AkurAI-Drive / backend/src/util.rs

Latest change 6e3a0824f4ec4d2bea2524a20b4960c7ab9e2766 - backend: akurai-drive-api (OIDC RP + per-tenant S3 provisioning) by olibuijr

use uuid::Uuid;

/// Random opaque token (32 lowercase hex chars) for session ids and OAuth state.
pub fn token() -> String {
    Uuid::new_v4().simple().to_string()
}

/// 6 lowercase hex chars, used as the bucket-name suffix for uniqueness.
fn short_hex() -> String {
    Uuid::new_v4().simple().to_string()[..6].to_string()
}

/// Slugify an org name into `[a-z0-9-]`, collapsing runs and trimming dashes.
fn slug(org: &str) -> String {
    let mut out = String::new();
    let mut last_dash = true; // leading dashes are dropped
    for c in org.to_lowercase().chars() {
        if c.is_ascii_alphanumeric() {
            out.push(c);
            last_dash = false;
        } else if !last_dash {
            out.push('-');
            last_dash = true;
        }
    }
    out.trim_matches('-').to_string()
}

/// Build an S3-legal bucket name: `<prefix>-<slug(org)>-<6 hex>`, lowercased,
/// `[a-z0-9-]` only, <= 63 chars. The slug is truncated to keep the whole name
/// within the limit.
pub fn bucket_name(prefix: &str, org: &str) -> String {
    let hex = short_hex();
    let prefix = prefix.to_lowercase();
    // Reserved length: "<prefix>-" + "-<hex>".
    let reserved = prefix.len() + 1 + 1 + hex.len();
    let max_slug = 63usize.saturating_sub(reserved);

    let mut org_slug = slug(org);
    if org_slug.len() > max_slug {
        org_slug.truncate(max_slug);
        org_slug = org_slug.trim_end_matches('-').to_string();
    }

    let mut name = if org_slug.is_empty() {
        format!("{prefix}-{hex}")
    } else {
        format!("{prefix}-{org_slug}-{hex}")
    };

    // Final safety net: keep only legal chars and the length bound.
    name = name
        .chars()
        .filter(|c| c.is_ascii_alphanumeric() || *c == '-')
        .collect();
    if name.len() > 63 {
        name.truncate(63);
    }
    name.trim_matches('-').to_string()
}

/// Provision an S3 bucket via the `aws` CLI. Credentials come from the process
/// environment (systemd EnvironmentFile). For us-east-1, no LocationConstraint is
/// allowed; any other region requires `--create-bucket-configuration`.
/// On success returns Ok(()); on non-zero exit returns the first stderr line.
pub fn create_bucket(bucket: &str, region: &str) -> Result<(), String> {
    let mut cmd = std::process::Command::new("aws");
    cmd.arg("s3api")
        .arg("create-bucket")
        .arg("--bucket")
        .arg(bucket)
        .arg("--region")
        .arg(region);

    if region != "us-east-1" {
        cmd.arg("--create-bucket-configuration")
            .arg(format!("LocationConstraint={region}"));
    }

    let output = cmd
        .output()
        .map_err(|e| format!("failed to run aws: {e}"))?;

    if output.status.success() {
        return Ok(());
    }

    let stderr = String::from_utf8_lossy(&output.stderr);
    let first = stderr
        .lines()
        .map(str::trim)
        .find(|line| !line.is_empty())
        .unwrap_or("aws create-bucket failed")
        .to_string();
    Err(first)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn bucket_name_is_legal() {
        let n = bucket_name("akurai-drive", "Acme ehf.");
        assert!(n.starts_with("akurai-drive-acme-ehf-"));
        assert!(n.len() <= 63);
        assert!(
            n.chars()
                .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-')
        );
    }

    #[test]
    fn bucket_name_truncates_long_org() {
        let n = bucket_name("akurai-drive", &"x".repeat(200));
        assert!(n.len() <= 63);
    }

    #[test]
    fn bucket_name_handles_empty_slug() {
        let n = bucket_name("akurai-drive", "***");
        assert!(n.starts_with("akurai-drive-"));
        assert!(n.len() <= 63);
    }
}