Add clear host deletion controls with workload safeguards

src/lib/server/hosts/index.ts

@@ -2,7 +2,7 @@ import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { isIP } from 'node:net';
 import { db } from '../db/index.js';
 import { ensureHostSchema } from './schema.js';
-import type { Host, HostInventory, HostMode, HostOperation, HostOperationState } from '../../hosts.js';
+import type { Host, HostDeletion, HostInventory, HostMode, HostOperation, HostOperationState } from '../../hosts.js';
 
 export const AGENT_PROTOCOL_VERSION = 1;
 export const HEARTBEAT_MAX_AGE_MS = 90_000;
@@ -33,12 +33,57 @@ function hostFromRow(row: HostRow): Host {
         readiness: row.mode === 'draining' ? 'draining' : row.mode === 'disabled' ? 'disabled' : !row.enrolled_at || (infrastructureReady && reasons.length) ? 'preparing' : reasons.length ? 'degraded' : 'ready',
         readinessReasons: reasons, inventory, enrolled: !!row.enrolled_at, credentialActive: !!row.credential_active };
 }
-export function listHosts(): Host[] { return (database().prepare(hostSql + ' ORDER BY h.name, h.id').all() as HostRow[]).map(hostFromRow); }
+export function listHosts(): Host[] { return (database().prepare(hostSql + ' WHERE h.deleted_at IS NULL ORDER BY h.name, h.id').all() as HostRow[]).map(hostFromRow); }
 export function getHost(id: string): Host | null {
-    const row = database().prepare(hostSql + ' WHERE h.id = ?').get(id) as HostRow | undefined;
+    const row = database().prepare(hostSql + ' WHERE h.id = ? AND h.deleted_at IS NULL').get(id) as HostRow | undefined;
     return row ? hostFromRow(row) : null;
 }
 function requireHost(id: string): Host { const host = getHost(id); if (!host) throw new Error('Host was not found.'); return host; }
+
+export class HostDeletionError extends Error {
+    constructor(message: string, readonly status: 404 | 409, readonly blockers: string[] = []) { super(message); }
+}
+
+/** Controller records can be removed only after all remote instance ownership is resolved. */
+export function hostDeletionStatus(id: string): HostDeletion {
+    if (!getHost(id)) throw new HostDeletionError('Host not found.', 404);
+    const handle = database();
+    const blockers: string[] = [];
+    const instances = handle.prepare('SELECT server FROM native_instances WHERE host_id=? AND retired_at IS NULL ORDER BY server').all(id) as { server: string }[];
+    if (instances.length) {
+        const names = instances.slice(0, 5).map(instance => instance.server).join(', ') + (instances.length > 5 ? ', …' : '');
+        blockers.push(`Remove the ${instances.length} server instance${instances.length === 1 ? '' : 's'} assigned to this host first (${names}). Queued and failed deployments also require removal.`);
+    }
+    const ports = handle.prepare('SELECT COUNT(*) AS count FROM ec_host_ports WHERE host_id=?').get(id) as { count: number };
+    if (ports.count && !instances.length) blockers.push(`This host still has ${ports.count} reserved game port${ports.count === 1 ? '' : 's'}. Finish or reconcile the corresponding server removals first.`);
+    // A pending command may have reached the agent before its acknowledgement.
+    // Only commands that have never been delivered are safe to cancel locally.
+    const operations = handle.prepare(`SELECT kind,state FROM ec_host_operations WHERE host_id=?
+        AND (state IN ('accepted','running','unknown') OR (state='pending' AND last_delivered_at IS NOT NULL))
+        ORDER BY created_at`).all(id) as { kind: string; state: string }[];
+    if (operations.length) {
+        const work = operations.slice(0, 5).map(operation => `${operation.kind}: ${operation.state}`).join(', ') + (operations.length > 5 ? ', …' : '');
+        blockers.push(`${operations.length} delivered operation${operations.length === 1 ? ' is' : 's are'} unresolved (${work}). Let the agent reconnect and finish or reconcile this work before deleting the host.`);
+    }
+    return { allowed: blockers.length === 0, blockers };
+}
+
+/** Retain references and audit history; deletion never sends remote cleanup commands. */
+export function deleteHost(id: string): void {
+    const handle = database();
+    handle.transaction(() => {
+        const status = hostDeletionStatus(id);
+        if (!status.allowed) throw new HostDeletionError(status.blockers.join(' '), 409, status.blockers);
+        const timestamp = now();
+        const reason = 'Host deleted before this operation was delivered to the agent.';
+        handle.prepare(`INSERT INTO ec_host_operation_events(operation_id,state,created_at,error)
+            SELECT id,'failed',?,? FROM ec_host_operations WHERE host_id=? AND state='pending' AND last_delivered_at IS NULL`).run(timestamp, reason, id);
+        handle.prepare("UPDATE ec_host_operations SET state='failed',error=?,updated_at=? WHERE host_id=? AND state='pending' AND last_delivered_at IS NULL").run(reason, timestamp, id);
+        handle.prepare('UPDATE ec_host_credentials SET revoked_at=? WHERE host_id=? AND revoked_at IS NULL').run(timestamp, id);
+        handle.prepare('UPDATE ec_host_enrollments SET consumed_at=? WHERE host_id=? AND consumed_at IS NULL').run(timestamp, id);
+        handle.prepare("UPDATE ec_hosts SET deleted_at=?,mode='disabled' WHERE id=? AND deleted_at IS NULL").run(timestamp, id);
+    }).immediate();
+}
 function textField(value: unknown, label: string, max = 200): string {
     if (typeof value !== 'string' || !value.trim() || value.length > max || /[\x00-\x1f]/.test(value)) throw new Error(`${label} must be a nonempty string up to ${max} characters.`);
     return value.trim();
@@ -195,6 +240,7 @@ export function pendingHostOperations(hostId: string): HostOperation[] {
 }
 export function reportHostOperation(hostId: string, id: string, input: { state: unknown; result?: unknown; error?: unknown }): HostOperation {
     return database().transaction(() => {
+        requireHost(hostId);
         const operation = getHostOperation(id);
         if (!operation || operation.hostId !== hostId) throw new Error('Operation was not found for this host.');
         if (!['accepted','running','completed','failed','unknown'].includes(input.state as string)) throw new Error('Invalid operation state.');