FabledSteward/plugins/docker/service.py

"""Docker queries shared by the plugin's pages and its MCP tools.

Each function takes an open session and returns rows or plain data, with no
Quart request context, so the routes and the /mcp tools (which run outside
Quart's pipeline) call the same code.
"""
from __future__ import annotations

from sqlalchemy import func, select

from steward.core.time_range import bucket_seconds
from steward.models.hosts import Host

from .models import DockerContainer, DockerEvent, DockerLog, DockerMetric, DockerMetricHourly


def bucket(values: list[float], target: int = 40) -> list[float]:
    """Bucket-average a series down to ~target points (DB-agnostic, in Python).

    Replaces the old SQL strftime() bucketing, which was SQLite-only and broke
    on Postgres. Agent cadence is dense, so a multi-hour window is hundreds of
    rows — averaging into a readable point count keeps the sparkline's shape.
    """
    n = len(values)
    if n <= target:
        return values
    size = (n + target - 1) // target
    out: list[float] = []
    for i in range(0, n, size):
        chunk = values[i:i + size]
        out.append(sum(chunk) / len(chunk))
    return out


async def container_history(db, host_id: str, name: str, since) -> tuple[list, list]:
    """Return (cpu_series, mem_series) sparkline-ready for one host's container."""
    rows = (await db.execute(
        select(DockerMetric.cpu_pct, DockerMetric.mem_pct)
        .where(DockerMetric.host_id == host_id)
        .where(DockerMetric.container_name == name)
        .where(DockerMetric.scraped_at >= since)
        .order_by(DockerMetric.scraped_at)
    )).all()
    cpu = bucket([r.cpu_pct or 0.0 for r in rows])
    mem = bucket([r.mem_pct or 0.0 for r in rows])
    return cpu, mem


async def host_map(db, host_ids: set[str]) -> dict[str, Host]:
    if not host_ids:
        return {}
    return {
        h.id: h for h in (await db.execute(
            select(Host).where(Host.id.in_(host_ids)))).scalars().all()
    }


def escape_like(text: str) -> str:
    """Make `text` match literally inside a LIKE/ILIKE pattern (escape char \\)."""
    return text.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")


async def list_containers(db, host_id: str | None = None) -> list[DockerContainer]:
    """Containers, running first then by name; one host's when host_id is given."""
    stmt = select(DockerContainer)
    if host_id is not None:
        stmt = stmt.where(DockerContainer.host_id == host_id)
    stmt = stmt.order_by((DockerContainer.status == "running").desc(), DockerContainer.name)
    return list((await db.execute(stmt)).scalars())


async def container_events(db, host_id: str, name: str, limit: int = 50) -> list[DockerEvent]:
    """A container's lifecycle events (start/stop/die/oom/health), newest first."""
    return list((await db.execute(
        select(DockerEvent)
        .where(DockerEvent.host_id == host_id)
        .where(DockerEvent.container_name == name)
        .order_by(DockerEvent.at.desc())
        .limit(limit)
    )).scalars())


async def query_logs(db, host_id: str, name: str, stream: str, query: str,
                     limit: int) -> list:
    """The recent retained lines for one container, newest-first, optionally
    filtered by stream and a case-insensitive substring.

    Newest-first is deliberate: the viewer replaces the list on each poll, which
    resets scroll to the top — so the latest lines stay visible without any
    scroll handling, and older lines are a scroll away.
    """
    stmt = (select(DockerLog.ts, DockerLog.stream, DockerLog.line)
            .where(DockerLog.host_id == host_id)
            .where(DockerLog.container_name == name))
    if stream in ("stdout", "stderr"):
        stmt = stmt.where(DockerLog.stream == stream)
    if query:
        stmt = stmt.where(DockerLog.line.ilike(f"%{escape_like(query)}%", escape="\\"))
    stmt = stmt.order_by(DockerLog.ts.desc(), DockerLog.id.desc()).limit(limit)
    return (await db.execute(stmt)).all()


CONTAINER_SERIES = ("cpu_pct", "mem_pct", "mem_usage_bytes")


async def container_points(db, host_id: str, name: str, metric: str, since,
                           target: int = 120) -> list[tuple]:
    """(time, average) points of one container metric since `since`, oldest first.

    Raw samples are bucket-averaged in SQL; the part of the range older than
    the oldest raw sample (already rolled up and pruned by retention) comes
    from the hourly table.
    """
    if metric not in CONTAINER_SERIES:
        raise ValueError(f"metric must be one of {', '.join(CONTAINER_SERIES)}")
    raw_col = getattr(DockerMetric, metric)
    width_s = bucket_seconds(since, target)
    rbucket = func.date_bin(
        func.make_interval(0, 0, 0, 0, 0, 0, width_s), DockerMetric.scraped_at, func.to_timestamp(0),
    ).label("bucket")
    raw = (await db.execute(
        select(rbucket, func.avg(raw_col))
        .where(DockerMetric.host_id == host_id, DockerMetric.container_name == name,
               DockerMetric.scraped_at >= since)
        .group_by(rbucket).order_by(rbucket)
    )).all()
    oldest_raw = raw[0][0] if raw else None
    hourly_stmt = (
        select(DockerMetricHourly.bucket, getattr(DockerMetricHourly, metric))
        .where(DockerMetricHourly.host_id == host_id,
               DockerMetricHourly.container_name == name,
               DockerMetricHourly.bucket >= since)
        .order_by(DockerMetricHourly.bucket)
    )
    if oldest_raw is not None:
        hourly_stmt = hourly_stmt.where(DockerMetricHourly.bucket < oldest_raw)
    hourly = (await db.execute(hourly_stmt)).all()
    return [(t, float(v)) for t, v in hourly] + [(t, float(v)) for t, v in raw]


async def search_logs(db, *, since, host_id: str | None = None, name: str | None = None,
                      text: str = "", stream: str = "", before=None, limit: int = 50) -> list:
    """Retained log lines matching a filter, newest first (limit + 1 fetched by callers
    that need to know whether more exist)."""
    stmt = (select(DockerLog.id, DockerLog.host_id, DockerLog.container_name,
                   DockerLog.ts, DockerLog.stream, DockerLog.line)
            .where(DockerLog.ts >= since))
    if host_id:
        stmt = stmt.where(DockerLog.host_id == host_id)
    if name:
        stmt = stmt.where(DockerLog.container_name == name)
    if stream in ("stdout", "stderr"):
        stmt = stmt.where(DockerLog.stream == stream)
    if text:
        stmt = stmt.where(DockerLog.line.ilike(f"%{escape_like(text)}%", escape="\\"))
    if before is not None:
        stmt = stmt.where(DockerLog.ts < before)
    stmt = stmt.order_by(DockerLog.ts.desc(), DockerLog.id.desc()).limit(limit)
    return list((await db.execute(stmt)).all())


async def log_context(db, host_id: str, name: str, ts, n: int) -> tuple[list, list]:
    """Up to n lines either side of `ts` in one container's log, each oldest first."""
    cols = (DockerLog.id, DockerLog.ts, DockerLog.stream, DockerLog.line)
    base = select(*cols).where(DockerLog.host_id == host_id, DockerLog.container_name == name)
    before = (await db.execute(
        base.where(DockerLog.ts < ts).order_by(DockerLog.ts.desc(), DockerLog.id.desc()).limit(n)
    )).all()
    after = (await db.execute(
        base.where(DockerLog.ts > ts).order_by(DockerLog.ts, DockerLog.id).limit(n)
    )).all()
    return list(reversed(before)), list(after)


async def recent_failures_by_container(db, since) -> dict[tuple[str, str], list]:
    """{(host_id, container_name): [die/oom events since `since`, newest first]}."""
    rows = (await db.execute(
        select(DockerEvent)
        .where(DockerEvent.event.in_(("die", "oom")), DockerEvent.at >= since)
        .order_by(DockerEvent.at.desc())
    )).scalars()
    out: dict[tuple[str, str], list] = {}
    for e in rows:
        out.setdefault((e.host_id, e.container_name), []).append(e)
    return out