mcp/internal/agent/dns.go

package agent

import (
	"bytes"
	"context"
	"encoding/json"
	"fmt"
	"io"
	"log/slog"
	"net/http"
	"strings"

	"git.wntrmute.dev/mc/mcp/internal/auth"
	"git.wntrmute.dev/mc/mcp/internal/config"
)

// DNSRegistrar creates and removes A records in MCNS during deploy
// and stop. It is nil-safe: all methods are no-ops when the receiver
// is nil.
type DNSRegistrar struct {
	serverURL  string
	token      string
	zone       string
	nodeAddr   string
	httpClient *http.Client
	logger     *slog.Logger
}

// DNSRecord is the JSON representation of an MCNS record.
type DNSRecord struct {
	ID    int    `json:"ID"`
	Name  string `json:"Name"`
	Type  string `json:"Type"`
	Value string `json:"Value"`
	TTL   int    `json:"TTL"`
}

// NewDNSRegistrar creates a DNSRegistrar. Returns (nil, nil) if
// cfg.ServerURL is empty (DNS registration disabled).
func NewDNSRegistrar(cfg config.MCNSConfig, logger *slog.Logger) (*DNSRegistrar, error) {
	if cfg.ServerURL == "" {
		logger.Info("mcns not configured, DNS registration disabled")
		return nil, nil
	}

	token, err := auth.LoadToken(cfg.TokenPath)
	if err != nil {
		return nil, fmt.Errorf("load mcns token: %w", err)
	}

	httpClient, err := newTLSClient(cfg.CACert)
	if err != nil {
		return nil, fmt.Errorf("create mcns HTTP client: %w", err)
	}

	logger.Info("mcns DNS registrar enabled", "server", cfg.ServerURL, "zone", cfg.Zone, "node_addr", cfg.NodeAddr)
	return &DNSRegistrar{
		serverURL:  strings.TrimRight(cfg.ServerURL, "/"),
		token:      token,
		zone:       cfg.Zone,
		nodeAddr:   cfg.NodeAddr,
		httpClient: httpClient,
		logger:     logger,
	}, nil
}

// EnsureRecord ensures an A record exists for the service in the
// configured zone, pointing to the node's address.
func (d *DNSRegistrar) EnsureRecord(ctx context.Context, serviceName string) error {
	if d == nil {
		return nil
	}

	existing, err := d.listRecords(ctx, serviceName)
	if err != nil {
		return fmt.Errorf("list DNS records: %w", err)
	}

	// Check if any existing record already has the correct value.
	for _, r := range existing {
		if r.Value == d.nodeAddr {
			d.logger.Debug("DNS record exists, skipping",
				"service", serviceName,
				"record", r.Name+"."+d.zone,
				"value", r.Value,
			)
			return nil
		}
	}

	// No record with the correct value — update the first one if it exists.
	if len(existing) > 0 {
		d.logger.Info("updating DNS record",
			"service", serviceName,
			"old_value", existing[0].Value,
			"new_value", d.nodeAddr,
		)
		return d.updateRecord(ctx, existing[0].ID, serviceName)
	}

	// No existing record — create one.
	d.logger.Info("creating DNS record",
		"service", serviceName,
		"record", serviceName+"."+d.zone,
		"value", d.nodeAddr,
	)
	return d.createRecord(ctx, serviceName)
}

// RemoveRecord removes A records for the service from the configured zone.
func (d *DNSRegistrar) RemoveRecord(ctx context.Context, serviceName string) error {
	if d == nil {
		return nil
	}

	existing, err := d.listRecords(ctx, serviceName)
	if err != nil {
		return fmt.Errorf("list DNS records: %w", err)
	}

	if len(existing) == 0 {
		d.logger.Debug("no DNS record to remove", "service", serviceName)
		return nil
	}

	for _, r := range existing {
		d.logger.Info("removing DNS record",
			"service", serviceName,
			"record", r.Name+"."+d.zone,
			"id", r.ID,
		)
		if err := d.deleteRecord(ctx, r.ID); err != nil {
			return err
		}
	}
	return nil
}

// DNSZone is the JSON representation of an MCNS zone.
type DNSZone struct {
	Name string `json:"Name"`
}

// ListZones returns all zones from MCNS.
func (d *DNSRegistrar) ListZones(ctx context.Context) ([]DNSZone, error) {
	if d == nil {
		return nil, fmt.Errorf("DNS registrar not configured")
	}

	url := fmt.Sprintf("%s/v1/zones", d.serverURL)
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
	if err != nil {
		return nil, fmt.Errorf("create list zones request: %w", err)
	}
	req.Header.Set("Authorization", "Bearer "+d.token)

	resp, err := d.httpClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("list zones: %w", err)
	}
	defer func() { _ = resp.Body.Close() }()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("read list zones response: %w", err)
	}

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("list zones: mcns returned %d: %s", resp.StatusCode, string(body))
	}

	var envelope struct {
		Zones []DNSZone `json:"zones"`
	}
	if err := json.Unmarshal(body, &envelope); err != nil {
		return nil, fmt.Errorf("parse list zones response: %w", err)
	}
	return envelope.Zones, nil
}

// ListZoneRecords returns all records in the given zone (no filters).
func (d *DNSRegistrar) ListZoneRecords(ctx context.Context, zone string) ([]DNSRecord, error) {
	if d == nil {
		return nil, fmt.Errorf("DNS registrar not configured")
	}

	url := fmt.Sprintf("%s/v1/zones/%s/records", d.serverURL, zone)
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
	if err != nil {
		return nil, fmt.Errorf("create list zone records request: %w", err)
	}
	req.Header.Set("Authorization", "Bearer "+d.token)

	resp, err := d.httpClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("list zone records: %w", err)
	}
	defer func() { _ = resp.Body.Close() }()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("read list zone records response: %w", err)
	}

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("list zone records: mcns returned %d: %s", resp.StatusCode, string(body))
	}

	var envelope struct {
		Records []DNSRecord `json:"records"`
	}
	if err := json.Unmarshal(body, &envelope); err != nil {
		return nil, fmt.Errorf("parse list zone records response: %w", err)
	}
	return envelope.Records, nil
}

// listRecords returns A records matching the service name in the zone.
func (d *DNSRegistrar) listRecords(ctx context.Context, serviceName string) ([]DNSRecord, error) {
	url := fmt.Sprintf("%s/v1/zones/%s/records?name=%s&type=A", d.serverURL, d.zone, serviceName)
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
	if err != nil {
		return nil, fmt.Errorf("create list request: %w", err)
	}
	req.Header.Set("Authorization", "Bearer "+d.token)

	resp, err := d.httpClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("list records: %w", err)
	}
	defer func() { _ = resp.Body.Close() }()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("read list response: %w", err)
	}

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("list records: mcns returned %d: %s", resp.StatusCode, string(body))
	}

	var envelope struct {
		Records []DNSRecord `json:"records"`
	}
	if err := json.Unmarshal(body, &envelope); err != nil {
		return nil, fmt.Errorf("parse list response: %w", err)
	}
	return envelope.Records, nil
}

// createRecord creates an A record in the zone.
func (d *DNSRegistrar) createRecord(ctx context.Context, serviceName string) error {
	reqBody := map[string]interface{}{
		"name":  serviceName,
		"type":  "A",
		"value": d.nodeAddr,
		"ttl":   300,
	}

	body, err := json.Marshal(reqBody)
	if err != nil {
		return fmt.Errorf("marshal create request: %w", err)
	}

	url := fmt.Sprintf("%s/v1/zones/%s/records", d.serverURL, d.zone)
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
	if err != nil {
		return fmt.Errorf("create record request: %w", err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+d.token)

	resp, err := d.httpClient.Do(req)
	if err != nil {
		return fmt.Errorf("create record: %w", err)
	}
	defer func() { _ = resp.Body.Close() }()

	if resp.StatusCode != http.StatusCreated && resp.StatusCode != http.StatusOK {
		respBody, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("create record: mcns returned %d: %s", resp.StatusCode, string(respBody))
	}

	return nil
}

// updateRecord updates an existing record's value.
func (d *DNSRegistrar) updateRecord(ctx context.Context, recordID int, serviceName string) error {
	reqBody := map[string]interface{}{
		"name":  serviceName,
		"type":  "A",
		"value": d.nodeAddr,
		"ttl":   300,
	}

	body, err := json.Marshal(reqBody)
	if err != nil {
		return fmt.Errorf("marshal update request: %w", err)
	}

	url := fmt.Sprintf("%s/v1/zones/%s/records/%d", d.serverURL, d.zone, recordID)
	req, err := http.NewRequestWithContext(ctx, http.MethodPut, url, bytes.NewReader(body))
	if err != nil {
		return fmt.Errorf("create update request: %w", err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+d.token)

	resp, err := d.httpClient.Do(req)
	if err != nil {
		return fmt.Errorf("update record: %w", err)
	}
	defer func() { _ = resp.Body.Close() }()

	if resp.StatusCode != http.StatusOK {
		respBody, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("update record: mcns returned %d: %s", resp.StatusCode, string(respBody))
	}

	return nil
}

// deleteRecord deletes a record by ID.
func (d *DNSRegistrar) deleteRecord(ctx context.Context, recordID int) error {
	url := fmt.Sprintf("%s/v1/zones/%s/records/%d", d.serverURL, d.zone, recordID)
	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, url, nil)
	if err != nil {
		return fmt.Errorf("create delete request: %w", err)
	}
	req.Header.Set("Authorization", "Bearer "+d.token)

	resp, err := d.httpClient.Do(req)
	if err != nil {
		return fmt.Errorf("delete record: %w", err)
	}
	defer func() { _ = resp.Body.Close() }()

	if resp.StatusCode != http.StatusNoContent && resp.StatusCode != http.StatusOK {
		respBody, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("delete record: mcns returned %d: %s", resp.StatusCode, string(respBody))
	}

	return nil
}