Provision instance bank credentials automatically (Refs #146)

src/routes/api/agent/bank/settle/+server.ts

@@ -0,0 +1,28 @@
+import { error, json } from '@sveltejs/kit';
+import { authenticateAgent, objectBody } from '$lib/server/hosts/http.js';
+import { db } from '$lib/server/db/index.js';
+import { bankRequest } from '$lib/server/fleet/bank.js';
+
+/** An assigned teardown may finish durable decisions, never prepare new spending. */
+export async function POST({ request }: { request: Request }) {
+    const host = authenticateAgent(request);
+    const body = await objectBody(request, 8192);
+    if (typeof body.operationId !== 'string' || !['commit', 'cancel'].includes(String(body.action)))
+        error(400, 'Invalid bank settlement.');
+    const scope = db()
+        .prepare(
+            `SELECT n.id, n.server FROM ec_host_operations o
+        JOIN native_instances n ON n.id=o.instance_id
+        WHERE o.id=? AND o.host_id=? AND o.kind IN ('instance.remove','instance.rebuild','instance.cancel-create')
+        AND o.state IN ('pending','accepted','running','unknown')`
+        )
+        .get(body.operationId, host.id) as { id: string; server: string } | undefined;
+    if (!scope) error(403, 'Bank settlement requires an assigned, unfinished teardown.');
+    const result = bankRequest(
+        body.action as 'commit' | 'cancel',
+        body.transfer,
+        scope.server,
+        scope.id
+    );
+    return json(result.body, { status: result.status, headers: { 'Cache-Control': 'no-store' } });
+}

src/routes/api/bank/[action]/+server.ts

@@ -29,7 +29,8 @@ export async function POST({ request, params }: { request: Request; params: { ac
         const { body, status } = bankRequest(
             params.action as BankAction,
             value,
-            authentication.server
+            authentication.server,
+            authentication.instanceId
         );
         return json(body, { status, headers });
     } catch {