feat: initial commit

2025-12-14 17:47:51 +00:00 · 2025-12-14 17:47:51 +00:00 · 075939142f
commit 075939142f
63 changed files with 9494 additions and 0 deletions
--- a/.env.example
+++ b/.env.example
@ -0,0 +1,12 @@
 DATABASE_URL=postgresql://user@localhost:5432/lawa
 DATABASE_ASYNC_URL=postgresql+asyncpg://user@localhost:5432/lawa
 ENVIRONMENT=LOCAL
 CORS_HEADERS=["*"]
 CORS_ORIGINS=["http://localhost:3000"]
 OIDC_ENDPOINT=https://www.example.com/.well-known/openid-configuration
 OIDC_CLIENT_ID=6c1243fd-00c3-4a3b-9081-5d8403352612
 OPENTOFU_PATH=/opt/homebrew/bin/tofu
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,143 @@
 # Byte-compiled / optimized / DLL files
 __pycache__/
 *.py[cod]
 *$py.class
 # C extensions
 *.so
 # Distribution / packaging
 .Python
 build/
 develop-eggs/
 dist/
 downloads/
 eggs/
 .eggs/
 lib/
 lib64/
 parts/
 sdist/
 var/
 wheels/
 pip-wheel-metadata/
 share/python-wheels/
 *.egg-info/
 .installed.cfg
 *.egg
 MANIFEST
 # PyInstaller
 #  Usually these files are written by a python script from a template
 #  before PyInstaller builds the exe, so as to inject date/other infos into it.
 *.manifest
 *.spec
 # Installer logs
 pip-log.txt
 pip-delete-this-directory.txt
 # Unit test / coverage reports
 htmlcov/
 .tox/
 .nox/
 .coverage
 .coverage.*
 .cache
 nosetests.xml
 coverage.xml
 *.cover
 *.py,cover
 .hypothesis/
 .pytest_cache/
 # Translations
 *.mo
 *.pot
 # Django stuff:
 *.log
 local_settings.py
 db.sqlite3
 db.sqlite3-journal
 # Flask stuff:
 instance/
 .webassets-cache
 # Scrapy stuff:
 .scrapy
 # Sphinx documentation
 docs/_build/
 # PyBuilder
 target/
 # Jupyter Notebook
 .ipynb_checkpoints
 # IPython
 profile_default/
 ipython_config.py
 # pyenv
 .python-version
 # pipenv
 #   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
 #   However, in case of collaboration, if having platform-specific dependencies or dependencies
 #   having no cross-platform support, pipenv may install dependencies that don't work, or not
 #   install all needed dependencies.
 #Pipfile.lock
 # PEP 582; used by e.g. github.com/David-OConnor/pyflow
 __pypackages__/
 # Celery stuff
 celerybeat-schedule
 celerybeat.pid
 # SageMath parsed files
 *.sage.py
 # Environments
 .env
 .env.prefect
 .venv
 env/
 venv/
 ENV/
 env.bak/
 venv.bak/
 # Spyder project settings
 .spyderproject
 .spyproject
 # Rope project settings
 .ropeproject
 # mkdocs documentation
 /site
 # mypy
 .mypy_cache/
 .dmypy.json
 dmypy.json
 # Pyre type checker
 .pyre/
 postgres-data*
 node_modules/
 .DS_Store
 # PyCharm
 .idea/
 backup.dump
 backup.dump.gz
 .vscode
 # Terraform
 .terraform
 .terraform.lock.hcl
--- a/48
+++ b/48
@ -0,0 +1,48 @@
 FROM python:3.12-bullseye
 ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONIOENCODING=utf-8 \
    # pip
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_DEFAULT_TIMEOUT=100 \
    PIP_ROOT_USER_ACTION=ignore \
    # poetry
    POETRY_VERSION=1.8.3 \
    POETRY_NO_INTERACTION=1 \
    POETRY_VIRTUALENVS_CREATE=false \
    POETRY_CACHE_DIR='/var/cache/pypoetry' \
    POETRY_HOME='/usr/local' \
    # app
    PROMETHEUS_MULTIPROC_DIR=/tmp/prometheus_multiproc_dir
 SHELL ["/bin/bash", "-eo", "pipefail", "-c"]
 RUN apt-get update && \
    apt-get install -y gcc libpq-dev curl && \
    curl -sSL 'https://install.python-poetry.org' | python - \
    && poetry --version \
    apt clean && \
    rm -rf /var/cache/apt/*
 COPY poetry.lock pyproject.toml /src/
 WORKDIR /src
 RUN --mount=type=cache,target="$POETRY_CACHE_DIR" \
  echo "$ENVIRONMENT" \
  # Install deps:
  && poetry run pip install -U pip \
  && poetry install \
    --no-interaction --no-ansi --sync --with prod
 COPY . .
 RUN useradd -m -d /src -s /bin/bash app \
    && chown -R app:app /src/* && chown -R app:app /src \
    && chmod +x entrypoints/* \
    && rm -rf /tmp/prometheus_multiproc_dir && mkdir -p /tmp/prometheus_multiproc_dir \
    && chown -R app:app /tmp/prometheus_multiproc_dir
 USER app
--- a/21
+++ b/21
@ -0,0 +1,21 @@
 (C) SR2 Communications Limited 2021-2025.
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
    1. Redistributions of source code must retain the above copyright notice,
       this list of conditions and the following disclaimer.
    2. Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in the
       documentation and/or other materials provided with the distribution.
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
--- a/README.md
+++ b/README.md
@ -0,0 +1,99 @@
 # ilo pali lili
 Backend for orchestrating deployment of censorship circumvention resources.
 ## 🪓 Local Development
 ### Setup just
 MacOS:
 ```shell
 brew install just
 ```
 Debian/Ubuntu:
 ```shell
 apt install just
 ````
 Others: [link](https://github.com/casey/just?tab=readme-ov-file#packages)
 ### Setup poetry
 ```shell
 pip install poetry
 ```
 Other ways: [link](https://python-poetry.org/docs/#installation)
 ### Setup Postgres (16.3)
 ```shell
 just up
 ```
 ### Copy the environment file and install dependencies
 1. `cp .env.example .env`
 2. `poetry install`
 ### Run the uvicorn server
 With default settings:
 ```shell
 just run
 ```
 With extra configs (e.g. logging file)
 ```shell
 just run --log-config logging.ini
 ```
 ### 🔍 Linters
 Format the code with `ruff --fix` and `ruff format`
 ```shell
 just lint
 ```
 ### Migrations
 - Create an automatic migration from changes in `src/database.py`
 ```shell
 just mm *migration_name*
 ```
 - Run migrations
 ```shell
 just migrate
 ```
 - Downgrade migrations
 ```shell
 just downgrade downgrade -1  # or -2 or base or hash of the migration
 ```
 ## 🏃🏻‍♀️‍➡️ Deployment
 Deployment is done with Docker and Gunicorn. The Dockerfile is optimized for small size and fast builds with a non-root user. The gunicorn configuration is set to use the number of workers based on the number of CPU cores.
 Example of running the app with docker compose:
 ```shell
 docker compose -f docker-compose.prod.yml up -d --build
 ```
 ## 📜 Conventions
 This project uses the
 [FastAPI best practices](https://github.com/zhanymkanov/fastapi-best-practices)
 documented by GitHub user zhanymkanov and was originally created from their
 [template](https://github.com/zhanymkanov/fastapi_production_template).
 ## 🖋️ Copyright
 Copyright © 2025 SR2 Communications Limited.
 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
 following conditions are met:
 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following
   disclaimer.
 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following
   disclaimer in the documentation and/or other materials provided with the distribution.
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
 INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--- a/alembic.ini
+++ b/alembic.ini
@ -0,0 +1,104 @@
 # A generic, single database configuration.
 [alembic]
 # path to migration scripts
 script_location = alembic
 # template used to generate migration file names; The default value is %%(rev)s_%%(slug)s
 # Uncomment the line below if you want the files to be prepended with date and time
 # see https://alembic.sqlalchemy.org/en/latest/tutorial.html#editing-the-ini-file
 # for all available tokens
 file_template = %%(year)d-%%(month).2d-%%(day).2d_%%(slug)s
 # sys.path path, will be prepended to sys.path if present.
 # defaults to the current working directory.
 prepend_sys_path = .
 # timezone to use when rendering the date within the migration file
 # as well as the filename.
 # If specified, requires the python-dateutil library that can be
 # installed by adding `alembic[tz]` to the pip requirements
 # string value is passed to dateutil.tz.gettz()
 # leave blank for localtime
 # timezone =
 # max length of characters to apply to the
 # "slug" field
 # truncate_slug_length = 40
 # set to 'true' to run the environment during
 # the 'revision' command, regardless of autogenerate
 # revision_environment = false
 # set to 'true' to allow .pyc and .pyo files without
 # a source .py file to be detected as revisions in the
 # versions/ directory
 # sourceless = false
 # version location specification; This defaults
 # to alembic/versions.  When using multiple version
 # directories, initial revisions must be specified with --version-path.
 # The path separator used here should be the separator specified by "version_path_separator" below.
 # version_locations = %(here)s/bar:%(here)s/bat:alembic/versions
 # version path separator; As mentioned above, this is the character used to split
 # version_locations. The default within new alembic.ini files is "os", which uses os.pathsep.
 # If this key is omitted entirely, it falls back to the legacy behavior of splitting on spaces and/or commas.
 # Valid values for version_path_separator are:
 #
 # version_path_separator = :
 # version_path_separator = ;
 # version_path_separator = space
 version_path_separator = os  # Use os.pathsep. Default configuration used for new projects.
 # the output encoding used when revision files
 # are written from script.py.mako
 # output_encoding = utf-8
 sqlalchemy.url = driver://user:pass@localhost/dbname
 [post_write_hooks]
 hooks = ruff_format,ruff
 ruff_format.type = exec
 ruff_format.executable = ruff
 ruff_format.options = format REVISION_SCRIPT_FILENAME
 ruff.type = exec
 ruff.executable = ruff
 ruff.options = check --fix REVISION_SCRIPT_FILENAME
 # Logging configuration
 [loggers]
 keys = root,sqlalchemy,alembic
 [handlers]
 keys = console
 [formatters]
 keys = generic
 [logger_root]
 level = WARN
 handlers = console
 qualname =
 [logger_sqlalchemy]
 level = WARN
 handlers =
 qualname = sqlalchemy.engine
 [logger_alembic]
 level = INFO
 handlers =
 qualname = alembic
 [handler_console]
 class = StreamHandler
 args = (sys.stderr,)
 level = NOTSET
 formatter = generic
 [formatter_generic]
 format = %(levelname)-5.5s [%(name)s] %(message)s
 datefmt = %H:%M:%S
--- a/alembic/README
+++ b/alembic/README
@ -0,0 +1 @@
 Generic single-database configuration.
--- a/alembic/pycache/env.cpython-312.pyc
+++ b/alembic/pycache/env.cpython-312.pyc
--- a/alembic/env.py
+++ b/alembic/env.py
@ -0,0 +1,92 @@
 from logging.config import fileConfig
 from sqlalchemy import engine_from_config, pool
 from alembic import context
 import src.main as _
 from src.config import settings
 from src.database import metadata
 # this is the Alembic Config object, which provides
 # access to the values within the .ini file in use.
 config = context.config
 # Interpret the config file for Python logging.
 # This line sets up loggers basically.
 if config.config_file_name is not None:
    fileConfig(config.config_file_name)
 # add your model's MetaData object here
 # for 'autogenerate' support
 # from myapp import mymodel
 # target_metadata = mymodel.Base.metadata
 target_metadata = metadata
 # other values from the config, defined by the needs of env.py,
 # can be acquired:
 # my_important_option = config.get_main_option("my_important_option")
 # ... etc.
 DATABASE_URL = str(settings.DATABASE_URL)
 db_driver = settings.DATABASE_URL.scheme
 db_driver_parts = db_driver.split("+")
 if len(db_driver_parts) > 1:  # e.g. postgresql+asyncpg
    sync_scheme = db_driver_parts[0].strip()
    DATABASE_URL = DATABASE_URL.replace(  # replace with sync driver
        db_driver, sync_scheme
    )
 config.set_main_option("sqlalchemy.url", DATABASE_URL)
 config.compare_type = True
 config.compare_server_default = True
 def run_migrations_offline() -> None:
    """Run migrations in 'offline' mode.
    This configures the context with just a URL
    and not an Engine, though an Engine is acceptable
    here as well.  By skipping the Engine creation
    we don't even need a DBAPI to be available.
    Calls to context.execute() here emit the given string to the
    script output.
    """
    url = config.get_main_option("sqlalchemy.url")
    context.configure(
        url=url,
        target_metadata=target_metadata,
        literal_binds=True,
        dialect_opts={"paramstyle": "named"},
    )
    with context.begin_transaction():
        context.run_migrations()
 def run_migrations_online() -> None:
    """Run migrations in 'online' mode.
    In this scenario we need to create an Engine
    and associate a connection with the context.
    """
    connectable = engine_from_config(
        config.get_section(config.config_ini_section),
        prefix="sqlalchemy.",
        poolclass=pool.NullPool,
    )
    with connectable.connect() as connection:
        context.configure(connection=connection, target_metadata=target_metadata)
        with context.begin_transaction():
            context.run_migrations()
 if context.is_offline_mode():
    run_migrations_offline()
 else:
    run_migrations_online()
--- a/alembic/script.py.mako
+++ b/alembic/script.py.mako
@ -0,0 +1,24 @@
 """${message}
 Revision ID: ${up_revision}
 Revises: ${down_revision | comma,n}
 Create Date: ${create_date}
 """
 from alembic import op
 import sqlalchemy as sa
 ${imports if imports else ""}
 # revision identifiers, used by Alembic.
 revision = ${repr(up_revision)}
 down_revision = ${repr(down_revision)}
 branch_labels = ${repr(branch_labels)}
 depends_on = ${repr(depends_on)}
 def upgrade() -> None:
    ${upgrades if upgrades else "pass"}
 def downgrade() -> None:
    ${downgrades if downgrades else "pass"}
--- a/alembic/versions/.gitkeep
+++ b/alembic/versions/.gitkeep
--- a/alembic/versions/pycache/2025-12-14_hi.cpython-312.pyc
+++ b/alembic/versions/pycache/2025-12-14_hi.cpython-312.pyc
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@ -0,0 +1,16 @@
 version: '3.7'
 services:
  app:
    container_name: app
    image: app
    env_file:
      - .env
    ports:
      - "8000:8000"
    build:
      context: .
      dockerfile: Dockerfile
    command:
      - entrypoints/gunicorn.sh
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -0,0 +1,19 @@
 version: '3.7'
 services:
  app_db:
    container_name: app_db
    hostname: app_db
    image: library/postgres:17.5
    environment:
      - POSTGRES_USER=app
      - POSTGRES_PASSWORD=app
      - POSTGRES_DB=app
    volumes:
      - app_db_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
 volumes:
  app_db_data:
    driver: "local"
--- a/entrypoints/gunicorn.sh
+++ b/entrypoints/gunicorn.sh
@ -0,0 +1,16 @@
 #!/usr/bin/env bash
 set -e
 DEFAULT_MODULE_NAME=src.main
 MODULE_NAME=${MODULE_NAME:-$DEFAULT_MODULE_NAME}
 VARIABLE_NAME=${VARIABLE_NAME:-app}
 export APP_MODULE=${APP_MODULE:-"$MODULE_NAME:$VARIABLE_NAME"}
 DEFAULT_GUNICORN_CONF=/src/gunicorn/gunicorn_conf.py
 export GUNICORN_CONF=${GUNICORN_CONF:-$DEFAULT_GUNICORN_CONF}
 export WORKER_CLASS=${WORKER_CLASS:-"uvicorn.workers.UvicornWorker"}
 # Start Gunicorn
 gunicorn --forwarded-allow-ips "*" -k "$WORKER_CLASS" -c "$GUNICORN_CONF" "$APP_MODULE"
--- a/frontend/.gitignore
+++ b/frontend/.gitignore
@ -0,0 +1,24 @@
 # Logs
 logs
 *.log
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 pnpm-debug.log*
 lerna-debug.log*
 node_modules
 dist
 dist-ssr
 *.local
 # Editor directories and files
 .vscode/*
 !.vscode/extensions.json
 .idea
 .DS_Store
 *.suo
 *.ntvs*
 *.njsproj
 *.sln
 *.sw?
--- a/frontend/README.md
+++ b/frontend/README.md
@ -0,0 +1,73 @@
 # React + TypeScript + Vite
 This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
 Currently, two official plugins are available:
 - [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Babel](https://babeljs.io/) (or [oxc](https://oxc.rs) when used in [rolldown-vite](https://vite.dev/guide/rolldown)) for Fast Refresh
 - [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh
 ## React Compiler
 The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
 ## Expanding the ESLint configuration
 If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
 ```js
 export default defineConfig([
  globalIgnores(['dist']),
  {
    files: ['**/*.{ts,tsx}'],
    extends: [
      // Other configs...
      // Remove tseslint.configs.recommended and replace with this
      tseslint.configs.recommendedTypeChecked,
      // Alternatively, use this for stricter rules
      tseslint.configs.strictTypeChecked,
      // Optionally, add this for stylistic rules
      tseslint.configs.stylisticTypeChecked,
      // Other configs...
    ],
    languageOptions: {
      parserOptions: {
        project: ['./tsconfig.node.json', './tsconfig.app.json'],
        tsconfigRootDir: import.meta.dirname,
      },
      // other options...
    },
  },
 ])
 ```
 You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:
 ```js
 // eslint.config.js
 import reactX from 'eslint-plugin-react-x'
 import reactDom from 'eslint-plugin-react-dom'
 export default defineConfig([
  globalIgnores(['dist']),
  {
    files: ['**/*.{ts,tsx}'],
    extends: [
      // Other configs...
      // Enable lint rules for React
      reactX.configs['recommended-typescript'],
      // Enable lint rules for React DOM
      reactDom.configs.recommended,
    ],
    languageOptions: {
      parserOptions: {
        project: ['./tsconfig.node.json', './tsconfig.app.json'],
        tsconfigRootDir: import.meta.dirname,
      },
      // other options...
    },
  },
 ])
 ```
--- a/frontend/eslint.config.js
+++ b/frontend/eslint.config.js
@ -0,0 +1,23 @@
 import js from '@eslint/js'
 import globals from 'globals'
 import reactHooks from 'eslint-plugin-react-hooks'
 import reactRefresh from 'eslint-plugin-react-refresh'
 import tseslint from 'typescript-eslint'
 import { defineConfig, globalIgnores } from 'eslint/config'
 export default defineConfig([
  globalIgnores(['dist']),
  {
    files: ['**/*.{ts,tsx}'],
    extends: [
      js.configs.recommended,
      tseslint.configs.recommended,
      reactHooks.configs.flat.recommended,
      reactRefresh.configs.vite,
    ],
    languageOptions: {
      ecmaVersion: 2020,
      globals: globals.browser,
    },
  },
 ])
--- a/frontend/index.html
+++ b/frontend/index.html
@ -0,0 +1,13 @@
 <!doctype html>
 <html lang="en">
  <head>
    <meta charset="UTF-8" />
    <link rel="icon" type="image/svg+xml" href="/vite.svg" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>frontend</title>
  </head>
  <body>
    <div id="root"></div>
    <script type="module" src="/src/main.tsx"></script>
  </body>
 </html>
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
--- a/frontend/package.json
+++ b/frontend/package.json
@ -0,0 +1,32 @@
 {
  "name": "frontend",
  "private": true,
  "version": "0.0.0",
  "type": "module",
  "scripts": {
    "dev": "vite",
    "build": "tsc -b && vite build",
    "lint": "eslint .",
    "preview": "vite preview"
  },
  "dependencies": {
    "antd": "^6.1.0",
    "react": "^19.2.0",
    "react-dom": "^19.2.0",
    "react-router": "^7.10.1"
  },
  "devDependencies": {
    "@eslint/js": "^9.39.1",
    "@types/node": "^24.10.1",
    "@types/react": "^19.2.5",
    "@types/react-dom": "^19.2.3",
    "@vitejs/plugin-react": "^5.1.1",
    "eslint": "^9.39.1",
    "eslint-plugin-react-hooks": "^7.0.1",
    "eslint-plugin-react-refresh": "^0.4.24",
    "globals": "^16.5.0",
    "typescript": "~5.9.3",
    "typescript-eslint": "^8.46.4",
    "vite": "^7.2.4"
  }
 }
--- a/frontend/public/vite.svg
+++ b/frontend/public/vite.svg
@ -0,0 +1 @@
 <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="31.88" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 257"><defs><linearGradient id="IconifyId1813088fe1fbc01fb466" x1="-.828%" x2="57.636%" y1="7.652%" y2="78.411%"><stop offset="0%" stop-color="#41D1FF"></stop><stop offset="100%" stop-color="#BD34FE"></stop></linearGradient><linearGradient id="IconifyId1813088fe1fbc01fb467" x1="43.376%" x2="50.316%" y1="2.242%" y2="89.03%"><stop offset="0%" stop-color="#FFEA83"></stop><stop offset="8.333%" stop-color="#FFDD35"></stop><stop offset="100%" stop-color="#FFA800"></stop></linearGradient></defs><path fill="url(#IconifyId1813088fe1fbc01fb466)" d="M255.153 37.938L134.897 252.976c-2.483 4.44-8.862 4.466-11.382.048L.875 37.958c-2.746-4.814 1.371-10.646 6.827-9.67l120.385 21.517a6.537 6.537 0 0 0 2.322-.004l117.867-21.483c5.438-.991 9.574 4.796 6.877 9.62Z"></path><path fill="url(#IconifyId1813088fe1fbc01fb467)" d="M185.432.063L96.44 17.501a3.268 3.268 0 0 0-2.634 3.014l-5.474 92.456a3.268 3.268 0 0 0 3.997 3.378l24.777-5.718c2.318-.535 4.413 1.507 3.936 3.838l-7.361 36.047c-.495 2.426 1.782 4.5 4.151 3.78l15.304-4.649c2.372-.72 4.652 1.36 4.15 3.788l-11.698 56.621c-.732 3.542 3.979 5.473 5.943 2.437l1.313-2.028l72.516-144.72c1.215-2.423-.88-5.186-3.54-4.672l-25.505 4.922c-2.396.462-4.435-1.77-3.759-4.114l16.646-57.705c.677-2.35-1.37-4.583-3.769-4.113Z"></path></svg>
--- a/frontend/src/ApiKeyButton.tsx
+++ b/frontend/src/ApiKeyButton.tsx
@ -0,0 +1,67 @@
 import {type Dispatch, type SetStateAction, useEffect} from 'react';
 import {Button, message} from "antd";
 interface ApiKeyProps {
    apiKey?: string;
    setApiKey: Dispatch<SetStateAction<string | undefined>>;
 }
 const ApiKeyButton: React.FC<ApiKeyProps> = ({apiKey, setApiKey}) => {
    // Check if API key already exists in localStorage on component mount
    useEffect(() => {
        const savedApiKey = localStorage.getItem('apiKey');
        if (savedApiKey) {
            setApiKey(savedApiKey);
        }
    }, [setApiKey]);
    const handleSetApiKey = async () => {
        const key = prompt('Please enter your API key:');
        if (key) {
            const response = await fetch(
                "/api/v1/tofu/instances",
                {
                    headers: {
                        "Authorization": `Bearer ${key}`,
                        "Content-Type": "application/json"
                    }
                }
            );
            if (response.ok) {
                // Store the API key in localStorage
                localStorage.setItem('apiKey', key);
                setApiKey(key);
                message.info("API key added successfully");
            } else {
                message.error("Invalid API key");
            }
        } else if (key !== undefined) { // User clicked OK but left empty
            message.error('API key cannot be empty.');
        }
        // If user clicked Cancel, do nothing
    };
    const handleRemoveApiKey = () => {
        localStorage.removeItem('apiKey');
        setApiKey(undefined);
    };
    return (
        <>
            {apiKey !== undefined ? (
                <div>
                    <Button type="default" danger onClick={handleRemoveApiKey}>
                        Remove API Key
                    </Button>
                </div>
            ) : (
                <Button type='primary' onClick={handleSetApiKey}>
                    Set API Key
                </Button>
            )}
        </>
    );
 };
 export default ApiKeyButton;
--- a/frontend/src/App.css
+++ b/frontend/src/App.css
@ -0,0 +1,12 @@
 body {
    margin: 0;
 }
 .demo-logo {
    width: 120px;
    min-width: 120px;
    height: 32px;
    background: rgba(255, 255, 255, .2);
    border-radius: 6px;
    margin-inline-end: 24px;
 }
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@ -0,0 +1,84 @@
 import React, {useState} from 'react';
 import {CloudServerOutlined, UnorderedListOutlined} from '@ant-design/icons';
 import {Breadcrumb, Layout, Menu, type MenuProps, theme, Typography} from 'antd';
 import "./App.css";
 import ApiKeyButton from "./ApiKeyButton.tsx";
 import TofuInstanceList from "./TofuInstanceList.tsx";
 import {Navigate, Route, Routes, useNavigate} from "react-router";
 import TofuInstanceDetail from "./TofuInstanceDetail.tsx";
 const {Header, Content, Footer, Sider} = Layout;
 const {Title, Paragraph} = Typography;
 const App: React.FC = () => {
    const {
        token: {colorBgContainer, borderRadiusLG},
    } = theme.useToken();
    const [apiKey, setApiKey] = useState<string | undefined>(undefined);
    const [breadcrumb, setBreadcrumb] = useState();
    const navigate = useNavigate();
    const sideMenu: MenuProps['items'] = [{
        key: 'tofu',
        label: 'OpenTofu',
        icon: React.createElement(CloudServerOutlined),
        children: [
            {
                key: 'instances',
                label: 'Instances',
                icon: React.createElement(UnorderedListOutlined),
                onClick: () => {
                    navigate("/tofu/instances/")
                }
            }
        ]
    }]
    return (
        <Layout>
            <Header style={{display: 'flex', alignItems: 'center'}}>
                <div className="demo-logo"/>
                <ApiKeyButton apiKey={apiKey} setApiKey={setApiKey}/>
            </Header>
            <div style={{padding: '0 48px'}}>
                {apiKey && <Breadcrumb
                    style={{margin: '16px 0'}}
                    items={breadcrumb}
                />}
                <Layout
                    style={{padding: '24px 0', background: colorBgContainer, borderRadius: borderRadiusLG}}
                >
                    {apiKey && <Sider style={{background: colorBgContainer}} width={200}>
                        <Menu
                            mode="inline"
                            defaultSelectedKeys={['instances']}
                            defaultOpenKeys={['tofu']}
                            style={{height: '100%'}}
                            items={sideMenu}
                        />
                    </Sider>}
                    <Content style={{padding: '0 24px', minHeight: 280}}>
                        {(apiKey && <Routes>
                            <Route index element={<Navigate to="/tofu/instances"/>}/>
                            <Route path="/tofu" element={<Navigate to="/tofu/instances"/>}/>
                            <Route path="/tofu/instances"
                                   element={<TofuInstanceList apiKey={apiKey} setBreadcrumb={setBreadcrumb}/>}/>
                            <Route path="/tofu/instances/:instanceId"
                                   element={<TofuInstanceDetail apiKey={apiKey} setBreadcrumb={setBreadcrumb}/>}/>
                        </Routes>) || <>
                            <Title>API Key Required</Title>
                            <Paragraph>Use the button above to enter your API key.</Paragraph>
                        </>}
                    </Content>
                </Layout>
            </div>
            <Footer style={{textAlign: 'center'}}>
                Copyright © 2021-{new Date().getFullYear()} SR2 Communications Limited.
            </Footer>
        </Layout>
    );
 };
 export default App;
--- a/frontend/src/TofuInstanceDetail.tsx
+++ b/frontend/src/TofuInstanceDetail.tsx
@ -0,0 +1,215 @@
 import {Alert, Button, Descriptions, Input, message, Modal, Space, Table, Tooltip, Typography} from "antd";
 import {type Dispatch, type SetStateAction, useEffect, useState} from "react";
 import {deleteInstance, statusTag, updateInstance} from "./client.tsx";
 import {useNavigate, useParams} from "react-router";
 import {DeleteOutlined, EyeOutlined, ReloadOutlined, ToolOutlined} from "@ant-design/icons";
 const {Title, Paragraph, Text} = Typography;
 const {TextArea} = Input;
 interface TofuInstanceDetailProps {
    apiKey: string
    setBreadcrumb: Dispatch<SetStateAction<object[]>>;
 }
 const showLogs = async (apiKey: string, taskId: number, setLogs: Dispatch<SetStateAction<string>>) => {
    const response = await fetch("/api/v1/tofu/logs/" + taskId, {
        headers: {
            "Authorization": `Bearer ${apiKey}`, "Content-Type": "application/json"
        },
    });
    const reader = response.body?.getReader();
    if (!reader) {
        message.error("Could not open logs stream");
        return;
    }
    const decoder = new TextDecoder()
    let buffer = "";
    let messages = "";
    while (true) {
        const {value, done} = await reader.read();
        buffer += decoder.decode(value, {stream: true});
        let boundary;
        while ((boundary = buffer.indexOf('\n')) !== -1) {
            const line = buffer.slice(0, boundary).trim();
            buffer = buffer.slice(boundary + 1);
            if (line) {
                try {
                    const json = JSON.parse(line);
                    if (json["@message"] === undefined) {
                        messages += JSON.stringify(json) + "\n";
                    } else {
                        messages += json["@message"] + "\n";
                    }
                } catch (e) {
                    console.error('Failed to parse JSON line:', e, 'Line:', line);
                }
            }
        }
        setLogs(messages);
        if (done) break;
    }
 }
 const TofuInstanceDetail: React.FC<TofuInstanceDetailProps> = ({apiKey, setBreadcrumb}) => {
    const [instance, setInstance] = useState(undefined);
    const [isLoading, setIsLoading] = useState(true);
    const [isConfigurationVisible, setIsConfigurationVisible] = useState(false);
    const [configuration, setConfiguration] = useState("");
    const [reloadCount, setReloadCount] = useState(0);
    const [errorMessage, setErrorMessage] = useState<string | undefined>(undefined);
    const [logs, setLogs] = useState("");
    const navigate = useNavigate();
    const {instanceId} = useParams();
    useEffect(() => {
        const fetchInstance = async () => {
            try {
                setIsLoading(true);
                const response = await fetch("/api/v1/tofu/instances/" + instanceId, {
                    headers: {
                        "Authorization": `Bearer ${apiKey}`, "Content-Type": "application/json"
                    }
                });
                if (response.ok) {
                    const data = await response.json();
                    data.tasks = data.tasks.map((task, index: number) => ({
                        ...task, key: index + 1
                    }));
                    setInstance(data);
                    if (data.outputs) {
                        data.outputs = Object.entries<object>(data.outputs).map(([key, value]) => ({
                            ...value,
                            output: key,
                            key: key,
                        }));
                    }
                    setConfiguration(JSON.stringify(data.configuration));
                    setErrorMessage(undefined);
                } else {
                    setErrorMessage("Failed to fetch instances:" + response.status);
                    setInstance(undefined);
                }
            } catch (error) {
                setErrorMessage("Error fetching instances:" + error);
                setInstance(undefined);
            } finally {
                setIsLoading(false);
            }
        };
        setBreadcrumb([
            {"title": "OpenTofu", href: "/tofu"},
            {"title": "Instances", href: "/tofu/instances"},
            {"title": "Instance " + instanceId},
        ])
        fetchInstance();
    }, [apiKey, instanceId, reloadCount, setBreadcrumb, setConfiguration, setInstance, setIsLoading]);
    const taskColumns = [{"title": "ID", "dataIndex": "id", "key": "id"}, {
        "title": "Status", "dataIndex": "status", "key": "state", render: statusTag
    }, {
        "title": "Created",
        dataIndex: "created_at",
        key: "created_at",
        sorter: (a, b) => a.created_at.localeCompare(b.created_at)
    }, {
        "title": "Started",
        dataIndex: "start_time",
        key: "start_time",
        render: (time) => (time || "Not yet"),
        sorter: (a, b) => a.start_time.localeCompare(b.start_time)
    }, {
        "title": "Ended",
        dataIndex: "end_time",
        key: "end_time",
        render: (time) => (time || "Not yet"),
        sorter: (a, b) => a.end_time.localeCompare(b.end_time)
    }, {
        title: 'Action', key: 'action', render: (_, record) => (<Space size="middle">
            <Button type="default" onClick={() => {
                showLogs(apiKey, record.id, setLogs)
            }}><EyeOutlined/> View Log</Button>
        </Space>),
    },]
    const outputColumns = [
        {"title": "Output", "dataIndex": "output", "key": "output"},
        {"title": "Value", "dataIndex": "value", "key": "value", render: (_, record) => {
            if (record.sensitive) {
                return (<Tooltip placement="top" title={record.value}>
                    <Text type="secondary">Sensitive Value</Text>
                </Tooltip>);
            } else {
                return record.value;
            }
        }},
        {"title": "Type", "dataIndex": "type", "key": "type"}
    ]
    return (<>
        <Title>Instance {instanceId}</Title>
        <Paragraph>
            {errorMessage && <Alert title={errorMessage} type="error"/>}
        </Paragraph>
        <Paragraph>
            <Space size="middle">
                <Button type="default" onClick={() => {
                    setIsConfigurationVisible(true)
                }}><ToolOutlined/> Configuration</Button>
                <Button onClick={() => setReloadCount(reloadCount + 1)}
                        loading={isLoading}><ReloadOutlined/> Reload</Button>
                <Button type="default" danger={true} onClick={() => {
                    deleteInstance(apiKey, instanceId).then(() => {
                        navigate("/tofu/instances")
                    });
                }}><DeleteOutlined/> Delete</Button>
            </Space>
        </Paragraph>
        {instance && <>
            <Descriptions title="Properties">
                <Descriptions.Item label="ID">{instance.id}</Descriptions.Item>
                <Descriptions.Item label="Status">{statusTag(instance.status)}</Descriptions.Item>
                <Descriptions.Item label="Created">{instance.created_at}</Descriptions.Item>
                <Descriptions.Item label="Updated">{instance.updated_at}</Descriptions.Item>
                <Descriptions.Item label="Drift Checked">{instance.drift_checked_at || "Never"}</Descriptions.Item>
                <Descriptions.Item label="State Lock">
                    {(instance.state_lock && "Since " + instance.state_lock.Created) || "Unlocked"}
                </Descriptions.Item>
            </Descriptions>
            <Title level={2}>Instance Tasks</Title>
            <Table columns={taskColumns} dataSource={instance.tasks} loading={isLoading}/>
            {instance.outputs && <>
                <Title level={2}>Instance Outputs</Title>
                <Table columns={outputColumns} dataSource={instance.outputs} loading={isLoading}/>
            </>}
            <Modal
                title="Configuration"
                open={isConfigurationVisible}
                onCancel={() => setIsConfigurationVisible(false)}
                footer={[<Button key="back" danger onClick={() => {
                    updateInstance(apiKey, instanceId, configuration);
                    setIsConfigurationVisible(false);
                }}>Update</Button>,
                    <Button key="back" onClick={() => setIsConfigurationVisible(false)}>Cancel</Button>]}
                width="90%"
            >
                <TextArea rows={20} value={configuration} onChange={(e) => setConfiguration(e.target.value)}/>
            </Modal>
            <Modal
                title="Logs"
                footer={[<Button key="back" onClick={() => setLogs("")}>Close</Button>]}
                onCancel={() => setLogs("")}
                width="90%"
                open={logs !== ""}
            >
                <pre style={{"overflow": "auto"}}>{logs}</pre>
            </Modal>
        </>}
    </>)
 };
 export default TofuInstanceDetail;
--- a/frontend/src/TofuInstanceList.tsx
+++ b/frontend/src/TofuInstanceList.tsx
@ -0,0 +1,119 @@
 import {Alert, Button, Input, Modal, Space, Table, Typography} from "antd";
 import {type Dispatch, type SetStateAction, useEffect, useState} from "react";
 import {createInstance, deleteInstance, statusTag} from "./client.tsx";
 import {useNavigate} from "react-router";
 import {PlusOutlined, ReloadOutlined} from "@ant-design/icons";
 const {Title, Paragraph} = Typography;
 const {TextArea} = Input;
 const defaultNewConfiguration = "{\"resource\":{\"random_password\":{\"example\":{\"length\":20}}},\"output\":{\"example\":{\"value\":\"${random_password.example.result}\",\"sensitive\":true}}}"
 interface TofuInstanceListProps {
    apiKey?: string
    setBreadcrumb: Dispatch<SetStateAction<object[]>>
 }
 const TofuInstanceList: React.FC<TofuInstanceListProps> = ({apiKey, setBreadcrumb}) => {
    const [instances, setInstances] = useState([]);
    const [isLoading, setIsLoading] = useState(true);
    const [isNewModalVisible, setIsNewModalVisible] = useState(false);
    const [configuration, setConfiguration] = useState<string>(defaultNewConfiguration);
    const [reloadCount, setReloadCount] = useState(0);
    const [errorMessage, setErrorMessage] = useState<string | undefined>(undefined);
    const navigate = useNavigate();
    useEffect(() => {
        const fetchInstances = async () => {
            try {
                setIsLoading(true);
                const response = await fetch("/api/v1/tofu/instances", {
                    headers: {
                        "Authorization": `Bearer ${apiKey}`, "Content-Type": "application/json"
                    }
                });
                if (response.ok) {
                    const data = await response.json();
                    setInstances((data.items || []).map((item: object, index: number) => ({
                        ...item, key: index + 1
                    })));
                    setErrorMessage(undefined);
                } else {
                    setErrorMessage("Failed to fetch deployments:" + response.status);
                    setInstances([]);
                }
            } catch (error) {
                setErrorMessage("Error fetching deployments:" + error);
                setInstances([]);
            } finally {
                setIsLoading(false);
            }
        };
        setBreadcrumb([{"title": "OpenTofu", href: "/tofu"}, {
            "title": "Instances",
            href: "/tofu/instances"
        }, {"title": "List"},])
        if (apiKey) fetchInstances();
    }, [apiKey, reloadCount, setBreadcrumb, setInstances, setIsLoading]); // Reload when apiKey or reloadCount changes
    if (!apiKey) return <></>;
    const columns = [{
        "title": "ID",
        "dataIndex": "id",
        "key": "id",
        sorter: (a, b) => a.id < b.id,
        defaultSortOrder: 'descend'
    }, {
        "title": "Status", "dataIndex": "status", "key": "state", render: statusTag
    }, {
        "title": "Last Status Change",
        key: "status_changed_at",
        dataIndex: "status_changed_at"
    }, {"title": "Last Drift Check", key: "drift_checked_at", dataIndex: "drift_checked_at"}, {
        title: 'Action', key: 'action', render: (_, record: { id: string | number; }) => (<Space size="middle">
                <Button type="primary" onClick={() => {
                    navigate("/tofu/instances/" + record.id)
                }}>Details</Button>
                <Button type="link" danger={true} onClick={() => {
                    deleteInstance(apiKey, record.id).then(() => {
                        setReloadCount(reloadCount + 1)
                    });
                }}>Delete</Button>
            </Space>),
    },]
    return (<>
            <Title>Instances</Title>
            <Paragraph>
                {errorMessage && <Alert title={errorMessage} type="error"/>}
            </Paragraph>
            <Paragraph>
                <Space size="middle">
                <Button type="dashed" onClick={() => setIsNewModalVisible(true)}><PlusOutlined /> New</Button>
                <Button onClick={() => setReloadCount(reloadCount + 1)} loading={isLoading}><ReloadOutlined /> Reload</Button>
                </Space>
            </Paragraph>
            <Table columns={columns} dataSource={instances} loading={isLoading}/>
        <Modal
            title="New Instance Configuration"
            open={isNewModalVisible}
            onCancel={() => setIsNewModalVisible(false)}
            footer={[<Button key="back" danger onClick={async () => {
                const instanceId = await createInstance(apiKey, configuration);
                setIsNewModalVisible(false);
                navigate("/tofu/instances/" + instanceId)
            }}>Update</Button>,
                <Button key="back" onClick={() => setIsNewModalVisible(false)}>Cancel</Button>]}
            width="90%"
        >
            <TextArea rows={20} value={configuration} onChange={(e) => setConfiguration(e.target.value)}/>
        </Modal>
        </>)
 };
 export default TofuInstanceList;
--- a/frontend/src/assets/react.svg
+++ b/frontend/src/assets/react.svg
@ -0,0 +1,5 @@
 <svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" role="img"
     class="iconify iconify--logos" width="35.93" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 228">
    <path fill="#00D8FF"
          d="M210.483 73.824a171.49 171.49 0 0 0-8.24-2.597c.465-1.9.893-3.777 1.273-5.621c6.238-30.281 2.16-54.676-11.769-62.708c-13.355-7.7-35.196.329-57.254 19.526a171.23 171.23 0 0 0-6.375 5.848a155.866 155.866 0 0 0-4.241-3.917C100.759 3.829 77.587-4.822 63.673 3.233C50.33 10.957 46.379 33.89 51.995 62.588a170.974 170.974 0 0 0 1.892 8.48c-3.28.932-6.445 1.924-9.474 2.98C17.309 83.498 0 98.307 0 113.668c0 15.865 18.582 31.778 46.812 41.427a145.52 145.52 0 0 0 6.921 2.165a167.467 167.467 0 0 0-2.01 9.138c-5.354 28.2-1.173 50.591 12.134 58.266c13.744 7.926 36.812-.22 59.273-19.855a145.567 145.567 0 0 0 5.342-4.923a168.064 168.064 0 0 0 6.92 6.314c21.758 18.722 43.246 26.282 56.54 18.586c13.731-7.949 18.194-32.003 12.4-61.268a145.016 145.016 0 0 0-1.535-6.842c1.62-.48 3.21-.974 4.76-1.488c29.348-9.723 48.443-25.443 48.443-41.52c0-15.417-17.868-30.326-45.517-39.844Zm-6.365 70.984c-1.4.463-2.836.91-4.3 1.345c-3.24-10.257-7.612-21.163-12.963-32.432c5.106-11 9.31-21.767 12.459-31.957c2.619.758 5.16 1.557 7.61 2.4c23.69 8.156 38.14 20.213 38.14 29.504c0 9.896-15.606 22.743-40.946 31.14Zm-10.514 20.834c2.562 12.94 2.927 24.64 1.23 33.787c-1.524 8.219-4.59 13.698-8.382 15.893c-8.067 4.67-25.32-1.4-43.927-17.412a156.726 156.726 0 0 1-6.437-5.87c7.214-7.889 14.423-17.06 21.459-27.246c12.376-1.098 24.068-2.894 34.671-5.345a134.17 134.17 0 0 1 1.386 6.193ZM87.276 214.515c-7.882 2.783-14.16 2.863-17.955.675c-8.075-4.657-11.432-22.636-6.853-46.752a156.923 156.923 0 0 1 1.869-8.499c10.486 2.32 22.093 3.988 34.498 4.994c7.084 9.967 14.501 19.128 21.976 27.15a134.668 134.668 0 0 1-4.877 4.492c-9.933 8.682-19.886 14.842-28.658 17.94ZM50.35 144.747c-12.483-4.267-22.792-9.812-29.858-15.863c-6.35-5.437-9.555-10.836-9.555-15.216c0-9.322 13.897-21.212 37.076-29.293c2.813-.98 5.757-1.905 8.812-2.773c3.204 10.42 7.406 21.315 12.477 32.332c-5.137 11.18-9.399 22.249-12.634 32.792a134.718 134.718 0 0 1-6.318-1.979Zm12.378-84.26c-4.811-24.587-1.616-43.134 6.425-47.789c8.564-4.958 27.502 2.111 47.463 19.835a144.318 144.318 0 0 1 3.841 3.545c-7.438 7.987-14.787 17.08-21.808 26.988c-12.04 1.116-23.565 2.908-34.161 5.309a160.342 160.342 0 0 1-1.76-7.887Zm110.427 27.268a347.8 347.8 0 0 0-7.785-12.803c8.168 1.033 15.994 2.404 23.343 4.08c-2.206 7.072-4.956 14.465-8.193 22.045a381.151 381.151 0 0 0-7.365-13.322Zm-45.032-43.861c5.044 5.465 10.096 11.566 15.065 18.186a322.04 322.04 0 0 0-30.257-.006c4.974-6.559 10.069-12.652 15.192-18.18ZM82.802 87.83a323.167 323.167 0 0 0-7.227 13.238c-3.184-7.553-5.909-14.98-8.134-22.152c7.304-1.634 15.093-2.97 23.209-3.984a321.524 321.524 0 0 0-7.848 12.897Zm8.081 65.352c-8.385-.936-16.291-2.203-23.593-3.793c2.26-7.3 5.045-14.885 8.298-22.6a321.187 321.187 0 0 0 7.257 13.246c2.594 4.48 5.28 8.868 8.038 13.147Zm37.542 31.03c-5.184-5.592-10.354-11.779-15.403-18.433c4.902.192 9.899.29 14.978.29c5.218 0 10.376-.117 15.453-.343c-4.985 6.774-10.018 12.97-15.028 18.486Zm52.198-57.817c3.422 7.8 6.306 15.345 8.596 22.52c-7.422 1.694-15.436 3.058-23.88 4.071a382.417 382.417 0 0 0 7.859-13.026a347.403 347.403 0 0 0 7.425-13.565Zm-16.898 8.101a358.557 358.557 0 0 1-12.281 19.815a329.4 329.4 0 0 1-23.444.823c-7.967 0-15.716-.248-23.178-.732a310.202 310.202 0 0 1-12.513-19.846h.001a307.41 307.41 0 0 1-10.923-20.627a310.278 310.278 0 0 1 10.89-20.637l-.001.001a307.318 307.318 0 0 1 12.413-19.761c7.613-.576 15.42-.876 23.31-.876H128c7.926 0 15.743.303 23.354.883a329.357 329.357 0 0 1 12.335 19.695a358.489 358.489 0 0 1 11.036 20.54a329.472 329.472 0 0 1-11 20.722Zm22.56-122.124c8.572 4.944 11.906 24.881 6.52 51.026c-.344 1.668-.73 3.367-1.15 5.09c-10.622-2.452-22.155-4.275-34.23-5.408c-7.034-10.017-14.323-19.124-21.64-27.008a160.789 160.789 0 0 1 5.888-5.4c18.9-16.447 36.564-22.941 44.612-18.3ZM128 90.808c12.625 0 22.86 10.235 22.86 22.86s-10.235 22.86-22.86 22.86s-22.86-10.235-22.86-22.86s10.235-22.86 22.86-22.86Z"></path>
 </svg>
--- a/frontend/src/client.tsx
+++ b/frontend/src/client.tsx
@ -0,0 +1,81 @@
 import {message, Tag} from "antd";
 const statusTag = (status: string) => {
    switch (status) {
        case "ACTIVE":
        case "COMPLETED":
            return (<Tag color="green">{status}</Tag>)
        case "PENDING":
        case "RUNNING":
            return (<Tag color="blue">{status}</Tag>);
        case "PENDING_DESTROY":
            return (<Tag color="yellow">{status.replace("_", " ")}</Tag>);
        case "FAILED":
        case "FAILED_DESTROY":
            return (<Tag color="red">{status.replace("_", " ")}</Tag>);
        default:
            return status;
    }
 }
 const createInstance = async (apiKey: string, configuration: string) => {
    const response = await fetch(
        "/api/v1/tofu/instances",
        {
            method: "POST",
            headers: {
                "Authorization": `Bearer ${apiKey}`,
                "Content-Type": "application/json"
            },
            body: JSON.stringify({"configuration": JSON.parse(configuration)})
        }
    );
    const status = response.status;
    const json = await response.json();
    if (status === 202) {
        message.info("OpenTofu instance " + json.id + " creation in progress!");
        return json.id;
    } else {
        message.error("Could not update OpenTofu instance " + json.id + ": " + status);
    }
 }
 const updateInstance = async (apiKey: string, instanceId: number, configuration: string) => {
    const response = await fetch(
        "/api/v1/tofu/instances/" + instanceId,
        {
            method: "PUT",
            headers: {
                "Authorization": `Bearer ${apiKey}`,
                "Content-Type": "application/json"
            },
            body: JSON.stringify({"configuration": JSON.parse(configuration)})
        }
    );
    const status = response.status;
    if (status === 202) {
        message.info("OpenTofu instance " + instanceId + " update in progress!");
    } else {
        message.error("Could not update OpenTofu instance " + instanceId + ": " + status);
    }
 }
 const deleteInstance = async (apiKey: string, instanceId: number) => {
    const response = await fetch(
        "/api/v1/tofu/instances/" + instanceId,
        {
            method: "DELETE",
            headers: {
                "Authorization": `Bearer ${apiKey}`,
            }
        }
    );
    const status = response.status;
    if (status === 202) {
        message.info("OpenTofu instance " + instanceId + " deletion in progress!");
    } else {
        message.error("Could not delete OpenTofu instance " + instanceId + ": " + status);
    }
 }
 export {createInstance, deleteInstance, statusTag, updateInstance};
--- a/frontend/src/main.tsx
+++ b/frontend/src/main.tsx
@ -0,0 +1,12 @@
 import {StrictMode} from 'react'
 import {createRoot} from 'react-dom/client'
 import App from './App.tsx'
 import {BrowserRouter} from "react-router";
 createRoot(document.getElementById('root')!).render(
    <StrictMode>
        <BrowserRouter>
            <App/>
        </BrowserRouter>
    </StrictMode>,
 )
--- a/frontend/tsconfig.app.json
+++ b/frontend/tsconfig.app.json
@ -0,0 +1,28 @@
 {
  "compilerOptions": {
    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
    "target": "ES2022",
    "useDefineForClassFields": true,
    "lib": ["ES2022", "DOM", "DOM.Iterable"],
    "module": "ESNext",
    "types": ["vite/client"],
    "skipLibCheck": true,
    /* Bundler mode */
    "moduleResolution": "bundler",
    "allowImportingTsExtensions": true,
    "verbatimModuleSyntax": true,
    "moduleDetection": "force",
    "noEmit": true,
    "jsx": "react-jsx",
    /* Linting */
    "strict": true,
    "noUnusedLocals": true,
    "noUnusedParameters": true,
    "erasableSyntaxOnly": true,
    "noFallthroughCasesInSwitch": true,
    "noUncheckedSideEffectImports": true
  },
  "include": ["src"]
 }
--- a/frontend/tsconfig.json
+++ b/frontend/tsconfig.json
@ -0,0 +1,7 @@
 {
  "files": [],
  "references": [
    { "path": "./tsconfig.app.json" },
    { "path": "./tsconfig.node.json" }
  ]
 }
--- a/frontend/tsconfig.node.json
+++ b/frontend/tsconfig.node.json
@ -0,0 +1,26 @@
 {
  "compilerOptions": {
    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
    "target": "ES2023",
    "lib": ["ES2023"],
    "module": "ESNext",
    "types": ["node"],
    "skipLibCheck": true,
    /* Bundler mode */
    "moduleResolution": "bundler",
    "allowImportingTsExtensions": true,
    "verbatimModuleSyntax": true,
    "moduleDetection": "force",
    "noEmit": true,
    /* Linting */
    "strict": true,
    "noUnusedLocals": true,
    "noUnusedParameters": true,
    "erasableSyntaxOnly": true,
    "noFallthroughCasesInSwitch": true,
    "noUncheckedSideEffectImports": true
  },
  "include": ["vite.config.ts"]
 }
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@ -0,0 +1,15 @@
 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
 // https://vite.dev/config/
 export default defineConfig({
  plugins: [react()],
  server: {
    proxy: {
      '/api/': {
        target: 'http://localhost:8000',
        changeOrigin: true,
      }
    }
  }
 })
--- a/gunicorn/gunicorn_conf.py
+++ b/gunicorn/gunicorn_conf.py
@ -0,0 +1,65 @@
 import multiprocessing
 from pydantic import Field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 try:
    from prometheus_client import multiprocess
    def child_exit(_, worker):
        multiprocess.mark_process_dead(worker.pid)
 except ImportError:
    pass
 class Settings(BaseSettings):
    model_config = SettingsConfigDict(
        env_file=".env", env_file_encoding="utf-8", extra="ignore"
    )
    host: str = "0.0.0.0"
    port: int = 8000
    bind: str | None = None
    workers_per_core: int = Field(1)
    max_workers: int | None = None
    web_concurrency: int | None = None
    graceful_timeout: int = 120
    timeout: int = 120
    keepalive: int = 5
    log_level: str = "INFO"
    log_config: str = "/src/logging_production.ini"
    @property
    def computed_bind(self) -> str:
        return self.bind if self.bind else f"{self.host}:{self.port}"
    @property
    def computed_web_concurrency(self) -> int:
        cores = multiprocessing.cpu_count()
        default_web_concurrency = self.workers_per_core * cores + 1
        if self.web_concurrency:
            assert self.web_concurrency > 0
            return self.web_concurrency
        else:
            web_concurrency = max(default_web_concurrency, 2)
            if self.max_workers:
                return min(web_concurrency, self.max_workers)
            return web_concurrency
 settings = Settings()
 # Gunicorn config variables
 loglevel = settings.log_level
 workers = settings.computed_web_concurrency
 bind = settings.computed_bind
 worker_tmp_dir = "/dev/shm"
 graceful_timeout = settings.graceful_timeout
 timeout = settings.timeout
 keepalive = settings.keepalive
 logconfig = settings.log_config
--- a/40
+++ b/40
@ -0,0 +1,40 @@
 default:
  just --list
 run *args:
  poetry run uvicorn src.main:app --reload {{args}}
 mm *args:
  poetry run alembic revision --autogenerate -m "{{args}}"
 migrate:
  poetry run alembic upgrade head
 downgrade *args:
  poetry run alembic downgrade {{args}}
 black *args:
  poetry run black {{args}} src
 ruff *args:
  poetry run ruff check {{args}} src
 lint:
  poetry run ruff format src
  just ruff --fix
 test:
  PYTHONPATH=. pytest tests
 # docker
 up:
  docker-compose up -d
 kill *args:
  docker-compose kill {{args}}
 build:
  docker-compose build
 ps:
  docker-compose ps
--- a/logging.ini
+++ b/logging.ini
@ -0,0 +1,28 @@
 [loggers]
 keys=root,uvicorn
 [handlers]
 keys=console
 [formatters]
 keys=standard
 [logger_root]
 level=INFO
 handlers=console
 formatter=standard
 [logger_uvicorn]
 propagate=0
 handlers=console
 formatter=standard
 qualname=uvicorn
 [handler_console]
 class=logging.StreamHandler
 level=DEBUG
 formatter=standard
 stream=ext://sys.stderr
 [formatter_standard]
 format=[%(asctime)s] [%(levelname)s] [%(name)s] %(message)s
--- a/logging_production.ini
+++ b/logging_production.ini
@ -0,0 +1,44 @@
 [loggers]
 keys=root,gunicorn.access,gunicorn.error,uvicorn
 [handlers]
 keys=console
 [formatters]
 keys=json
 [logger_root]
 level=INFO
 handlers=console
 formatter=json
 [logger_gunicorn.access]
 level=INFO
 handlers=console
 formatter=json
 qualname=gunicorn.access
 propagate=1
 [logger_gunicorn.error]
 level=INFO
 handlers=console
 formatter=json
 qualname=gunicorn.error
 propagate=0
 [logger_uvicorn]
 propagate=0
 handlers=console
 formatter=json
 qualname=uvicorn
 [handler_console]
 class=logging.StreamHandler
 level=INFO
 formatter=json
 stream=ext://sys.stderr
 [formatter_json]
 class=pythonjsonlogger.jsonlogger.JsonFormatter
 format=[%(asctime)s] [%(levelname)s] [%(name)s] %(message)s
 datefmt=%Y-%m-%dT%H:%M:%S
--- a/poetry.lock
+++ b/poetry.lock
--- a/pyproject.toml
+++ b/pyproject.toml
@ -0,0 +1,48 @@
 [tool.poetry]
 name = "pali-lili"
 version = "0.0.0"
 description = "Cloud orchestration microservice based on FastAPI."
 authors = ["irl"]
 readme = "README.md"
 license = "BSD-2"
 package-mode = false
 [tool.poetry.dependencies]
 python = "^3.12"
 aiofiles = "^24.1.0"
 bcrypt = "^5.0.0"
 alembic = "^1.13.1"
 asyncpg = "^0.29.0"
 fastapi = "^0.115.12"
 fastapi-pagination = "^0.13.1"
 httpx = "^0.27.0"
 psycopg2-binary = "^2.9.9"
 pydantic = {extras = ["email"], version = "^2.11.4"}
 pydantic-settings = "^2.9.1"
 python-jose = {extras=["cryptogrpahy"], version = "^3.4.0"}
 sqlalchemy = {extras = ["asyncio"], version = "^2.0.30"}
 uvicorn = {extras = ["standard"], version = "^0.30.6"}
 [tool.poetry.group.dev.dependencies]
 black = "^25.1.0"
 ruff = "^0.4.10"
 pytest = "^8.3.5"
 [tool.poetry.group.prod.dependencies]
 gunicorn = "^22.0.0"
 python-json-logger = "^2.0.7"
 prometheus-client = "^0.20.0"
 [build-system]
 requires = ["poetry-core"]
 build-backend = "poetry.core.masonry.api"
 [tool.black]
 line-length = 92
 [tool.pytest.ini_options]
 asyncio_default_fixture_loop_scope = "module"
 [tool.ruff]
 target-version = "py312"
 line-length = 92
--- a/scripts/postgres/backup
+++ b/scripts/postgres/backup
@ -0,0 +1,17 @@
 #!/bin/sh -e
 echo "Backup process started."
 export POSTGRES_USER="${POSTGRES_USER}"
 # Save the current date in YYYY-MM-DD format to a variable
 current_datetime=$(date +%Y-%m-%d-%H%M%S)
 backup_directory="/backups"
 backup_filename="${backup_directory}/backup-${current_datetime}.dump.gz"
 # Run pg_dump and compress its output, then save to /backups with the current date in the filename
 pg_dump -Fc app -U "$POSTGRES_USER" | gzip > "$backup_filename"
 echo "Backup has been created and saved to ${backup_filename}"
--- a/scripts/postgres/restore
+++ b/scripts/postgres/restore
@ -0,0 +1,38 @@
 #!/bin/sh -e
 # The directory where backups are stored
 BACKUP_DIRECTORY="/backups"
 # Check if a file name was provided as a parameter
 if [ $# -eq 0 ]; then
  echo "No file name provided. Please provide a file name to check."
  exit 1
 fi
 # The file name is taken from the first argument provided to the script
 file_name="$1"
 # Full path to the file
 full_file_path="${BACKUP_DIRECTORY}/${file_name}"
 # Check if the file exists
 if [ -f "$full_file_path" ]; then
  echo "File ${file_name} exists."
 else
  echo "File ${file_name} does not exist."
  exit 1
 fi
 export POSTGRES_USER="${POSTGRES_USER}"
 export POSTGRES_DB="${POSTGRES_DB}"
 echo "Dropping the database..."
 dropdb "$POSTGRES_DB" -U "$POSTGRES_USER"
 echo "Creating a new database..."
 createdb "$POSTGRES_DB" --owner="$POSTGRES_USER" -U "$POSTGRES_USER"
 echo "Applying the backup to the new database..."
 gunzip -c "${full_file_path}" | pg_restore -U "$POSTGRES_USER" -d "$POSTGRES_DB"
 echo "Backup applied successfully."
--- a/src/API.md
+++ b/src/API.md
@ -0,0 +1,70 @@
 :::warning[Under construction]
 This documentation is a work in progress. Please [get in touch](/contact) with us if you have any questions.
 :::
 Learn how to use the jasima.app API.
 Everything that can be done within the portal can also be achieved using our API, documented in this section.
 ## Authentication
 We use an API key for authentication.
 This should be passed to the API in an `Authorization` header:
 ```http request
 Authorization: Bearer <token>
 ```
 ## Data Format
 The API uses JSON as the default format for both requests and responses, ensuring consistency and simplicity in data
 handling:
 * For GET requests, the API expects parameters to be passed via query strings.
 * For other HTTP methods (e.g., POST, PUT), the request body (if required) should be formatted as JSON.
 There is no need to explicitly specify content encoding in the headers, as the API assumes JSON by default for all
 applicable requests and responses.
 ## Pagination
 The API supports pagination to manage large datasets efficiently. Use the page and perPage query parameters to control the data returned in your requests.
 Parameters:
 * `page`: The page number to retrieve.
 * `size`: The number of items to include per page.
 Example request:
 ```http request
 GET https://api.jasima.app/api/v1/widgets?page=1&size=10
 ```
 Example response:
 ```http request
 {
  "items": [
  ],
  "total": 0,
  "page": 1,
  "size": 10,
  "pages": 0
 }
 ```
 Bear in mind the following:
 * The `page` field in the response indicates the current page being viewed. 
 * The `total` field shows the total number of items available.
 * The `pages` field indicates the total number of pages, and can be used to determine whether there are additional pages
  to fetch.
 Use this structure to efficiently navigate through large datasets while ensuring optimal performance.
 ## Errors
 :::info[TODO]
 Document the common status codes, and the validation error response format.
 :::
 ## Schemas
--- a/src/init.py
+++ b/src/init.py
--- a/src/config.py
+++ b/src/config.py
@ -0,0 +1,56 @@
 from os.path import abspath, dirname, join
 from typing import Any
 from pydantic import PostgresDsn
 from pydantic_settings import BaseSettings, SettingsConfigDict
 from src.constants import Environment
 API_README_PATH = abspath(join(dirname(__file__), "API.md"))
 with open(API_README_PATH, "r", encoding="utf-8") as f:
    API_README_MD = f.read()
 class CustomBaseSettings(BaseSettings):
    model_config = SettingsConfigDict(
        env_file=".env", env_file_encoding="utf-8", extra="ignore"
    )
 class Config(CustomBaseSettings):
    DATABASE_URL: PostgresDsn  # Used for alembic migrations
    DATABASE_ASYNC_URL: PostgresDsn
    DATABASE_POOL_SIZE: int = 16
    DATABASE_POOL_TTL: int = 60 * 20  # 20 minutes
    DATABASE_POOL_PRE_PING: bool = True
    ENVIRONMENT: Environment = Environment.PRODUCTION
    CORS_ORIGINS: list[str] = ["*"]
    CORS_ORIGINS_REGEX: str | None = None
    CORS_HEADERS: list[str] = ["*"]
    API_KEY: str
    APP_VERSION: str = "0.0.0"
 settings = Config()
 tags_metadata = [
    {
        "name": "OpenTofu",
        "description": "Operations for managing OpenTofu deployments.",
    },
 ]
 app_configs: dict[str, Any] = {
    "title": "pali lili API",
    "version": settings.APP_VERSION,
    "description": API_README_MD,
    "openapi_tags": tags_metadata,
 }
 if not settings.ENVIRONMENT.is_debug:
    app_configs["openapi_url"] = None  # hide docs
--- a/src/constants.py
+++ b/src/constants.py
@ -0,0 +1,32 @@
 from enum import Enum
 DB_NAMING_CONVENTION = {
    "ix": "%(column_0_label)s_idx",
    "uq": "%(table_name)s_%(column_0_name)s_key",
    "ck": "%(table_name)s_%(constraint_name)s_check",
    "fk": "%(table_name)s_%(column_0_name)s_fkey",
    "pk": "%(table_name)s_pkey",
 }
 class Environment(str, Enum):
    LOCAL = "LOCAL"
    TESTING = "TESTING"
    STAGING = "STAGING"
    PRODUCTION = "PRODUCTION"
    @property
    def is_debug(self):
        return self in (self.LOCAL, self.STAGING, self.TESTING)
    @property
    def is_local(self):
        return self is Environment.LOCAL
    @property
    def is_testing(self):
        return self == self.TESTING
    @property
    def is_deployed(self) -> bool:
        return self in (self.STAGING, self.PRODUCTION)
--- a/src/database.py
+++ b/src/database.py
@ -0,0 +1,57 @@
 import contextlib
 from typing import AsyncIterator, AsyncGenerator, Annotated
 from fastapi import Depends
 from sqlalchemy import (
    MetaData,
 )
 from sqlalchemy.ext.asyncio import (
    AsyncConnection,
    create_async_engine,
    AsyncSession,
    async_sessionmaker,
 )
 from src.config import settings
 from src.constants import DB_NAMING_CONVENTION
 DATABASE_URL = str(settings.DATABASE_ASYNC_URL)
 engine = create_async_engine(
    DATABASE_URL,
    pool_size=settings.DATABASE_POOL_SIZE,
    pool_recycle=settings.DATABASE_POOL_TTL,
    pool_pre_ping=settings.DATABASE_POOL_PRE_PING,
 )
 metadata = MetaData(naming_convention=DB_NAMING_CONVENTION)
 sessionmaker = async_sessionmaker(autocommit=False, expire_on_commit=False, bind=engine)
@contextlib.asynccontextmanager
 async def get_db_connection() -> AsyncIterator[AsyncConnection]:
    async with engine.begin() as connection:
        try:
            yield connection
        except Exception:
            await connection.rollback()
            raise
@contextlib.asynccontextmanager
 async def get_db_session() -> AsyncIterator[AsyncSession]:
    session = sessionmaker()
    try:
        yield session
    except Exception:
        await session.rollback()
        raise
    finally:
        await session.close()
 async def get_db() -> AsyncGenerator[AsyncSession, None]:
    async with get_db_session() as session:
        yield session
 DbSession = Annotated[AsyncSession, Depends(get_db)]
--- a/src/exceptions.py
+++ b/src/exceptions.py
@ -0,0 +1,33 @@
 from typing import Any
 from fastapi import HTTPException, status
 class DetailedHTTPException(HTTPException):
    STATUS_CODE = status.HTTP_500_INTERNAL_SERVER_ERROR
    DETAIL = "Server error"
    def __init__(self, **kwargs: dict[str, Any]) -> None:
        super().__init__(status_code=self.STATUS_CODE, detail=self.DETAIL, **kwargs)
 class PermissionDenied(DetailedHTTPException):
    STATUS_CODE = status.HTTP_403_FORBIDDEN
    DETAIL = "Permission denied"
 class NotFound(DetailedHTTPException):
    STATUS_CODE = status.HTTP_404_NOT_FOUND
 class BadRequest(DetailedHTTPException):
    STATUS_CODE = status.HTTP_400_BAD_REQUEST
    DETAIL = "Bad Request"
 class NotAuthenticated(DetailedHTTPException):
    STATUS_CODE = status.HTTP_401_UNAUTHORIZED
    DETAIL = "User not authenticated"
    def __init__(self) -> None:
        super().__init__(headers={"WWW-Authenticate": "Bearer"})
--- a/src/main.py
+++ b/src/main.py
@ -0,0 +1,44 @@
 from contextlib import asynccontextmanager
 from typing import AsyncGenerator
 from fastapi import FastAPI
 from fastapi_pagination import add_pagination
 from starlette.middleware.cors import CORSMiddleware
 from src.config import app_configs, settings
 from src.tofu.exceptions import TofuStateLocked
 from src.tofu.router import router as tofu_router, tofu_state_locked_handler
 from src.tofu.tasks import periodic_tofu_process_tasks
@asynccontextmanager
 async def lifespan(_application: FastAPI) -> AsyncGenerator:
    await periodic_tofu_process_tasks()
    # Startup
    yield
    # Shutdown
 app = FastAPI(**app_configs, lifespan=lifespan)
 add_pagination(app)
 app.add_middleware(
    CORSMiddleware,
    allow_origins=settings.CORS_ORIGINS,
    allow_origin_regex=settings.CORS_ORIGINS_REGEX,
    allow_credentials=True,
    allow_methods=("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"),
    allow_headers=settings.CORS_HEADERS,
 )
 app.add_exception_handler(TofuStateLocked, tofu_state_locked_handler)
 app.include_router(
    tofu_router,
    prefix="/api/v1/tofu",
 )
@app.get("/healthcheck", include_in_schema=False)
 async def healthcheck() -> dict[str, str]:
    return {"status": "ok"}
--- a/src/models.py
+++ b/src/models.py
@ -0,0 +1,50 @@
 from datetime import datetime
 from typing import Any
 from sqlalchemy import JSON, DateTime, func, ForeignKey
 from sqlalchemy.orm import (
    DeclarativeBase,
    Mapped,
    mapped_column,
    relationship,
    declared_attr,
 )
 from src.database import metadata
 class CustomBase(DeclarativeBase):
    type_annotation_map = {
        datetime: DateTime(timezone=True),
        dict[str, Any]: JSON,
    }
    metadata = metadata
 class ActivatedMixin:
    active: Mapped[bool] = mapped_column(default=True)
 class DeletedTimestampMixin:
    deleted_at: Mapped[datetime | None] = mapped_column(nullable=True)
 class DescriptionMixin:
    description: Mapped[str]
 class IdMixin:
    id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
 class TimestampMixin:
    created_at: Mapped[datetime] = mapped_column(default=func.now())
    updated_at: Mapped[datetime] = mapped_column(default=func.now(), onupdate=func.now())
 class TofuInstanceMixin:
    tofu_instance_id: Mapped[int] = mapped_column(ForeignKey("tofu_instance.id"))
    @declared_attr
    def tofu_instance(cls):
        return relationship("TofuInstance")
--- a/src/schemas.py
+++ b/src/schemas.py
@ -0,0 +1,91 @@
 from datetime import datetime, timezone
 from typing import Annotated, Literal
 from uuid import UUID
 from email_validator.rfc_constants import DOMAIN_NAME_REGEX
 from fastapi.encoders import jsonable_encoder
 from pydantic import BaseModel, ConfigDict, PlainSerializer, RootModel, StringConstraints
 def datetime_to_utc_str(dt: datetime) -> str:
    if not dt.tzinfo:
        dt = dt.replace(tzinfo=timezone.utc)
    else:
        dt = dt.astimezone(timezone.utc)
    return dt.strftime("%Y-%m-%dT%H:%M:%SZ")
 CustomDatetime = Annotated[datetime, PlainSerializer(datetime_to_utc_str, return_type=str)]
 class CustomModelMixin:
    model_config = ConfigDict(
        populate_by_name=True,
    )
    def serializable_dict(self, **kwargs):
        """Return a dict which contains only serializable fields."""
        default_dict = self.model_dump()
        return jsonable_encoder(default_dict, custom_encoder={UUID: str})
 class CustomModel(BaseModel, CustomModelMixin):
    pass
 class CustomRootModel(RootModel, CustomModelMixin):
    pass
 class OkResponse(CustomModel):
    """
    A generic payload to respond with to indicate success where no other information is required or available.
    Pairs well with HTTP status code 200.
    """
    ok: Literal[True]
 class AcceptedResponse(CustomModel):
    """
    A generic payload to respond with where a request has been accepted but perhaps has not yet been processed.
    Pairs well with HTTP status code 201.
    """
    id: int
 class CreatedResponse(CustomModel):
    """
    A generic payload to respond with where a request has resulted in a thing being created.
    Pairs well with HTTP status code 202.
    """
    id: int
 class ActivatedMixin:
    active: bool
 class DescriptionMixin:
    description: str
 class DeletedTimestampMixin:
    deleted_at: CustomDatetime
 class IdMixin:
    id: int
 class TimestampMixin:
    created_at: CustomDatetime
    updated_at: CustomDatetime
 DomainName = Annotated[
    str, StringConstraints(strip_whitespace=True, to_lower=True, pattern=DOMAIN_NAME_REGEX)
 ]
--- a/src/tofu/init.py
+++ b/src/tofu/init.py
--- a/src/tofu/client.py
+++ b/src/tofu/client.py
@ -0,0 +1,165 @@
 import asyncio
 import json
 import os
 import shutil
 import tempfile
 from datetime import datetime, timezone
 from json import JSONDecodeError
 from typing import Any, TYPE_CHECKING
 import aiofiles
 from sqlalchemy.ext.asyncio import AsyncSession
 from src.tofu.config import settings
 from src.tofu.exceptions import TofuExecutionError, TofuTypeError
 from src.tofu.models import TofuInstanceTask, TofuInstanceTaskLog
 from src.tofu.security import generate_password, generate_password_hash
 def _convert_python_to_tf(value: Any) -> Any:
    """Convert Python types to Terraform-compatible types."""
    if isinstance(value, bool):
        return value
    elif isinstance(value, (int, float)):
        return value
    elif isinstance(value, str):
        return value
    elif isinstance(value, list):
        return [_convert_python_to_tf(item) for item in value]
    elif isinstance(value, dict):
        return {str(k): _convert_python_to_tf(v) for k, v in value.items()}
    elif value is None:
        return None
    else:
        raise TofuTypeError(f"Unsupported type for Terraform conversion: {type(value)}")
 class TofuManager:
    def __init__(
        self,
        db: AsyncSession,
        instance_task: TofuInstanceTask,
        working_dir: str | None = None,
    ):
        self.db = db
        self.instance_task = instance_task
        self._is_temp_dir = working_dir is None
        self._working_dir = working_dir
        self.tofu_path = settings.OPENTOFU_PATH
    async def __aenter__(self) -> "TofuManager":
        return self
    async def __aexit__(self, exc_type: Any, exc_value: Any, traceback: Any) -> None:
        self.instance_task.instance.state_password = None
        await self.db.commit()
        # Only clean up temporary directories if there was no exception
        if self._is_temp_dir and self._working_dir and exc_type is None:
            shutil.rmtree(self._working_dir)
    async def _create_config(self) -> None:
        config = self.instance_task.instance.configuration
        self.password = generate_password()
        self.instance_task.instance.state_password = generate_password_hash(self.password)
        await self.db.commit()
        if "terraform" not in config:
            config["terraform"] = {}
        config["terraform"]["backend"] = {
            "http": {
                "address": f"http://localhost:8000/api/v1/tofu/instances/{self.instance_task.instance_id}/state",
                "lock_address": f"http://localhost:8000/api/v1/tofu/instances/{self.instance_task.instance_id}/state",
                "unlock_address": f"http://localhost:8000/api/v1/tofu/instances/{self.instance_task.instance_id}/state",
            }
        }
        async with aiofiles.open(await self.config_file(), "w") as f:
            await f.write(json.dumps(config, indent=2))
    async def _process_output_line(self, line: str) -> None:
        try:
            data = json.loads(line)
        except json.decoder.JSONDecodeError:
            data = {
                "@level": "info",
                "@timestamp": datetime.now(tz=timezone.utc).strftime(
                    "%Y-%m-%dT%H:%M:%S.%f%z"
                ),
                "@module": "manager",
                "@message": line,
                "type": "decode-error",
            }
        log = TofuInstanceTaskLog(
            instance_task_id=self.instance_task.id,
            timestamp=datetime.strptime(data["@timestamp"], "%Y-%m-%dT%H:%M:%S.%f%z"),
            log=data,
        )
        self.db.add(log)
        await self.db.commit()
    async def _run_command(
        self,
        command: str,
        *args: str,
        json_output: bool = False,
        log_output: bool = True,
        return_output: bool = False,
    ) -> str | None:
        cmd = [self.tofu_path, command] + list(args)
        if json_output:
            cmd.append("-json")
        process = await asyncio.create_subprocess_exec(
            *cmd,
            cwd=await self.working_dir(),
            stdout=asyncio.subprocess.PIPE,
            stderr=asyncio.subprocess.DEVNULL,
            env={
                "TF_HTTP_USERNAME": "tofu",
                "TF_HTTP_PASSWORD": self.password,
            },
        )
        if TYPE_CHECKING:
            assert process.stdout is not None
        result = []
        async for line in process.stdout:
            if return_output:
                result.append(line.decode("utf-8"))
            if log_output:
                await self._process_output_line(line.decode("utf-8"))
        await process.wait()
        if process.returncode != 0:
            raise TofuExecutionError(f"Tofu command failed: {process.returncode}")
        return "\n".join(result) if return_output else None
    async def config_file(self) -> str:
        return os.path.join(await self.working_dir(), "main.tf.json")
    async def working_dir(self) -> str:
        if self._working_dir:
            return self._working_dir
        self._working_dir = await asyncio.to_thread(tempfile.mkdtemp, prefix="tofu-")
        return self._working_dir
    async def init(self, upgrade: bool = True) -> None:
        await self._create_config()
        args = []
        if upgrade:
            args.append("-upgrade")
        await self._run_command("init", *args, json_output=True)
    async def apply(self) -> None:
        await self._create_config()
        await self._run_command("apply", "-auto-approve", json_output=True)
    async def destroy(self) -> None:
        await self._create_config()
        await self._run_command("destroy", "-auto-approve", json_output=True)
    async def output(self) -> None:
        await self._create_config()
        try:
            outputs = await self._run_command(
                "output", json_output=True, log_output=False, return_output=True
            )
            self.instance_task.instance.outputs = json.loads(outputs)
            await self.db.commit()
        except JSONDecodeError:
            raise TofuExecutionError("Could not parse JSON output")
--- a/src/tofu/config.py
+++ b/src/tofu/config.py
@ -0,0 +1,13 @@
 from os.path import abspath, dirname, join
 from src.config import CustomBaseSettings
 class Config(CustomBaseSettings):
    OPENTOFU_PATH: str = "/usr/bin/tofu"
    OPENTOFU_MODULES_PATH: str = abspath(
        join(dirname(__file__), "..", "..", "tofu")
    )  # no trailing slash from abspath
 settings = Config()
--- a/src/tofu/exceptions.py
+++ b/src/tofu/exceptions.py
@ -0,0 +1,39 @@
 from typing import Any
 from starlette import status
 from starlette.exceptions import HTTPException
 class TofuExecutionError(RuntimeError):
    """An error occurred when executing an OpenTofu command."""
 class TofuTypeError(TypeError):
    """A value provided used a type that cannot be converted to a supported OpenTofu type."""
 class TofuStateLocked(RuntimeError):
    """A request could not be completed as the state is locked, and the requestor does not hold the lock."""
    def __init__(self, lock: dict[str, Any]) -> None:
        self.lock = lock
 class TofuForbiddenException(HTTPException):
    def __init__(
        self,
        **kwargs: Any,
    ) -> None:
        super().__init__(status_code=status.HTTP_403_FORBIDDEN, detail="Forbidden")
 class TofuUnauthorizedException(HTTPException):
    def __init__(
        self,
        **kwargs: Any,
    ) -> None:
        super().__init__(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Unauthorized",
            headers={"WWW-Authenticate": 'Basic realm="jasima"'},
        )
--- a/src/tofu/models.py
+++ b/src/tofu/models.py
@ -0,0 +1,107 @@
 from datetime import datetime
 from enum import Enum
 from typing import Any
 from sqlalchemy import ForeignKey, func, text
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from src.models import CustomBase, TimestampMixin, IdMixin, DeletedTimestampMixin
 class TofuInstanceStatus(Enum):
    ACTIVE = "ACTIVE"
    DEPLOYING = "DEPLOYING"
    DESTROYED = "DESTROYED"
    DESTROYING = "DESTROYING"
    DRIFTED = "DRIFTED"
    FAILED = "FAILED"
    FAILED_DESTROY = "FAILED_DESTROY"
    PENDING = "PENDING"
    PENDING_DESTROY = "PENDING_DESTROY"
    PENDING_DRIFT_CHECK = "PENDING_DRIFT_CHECK"
 class TofuInstance(CustomBase, IdMixin, TimestampMixin, DeletedTimestampMixin):
    __tablename__ = "tofu_instance"
    status: Mapped[TofuInstanceStatus] = mapped_column(default=TofuInstanceStatus.PENDING)
    configuration: Mapped[dict[str, Any]]
    outputs: Mapped[dict[str, Any] | None]
    plan: Mapped[dict[str, Any] | None]
    state: Mapped[dict[str, Any] | None]
    state_password: Mapped[bytes | None]
    state_lock: Mapped[dict[str, Any] | None]
    status_changed_at: Mapped[datetime] = mapped_column(default=func.now())
    drift_checked_at: Mapped[datetime | None]
    tasks = relationship("TofuInstanceTask", back_populates="instance")
    status_changes = relationship("TofuInstanceStatusChange", back_populates="instance")
 class TofuInstanceStatusChange(CustomBase, IdMixin):
    __tablename__ = "tofu_instance_status_change"
    instance_id: Mapped[int] = mapped_column(ForeignKey("tofu_instance.id"))
    instance_task_id: Mapped[int] = mapped_column(ForeignKey("tofu_instance_task.id"))
    timestamp: Mapped[datetime] = mapped_column(default=func.now())
    old_status: Mapped[TofuInstanceStatus]
    new_status: Mapped[TofuInstanceStatus]
    instance = relationship("TofuInstance", back_populates="status_changes")
 class TofuInstanceTaskType(Enum):
    CHECK_DRIFT = "CHECK_DRIFT"
    DEPLOY = "DEPLOY"
    DESTROY = "DESTROY"
 class TofuInstanceTaskStatus(Enum):
    CANCELED = "CANCELED"
    COMPLETED = "COMPLETED"
    FAILED = "FAILED"
    PENDING = "PENDING"
    RUNNING = "RUNNING"
 class TofuInstanceTask(CustomBase, IdMixin, TimestampMixin):
    __tablename__ = "tofu_instance_task"
    instance_id: Mapped[int] = mapped_column(ForeignKey("tofu_instance.id"))
    task: Mapped[TofuInstanceTaskType]
    status: Mapped[TofuInstanceTaskStatus] = mapped_column(
        default=TofuInstanceTaskStatus.PENDING
    )
    start_time: Mapped[datetime | None]
    end_time: Mapped[datetime | None]
    instance = relationship("TofuInstance", back_populates="tasks")
 class TofuInstanceTaskLog(CustomBase, IdMixin):
    __tablename__ = "tofu_instance_task_log"
    instance_task_id: Mapped[int] = mapped_column(ForeignKey("tofu_instance_task.id"))
    timestamp: Mapped[datetime] = mapped_column(default=func.now())
    log: Mapped[dict[str, Any]]
 class TofuBruteForce(CustomBase, IdMixin, TimestampMixin):
    __tablename__ = "tofu_brute_force"
    host: Mapped[str]
    expiry: Mapped[datetime] = mapped_column(default=func.now() + text("INTERVAL '1 hour'"))
 def update_tofu_instance_status(
    db: AsyncSession, instance: TofuInstance, task_id: int, new_status: TofuInstanceStatus
 ) -> None:
    status_change = TofuInstanceStatusChange(
        instance_id=instance.id,
        instance_task_id=task_id,
        old_status=instance.status,
        new_status=new_status,
    )
    db.add(status_change)
    instance.status = new_status
    instance.status_changed_at = func.now()
    if new_status == TofuInstanceStatus.DESTROYED:
        instance.deleted_at = func.now()
--- a/src/tofu/router.py
+++ b/src/tofu/router.py
@ -0,0 +1,356 @@
 import asyncio
 import json
 from datetime import datetime, timezone, timedelta
 from typing import Any, Annotated, AsyncIterator
 from fastapi import APIRouter, HTTPException, Request, Query
 from fastapi_pagination import Page
 from fastapi_pagination.ext.sqlalchemy import apaginate
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 from starlette import status
 from starlette.responses import JSONResponse, Response, StreamingResponse
 from src.database import DbSession
 from src.schemas import AcceptedResponse, OkResponse
 from src.tofu.exceptions import TofuStateLocked, TofuUnauthorizedException
 from src.tofu.models import (
    TofuInstance,
    TofuInstanceTask,
    TofuInstanceTaskType,
    TofuInstanceStatus,
    TofuInstanceTaskLog,
    TofuInstanceTaskStatus,
    update_tofu_instance_status,
 )
 from src.tofu.schemas import (
    TofuInstanceDetail,
    TofuInstanceCreate,
    TofuInstanceSummary,
    TofuInstanceUpdate,
    TofuInstanceState,
    TofuInstanceStateLock,
 )
 from src.tofu.security import (
    Password,
    validate_password,
    generate_password_hash,
    block_host_brute_force,
    APIKey,
 )
 router = APIRouter()
 TofuLockID = Annotated[str | None, Query(alias="ID", description="State lock ID")]
 async def tofu_state_locked_handler(request: Request, exc: Exception) -> Response:
    if isinstance(exc, TofuStateLocked):
        return JSONResponse(status_code=status.HTTP_423_LOCKED, content=exc.lock)
    raise RuntimeError(exc)
@router.get(
    "/instances",
    response_model=Page[TofuInstanceSummary],
    tags=["OpenTofu"],
 )
 async def list_tofu_instances(db: DbSession, _: APIKey) -> Page[TofuInstance]:
    return await apaginate(
        db, select(TofuInstance).filter(TofuInstance.deleted_at == None)  # noqa: E711
    )
@router.post(
    "/instances",
    response_model=AcceptedResponse,
    status_code=status.HTTP_202_ACCEPTED,
    tags=["OpenTofu"],
 )
 async def create_tofu_instance(
    instance_data: TofuInstanceCreate, db: DbSession, _: APIKey
 ) -> JSONResponse:
    hashed_password: str | None = (
        generate_password_hash(instance_data.password) if instance_data.password else None
    )
    instance = TofuInstance(
        configuration=instance_data.configuration, state_password=hashed_password
    )
    db.add(instance)
    await db.flush()
    task = TofuInstanceTask(instance_id=instance.id, task=TofuInstanceTaskType.DEPLOY)
    db.add(task)
    await db.commit()
    await db.refresh(instance)
    return JSONResponse(status_code=status.HTTP_202_ACCEPTED, content={"id": instance.id})
 async def _get_tofu_instance(
    db: AsyncSession,
    instance_id: int,
    password: str | None = None,
    host: str | None = None,
    *,
    detail: bool = False,
    password_required: bool = True,
 ) -> TofuInstance:
    if detail:
        query = (
            select(TofuInstance)
            .filter(TofuInstance.id == instance_id)
            .options(
                selectinload(TofuInstance.status_changes), selectinload(TofuInstance.tasks)
            )
        )
    else:
        query = select(TofuInstance).filter(TofuInstance.id == instance_id)
    row = (await db.execute(query)).first()
    if not row:
        raise HTTPException(status_code=404, detail="No instance found")
    if password_required:
        if not host:
            raise TofuUnauthorizedException
        if not validate_password(password, row[0].state_password):
            await block_host_brute_force(db, host)
            raise TofuUnauthorizedException
    return row[0]
@router.get(
    "/instances/{instance_id}",
    response_model=TofuInstanceDetail,
    tags=["OpenTofu"],
 )
 async def get_tofu_instance(instance_id: int, db: DbSession, _: APIKey) -> TofuInstance:
    return await _get_tofu_instance(db, instance_id, detail=True, password_required=False)
@router.put(
    "/instances/{instance_id}",
    response_model=AcceptedResponse,
    status_code=status.HTTP_202_ACCEPTED,
    response_description="Update accepted (deployment task pending)",
    responses={
        status.HTTP_200_OK: {"description": "Update Successful", "model": AcceptedResponse},
        status.HTTP_404_NOT_FOUND: {"description": "Instance not found"},
        status.HTTP_412_PRECONDITION_FAILED: {
            "description": "Update failed due to current status"
        },
    },
    tags=["OpenTofu"],
 )
 async def update_tofu_instance(
    instance_id: int, instance_data: TofuInstanceUpdate, db: DbSession, _: APIKey
 ) -> JSONResponse:
    query = select(TofuInstance).with_for_update().filter(TofuInstance.id == instance_id)
    row = (await db.execute(query)).first()
    if not row:
        raise HTTPException(status_code=404, detail="Instance not found")
    instance = row[0]
    if instance.status not in [TofuInstanceStatus.ACTIVE, TofuInstanceStatus.DRIFTED]:
        raise HTTPException(
            status_code=412, detail="Updates only allowed for active instances"
        )
    if instance_data.configuration:
        instance.configuration = instance_data.configuration
        task = TofuInstanceTask(instance_id=instance.id, task=TofuInstanceTaskType.DEPLOY)
        db.add(task)
        await db.flush()
        update_tofu_instance_status(db, instance, task.id, TofuInstanceStatus.PENDING)
    if instance_data.password:
        instance.password = generate_password_hash(instance_data.password)
    await db.commit()  # release FOR UPDATE lock
    return JSONResponse(status_code=status.HTTP_202_ACCEPTED, content={"id": instance.id})
@router.delete(
    "/instances/{instance_id}",
    status_code=202,
    response_model=AcceptedResponse,
    tags=["OpenTofu"],
 )
 async def destroy_tofu_instance(instance_id: int, db: DbSession, _: APIKey) -> Response:
    query = select(TofuInstance).with_for_update().filter(TofuInstance.id == instance_id)
    row = (await db.execute(query)).first()
    if not row:
        raise HTTPException(status_code=404, detail="Resource not found")
    instance = row[0]
    if instance.status not in [
        TofuInstanceStatus.ACTIVE,
        TofuInstanceStatus.DRIFTED,
        TofuInstanceStatus.FAILED,
    ]:
        raise HTTPException(
            status_code=412,
            detail="Instance cannot be destroyed currently as it is pending update",
        )
    task = TofuInstanceTask(instance_id=instance.id, task=TofuInstanceTaskType.DESTROY)
    db.add(task)
    await db.flush()
    update_tofu_instance_status(db, instance, task.id, TofuInstanceStatus.PENDING_DESTROY)
    await db.commit()  # release FOR UPDATE lock
    return JSONResponse(status_code=status.HTTP_202_ACCEPTED, content={"id": instance_id})
 async def _get_tofu_instance_state(
    db: AsyncSession,
    instance_id: int,
    password: str | None = None,
    host: str | None = None,
    *,
    password_required: bool = True,
 ) -> dict[str, Any]:
    instance = await _get_tofu_instance(
        db, instance_id, password, host, password_required=password_required
    )
    if not instance.state:
        raise HTTPException(status_code=404, detail="No state found")
    return instance.state
@router.get(
    "/instances/{instance_id}/state",
    response_model=TofuInstanceState,
    tags=["OpenTofu"],
 )
 async def get_tofu_instance_state_route(
    instance_id: int, db: DbSession, password: Password, request: Request
 ) -> dict[str, Any]:
    return await _get_tofu_instance_state(db, instance_id, password, request.client.host)
@router.post(
    "/instances/{instance_id}/state",
    response_model=None,
    tags=["OpenTofu"],
 )
 async def update_tofu_instance_state(
    instance_id: int,
    new_state: TofuInstanceState,
    db: DbSession,
    password: Password,
    request: Request,
    lock_id: TofuLockID = None,
 ) -> Response:
    instance = await _get_tofu_instance(db, instance_id, password, request.client.host)
    if instance.state_lock and instance.state_lock["ID"] != lock_id:
        raise TofuStateLocked(instance.state_lock)
    instance.state = new_state.model_dump()
    await db.commit()
    return Response(status_code=200)
@router.api_route(
    "/instances/{instance_id}/state",
    methods=["LOCK"],
    response_model=OkResponse,
    tags=["OpenTofu"],
    include_in_schema=False,
 )
 async def lock_tofu_instance_state(
    instance_id: int,
    lock: TofuInstanceStateLock,
    db: DbSession,
    password: Password,
    request: Request,
 ) -> JSONResponse:
    instance = await _get_tofu_instance(db, instance_id, password, request.client.host)
    if instance.state_lock:
        return JSONResponse(status_code=423, content=instance.state_lock)
    instance.state_lock = lock.serializable_dict()
    await db.commit()
    return JSONResponse(
        status_code=200, content={"result": "ok"}
    )  # A 204 would make sense here but the spec needs 200
@router.api_route(
    "/instances/{instance_id}/state",
    response_model=OkResponse,
    methods=["UNLOCK"],
    tags=["OpenTofu"],
    include_in_schema=False,
 )
 async def unlock_tofu_instance_state(
    instance_id: int,
    db: DbSession,
    password: Password,
    request: Request,
    lock_id: TofuLockID = None,
 ) -> JSONResponse:
    instance = await _get_tofu_instance(db, instance_id, password, request.client.host)
    if not instance.state_lock:
        JSONResponse(
            status_code=200, content={"result": "ok"}
        )  # A 204 would make sense here but the spec needs 200
    if lock_id is None or instance.state_lock["ID"] == lock_id:
        # force-unlock seems to not give an ID to verify so accept no ID being present.
        # This may not be great for robustness but it's not a security issue as the protocol
        # requires returning the lock ID to clients anyway when the lock ID is not correct.
        instance.state_lock = None
        await db.commit()
        return JSONResponse(
            status_code=200, content={"result": "ok"}
        )  # A 204 would make sense here but the spec needs 200
    raise TofuStateLocked(instance.state_lock)
@router.delete(
    "/instances/{instance_id}/state",
    response_model=OkResponse,
    tags=["OpenTofu"],
 )
 async def purge_tofu_instance_state(
    instance_id: int,
    db: DbSession,
    password: Password,
    request: Request,
    lock_id: TofuLockID = None,
 ) -> JSONResponse:
    instance = await _get_tofu_instance(db, instance_id, password, request.client.host)
    if instance.state_lock:
        if instance.state_lock["ID"] != lock_id:
            raise TofuStateLocked(instance.state_lock)
    instance.state = None
    instance.state_lock = None
    await db.commit()
    return JSONResponse(status_code=200, content={"result": "ok"})
@router.get("/logs/{task_id}", tags=["OpenTofu"])
 async def get_logs(task_id: int, db: DbSession, _: APIKey) -> StreamingResponse:
    # TODO: This could definitely be optimised but I don't think it's going to see heavy usage, just for debugging
    async def stream_log() -> AsyncIterator[str]:
        start = datetime.now(tz=timezone.utc)
        seen_log_id = 0
        task_query = select(TofuInstanceTask).where(TofuInstanceTask.id == task_id)
        row = (await db.execute(task_query)).first()
        if not row:
            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not found")
        task = row[0]
        while True:
            if datetime.now(tz=timezone.utc) - start > timedelta(minutes=5):
                return
            result = await db.execute(
                select(TofuInstanceTaskLog)
                .where(
                    TofuInstanceTaskLog.instance_task_id == task_id,
                    TofuInstanceTaskLog.id > seen_log_id,
                )
                .order_by(TofuInstanceTaskLog.timestamp)
            )
            for log in result.all():
                seen_log_id = log[0].id
                yield json.dumps(log[0].log) + "\n"
            await db.refresh(task)
            if row[0].status in [
                TofuInstanceTaskStatus.PENDING,
                TofuInstanceTaskStatus.FAILED,
                TofuInstanceTaskStatus.COMPLETED,
            ]:
                print("done")
                return
            await asyncio.sleep(1)
    return StreamingResponse(stream_log(), media_type="application/x-ndjson")
--- a/src/tofu/schemas.py
+++ b/src/tofu/schemas.py
@ -0,0 +1,76 @@
 from datetime import datetime
 from enum import Enum
 from typing import Any
 from uuid import UUID
 from pydantic import ConfigDict
 from src.schemas import CustomModel, TimestampMixin, CustomDatetime, IdMixin
 from src.tofu.models import TofuInstanceStatus, TofuInstanceTaskType, TofuInstanceTaskStatus
 class TofuOperationType(Enum):
    # https://github.com/opentofu/opentofu/blob/main/internal/backend/operation_type.go
    INVALID = "OperationTypeInvalid"
    REFRESH = "OperationTypeRefresh"
    PLAN = "OperationTypePlan"
    APPLY = "OperationTypeApply"
 class TofuInstanceState(CustomModel):
    # TODO: Do better
    model_config = ConfigDict(extra="allow")
 class TofuInstanceStateLock(CustomModel):
    model_config = ConfigDict(extra="allow")
    ID: UUID
    Operation: TofuOperationType
    Info: str
    Who: str
    Version: str
    Created: str
    Path: str
 class TofuInstanceSummary(CustomModel, IdMixin, TimestampMixin):
    status: TofuInstanceStatus
    status_changed_at: CustomDatetime
    drift_checked_at: CustomDatetime | None
 class TofuInstanceStatusChange(CustomModel):
    instance_task_id: int
    timestamp: datetime
    old_status: TofuInstanceStatus
    new_status: TofuInstanceStatus
 class TofuInstanceTask(CustomModel, TimestampMixin):
    id: int
    task: TofuInstanceTaskType
    status: TofuInstanceTaskStatus
    start_time: datetime | None
    end_time: datetime | None
 class TofuInstanceDetail(CustomModel, IdMixin, TimestampMixin):
    status: TofuInstanceStatus
    configuration: dict[str, Any]
    outputs: dict[str, Any] | None
    plan: dict[str, Any] | None
    status_changed_at: CustomDatetime
    drift_checked_at: CustomDatetime | None
    state_lock: TofuInstanceStateLock | None
    tasks: list[TofuInstanceTask]
    status_changes: list[TofuInstanceStatusChange]
 class TofuInstanceCreate(CustomModel):
    configuration: dict[str, Any]
    password: str | None = None
 class TofuInstanceUpdate(CustomModel):
    configuration: dict[str, Any] | None = None
    password: str | None = None
--- a/src/tofu/security.py
+++ b/src/tofu/security.py
@ -0,0 +1,93 @@
 from datetime import datetime, timezone
 from typing import Annotated
 import bcrypt
 from fastapi import Depends
 from fastapi.security import (
    HTTPBasic,
    HTTPBasicCredentials,
    HTTPBearer,
    HTTPAuthorizationCredentials,
 )
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from starlette.requests import Request
 from src.config import settings
 from src.database import DbSession
 from src.tofu.exceptions import TofuForbiddenException, TofuUnauthorizedException
 from src.tofu.models import TofuBruteForce
 from src.utils import generate_random_alphanum
 basic = HTTPBasic()
 Credentials = Annotated[HTTPBasicCredentials, Depends(basic)]
 async def block_host_brute_force(db: AsyncSession, host: str) -> None:
    db.add(TofuBruteForce(host=host))
    await db.commit()
 async def is_blocked_brute_force(request: Request, db: DbSession) -> None:
    query = select(TofuBruteForce).where(TofuBruteForce.host == request.client.host)
    row = (await db.execute(query)).first()
    block: TofuBruteForce | None = row[0] if row else None
    if block:
        if block.expiry < datetime.now(tz=timezone.utc):
            db.delete(block)
            await db.commit()
            return await is_blocked_brute_force(
                request, db
            )  # Just in case there's another block in the table
        raise TofuForbiddenException
    return None
 BruteForceProtection = Annotated[None, Depends(is_blocked_brute_force)]
 def generate_password() -> str:
    return generate_random_alphanum(40)
 def generate_password_hash(password_str: str) -> bytes:
    password = password_str.encode("utf-8")
    salt = bcrypt.gensalt()
    return bcrypt.hashpw(password, salt)
 def validate_password(password_str: str, password_hash: bytes) -> bool:
    if password_hash is None:
        return False
    password = password_str.encode("utf-8")
    return bcrypt.checkpw(password, password_hash)
 def get_password(
    db: DbSession, credentials: Credentials, request: Request, _: BruteForceProtection
 ) -> str:
    if not credentials or not credentials.password:
        block_host_brute_force(db, request.client.host)
        raise TofuUnauthorizedException
    return credentials.password
 Password = Annotated[str, Depends(get_password)]
 bearer = HTTPBearer()
 async def api_key(
    db: DbSession,
    request: Request,
    _: BruteForceProtection,
    credentials: HTTPAuthorizationCredentials = Depends(bearer),
 ) -> None:
    api_key = credentials.credentials
    print(api_key)
    if api_key != settings.API_KEY:
        await block_host_brute_force(db, request.client.host)
        raise TofuUnauthorizedException
 APIKey = Annotated[None, Depends(api_key)]
--- a/src/tofu/service.py
+++ b/src/tofu/service.py
@ -0,0 +1,80 @@
 from typing import Any
 from sqlalchemy.ext.asyncio import AsyncSession
 from starlette.background import BackgroundTask
 from starlette.exceptions import HTTPException
 from src.tofu.models import (
    TofuInstance,
    TofuInstanceTask,
    TofuInstanceTaskType,
    TofuInstanceStatus,
    update_tofu_instance_status,
 )
 from src.tofu.tasks import process_tasks
 async def create_tofu_instance(
    configuration: dict[str, Any],
    db: AsyncSession,
    *,
    commit: bool = False,
    create_task: bool = True
 ) -> tuple[int, BackgroundTask | None]:
    instance = TofuInstance(configuration=configuration)
    db.add(instance)
    await db.flush()
    if create_task:
        task = TofuInstanceTask(instance_id=instance.id, task=TofuInstanceTaskType.DEPLOY)
        db.add(task)
    if commit:
        await db.commit()
    return instance.id, BackgroundTask(process_tasks) if create_task else None
 async def create_empty_tofu_instance(db: AsyncSession) -> int:
    config = {}
    tofu_instance_id, _ = await create_tofu_instance(config, db, create_task=False)
    return tofu_instance_id
 async def update_tofu_instance(
    instance: TofuInstance,
    configuration: dict[str, Any],
    db: AsyncSession,
    *,
    commit: bool = False,
    allow_pending: bool = False
 ) -> BackgroundTask:
    allowed_status = [TofuInstanceStatus.ACTIVE, TofuInstanceStatus.DRIFTED]
    if allow_pending:
        allowed_status.append(TofuInstanceStatus.PENDING)
    if instance.status not in allowed_status:
        raise HTTPException(
            status_code=412, detail="Updates only allowed for active instances"
        )
    instance.configuration = configuration
    task = TofuInstanceTask(instance_id=instance.id, task=TofuInstanceTaskType.DEPLOY)
    db.add(task)
    await db.flush()
    update_tofu_instance_status(db, instance, task.id, TofuInstanceStatus.PENDING)
    if commit:
        await db.commit()
    return BackgroundTask(process_tasks)
 async def destroy_tofu_instance(
    instance: TofuInstance, db: AsyncSession, *, commit: bool = False
 ) -> BackgroundTask:
    if instance.status not in [TofuInstanceStatus.ACTIVE, TofuInstanceStatus.DRIFTED]:
        raise HTTPException(
            status_code=412,
            detail="Instance cannot be destroyed currently as it is pending update",
        )
    task = TofuInstanceTask(instance_id=instance.id, task=TofuInstanceTaskType.DESTROY)
    db.add(task)
    await db.flush()
    update_tofu_instance_status(db, instance, task.id, TofuInstanceStatus.PENDING_DESTROY)
    if commit:
        await db.commit()
    return BackgroundTask(process_tasks)
--- a/src/tofu/tasks.py
+++ b/src/tofu/tasks.py
@ -0,0 +1,86 @@
 from datetime import datetime, timezone
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 from src.database import get_db_session
 from src.tofu.client import TofuManager
 from src.tofu.exceptions import TofuExecutionError
 from src.tofu.models import (
    TofuInstanceStatus,
    TofuInstanceTask,
    TofuInstanceTaskType,
    TofuInstanceTaskStatus,
    update_tofu_instance_status,
 )
 from src.utils import repeat_every
 async def deploy_tofu_instance(db: AsyncSession, task: TofuInstanceTask) -> None:
    try:
        async with TofuManager(db, task) as tofu:
            await tofu.init()
            await tofu.apply()
            await tofu.output()
        update_tofu_instance_status(db, task.instance, task.id, TofuInstanceStatus.ACTIVE)
        task.instance.drift_checked_at = task.end_time = datetime.now(tz=timezone.utc)
    except TofuExecutionError as exc:
        update_tofu_instance_status(db, task.instance, task.id, TofuInstanceStatus.FAILED)
        raise exc
 async def destroy_tofu_instance(db: AsyncSession, task: TofuInstanceTask) -> None:
    try:
        async with TofuManager(db, task) as tofu:
            await tofu.init()
            await tofu.destroy()
        update_tofu_instance_status(
            db, task.instance, task.id, TofuInstanceStatus.DESTROYED
        )
        task.instance.outputs = {}
        task.instance.drift_checked_at = task.end_time = datetime.now(tz=timezone.utc)
    except TofuExecutionError as exc:
        update_tofu_instance_status(
            db, task.instance, task.id, TofuInstanceStatus.FAILED_DESTROY
        )
        raise exc
 async def process_tasks() -> None:
    async with get_db_session() as db:
        while True:
            query = (
                select(TofuInstanceTask)
                .with_for_update(skip_locked=True)
                .options(selectinload(TofuInstanceTask.instance))
                .filter(TofuInstanceTask.status == TofuInstanceTaskStatus.PENDING)
                .limit(1)
            )
            row = (await db.execute(query)).first()
            if not row:
                break
            task = row[0]
            task.status = TofuInstanceTaskStatus.RUNNING
            task.start_time = datetime.now(tz=timezone.utc)
            await db.commit()  # release FOR UPDATE lock
            try:
                match task.task:
                    case TofuInstanceTaskType.DEPLOY:
                        await deploy_tofu_instance(db, task)
                    case TofuInstanceTaskType.DESTROY:
                        await destroy_tofu_instance(db, task)
                    case TofuInstanceTaskType.CHECK_DRIFT:
                        print("NOT IMPLEMMENTED")  # TODO: Implement
                task.status = TofuInstanceTaskStatus.COMPLETED
                task.end_time = datetime.now(tz=timezone.utc)
            except TofuExecutionError:
                task.status = TofuInstanceTaskStatus.FAILED
                task.end_time = datetime.now(tz=timezone.utc)
            finally:
                await db.commit()
@repeat_every(seconds=5, wait_first=0)
 async def periodic_tofu_process_tasks():
    await process_tasks()
--- a/src/utils.py
+++ b/src/utils.py
@ -0,0 +1,199 @@
 import asyncio
 import logging
 import random
 import string
 from datetime import datetime, timedelta, timezone
 from functools import wraps
 from traceback import format_exception
 from typing import Callable, Coroutine, Any
 from starlette.concurrency import run_in_threadpool
 logger = logging.getLogger(__name__)
 ALPHA_NUM = string.ascii_letters + string.digits
 LOWER_NUM = string.ascii_lowercase + string.digits
 TOP_SUBDOMAINS = [
    "admin",
    "api",
    "app",
    "apps",
    "autodiscover",
    "baidu",
    "bbs",
    "beta",
    "blog",
    "cdn",
    "citrix",
    "cloud",
    "demo",
    "dev",
    "email",
    "en",
    "exchange",
    "forum",
    "ftp",
    "gateway",
    "gov",
    "gw",
    "home",
    "host",
    "images",
    "img",
    "info",
    "intranet",
    "login",
    "m",
    "mail",
    "mail1",
    "mail2",
    "mail3",
    "media",
    "mobile",
    "news",
    "office",
    "owa",
    "portal",
    "remote",
    "secure",
    "server",
    "server1",
    "shop",
    "ssl",
    "stage",
    "staging",
    "start",
    "static",
    "store",
    "support",
    "test",
    "web",
    "webmail",
    "wiki",
    "www1",
    "www2",
 ]
 NoArgsNoReturnFuncT = Callable[[], None]
 NoArgsNoReturnAsyncFuncT = Callable[[], Coroutine[Any, Any, None]]
 ExcArgNoReturnFuncT = Callable[[Exception], None]
 ExcArgNoReturnAsyncFuncT = Callable[[Exception], Coroutine[Any, Any, None]]
 NoArgsNoReturnAnyFuncT = NoArgsNoReturnFuncT | NoArgsNoReturnAsyncFuncT
 ExcArgNoReturnAnyFuncT = ExcArgNoReturnFuncT | ExcArgNoReturnAsyncFuncT
 NoArgsNoReturnDecorator = Callable[[NoArgsNoReturnAnyFuncT], NoArgsNoReturnAsyncFuncT]
 async def _handle_repeat_func(func: NoArgsNoReturnAnyFuncT) -> None:
    if asyncio.iscoroutinefunction(func):
        await func()
    else:
        await run_in_threadpool(func)
 async def _handle_repeat_exc(
    exc: Exception, on_exception: ExcArgNoReturnAnyFuncT | None
 ) -> None:
    if on_exception:
        if asyncio.iscoroutinefunction(on_exception):
            await on_exception(exc)
        else:
            await run_in_threadpool(on_exception, exc)
 def repeat_every(
    *,
    seconds: float,
    wait_first: float | None = None,
    max_repetitions: int | None = None,
    on_complete: NoArgsNoReturnAnyFuncT | None = None,
    on_exception: ExcArgNoReturnAnyFuncT | None = None,
 ) -> NoArgsNoReturnDecorator:
    """
    This function returns a decorator that modifies a function so it is periodically re-executed after its first call.
    The function it decorates should accept no arguments and return nothing. If necessary, this can be accomplished
    by using `functools.partial` or otherwise wrapping the target function prior to decoration.
    Parameters
    ----------
    seconds: float
        The number of seconds to wait between repeated calls
    wait_first: float (default None)
        If not None, the function will wait for the given duration before the first call
    max_repetitions: Optional[int] (default None)
        The maximum number of times to call the repeated function. If `None`, the function is repeated forever.
    on_complete: Optional[Callable[[], None]] (default None)
        A function to call after the final repetition of the decorated function.
    on_exception: Optional[Callable[[Exception], None]] (default None)
        A function to call when an exception is raised by the decorated function.
    """
    def decorator(func: NoArgsNoReturnAnyFuncT) -> NoArgsNoReturnAsyncFuncT:
        """
        Converts the decorated function into a repeated, periodically-called version of itself.
        """
        @wraps(func)
        async def wrapped() -> None:
            async def loop() -> None:
                if wait_first is not None:
                    await asyncio.sleep(wait_first)
                repetitions = 0
                while max_repetitions is None or repetitions < max_repetitions:
                    try:
                        await _handle_repeat_func(func)
                    except Exception as exc:
                        formatted_exception = "".join(
                            format_exception(type(exc), exc, exc.__traceback__)
                        )
                        logger.error(formatted_exception)
                        await _handle_repeat_exc(exc, on_exception)
                    repetitions += 1
                    await asyncio.sleep(seconds)
                if on_complete:
                    await _handle_repeat_func(on_complete)
            asyncio.ensure_future(loop())
        return wrapped
    return decorator
 def perishable_cache(expires: int, minimum: int):
    def decorator(func):
        cache_data = {}
        @wraps(func)
        async def wrapper(*args, retry: bool = False, **kwargs):
            timeout = minimum if retry else expires
            if "cached_time" in cache_data:
                if datetime.now(tz=timezone.utc) - cache_data["cached_time"] < timedelta(
                    seconds=timeout
                ):
                    return cache_data["cached_result"]
            result = await func(*args, retry=retry, **kwargs)
            cache_data["cached_result"] = result
            cache_data["cached_time"] = datetime.now(tz=timezone.utc)
            return result
        return wrapper
    return decorator
 def generate_random_alphanum(length: int = 20, prefix: str = "") -> str:
    return prefix + "".join(random.choices(ALPHA_NUM, k=length - len(prefix)))
 def generate_random_lowernum(length: int = 20, prefix: str = "") -> str:
    return prefix + "".join(random.choices(LOWER_NUM, k=length - len(prefix)))
 def generate_random_subdomain() -> str:
    return random.choice(TOP_SUBDOMAINS)
--- a/tests/tofu/test_tofu_state.py
+++ b/tests/tofu/test_tofu_state.py
@ -0,0 +1,136 @@
 from typing import AsyncGenerator
 import pytest
 from httpx import AsyncClient, ASGITransport
 from src.auth.service import get_admin
 from src.main import app
 PASSWORD="password123"
 AUTH=("tofu", PASSWORD)
 CREATE_INSTANCE_PAYLOAD = {
    "suppress_deployment": True,
    "password": PASSWORD,
    "configuration": {
        "terraform": {"required_providers": {"random": {"source": "hashicorp/random", "version": ">= 3.0.0"}}},
        "provider": {"random": {}},
        "variable": {
            "password_length": {"description": "Length of the random password", "type": "number", "default": 16}
        },
        "resource": {"random_password": {"example": {"length": "${var.password_length}", "special": True}}},
        "output": {"generated_password": {"value": "${random_password.example.result}", "sensitive": True}},
    },
 }
 INITIAL_STATE_PAYLOAD = {"key": "value"}
 UPDATE_STATE_PAYLOAD = {"key": "value"}
 STATE_LOCK_PAYLOAD_1 = {"ID": "bd812a7e-2297-4b70-acc9-d51015a9172c",
                        "Operation": "OperationTypeInvalid",
                        "Info": "",
                        "Who": "",
                        "Version": "",
                        "Created": "1990-01-01T12:00:00Z",
                        "Path": ""
                        }
 STATE_LOCK_PAYLOAD_2 = {"ID": "ab0eb55f-2f00-4e02-9bf5-e2c6658ab8af",
                        "Operation": "OperationTypeInvalid",
                        "Info": "",
                        "Who": "",
                        "Version": "",
                        "Created": "1990-01-01T12:00:00Z",
                        "Path": ""
                        }
@pytest.fixture(scope="module")
 async def client() -> AsyncGenerator[AsyncClient, None]:
    host, port = "127.0.0.1", "9000"
    async def override_get_admin():
        return None
    app.dependency_overrides[get_admin] = override_get_admin
    async with AsyncClient(transport=ASGITransport(app=app, client=(host, port)), base_url="http://test", auth=AUTH) as client:
        yield client
@pytest.fixture
 async def instance_id(client: AsyncClient):
    response = await client.post("/api/v1/tofu/instances", json=CREATE_INSTANCE_PAYLOAD)
    assert response.status_code == 202
    return response.json()["id"]
@pytest.mark.anyio
 async def test_state_no_locking(client: AsyncClient, instance_id: int):
    # Initially there should be no state
    response = await client.get(f"/api/v1/tofu/instances/{instance_id}/state")
    assert response.status_code == 404
    # Let's create the state
    response = await client.post(f"/api/v1/tofu/instances/{instance_id}/state", json=INITIAL_STATE_PAYLOAD)
    assert response.status_code == 200
    # Now check the state is retrievable
    response = await client.get(f"/api/v1/tofu/instances/{instance_id}/state")
    assert response.status_code == 200
    assert response.json() == INITIAL_STATE_PAYLOAD
    # Now update the state
    response = await client.post(f"/api/v1/tofu/instances/{instance_id}/state", json=UPDATE_STATE_PAYLOAD)
    assert response.status_code == 200
    # Now check the state is retrievable
    response = await client.get(f"/api/v1/tofu/instances/{instance_id}/state")
    assert response.status_code == 200
    assert response.json() == UPDATE_STATE_PAYLOAD
    # Now purge the state
    response = await client.delete(f"/api/v1/tofu/instances/{instance_id}/state")
    assert response.status_code == 200
    # And check it is gone
    response = await client.get(f"/api/v1/tofu/instances/{instance_id}/state")
    assert response.status_code == 404
@pytest.mark.anyio
 async def test_state_double_locking(client: AsyncClient, instance_id: int):
    response = await client.request("LOCK", f"/api/v1/tofu/instances/{instance_id}/state", json=STATE_LOCK_PAYLOAD_1)
    assert response.status_code == 200
    response = await client.request("LOCK", f"/api/v1/tofu/instances/{instance_id}/state", json=STATE_LOCK_PAYLOAD_2)
    assert response.status_code == 423
    assert response.json() == STATE_LOCK_PAYLOAD_1
    response = await client.request("UNLOCK",
                                    f"/api/v1/tofu/instances/{instance_id}/state?ID=" + STATE_LOCK_PAYLOAD_2['ID'])
    assert response.status_code == 423
    assert response.json() == STATE_LOCK_PAYLOAD_1
    response = await client.request("UNLOCK",
                                    f"/api/v1/tofu/instances/{instance_id}/state?ID=" + STATE_LOCK_PAYLOAD_1['ID'])
    assert response.status_code == 200
@pytest.mark.anyio
 async def test_state_locked_update(client: AsyncClient, instance_id: int):
    response = await client.request("LOCK", f"/api/v1/tofu/instances/{instance_id}/state", json=STATE_LOCK_PAYLOAD_1)
    assert response.status_code == 200
    response = await client.post(f"/api/v1/tofu/instances/{instance_id}/state?ID=" + STATE_LOCK_PAYLOAD_1['ID'],
                                 json=INITIAL_STATE_PAYLOAD)
    assert response.status_code == 200
    response = await client.post(f"/api/v1/tofu/instances/{instance_id}/state?ID=" + STATE_LOCK_PAYLOAD_2['ID'],
                                 json=UPDATE_STATE_PAYLOAD)
    assert response.status_code == 423
    assert response.json() == STATE_LOCK_PAYLOAD_1
    response = await client.post(f"/api/v1/tofu/instances/{instance_id}/state?ID=" + STATE_LOCK_PAYLOAD_1['ID'],
                                 json=UPDATE_STATE_PAYLOAD)
    assert response.status_code == 200
    response = await client.delete(f"/api/v1/tofu/instances/{instance_id}/state?ID=" + STATE_LOCK_PAYLOAD_2['ID'])
    assert response.status_code == 423
    assert response.json() == STATE_LOCK_PAYLOAD_1
    response = await client.delete(f"/api/v1/tofu/instances/{instance_id}/state?ID=" + STATE_LOCK_PAYLOAD_1['ID'])
    assert response.status_code == 200
@pytest.mark.anyio
 async def test_state_allow_force_unlock(client: AsyncClient, instance_id: int):
    # force-unlock doesn't include the ID when calling the unlock endpoint
    response = await client.request("LOCK", f"/api/v1/tofu/instances/{instance_id}/state", json=STATE_LOCK_PAYLOAD_1)
    assert response.status_code == 200
    response = await client.request("UNLOCK", f"/api/v1/tofu/instances/{instance_id}/state", json=STATE_LOCK_PAYLOAD_1)
    assert response.status_code == 200
		`@ -0,0 +1 @@`
							<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="31.88" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 257"><defs><linearGradient id="IconifyId1813088fe1fbc01fb466" x1="-.828%" x2="57.636%" y1="7.652%" y2="78.411%"><stop offset="0%" stop-color="#41D1FF"></stop><stop offset="100%" stop-color="#BD34FE"></stop></linearGradient><linearGradient id="IconifyId1813088fe1fbc01fb467" x1="43.376%" x2="50.316%" y1="2.242%" y2="89.03%"><stop offset="0%" stop-color="#FFEA83"></stop><stop offset="8.333%" stop-color="#FFDD35"></stop><stop offset="100%" stop-color="#FFA800"></stop></linearGradient></defs><path fill="url(#IconifyId1813088fe1fbc01fb466)" d="M255.153 37.938L134.897 252.976c-2.483 4.44-8.862 4.466-11.382.048L.875 37.958c-2.746-4.814 1.371-10.646 6.827-9.67l120.385 21.517a6.537 6.537 0 0 0 2.322-.004l117.867-21.483c5.438-.991 9.574 4.796 6.877 9.62Z"></path><path fill="url(#IconifyId1813088fe1fbc01fb467)" d="M185.432.063L96.44 17.501a3.268 3.268 0 0 0-2.634 3.014l-5.474 92.456a3.268 3.268 0 0 0 3.997 3.378l24.777-5.718c2.318-.535 4.413 1.507 3.936 3.838l-7.361 36.047c-.495 2.426 1.782 4.5 4.151 3.78l15.304-4.649c2.372-.72 4.652 1.36 4.15 3.788l-11.698 56.621c-.732 3.542 3.979 5.473 5.943 2.437l1.313-2.028l72.516-144.72c1.215-2.423-.88-5.186-3.54-4.672l-25.505 4.922c-2.396.462-4.435-1.77-3.759-4.114l16.646-57.705c.677-2.35-1.37-4.583-3.769-4.113Z"></path></svg>