsx", "decorators-legacy"],
  "importOrderMergeDuplicateImports": true,
  "importOrderCombineTypeAndValueImports": true,
  "plugins": ["@ianvs/prettier-plugin-sort-imports", "prettier-plugin-tailwindcss"]
}
</file>

<file path="ui/components.json">
{
  "$schema": "https://ui.shadcn.com/schema.json",
  "style": "new-york",
  "rsc": false,
  "tsx": true,
  "tailwind": {
    "config": "",
    "css": "src/index.css",
    "baseColor": "zinc",
    "cssVariables": true,
    "prefix": ""
  },
  "iconLibrary": "lucide",
  "aliases": {
    "components": "@/components",
    "utils": "@/lib/utils",
    "ui": "@/components/ui",
    "lib": "@/lib",
    "hooks": "@/hooks"
  },
  "registries": {}
}
</file>

<file path="ui/eslint.config.js">
import js from "@eslint/js"
import reactHooks from "eslint-plugin-react-hooks"
import reactRefresh from "eslint-plugin-react-refresh"
import { defineConfig, globalIgnores } from "eslint/config"
import globals from "globals"
import tseslint from "typescript-eslint"

export default defineConfig([
  globalIgnores(["dist", "src/sdk", "src/components"]),
  {
    files: ["**/*.{ts,tsx}"],
    extends: [
      js.configs.recommended,
      ...tseslint.configs.recommended,
      //reactHooks.configs['recommended-latest'],
      //reactRefresh.configs.vite,
    ],
    plugins: {
      "react-hooks": reactHooks,
      "react-refresh": reactRefresh,
    },
    rules: {
      ...(reactHooks.configs["recommended-latest"]?.rules ?? {}),
      ...(reactRefresh.configs.vite?.rules ?? {}),
      "@typescript-eslint/no-explicit-any": "off",
    },
    languageOptions: {
      ecmaVersion: 2020,
      globals: globals.browser,
    },
  },
])
</file>

<file path="ui/index.html">
<!doctype html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <link rel="icon" type="image/svg+xml" href="/vite.svg" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>AutoGlue</title>
  </head>
  <body>
    <div id="root"></div>
    <script type="module" src="/src/main.tsx"></script>
  </body>
</html>
</file>

<file path="ui/README.md">
# React + TypeScript + Vite

This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.

Currently, two official plugins are available:

- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Babel](https://babeljs.io/) (or [oxc](https://oxc.rs) when used in [rolldown-vite](https://vite.dev/guide/rolldown)) for Fast Refresh
- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh

## React Compiler

The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).

## Expanding the ESLint configuration

If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:

```js
export default defineConfig([
  globalIgnores(['dist']),
  {
    files: ['**/*.{ts,tsx}'],
    extends: [
      // Other configs...

      // Remove tseslint.configs.recommended and replace with this
      tseslint.configs.recommendedTypeChecked,
      // Alternatively, use this for stricter rules
      tseslint.configs.strictTypeChecked,
      // Optionally, add this for stylistic rules
      tseslint.configs.stylisticTypeChecked,

      // Other configs...
    ],
    languageOptions: {
      parserOptions: {
        project: ['./tsconfig.node.json', './tsconfig.app.json'],
        tsconfigRootDir: import.meta.dirname,
      },
      // other options...
    },
  },
])
```

You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:

```js
// eslint.config.js
import reactX from 'eslint-plugin-react-x'
import reactDom from 'eslint-plugin-react-dom'

export default defineConfig([
  globalIgnores(['dist']),
  {
    files: ['**/*.{ts,tsx}'],
    extends: [
      // Other configs...
      // Enable lint rules for React
      reactX.configs['recommended-typescript'],
      // Enable lint rules for React DOM
      reactDom.configs.recommended,
    ],
    languageOptions: {
      parserOptions: {
        project: ['./tsconfig.node.json', './tsconfig.app.json'],
        tsconfigRootDir: import.meta.dirname,
      },
      // other options...
    },
  },
])
```
</file>

<file path="ui/tsconfig.app.json">
{
  "compilerOptions": {
    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
    "target": "ES2022",
    "useDefineForClassFields": true,
    "lib": ["ES2022", "DOM", "DOM.Iterable"],
    "module": "ESNext",
    "types": ["vite/client"],
    "skipLibCheck": true,

    /* Bundler mode */
    "moduleResolution": "bundler",
    "allowImportingTsExtensions": true,
    "verbatimModuleSyntax": true,
    "moduleDetection": "force",
    "noEmit": true,
    "jsx": "react-jsx",

    /* Linting */
    "strict": true,
    "noUnusedLocals": false,
    "noUnusedParameters": false,
    "erasableSyntaxOnly": false,
    "noFallthroughCasesInSwitch": true,
    "noUncheckedSideEffectImports": true,
    "baseUrl": ".",
    "paths": {
      "@/*": ["./src/*"]
    }
  },
  "include": ["src"]
}
</file>

<file path="ui/tsconfig.json">
{
  "files": [],
  "references": [
    { "path": "./tsconfig.app.json" },
    { "path": "./tsconfig.node.json" }
  ],
  "compilerOptions": {
    "baseUrl": ".",
    "paths": {
      "@/*": ["./src/*"]
    },
    "jsx": "react-jsx"
  },
}
</file>

<file path="ui/tsconfig.node.json">
{
  "compilerOptions": {
    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
    "target": "ES2023",
    "lib": ["ES2023"],
    "module": "ESNext",
    "types": ["node"],
    "skipLibCheck": true,

    /* Bundler mode */
    "moduleResolution": "bundler",
    "allowImportingTsExtensions": true,
    "verbatimModuleSyntax": true,
    "moduleDetection": "force",
    "noEmit": true,

    /* Linting */
    "strict": true,
    "noUnusedLocals": true,
    "noUnusedParameters": true,
    "erasableSyntaxOnly": true,
    "noFallthroughCasesInSwitch": true,
    "noUncheckedSideEffectImports": true
  },
  "include": ["vite.config.ts"]
}
</file>

<file path="ui/tsconfig.tsbuildinfo">
{"root":["./src/app.tsx","./src/main.tsx","./src/sdkclient.ts","./src/api/annotations.ts","./src/api/archer_admin.ts","./src/api/clusters.ts","./src/api/credentials.ts","./src/api/dns.ts","./src/api/footer.ts","./src/api/labels.ts","./src/api/loadbalancers.ts","./src/api/me.ts","./src/api/node_pools.ts","./src/api/servers.ts","./src/api/ssh.ts","./src/api/taints.ts","./src/api/with-refresh.ts","./src/auth/logout.ts","./src/auth/org.ts","./src/auth/store.ts","./src/components/protected-route.tsx","./src/components/ui/accordion.tsx","./src/components/ui/alert-dialog.tsx","./src/components/ui/alert.tsx","./src/components/ui/aspect-ratio.tsx","./src/components/ui/avatar.tsx","./src/components/ui/badge.tsx","./src/components/ui/breadcrumb.tsx","./src/components/ui/button-group.tsx","./src/components/ui/button.tsx","./src/components/ui/calendar.tsx","./src/components/ui/card.tsx","./src/components/ui/carousel.tsx","./src/components/ui/chart.tsx","./src/components/ui/checkbox.tsx","./src/components/ui/collapsible.tsx","./src/components/ui/command.tsx","./src/components/ui/context-menu.tsx","./src/components/ui/dialog.tsx","./src/components/ui/drawer.tsx","./src/components/ui/dropdown-menu.tsx","./src/components/ui/empty.tsx","./src/components/ui/field.tsx","./src/components/ui/form.tsx","./src/components/ui/hover-card.tsx","./src/components/ui/input-group.tsx","./src/components/ui/input-otp.tsx","./src/components/ui/input.tsx","./src/components/ui/item.tsx","./src/components/ui/kbd.tsx","./src/components/ui/label.tsx","./src/components/ui/menubar.tsx","./src/components/ui/navigation-menu.tsx","./src/components/ui/pagination.tsx","./src/components/ui/popover.tsx","./src/components/ui/progress.tsx","./src/components/ui/radio-group.tsx","./src/components/ui/resizable.tsx","./src/components/ui/scroll-area.tsx","./src/components/ui/select.tsx","./src/components/ui/separator.tsx","./src/components/ui/sheet.tsx","./src/components/ui/sidebar.tsx","./src/components/ui/skeleton.tsx","./src/components/ui/slider.tsx","./src/components/ui/sonner.tsx","./src/components/ui/spinner.tsx","./src/components/ui/switch.tsx","./src/components/ui/table.tsx","./src/components/ui/tabs.tsx","./src/components/ui/textarea.tsx","./src/components/ui/toggle-group.tsx","./src/components/ui/toggle.tsx","./src/components/ui/tooltip.tsx","./src/hooks/use-auth-actions.ts","./src/hooks/use-auth.ts","./src/hooks/use-me.ts","./src/hooks/use-mobile.ts","./src/layouts/app-shell.tsx","./src/layouts/footer.tsx","./src/layouts/nav-config.ts","./src/layouts/org-switcher.tsx","./src/layouts/theme-switcher.tsx","./src/layouts/topbar.tsx","./src/lib/utils.ts","./src/pages/annotation-page.tsx","./src/pages/cluster-page.tsx","./src/pages/credential-page.tsx","./src/pages/dns-page.tsx","./src/pages/docs-page.tsx","./src/pages/jobs-page.tsx","./src/pages/labels-page.tsx","./src/pages/load-balancers-page.tsx","./src/pages/login.tsx","./src/pages/me-page.tsx","./src/pages/node-pools-page.tsx","./src/pages/server-page.tsx","./src/pages/ssh-page.tsx","./src/pages/taints-page.tsx","./src/pages/org/api-keys.tsx","./src/pages/org/members.tsx","./src/pages/org/settings.tsx","./src/providers/index.tsx","./src/providers/theme-provider.tsx","./src/sdk/index.ts","./src/sdk/runtime.ts","./src/sdk/apis/annotationsapi.ts","./src/sdk/apis/archeradminapi.ts","./src/sdk/apis/authapi.ts","./src/sdk/apis/clustersapi.ts","./src/sdk/apis/credentialsapi.ts","./src/sdk/apis/dnsapi.ts","./src/sdk/apis/healthapi.ts","./src/sdk/apis/labelsapi.ts","./src/sdk/apis/loadbalancersapi.ts","./src/sdk/apis/meapikeysapi.ts","./src/sdk/apis/meapi.ts","./src/sdk/apis/metaapi.ts","./src/sdk/apis/nodepoolsapi.ts","./src/sdk/apis/orgsapi.ts","./src/sdk/apis/serversapi.ts","./src/sdk/apis/sshapi.ts","./src/sdk/apis/taintsapi.ts","./src/sdk/apis/index.ts","./src/sdk/models/dtoannotationresponse.ts","./src/sdk/models/dtoattachannotationsrequest.ts","./src/sdk/models/dtoattachbastionrequest.ts","./src/sdk/models/dtoattachcaptaindomainrequest.ts","./src/sdk/models/dtoattachlabelsrequest.ts","./src/sdk/models/dtoattachloadbalancerrequest.ts","./src/sdk/models/dtoattachnodepoolrequest.ts","./src/sdk/models/dtoattachrecordsetrequest.ts","./src/sdk/models/dtoattachserversrequest.ts","./src/sdk/models/dtoattachtaintsrequest.ts","./src/sdk/models/dtoauthstartresponse.ts","./src/sdk/models/dtoclusterresponse.ts","./src/sdk/models/dtocreateannotationrequest.ts","./src/sdk/models/dtocreateclusterrequest.ts","./src/sdk/models/dtocreatecredentialrequest.ts","./src/sdk/models/dtocreatedomainrequest.ts","./src/sdk/models/dtocreatelabelrequest.ts","./src/sdk/models/dtocreateloadbalancerrequest.ts","./src/sdk/models/dtocreatenodepoolrequest.ts","./src/sdk/models/dtocreaterecordsetrequest.ts","./src/sdk/models/dtocreatesshrequest.ts","./src/sdk/models/dtocreateserverrequest.ts","./src/sdk/models/dtocreatetaintrequest.ts","./src/sdk/models/dtocredentialout.ts","./src/sdk/models/dtodomainresponse.ts","./src/sdk/models/dtoenqueuerequest.ts","./src/sdk/models/dtojwk.ts","./src/sdk/models/dtojwks.ts","./src/sdk/models/dtojob.ts","./src/sdk/models/dtojobstatus.ts","./src/sdk/models/dtolabelresponse.ts","./src/sdk/models/dtoloadbalancerresponse.ts","./src/sdk/models/dtologoutrequest.ts","./src/sdk/models/dtonodepoolresponse.ts","./src/sdk/models/dtopagejob.ts","./src/sdk/models/dtoqueueinfo.ts","./src/sdk/models/dtorecordsetresponse.ts","./src/sdk/models/dtorefreshrequest.ts","./src/sdk/models/dtoserverresponse.ts","./src/sdk/models/dtosetkubeconfigrequest.ts","./src/sdk/models/dtosshresponse.ts","./src/sdk/models/dtosshrevealresponse.ts","./src/sdk/models/dtotaintresponse.ts","./src/sdk/models/dtotokenpair.ts","./src/sdk/models/dtoupdateannotationrequest.ts","./src/sdk/models/dtoupdateclusterrequest.ts","./src/sdk/models/dtoupdatecredentialrequest.ts","./src/sdk/models/dtoupdatedomainrequest.ts","./src/sdk/models/dtoupdatelabelrequest.ts","./src/sdk/models/dtoupdateloadbalancerrequest.ts","./src/sdk/models/dtoupdatenodepoolrequest.ts","./src/sdk/models/dtoupdaterecordsetrequest.ts","./src/sdk/models/dtoupdateserverrequest.ts","./src/sdk/models/dtoupdatetaintrequest.ts","./src/sdk/models/getsshkey200response.ts","./src/sdk/models/handlerscreateuserkeyrequest.ts","./src/sdk/models/handlershealthstatus.ts","./src/sdk/models/handlersmeresponse.ts","./src/sdk/models/handlersmemberout.ts","./src/sdk/models/handlersmemberupsertreq.ts","./src/sdk/models/handlersorgcreatereq.ts","./src/sdk/models/handlersorgkeycreatereq.ts","./src/sdk/models/handlersorgkeycreateresp.ts","./src/sdk/models/handlersorgupdatereq.ts","./src/sdk/models/handlersupdatemerequest.ts","./src/sdk/models/handlersuserapikeyout.ts","./src/sdk/models/handlersversionresponse.ts","./src/sdk/models/modelsapikey.ts","./src/sdk/models/modelsorganization.ts","./src/sdk/models/modelsuser.ts","./src/sdk/models/modelsuseremail.ts","./src/sdk/models/utilserrorresponse.ts","./src/sdk/models/index.ts","./src/types/rapidoc.d.ts"],"errors":true,"version":"5.9.3"}
</file>

<file path="ui/vite.config.ts">
import path from "path"
import tailwindcss from "@tailwindcss/vite"
import react from "@vitejs/plugin-react"
import { defineConfig } from "vite"

// https://vite.dev/config/
export default defineConfig({
  plugins: [react(), tailwindcss()],
  resolve: {
    alias: {
      "@": path.resolve(__dirname, "./src"),
    },
  },
  server: {
    port: 5173,
    proxy: {
      "/api": "http://localhost:8080",
      "/swagger": "http://localhost:8080",
      "/db-studio": "http://localhost:8080",
    },
    allowedHosts: [".getexposed.io"],
  },
  build: {
    chunkSizeWarningLimit: 1000,
    outDir: "../internal/web/dist",
    emptyOutDir: true,
    sourcemap: true,
    cssMinify: "lightningcss",
    rollupOptions: {
      output: { manualChunks: { react: ["react", "react-dom", "react-router-dom"] } },
    },
  },
  esbuild: { legalComments: "none" },
})
</file>

<file path=".dockerignore">
terraform
terraform-provider-autoglue
sdk
</file>

<file path=".semgrep.yml">
# AutoGlue Semgrep configuration
# Use with: opengrep scan --config .semgrep.yml .

rules:

  #
  # 1. Suppress known benign “direct write to ResponseWriter” warnings
  #
  - id: autoglue.ignore.direct-write-static
    message: Ignore direct writes for static or binary responses
    languages: [go]
    severity: INFO
    metadata:
      category: suppression
      project: autoglue
    patterns:
      - pattern: |
          _, _ = $W.Write($DATA)
    pattern-inside: |
      func $F($X...) {
        ...
      }
    paths:
      include:
        - internal/api/utils.go
        - internal/handlers/ssh_keys.go


  #
  # 2. Enforce Allowed Origins checking in writePostMessageHTML
  #
  - id: autoglue.auth.require-origin-validation
    message: >
      writePostMessageHTML must validate `origin` against known allowed origins
      to prevent token exfiltration via crafted state/redirect parameters.
    languages: [go]
    severity: ERROR
    metadata:
      category: security
      project: autoglue

    # Look for the JS snippet inside the Go string literal using a regex.
    # This is NOT Go code, so we must use pattern-regex, not pattern.
    pattern-regex: |
      window\.opener\.postMessage\(\{ type: 'autoglue:auth', payload: data \}, .*?\);

    paths:
      include:
        - internal/handlers/auth.go


  #
  # 3. Require httpOnly+Secure cookies for JWT cookies
  #
  - id: autoglue.cookies.ensure-secure-jwt
    message: >
      JWT cookies must always have a Secure field (true in prod, false only for localhost dev).
    languages: [go]
    severity: WARNING
    metadata:
      category: security
      project: autoglue

    patterns:
      # 1) Find any SetCookie for ag_jwt
      - pattern: |
          http.SetCookie($W, &http.Cookie{
            Name: "ag_jwt",
            ...
          })
      # 2) BUT ignore cases where the Secure field is present
      - pattern-not: |
          http.SetCookie($W, &http.Cookie{
            Name: "ag_jwt",
            Secure: $SECURE,
            ...
          })

    paths:
      include:
        - internal/handlers/auth.go


  #
  # 4. Ban path.Clean for user-controlled paths
  #
  - id: autoglue.filesystem.no-path-clean
    message: Use securejoin instead of path.Clean() for file paths.
    languages: [go]
    severity: WARNING
    metadata:
      category: security
      project: autoglue

    pattern: |
      path.Clean($X)

    paths:
      include:
        - internal/web/static.go
</file>

<file path="docker-compose.yml">
services:
  postgres:
    build:
      context: postgres
    env_file: .env
    environment:
      POSTGRES_USER: $DB_USER
      POSTGRES_PASSWORD: $DB_PASSWORD
      POSTGRES_DB: $DB_NAME
    expose:
      - 5432
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data

  mailpit:
    image: axllent/mailpit@sha256:c076638db1e15662150be4fb62b8a6e96ef6ba5bde90c838a0239225854830f7
    restart: always
    ports:
      - "1025:1025"
      - "8025:8025"

volumes:
  postgres_data:
</file>

<file path="main.go">
package main

import (
	"github.com/glueops/autoglue/cmd"
	"github.com/glueops/autoglue/docs"
	"github.com/glueops/autoglue/internal/version"
)

// @title AutoGlue API
// @version dev
// @description API for managing K3s clusters across cloud providers
// @contact.name GlueOps

// @servers.url https://autoglue.glueopshosted.com/api/v1
// @servers.description Production API
// @servers.url https://autoglue.glueopshosted.rocks/api/v1
// @servers.description Pre-Production API
// @servers.url https://autoglue.apps.nonprod.earth.onglueops.rocks/api/v1
// @servers.description Staging API
// @servers.url http://localhost:8080/api/v1
// @servers.description Local dev

// @securityDefinitions.apikey BearerAuth
// @in header
// @name Authorization
// @description Bearer token authentication

// @securityDefinitions.apikey ApiKeyAuth
// @in header
// @name X-API-KEY
// @description	User API key

// @securityDefinitions.apikey OrgKeyAuth
// @in header
// @name X-ORG-KEY
// @description Org-level key/secret authentication

// @securityDefinitions.apikey OrgSecretAuth
// @in header
// @name X-ORG-SECRET
// @description	Org-level secret

func main() {
	docs.SwaggerInfo.Version = version.Version
	cmd.Execute()
}
</file>

<file path="README.md">
# Autoglue

## Setup Env
create .env file:
```bash
cp .env.example .env
```

## Bring up Database:
```bash
docker compose up -d
```

## Generate JWT tokens used for auth in the DB
Private Key is encrypted by `JWT_PRIVATE_ENC_KEY`
If this is not set, the private key is stored in plain text in the DB - its never exposed at any rate

```bash
go run . keys generate
```

## Generate master encryption key 
The master encryption key is used to generate the org encryption keys - without it there will be failures
```bash
go run . encrypt create-master
```

## Ensure your swagger and SDKs are up to date with the api spec
```bash
make swagger
make sdk-all
```

## Build terraform provider
Currently, the terraform provider consumes the go sdk through an alias
Once the SDK is published to its own repo, the alias can be removed. but this is why its imperative to ensure the SDK is up to date

The command below builds the provider binary, and installs it where terraform expects it to be placed if it were downloaded from a registry
```bash
cd terraform-provider-autoglue
make dev
```

## See UI & terraform in action
From the project root
## UI & API - required for the terraform
Start the API & UI (the env embeds it with a dev proxy)

if you witness a failure here, run `make ui`

This is most likely the SPA handler trying to embed ui files that dont exist
```bash
go run .
```

From your GLUEOPS profiled browser - http://localhost:8080
Login - this is restricted to glueops.dev at the minute (in google workspace settings - outside of the API)

Create your org (http://localhost:8080/me) - you should be redirected here after initial login

Once you have an org - create a set of api keys for your org:
They will be in the format of:
Example values only; these are not real secrets.
```text
Org Key: org_lnJwmyyWH7JC-JgZo5v3Kw
Org Secret: fqd9yebGMfK6h5HSgWn4sXrwr9xlFbvbIYtNylRElMQ
```

use them in terraform/envs/dev/terraform.tfvars

in my example here, i also create ssh keys in my example:
```terraform
org_key = "org_lnJwmyyWH7JC-JgZo5v3Kw"
org_secret = "fqd9yebGMfK6h5HSgWn4sXrwr9xlFbvbIYtNylRElMQ"

ssh_keys = {
  bastionKey = {
    name            = "Bastion Key"
    comment         = "deploy@autoglue"
    type            = "rsa"
    bits            = 4096
    enable_download = true
    download_part   = "both"
    download_dir    = "out/bastionKey"
  }
  clusterKey = {
    name    = "Cluster Key"
    comment = "bastion@autoglue"
    type    = "ed25519"           # bits ignored
    enable_download = true
    download_part   = "both"
    download_dir    = "out/clusterKey"
  }
}

```

explore `main.tf` for how the module ssh-keys module is used
also you will see there how to create servers using the servers module

in `terraform/envs/dev`
```bash
rm -rf .terraform*
tofu init -upgrade

tofu plan

tofu apply -auto-approve
```

If everything went to plan, you'll have an `out` directory containting 2 zip file - one for each of the ssh keys

In the UI you will also see the SSH Keys on its page,
you will also see the servers created on its page.

## <span style="color:red">WARNING</span>
<span style="color:red">!!!!Terraform destroy deletes the keys from the api as well as deletes the local files!!!!</span>
```bash
tofu destroy -auto-approve
```
</file>

<file path="internal/bg/bastion.go">
package bg

import (
	"context"
	"encoding/base64"
	"fmt"
	"net"
	"strings"
	"time"

	"github.com/dyaksa/archer"
	"github.com/dyaksa/archer/job"
	"github.com/glueops/autoglue/internal/models"
	"github.com/glueops/autoglue/internal/utils"
	"github.com/google/uuid"
	"github.com/rs/zerolog/log"
	"golang.org/x/crypto/ssh"
	"gorm.io/gorm"
)

// ----- Public types -----

type BastionBootstrapArgs struct {
	IntervalS int `json:"interval_seconds,omitempty"`
}

type BastionBootstrapFailure struct {
	ID     uuid.UUID `json:"id"`
	Step   string    `json:"step"`
	Reason string    `json:"reason"`
}

type BastionBootstrapResult struct {
	Status       string                    `json:"status"`
	Processed    int                       `json:"processed"`
	Ready        int                       `json:"ready"`
	Failed       int                       `json:"failed"`
	ElapsedMs    int                       `json:"elapsed_ms"`
	FailedServer []uuid.UUID               `json:"failed_server_ids"`
	Failures     []BastionBootstrapFailure `json:"failures"`
}

// ----- Worker -----

func BastionBootstrapWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
	return func(ctx context.Context, j job.Job) (any, error) {
		args := BastionBootstrapArgs{IntervalS: 120}
		jobID := j.ID
		start := time.Now()

		_ = j.ParseArguments(&args)
		if args.IntervalS <= 0 {
			args.IntervalS = 120
		}

		var servers []models.Server
		if err := db.
			Preload("SshKey").
			Where("role = ? AND status = ?", "bastion", "pending").
			Find(&servers).Error; err != nil {
			log.Printf("[bastion] level=ERROR job=%s step=query msg=%q", jobID, err)
			return nil, err
		}

		// log.Printf("[bastion] level=INFO job=%s step=start count=%d", jobID, len(servers))

		proc, ok, fail := 0, 0, 0
		var failedIDs []uuid.UUID
		var failures []BastionBootstrapFailure

		perHostTimeout := 8 * time.Minute

		for i := range servers {
			s := &servers[i]
			// hostStart := time.Now()
			proc++

			// 1) Defensive IP check
			if s.PublicIPAddress == nil || *s.PublicIPAddress == "" {
				fail++
				failedIDs = append(failedIDs, s.ID)
				failures = append(failures, BastionBootstrapFailure{ID: s.ID, Step: "ip_check", Reason: "missing public ip"})
				logHostErr(jobID, s, "ip_check", fmt.Errorf("missing public ip"))
				_ = setServerStatus(db, s.ID, "failed")
				continue
			}

			// 2) Move to provisioning
			if err := setServerStatus(db, s.ID, "provisioning"); err != nil {
				fail++
				failedIDs = append(failedIDs, s.ID)
				failures = append(failures, BastionBootstrapFailure{ID: s.ID, Step: "set_provisioning", Reason: err.Error()})
				logHostErr(jobID, s, "set_provisioning", err)
				continue
			}

			// 3) Decrypt private key for org
			privKey, err := utils.DecryptForOrg(
				s.OrganizationID,
				s.SshKey.EncryptedPrivateKey,
				s.SshKey.PrivateIV,
				s.SshKey.PrivateTag,
				db,
			)
			if err != nil {
				fail++
				failedIDs = append(failedIDs, s.ID)
				failures = append(failures, BastionBootstrapFailure{ID: s.ID, Step: "decrypt_key", Reason: err.Error()})
				logHostErr(jobID, s, "decrypt_key", err)
				_ = setServerStatus(db, s.ID, "failed")
				continue
			}

			// 4) SSH + install docker
			host := net.JoinHostPort(*s.PublicIPAddress, "22")
			runCtx, cancel := context.WithTimeout(ctx, perHostTimeout)
			out, err := sshInstallDockerWithOutput(runCtx, db, s, host, s.SSHUser, []byte(privKey))
			cancel()

			if err != nil {
				fail++
				failedIDs = append(failedIDs, s.ID)
				failures = append(failures, BastionBootstrapFailure{ID: s.ID, Step: "ssh_install", Reason: err.Error()})
				// include a short tail of output to speed debugging without flooding logs
				tail := out
				if len(tail) > 800 {
					tail = tail[len(tail)-800:]
				}
				logHostErr(jobID, s, "ssh_install", fmt.Errorf("%v | tail=%q", err, tail))
				_ = setServerStatus(db, s.ID, "failed")
				continue
			}

			// 5) Mark ready
			if err := setServerStatus(db, s.ID, "ready"); err != nil {
				fail++
				failedIDs = append(failedIDs, s.ID)
				failures = append(failures, BastionBootstrapFailure{ID: s.ID, Step: "set_ready", Reason: err.Error()})
				logHostErr(jobID, s, "set_ready", err)
				_ = setServerStatus(db, s.ID, "failed")
				continue
			}
			ok++
		}

		res := BastionBootstrapResult{
			Status:       "ok",
			Processed:    proc,
			Ready:        ok,
			Failed:       fail,
			ElapsedMs:    int(time.Since(start).Milliseconds()),
			FailedServer: failedIDs,
			Failures:     failures,
		}

		log.Debug().Int("processed", proc).Int("ready", ok).Int("failed", fail).Msg("[bastion] reconcile tick ok")

		next := time.Now().Add(time.Duration(args.IntervalS) * time.Second)
		_, _ = jobs.Enqueue(
			ctx,
			uuid.NewString(),
			"bootstrap_bastion",
			args,
			archer.WithScheduleTime(next),
			archer.WithMaxRetries(1),
		)
		return res, nil
	}
}

// ----- Helpers -----

func setServerStatus(db *gorm.DB, id uuid.UUID, status string) error {
	return db.Model(&models.Server{}).
		Where("id = ?", id).
		Updates(map[string]any{
			"status":     status,
			"updated_at": time.Now(),
		}).Error
}

// uniform log helpers for consistent, greppable output
func logHostErr(jobID string, s *models.Server, step string, err error) {
	ip := ""
	if s.PublicIPAddress != nil {
		ip = *s.PublicIPAddress
	}
	log.Printf("[bastion] level=ERROR job=%s server_id=%s host=%s step=%s msg=%q",
		jobID, s.ID, ip, step, err)
}

func logHostInfo(jobID string, s *models.Server, step, msg string, kv ...any) {
	ip := ""
	if s.PublicIPAddress != nil {
		ip = *s.PublicIPAddress
	}
	log.Printf("[bastion] level=INFO job=%s server_id=%s host=%s step=%s %s kv=%v",
		jobID, s.ID, ip, step, msg, kv)
}

// ----- SSH & command execution -----

// returns combined stdout/stderr so caller can log it on error
func sshInstallDockerWithOutput(
	ctx context.Context,
	db *gorm.DB,
	s *models.Server,
	host, user string,
	privateKeyPEM []byte,
) (string, error) {
	signer, err := ssh.ParsePrivateKey(privateKeyPEM)
	if err != nil {
		return "", fmt.Errorf("parse private key: %w", err)
	}

	hkcb := makeDBHostKeyCallback(db, s)

	config := &ssh.ClientConfig{
		User:            user,
		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
		HostKeyCallback: hkcb,
		Timeout:         30 * time.Second,
	}

	// context-aware dial
	dialer := &net.Dialer{}
	conn, err := dialer.DialContext(ctx, "tcp", host)
	if err != nil {
		return "", fmt.Errorf("dial: %w", err)
	}
	defer conn.Close()

	c, chans, reqs, err := ssh.NewClientConn(conn, host, config)
	if err != nil {
		return "", fmt.Errorf("ssh handshake: %w", err)
	}
	client := ssh.NewClient(c, chans, reqs)
	defer client.Close()

	sess, err := client.NewSession()
	if err != nil {
		return "", fmt.Errorf("session: %w", err)
	}
	defer sess.Close()

	// --- script to run remotely (no extra quoting) ---
	script := `
set -euxo pipefail

# ----------- toggles (set to 0 to skip) -----------
: "${BASELINE_PKGS:=1}"
: "${INSTALL_DOCKER:=1}"
: "${SSH_HARDEN:=1}"
: "${FIREWALL:=1}"
: "${AUTO_UPDATES:=1}"
: "${TIME_SYNC:=1}"
: "${FAIL2BAN:=1}"
: "${BANNER:=1}"
: "${APT_LOCK_WAIT_SECS:=300}"

# ----------- helpers -----------
have() { command -v "$1" >/dev/null 2>&1; }

# Wait for dpkg/apt locks to be released (handles cloud-init, unattended-upgrades, etc.)
apt_wait_lock() {
  local max_wait="$APT_LOCK_WAIT_SECS" waited=0
  local lock_files="/var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/lib/apt/lists/lock /var/cache/apt/archives/lock"

  # Determine which tool to check lock holders
  local check_cmd=""
  if have fuser; then
    check_cmd="fuser"
  elif have lsof; then
    check_cmd="lsof"
  else
    echo "WARNING: neither fuser nor lsof available, skipping apt lock wait" >&2
    return 0
  fi

  while [ $waited -lt $max_wait ]; do
    local locked=false
    if [ "$check_cmd" = "fuser" ]; then
      sudo fuser $lock_files >/dev/null 2>&1 && locked=true
    else
      sudo lsof $lock_files >/dev/null 2>&1 && locked=true
    fi
    if ! $locked; then
      return 0
    fi
    echo "Waiting for apt/dpkg lock to be released... (${waited}s/${max_wait}s)"
    sleep 5
    waited=$((waited + 5))
  done
  echo "WARNING: apt/dpkg lock still held after ${max_wait}s, proceeding anyway" >&2
}

pm=""
if have apt-get; then pm="apt"
elif have dnf; then pm="dnf"
elif have yum; then pm="yum"
elif have zypper; then pm="zypper"
elif have apk; then pm="apk"
fi

pm_update_install() {
  case "$pm" in
    apt)
      apt_wait_lock
      sudo apt-get update -y
      sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
      ;;
    dnf)    sudo dnf install -y "$@" ;;
    yum)    sudo yum install -y "$@" ;;
    zypper) sudo zypper --non-interactive install -y "$@" || true ;;
    apk)    sudo apk add --no-cache "$@" ;;
    *)
      echo "Unsupported distro: couldn't detect package manager" >&2
      return 1
      ;;
  esac
}

systemd_enable_now() {
  if have systemctl; then
    sudo systemctl enable --now "$1" || true
  fi
}

sshd_reload() {
  if have systemctl && systemctl is-enabled ssh >/dev/null 2>&1; then
    sudo systemctl reload ssh || true
  elif have systemctl && systemctl is-enabled sshd >/dev/null 2>&1; then
    sudo systemctl reload sshd || true
  fi
}

# ----------- baseline packages -----------
if [ "$BASELINE_PKGS" = "1" ] && [ -n "$pm" ]; then
  pkgs_common="curl ca-certificates gnupg git jq unzip tar vim tmux htop net-tools"
  case "$pm" in
    apt)   pkgs="$pkgs_common ufw openssh-client" ;;
    dnf|yum) pkgs="$pkgs_common firewalld openssh-clients" ;;
    zypper)  pkgs="$pkgs_common firewalld openssh" ;;
    apk)     pkgs="$pkgs_common openssh-client" ;;
  esac
  pm_update_install $pkgs || true
fi

# ----------- docker & compose v2 -----------
if [ "$INSTALL_DOCKER" = "1" ]; then
  if ! have docker; then
    if [ "$pm" = "apt" ]; then apt_wait_lock; fi
    curl -fsSL https://get.docker.com | sh
  fi

  # try to enable/start (handles distros with systemd)
  if have systemctl; then
    sudo systemctl enable --now docker || true
  fi

  # add current ssh user to docker group if exists
  if getent group docker >/dev/null 2>&1; then
    sudo usermod -aG docker "$(id -un)" || true
  fi

  # docker compose v2 (plugin) if missing
  if ! docker compose version >/dev/null 2>&1; then
    # Try package first (Debian/Ubuntu name)
    if [ "$pm" = "apt" ]; then
      apt_wait_lock
      sudo apt-get update -y
      sudo apt-get install -y docker-compose-plugin || true
    fi

    # Fallback: install static plugin binary under ~/.docker/cli-plugins
    if ! docker compose version >/dev/null 2>&1; then
      mkdir -p ~/.docker/cli-plugins
      arch="$(uname -m)"
      case "$arch" in
        x86_64|amd64) arch="x86_64" ;;
        aarch64|arm64) arch="aarch64" ;;
      esac
      curl -fsSL -o ~/.docker/cli-plugins/docker-compose \
        "https://github.com/docker/compose/releases/download/v2.29.7/docker-compose-$(uname -s)-$arch"
      chmod +x ~/.docker/cli-plugins/docker-compose
    fi
  fi
fi

# ----------- SSH hardening (non-destructive: separate conf file) -----------
if [ "$SSH_HARDEN" = "1" ]; then
  confd="/etc/ssh/sshd_config.d"
  if [ -d "$confd" ] && [ -w "$confd" ]; then
    sudo tee "$confd/10-bastion.conf" >/dev/null <<'EOF'
# Bastion hardening
PasswordAuthentication no
ChallengeResponseAuthentication no
KbdInteractiveAuthentication no
UsePAM yes
PermitEmptyPasswords no
PubkeyAuthentication yes
ClientAliveInterval 300
ClientAliveCountMax 2
LoginGraceTime 20
MaxAuthTries 3
MaxSessions 10
AllowAgentForwarding no
X11Forwarding no
EOF
    sshd_reload
  else
    echo "Skipping SSH hardening: $confd not present or not writable" >&2
  fi

  # lock root password (no effect if already locked)
  if have passwd; then
    sudo passwd -l root || true
  fi
fi

# ----------- firewall -----------
if [ "$FIREWALL" = "1" ]; then
  if have ufw; then
    # Keep it minimal: allow SSH and rate-limit
    sudo ufw --force reset || true
    sudo ufw default deny incoming
    sudo ufw default allow outgoing
    sudo ufw allow OpenSSH || sudo ufw allow 22/tcp
    sudo ufw limit OpenSSH || true
    sudo ufw --force enable
  elif have firewall-cmd; then
    systemd_enable_now firewalld
    sudo firewall-cmd --permanent --add-service=ssh || sudo firewall-cmd --permanent --add-port=22/tcp
    sudo firewall-cmd --reload || true
  else
    echo "No supported firewall tool detected; skipping." >&2
  fi
fi

# ----------- unattended / automatic updates -----------
if [ "$AUTO_UPDATES" = "1" ] && [ -n "$pm" ]; then
  case "$pm" in
    apt)
      pm_update_install unattended-upgrades apt-listchanges || true
      sudo dpkg-reconfigure -f noninteractive unattended-upgrades || true
      sudo tee /etc/apt/apt.conf.d/20auto-upgrades >/dev/null <<'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";
EOF
      ;;
    dnf)
      pm_update_install dnf-automatic || true
      sudo sed -i 's/^apply_updates = .*/apply_updates = yes/' /etc/dnf/automatic.conf || true
      systemd_enable_now dnf-automatic.timer
      ;;
    yum)
      pm_update_install yum-cron || true
      sudo sed -i 's/apply_updates = no/apply_updates = yes/' /etc/yum/yum-cron.conf || true
      systemd_enable_now yum-cron
      ;;
    zypper)
      pm_update_install pkgconf-pkg-config || true
      # SUSE has automatic updates via transactional-update / yast2-online-update; skipping heavy config.
      ;;
    apk)
      # Alpine: no official unattended updater; consider periodic 'apk upgrade' via cron (skipped by default).
      ;;
  esac
fi

# ----------- time sync -----------
if [ "$TIME_SYNC" = "1" ]; then
  if have timedatectl; then
    # Prefer systemd-timesyncd if available; else install/enable chrony
    if [ -f /lib/systemd/system/systemd-timesyncd.service ] || [ -f /usr/lib/systemd/system/systemd-timesyncd.service ]; then
      systemd_enable_now systemd-timesyncd
    else
      pm_update_install chrony || true
      systemd_enable_now chronyd || systemd_enable_now chrony || true
    fi
    timedatectl set-ntp true || true
  else
    pm_update_install chrony || true
    systemd_enable_now chronyd || systemd_enable_now chrony || true
  fi
fi

# ----------- fail2ban (basic sshd jail) -----------
if [ "$FAIL2BAN" = "1" ]; then
  pm_update_install fail2ban || true
  if [ -d /etc/fail2ban ]; then
    sudo tee /etc/fail2ban/jail.d/sshd.local >/dev/null <<'EOF'
[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
maxretry = 4
bantime = 1h
findtime = 10m
EOF
    systemd_enable_now fail2ban
  fi
fi

# ----------- SSH banner / MOTD -----------
if [ "$BANNER" = "1" ]; then
  if [ -w /etc/issue.net ] || sudo test -w /etc/issue.net; then
    sudo tee /etc/issue.net >/dev/null <<'EOF'
NOTICE: Authorized use only. Activity may be monitored and reported.
EOF
    # Ensure banner is enabled via our bastion conf
    if [ -d /etc/ssh/sshd_config.d ]; then
      if ! grep -q '^Banner ' /etc/ssh/sshd_config.d/10-bastion.conf 2>/dev/null; then
        echo 'Banner /etc/issue.net' | sudo tee -a /etc/ssh/sshd_config.d/10-bastion.conf >/dev/null
        sshd_reload
      fi
    fi
  fi
fi

echo "Bootstrap complete. If you were added to the docker group, log out and back in to apply."
`

	// Send script via stdin to avoid quoting/escaping issues
	sess.Stdin = strings.NewReader(script)

	// Capture combined stdout+stderr
	out, runErr := sess.CombinedOutput("bash -s")
	return string(out), wrapSSHError(runErr, string(out))
}

// annotate common SSH/remote failure modes to speed triage
func wrapSSHError(err error, output string) error {
	if err == nil {
		return nil
	}
	switch {
	case strings.Contains(output, "Could not resolve host"):
		return fmt.Errorf("remote run: name resolution failed: %w", err)
	case strings.Contains(output, "Permission denied"):
		return fmt.Errorf("remote run: permission denied (check user/key/authorized_keys): %w", err)
	case strings.Contains(output, "apt-get"):
		return fmt.Errorf("remote run: apt failed: %w", err)
	case strings.Contains(output, "yum"):
		return fmt.Errorf("remote run: yum failed: %w", err)
	default:
		return fmt.Errorf("remote run: %w", err)
	}
}

// super simple escaping for a here-string; avoids quoting hell
func sshEscape(s string) string {
	return fmt.Sprintf("%q", s)
}

// makeDBHostKeyCallback returns a HostKeyCallback bound to a specific server row.
// TOFU semantics:
//   - If s.SSHHostKey is empty: store the current key in DB and accept.
//   - If s.SSHHostKey is set: require exact match, else error (possible MITM/reinstall).
func makeDBHostKeyCallback(db *gorm.DB, s *models.Server) ssh.HostKeyCallback {
	return func(hostname string, remote net.Addr, key ssh.PublicKey) error {
		algo := key.Type()
		enc := base64.StdEncoding.EncodeToString(key.Marshal())

		// First-time connect: persist key (TOFU).
		if s.SSHHostKey == "" {
			if err := db.Model(&models.Server{}).
				Where("id = ? AND (ssh_host_key IS NULL or ssh_host_key = '')", s.ID).
				Updates(map[string]any{
					"ssh_host_key":      enc,
					"ssh_host_key_algo": algo,
				}).Error; err != nil {
				return fmt.Errorf("store new host key for %s (%s): %w", hostname, s.ID, err)
			}

			s.SSHHostKey = enc
			s.SSHHostKeyAlgo = algo
			return nil
		}

		if s.SSHHostKeyAlgo != algo || s.SSHHostKey != enc {
			return fmt.Errorf(
				"host key mismatch for %s (server_id=%s, stored=%s/%s, got=%s/%s) - POSSIBLE MITM or host reinstalled",
				hostname, s.ID, s.SSHHostKeyAlgo, s.SSHHostKey, algo, enc,
			)
		}
		return nil
	}
}
</file>

<file path="ui/src/api/actions.ts">
import { withRefresh } from "@/api/with-refresh.ts"
import type { DtoCreateActionRequest, DtoUpdateActionRequest } from "@/sdk"
import { makeActionsApi } from "@/sdkClient.ts"

const actions = makeActionsApi()
export const actionsApi = {
  listActions: () =>
    withRefresh(async () => {
      return await actions.listActions()
    }),
  createAction: (body: DtoCreateActionRequest) =>
    withRefresh(async () => {
      return await actions.createAction({
        createActionRequest: body,
      })
    }),
  updateAction: (id: string, body: DtoUpdateActionRequest) =>
    withRefresh(async () => {
      return await actions.updateAction({
        actionID: id,
        updateActionRequest: body,
      })
    }),
  deleteAction: (id: string) =>
    withRefresh(async () => {
      await actions.deleteAction({
        actionID: id,
      })
    }),
}
</file>

<file path="ui/src/api/annotations.ts">
import { withRefresh } from "@/api/with-refresh.ts"
import type { DtoCreateAnnotationRequest, DtoUpdateAnnotationRequest } from "@/sdk"
import { makeAnnotationsApi } from "@/sdkClient.ts"

const annotations = makeAnnotationsApi()
export const annotationsApi = {
  listAnnotations: () =>
    withRefresh(async () => {
      return await annotations.listAnnotations()
    }),
  createAnnotation: (body: DtoCreateAnnotationRequest) =>
    withRefresh(async () => {
      return await annotations.createAnnotation({
        createAnnotationRequest: body,
      })
    }),
  getAnnotation: (id: string) =>
    withRefresh(async () => {
      return await annotations.getAnnotation({ id })
    }),
  deleteAnnotation: (id: string) =>
    withRefresh(async () => {
      await annotations.deleteAnnotation({ id })
    }),
  updateAnnotation: (id: string, body: DtoUpdateAnnotationRequest) =>
    withRefresh(async () => {
      return await annotations.updateAnnotation({
        id,
        updateAnnotationRequest: body,
      })
    }),
}
</file>

<file path="ui/src/api/archer_admin.ts">
import { withRefresh } from "@/api/with-refresh.ts"
import type { AdminListArcherJobsRequest } from "@/sdk"
import { makeArcherAdminApi } from "@/sdkClient.ts"

const archerAdmin = makeArcherAdminApi()

export const archerAdminApi = {
  listJobs: (params: AdminListArcherJobsRequest = {}) => {
    return withRefresh(async () => {
      return await archerAdmin.adminListArcherJobs(params)
    })
  },
  enqueue: (body: {
    queue: string
    type: string
    payload?: object | undefined
    run_at?: string
  }) => {
    return withRefresh(async () => {
      return await archerAdmin.adminEnqueueArcherJob({ adminEnqueueArcherJobRequest: body })
    })
  },
  retryJob: (id: string) => {
    return withRefresh(async () => {
      return await archerAdmin.adminRetryArcherJob({ id })
    })
  },
  cancelJob: (id: string) => {
    return withRefresh(async () => {
      return await archerAdmin.adminCancelArcherJob({ id })
    })
  },
  listQueues: () => {
    return withRefresh(async () => {
      return await archerAdmin.adminListArcherQueues()
    })
  },
}
</file>

<file path="ui/src/api/clusters.ts">
import { withRefresh } from "@/api/with-refresh";
import type { DtoAttachBastionRequest, DtoAttachCaptainDomainRequest, DtoAttachLoadBalancerRequest, DtoAttachRecordSetRequest, DtoCreateClusterRequest, DtoSetKubeconfigRequest, DtoUpdateClusterRequest } from "@/sdk";
import { makeClusterApi, makeClusterRunsApi } from "@/sdkClient";





const clusters = makeClusterApi()
const clusterRuns = makeClusterRunsApi()

export const clustersApi = {
  // --- basic CRUD ---

  listClusters: (q?: string) =>
    withRefresh(async () => {
      return await clusters.listClusters(q ? { q } : {})
    }),

  getCluster: (id: string) =>
    withRefresh(async () => {
      return await clusters.getCluster({ clusterID: id })
    }),

  createCluster: (body: DtoCreateClusterRequest) =>
    withRefresh(async () => {
      return await clusters.createCluster({
        createClusterRequest: body,
      })
    }),

  updateCluster: (id: string, body: DtoUpdateClusterRequest) =>
    withRefresh(async () => {
      return await clusters.updateCluster({
        clusterID: id,
        updateClusterRequest: body,
      })
    }),

  deleteCluster: (id: string) =>
    withRefresh(async () => {
      return await clusters.deleteCluster({ clusterID: id })
    }),

  // --- kubeconfig ---

  setKubeconfig: (clusterID: string, body: DtoSetKubeconfigRequest) =>
    withRefresh(async () => {
      return await clusters.setClusterKubeconfig({
        clusterID,
        setClusterKubeconfigRequest: body,
      })
    }),

  clearKubeconfig: (clusterID: string) =>
    withRefresh(async () => {
      return await clusters.clearClusterKubeconfig({ clusterID })
    }),

  // --- captain domain ---

  attachCaptainDomain: (clusterID: string, body: DtoAttachCaptainDomainRequest) =>
    withRefresh(async () => {
      return await clusters.attachCaptainDomain({
        clusterID,
        attachCaptainDomainRequest: body,
      })
    }),

  detachCaptainDomain: (clusterID: string) =>
    withRefresh(async () => {
      return await clusters.detachCaptainDomain({ clusterID })
    }),

  // --- control plane record set ---

  attachControlPlaneRecordSet: (clusterID: string, body: DtoAttachRecordSetRequest) =>
    withRefresh(async () => {
      return await clusters.attachControlPlaneRecordSet({
        clusterID,
        attachControlPlaneRecordSetRequest: body,
      })
    }),

  detachControlPlaneRecordSet: (clusterID: string) =>
    withRefresh(async () => {
      return await clusters.detachControlPlaneRecordSet({ clusterID })
    }),

  // --- load balancers ---

  attachAppsLoadBalancer: (clusterID: string, body: DtoAttachLoadBalancerRequest) =>
    withRefresh(async () => {
      return await clusters.attachAppsLoadBalancer({
        clusterID,
        attachAppsLoadBalancerRequest: body,
      })
    }),

  detachAppsLoadBalancer: (clusterID: string) =>
    withRefresh(async () => {
      return await clusters.detachAppsLoadBalancer({ clusterID })
    }),

  attachGlueOpsLoadBalancer: (clusterID: string, body: DtoAttachLoadBalancerRequest) =>
    withRefresh(async () => {
      return await clusters.attachGlueOpsLoadBalancer({
        clusterID,
        attachAppsLoadBalancerRequest: body,
      })
    }),

  detachGlueOpsLoadBalancer: (clusterID: string) =>
    withRefresh(async () => {
      return await clusters.detachGlueOpsLoadBalancer({ clusterID })
    }),

  // --- bastion ---

  attachBastion: (clusterID: string, body: DtoAttachBastionRequest) =>
    withRefresh(async () => {
      return await clusters.attachBastionServer({
        clusterID,
        attachBastionServerRequest: body,
      })
    }),

  detachBastion: (clusterID: string) =>
    withRefresh(async () => {
      return await clusters.detachBastionServer({ clusterID })
    }),

  // -- node-pools

  attachNodePool: (clusterID: string, nodePoolID: string) =>
    withRefresh(async () => {
      return await clusters.attachNodePool({
        clusterID,
        attachNodePoolRequest: { node_pool_id: nodePoolID },
      })
    }),

  detachNodePool: (clusterID: string, nodePoolID: string) =>
    withRefresh(async () => {
      return await clusters.detachNodePool({ clusterID, nodePoolID })
    }),

  // --- cluster runs / actions ---
  listClusterRuns: (clusterID: string) =>
    withRefresh(async () => {
      return await clusterRuns.listClusterRuns({ clusterID })
    }),

  getClusterRun: (clusterID: string, runID: string) =>
    withRefresh(async () => {
      return await clusterRuns.getClusterRun({ clusterID, runID })
    }),

  runClusterAction: (clusterID: string, actionID: string) =>
    withRefresh(async () => {
      return await clusterRuns.runClusterAction({ clusterID, actionID })
    }),
}
</file>

<file path="ui/src/api/credentials.ts">
import { withRefresh } from "@/api/with-refresh.ts"
import type { DtoCreateCredentialRequest, DtoUpdateCredentialRequest } from "@/sdk"
import { makeCredentialsApi } from "@/sdkClient.ts"

const credentials = makeCredentialsApi()

export const credentialsApi = {
  listCredentials: () =>
    withRefresh(async () => {
      return await credentials.listCredentials()
    }),
  createCredential: async (body: DtoCreateCredentialRequest) =>
    withRefresh(async () => {
      return await credentials.createCredential({ createCredentialRequest: body })
    }),
  getCredential: async (id: string) =>
    withRefresh(async () => {
      return await credentials.getCredential({ id })
    }),
  deleteCredential: async (id: string) =>
    withRefresh(async () => {
      await credentials.deleteCredential({ id })
    }),
  updateCredential: async (id: string, body: DtoUpdateCredentialRequest) =>
    withRefresh(async () => {
      return await credentials.updateCredential({ id, updateCredentialRequest: body })
    }),
  revealCredential: async (id: string) =>
    withRefresh(async () => {
      return await credentials.revealCredential({ id })
    }),
}
</file>

<file path="ui/src/api/dns.ts">
import { withRefresh } from "@/api/with-refresh.ts"
import type {
  DtoCreateDomainRequest,
  DtoCreateRecordSetRequest,
  DtoUpdateDomainRequest,
  DtoUpdateRecordSetRequest,
} from "@/sdk"
import { makeDnsApi } from "@/sdkClient.ts"

const dns = makeDnsApi()

export const dnsApi = {
  listDomains: () =>
    withRefresh(async () => {
      return await dns.listDomains()
    }),
  getDomain: (id: string) =>
    withRefresh(async () => {
      return await dns.getDomain({ id })
    }),
  createDomain: async (body: DtoCreateDomainRequest) =>
    withRefresh(async () => {
      return await dns.createDomain({ createDomainRequest: body })
    }),
  updateDomain: async (id: string, body: DtoUpdateDomainRequest) =>
    withRefresh(async () => {
      return await dns.updateDomain({ id, updateDomainRequest: body })
    }),
  deleteDomain: async (id: string) =>
    withRefresh(async () => {
      return await dns.deleteDomain({ id })
    }),
  listRecordSetsByDomain: async (domainId: string) =>
    withRefresh(async () => {
      return await dns.listRecordSets({ domainId })
    }),
  createRecordSetsByDomain: async (domainId: string, body: DtoCreateRecordSetRequest) =>
    withRefresh(async () => {
      return await dns.createRecordSet({ domainId, createRecordSetRequest: body })
    }),
  updateRecordSetsByDomain: async (id: string, body: DtoUpdateRecordSetRequest) =>
    withRefresh(async () => {
      return await dns.updateRecordSet({ id, updateRecordSetRequest: body })
    }),
  deleteRecordSetsByDomain: async (id: string) =>
    withRefresh(async () => {
      return await dns.deleteRecordSet({ id })
    }),
}
</file>

<file path="ui/src/api/labels.ts">
import { withRefresh } from "@/api/with-refresh.ts"
import type { DtoCreateLabelRequest, DtoUpdateLabelRequest } from "@/sdk"
import { makeLabelsApi } from "@/sdkClient.ts"

const labels = makeLabelsApi()

export const labelsApi = {
  listLabels: () =>
    withRefresh(async () => {
      return await labels.listLabels()
    }),
  createLabel: (body: DtoCreateLabelRequest) =>
    withRefresh(async () => {
      return await labels.createLabel({ createLabelRequest: body })
    }),
  getLabel: (id: string) =>
    withRefresh(async () => {
      return await labels.getLabel({ id })
    }),
  deleteLabel: (id: string) =>
    withRefresh(async () => {
      await labels.deleteLabel({ id })
    }),
  updateLabel: (id: string, body: DtoUpdateLabelRequest) =>
    withRefresh(async () => {
      return await labels.updateLabel({ id, updateLabelRequest: body })
    }),
}
</file>

<file path="ui/src/api/loadbalancers.ts">
import { withRefresh } from "@/api/with-refresh"
import type { DtoCreateLoadBalancerRequest, DtoUpdateLoadBalancerRequest } from "@/sdk"
import { makeLoadBalancerApi } from "@/sdkClient"

const loadBalancers = makeLoadBalancerApi()
export const loadBalancersApi = {
  listLoadBalancers: () =>
    withRefresh(async () => {
      return await loadBalancers.listLoadBalancers()
    }),
  getLoadBalancer: (id: string) =>
    withRefresh(async () => {
      return await loadBalancers.getLoadBalancers({ id })
    }),
  createLoadBalancer: (body: DtoCreateLoadBalancerRequest) =>
    withRefresh(async () => {
      return await loadBalancers.createLoadBalancer({
        createLoadBalancerRequest: body,
      })
    }),
  updateLoadBalancer: (id: string, body: DtoUpdateLoadBalancerRequest) =>
    withRefresh(async () => {
      return await loadBalancers.updateLoadBalancer({
        id,
        updateLoadBalancerRequest: body,
      })
    }),
  deleteLoadBalancer: (id: string) =>
    withRefresh(async () => {
      return await loadBalancers.deleteLoadBalancer({ id })
    }),
}
</file>

<file path="ui/src/api/me.ts">
import { withRefresh } from "@/api/with-refresh.ts";
import type { HandlersCreateUserKeyRequest, HandlersMeResponse, HandlersUpdateMeRequest, HandlersUserAPIKeyOut, ModelsUser } from "@/sdk";
import { makeMeApi, makeMeKeysApi } from "@/sdkClient.ts";





const me = makeMeApi()
const keys = makeMeKeysApi()

export type MeResponse = HandlersMeResponse & ModelsUser

export const meApi = {
  getMe: () =>
    withRefresh(async (): Promise<MeResponse> => {
      return await me.getMe()
    }),

  updateMe: (body: HandlersUpdateMeRequest) =>
    withRefresh(async (): Promise<ModelsUser> => {
      return await me.updateMe({ updateMeRequest: body })
    }),

  listKeys: () =>
    withRefresh(async (): Promise<HandlersUserAPIKeyOut[]> => {
      return await keys.listUserAPIKeys()
    }),

  createKey: (body: HandlersCreateUserKeyRequest) =>
    withRefresh(async (): Promise<HandlersUserAPIKeyOut> => {
      return await keys.createUserAPIKey({ createUserAPIKeyRequest: body })
    }),

  deleteKey: (id: string) =>
    withRefresh(async (): Promise<boolean> => {
      await keys.deleteUserAPIKey({ id })
      return true
    }),
}
</file>

<file path="ui/src/api/node_pools.ts">
import { withRefresh } from "@/api/with-refresh.ts"
import type {
  DtoAttachAnnotationsRequest,
  DtoAttachLabelsRequest,
  DtoAttachServersRequest,
  DtoAttachTaintsRequest,
  DtoCreateNodePoolRequest,
  DtoUpdateNodePoolRequest,
} from "@/sdk"
import { makeNodePoolApi } from "@/sdkClient.ts"

const nodePools = makeNodePoolApi()
export const canAttachToPool = (poolRole: string | undefined, serverRole: string | undefined) => {
  if (!poolRole) return true
  return poolRole === serverRole
}

export const nodePoolsApi = {
  listNodePools: () =>
    withRefresh(async () => {
      return await nodePools.listNodePools({})
    }),
  createNodePool: (body: DtoCreateNodePoolRequest) =>
    withRefresh(async () => {
      return await nodePools.createNodePool({ createNodePoolRequest: body })
    }),
  getNodePool: (id: string) =>
    withRefresh(async () => {
      return await nodePools.getNodePool({ id })
    }),
  deleteNodePool: (id: string) =>
    withRefresh(async () => {
      await nodePools.deleteNodePool({ id })
    }),
  updateNodePool: (id: string, body: DtoUpdateNodePoolRequest) =>
    withRefresh(async () => {
      return await nodePools.updateNodePool({ id, updateNodePoolRequest: body })
    }),
  // Servers
  listNodePoolServers: (id: string) =>
    withRefresh(async () => {
      return await nodePools.listNodePoolServers({ id })
    }),
  attachNodePoolServer: (id: string, body: DtoAttachServersRequest) =>
    withRefresh(async () => {
      return await nodePools.attachNodePoolServers({ id, attachNodePoolServersRequest: body })
    }),
  detachNodePoolServers: (id: string, serverId: string) =>
    withRefresh(async () => {
      return await nodePools.detachNodePoolServer({ id, serverId })
    }),
  // Taints
  listNodePoolTaints: (id: string) =>
    withRefresh(async () => {
      return await nodePools.listNodePoolTaints({ id })
    }),
  attachNodePoolTaints: (id: string, body: DtoAttachTaintsRequest) =>
    withRefresh(async () => {
      return await nodePools.attachNodePoolTaints({ id, attachNodePoolTaintsRequest: body })
    }),
  detachNodePoolTaints: (id: string, taintId: string) =>
    withRefresh(async () => {
      return await nodePools.detachNodePoolTaint({ id, taintId })
    }),
  // Labels
  listNodePoolLabels: (id: string) =>
    withRefresh(async () => {
      return await nodePools.listNodePoolLabels({ id })
    }),
  attachNodePoolLabels: (id: string, body: DtoAttachLabelsRequest) =>
    withRefresh(async () => {
      return await nodePools.attachNodePoolLabels({ id, attachNodePoolLabelsRequest: body })
    }),
  detachNodePoolLabels: (id: string, labelId: string) =>
    withRefresh(async () => {
      return await nodePools.detachNodePoolLabel({ id, labelId })
    }),
  // Annotations
  listNodePoolAnnotations: (id: string) =>
    withRefresh(async () => {
      return await nodePools.listNodePoolAnnotations({ id })
    }),
  attachNodePoolAnnotations: (id: string, body: DtoAttachAnnotationsRequest) =>
    withRefresh(async () => {
      return await nodePools.attachNodePoolAnnotations({ id, attachNodePoolAnnotationsRequest: body })
    }),
  detachNodePoolAnnotations: (id: string, annotationId: string) =>
    withRefresh(async () => {
      return await nodePools.detachNodePoolAnnotation({ id, annotationId })
    }),
}
</file>

<file path="ui/src/api/servers.ts">
import { withRefresh } from "@/api/with-refresh.ts"
import type { DtoCreateServerRequest, DtoUpdateServerRequest } from "@/sdk"
import { makeServersApi } from "@/sdkClient.ts"

const servers = makeServersApi()

export const serversApi = {
  listServers: () =>
    withRefresh(async () => {
      return await servers.listServers()
    }),
  createServer: (body: DtoCreateServerRequest) =>
    withRefresh(async () => {
      return await servers.createServer({ createServerRequest: body })
    }),
  getServer: (id: string) =>
    withRefresh(async () => {
      return await servers.getServer({ id })
    }),
  updateServer: (id: string, body: DtoUpdateServerRequest) =>
    withRefresh(async () => {
      return await servers.updateServer({ id, updateServerRequest: body })
    }),
  deleteServer: (id: string) =>
    withRefresh(async () => {
      await servers.deleteServer({ id })
    }),
}
</file>

<file path="ui/src/api/ssh.ts">
import { withRefresh } from "@/api/with-refresh.ts"
import { orgStore } from "@/auth/org.ts"
import { authStore } from "@/auth/store.ts"
import type { DtoCreateSSHRequest, DtoSshResponse, DtoSshRevealResponse } from "@/sdk"
import { makeSshApi } from "@/sdkClient.ts"

const ssh = makeSshApi()
export type SshDownloadPart = "public" | "private" | "both"

function authHeaders() {
  const token = authStore.getAccessToken()
  const orgId = orgStore.get()
  return {
    ...(token ? { Authorization: `Bearer ${token}` } : {}),
    ...(orgId ? { "X-Org-ID": orgId } : {}),
  }
}

async function authedFetch(input: RequestInfo | URL, init: RequestInit = {}) {
  return fetch(input, {
    ...init,
    headers: { ...(init.headers as any), ...authHeaders() },
    credentials: "include", // keep if you rely on cookies/HttpOnly sessions
  })
}

export const sshApi = {
  listSshKeys: () =>
    withRefresh(async (): Promise<DtoSshResponse[]> => {
      return await ssh.listPublicSshKeys()
    }),

  createSshKey: (body: DtoCreateSSHRequest) =>
    withRefresh(async (): Promise<DtoSshResponse> => {
      // SDK expects { body }
      return await ssh.createSSHKey({ createSSHKeyRequest: body })
    }),

  getSshKeyById: (id: string) =>
    withRefresh(async (): Promise<DtoSshResponse> => {
      return await ssh.getSSHKey({ id })
    }),

  revealSshKeyById: (id: string) =>
    withRefresh(async (): Promise<DtoSshRevealResponse> => {
      // Create the URL for the reveal endpoint
      const url = new URL(`/api/v1/ssh/${id}`, window.location.origin)
      url.searchParams.set("reveal", "true") // Add the reveal query parameter

      // Use the custom fetch utility that includes authentication headers
      const res = await authedFetch(url.toString())
      if (!res.ok) throw new Error(`Failed to reveal key: ${res.statusText}`)

      // Parse the JSON directly, bypassing the generated SDK's DTO mapping.
      // This preserves the 'private_key' field.
      return (await res.json()) as DtoSshRevealResponse
    }),

  deleteSshKey: (id: string) =>
    withRefresh(async (): Promise<void> => {
      await ssh.deleteSSHKey({ id })
    }),

  // 1) JSON mode: returns structured JSON with filenames & (optionally) base64 zip
  downloadJson: (id: string, part: SshDownloadPart) =>
    withRefresh(async () => {
      const url = new URL(`/api/v1/ssh/${id}/download`, window.location.origin)
      url.searchParams.set("part", part)
      url.searchParams.set("mode", "json")

      const res = await authedFetch(url.toString())
      if (!res.ok) throw new Error(`Download failed: ${res.statusText}`)
      return (await res.json()) as {
        id: string
        name: string | null
        fingerprint: string
        filenames: string[]
        publicKey?: string | null
        privatePEM?: string | null
        zipBase64?: string | null
      }
    }),

  // 2) Attachment mode: returns a Blob (public/private file or a .zip)
  downloadBlob: (id: string, part: SshDownloadPart) =>
    withRefresh(async (): Promise<{ filename: string; blob: Blob }> => {
      const url = new URL(`/api/v1/ssh/${id}/download`, window.location.origin)
      url.searchParams.set("part", part)

      const res = await authedFetch(url.toString())
      if (!res.ok) throw new Error(`Download failed: ${res.statusText}`)

      // Parse filename from Content-Disposition
      const cd = res.headers.get("Content-Disposition") || ""
      const match = /filename="([^"]+)"/i.exec(cd)
      const filename = match?.[1] ?? "ssh-key-download"

      const blob = await res.blob()
      return { filename, blob }
    }),
}
</file>

<file path="ui/src/api/taints.ts">
import { withRefresh } from "@/api/with-refresh.ts"
import type { DtoCreateTaintRequest, DtoUpdateTaintRequest } from "@/sdk"
import { makeTaintsApi } from "@/sdkClient.ts"

const taints = makeTaintsApi()
export const taintsApi = {
  listTaints: () =>
    withRefresh(async () => {
      return await taints.listTaints()
    }),
  createTaint: (body: DtoCreateTaintRequest) =>
    withRefresh(async () => {
      return await taints.createTaint({ createTaintRequest: body })
    }),
  getTaint: (id: string) =>
    withRefresh(async () => {
      return await taints.getTaint({ id })
    }),
  deleteTaint: (id: string) =>
    withRefresh(async () => {
      await taints.deleteTaint({ id })
    }),
  updateTaint: (id: string, body: DtoUpdateTaintRequest) =>
    withRefresh(async () => {
      return await taints.updateTaint({ id, updateTaintRequest: body })
    }),
}
</file>

<file path="ui/src/auth/logout.ts">
import { authStore } from "@/auth/store.ts"
import type { DtoLogoutRequest } from "@/sdk"
import { makeAuthApi } from "@/sdkClient.ts"

export async function logoutEverywhere(): Promise<void> {
  const tokens = authStore.get()

  if (!tokens?.refresh_token) {
    authStore.logout()
    return
  }

  try {
    const body: DtoLogoutRequest = { refresh_token: tokens.refresh_token } as DtoLogoutRequest
    await makeAuthApi().logout({ logoutRequest: body })
  } catch (err) {
    console.warn("Logout API failed; clearing local state anyway", err)
  } finally {
    authStore.logout()
  }
}
</file>

<file path="ui/src/layouts/org-switcher.tsx">
import { useEffect, useState } from "react"
import { orgStore } from "@/auth/org.ts"
import { Building2, Check, ChevronsUpDown } from "lucide-react"

import { cn } from "@/lib/utils.ts"
import { Button } from "@/components/ui/button.tsx"
import {
  Command,
  CommandEmpty,
  CommandGroup,
  CommandInput,
  CommandItem,
  CommandList,
} from "@/components/ui/command.tsx"
import { Popover, PopoverContent, PopoverTrigger } from "@/components/ui/popover.tsx"

type Org = { id: string; name: string }

export const OrgSwitcher = ({ orgs }: { orgs: Org[] }) => {
  const [open, setOpen] = useState(false)
  const [value, setValue] = useState(orgStore.get() ?? "")

  useEffect(() => {
    return orgStore.subscribe((id) => setValue(id ?? ""))
  }, [])

  const selected = orgs.find((o) => o.id === value)

  return (
    <Popover open={open} onOpenChange={setOpen}>
      <PopoverTrigger asChild>
        <Button
          variant="ghost"
          className="h-9 w-full justify-between px-2"
          aria-label="Switch organization"
        >
          <span className="flex items-center gap-2 truncate">
            <Building2 className="h-4 w-4" />
            <span className="truncate">{selected?.name ?? "Select org"}</span>
          </span>
          <ChevronsUpDown className="ml-2 h-4 w-4 opacity-50" />
        </Button>
      </PopoverTrigger>
      <PopoverContent className="w-[280px] p-0" align="start">
        <Command>
          <CommandInput placeholder="Search orgs..." />
          <CommandList>
            <CommandEmpty>No orgs found.</CommandEmpty>
            <CommandGroup heading="Organizations">
              {orgs.map((org) => (
                <CommandItem
                  key={org.id}
                  value={org.id}
                  onSelect={(v) => {
                    orgStore.set(v)
                    setOpen(false)
                    // Reload page to refresh data for the new org
                    window.location.reload()
                  }}
                >
                  <Check
                    className={cn("mr-2 h-4 w-4", value === org.id ? "opacity-100" : "opacity-0")}
                  />
                  <span className="truncate">{org.name}</span>
                </CommandItem>
              ))}
            </CommandGroup>
          </CommandList>
        </Command>
      </PopoverContent>
    </Popover>
  )
}
</file>

<file path="ui/src/layouts/topbar.tsx">
import { useEffect, useMemo, useState } from "react"
import { ThemePillSwitcher } from "@/layouts/theme-switcher"
import { Link, useLocation } from "react-router-dom"

import { orgStore } from "@/auth/org.ts"
import { useMe } from "@/hooks/use-me.ts"
import { Avatar, AvatarFallback } from "@/components/ui/avatar.tsx"
import {
  Breadcrumb,
  BreadcrumbItem,
  BreadcrumbLink,
  BreadcrumbList,
  BreadcrumbPage,
  BreadcrumbSeparator,
} from "@/components/ui/breadcrumb.tsx"
import { Button } from "@/components/ui/button.tsx"
import { SidebarTrigger } from "@/components/ui/sidebar.tsx"

export const Topbar = () => {
  const loc = useLocation()
  const { data: me, isLoading } = useMe()
  const [orgId, setOrgId] = useState<string | null>(orgStore.get())

  useEffect(() => {
    return orgStore.subscribe((id) => setOrgId(id))
  }, [])

  const crumbs = useMemo(() => {
    const parts = loc.pathname.split("/").filter(Boolean)
    const acc: { to: string; label: string }[] = []
    let build = ""
    for (const p of parts) {
      build += `/${p}`
      acc.push({ to: build, label: p })
    }
    return acc
  }, [loc.pathname])

  const initials = useMemo(() => {
    if (!me) return "U"
    const name = me.display_name || me.primary_email || ""
    const parts = name.trim().split(/\s+/)
    if (parts.length >= 2) return (parts[0][0] + parts[1][0]).toUpperCase()
    if (parts.length === 1 && parts[0]) return parts[0][0]!.toUpperCase()
    return "U"
  }, [me])

  const activeOrg = useMemo(() => {
    if (!orgId || !me?.organizations) return null
    return me.organizations.find((o) => o.id === orgId)
  }, [orgId, me])

  return (
    <div className="flex h-12 items-center gap-2 border-b px-3">
      <SidebarTrigger />
      {activeOrg && (
        <div className="text-muted-foreground flex items-center gap-1.5 text-sm">
          <span className="font-medium">{activeOrg.name}</span>
          <span className="text-border">|</span>
        </div>
      )}
      <div className="flex-1">
        <Breadcrumb>
          <BreadcrumbList>
            <BreadcrumbItem>
              <BreadcrumbLink asChild>
                <Link to="/">Home</Link>
              </BreadcrumbLink>
            </BreadcrumbItem>
            {crumbs.map((c, i) => (
              <span key={c.to} className="flex items-center">
                <BreadcrumbSeparator />
                <BreadcrumbItem>
                  {i === crumbs.length - 1 ? (
                    <BreadcrumbPage className="capitalize">{c.label}</BreadcrumbPage>
                  ) : (
                    <BreadcrumbLink asChild>
                      <Link to={c.to} className="capitalize">
                        {c.label}
                      </Link>
                    </BreadcrumbLink>
                  )}
                </BreadcrumbItem>
              </span>
            ))}
          </BreadcrumbList>
        </Breadcrumb>
      </div>

      <ThemePillSwitcher variant="wide" />
      <Button variant="ghost" size="sm" asChild>
        <Link to="/me">{isLoading ? "…" : me?.display_name || "Profile"}</Link>
      </Button>

      <Avatar className="h-7 w-7">
        <AvatarFallback>{initials}</AvatarFallback>
      </Avatar>
    </div>
  )
}
</file>

<file path="ui/src/pages/org/api-keys.tsx">
import { useState } from "react"
import { withRefresh } from "@/api/with-refresh.ts"
import { orgStore } from "@/auth/org.ts"
import { makeOrgsApi } from "@/sdkClient.ts"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import { Badge } from "@/components/ui/badge.tsx"
import { Button } from "@/components/ui/button.tsx"
import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card.tsx"
import {
  Dialog,
  DialogContent,
  DialogFooter,
  DialogHeader,
  DialogTitle,
} from "@/components/ui/dialog.tsx"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form.tsx"
import { Input } from "@/components/ui/input.tsx"
import {
  Table,
  TableBody,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table.tsx"

// 1) No coerce; we’ll do the conversion in onChange
const createSchema = z.object({
  name: z.string(),
  expires_in_hours: z.number().int().min(1).max(43800),
})

type CreateValues = z.infer<typeof createSchema>

export const OrgApiKeys = () => {
  const api = makeOrgsApi()
  const qc = useQueryClient()
  const orgId = orgStore.get()

  const q = useQuery({
    enabled: !!orgId,
    queryKey: ["org:keys", orgId],
    queryFn: () => withRefresh(() => api.listOrgKeys({ id: orgId! })),
  })

  // 2) Form holds numbers directly
  const form = useForm<CreateValues>({
    resolver: zodResolver(createSchema),
    defaultValues: {
      name: "",
      expires_in_hours: 720,
    },
  })

  const [showSecret, setShowSecret] = useState<{
    key?: string
    secret?: string
  } | null>(null)

  const createMut = useMutation({
    mutationFn: (v: CreateValues) => api.createOrgKey({ id: orgId!, createOrgKeyRequest: v }),
    onSuccess: (resp) => {
      void qc.invalidateQueries({ queryKey: ["org:keys", orgId] })
      setShowSecret({ key: resp.org_key, secret: resp.org_secret })
      toast.success("Key created")
      form.reset({ name: "", expires_in_hours: 720 })
    },
    onError: (e: any) => toast.error(e?.message ?? "Failed to create key"),
  })

  const deleteMut = useMutation({
    mutationFn: (keyId: string) => api.deleteOrgKey({ id: orgId!, keyId }),
    onSuccess: () => {
      void qc.invalidateQueries({ queryKey: ["org:keys", orgId] })
      toast.success("Key deleted")
    },
    onError: (e: any) => toast.error(e?.message ?? "Failed to delete key"),
  })

  if (!orgId) return <p className="text-muted-foreground">Pick an organization.</p>
  if (q.isLoading) return <p>Loading...</p>
  if (q.error) return <p className="text-destructive">Failed to load keys.</p>

  return (
    <Card>
      <CardHeader>
        <CardTitle>Org API Keys</CardTitle>
      </CardHeader>
      <CardContent className="space-y-6">
        <Form {...form}>
          <form
            onSubmit={form.handleSubmit((v) => createMut.mutate(v))}
            className="grid grid-cols-1 items-end gap-3 md:grid-cols-12"
          >
            <div className="md:col-span-6">
              <FormField
                control={form.control}
                name="name"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Name</FormLabel>
                    <FormControl>
                      <Input placeholder="automation-bot" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />
            </div>

            <div className="md:col-span-4">
              <FormField
                control={form.control}
                name="expires_in_hours"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Expires In (hours)</FormLabel>
                    <FormControl>
                      <Input
                        type="number"
                        placeholder="e.g. 720"
                        {...field}
                        // 3) Convert string → number (or undefined if empty)
                        value={field.value ?? ""}
                        onChange={(e) => {
                          const v = e.target.value
                          field.onChange(v === "" ? undefined : Number(v))
                        }}
                      />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />
            </div>

            <div className="md:col-span-2">
              <Button type="submit" className="w-full" disabled={createMut.isPending}>
                Create
              </Button>
            </div>
          </form>
        </Form>

        <div className="overflow-x-auto rounded-md border">
          <Table>
            <TableHeader>
              <TableRow>
                <TableHead>Name</TableHead>
                <TableHead>Scope</TableHead>
                <TableHead>Created</TableHead>
                <TableHead>Expires</TableHead>
                <TableHead>Status</TableHead>
                <TableHead className="w-28" />
              </TableRow>
            </TableHeader>
            <TableBody>
              {q.data?.map((k) => (
                <TableRow key={k.id}>
                  <TableCell>{k.name ?? "-"}</TableCell>
                  <TableCell>{k.scope}</TableCell>
                  <TableCell>{new Date(k.created_at!).toLocaleString()}</TableCell>
                  <TableCell>
                    {k.expires_at ? new Date(k.expires_at).toLocaleString() : "-"}
                  </TableCell>
                  <TableCell>
                    {(() => {
                      const isExpired = k.expires_at ? new Date(k.expires_at) <= new Date() : false

                      if (k.revoked) {
                        return (
                          <Badge variant="destructive" className="font-mono">
                            Revoked
                          </Badge>
                        )
                      }

                      if (isExpired) {
                        return (
                          <Badge variant="outline" className="font-mono">
                            Expired
                          </Badge>
                        )
                      }

                      return (
                        <Badge variant="secondary" className="font-mono">
                          Active
                        </Badge>
                      )
                    })()}
                  </TableCell>
                  <TableCell className="text-right">
                    <Button variant="destructive" size="sm" onClick={() => deleteMut.mutate(k.id!)}>
                      Delete
                    </Button>
                  </TableCell>
                </TableRow>
              ))}
              {q.data?.length === 0 && (
                <TableRow>
                  <TableCell colSpan={5} className="text-muted-foreground p-4">
                    No keys.
                  </TableCell>
                </TableRow>
              )}
            </TableBody>
          </Table>
        </div>

        {/* Show once dialog with key/secret */}
        <Dialog open={!!showSecret} onOpenChange={(o) => !o && setShowSecret(null)}>
          <DialogContent>
            <DialogHeader>
              <DialogTitle>Copy your credentials</DialogTitle>
            </DialogHeader>
            <div className="space-y-2">
              <div>
                <div className="text-muted-foreground mb-1 text-xs">Org Key</div>
                <Input
                  readOnly
                  value={showSecret?.key ?? ""}
                  onFocus={(e) => e.currentTarget.select()}
                />
              </div>
              <div>
                <div className="text-muted-foreground mb-1 text-xs">Org Secret</div>
                <Input
                  readOnly
                  value={showSecret?.secret ?? ""}
                  onFocus={(e) => e.currentTarget.select()}
                />
              </div>
              <p className="text-muted-foreground text-xs">
                This secret is shown once. Store it securely.
              </p>
            </div>
            <DialogFooter>
              <Button onClick={() => setShowSecret(null)}>Done</Button>
            </DialogFooter>
          </DialogContent>
        </Dialog>
      </CardContent>
    </Card>
  )
}
</file>

<file path="ui/src/pages/org/members.tsx">
import { useMemo, useState } from "react";
import { withRefresh } from "@/api/with-refresh.ts";
import { orgStore } from "@/auth/org.ts";
import { makeOrgsApi } from "@/sdkClient.ts";
import { zodResolver } from "@hookform/resolvers/zod";
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
import { Loader2 } from "lucide-react";
import { useForm } from "react-hook-form";
import { toast } from "sonner";
import { z } from "zod";



import { Button } from "@/components/ui/button.tsx";
import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card.tsx";
import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from "@/components/ui/form.tsx";
import { Input } from "@/components/ui/input.tsx";
import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select.tsx";
import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table.tsx";





const addSchema = z.object({
  user_id: z.uuid("Invalid UUID"),
  role: z.enum(["owner", "admin", "member"]),
})
type AddValues = z.infer<typeof addSchema>

export const OrgMembers = () => {
  const api = makeOrgsApi()
  const qc = useQueryClient()
  const orgId = orgStore.get()
  const [updatingId, setUpdatingId] = useState<string | null>(null)

  const q = useQuery({
    enabled: !!orgId,
    queryKey: ["org:members", orgId],
    queryFn: () => withRefresh(() => api.listMembers({ id: orgId! })),
  })

  const ownersCount = useMemo(
    () => (q.data ?? []).filter((m) => m.role === "owner").length,
    [q.data]
  )

  const form = useForm<AddValues>({
    resolver: zodResolver(addSchema),
    defaultValues: {
      user_id: "",
      role: "member",
    },
  })

  const addMut = useMutation({
    mutationFn: (v: AddValues) => api.addOrUpdateMember({ id: orgId!, addOrUpdateMemberRequest: v }),
    onSuccess: () => {
      toast.success("Member added/updated")
      void qc.invalidateQueries({ queryKey: ["org:members", orgId] })
      form.reset({ user_id: "", role: "member" })
    },
    onError: (e: any) => toast.error(e?.message ?? "Failed"),
  })

  const removeMut = useMutation({
    mutationFn: (userId: string) => api.removeMember({ id: orgId!, userId }),
    onSuccess: () => {
      toast.success("Member removed")
      void qc.invalidateQueries({ queryKey: ["org:members", orgId] })
    },
    onError: (e: any) => toast.error(e?.message ?? "Failed"),
  })

  const roleMut = useMutation({
    mutationFn: ({ userId, role }: { userId: string; role: "owner" | "admin" | "member" }) =>
      api.addOrUpdateMember({ id: orgId!, addOrUpdateMemberRequest: { user_id: userId, role } }),
    onMutate: async ({ userId, role }) => {
      setUpdatingId(userId)
      // cancel queries and snapshot previous
      await qc.cancelQueries({ queryKey: ["org:members", orgId] })
      const prev = qc.getQueryData<any>(["org:members", orgId])
      // optimistic update
      qc.setQueryData(["org:members", orgId], (old: any[] = []) =>
        old.map((m) => (m.user_id === userId ? { ...m, role } : m))
      )
      return { prev }
    },
    onError: (e, _vars, ctx) => {
      if (ctx?.prev) qc.setQueryData(["org:members", orgId], ctx.prev)
      toast.error((e as any)?.message ?? "Failed to update role")
    },
    onSuccess: () => {
      toast.success("Role updated")
    },
    onSettled: () => {
      setUpdatingId(null)
      void qc.invalidateQueries({ queryKey: ["org:members", orgId] })
    },
  })

  const canDowngrade = (m: any) => !(m.role === "owner" && ownersCount <= 1)

  if (!orgId) return <p className="text-muted-foreground">Pick an organization.</p>
  if (q.isLoading) return <p>Loading...</p>
  if (q.error) return <p className="text-destructive">Failed to load members.</p>

  return (
    <Card>
      <CardHeader>
        <CardTitle>Members</CardTitle>
      </CardHeader>
      <CardContent className="space-y-6">
        {/* Add/Update */}
        <Form {...form}>
          <form
            className="grid grid-cols-1 items-end gap-3 md:grid-cols-12"
            onSubmit={form.handleSubmit((v) => addMut.mutate(v))}
          >
            <div className="md:col-span-6">
              <FormField
                control={form.control}
                name="user_id"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>User ID</FormLabel>
                    <FormControl>
                      <Input placeholder="UUID" {...field} />
                    </FormControl>
                    <FormMessage />
                  </FormItem>
                )}
              />
            </div>

            <div className="md:col-span-4">
              <FormField
                control={form.control}
                name="role"
                render={({ field }) => (
                  <FormItem>
                    <FormLabel>Role</FormLabel>
                    <Select onValueChange={field.onChange} value={field.value}>
                      <SelectTrigger>
                        <SelectValue placeholder="Select role" />
                      </SelectTrigger>
                      <SelectContent>
                        <SelectItem value="member">member</SelectItem>
                        <SelectItem value="admin">admin</SelectItem>
                        <SelectItem value="owner">owner</SelectItem>
                      </SelectContent>
                    </Select>
                    <FormMessage />
                  </FormItem>
                )}
              />
            </div>

            <div className="md:col-span-2">
              <Button type="submit" className="w-full" disabled={addMut.isPending}>
                Save
              </Button>
            </div>
          </form>
        </Form>

        <div className="overflow-x-auto rounded-md border">
          <Table>
            <TableHeader>
              <TableRow>
                <TableHead>Id</TableHead>
                <TableHead>User</TableHead>
                <TableHead>Role</TableHead>
                <TableHead className="w-28"></TableHead>
              </TableRow>
            </TableHeader>
            <TableBody>
              {q.data?.map((m) => {
                const isRowPending = updatingId === m.user_id
                return (
                  <TableRow key={m.user_id} className="align-middle">
                    <TableCell className="font-mono text-xs">{m.user_id}</TableCell>
                    <TableCell>{m.email}</TableCell>

                    {/* Inline role select */}
                    <TableCell className="capitalize">
                      <div className="flex items-center gap-2">
                        <Select
                          value={m.role}
                          onValueChange={(next) => {
                            if (m.role === next) return
                            if (m.role === "owner" && next !== "owner" && !canDowngrade(m)) {
                              toast.error("You cannot demote the last owner.")
                              return
                            }
                            roleMut.mutate({
                              userId: m.user_id!,
                              role: next as any,
                            })
                          }}
                          disabled={isRowPending}
                        >
                          <SelectTrigger className="h-8 w-[140px]">
                            <SelectValue />
                          </SelectTrigger>
                          <SelectContent>
                            <SelectItem value="member">member</SelectItem>
                            <SelectItem value="admin">admin</SelectItem>
                            <SelectItem value="owner">owner</SelectItem>
                          </SelectContent>
                        </Select>

                        {isRowPending && <Loader2 className="h-4 w-4 animate-spin" />}
                      </div>
                    </TableCell>

                    <TableCell className="text-right">
                      <Button
                        variant="destructive"
                        size="sm"
                        onClick={() => removeMut.mutate(m.user_id!)}
                        disabled={m.role === "owner" && ownersCount <= 1}
                        title={
                          m.role === "owner" && ownersCount <= 1
                            ? "Cannot remove the last owner"
                            : ""
                        }
                      >
                        Remove
                      </Button>
                    </TableCell>
                  </TableRow>
                )
              })}
              {q.data?.length === 0 && (
                <TableRow>
                  <TableCell colSpan={3} className="text-muted-foreground p-4">
                    No members.
                  </TableCell>
                </TableRow>
              )}
            </TableBody>
          </Table>
        </div>
      </CardContent>
    </Card>
  )
}
</file>

<file path="ui/src/pages/org/settings.tsx">
import { useEffect } from "react"
import { withRefresh } from "@/api/with-refresh.ts"
import { orgStore } from "@/auth/org.ts"
import { makeOrgsApi } from "@/sdkClient.ts"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import { Button } from "@/components/ui/button.tsx"
import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card.tsx"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form.tsx"
import { Input } from "@/components/ui/input.tsx"

/*
const isS3 = (c: DtoCredentialOut) =>
  c.provider === "aws" &&
  c.scope_kind === "service" &&
  // scope may be JSON; allow both object and stringified JSON
  (() => {
    const s = (c as any).scope
    try {
      const obj = typeof s === "string" ? JSON.parse(s) : s || {}
      return obj?.service === "s3"
    } catch {
      return false
    }
  })()
*/

const schema = z.object({
  name: z.string().min(1, "Required"),
  domain: z.string().optional(),
})

type Values = z.infer<typeof schema>

export const OrgSettings = () => {
  const api = makeOrgsApi()
  const qc = useQueryClient()
  const orgId = orgStore.get()

  const q = useQuery({
    enabled: !!orgId,
    queryKey: ["org", orgId],
    queryFn: () => withRefresh(() => api.getOrg({ id: orgId! })),
  })

  /*
  const credentialQ = useQuery({
    queryKey: ["credentials", "s3"],
    queryFn: () => credentialsApi.listCredentials(), // client-side filter
  })

  const s3Credentials = useMemo(() => (credentialQ.data ?? []).filter(isS3), [credentialQ.data])
  */
  const form = useForm<Values>({
    resolver: zodResolver(schema),
    defaultValues: {
      name: "",
      domain: "",
    },
  })

  useEffect(() => {
    if (q.data) {
      form.reset({
        name: q.data.name ?? "",
        domain: q.data.domain ?? "",
      })
    }
  }, [q.data, form])

  const updateMut = useMutation({
    mutationFn: (v: Partial<Values>) => api.updateOrg({ id: orgId!, updateOrgRequest: v }),
    onSuccess: () => {
      void qc.invalidateQueries({ queryKey: ["org", orgId] })
      toast.success("Organization updated")
    },
    onError: (e: any) => toast.error(e?.message ?? "Update failed"),
  })

  const deleteMut = useMutation({
    mutationFn: () => api.deleteOrg({ id: orgId! }),
    onSuccess: () => {
      toast.success("Organization deleted")
      orgStore.set("")
      void qc.invalidateQueries({ queryKey: ["orgs:mine"] })
    },
    onError: (e: any) => toast.error(e?.message ?? "Delete failed"),
  })

  if (!orgId) {
    return <p className="text-muted-foreground">Pick an organization.</p>
  }
  if (q.isLoading) return <p>Loading...</p>
  if (q.error) return <p className="text-destructive">Failed to load.</p>

  const onSubmit = (v: Values) => {
    const delta: Partial<Values> = {}
    if (v.name !== q.data?.name) delta.name = v.name
    const normDomain = v.domain?.trim() || undefined
    if ((normDomain ?? null) !== (q.data?.domain ?? null)) delta.domain = normDomain
    if (Object.keys(delta).length === 0) return
    updateMut.mutate(delta)
  }

  return (
    <Card>
      <CardHeader>
        <CardTitle>Organization Settings</CardTitle>
      </CardHeader>
      <CardContent className="space-y-6">
        <Form {...form}>
          <form className="space-y-4" onSubmit={form.handleSubmit(onSubmit)}>
            <FormField
              control={form.control}
              name="name"
              render={({ field }) => (
                <FormItem>
                  <FormLabel>Name</FormLabel>
                  <FormControl>
                    <Input {...field} />
                  </FormControl>
                  <FormMessage />
                </FormItem>
              )}
            />

            <FormField
              control={form.control}
              name="domain"
              render={({ field }) => (
                <FormItem>
                  <FormLabel>Domain (optional)</FormLabel>
                  <FormControl>
                    <Input placeholder="acme.com" {...field} />
                  </FormControl>
                  <FormMessage />
                </FormItem>
              )}
            />

            <div className="flex gap-2">
              <Button type="submit" disabled={updateMut.isPending}>
                Save
              </Button>
              <Button
                type="button"
                variant="destructive"
                onClick={() => deleteMut.mutate()}
                disabled={deleteMut.isPending}
              >
                Delete Org
              </Button>
            </div>
          </form>
        </Form>
      </CardContent>
    </Card>
  )
}
</file>

<file path="ui/src/pages/me-page.tsx">
import { useMemo, useState } from "react"
import { meApi } from "@/api/me.ts"
import { withRefresh } from "@/api/with-refresh.ts"
import { makeOrgsApi } from "@/sdkClient.ts"
import { zodResolver } from "@hookform/resolvers/zod"
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
import { useForm } from "react-hook-form"
import { toast } from "sonner"
import { z } from "zod"

import {
  AlertDialog,
  AlertDialogAction,
  AlertDialogCancel,
  AlertDialogContent,
  AlertDialogDescription,
  AlertDialogFooter,
  AlertDialogHeader,
  AlertDialogTitle,
  AlertDialogTrigger,
} from "@/components/ui/alert-dialog.tsx"
import { Button } from "@/components/ui/button"
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card.tsx"
import {
  Dialog,
  DialogClose,
  DialogContent,
  DialogDescription,
  DialogFooter,
  DialogHeader,
  DialogTitle,
  DialogTrigger,
} from "@/components/ui/dialog.tsx"
import {
  Form,
  FormControl,
  FormField,
  FormItem,
  FormLabel,
  FormMessage,
} from "@/components/ui/form.tsx"
import { Input } from "@/components/ui/input.tsx"
import { Label } from "@/components/ui/label.tsx"
import { Separator } from "@/components/ui/separator.tsx"
import {
  Table,
  TableBody,
  TableCaption,
  TableCell,
  TableHead,
  TableHeader,
  TableRow,
} from "@/components/ui/table.tsx"

const orgsApi = makeOrgsApi()

const orgApi = {
  create: (body: { name: string; domain?: string }) =>
    withRefresh(async () => orgsApi.createOrg({ createOrgRequest: body })), // POST /orgs
}

const profileSchema = z.object({
  display_name: z.string().min(2, "Too short").max(100, "Too long"),
})

type ProfileForm = z.infer<typeof profileSchema>

const createKeySchema = z.object({
  name: z.string().min(2, "Too short").max(100, "Too long"),
  expires_in_hours: z.number().min(1).max(43800),
})

type CreateKeyForm = z.infer<typeof createKeySchema>

const createOrgSchema = z.object({
  name: z.string().min(2, "Too short").max(100, "Too long"),
  domain: z
    .string()
    .trim()
    .toLowerCase()
    .optional()
    .or(z.literal(""))
    .refine((v) => !v || /^[a-z0-9.-]+\.[a-z]{2,}$/i.test(v), "Invalid domain (e.g. example.com)"),
})

type CreateOrgForm = z.infer<typeof createOrgSchema>

export const MePage = () => {
  const qc = useQueryClient()

  const meQ = useQuery({
    queryKey: ["me"],
    queryFn: () => meApi.getMe(),
  })

  const form = useForm<ProfileForm>({
    resolver: zodResolver(profileSchema),
    defaultValues: {
      display_name: "",
    },
    values: meQ.data ? { display_name: meQ.data.display_name ?? "" } : undefined,
  })

  const updateMut = useMutation({
    mutationFn: (values: ProfileForm) => meApi.updateMe(values),
    onSuccess: () => {
      void qc.invalidateQueries({ queryKey: ["me"] })
      toast.success("Profile updated")
    },
    onError: (e: any) => toast.error(e?.message ?? "Update failed"),
  })

  const keysQ = useQuery({
    queryKey: ["me", "api-keys"],
    queryFn: () => meApi.listKeys(),
  })

  const [createOpen, setCreateOpen] = useState(false)
  const [justCreated, setJustCreated] = useState<ReturnType<typeof Object> | null>(null)

  const createForm = useForm<CreateKeyForm>({
    resolver: zodResolver(createKeySchema),
    defaultValues: {
      name: "",
      expires_in_hours: 720,
    },
  })

  const createMut = useMutation({
    mutationFn: (v: CreateKeyForm) =>
      meApi.createKey({
        name: v.name,
        expires_in_hours: v.expires_in_hours,
      } as CreateKeyForm),
    onSuccess: (resp: any) => {
      setJustCreated(resp)
      setCreateOpen(false)
      void qc.invalidateQueries({ queryKey: ["me", "api-keys"] })
      toast.success("API key created")
    },
    onError: (e: any) => toast.error(e?.message ?? "Failed to create key"),
  })

  const [deleteId, setDeleteId] = useState<string | null>(null)

  const delMut = useMutation({
    mutationFn: (id: string) => meApi.deleteKey(id),
    onSuccess: () => {
      void qc.invalidateQueries({ queryKey: ["me", "api-keys"] })
      setDeleteId(null)
      toast.success("Key deleted")
    },
    onError: (e: any) => toast.error(e?.message ?? "Failed to delete key"),
  })

  const primaryEmail = useMemo(
    () => meQ.data?.emails?.find((e) => e.is_primary)?.email ?? meQ.data?.primary_email ?? "",
    [meQ.data]
  )

  // --- Create Org dialog + mutation ---
  const [orgOpen, setOrgOpen] = useState<boolean>(false)

  const orgForm = useForm<CreateOrgForm>({
    resolver: zodResolver(createOrgSchema),
    defaultValues: {
      name: "",
      domain: "",
    },
  })

  const orgCreateMut = useMutation({
    mutationFn: (v: CreateOrgForm) =>
      orgApi.create({
        name: v.name.trim(),
        domain: v.domain?.trim() ? v.domain.trim().toLowerCase() : undefined,
      }),
    onSuccess: () => {
      setOrgOpen(false)
      orgForm.reset()
      void qc.invalidateQueries({ queryKey: ["me"] })
      toast.success("Organization created")
    },
    onError: (e: any) => toast.error(e?.message ?? "Failed to create organization"),
  })

  if (meQ.isLoading) return <div className="p-6">Loading…</div>
  if (meQ.error) return <div className="text-destructive p-6">Failed to load profile</div>

  return (
    <div className="space-y-6 p-6">
      {/* Profile */}
      <Card>
        <CardHeader>
          <CardTitle>Profile</CardTitle>
          <CardDescription>Manage your personal information.</CardDescription>
        </CardHeader>
        <CardContent>
          <div className="grid gap-6 md:grid-cols-2">
            <div className="space-y-4">
              <div>
                <Label>Email</Label>
                <div className="text-muted-foreground mt-1 text-sm">{primaryEmail || "—"}</div>
              </div>

              <div>
                <Label>ID</Label>
                <div className="text-muted-foreground mt-1 text-sm">{meQ.data?.id || "—"}</div>
                <div className="text-muted-foreground mt-1 text-sm">
                  Share this ID with the organization owner of the Organization to join
                </div>
              </div>
              <Form {...form}>
                <form
                  className="space-y-4"
                  onSubmit={form.handleSubmit((v) => updateMut.mutate(v))}
                >
                  <FormField
                    control={form.control}
                    name="display_name"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Display name</FormLabel>
                        <FormControl>
                          <Input placeholder="Your name" {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <Button type="submit" disabled={updateMut.isPending}>
                    Save
                  </Button>
                </form>
              </Form>
            </div>

            {/* Organizations + Create Org */}
            <div className="space-y-3">
              <div className="flex items-center justify-between">
                <Label>Organizations</Label>
                <Dialog open={orgOpen} onOpenChange={setOrgOpen}>
                  <DialogTrigger asChild>
                    <Button size="sm">New Organization</Button>
                  </DialogTrigger>
                  <DialogContent>
                    <DialogHeader>
                      <DialogTitle>Create organization</DialogTitle>
                      <DialogDescription>
                        Give it a name, and optionally assign your company domain.
                      </DialogDescription>
                    </DialogHeader>

                    <Form {...orgForm}>
                      <form
                        className="space-y-4"
                        onSubmit={orgForm.handleSubmit((v) => orgCreateMut.mutate(v))}
                      >
                        <FormField
                          control={orgForm.control}
                          name="name"
                          render={({ field }) => (
                            <FormItem>
                              <FormLabel>Name</FormLabel>
                              <FormControl>
                                <Input placeholder="Acme Inc." {...field} />
                              </FormControl>
                              <FormMessage />
                            </FormItem>
                          )}
                        />

                        <FormField
                          control={orgForm.control}
                          name="domain"
                          render={({ field }) => (
                            <FormItem>
                              <FormLabel>Domain (optional)</FormLabel>
                              <FormControl>
                                <Input placeholder="acme.com" {...field} />
                              </FormControl>
                              <FormMessage />
                            </FormItem>
                          )}
                        />

                        <DialogFooter>
                          <DialogClose asChild>
                            <Button type="button" variant="outline">
                              Cancel
                            </Button>
                          </DialogClose>
                          <Button type="submit" disabled={orgCreateMut.isPending}>
                            Create
                          </Button>
                        </DialogFooter>
                      </form>
                    </Form>
                  </DialogContent>
                </Dialog>
              </div>

              <div className="rounded-md border">
                <Table>
                  <TableHeader>
                    <TableRow>
                      <TableHead>Id</TableHead>
                      <TableHead>Name</TableHead>
                      <TableHead>Domain</TableHead>
                    </TableRow>
                  </TableHeader>
                  <TableBody>
                    {meQ.data?.organizations?.map((o) => (
                      <TableRow key={o.id}>
                        <TableCell>{o.id}</TableCell>
                        <TableCell>{o.name}</TableCell>
                        <TableCell>{(o as any).domain ?? "—"}</TableCell>
                      </TableRow>
                    ))}
                    {(!meQ.data?.organizations || meQ.data.organizations.length === 0) && (
                      <TableRow>
                        <TableCell colSpan={2} className="text-muted-foreground">
                          No organizations
                        </TableCell>
                      </TableRow>
                    )}
                  </TableBody>
                </Table>
              </div>
            </div>
          </div>
        </CardContent>
      </Card>

      <Separator />

      {/* API Keys (unchanged) */}
      <Card>
        <CardHeader className="flex flex-row items-center justify-between space-y-0">
          <div>
            <CardTitle>User API Keys</CardTitle>
            <CardDescription>Personal keys for API access.</CardDescription>
          </div>
          <Dialog open={createOpen} onOpenChange={setCreateOpen}>
            <DialogTrigger asChild>
              <Button>New Key</Button>
            </DialogTrigger>
            <DialogContent>
              <DialogHeader>
                <DialogTitle>Create API Key</DialogTitle>
                <DialogDescription>Give it a label and expiry.</DialogDescription>
              </DialogHeader>
              <Form {...createForm}>
                <form
                  className="space-y-4"
                  onSubmit={createForm.handleSubmit((v) => createMut.mutate(v))}
                >
                  <FormField
                    control={createForm.control}
                    name="name"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Label</FormLabel>
                        <FormControl>
                          <Input placeholder="CI script, local dev, ..." {...field} />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <FormField
                    control={createForm.control}
                    name="expires_in_hours"
                    render={({ field }) => (
                      <FormItem>
                        <FormLabel>Expires in hours</FormLabel>
                        <FormControl>
                          <Input
                            type="number"
                            inputMode="numeric"
                            step={1}
                            min={1}
                            placeholder="e.g. 720"
                            {...field}
                            onChange={(e) =>
                              field.onChange(e.target.value === "" ? "" : Number(e.target.value))
                            }
                          />
                        </FormControl>
                        <FormMessage />
                      </FormItem>
                    )}
                  />

                  <DialogFooter>
                    <DialogClose asChild>
                      <Button type="button" variant="outline">
                        Cancel
                      </Button>
                    </DialogClose>
                    <Button type="submit" disabled={createMut.isPending}>
                      Create
                    </Button>
                  </DialogFooter>
                </form>
              </Form>
            </DialogContent>
          </Dialog>
        </CardHeader>

        <CardContent>
          <div className="overflow-x-auto rounded-md border">
            <Table className="text-sm">
              <TableCaption>Your user-scoped API keys.</TableCaption>
              <TableHeader>
                <TableRow>
                  <TableHead>Label</TableHead>
                  <TableHead>Created</TableHead>
                  <TableHead>Expires</TableHead>
                  <TableHead>Last used</TableHead>
                  <TableHead className="w-24" />
                </TableRow>
              </TableHeader>
              <TableBody>
                {keysQ.data?.map((k) => (
                  <TableRow key={k.id}>
                    <TableCell>{k.name ?? "—"}</TableCell>
                    <TableCell>{new Date(k.created_at!).toLocaleString()}</TableCell>
                    <TableCell>
                      {k.expires_at ? new Date(k.expires_at).toLocaleString() : "—"}
                    </TableCell>
                    <TableCell>
                      {k.last_used_at ? new Date(k.last_used_at).toLocaleString() : "—"}
                    </TableCell>
                    <TableCell className="text-right">
                      <AlertDialog
                        open={deleteId === k.id}
                        onOpenChange={(o) => !o && setDeleteId(null)}
                      >
                        <AlertDialogTrigger asChild>
                          <Button
                            variant="destructive"
                            size="sm"
                            onClick={() => setDeleteId(k.id!)}
                          >
                            Delete
                          </Button>
                        </AlertDialogTrigger>
                        <AlertDialogContent>
                          <AlertDialogHeader>
                            <AlertDialogTitle>Delete this key?</AlertDialogTitle>
                            <AlertDialogDescription>
                              This action cannot be undone. Requests using this key will stop
                              working.
                            </AlertDialogDescription>
                          </AlertDialogHeader>
                          <AlertDialogFooter>
                            <AlertDialogCancel>Cancel</AlertDialogCancel>
                            <AlertDialogAction onClick={() => delMut.mutate(k.id!)}>
                              Delete
                            </AlertDialogAction>
                          </AlertDialogFooter>
                        </AlertDialogContent>
                      </AlertDialog>
                    </TableCell>
                  </TableRow>
                ))}
                {(!keysQ.data || keysQ.data.length === 0) && (
                  <TableRow>
                    <TableCell colSpan={5} className="text-muted-foreground">
                      No API keys yet.
                    </TableCell>
                  </TableRow>
                )}
              </TableBody>
            </Table>
          </div>
        </CardContent>
      </Card>

      {/* Plaintext key shown once */}
      <Dialog open={!!justCreated} onOpenChange={(o) => !o && setJustCreated(null)}>
        <DialogContent>
          <DialogHeader>
            <DialogTitle>Copy your new API key</DialogTitle>
            <DialogDescription>This is only shown once. Store it securely.</DialogDescription>
          </DialogHeader>
          <div className="rounded-md border p-3 font-mono text-sm break-all">
            {(justCreated as any)?.plain ?? "—"}
          </div>
          <div className="flex justify-end gap-2">
            <Button
              variant="outline"
              onClick={() => {
                const val = (justCreated as any)?.plain
                if (val) {
                  navigator.clipboard.writeText(val)
                  toast.success("Copied")
                }
              }}
            >
              Copy
            </Button>
            <Button onClick={() => setJustCreated(null)}>Done</Button>
          </div>
        </DialogContent>
      </Dialog>
    </div>
  )
}
</file>

<file path=".gitignore">
# Created by https://www.toptal.com/developers/gitignore/api/go,react,intellij+all
# Edit at https://www.toptal.com/developers/gitignore?templates=go,react,intellij+all

### Go ###
# If you prefer the allow list template instead of the deny list, see community template:
# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
#
# Binaries for programs and plugins
*.exe
*.exe~
*.dll
*.so
*.dylib

# Test binary, built with `go test -c`
*.test

# Output of the go coverage tool, specifically when used with LiteIDE
*.out

# Dependency directories (remove the comment below to include it)
# vendor/

# Go workspace file
go.work

### Intellij+all ###
# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839

# User-specific stuff
.idea/**/workspace.xml
.idea/**/tasks.xml
.idea/**/usage.statistics.xml
.idea/**/dictionaries
.idea/**/shelf

# AWS User-specific
.idea/**/aws.xml

# Generated files
.idea/**/contentModel.xml

# Sensitive or high-churn files
.idea/**/dataSources/
.idea/**/dataSources.ids
.idea/**/dataSources.local.xml
.idea/**/sqlDataSources.xml
.idea/**/dynamic.xml
.idea/**/uiDesigner.xml
.idea/**/dbnavigator.xml

# Gradle
.idea/**/gradle.xml
.idea/**/libraries

# Gradle and Maven with auto-import
# When using Gradle or Maven with auto-import, you should exclude module files,
# since they will be recreated, and may cause churn.  Uncomment if using
# auto-import.
# .idea/artifacts
# .idea/compiler.xml
# .idea/jarRepositories.xml
# .idea/modules.xml
# .idea/*.iml
# .idea/modules
# *.iml
# *.ipr

# CMake
cmake-build-*/

# Mongo Explorer plugin
.idea/**/mongoSettings.xml

# File-based project format
*.iws

# IntelliJ
out/

# mpeltonen/sbt-idea plugin
.idea_modules/

# JIRA plugin
atlassian-ide-plugin.xml

# Cursive Clojure plugin
.idea/replstate.xml

# SonarLint plugin
.idea/sonarlint/

# Crashlytics plugin (for Android Studio and IntelliJ)
com_crashlytics_export_strings.xml
crashlytics.properties
crashlytics-build.properties
fabric.properties

# Editor-based Rest Client
.idea/httpRequests

# Android studio 3.1+ serialized cache file
.idea/caches/build_file_checksums.ser

### Intellij+all Patch ###
# Ignore everything but code style settings and run configurations
# that are supposed to be shared within teams.

.idea/*

!.idea/codeStyles
!.idea/runConfigurations

### react ###
.DS_*
*.log
logs
**/*.backup.*
**/*.back.*

node_modules
bower_components

*.sublime*

psd
thumb
sketch

# End of https://www.toptal.com/developers/gitignore/api/go,react,intellij+all

.env
config.yaml
go_*_WhiteSpaceConflict/
notes.txt

.terraform
.terraform.lock*
terraform.tfstate*

ui/src/sdk
sdk/ts/**/*
internal/web/dist
docs/docs.go
docs/openapi.json
docs/openapi.yaml
</file>

<file path="agents.md">
# Autoglue Repository Architecture & Agents

## Overview

Autoglue is a Kubernetes cluster management platform built with Go that manages the lifecycle of K3s clusters across GlueOps-supported cloud providers. It provides a REST API for cluster provisioning, configuration, and management, along with a web UI and Terraform provider.

## Repository Structure

```
autoglue/
├── cmd/                    # CLI commands
├── internal/              # Internal packages
│   ├── api/              # HTTP API routes and middleware
│   ├── app/              # Application setup
│   ├── auth/             # Authentication logic
│   ├── bg/               # Background job workers
│   ├── common/           # Common utilities
│   ├── config/           # Configuration management
│   ├── db/               # Database operations
│   ├── handlers/         # HTTP request handlers
│   ├── keys/             # Cryptographic key management
│   ├── mapper/           # Data mapping utilities
│   ├── models/           # Database models
│   ├── utils/            # Utility functions
│   ├── version/          # Version information
│   └── web/              # Web UI integration
├── sdk/                   # Generated SDKs
│   └── ts/               # TypeScript SDK
├── ui/                    # Frontend application (React)
├── docs/                  # OpenAPI/Swagger documentation
├── postgres/              # PostgreSQL configuration
├── main.go                # Application entry point
├── schema.sql             # Database schema
└── docker-compose.yml     # Development environment

```

## Core Components

### 1. API Layer (`internal/api`)

The API layer provides RESTful endpoints for managing cloud resources:

- **Authentication** (`mount_auth_routes.go`): OAuth/OIDC integration, JWT tokens
- **Clusters** (`mount_cluster_routes.go`): Kubernetes cluster management
- **Servers** (`mount_server_routes.go`): Server resource management
- **SSH Keys** (`mount_ssh_routes.go`): SSH key generation and management
- **DNS** (`mount_dns_routes.go`): DNS record management
- **Load Balancers** (`mount_load_balancer_routes.go`): Load balancer configuration
- **Node Pools** (`mount_node_pool_routes.go`): Worker node pool management
- **Credentials** (`mount_credential_routes.go`): Cloud provider credentials
- **Organizations** (`mount_org_routes.go`): Multi-tenant organization management

**Middleware:**
- Request logging with zerolog
- Rate limiting (1000 requests/minute per IP)
- CORS handling
- Security headers
- Authentication/Authorization
- Request body size limits (10MB)

### 2. Background Jobs (`internal/bg`)

Autoglue uses the [Archer](https://github.com/dyaksa/archer) job queue system with PostgreSQL-backed job persistence.

**Active Job Workers:**

| Worker | Purpose | Timeout |
|--------|---------|---------|
| `bootstrap_bastion` | Provision and configure bastion host servers | Configurable (default 60s) |
| `archer_cleanup` | Clean up old job records | 5 minutes |
| `tokens_cleanup` | Purge expired refresh tokens | 5 minutes |
| `db_backup_s3` | Backup database to S3 | 15 minutes |
| `dns_reconcile` | Synchronize DNS records with Route53 | 2 minutes |
| `org_key_sweeper` | Remove expired organization API keys | 5 minutes |
| `cluster_action` | Execute cluster lifecycle actions | Configurable |

**Planned Job Workers (Currently Disabled):**

The following workers exist in the codebase but are currently commented out:
- `prepare_cluster` - Prepare infrastructure for cluster deployment
- `cluster_setup` - Initial cluster configuration
- `cluster_bootstrap` - Full Kubernetes cluster bootstrapping process

**Configuration:**
- `archer.instances`: Number of worker instances (default: 1)
- `archer.timeoutSec`: Job timeout in seconds (default: 60)
- `archer.cleanup_retain_days`: Job retention period (default: 7 days)

### 3. Data Models (`internal/models`)

**Core Models:**

- `User` - User accounts with OAuth integration
- `Organization` - Multi-tenant organizations
- `Membership` - User-organization relationships
- `ApiKey` - API authentication tokens (user and org-level)
- `OrganizationKey` - Organization-level credentials with auto-expiry
- `Cluster` - Kubernetes cluster definitions
- `NodePool` - Worker node group configurations
- `Server` - Individual server instances
- `SshKey` - SSH keypair management with encryption
- `LoadBalancer` - Load balancer configurations
- `Domain` - DNS domain management
- `Credential` - Cloud provider API credentials (AWS, etc.)
- `Job` - Background job queue records
- `SigningKey` - JWT signing keys with rotation
- `RefreshToken` - OAuth refresh token storage
- `MasterKey` - Master encryption key for data at rest
- `Label`, `Annotation`, `Taint` - Kubernetes resource metadata

### 4. Handlers (`internal/handlers`)

Request handlers implement business logic for API endpoints:

- `auth.go` - OAuth flows, token issuance
- `clusters.go` - Cluster CRUD operations
- `servers.go` - Server provisioning
- `ssh_keys.go` - SSH key generation with Ed25519/RSA support
- `dns.go` - DNS record management via Route53
- `load_balancers.go` - Load balancer configuration
- `node_pools.go` - Node pool management with labels/annotations/taints
- `credentials.go` - Cloud credential storage
- `orgs.go` - Organization management
- `me.go` - Current user information
- `me_keys.go` - User API key management
- `health.go` - Health check endpoints
- `version.go` - Version information

### 5. Security & Encryption

**Cryptography:**
- **Master Key**: AES-256-GCM encryption for root secrets
- **Organization Keys**: Per-org encryption keys derived from master key
- **SSH Keys**: Secure generation and encrypted storage
- **JWT Tokens**: RS256 signing with key rotation
- **API Keys**: Argon2id hashing for token storage
- **At-Rest Encryption**: All sensitive data (kubeconfigs, credentials, SSH keys)

**Authentication Methods:**
1. OAuth/OIDC (Google Workspace integration)
2. Bearer tokens (JWT)
3. Organization Key/Secret pairs
4. User API keys

### 6. CLI Commands (`cmd`)

- `serve` - Start the API server (default command)
- `keys generate` - Generate JWT signing keys
- `encrypt create-master` - Create master encryption key
- `db` - Database management utilities
- `version` - Display version information

### 7. Integration Points

**Cloud Providers:**
- AWS (Route53 for DNS, S3 for backups)
- Support for multi-cloud credentials

**External Services:**
- PostgreSQL (primary data store)
- S3-compatible storage (backups)
- OAuth providers (Google)

**SDKs:**
- TypeScript SDK (`sdk/ts/`) - Generated from OpenAPI spec
- Go SDK (consumed via module alias) - Used by external integrations

**External Integrations:**
- Terraform Provider - Separate repository providing IaC support for Autoglue resources

## Development Workflow

### Prerequisites
- Go 1.25.4+
- Docker & Docker Compose
- PostgreSQL (via docker-compose)
- Node.js (for UI development)

### Setup
```bash
# 1. Configure environment
cp .env.example .env

# 2. Start database
docker compose up -d

# 3. Generate JWT keys
go run . keys generate

# 4. Create master encryption key
go run . encrypt create-master

# 5. Update OpenAPI docs and SDKs
make swagger
make sdk-all

# 6. Start API server with embedded UI
go run .
```

### Build & Test
```bash
# Build application
go build -o autoglue .

# Run tests
go test ./...

# Build UI
make ui
```

**Note:** The Terraform provider is maintained in a separate repository.

## API Architecture

### Request Flow
```
Client → CORS → Rate Limit → Logger → Auth → Handler → DB/Jobs → Response
```

### Authentication Flow
1. User logs in via OAuth (Google)
2. Backend validates token with provider
3. JWT access token issued (short-lived)
4. Refresh token stored in DB
5. Organization context from `X-Org-ID` header

### Job Execution Flow
1. Handler enqueues job via `Jobs.Enqueue()`
2. Archer worker picks up job from PostgreSQL
3. Worker executes task with timeout
4. Result stored in `jobs` table
5. Retries on failure (configurable)

## Database Schema

**Key Tables:**
- `users` - User accounts
- `accounts` - OAuth provider linkage
- `organizations` - Tenant isolation
- `memberships` - User-org relationships
- `api_keys` - Authentication tokens
- `clusters` - K8s cluster definitions
- `node_pools` - Worker node groups
- `servers` - Compute instances
- `ssh_keys` - SSH keypair storage
- `load_balancers` - LB configurations
- `domains` - DNS domains
- `credentials` - Cloud API credentials
- `jobs` - Background job queue
- `signing_keys` - JWT key rotation
- `refresh_tokens` - OAuth token storage
- `master_keys` - Encryption key hierarchy

## Configuration

Environment variables (`.env`):
- `DATABASE_URL` - PostgreSQL connection string
- `JWT_PRIVATE_ENC_KEY` - JWT private key encryption
- `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` - OAuth
- `ALLOWED_ORIGINS` - CORS configuration
- `archer.*` - Job queue settings
- AWS credentials for Route53/S3

## Deployment

### Docker
```bash
docker build -t autoglue .
docker run -p 8080:8080 --env-file .env autoglue
```

### Production Considerations
- Database connection pooling
- Rate limiting configuration
- CORS allowed origins
- JWT key rotation schedule
- Backup retention policies
- Worker instance scaling
- Monitoring and alerting

## API Documentation

- **Swagger UI**: `http://localhost:8080/swagger/index.html`
- **OpenAPI Spec**: `docs/openapi.yaml`
- **SDK Documentation**: `sdk/ts/README.md`

## Testing

The repository includes:
- Unit tests for handlers (`*_test.go`)
- Test utilities (`internal/testutil/`)
- Integration tests with embedded PostgreSQL

Run tests:
```bash
go test ./internal/handlers/
go test -v ./...
```

## Key Features

1. **Multi-tenancy**: Organization-based resource isolation
2. **Encryption at Rest**: All sensitive data encrypted per-org
3. **Async Job Processing**: Background tasks with retry logic
4. **API Key Management**: Multiple authentication methods
5. **SSH Key Generation**: Automated keypair creation (RSA/Ed25519)
6. **DNS Automation**: Route53 integration for DNS records
7. **Kubernetes Management**: Cluster lifecycle automation
8. **Terraform Provider**: Infrastructure-as-Code support
9. **Web UI**: React-based management interface
10. **OpenAPI/Swagger**: Auto-generated API documentation

## Architecture Patterns

- **Repository Pattern**: Data access abstraction via GORM
- **Dependency Injection**: Dependencies passed to handlers
- **Middleware Chain**: Request processing pipeline
- **Job Queue**: Async processing with Archer
- **Multi-tenant**: Organization-scoped data isolation
- **Encryption**: Key hierarchy (master → org → resource)

## Future Enhancements

Based on commented code and structure:
- Full cluster provisioning automation
- Additional cloud provider support
- Enhanced monitoring and observability
- Cluster backup and restore
- Advanced RBAC controls
- Custom resource definitions

## Resources

- **GitHub**: https://github.com/GlueOps/autoglue
- **Production API**: https://autoglue.glueopshosted.com/api/v1
- **Pre-prod API**: https://autoglue.glueopshosted.rocks/api/v1
- **Staging API**: https://autoglue.apps.nonprod.earth.onglueops.rocks/api/v1
</file>

<file path="Makefile">
# ========= Makefile (optimized + DRY + annotated) =========

# --- strict shell & make behavior ---
SHELL := $(shell command -v bash 2>/dev/null || echo /bin/sh)
.SHELLFLAGS := -eu -o pipefail -c

.DELETE_ON_ERROR:
MAKEFLAGS += --warn-undefined-variables
.ONESHELL:

# --- variables ---
GOCMD        ?= go
GOINSTALL    := $(GOCMD) install
BIN          ?= autoglue
MAIN         ?= main.go
UI_DIR       ?= ui
UI_DEST_DIR  ?= internal/web

# Module path (used for ldflags to internal/version)
GIT_HOST     ?= github.com
GIT_USER     ?= glueops
MODULE_PATH  ?= $(GIT_HOST)/$(GIT_USER)/$(BIN)

# SDK / module settings (Go)
SDK_REPO     ?= $(BIN)-sdk-go               # repo name used for module path
SDK_OUTDIR   ?= ../autoglue-sdk-go          # output directory (inside repo)
SDK_PKG      ?= ${BIN}                      # package name inside the SDK

UI_SSG_ROUTES ?= /,/login,/docs,/pricing

# Go versioning (go.mod uses major.minor; you’re on 1.25.4)
GO_VERSION   ?= 1.25.4
SWAG_FLAGS   ?= --v3.1 --outputTypes json,yaml,go

# SDK / package settings (TypeScript)
SDK_TS_OUTDIR     ?= sdk/ts
SDK_TS_GEN        ?= typescript-fetch
SDK_TS_NPM_NAME   ?= @glueops/$(SDK_REPO)
SDK_TS_NPM_VER    ?= 0.1.0
SDK_TS_DIR        := $(abspath $(SDK_TS_OUTDIR))
SDK_TS_PROPS      ?= supportsES6=true,typescriptThreePlus=true,useSingleRequestParameter=true,withSeparateModelsAndApi=true,modelPropertyNaming=original,enumPropertyNaming=original,useUnionTypes=true
SDK_TS_PROPS_FLAGS := $(foreach p,$(subst , ,$(SDK_TS_PROPS)),-p $(p))

# Path for vendored UI SDK (absolute, path-safe)
SDK_TS_UI_OUTDIR ?= ui/src/sdk
SDK_TS_UI_DIR    := $(abspath $(SDK_TS_UI_OUTDIR))

SWAG         := $(shell command -v swag 2>/dev/null)
GMU          := $(shell command -v go-mod-upgrade 2>/dev/null)
YARN         := $(shell command -v yarn 2>/dev/null)
NPM          := $(shell command -v npm 2>/dev/null)
BROTLI       := $(shell command -v brotli 2>/dev/null)
GZIP         := $(shell command -v gzip 2>/dev/null)

# OpenAPI Generator wrapper (npm) and *core* version pin
OGC_WRAPPER                ?= @openapitools/openapi-generator-cli@latest
OPENAPI_GENERATOR_VERSION  ?= 7.17.0
OGC_BIN                    := npx -y $(OGC_WRAPPER)

# Cache the core generator jar (faster CI/local)
export OPENAPI_GENERATOR_CLI_CACHE_DIR ?= $(HOME)/.openapi-generator

# Toggle alias-as-model (can trigger name collisions in some specs)
ALIAS_AS_MODEL ?= true
ALIAS_FLAG     := $(if $(filter true,$(ALIAS_AS_MODEL)),--generate-alias-as-model,)

# Post-process generated Go with gofmt (OpenAPI Generator honors this env var)
export GO_POST_PROCESS_FILE := gofmt -w

# Default goal
.DEFAULT_GOAL := help

# --- version metadata (ldflags) ---
VERSION  := $(shell git describe --tags --always 2>/dev/null || echo "dev")
COMMIT   := $(shell git rev-parse HEAD 2>/dev/null || echo "none")
DATE     := $(shell date -u +'%Y-%m-%dT%H:%M:%SZ')
BUILT_BY := $(shell whoami)

LDFLAGS := -X '$(MODULE_PATH)/internal/version.Version=$(VERSION)' \
           -X '$(MODULE_PATH)/internal/version.Commit=$(COMMIT)' \
           -X '$(MODULE_PATH)/internal/version.Date=$(DATE)' \
           -X '$(MODULE_PATH)/internal/version.BuiltBy=$(BUILT_BY)'

# --- whitespace trimming helper ---
trim = $(strip $1)

# sanitized copies (use these everywhere in recipes)
SDK_OUTDIR_CLEAN    := $(call trim,$(SDK_OUTDIR))
SDK_TS_DIR_CLEAN    := $(call trim,$(SDK_TS_DIR))
SDK_TS_UI_DIR_CLEAN := $(call trim,$(SDK_TS_UI_DIR))
GIT_HOST_CLEAN      := $(call trim,$(GIT_HOST))
GIT_USER_CLEAN      := $(call trim,$(GIT_USER))
SDK_REPO_CLEAN      := $(call trim,$(SDK_REPO))
SDK_PKG_CLEAN       := $(call trim,$(SDK_PKG))

# --- phony targets ---
.PHONY: all prepare ui-install ui-build ui swagger build clean fmt vet tidy upgrade \
        sdk sdk-go sdk-ts sdk-ts-ui sdk-all help dev ui-compress print-version \
        validate-spec check-tags doctor diff-swagger

# --- inputs/outputs for swagger (incremental) ---
DOCS_JSON := docs/openapi.json
DOCS_YAML := docs/openapi.yaml
# Prefer git for speed; fall back to find. Exclude UI dir.
#GO_SRCS := $(shell (git ls-files '*.go' ':!$(UI_DIR)/**' 2>/dev/null || find . -name '*.go' -not -path './$(UI_DIR)/*' -type f))
GO_SRCS := $(shell ( \
  git ls-files '*.go' ':!$(UI_DIR)/**' ':!docs/**' ':!sdk/**' ':!terraform-provider-autoglue/**' 2>/dev/null \
  || find . -name '*.go' -not -path './$(UI_DIR)/*' -not -path './docs/*' -type f \
))

# Rebuild swagger when Go sources change
$(DOCS_JSON) $(DOCS_YAML): $(GO_SRCS)
	@echo ">> Generating Swagger docs..."
	@if ! command -v swag >/dev/null 2>&1; then \
		echo "Installing swag/v2 CLI @latest..."; \
		$(GOINSTALL) github.com/swaggo/swag/v2/cmd/swag@latest; \
	fi
	@rm -rf docs/openapi.* docs/docs.go
	@swag fmt --exclude main.go -d .
	@swag init $(SWAG_FLAGS) -g $(MAIN) -o docs
	@mv docs/swagger.json $(DOCS_JSON)
	@mv docs/swagger.yaml $(DOCS_YAML)

# --- spec validation + tag guard ---
validate-spec: $(DOCS_JSON) ## Validate docs/swagger.json and pin the core OpenAPI Generator version
	@$(OGC_BIN) version-manager set "$(OPENAPI_GENERATOR_VERSION)"
	@$(OGC_BIN) version
	@$(OGC_BIN) validate -i $(DOCS_JSON)
	@echo ">> Spec valid."

check-tags: $(DOCS_JSON) ## Check that Swagger tags contain no spaces/slashes (jq optional)
	@echo ">> Checking tags for invalid characters (spaces or slashes)"
	@if command -v jq >/dev/null 2>&1; then \
		! jq -r '..|.tags? // empty | .[]' $(DOCS_JSON) | grep -Eq '[ /]'; \
	else \
		echo "jq not found; skipping tag check (install jq to enable)"; \
	fi

# Optional: quick diff between JSON & YAML swagger (nice for drift)
diff-swagger: $(DOCS_JSON) $(DOCS_YAML) ## Show diff between swagger.json and swagger.yaml (requires yq)
	@command -v yq >/dev/null 2>&1 || { echo "yq not found; brew install yq"; exit 1; }
	@diff -u <(jq -S . $(DOCS_JSON)) <(yq -o=json -S '.' $(DOCS_YAML)) || true

# --- meta targets ---
all: build ## Default meta-target: build everything
prepare: fmt vet tidy upgrade ## go fmt, vet, tidy, and upgrade module dependencies

# --- go hygiene ---
fmt: ## go fmt ./...
	@$(GOCMD) fmt ./...

vet: ## go vet ./...
	@$(GOCMD) vet ./...

tidy: ## go mod tidy
	@$(GOCMD) mod tidy

upgrade: ## Upgrade module requirements with go-mod-upgrade (best-effort)
	@echo ">> Checking go-mod-upgrade..."
	@if [ -z "$(GMU)" ]; then \
		echo "Installing go-mod-upgrade..."; \
		$(GOINSTALL) github.com/oligot/go-mod-upgrade@latest; \
	fi
	@go-mod-upgrade -f || true

# --- ui ---
ui-install: ## Install frontend dependencies (yarn or npm)
	@echo ">> Installing UI deps in $(UI_DIR)..."
	@if [ -n "$(YARN)" ]; then \
		cd $(UI_DIR) && yarn install --frozen-lockfile; \
	elif [ -n "$(NPM)" ]; then \
		cd $(UI_DIR) && npm ci; \
	else \
		echo "Error: neither yarn nor npm is installed." >&2; exit 1; \
	fi

ui-build: ui-install ## Build frontend (Vite)
	@echo ">> Building UI in $(UI_DIR)..."
	@rm -rf $(UI_DEST_DIR)/dist
	@if [ -n "$(YARN)" ]; then \
		cd $(UI_DIR) && yarn build; \
	else \
		cd $(UI_DIR) && npm run build; \
	fi

ui-compress: ui-build ## Precompress UI assets with brotli/gzip if available
	@echo ">> Precompressing assets (brotli + gzip) in $(UI_DEST_DIR)/dist"
	@if [ -n "$(BROTLI)" ]; then \
		find "$(UI_DEST_DIR)/dist" -type f \( -name '*.js' -o -name '*.css' -o -name '*.html' \) -print0 | \
		 xargs -0 -I{} brotli -f {}; \
	else echo "brotli not found; skipping .br"; fi
	@if [ -n "$(GZIP)" ]; then \
		find "$(UI_DEST_DIR)/dist" -type f \( -name '*.js' -o -name '*.css' -o -name '*.html' \) -print0 | \
		 xargs -0 -I{} gzip -kf {}; \
	else echo "gzip not found; skipping .gz"; fi

ui: ui-compress ## Build and precompress UI

# --- swagger convenience phony (kept for UX) ---
.PHONY: swagger
swagger: $(DOCS_JSON) ## Generate Swagger docs if stale
	@true

# --- build ---
build: prepare ui swagger sdk-all ## Build everything: Go hygiene, UI, Swagger, SDKs, then Go binary
	@echo ">> Building Go binary: $(BIN)"
	@$(GOCMD) get github.com/swaggo/swag/v2@v2.0.0-rc5
	@$(GOCMD) build -trimpath -ldflags "$(LDFLAGS)" -o $(BIN) $(MAIN)

# Handy: print resolved version metadata
print-version: ## Print ldflags/version metadata
	@echo "VERSION  = $(VERSION)"
	@echo "COMMIT   = $(COMMIT)"
	@echo "DATE     = $(DATE)"
	@echo "BUILT_BY = $(BUILT_BY)"
	@echo "LDFLAGS  = $(LDFLAGS)"

# --- development ---
dev: ui-install swagger ## Run Vite dev server and Go API (serve)
	@echo ">> Starting Vite (frontend) and Go API (backend) with dev env..."
	@cd $(UI_DIR) && \
	( \
		if command -v yarn >/dev/null 2>&1; then \
			yarn dev & \
		elif command -v npm >/dev/null 2>&1; then \
			npm run dev & \
		else \
			echo "Error: neither yarn nor npm is installed." >&2; exit 1; \
		fi; \
		cd .. && \
		$(GOCMD) run . serve & \
		wait \
	)

# --- shared generator flags ---
GEN_COMMON := --enable-post-process-file $(ALIAS_FLAG) -i $(DOCS_JSON)

# --- DRY macro for openapi-generator generate ---
# Usage: $(call OGC_GENERATE,<generator>,<outdir>,<extra flags>)
define OGC_GENERATE
	$(OGC_BIN) generate \
		$(GEN_COMMON) \
		-g $(1) \
		-o $(2) \
		$(3)
endef

# Convenience bundles
OAG_GIT_PROPS := --git-host "$(GIT_HOST_CLEAN)" --git-user-id "$(GIT_USER_CLEAN)" --git-repo-id "$(SDK_REPO_CLEAN)"
TS_PROPS      := -p npmName=$(SDK_TS_NPM_NAME) -p npmVersion=$(SDK_TS_NPM_VER) $(SDK_TS_PROPS_FLAGS)

# --- sdk generation (Go) ---
sdk-go: $(DOCS_JSON) validate-spec check-tags ## Generate Go SDK + tidy module
	@echo ">> Generating Go SDK (module $(GIT_HOST_CLEAN)/$(GIT_USER_CLEAN)/$(SDK_REPO_CLEAN), Go $(GO_VERSION))..."
	@$(call OGC_GENERATE,go,$(SDK_OUTDIR_CLEAN),--additional-properties=packageName=$(SDK_PKG_CLEAN) $(OAG_GIT_PROPS))
	@cd "$(SDK_OUTDIR_CLEAN)"; \
	$(GOCMD) mod edit -go=$(GO_VERSION); \
	$(GOCMD) mod tidy

# --- sdk generation (TypeScript) ---
sdk-ts: $(DOCS_JSON) validate-spec check-tags ## Generate TypeScript SDK, format, and build
	@echo ">> Generating TypeScript SDK in $(SDK_TS_DIR_CLEAN)"
	@rm -rf "$(SDK_TS_DIR_CLEAN)"; mkdir -p "$(SDK_TS_DIR_CLEAN)"
	@$(call OGC_GENERATE,$(SDK_TS_GEN),$(SDK_TS_DIR_CLEAN),$(TS_PROPS))
	@if command -v npx >/dev/null 2>&1; then \
		echo ">> Prettier: formatting generated TS SDK"; \
		cd "$(SDK_TS_DIR_CLEAN)" && npx --yes prettier -w . || true; \
	fi
	@echo ">> Installing & building TS SDK in $(SDK_TS_DIR_CLEAN)"
	@if command -v yarn >/dev/null 2>&1; then \
		cd "$(SDK_TS_DIR_CLEAN)" && yarn install --frozen-lockfile || true; \
		cd "$(SDK_TS_DIR_CLEAN)" && yarn build || true; \
	elif command -v npm >/dev/null 2>&1; then \
		cd "$(SDK_TS_DIR_CLEAN)" && npm ci || npm install || true; \
		cd "$(SDK_TS_DIR_CLEAN)" && npm run build || true; \
	else \
		echo "Warning: neither yarn nor npm is installed; skipping install/build for TS SDK."; \
	fi

# --- sdk generation (TypeScript into UI/src) ---
sdk-ts-ui: $(DOCS_JSON) validate-spec check-tags ## Generate TS SDK directly into UI src (no package files)
	@echo ">> Generating TypeScript SDK directly into UI source: $(SDK_TS_UI_DIR_CLEAN)"
	@rm -rf "$(SDK_TS_UI_DIR_CLEAN)"; mkdir -p "$(SDK_TS_UI_DIR_CLEAN)"
	@$(call OGC_GENERATE,typescript-fetch,$(SDK_TS_UI_DIR_CLEAN),$(TS_PROPS))
	@if [ -d "$(SDK_TS_UI_DIR_CLEAN)/src" ]; then \
		mv "$(SDK_TS_UI_DIR_CLEAN)/src/"* "$(SDK_TS_UI_DIR_CLEAN)/"; \
		rm -rf "$(SDK_TS_UI_DIR_CLEAN)/src"; \
	fi
	@rm -f "$(SDK_TS_UI_DIR_CLEAN)/package.json" "$(SDK_TS_UI_DIR_CLEAN)/tsconfig.json" "$(SDK_TS_UI_DIR_CLEAN)/README.md"

# --- convenience ---
sdk-all: sdk-go sdk-ts sdk-ts-ui ## Generate Go + TS SDKs (tip: run with "make -j sdk-all" for parallel)
sdk: sdk-go ## Alias for sdk-go

# --- clean/help ---
clean: ## Clean build artifacts, Swagger outputs, UI dist, and SDKs
	@echo ">> Cleaning artifacts..."
	@rm -rf "$(BIN)" docs/swagger.* docs/docs.go \
		"$(UI_DEST_DIR)/dist" "$(UI_DIR)/dist" "$(UI_DIR)/node_modules" \
		"$(SDK_OUTDIR_CLEAN)" "$(SDK_TS_DIR_CLEAN)" "$(SDK_TS_UI_DIR_CLEAN)"

doctor: ## Print environment diagnostics (shell, versions, generator availability)
	@echo ">> Make is using shell: $(SHELL)"
	@{ \
		echo ">> Detected runtime shell process: $$0"; \
		command -v bash >/dev/null 2>&1 || { echo "bash not found. On macOS: brew install bash"; exit 1; }; \
		echo ">> Versions:"; \
		bash --version | head -1 || true; \
		go version || true; \
		node -v || true; \
		npm -v || true; \
		npx -v || true; \
		jq --version || true; \
		echo ">> OpenAPI Generator (wrapper) available via npx:"; \
		$(OGC_BIN) version || true; \
	}

fetch-pgweb: ## Fetch PGWeb Binaries for embedding
	go run ./tools/pgweb_fetch.go

help: ## Show this help
	@grep -hE '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | \
	awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'

# ========= end Makefile =========
</file>

<file path=".github/workflows/docker-publish.yml">
name: Docker Publish

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

on:
  push:
    branches: [ "main" ]
    # Publish semver tags as releases.
    tags: [ 'v*.*.*' ]
  pull_request:
    branches: [ "main" ]

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}


jobs:
  build:

    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      # Install the cosign tool except on PR
      # https://github.com/sigstore/cosign-installer
      - name: Install cosign
        if: github.event_name != 'pull_request'
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          cosign-release: 'v2.2.4'

      # Set up BuildKit Docker container builder to be able to build
      # multi-platform images and export cache
      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      # Login against a Docker registry except on PR
      # https://github.com/docker/login-action
      - name: Log into registry ${{ env.REGISTRY }}
        if: github.event_name != 'pull_request'
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Extract metadata (tags, labels) for Docker
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=tag
            type=ref,event=branch
            type=raw,value=latest

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          platforms: linux/amd64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Sign the resulting Docker image digest except on PRs.
      # This will only write to the public Rekor transparency log when the Docker
      # repository is public to avoid leaking data.  If you would like to publish
      # transparency data even for private images, pass --force to cosign below.
      # https://github.com/sigstore/cosign
      - name: Sign the published Docker image
        if: ${{ github.event_name != 'pull_request' }}
        env:
          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
          TAGS: ${{ steps.meta.outputs.tags }}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
</file>

<file path="Dockerfile">
#################################
# Builder: Go + Node in one
#################################
FROM golang:1.26.0-alpine@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5 AS builder

RUN apk add --no-cache \
    bash git ca-certificates tzdata \
    build-base \
    nodejs npm \
    openjdk17-jre-headless \
    jq yq brotli

RUN npm i -g yarn pnpm

WORKDIR /src

COPY . .
RUN make clean
RUN make swagger
RUN make sdk-ts-ui
RUN make ui
RUN make build

#################################
# Runtime
#################################
FROM alpine:3.23@sha256:865b95f46d98cf867a156fe4a135ad3fe50d2056aa3f25ed31662dff6da4eb62

RUN apk add --no-cache ca-certificates tzdata postgresql17-client \
 && addgroup -S app && adduser -S app -G app

WORKDIR /app
COPY --from=builder /src/autoglue /app/autoglue

ENV PORT=8080
EXPOSE 8080
USER app

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD wget -qO- "http://127.0.0.1:${PORT}/api/v1/healthz" || exit 1

ENTRYPOINT ["/app/autoglue"]
</file>

<file path="go.mod">
module github.com/glueops/autoglue

go 1.25.4

require (
	github.com/alexedwards/argon2id v1.0.0
	github.com/aws/aws-sdk-go-v2 v1.41.2
	github.com/aws/aws-sdk-go-v2/config v1.32.10
	github.com/aws/aws-sdk-go-v2/credentials v1.19.10
	github.com/aws/aws-sdk-go-v2/service/route53 v1.62.2
	github.com/aws/aws-sdk-go-v2/service/s3 v1.96.2
	github.com/aws/smithy-go v1.24.2
	github.com/coreos/go-oidc/v3 v3.17.0
	github.com/dyaksa/archer v1.1.5
	github.com/fergusstrange/embedded-postgres v1.33.0
	github.com/gin-gonic/gin v1.11.0
	github.com/go-chi/chi/v5 v5.2.5
	github.com/go-chi/cors v1.2.2
	github.com/go-chi/httprate v0.15.0
	github.com/go-playground/validator/v10 v10.30.1
	github.com/golang-jwt/jwt/v5 v5.3.1
	github.com/google/uuid v1.6.0
	github.com/joho/godotenv v1.5.1
	github.com/rs/zerolog v1.34.0
	github.com/sosedoff/pgweb v0.17.0
	github.com/spf13/cobra v1.10.2
	github.com/spf13/viper v1.21.0
	github.com/swaggo/swag/v2 v2.0.0-rc5
	golang.org/x/crypto v0.48.0
	golang.org/x/oauth2 v0.35.0
	gopkg.in/yaml.v3 v3.0.1
	gorm.io/datatypes v1.2.7
	gorm.io/driver/postgres v1.6.0
	gorm.io/gorm v1.31.1
)

require (
	filippo.io/edwards25519 v1.1.1 // indirect
	github.com/BurntSushi/toml v1.1.0 // indirect
	github.com/KyleBanks/depth v1.2.1 // indirect
	github.com/ScaleFT/sshkeys v0.0.0-20200327173127-6142f742bca5 // indirect
	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5 // indirect
	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18 // indirect
	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18 // indirect
	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18 // indirect
	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.18 // indirect
	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5 // indirect
	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.10 // indirect
	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.18 // indirect
	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.18 // indirect
	github.com/aws/aws-sdk-go-v2/service/signin v1.0.6 // indirect
	github.com/aws/aws-sdk-go-v2/service/sso v1.30.11 // indirect
	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15 // indirect
	github.com/aws/aws-sdk-go-v2/service/sts v1.41.7 // indirect
	github.com/beorn7/perks v1.0.1 // indirect
	github.com/bytedance/sonic v1.14.0 // indirect
	github.com/bytedance/sonic/loader v0.3.0 // indirect
	github.com/cespare/xxhash/v2 v2.2.0 // indirect
	github.com/cloudwego/base64x v0.1.6 // indirect
	github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a // indirect
	github.com/fsnotify/fsnotify v1.9.0 // indirect
	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
	github.com/gin-contrib/sse v1.1.0 // indirect
	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
	github.com/go-openapi/jsonpointer v0.19.6 // indirect
	github.com/go-openapi/jsonreference v0.20.2 // indirect
	github.com/go-openapi/spec v0.20.9 // indirect
	github.com/go-openapi/swag v0.22.3 // indirect
	github.com/go-playground/locales v0.14.1 // indirect
	github.com/go-playground/universal-translator v0.18.1 // indirect
	github.com/go-sql-driver/mysql v1.8.1 // indirect
	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
	github.com/goccy/go-json v0.10.5 // indirect
	github.com/goccy/go-yaml v1.18.0 // indirect
	github.com/inconshreveable/mousetrap v1.1.0 // indirect
	github.com/jackc/pgpassfile v1.0.0 // indirect
	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
	github.com/jackc/pgx/v5 v5.6.0 // indirect
	github.com/jackc/puddle/v2 v2.2.2 // indirect
	github.com/jessevdk/go-flags v1.5.0 // indirect
	github.com/jinzhu/inflection v1.0.0 // indirect
	github.com/jinzhu/now v1.1.5 // indirect
	github.com/jmoiron/sqlx v1.3.5 // indirect
	github.com/josharian/intern v1.0.0 // indirect
	github.com/json-iterator/go v1.1.12 // indirect
	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
	github.com/leodido/go-urn v1.4.0 // indirect
	github.com/lib/pq v1.10.9 // indirect
	github.com/mailru/easyjson v0.7.7 // indirect
	github.com/mattn/go-colorable v0.1.13 // indirect
	github.com/mattn/go-isatty v0.0.20 // indirect
	github.com/mitchellh/go-homedir v1.1.0 // indirect
	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
	github.com/modern-go/reflect2 v1.0.2 // indirect
	github.com/mr-tron/base58 v1.2.0 // indirect
	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
	github.com/prometheus/client_golang v1.19.1 // indirect
	github.com/prometheus/client_model v0.5.0 // indirect
	github.com/prometheus/common v0.48.0 // indirect
	github.com/prometheus/procfs v0.12.0 // indirect
	github.com/quic-go/qpack v0.5.1 // indirect
	github.com/quic-go/quic-go v0.54.0 // indirect
	github.com/sagikazarmark/locafero v0.11.0 // indirect
	github.com/sirupsen/logrus v1.9.0 // indirect
	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
	github.com/spf13/afero v1.15.0 // indirect
	github.com/spf13/cast v1.10.0 // indirect
	github.com/spf13/pflag v1.0.10 // indirect
	github.com/subosito/gotenv v1.6.0 // indirect
	github.com/sv-tools/openapi v0.4.0 // indirect
	github.com/tuvistavie/securerandom v0.0.0-20140719024926-15512123a948 // indirect
	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
	github.com/ugorji/go/codec v1.3.0 // indirect
	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
	github.com/zeebo/xxh3 v1.0.2 // indirect
	go.uber.org/mock v0.5.0 // indirect
	go.yaml.in/yaml/v3 v3.0.4 // indirect
	golang.org/x/arch v0.20.0 // indirect
	golang.org/x/mod v0.32.0 // indirect
	golang.org/x/net v0.49.0 // indirect
	golang.org/x/sync v0.19.0 // indirect
	golang.org/x/sys v0.41.0 // indirect
	golang.org/x/text v0.34.0 // indirect
	golang.org/x/tools v0.41.0 // indirect
	google.golang.org/protobuf v1.36.9 // indirect
	gorm.io/driver/mysql v1.5.6 // indirect
)
</file>

<file path="ui/package.json">
{
  "name": "ui",
  "private": true,
  "version": "0.0.0",
  "type": "module",
  "scripts": {
    "dev": "vite",
    "build": "tsc -b && vite build",
    "lint": "eslint .",
    "preview": "vite preview"
  },
  "dependencies": {
    "@hookform/resolvers": "^5.2.2",
    "@radix-ui/react-accordion": "^1.2.12",
    "@radix-ui/react-alert-dialog": "^1.1.15",
    "@radix-ui/react-aspect-ratio": "^1.1.8",
    "@radix-ui/react-avatar": "^1.1.11",
    "@radix-ui/react-checkbox": "^1.3.3",
    "@radix-ui/react-collapsible": "^1.1.12",
    "@radix-ui/react-context-menu": "^2.2.16",
    "@radix-ui/react-dialog": "^1.1.15",
    "@radix-ui/react-dropdown-menu": "^2.1.16",
    "@radix-ui/react-hover-card": "^1.1.15",
    "@radix-ui/react-label": "^2.1.8",
    "@radix-ui/react-menubar": "^1.1.16",
    "@radix-ui/react-navigation-menu": "^1.2.14",
    "@radix-ui/react-popover": "^1.1.15",
    "@radix-ui/react-progress": "^1.1.8",
    "@radix-ui/react-radio-group": "^1.3.8",
    "@radix-ui/react-scroll-area": "^1.2.10",
    "@radix-ui/react-select": "^2.2.6",
    "@radix-ui/react-separator": "^1.1.8",
    "@radix-ui/react-slider": "^1.3.6",
    "@radix-ui/react-slot": "^1.2.4",
    "@radix-ui/react-switch": "^1.2.6",
    "@radix-ui/react-tabs": "^1.1.13",
    "@radix-ui/react-toggle": "^1.1.10",
    "@radix-ui/react-toggle-group": "^1.1.11",
    "@radix-ui/react-tooltip": "^1.2.8",
    "@radix-ui/react-use-controllable-state": "^1.2.2",
    "@tailwindcss/vite": "^4.1.18",
    "@tanstack/react-query": "^5.90.12",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
    "cmdk": "^1.1.1",
    "date-fns": "^4.1.0",
    "embla-carousel-react": "^8.6.0",
    "input-otp": "^1.4.2",
    "lucide-react": "^0.575.0",
    "motion": "^12.23.26",
    "next-themes": "^0.4.6",
    "rapidoc": "^9.3.8",
    "react": "^19.2.3",
    "react-day-picker": "^9.13.0",
    "react-dom": "^19.2.3",
    "react-hook-form": "^7.70.0",
    "react-icons": "^5.5.0",
    "react-resizable-panels": "^3.0.6",
    "react-router-dom": "^7.11.0",
    "recharts": "2.15.4",
    "sonner": "^2.0.7",
    "tailwind-merge": "^3.4.0",
    "tailwindcss": "^4.1.18",
    "vaul": "^1.1.2",
    "zod": "^4.2.1"
  },
  "devDependencies": {
    "@eslint/js": "9.39.3",
    "@ianvs/prettier-plugin-sort-imports": "4.7.1",
    "@types/node": "25.3.0",
    "@types/react": "19.2.14",
    "@types/react-dom": "19.2.3",
    "@vitejs/plugin-react": "5.1.4",
    "eslint": "9.39.3",
    "eslint-plugin-react-hooks": "7.0.1",
    "eslint-plugin-react-refresh": "0.5.2",
    "globals": "16.5.0",
    "prettier": "3.8.1",
    "prettier-plugin-tailwindcss": "0.7.2",
    "shadcn": "3.8.5",
    "tw-animate-css": "1.4.0",
    "typescript": "5.9.3",
    "typescript-eslint": "8.56.1",
    "vite": "7.3.1"
  }
}
</file>

</files>