refactor(supervisor): prepare desired-state snapshots

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

Author: pimlock

crates/openshell-sandbox/src/lib.rs

@@ -3948,47 +3948,12 @@ async fn run_policy_poll_loop_with_client<C: PolicyGatewayClient>(
             {
                 Ok(env_result) => {
                     let provider_env_revision = env_result.provider_env_revision;
-                    let install_result = ctx.provider_credentials.install_bound_environment(
-                        provider_env_revision,
-                        env_result.environment,
-                        env_result.credential_expires_at_ms,
-                        env_result.dynamic_credentials,
-                        env_result.static_credential_bindings,
-                        env_result.non_secret_environment_keys,
-                    );
-                    if let Err(error) = install_result {
-                        ocsf_emit!(
-                            ConfigStateChangeBuilder::new(ocsf_ctx())
-                                .severity(SeverityId::High)
-                                .status(StatusId::Failure)
-                                .state(StateId::Disabled, "fail_closed")
-                                .message(format!(
-                                    "Rejected provider environment refresh; static provider credentials were revoked; fetched dynamic token grants remain active: {error}"
-                                ))
-                                .build()
-                        );
-                    } else {
-                        let child_env = ctx.provider_credentials.child_env_with_gcp_resolved();
-                        let env_count = child_env.len();
-                        if let Some(publisher) = ctx.sidecar_control_publisher.as_ref() {
-                            publisher
-                                .publish_provider_env(provider_env_revision, child_env.clone());
-                        }
+                    if apply_provider_environment_snapshot(
+                        &ctx.provider_credentials,
+                        env_result,
+                        ctx.sidecar_control_publisher.as_ref(),
+                    ) {
                         current_provider_env_revision = provider_env_revision;
-                        ocsf_emit!(
-                            ConfigStateChangeBuilder::new(ocsf_ctx())
-                                .severity(SeverityId::Informational)
-                                .status(StatusId::Success)
-                                .state(StateId::Enabled, "loaded")
-                                .unmapped(
-                                    "provider_env_revision",
-                                    serde_json::json!(provider_env_revision)
-                                )
-                                .message(format!(
-                                    "Provider environment refreshed [revision:{provider_env_revision} env_count:{env_count}]"
-                                ))
-                                .build()
-                        );
                     }
                 }
                 Err(e) => {
@@ -4262,6 +4227,61 @@ async fn run_policy_poll_loop_with_client<C: PolicyGatewayClient>(
     }
 }
 
+/// Apply one complete provider-environment snapshot to the live credential state.
+///
+/// The caller remains responsible for serializing snapshots and deciding whether
+/// a failed application should be retried. Keeping transport outside this helper
+/// lets polling and supervisor-session updates share the same installation path.
+fn apply_provider_environment_snapshot(
+    provider_credentials: &ProviderCredentialState,
+    snapshot: openshell_core::grpc_client::ProviderEnvironmentResult,
+    sidecar_control_publisher: Option<&sidecar_control::Publisher>,
+) -> bool {
+    let provider_env_revision = snapshot.provider_env_revision;
+    let install_result = provider_credentials.install_bound_environment(
+        provider_env_revision,
+        snapshot.environment,
+        snapshot.credential_expires_at_ms,
+        snapshot.dynamic_credentials,
+        snapshot.static_credential_bindings,
+        snapshot.non_secret_environment_keys,
+    );
+    if let Err(error) = install_result {
+        ocsf_emit!(
+            ConfigStateChangeBuilder::new(ocsf_ctx())
+                .severity(SeverityId::High)
+                .status(StatusId::Failure)
+                .state(StateId::Disabled, "fail_closed")
+                .message(format!(
+                    "Rejected provider environment refresh; static provider credentials were revoked; fetched dynamic token grants remain active: {error}"
+                ))
+                .build()
+        );
+        return false;
+    }
+
+    let child_env = provider_credentials.child_env_with_gcp_resolved();
+    let env_count = child_env.len();
+    if let Some(publisher) = sidecar_control_publisher {
+        publisher.publish_provider_env(provider_env_revision, child_env);
+    }
+    ocsf_emit!(
+        ConfigStateChangeBuilder::new(ocsf_ctx())
+            .severity(SeverityId::Informational)
+            .status(StatusId::Success)
+            .state(StateId::Enabled, "loaded")
+            .unmapped(
+                "provider_env_revision",
+                serde_json::json!(provider_env_revision)
+            )
+            .message(format!(
+                "Provider environment refreshed [revision:{provider_env_revision} env_count:{env_count}]"
+            ))
+            .build()
+    );
+    true
+}
+
 fn apply_ocsf_json_setting(
     enabled: &AtomicBool,
     settings: &std::collections::HashMap<String, openshell_core::proto::EffectiveSetting>,
@@ -4498,6 +4518,35 @@ mod tests {
         );
     }
 
+    #[test]
+    fn provider_environment_snapshot_apply_installs_complete_snapshot() {
+        let provider_credentials =
+            ProviderCredentialState::from_child_env_snapshot(1, std::collections::HashMap::new());
+        let applied = apply_provider_environment_snapshot(
+            &provider_credentials,
+            openshell_core::grpc_client::ProviderEnvironmentResult {
+                environment: std::collections::HashMap::from([(
+                    "API_BASE".to_string(),
+                    "https://example.test".to_string(),
+                )]),
+                provider_env_revision: 7,
+                credential_expires_at_ms: std::collections::HashMap::new(),
+                dynamic_credentials: std::collections::HashMap::new(),
+                static_credential_bindings: std::collections::HashMap::new(),
+                non_secret_environment_keys: vec!["API_BASE".to_string()],
+            },
+            None,
+        );
+
+        assert!(applied);
+        let snapshot = provider_credentials.snapshot();
+        assert_eq!(snapshot.revision, 7);
+        assert_eq!(
+            snapshot.child_env.get("API_BASE").map(String::as_str),
+            Some("openshell:resolve:env:v7_API_BASE")
+        );
+    }
+
     #[tokio::test]
     async fn sidecar_control_provider_env_update_orders_by_generation() {
         let (tx, rx) = tokio::sync::mpsc::unbounded_channel();

crates/openshell-server/src/grpc/policy.rs

@@ -2321,6 +2321,21 @@ pub(super) async fn handle_get_sandbox_config(
 
     let sandbox =
         super::sandbox::fetch_and_authorize_sandbox(state, &principal, &sandbox_id).await?;
+    build_sandbox_config_snapshot(state, &sandbox)
+        .await
+        .map(Response::new)
+}
+
+/// Build the effective gateway-owned configuration for an authorized sandbox.
+///
+/// Keeping request authentication outside this function lets supervisor session
+/// bootstrap and reconciliation reuse the same snapshot construction path as
+/// the public `GetSandboxConfig` RPC.
+pub async fn build_sandbox_config_snapshot(
+    state: &ServerState,
+    sandbox: &Sandbox,
+) -> Result<GetSandboxConfigResponse, Status> {
+    let sandbox_id = sandbox.object_id().to_string();
     let workspace = sandbox.object_workspace().to_string();
     let sandbox_provider_names = sandbox
         .spec
@@ -2498,7 +2513,7 @@ pub(super) async fn handle_get_sandbox_config(
     );
     if let Some(policy) = policy.as_ref() {
         validate_policy_credential_bindings_for_sandbox(
-            state.as_ref(),
+            state,
             &provider_profile_catalog,
             &workspace,
             &sandbox_provider_names,
@@ -2515,7 +2530,7 @@ pub(super) async fn handle_get_sandbox_config(
     )
     .await?;
 
-    Ok(Response::new(GetSandboxConfigResponse {
+    Ok(GetSandboxConfigResponse {
         policy,
         version,
         policy_hash,
@@ -2532,7 +2547,7 @@ pub(super) async fn handle_get_sandbox_config(
             .as_str()
             .to_string(),
         extension_authentication_enabled: state.sandbox_jwt_issuer.is_some(),
-    }))
+    })
 }
 
 #[cfg(test)]
@@ -3042,6 +3057,23 @@ pub(super) async fn handle_get_sandbox_provider_environment(
         .await
         .map_err(|e| Status::internal(format!("fetch sandbox failed: {e}")))?
         .ok_or_else(|| Status::not_found("sandbox not found"))?;
+
+    build_provider_environment_snapshot(state, &sandbox, supports_static_credential_bindings)
+        .await
+        .map(Response::new)
+}
+
+/// Build the gateway-owned provider environment for an authorized sandbox.
+///
+/// `supports_static_credential_bindings` preserves the existing fetch RPC's
+/// compatibility behavior. The required session protocol introduced by
+/// #1731 will call this builder with binding support enabled.
+pub async fn build_provider_environment_snapshot(
+    state: &ServerState,
+    sandbox: &Sandbox,
+    supports_static_credential_bindings: bool,
+) -> Result<GetSandboxProviderEnvironmentResponse, Status> {
+    let sandbox_id = sandbox.object_id().to_string();
     let workspace = sandbox.object_workspace().to_string();
 
     let spec = sandbox
@@ -3061,10 +3093,10 @@ pub(super) async fn handle_get_sandbox_provider_environment(
     )
     .await?;
     let effective_policy = current_effective_policy_for_sandbox(
-        state.as_ref(),
+        state,
         &provider_profile_catalog,
         &workspace,
-        &sandbox,
+        sandbox,
         &sandbox_id,
     )
     .await?;
@@ -3136,14 +3168,14 @@ pub(super) async fn handle_get_sandbox_provider_environment(
         .cloned()
         .collect();
 
-    Ok(Response::new(GetSandboxProviderEnvironmentResponse {
+    Ok(GetSandboxProviderEnvironmentResponse {
         environment: provider_environment.environment,
         provider_env_revision,
         credential_expires_at_ms: provider_environment.credential_expires_at_ms,
         dynamic_credentials: provider_environment.dynamic_credentials,
         static_credential_bindings: provider_environment.static_credential_bindings,
         non_secret_environment_keys,
-    }))
+    })
 }
 
 // ---------------------------------------------------------------------------
@@ -9673,6 +9705,54 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn snapshot_builders_match_existing_fetch_rpc_payloads() {
+        use openshell_core::proto::GetSandboxProviderEnvironmentRequest;
+
+        let state = test_server_state().await;
+        state
+            .store
+            .put_message(&test_provider("work-github", "github"))
+            .await
+            .unwrap();
+        let sandbox = test_sandbox(
+            "sb-builder-parity",
+            "builder-parity",
+            test_policy_with_rule("sandbox_only", "sandbox.example.com"),
+            vec!["work-github".to_string()],
+        );
+        state.store.put_message(&sandbox).await.unwrap();
+
+        let built_config = build_sandbox_config_snapshot(&state, &sandbox)
+            .await
+            .unwrap();
+        let fetched_config = handle_get_sandbox_config(
+            &state,
+            with_user(Request::new(GetSandboxConfigRequest {
+                sandbox_id: sandbox.object_id().to_string(),
+            })),
+        )
+        .await
+        .unwrap()
+        .into_inner();
+        assert_eq!(built_config, fetched_config);
+
+        let built_environment = build_provider_environment_snapshot(&state, &sandbox, true)
+            .await
+            .unwrap();
+        let fetched_environment = handle_get_sandbox_provider_environment(
+            &state,
+            with_user(Request::new(GetSandboxProviderEnvironmentRequest {
+                sandbox_id: sandbox.object_id().to_string(),
+                supports_static_credential_bindings: true,
+            })),
+        )
+        .await
+        .unwrap()
+        .into_inner();
+        assert_eq!(built_environment, fetched_environment);
+    }
+
     #[tokio::test]
     async fn provider_environment_resolution_is_unchanged_by_providers_v2_setting() {
         use openshell_core::proto::GetSandboxProviderEnvironmentRequest;