compliance-scanner-agent/compliance-agent/src/api/handlers/onboarding.rs

//! Onboarding API — CRUD for unified targets, artifact add, classification, and
//! the scan-applicability matrix. The wizard (and future integrations) drive
//! onboarding through these endpoints.

use std::collections::HashMap;
use std::sync::Arc;

use axum::extract::{Extension, Path, Query};
use axum::http::StatusCode;
use axum::Json;
use mongodb::bson::{doc, oid::ObjectId, to_bson};
use serde::{Deserialize, Serialize};

use compliance_core::models::{
    Artifact, ArtifactKind, ComplianceProfile, OnboardedTarget, PlcFormat, TargetScanConfig,
    TargetType,
};
use compliance_core::scan_matrix::{applicable_scans, supports_pentest};
use compliance_core::tenant_ctx::TenantCtx;

use crate::agent::ComplianceAgent;
use crate::classify::{classify_target, MockFirmwareDetector};

use super::dto::tenant_db;
use super::{collect_cursor_async, ApiResponse, PaginationParams};

type AgentExt = Extension<Arc<ComplianceAgent>>;

/// A client-supplied artifact spec. The server builds the [`Artifact`] (and its
/// id) from it, so clients never set internal fields.
#[derive(Deserialize)]
pub struct ArtifactInput {
    pub kind: ArtifactKind,
    pub source_ref: String,
    #[serde(default)]
    pub branch: Option<String>,
    #[serde(default)]
    pub plc_format: Option<PlcFormat>,
}

impl ArtifactInput {
    fn build(&self) -> Artifact {
        let s = self.source_ref.clone();
        match self.kind {
            ArtifactKind::GitRepo => {
                Artifact::git_repo(s, self.branch.clone().unwrap_or_else(|| "main".to_string()))
            }
            ArtifactKind::LiveUrl => Artifact::live_url(s),
            ArtifactKind::FirmwareImage => Artifact::firmware_image(s),
            ArtifactKind::SourceArchive => Artifact::source_archive(s),
            ArtifactKind::MobilePackage => Artifact::mobile_package(s),
            ArtifactKind::ContainerImage => Artifact::container_image(s),
            ArtifactKind::PlcProject => {
                Artifact::plc_project(s, self.plc_format.unwrap_or(PlcFormat::PlcopenXml))
            }
            ArtifactKind::PlaintextDescription => Artifact::plaintext(s),
        }
    }
}

#[derive(Deserialize)]
pub struct CreateTargetRequest {
    pub name: String,
    pub target_type: TargetType,
    #[serde(default)]
    pub description: Option<String>,
    #[serde(default)]
    pub artifacts: Vec<ArtifactInput>,
}

#[derive(Deserialize)]
pub struct UpdateTargetRequest {
    pub name: Option<String>,
    pub target_type: Option<TargetType>,
    pub scan_config: Option<TargetScanConfig>,
    pub compliance_profile: Option<ComplianceProfile>,
    pub scan_schedule: Option<String>,
}

/// One applicable-scan option, serialized for the wizard.
#[derive(Serialize)]
pub struct ScanOptionDto {
    pub scan: String,
    pub default_on: bool,
    pub rationale: String,
    pub required_artifact: Option<String>,
    pub blocked_reason: Option<String>,
}

#[derive(Serialize)]
pub struct ApplicableScansResponse {
    pub scans: Vec<ScanOptionDto>,
    pub pentest_supported: bool,
}

fn parse_oid(id: &str) -> Result<ObjectId, StatusCode> {
    ObjectId::parse_str(id).map_err(|_| StatusCode::BAD_REQUEST)
}

/// GET /api/v1/targets — list onboarded targets (paginated).
#[tracing::instrument(skip_all)]
pub async fn list_targets(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Query(params): Query<PaginationParams>,
) -> Result<Json<ApiResponse<Vec<OnboardedTarget>>>, StatusCode> {
    let db = tenant_db(&agent, &tenant).await?;
    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
    let total = db
        .onboarded_targets()
        .count_documents(doc! {})
        .await
        .unwrap_or(0);
    let targets = match db
        .onboarded_targets()
        .find(doc! {})
        .skip(skip)
        .limit(params.limit)
        .await
    {
        Ok(cursor) => collect_cursor_async(cursor).await,
        Err(e) => {
            tracing::warn!("Failed to fetch onboarded targets: {e}");
            Vec::new()
        }
    };
    Ok(Json(ApiResponse {
        data: targets,
        total: Some(total),
        page: Some(params.page),
    }))
}

/// POST /api/v1/targets — create an onboarded target.
#[tracing::instrument(skip_all)]
pub async fn create_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Json(req): Json<CreateTargetRequest>,
) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let mut target = OnboardedTarget::new(req.name, req.target_type);
    target.description = req.description;
    target.artifacts = req.artifacts.iter().map(ArtifactInput::build).collect();

    let db = tenant_db(&agent, &tenant).await?;
    let res = db
        .onboarded_targets()
        .insert_one(&target)
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    target.id = res.inserted_id.as_object_id();
    Ok(Json(ApiResponse {
        data: target,
        total: None,
        page: None,
    }))
}

/// GET /api/v1/targets/{id} — fetch one target.
#[tracing::instrument(skip_all, fields(target_id = %id))]
pub async fn get_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    let target = db
        .onboarded_targets()
        .find_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .ok_or(StatusCode::NOT_FOUND)?;
    Ok(Json(ApiResponse {
        data: target,
        total: None,
        page: None,
    }))
}

/// PATCH /api/v1/targets/{id} — update mutable fields.
#[tracing::instrument(skip_all, fields(target_id = %id))]
pub async fn update_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
    Json(req): Json<UpdateTargetRequest>,
) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;

    let mut set = doc! { "updated_at": mongodb::bson::DateTime::now() };
    if let Some(name) = req.name {
        set.insert("name", name);
    }
    if let Some(tt) = req.target_type {
        set.insert(
            "target_type",
            to_bson(&tt).map_err(|_| StatusCode::BAD_REQUEST)?,
        );
    }
    if let Some(sc) = req.scan_config {
        set.insert(
            "scan_config",
            to_bson(&sc).map_err(|_| StatusCode::BAD_REQUEST)?,
        );
    }
    if let Some(cp) = req.compliance_profile {
        set.insert(
            "compliance_profile",
            to_bson(&cp).map_err(|_| StatusCode::BAD_REQUEST)?,
        );
    }
    if let Some(ss) = req.scan_schedule {
        set.insert("scan_schedule", ss);
    }

    db.onboarded_targets()
        .update_one(doc! { "_id": oid }, doc! { "$set": set })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;

    get_target(Extension(agent), tenant, Path(id)).await
}

/// DELETE /api/v1/targets/{id} — remove the target and its findings/scans.
#[tracing::instrument(skip_all, fields(target_id = %id))]
pub async fn delete_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
) -> Result<Json<serde_json::Value>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    db.onboarded_targets()
        .delete_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    // Cascade the collections keyed by repo_id == target id (best-effort).
    let by_repo = doc! { "repo_id": &id };
    let _ = db.findings().delete_many(by_repo.clone()).await;
    let _ = db.scan_runs().delete_many(by_repo.clone()).await;
    let _ = db.sbom_entries().delete_many(by_repo.clone()).await;
    let _ = db.cve_alerts().delete_many(by_repo).await;
    Ok(Json(serde_json::json!({ "status": "deleted" })))
}

/// POST /api/v1/targets/{id}/artifacts — attach an artifact (by reference).
#[tracing::instrument(skip_all, fields(target_id = %id))]
pub async fn add_artifact(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
    Json(input): Json<ArtifactInput>,
) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    let artifact = to_bson(&input.build()).map_err(|_| StatusCode::BAD_REQUEST)?;
    db.onboarded_targets()
        .update_one(
            doc! { "_id": oid },
            doc! { "$push": { "artifacts": artifact }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
        )
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    get_target(Extension(agent), tenant, Path(id)).await
}

/// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
#[tracing::instrument(skip_all, fields(target_id = %id))]
pub async fn applicable_scans_for_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
) -> Result<Json<ApiResponse<ApplicableScansResponse>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    let target = db
        .onboarded_targets()
        .find_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .ok_or(StatusCode::NOT_FOUND)?;

    let scans = applicable_scans(&target)
        .into_iter()
        .map(|o| ScanOptionDto {
            scan: o.scan.to_string(),
            default_on: o.default_on,
            rationale: o.rationale,
            required_artifact: o.required_artifact.map(|k| k.to_string()),
            blocked_reason: o.blocked_reason,
        })
        .collect();

    Ok(Json(ApiResponse {
        data: ApplicableScansResponse {
            scans,
            pentest_supported: supports_pentest(target.target_type),
        },
        total: None,
        page: None,
    }))
}

/// POST /api/v1/targets/{id}/detect — classify the target from its artifacts.
///
/// This is the lightweight pass: it classifies from artifact kinds without
/// ingesting (cloning) sources, so it returns immediately. Deep detection (after
/// ingest, with tramiton firmware analysis) is a follow-up background step.
#[tracing::instrument(skip_all, fields(target_id = %id))]
pub async fn detect_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    let mut target = db
        .onboarded_targets()
        .find_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .ok_or(StatusCode::NOT_FOUND)?;

    // No ingested working paths here → kind-based classification only; the mock
    // firmware detector is never invoked (no firmware working path present).
    let empty = HashMap::new();
    let detector = MockFirmwareDetector { detection: None };
    let classification = classify_target(&target, &empty, &detector)
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;

    let classification_bson =
        to_bson(&classification).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    db.onboarded_targets()
        .update_one(
            doc! { "_id": oid },
            doc! { "$set": { "classification": classification_bson, "updated_at": mongodb::bson::DateTime::now() } },
        )
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    target.classification = Some(classification);

    Ok(Json(ApiResponse {
        data: target,
        total: None,
        page: None,
    }))
}

/// POST /api/v1/targets/{id}/scan — trigger a scan for the target.
///
/// Dispatches to the unified pipeline when `UNIFIED_PIPELINE` is set (else the
/// legacy path). Runs in the background and returns immediately.
#[tracing::instrument(skip_all, fields(target_id = %id))]
pub async fn trigger_target_scan(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
) -> Result<Json<serde_json::Value>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    // 404 if the target doesn't exist for this tenant.
    if db
        .onboarded_targets()
        .find_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .is_none()
    {
        return Err(StatusCode::NOT_FOUND);
    }

    let agent_clone = (*agent).clone();
    let tenant_id = tenant.0.tenant_id.clone();
    tokio::spawn(async move {
        // Always the unified target pipeline — this endpoint is about an
        // onboarded target by construction, independent of the global
        // `unified_pipeline` transition flag used by the legacy paths.
        if let Err(e) = agent_clone
            .run_target_scan(
                &tenant_id,
                &id,
                compliance_core::models::ScanTrigger::Manual,
            )
            .await
        {
            tracing::error!("Manual target scan failed for {id}: {e}");
        }
    });
    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
}