Function handle_create_ssh_session

crates/openshell-server/src/grpc/sandbox.rs:1330–1404

(
    state: &Arc<ServerState>,
    request: Request<CreateSshSessionRequest>,
)

// ---------------------------------------------------------------------------

pub(super) async fn handle_create_ssh_session(
    state: &Arc<ServerState>,
    request: Request<CreateSshSessionRequest>,
) -> Result<Response<CreateSshSessionResponse>, Status> {
    let req = request.into_inner();
    if req.sandbox_id.is_empty() {
        return Err(Status::invalid_argument("sandbox_id is required"));
    }

    let sandbox = state
        .store
        .get_message::<Sandbox>(&req.sandbox_id)
        .await
        .map_err(|e| Status::internal(format!("fetch sandbox failed: {e}")))?
        .ok_or_else(|| Status::not_found("sandbox not found"))?;

    if SandboxPhase::try_from(sandbox.phase()).ok() != Some(SandboxPhase::Ready) {
        return Err(Status::failed_precondition("sandbox is not ready"));
    }

    let token = uuid::Uuid::new_v4().to_string();
    let now_ms = current_time_ms();
    let expires_at_ms = if state.config.ssh_session_ttl_secs > 0 {
        now_ms + (state.config.ssh_session_ttl_secs as i64 * 1000)
    } else {
        0
    };
    let session = SshSession {
        metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta {
            id: token.clone(),
            name: generate_name(),
            created_at_ms: now_ms,
            labels: std::collections::HashMap::new(),
            resource_version: 0,
        }),
        sandbox_id: req.sandbox_id.clone(),
        token: token.clone(),
        revoked: false,
        expires_at_ms,
    };

    // Ensure metadata is valid (defense in depth - should always be true for server-constructed metadata)
    super::validation::validate_object_metadata(session.metadata.as_ref(), "ssh_session")?;

    // Use MustCreate to atomically ensure the session token is unique
    state
        .store
        .put_if(
            SshSession::object_type(),
            &token,
            session.object_name(),
            &session.encode_to_vec(),
            None,
            WriteCondition::MustCreate,
        )
        .await
        .map_err(|e| Status::internal(format!("persist ssh session failed: {e}")))?;