majuna/app/portal/cloud.py

from typing import Dict, List, Optional, Type, Union

from flask import Blueprint, redirect, render_template, url_for
from flask.typing import ResponseReturnValue
from flask_wtf import FlaskForm
from wtforms import (
    BooleanField,
    Form,
    FormField,
    IntegerField,
    SelectField,
    StringField,
    SubmitField,
)
from wtforms.validators import InputRequired

from app.extensions import db
from app.models.cloud import CloudAccount, CloudProvider

bp = Blueprint("cloud", __name__)

_SECTION_TEMPLATE_VARS = {
    "section": "cloud",
    "help_url": "https://bypass.censorship.guide/user/cloud.html",
}


class NewCloudAccountForm(FlaskForm):  # type: ignore
    provider = SelectField("Cloud Provider", validators=[InputRequired()])
    submit = SubmitField("Next")


class AWSAccountForm(FlaskForm):  # type: ignore
    provider = StringField("Platform", render_kw={"disabled": ""})
    description = StringField("Description", validators=[InputRequired()])
    aws_access_key = StringField("AWS Access Key", validators=[InputRequired()])
    aws_secret_key = StringField("AWS Secret Key", validators=[InputRequired()])
    aws_region = StringField(
        "AWS Region", default="us-east-2", validators=[InputRequired()]
    )
    max_distributions = IntegerField(
        "Cloudfront Distributions Quota",
        default=200,
        description="This is the quota for number of distributions per account.",
        validators=[InputRequired()],
    )
    max_instances = IntegerField(
        "EC2 Instance Quota",
        default=2,
        description="This can be impacted by a number of quotas including instance limits "
        "and IP address limits.",
        validators=[InputRequired()],
    )
    enabled = BooleanField(
        "Enable this account",
        default=True,
        description="New resources will not be deployed to disabled accounts, however existing "
        "resources will persist until destroyed at the end of their lifecycle.",
    )
    submit = SubmitField("Save Changes")


class HcloudAccountForm(FlaskForm):  # type: ignore
    provider = StringField("Platform", render_kw={"disabled": ""})
    description = StringField("Description", validators=[InputRequired()])
    hcloud_token = StringField("Hetzner Cloud Token", validators=[InputRequired()])
    max_instances = IntegerField(
        "Server Limit", default=10, validators=[InputRequired()]
    )
    enabled = BooleanField(
        "Enable this account",
        default=True,
        description="New resources will not be deployed to disabled accounts, however existing "
        "resources will persist until destroyed at the end of their lifecycle.",
    )
    submit = SubmitField("Save Changes")


class GitlabAccountForm(FlaskForm):  # type: ignore
    provider = StringField("Platform", render_kw={"disabled": ""})
    description = StringField("Description", validators=[InputRequired()])
    gitlab_token = StringField("GitLab Access Token", validators=[InputRequired()])
    enabled = BooleanField(
        "Enable this account",
        default=True,
        description="New resources will not be deployed to disabled accounts, however existing "
        "resources will persist until destroyed at the end of their lifecycle.",
    )
    submit = SubmitField("Save Changes")


class OvhHorizonForm(Form):  # type: ignore[misc]
    ovh_openstack_user = StringField("User")
    ovh_openstack_password = StringField("Password")
    ovh_openstack_tenant_id = StringField("Tenant ID")


class OvhApiForm(Form):  # type: ignore[misc]
    ovh_cloud_application_key = StringField("Application Key")
    ovh_cloud_application_secret = StringField("Application Secret")
    ovh_cloud_consumer_key = StringField("Consumer Key")


class OvhAccountForm(FlaskForm):  # type: ignore
    provider = StringField("Platform", render_kw={"disabled": ""})
    description = StringField("Description", validators=[InputRequired()])
    horizon = FormField(OvhHorizonForm, "OpenStack Horizon API")
    ovh_api = FormField(OvhApiForm, "OVH API")
    max_instances = IntegerField(
        "Server Limit", default=10, validators=[InputRequired()]
    )
    enabled = BooleanField(
        "Enable this account",
        default=True,
        description="New resources will not be deployed to disabled accounts, however existing "
        "resources will persist until destroyed at the end of their lifecycle.",
    )
    submit = SubmitField("Save Changes")


class GandiHorizonForm(Form):  # type: ignore[misc]
    gandi_openstack_user = StringField("User")
    gandi_openstack_password = StringField("Password")
    gandi_openstack_tenant_id = StringField("Tenant ID")


class GandiAccountForm(FlaskForm):  # type: ignore
    provider = StringField("Platform", render_kw={"disabled": ""})
    description = StringField("Description", validators=[InputRequired()])
    horizon = FormField(GandiHorizonForm, "OpenStack Horizon API")
    max_instances = IntegerField(
        "Server Limit", default=10, validators=[InputRequired()]
    )
    enabled = BooleanField(
        "Enable this account",
        default=True,
        description="New resources will not be deployed to disabled accounts, however existing "
        "resources will persist until destroyed at the end of their lifecycle.",
    )
    submit = SubmitField("Save Changes")


CloudAccountForm = Union[
    AWSAccountForm, HcloudAccountForm, GandiAccountForm, OvhAccountForm
]

provider_forms: Dict[str, Type[CloudAccountForm]] = {
    CloudProvider.AWS.name: AWSAccountForm,
    CloudProvider.HCLOUD.name: HcloudAccountForm,
    CloudProvider.GANDI.name: GandiAccountForm,
    CloudProvider.GITLAB.name: GitlabAccountForm,
    CloudProvider.OVH.name: OvhAccountForm,
}


def cloud_account_save(
    account: Optional[CloudAccount], provider: CloudProvider, form: CloudAccountForm
) -> None:
    if not account:
        account = CloudAccount()
        account.provider = provider
        db.session.add(account)
    if account.provider != provider:
        raise RuntimeError("Provider mismatch in saving cloud account.")
    account.description = form.description.data
    account.enabled = form.enabled.data
    if provider == CloudProvider.AWS and isinstance(form, AWSAccountForm):
        account.credentials = {
            "aws_access_key": form.aws_access_key.data,
            "aws_secret_key": form.aws_secret_key.data,
            "aws_region": form.aws_region.data,
        }
        account.max_distributions = form.max_distributions.data
        account.max_sub_distributions = 1
        account.max_instances = form.max_instances.data
    elif provider == CloudProvider.HCLOUD and isinstance(form, HcloudAccountForm):
        account.credentials = {
            "hcloud_token": form.hcloud_token.data,
        }
        account.max_distributions = 0
        account.max_sub_distributions = 0
        account.max_instances = form.max_instances.data
    elif provider == CloudProvider.GANDI and isinstance(form, GandiAccountForm):
        account.credentials = {
            "gandi_openstack_user": form.horizon.data["gandi_openstack_user"],
            "gandi_openstack_password": form.horizon.data["gandi_openstack_password"],
            "gandi_openstack_tenant_id": form.horizon.data["gandi_openstack_tenant_id"],
        }
        account.max_distributions = 0
        account.max_sub_distributions = 0
        account.max_instances = form.max_instances.data
    elif provider == CloudProvider.GITLAB and isinstance(form, GitlabAccountForm):
        account.credentials = {
            "gitlab_token": form.gitlab_token.data,
        }
    elif provider == CloudProvider.OVH and isinstance(form, OvhAccountForm):
        account.credentials = {
            "ovh_openstack_user": form.horizon.data["ovh_openstack_user"],
            "ovh_openstack_password": form.horizon.data["ovh_openstack_password"],
            "ovh_openstack_tenant_id": form.horizon.data["ovh_openstack_tenant_id"],
            "ovh_cloud_application_key": form.ovh_api.data["ovh_cloud_application_key"],
            "ovh_cloud_application_secret": form.ovh_api.data[
                "ovh_cloud_application_secret"
            ],
            "ovh_cloud_consumer_key": form.ovh_api.data["ovh_cloud_consumer_key"],
        }
        account.max_distributions = 0
        account.max_sub_distributions = 0
        account.max_instances = form.max_instances.data
    else:
        raise RuntimeError("Unknown provider or form data did not match provider.")


def cloud_account_populate(form: CloudAccountForm, account: CloudAccount) -> None:
    form.provider.data = account.provider.description
    form.description.data = account.description
    form.enabled.data = account.enabled
    if account.provider == CloudProvider.AWS and isinstance(form, AWSAccountForm):
        form.aws_access_key.data = account.credentials["aws_access_key"]
        form.aws_secret_key.data = account.credentials["aws_secret_key"]
        form.aws_region.data = account.credentials["aws_region"]
        form.max_distributions.data = account.max_distributions
        form.max_instances.data = account.max_instances
    elif account.provider == CloudProvider.HCLOUD and isinstance(
        form, HcloudAccountForm
    ):
        form.hcloud_token.data = account.credentials["hcloud_token"]
        form.max_instances.data = account.max_instances
    elif account.provider == CloudProvider.GANDI and isinstance(form, GandiAccountForm):
        form.horizon.form.gandi_openstack_user.data = account.credentials[
            "gandi_openstack_user"
        ]
        form.horizon.form.gandi_openstack_password.data = account.credentials[
            "gandi_openstack_password"
        ]
        form.horizon.form.gandi_openstack_tenant_id.data = account.credentials[
            "gandi_openstack_tenant_id"
        ]
        form.max_instances.data = account.max_instances
    elif account.provider == CloudProvider.GITLAB and isinstance(
        form, GitlabAccountForm
    ):
        form.gitlab_token.data = account.credentials["gitlab_token"]
    elif account.provider == CloudProvider.OVH and isinstance(form, OvhAccountForm):
        form.horizon.form.ovh_openstack_user.data = account.credentials[
            "ovh_openstack_user"
        ]
        form.horizon.form.ovh_openstack_password.data = account.credentials[
            "ovh_openstack_password"
        ]
        form.horizon.form.ovh_openstack_tenant_id.data = account.credentials[
            "ovh_openstack_tenant_id"
        ]
        form.ovh_api.form.ovh_cloud_application_key.data = account.credentials[
            "ovh_cloud_application_key"
        ]
        form.ovh_api.form.ovh_cloud_application_secret.data = account.credentials[
            "ovh_cloud_application_secret"
        ]
        form.ovh_api.form.ovh_cloud_consumer_key.data = account.credentials[
            "ovh_cloud_consumer_key"
        ]
        form.max_instances.data = account.max_instances
    else:
        raise RuntimeError(
            f"Unknown provider {account.provider} or form data {type(form)} did not match provider."
        )


@bp.route("/list")
def cloud_account_list() -> ResponseReturnValue:
    accounts: List[CloudAccount] = CloudAccount.query.filter(
        CloudAccount.destroyed.is_(None)
    ).all()
    return render_template(
        "list.html.j2",
        title="Cloud Accounts",
        item="cloud account",
        items=accounts,
        new_link=url_for("portal.cloud.cloud_account_new"),
        **_SECTION_TEMPLATE_VARS,
    )


@bp.route("/new", methods=["GET", "POST"])
def cloud_account_new() -> ResponseReturnValue:
    form = NewCloudAccountForm()
    form.provider.choices = sorted(
        [(provider.name, provider.description) for provider in CloudProvider],
        key=lambda p: p[1].lower(),
    )
    if form.validate_on_submit():
        return redirect(
            url_for("portal.cloud.cloud_account_new_for", provider=form.provider.data)
        )
    return render_template("new.html.j2", form=form, **_SECTION_TEMPLATE_VARS)


@bp.route("/new/<provider>", methods=["GET", "POST"])
def cloud_account_new_for(provider: str) -> ResponseReturnValue:
    form = provider_forms[provider]()
    form.provider.data = CloudProvider[provider].description
    if form.validate_on_submit():
        cloud_account_save(None, CloudProvider[provider], form)
        db.session.commit()
        return redirect(url_for("portal.cloud.cloud_account_list"))
    return render_template("new.html.j2", form=form, **_SECTION_TEMPLATE_VARS)


@bp.route("/edit/<account_id>", methods=["GET", "POST"])
def cloud_account_edit(account_id: int) -> ResponseReturnValue:
    account = CloudAccount.query.filter(
        CloudAccount.id == account_id,
        CloudAccount.destroyed.is_(None),
    ).first()
    if not account:
        return "Not found", 404
    form = provider_forms[account.provider.name]()
    if form.validate_on_submit():
        cloud_account_save(account, account.provider, form)
        print(account.description)
        db.session.commit()
        return redirect(url_for("portal.cloud.cloud_account_list"))
    cloud_account_populate(form, account)
    return render_template("new.html.j2", form=form, **_SECTION_TEMPLATE_VARS)