lava_callback: Add API call to pipeline

Add call to create custom checkout node (manually specified commit).

Signed-off-by: Denys Fedoryshchenko <[email protected]>

Author: nuclearcat

docker/lava-callback/requirements.txt

@@ -1,3 +1,4 @@
 uwsgi==2.0.22
 uvicorn==0.30.1
 fastapi==0.111.0
+pyjwt==2.8.0

src/lava_callback.py

@@ -1,7 +1,8 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 #
-# Copyright (C) 2023 Collabora Limited
+# Copyright (C) 2024 Collabora Limited
 # Author: Guillaume Tucker <[email protected]>
+# Author: Denys Fedoryshchenko <[email protected]>
 
 import os
 import tempfile
@@ -12,12 +13,16 @@
 import toml
 import threading
 import uvicorn
-from fastapi import FastAPI, HTTPException, Request
-
+import jwt
+import logging
+from datetime import datetime, timedelta
+from fastapi import FastAPI, HTTPException, Request, Header
+from pydantic import BaseModel
 import kernelci.api.helper
 import kernelci.config
 import kernelci.runtime.lava
 import kernelci.storage
+import kernelci.config
 from concurrent.futures import ThreadPoolExecutor
 
 
@@ -26,11 +31,21 @@
     SETTINGS.get('DEFAULT', {}).get('yaml_config', 'config')
 )
 SETTINGS_PREFIX = 'runtime'
+YAMLCFG = kernelci.config.load_yaml('config')
 
 app = FastAPI()
 executor = ThreadPoolExecutor(max_workers=16)
 
 
+class ManualCheckout(BaseModel):
+    nodeid: str
+    commit: str
+
+
+class JobRetry(BaseModel):
+    nodeid: str
+
+
 def _get_api_helper(api_config_name, api_token):
     api_config = CONFIGS['api'][api_config_name]
     api = kernelci.api.get_api(api_config, api_token)
@@ -112,7 +127,7 @@ def async_job_submit(api_helper, node_id, job_callback):
     results = job_callback.get_results()
     job_node = api_helper.api.node.get(node_id)
     if not job_node:
-        print(f'Node {node_id} not found')
+        logging.error(f'Node {node_id} not found')
         return
     # TODO: Verify lab_name matches job node lab name
     # Also extract job_id and compare with node job_id (future)
@@ -187,9 +202,194 @@ async def callback(node_id: str, request: Request):
     return 'OK', 202
 
 
+def decode_jwt(jwtstr):
+    '''
+    JWT secret stored at SETTINGS['jwt']['secret']
+    which means secret.toml file should have jwt section
+    with parameter secret= "<secret>"
+    '''
+    secret = SETTINGS.get('jwt', {}).get('secret')
+    if not secret:
+        logging.error('No JWT secret configured')
+        return None
+    return jwt.decode(jwtstr, secret, algorithms=['HS256'])
+
+
+def validate_permissions(jwtoken, permission):
+    if not jwtoken:
+        return False
+    try:
+        decoded = decode_jwt(jwtoken)
+    except Exception as e:
+        logging.error(f'Error decoding JWT: {e}')
+        return False
+    if not decoded:
+        logging.error('Invalid JWT')
+        return False
+    permissions = decoded.get('permissions')
+    if not permissions:
+        logging.error('No permissions in JWT')
+        return False
+    if permission not in permissions:
+        logging.error(f'Permission {permission} not in JWT')
+        return False
+    return decoded
+
+
+def find_parent_kind(node, api_helper, kind):
+    parent_id = node.get('parent')
+    if not parent_id:
+        return None
+    parent_node = api_helper.api.node.get(parent_id)
+    if not parent_node:
+        return None
+    if parent_node.get('kind') == kind:
+        return parent_node
+    return find_parent_kind(parent_node, api_helper, kind)
+
+
+@app.post('/api/jobretry')
+async def jobretry(data: JobRetry, request: Request,
+                   Authorization: str = Header(None)):
+    '''
+    API call to assist in regression bisecting by retrying a specific job
+    retrieved from test results.
+    '''
+    # Validate JWT token from Authorization header
+    jwtoken = Authorization
+    decoded = validate_permissions(jwtoken, 'testretry')
+    if not decoded:
+        return 'Unauthorized', 401
+
+    email = decoded.get('email')
+    logging.info(f"User {email} is retrying job {data.nodeid}")
+    api_config_name = SETTINGS.get('DEFAULT', {}).get('api_config')
+    if not api_config_name:
+        return 'No default API name set', 500
+    api_token = os.getenv('KCI_API_TOKEN')
+    api_helper = _get_api_helper(api_config_name, api_token)
+    node = api_helper.api.node.get(data.nodeid)
+    if not node:
+        return 'Node not found', 404
+    if node['kind'] != 'job':
+        return 'Node is not a job', 400
+
+    knode = find_parent_kind(node, api_helper, 'kbuild')
+    if not knode:
+        return 'Kernel build not found', 404
+
+    jobfilter = [knode['name'], node['name']]
+    knode['jobfilter'] = jobfilter
+    knode['op'] = 'updated'
+    knode['data'].pop('artifacts', None)
+    # state - done, result - pass
+    if knode.get('state') != 'done':
+        return 'Kernel build is not done', 400
+    if knode.get('result') != 'pass':
+        return 'Kernel build result is not pass', 400
+    # remove created, updated, timeout, owner, submitter, usergroups
+    knode.pop('created', None)
+    knode.pop('updated', None)
+    knode.pop('timeout', None)
+    knode.pop('owner', None)
+    knode.pop('submitter', None)
+    knode.pop('usergroups', None)
+
+    evnode = {'data': knode}
+    # Now we can submit custom kbuild node to the API(pub/sub)
+    api_helper.api.send_event('node', evnode)
+    logging.info(f"Job retry for node {data.nodeid} submitted")
+    return 'OK', 200
+
+
+@app.post('/api/checkout')
+async def checkout(data: ManualCheckout, request: Request,
+                   Authorization: str = Header(None)):
+    '''
+    API call to assist in regression bisecting by manually checking out
+    a specific commit on a specific branch of a specific tree, retrieved
+    from test results.
+    '''
+    # Validate JWT token from Authorization header
+    jwtoken = Authorization
+    decoded = validate_permissions(jwtoken, 'checkout')
+    if not decoded:
+        return 'Unauthorized', 401
+
+    email = decoded.get('email')
+    if not email:
+        return 'Unauthorized', 401
+    logging.info(f"User {email} is checking out {data.nodeid} at custom commit {data.commit}")
+
+    api_config_name = SETTINGS.get('DEFAULT', {}).get('api_config')
+    if not api_config_name:
+        return 'No default API name set', 500
+    api_token = os.getenv('KCI_API_TOKEN')
+    api_helper = _get_api_helper(api_config_name, api_token)
+    node = api_helper.api.node.get(data.nodeid)
+    if not node:
+        return 'Node not found', 404
+    try:
+        treename = node['data']['kernel_revision']['tree']
+        treeurl = node['data']['kernel_revision']['url']
+        branch = node['data']['kernel_revision']['branch']
+        commit = node['data']['kernel_revision']['commit']
+    except KeyError:
+        return 'Node does not have kernel revision data', 400
+
+    if node['kind'] != 'job':
+        jobnode = find_parent_kind(node, api_helper, 'job')
+        if not jobnode:
+            return 'Job not found', 404
+    else:
+        jobnode = node
+
+    kbuildnode = find_parent_kind(node, api_helper, 'kbuild')
+    if not kbuildnode:
+        return 'Kernel build not found', 404
+
+    kbuildname = kbuildnode['name']
+    testname = jobnode['name']
+
+    # Now we can submit custom checkout node to the API
+    # Maybe add field who requested the checkout?
+    timeout = 300
+    checkout_timeout = datetime.utcnow() + timedelta(minutes=timeout)
+    node = {
+        "kind": "checkout",
+        "name": "checkout",
+        "path": ["checkout"],
+        "data": {
+            "kernel_revision": {
+                "tree": treename,
+                "branch": branch,
+                "commit": commit,
+                "url": treeurl
+            }
+        },
+        "timeout": checkout_timeout.isoformat(),
+        "jobfilter": [
+            kbuildname,
+            testname
+        ],
+    }
+    r = api_helper.api.node.add(node)
+    if not r:
+        return 'Failed to submit checkout node', 500
+    else:
+        logging.info(f"Checkout node {r['id']} submitted")
+        return r, 200
+
+
 # Default built-in development server, not suitable for production
 if __name__ == '__main__':
     tokens = SETTINGS.get(SETTINGS_PREFIX)
     if not tokens:
         print('No tokens configured in toml file')
+    jwt_secret = SETTINGS.get('jwt', {}).get('secret')
+    if not jwt_secret:
+        print('No JWT secret configured')
+    api_token = os.getenv('KCI_API_TOKEN')
+    if not api_token:
+        print('No API token set')
     uvicorn.run(app, host='0.0.0.0', port=8000)