state.go

package main

import (
	"encoding/json"
	"errors"
	"fmt"
	"os"
	"strings"
	"time"

	"github.com/pulumi/pulumi/sdk/v3/go/common/apitype"
	"github.com/sst/sst/v3/cmd/sst/cli"
	"github.com/sst/sst/v3/cmd/sst/mosaic/ui"
	"github.com/sst/sst/v3/internal/util"
	"github.com/sst/sst/v3/pkg/id"
	"github.com/sst/sst/v3/pkg/process"
	"github.com/sst/sst/v3/pkg/project/provider"
	"github.com/sst/sst/v3/pkg/state"
)

var CmdState = &cli.Command{
	Name: "state",
	Description: cli.Description{
		Short: "Manage state of your app",
	},
	Children: []*cli.Command{
		{
			Name: "edit",
			Description: cli.Description{
				Short: "Edit the state of your app",
				Long: strings.Join([]string{
					"Edit the raw state of your app directly.",
					"",
					"This opens your state file in your local editor (`$EDITOR`, or `vim` by default).",
					"When you save and exit, SST pushes those changes back to your backend.",
					"",
					":::danger",
					"This command is dangerous. If you make an invalid change, you can corrupt your state and break deploys.",
					"Only use this if you understand the state format and know exactly what you are changing.",
					"Consider using safer commands like `sst state remove` or `sst state repair` first.",
					":::",
				}, "\n"),
			},
			Run: func(c *cli.Cli) error {
				p, err := c.InitProject()
				if err != nil {
					return err
				}
				defer p.Cleanup()

				update, err := p.Lock("edit")
				if err != nil {
					return util.NewReadableError(err, "Could not lock state")
				}
				defer p.Unlock()
				defer func() {
					update.TimeCompleted = time.Now().UTC().Format(time.RFC3339)
					provider.PutUpdate(p.Backend(), p.App().Name, p.App().Stage, update)
				}()
				workdir, err := p.NewWorkdir(update.ID)
				if err != nil {
					return err
				}
				defer workdir.Cleanup()

				path, err := workdir.Pull()
				if err != nil {
					return util.NewReadableError(err, "Could not pull state")
				}
				editor := os.Getenv("EDITOR")
				if editor == "" {
					editor = "vim"
				}
				editorArgs := append(strings.Fields(editor), path)
				fmt.Println(editorArgs)
				cmd := process.Command(editorArgs[0], editorArgs[1:]...)
				cmd.Stdin = os.Stdin
				cmd.Stdout = os.Stdout
				cmd.Stderr = os.Stderr
				if err := cmd.Start(); err != nil {
					return util.NewReadableError(err, "Could not start editor")
				}
				if err := cmd.Wait(); err != nil {
					return util.NewReadableError(err, "Editor exited with error")
				}

				return workdir.Push(update.ID)
			},
		},
		{
			Name: "export",
			Flags: []cli.Flag{
				{
					Name: "decrypt",
					Type: "bool",
					Description: cli.Description{
						Short: "Decrypt the state",
						Long:  "Decrypt the state before printing it out.",
					},
				},
			},
			Description: cli.Description{
				Short: "Prints the state of your app",
				Long: strings.Join([]string{
					"Prints the state of your app.",
					"",
					"This pull the state of your app from the cloud provider and then prints it out.",
					"You can write this to a file or view it directly in your terminal.",
					"",
					"This can be run for specific stages as well.",
					"",
					"```bash frame=\"none\"",
					"sst state export --stage production",
					"```",
					"",
					"By default, it runs on your personal stage.",
				}, "\n"),
			},
			Run: func(c *cli.Cli) error {
				p, err := c.InitProject()
				if err != nil {
					return err
				}
				defer p.Cleanup()
				workdir, err := p.NewWorkdir(id.Descending())
				if err != nil {
					return err
				}
				defer workdir.Cleanup()

				_, err = workdir.Pull()
				if err != nil {
					return util.NewReadableError(err, "Could not pull state")
				}
				exported, err := workdir.Export()
				if err != nil {
					return err
				}
				if c.Bool("decrypt") {
					passphrase, err := provider.Passphrase(p.Backend(), p.App().Name, p.App().Stage)
					if err != nil {
						return err
					}
					exported, err = state.Decrypt(c.Context, passphrase, exported)
					if err != nil {
						return err
					}
				}
				encoder := json.NewEncoder(os.Stdout)
				encoder.SetIndent("", "  ")
				return encoder.Encode(exported)
			},
		},
		{
			Name: "list",
			Description: cli.Description{
				Short: "List all deployed stages",
				Long: strings.Join([]string{
					"Lists all the stages of your app for the current set of credentials.",
					"",
					":::note",
					"This does not list the stages that are deployed in other accounts.",
					":::",
					"",
					"This pulls the state of your app from the cloud provider and then prints out all the stages that are listed in the state.",
				}, "\n"),
			},
			Run: func(c *cli.Cli) error {
				p, err := c.InitProject()
				if err != nil {
					return err
				}
				defer p.Cleanup()
				backend := p.Backend()
				currentStage := p.App().Stage

				stages, err := provider.ListStages(backend, p.App().Name)
				if err != nil {
					return err
				}

				lines, err := provider.Info(backend)
				if err != nil {
					ui.Error("Failed to load provider information")
					return err
				}

				renderKeyValue("App", p.App().Name)

				for _, line := range lines {
					renderKeyValue(line.Key, line.Value)
				}

				if len(stages) == 0 {
					fmt.Println(
						ui.TEXT_NORMAL_BOLD.Render(indent("Stages:")) +
							ui.TEXT_NORMAL.Render(currentStage) + " " + ui.TEXT_WARNING_DIM.Render("(not deployed)"),
					)
					return nil
				}

				currentDeployed := false
				for i, stage := range stages {
					rendered := ui.TEXT_GRAY.Render(stage)
					if stage == currentStage {
						rendered = ui.TEXT_NORMAL.Render(stage)
						currentDeployed = true
					}

					if i == 0 {
						fmt.Println(ui.TEXT_NORMAL_BOLD.Render(indent("Stages:")) + rendered)
						continue
					}

					fmt.Println(indent("") + rendered)
				}

				if !currentDeployed {
					fmt.Println(indent("") + ui.TEXT_NORMAL.Render(currentStage) + " " + ui.TEXT_WARNING_DIM.Render("(not deployed)"))
				}

				return nil
			},
		},
		{
			Name: "remove",
			Args: []cli.Argument{
				{
					Name:     "target",
					Required: true,
					Description: cli.Description{
						Short: "The name of the resource to remove",
						Long:  "The name of the resource to remove.",
					},
				},
			},
			Description: cli.Description{
				Short: "Remove a resource from only the state",
				Long: strings.Join([]string{
					"Removes the reference for the given resource from the state.",
					"",
					":::note",
					"This does not remove the resource itself.",
					":::",
					"",
					"This does not remove the resource itself, it only edits the state of your app.",
					"",
					"```bash frame=\"none\"",
					"sst state remove MyBucket",
					"```",
					"",
					"Here, `MyBucket` is the name of the resource as defined in your `sst.config.ts`.",
					"",
					"```ts title=\"sst.config.ts\"",
					"new sst.aws.Bucket(\"MyBucket\");",
					"```",
					"",
					"This command will:",
					"",
					"1. Find the resource with the given name in the state.",
					"2. Remove that from the state. It does not remove the children of this resource.",
					"3. Runs a `repair` to remove any dependencies to this resource.",
					"",
					"You can run this for specific stages as well.",
					"",
					"```bash frame=\"none\"",
					"sst state remove MyBucket --stage production",
					"```",
					"",
					"By default, it runs on your personal stage.",
				}, "\n"),
			},
			Run: func(c *cli.Cli) error {
				p, err := c.InitProject()
				if err != nil {
					return err
				}
				defer p.Cleanup()

				update, err := p.Lock("edit")
				if err != nil {
					return util.NewReadableError(err, "Could not lock state")
				}
				defer p.Unlock()
				defer func() {
					update.TimeCompleted = time.Now().UTC().Format(time.RFC3339)
					provider.PutUpdate(p.Backend(), p.App().Name, p.App().Stage, update)
				}()
				workdir, err := p.NewWorkdir(update.ID)
				if err != nil {
					return err
				}
				defer workdir.Cleanup()

				_, err = workdir.Pull()
				if err != nil {
					return util.NewReadableError(err, "Could not pull state")
				}

				checkpoint, err := workdir.Export()
				if err != nil {
					return util.NewReadableError(err, "Could not export state")
				}

				target := c.Positional(0)
				muts := state.Remove(target, checkpoint)
				err = confirmMutations(muts)
				if err != nil {
					return err
				}

				err = workdir.Import(checkpoint)
				if err != nil {
					return util.NewReadableError(err, "Could not import state")
				}

				err = workdir.Push(update.ID)
				if err != nil {
					return err
				}
				ui.Success("Resource removed")
				return nil
			},
		},
		{
			Name: "repair",
			Description: cli.Description{
				Short: "Repair the state of your app",
				Long: strings.Join([]string{
					"Repairs the state of your app if it's corrupted.",
					"",
					"Sometimes, if something goes wrong with your app, or if the state was directly",
					"edited, the state can become corrupted. This will cause your `sst deploy` command",
					"to fail.",
					"",
					"This command looks for the following issues and fixes them.",
					"",
					"1. Since the state is a list of resources, if one resource depends on another,",
					"   it needs to be listed after the one it depends on. This command finds resources",
					"   that depend on each other but are not ordered correctly and **reorders them**.",
					"",
					"2. If resource B depends on resource A, but resource A is not listed in the state,",
					"   it'll **remove the dependency**.",
					"",
					"This command does this by going through all the resources in the state, fixing the",
					"issues and updating the state.",
					"",
					"You can run this for specific stages as well.",
					"",
					"```bash frame=\"none\"",
					"sst state repair --stage production",
					"```",
					"",
					"If the current state cannot be read, you can opt into restoring the latest valid",
					"snapshot with `--dangerously-revert`. This is unsafe and can orphan or recreate",
					"resources on future deploys.",
					"",
					"By default, it runs on your personal stage.",
				}, "\n"),
			},
			Flags: []cli.Flag{
				{
					Name: "dangerously-revert",
					Type: "bool",
					Description: cli.Description{
						Short: "Dangerously restore latest valid snapshot if current state cannot be read",
					},
				},
			},
			Run: func(c *cli.Cli) error {
				p, err := c.InitProject()
				if err != nil {
					return err
				}
				defer p.Cleanup()

				update, err := p.Lock("repair")
				if err != nil {
					return util.NewReadableError(err, "Could not lock state")
				}
				defer p.Unlock()
				defer func() {
					update.TimeCompleted = time.Now().UTC().Format(time.RFC3339)
					provider.PutUpdate(p.Backend(), p.App().Name, p.App().Stage, update)
				}()
				workdir, err := p.NewWorkdir(update.ID)
				if err != nil {
					return err
				}
				defer workdir.Cleanup()

				_, pullErr := workdir.Pull()
				if pullErr != nil && !errors.Is(pullErr, provider.ErrStateNotFound) {
					return util.NewReadableError(pullErr, "Could not pull state")
				}

				recoveredSnapshotID := ""
				var checkpoint *apitype.CheckpointV3
				if pullErr == nil {
					checkpoint, err = workdir.Export()
				}
				if pullErr != nil || err != nil {
					if !c.Bool("dangerously-revert") {
						return repairSnapshotFlagRequired(pullErr, err)
					}
					snapshot, snapshotID, recoverErr := provider.LatestValidSnapshot(p.Backend(), p.App().Name, p.App().Stage)
					if recoverErr != nil {
						return util.NewReadableError(recoverErr, "Could not recover state")
					}
					err = workdir.ImportRaw(snapshot)
					if err != nil {
						return util.NewReadableError(err, "Could not restore snapshot")
					}
					recoveredSnapshotID = snapshotID
					checkpoint, err = workdir.Export()
					if err != nil {
						return util.NewReadableError(err, "Could not export state")
					}
				}

				if checkpoint == nil {
					return util.NewReadableError(nil, "Could not export state")
				}

				muts := state.Repair(checkpoint)
				err = confirmRepairMutations(recoveredSnapshotID, muts)
				if err != nil {
					return err
				}

				// prompt for confirmation to continue
				fmt.Print("Do you want to commit these changes? (y/n): ")
				var response string
				_, err = fmt.Scanln(&response)
				if err != nil {
					return fmt.Errorf("failed to read user input: %w", err)
				}
				if strings.ToLower(response) != "y" {
					return util.NewReadableError(nil, "Cancelled repair")
				}

				err = workdir.Import(checkpoint)
				if err != nil {
					return util.NewReadableError(err, "Could not import state")
				}

				err = workdir.Push(update.ID)
				if err != nil {
					return err
				}
				ui.Success("State repaired")
				return nil
			},
		},
	},
}

func confirmMutations(muts []state.Mutation) error {
	if len(muts) == 0 {
		return util.NewReadableError(nil, "No changes made")
	}
	fmt.Println("Removing:")
	for _, item := range muts {
		if item.Remove != nil {
			fmt.Printf("- %s → %s\n", item.Remove.Resource.Type().DisplayName(), item.Remove.Resource.Name())
		}
		if item.RemoveDependency != nil {
			fmt.Printf("- dependency from %s → %s on %s → %s\n", item.RemoveDependency.Resource.Type().DisplayName(), item.RemoveDependency.Resource.Name(), item.RemoveDependency.Dependency.Type().DisplayName(), item.RemoveDependency.Dependency.Name())
		}
		if item.RemoveProperty != nil {
			fmt.Printf("- property dependency from %s → %s → %s on %s → %s\n", item.RemoveProperty.Resource.URNName(), item.RemoveProperty.Resource.Name(), item.RemoveProperty.Property, item.RemoveProperty.Dependency.Type().DisplayName(), item.RemoveProperty.Dependency.Name())
		}
	}

	// prompt for confirmation to continue
	fmt.Print("Do you want to commit these changes? (y/n): ")
	var response string
	_, err := fmt.Scanln(&response)
	if err != nil {
		return util.NewReadableError(err, "failed to read user input")
	}
	if strings.ToLower(response) != "y" {
		return util.NewReadableError(nil, "Abandoning changes")
	}
	return nil
}

func confirmRepairMutations(snapshotID string, muts []state.Mutation) error {
	if snapshotID != "" {
		fmt.Printf("Recovering state from snapshot: %s\n", snapshotID)
	}
	if len(muts) == 0 {
		if snapshotID == "" {
			return util.NewReadableError(nil, "No changes made")
		}
		return nil
	}
	return confirmMutations(muts)
}

func repairSnapshotFlagRequired(pullErr error, exportErr error) error {
	cause := exportErr
	if cause == nil {
		cause = pullErr
	}
	return util.NewReadableError(cause, "State is missing or corrupted. Re-run `sst state repair --dangerously-revert` to restore the latest valid snapshot. This can orphan or recreate resources.")
}

func indent(key string) string {
	return fmt.Sprintf("%-12s", key)
}

func renderKeyValue(key string, value string) {
	fmt.Println(ui.TEXT_NORMAL_BOLD.Render(indent(key+":")) + ui.TEXT_GRAY.Render(value))
}