feat(infra): auto-commit con 86 cambios

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-26 19:38:15 +02:00
parent de9bfec498
commit fe65c5e527
85 changed files with 11840 additions and 92 deletions
@@ -0,0 +1,247 @@
+package infra
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// DockerExecOpts configura la ejecucion de un comando dentro de un container Docker.
+type DockerExecOpts struct {
+	ContainerID     string   // ID o nombre del container destino.
+	Cmd             []string // argv. Cmd[0] = binario, debe estar en BinariesAllowed.
+	BinariesAllowed []string // Whitelist de binarios permitidos. EMPTY = rechaza todo.
+	User            string   // Usuario/grupo "UID:GID"; vacio = default del container.
+	WorkingDir      string   // Directorio de trabajo dentro del container.
+	Env             []string // Variables de entorno en formato "KEY=VAL".
+	TimeoutSeconds  int      // Timeout de ejecucion; default 30 si es 0.
+	DockerHost      string   // Socket Docker; default "unix:///var/run/docker.sock".
+}
+
+// DockerExecResult contiene el resultado de ejecutar un comando en un container.
+type DockerExecResult struct {
+	ExitCode int    // Codigo de salida del proceso.
+	Stdout   string // Salida estandar capturada.
+	Stderr   string // Salida de error capturada.
+	Duration int64  // Duracion real de ejecucion en milisegundos.
+}
+
+// DockerContainerExec ejecuta un comando dentro de un container Docker via Engine API.
+//
+// Flujo: POST /containers/<id>/exec → POST /exec/<id>/start → demux stream → GET /exec/<id>/json.
+// El comando se pasa como argv directo (sin shell). Aplica whitelist obligatoria de binarios.
+// Timeout gestionado via context.WithTimeout.
+func DockerContainerExec(opts DockerExecOpts) (DockerExecResult, error) {
+	// --- Validacion de seguridad (prioritaria, antes de contactar el engine) ---
+	if len(opts.Cmd) == 0 {
+		return DockerExecResult{}, fmt.Errorf("docker exec: Cmd must not be empty")
+	}
+	if len(opts.BinariesAllowed) == 0 {
+		return DockerExecResult{}, fmt.Errorf("docker exec: no binaries whitelisted: refusing")
+	}
+	bin := opts.Cmd[0]
+	inWhitelist := false
+	for _, b := range opts.BinariesAllowed {
+		if b == bin {
+			inWhitelist = true
+			break
+		}
+	}
+	if !inWhitelist {
+		return DockerExecResult{}, fmt.Errorf("docker exec: binary %q not in whitelist %v", bin, opts.BinariesAllowed)
+	}
+	if opts.ContainerID == "" {
+		return DockerExecResult{}, fmt.Errorf("docker exec: ContainerID must not be empty")
+	}
+
+	// --- Defaults ---
+	timeout := opts.TimeoutSeconds
+	if timeout <= 0 {
+		timeout = 30
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)*time.Second)
+	defer cancel()
+
+	// Reuse dockerHTTPClient from docker_container_logs.go (same package).
+	client, baseURL, err := dockerHTTPClient(opts.DockerHost)
+	if err != nil {
+		return DockerExecResult{}, fmt.Errorf("docker exec: building client: %w", err)
+	}
+
+	start := time.Now()
+
+	// --- Step 1: Create exec instance ---
+	execID, err := dockerExecCreate(ctx, client, baseURL, opts)
+	if err != nil {
+		return DockerExecResult{}, fmt.Errorf("docker exec create: %w", err)
+	}
+
+	// --- Step 2: Start exec and capture stream ---
+	stdout, stderr, err := dockerExecStart(ctx, client, baseURL, execID)
+	if err != nil {
+		return DockerExecResult{}, fmt.Errorf("docker exec start: %w", err)
+	}
+
+	// --- Step 3: Inspect to get exit code ---
+	exitCode, err := dockerExecInspect(ctx, client, baseURL, execID)
+	if err != nil {
+		return DockerExecResult{}, fmt.Errorf("docker exec inspect: %w", err)
+	}
+
+	duration := time.Since(start).Milliseconds()
+
+	return DockerExecResult{
+		ExitCode: exitCode,
+		Stdout:   stdout,
+		Stderr:   stderr,
+		Duration: duration,
+	}, nil
+}
+
+// dockerExecCreate llama POST /containers/<id>/exec y devuelve el ExecID.
+func dockerExecCreate(ctx context.Context, client *http.Client, baseURL string, opts DockerExecOpts) (string, error) {
+	type createBody struct {
+		AttachStdout bool     `json:"AttachStdout"`
+		AttachStderr bool     `json:"AttachStderr"`
+		Tty          bool     `json:"Tty"`
+		Cmd          []string `json:"Cmd"`
+		User         string   `json:"User,omitempty"`
+		WorkingDir   string   `json:"WorkingDir,omitempty"`
+		Env          []string `json:"Env,omitempty"`
+	}
+
+	body := createBody{
+		AttachStdout: true,
+		AttachStderr: true,
+		Tty:          false,
+		Cmd:          opts.Cmd,
+		User:         opts.User,
+		WorkingDir:   opts.WorkingDir,
+		Env:          opts.Env,
+	}
+
+	bodyBytes, err := json.Marshal(body)
+	if err != nil {
+		return "", err
+	}
+
+	url := fmt.Sprintf("%s/containers/%s/exec", baseURL, opts.ContainerID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(bodyBytes))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusCreated {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		return "", fmt.Errorf("engine returned %d: %s", resp.StatusCode, strings.TrimSpace(string(b)))
+	}
+
+	var result struct {
+		ID string `json:"Id"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return "", err
+	}
+	if result.ID == "" {
+		return "", fmt.Errorf("engine returned empty exec ID")
+	}
+
+	return result.ID, nil
+}
+
+// dockerExecStart llama POST /exec/<id>/start y demux el stream multiplexado de Docker.
+// Reusa dockerDemuxFrame de docker_container_logs.go (mismo paquete).
+// Retorna (stdout, stderr, error).
+func dockerExecStart(ctx context.Context, client *http.Client, baseURL, execID string) (string, string, error) {
+	type startBody struct {
+		Detach bool `json:"Detach"`
+		Tty    bool `json:"Tty"`
+	}
+	bodyBytes, _ := json.Marshal(startBody{Detach: false, Tty: false})
+
+	url := fmt.Sprintf("%s/exec/%s/start", baseURL, execID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(bodyBytes))
+	if err != nil {
+		return "", "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		if ctx.Err() != nil {
+			return "", "", fmt.Errorf("docker exec timed out")
+		}
+		return "", "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		return "", "", fmt.Errorf("engine returned %d on start: %s", resp.StatusCode, strings.TrimSpace(string(b)))
+	}
+
+	// Demux usando dockerDemuxFrame de docker_container_logs.go.
+	var stdoutBuf, stderrBuf strings.Builder
+	for {
+		streamType, payload, err := dockerDemuxFrame(resp.Body)
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			if ctx.Err() != nil {
+				return "", "", fmt.Errorf("docker exec timed out")
+			}
+			return "", "", fmt.Errorf("reading exec stream: %w", err)
+		}
+		switch streamType {
+		case 1: // stdout
+			stdoutBuf.Write(payload)
+		case 2: // stderr
+			stderrBuf.Write(payload)
+		}
+	}
+
+	return stdoutBuf.String(), stderrBuf.String(), nil
+}
+
+// dockerExecInspect llama GET /exec/<id>/json y devuelve el ExitCode.
+func dockerExecInspect(ctx context.Context, client *http.Client, baseURL, execID string) (int, error) {
+	url := fmt.Sprintf("%s/exec/%s/json", baseURL, execID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return -1, err
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return -1, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		return -1, fmt.Errorf("engine returned %d on inspect: %s", resp.StatusCode, strings.TrimSpace(string(b)))
+	}
+
+	var result struct {
+		ExitCode int `json:"ExitCode"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return -1, err
+	}
+
+	return result.ExitCode, nil
+}