WP-10: OS and package inventory

Debian inspector (dpkg-query, apt-get -s upgrade, snap list, os-release,
reboot-required) behind a CommandRunner port with tested parsers, fake
inspector for dev, persisted inventory snapshot, package_refresh job,
/api/system/inventory, Updates page with OS card, summary and filterable
package table.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/api/src/lib.rs

@@ -7,18 +7,24 @@ pub mod jobs;
 pub mod openapi;
 pub mod rate_limit;
 pub mod settings;
+pub mod system;
 pub mod test_support;
 pub mod users;
 
 use std::sync::Arc;
 
 use application::scheduler::Scheduler;
-use application::{AuthService, JobRunner, SettingsService, UserService};
+use application::{
+    AuthService, InventoryService, JobRunner, PackageRefreshJob, SettingsService, UserService,
+};
 use axum::{routing::get, Json, Router};
+use domain::jobs::JobKind;
+use domain::ports::HostInspector;
 use domain::ports::Mailer;
 use infrastructure::{
-    AesGcmCipher, Argon2Hasher, DbPool, JwtIssuer, LettreMailer, SqliteAuditLog, SqliteJobRuns,
-    SqliteRefreshTokens, SqliteSettings, SqliteUsers,
+    AesGcmCipher, Argon2Hasher, DbPool, DebianInspector, FakeHostInspector, JwtIssuer,
+    LettreMailer, SqliteAuditLog, SqliteInventory, SqliteJobRuns, SqliteRefreshTokens,
+    SqliteSettings, SqliteUsers, SystemCommandRunner,
 };
 use tower_http::services::{ServeDir, ServeFile};
 use tower_http::trace::TraceLayer;
@@ -32,20 +38,19 @@ pub struct AppState {
     pub users: Arc<UserService>,
     pub settings: Arc<SettingsService>,
     pub jobs: Arc<JobRunner>,
+    pub inventory: Arc<InventoryService>,
     pub login_limiter: Arc<rate_limit::RateLimiter>,
 }
 
 impl AppState {
     /// Wire the services on top of a connected database.
     pub fn new(cfg: Config, pool: DbPool) -> anyhow::Result<Self> {
-        let fake = cfg.fake_host;
-        Self::with_adapters(cfg, pool, Arc::new(LettreMailer), move |r| {
-            if fake {
-                test_support::register_test_jobs(r)
-            } else {
-                r
-            }
-        })
+        let inspector: Arc<dyn HostInspector> = if cfg.fake_host {
+            Arc::new(FakeHostInspector)
+        } else {
+            Arc::new(DebianInspector::new(Arc::new(SystemCommandRunner)))
+        };
+        Self::with_adapters(cfg, pool, Arc::new(LettreMailer), inspector, |r| r)
     }
 
     /// Wiring with replaceable adapters (used by tests and the fake-host mode).
@@ -53,6 +58,7 @@ impl AppState {
         cfg: Config,
         pool: DbPool,
         mailer: Arc<dyn Mailer>,
+        inspector: Arc<dyn HostInspector>,
         register_jobs: impl FnOnce(JobRunner) -> JobRunner,
     ) -> anyhow::Result<Self> {
         let users = Arc::new(SqliteUsers(pool.clone()));
@@ -70,13 +76,22 @@ impl AppState {
             cipher,
             mailer,
         ));
-        let jobs = Arc::new(register_jobs(JobRunner::new(Arc::new(SqliteJobRuns(pool)))));
+        let inventory = Arc::new(InventoryService::new(
+            inspector,
+            Arc::new(SqliteInventory(pool.clone())),
+        ));
+        let runner = JobRunner::new(Arc::new(SqliteJobRuns(pool))).register(
+            JobKind::PackageRefresh,
+            Arc::new(PackageRefreshJob(inventory.clone())),
+        );
+        let jobs = Arc::new(register_jobs(runner));
         Ok(Self {
             cfg,
             auth: Arc::new(auth),
             users: Arc::new(UserService::new(users, hasher)),
             settings,
             jobs,
+            inventory,
             login_limiter: Arc::new(rate_limit::RateLimiter::new(
                 10,
                 std::time::Duration::from_secs(60),
@@ -109,6 +124,7 @@ pub fn build_app(state: AppState) -> Router {
         .nest("/api/users", users::router())
         .nest("/api/settings", settings::router())
         .nest("/api/jobs", jobs::router())
+        .nest("/api/system", system::router())
         .fallback_service(spa)
         .layer(TraceLayer::new_for_http())
         .with_state(state)

backend/crates/api/src/openapi.rs

@@ -26,6 +26,7 @@ impl Modify for BearerAuth {
         crate::users::list, crate::users::create, crate::users::get_one, crate::users::update, crate::users::reset_password,
         crate::settings::get_smtp, crate::settings::put_smtp, crate::settings::test_smtp, crate::settings::list_schedules, crate::settings::put_schedule,
         crate::jobs::list, crate::jobs::kinds, crate::jobs::get_one, crate::jobs::run,
+        crate::system::inventory,
     ),
     modifiers(&BearerAuth)
 )]

backend/crates/api/src/system.rs

@@ -0,0 +1,62 @@
+//! /api/system: host inventory.
+use axum::extract::State;
+use axum::routing::get;
+use axum::{Json, Router};
+use domain::host::{OsInfo, Package};
+use serde::Serialize;
+use utoipa::ToSchema;
+
+use crate::error::ApiError;
+use crate::extract::AuthUser;
+use crate::AppState;
+
+pub fn router() -> Router<AppState> {
+    Router::new().route("/inventory", get(inventory))
+}
+
+#[derive(Serialize, ToSchema)]
+pub struct Summary {
+    pub total: usize,
+    pub upgradable: usize,
+    pub security: usize,
+}
+
+#[derive(Serialize, ToSchema)]
+pub struct InventoryResponse {
+    pub refreshed_at: Option<chrono::DateTime<chrono::Utc>>,
+    #[schema(value_type = Object)]
+    pub os: Option<OsInfo>,
+    #[schema(value_type = Vec<Object>)]
+    pub packages: Vec<Package>,
+    pub summary: Summary,
+}
+
+#[utoipa::path(get, path = "/api/system/inventory", tag = "system", security(("bearer" = [])), responses((status = 200, body = InventoryResponse)))]
+async fn inventory(
+    State(state): State<AppState>,
+    _: AuthUser,
+) -> Result<Json<InventoryResponse>, ApiError> {
+    let res = match state.inventory.current().await? {
+        Some(inv) => InventoryResponse {
+            summary: Summary {
+                total: inv.packages.len(),
+                upgradable: inv.upgradable(),
+                security: inv.security_upgrades(),
+            },
+            refreshed_at: Some(inv.refreshed_at),
+            os: Some(inv.os),
+            packages: inv.packages,
+        },
+        None => InventoryResponse {
+            refreshed_at: None,
+            os: None,
+            packages: vec![],
+            summary: Summary {
+                total: 0,
+                upgradable: 0,
+                security: 0,
+            },
+        },
+    };
+    Ok(Json(res))
+}

backend/crates/api/src/test_support.rs

@@ -4,7 +4,6 @@ use std::sync::{Arc, Mutex};
 use application::{JobHandler, JobLog, JobRunner};
 use async_trait::async_trait;
 use axum::Router;
-use domain::jobs::JobKind;
 use domain::ports::Mailer;
 use domain::settings::SmtpSettings;
 use domain::DomainError;
@@ -49,6 +48,7 @@ pub fn sent_mails(_app: &Router) -> Vec<(Vec<String>, String, String)> {
     SENT.lock().unwrap().clone()
 }
 
+/// Test handler for kinds without a real implementation yet.
 pub struct TestJob;
 
 #[async_trait]
@@ -60,7 +60,7 @@ impl JobHandler for TestJob {
 }
 
 pub fn register_test_jobs(runner: JobRunner) -> JobRunner {
-    runner.register(JobKind::PackageRefresh, Arc::new(TestJob))
+    runner
 }
 
 pub async fn build_test_app() -> Router {
@@ -79,8 +79,14 @@ async fn build_test_app_with(cfg: Config) -> Router {
     let pool = infrastructure::connect(&cfg.database_url)
         .await
         .expect("db");
-    let state = AppState::with_adapters(cfg, pool, Arc::new(RecordingMailer), register_test_jobs)
-        .expect("state");
+    let state = AppState::with_adapters(
+        cfg,
+        pool,
+        Arc::new(RecordingMailer),
+        Arc::new(infrastructure::FakeHostInspector),
+        register_test_jobs,
+    )
+    .expect("state");
     state.bootstrap().await.expect("bootstrap");
     build_app(state)
 }