Function handle_create_sandbox_inner

crates/openshell-server/src/grpc/sandbox.rs:119–233

(
    state: &Arc<ServerState>,
    request: Request<CreateSandboxRequest>,
)

}

async fn handle_create_sandbox_inner(
    state: &Arc<ServerState>,
    request: Request<CreateSandboxRequest>,
) -> Result<Response<SandboxResponse>, Status> {
    let request = request.into_inner();
    let spec = request
        .spec
        .ok_or_else(|| Status::invalid_argument("spec is required"))?;

    // Validate field sizes before any I/O (fail fast on oversized payloads).
    validate_sandbox_spec(&request.name, &spec)?;

    // Validate labels (keys and values must meet Kubernetes requirements).
    for (key, value) in &request.labels {
        crate::grpc::validation::validate_label_key(key)?;
        crate::grpc::validation::validate_label_value(value)?;
    }

    let _sandbox_sync_guard = if spec.providers.is_empty() {
        None
    } else {
        Some(state.compute.sandbox_sync_guard().await)
    };

    // Validate provider names exist (fail fast).
    for name in &spec.providers {
        state
            .store
            .get_message_by_name::<Provider>(name)
            .await
            .map_err(|e| Status::internal(format!("fetch provider failed: {e}")))?
            .ok_or_else(|| Status::failed_precondition(format!("provider '{name}' not found")))?;
    }
    validate_provider_environment_keys_unique(state.store.as_ref(), &spec.providers).await?;

    // Ensure the template always carries the resolved image.
    let mut spec = spec;
    let template = spec.template.get_or_insert_with(SandboxTemplate::default);
    if template.image.is_empty() {
        template.image = state.compute.default_image().to_string();
    }

    // Ensure process identity defaults to "sandbox" when missing or
    // empty, then validate policy safety before persisting.
    if let Some(ref mut policy) = spec.policy {
        openshell_policy::ensure_sandbox_process_identity(policy);
        validate_no_reserved_provider_policy_keys(policy)?;
        validate_policy_safety(policy)?;
    }

    let id = uuid::Uuid::new_v4().to_string();
    let name = if request.name.is_empty() {
        petname::petname(2, "-").unwrap_or_else(generate_name)
    } else {
        request.name.clone()
    };

    let now_ms = current_time_ms();