offscale/web/useHeadscaleData.ts

import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
import { useClient } from 'hooks/useClient';
import type { HeadscaleNode, HeadscaleUserWithCounts, HeadscalePreAuthKey } from './shared';

// Queries for the domain sections. All three act on whichever server is active, so they live under the
// same ['headscale'] key prefix that switching servers invalidates wholesale (see useHeadscaleServers).
//
// Mutations invalidate broadly rather than patching caches: deleting a user changes node counts, approving
// a route changes subnetRoutes, expiring a key changes nothing else but costs one cheap refetch. The lists
// are small and the correctness is worth more than the round trip.

const NODES_KEY = ['headscale', 'nodes'] as const;
const USERS_KEY = ['headscale', 'users'] as const;
const KEYS_KEY = ['headscale', 'keys'] as const;

const EMPTY_NODES: HeadscaleNode[] = [];
const EMPTY_USERS: HeadscaleUserWithCounts[] = [];
const EMPTY_KEYS: HeadscalePreAuthKey[] = [];

export function useHeadscaleNodes() {
  const { get, post, delete: del } = useClient();
  const qc = useQueryClient();
  const invalidate = () => qc.invalidateQueries({ queryKey: ['headscale'] });

  const query = useQuery({
    queryKey: NODES_KEY,
    queryFn: () => get<{ nodes: HeadscaleNode[] }>('/offscale/_officer/nodes'),
    // Online/lastSeen go stale fast, and this is a screen you sit on while waiting for a machine to join.
    refetchInterval: 20_000,
    staleTime: 10_000,
  });

  const rename = useMutation({
    mutationFn: ({ id, name }: { id: string; name: string }) => post(`/offscale/_officer/nodes/${id}/rename`, { name }),
    onSuccess: invalidate,
  });

  const setTags = useMutation({
    mutationFn: ({ id, tags }: { id: string; tags: string[] }) => post(`/offscale/_officer/nodes/${id}/tags`, { tags }),
    onSuccess: invalidate,
  });

  // Re-owning a node. Takes the target user's id, not its name — Headscale's ids are uint64-as-string.
  const moveToUser = useMutation({
    mutationFn: ({ id, userId }: { id: string; userId: string }) =>
      post(`/offscale/_officer/nodes/${id}/user`, { userId }),
    onSuccess: invalidate,
  });

  // Single-route toggle: the sidecar reads the current approved set and writes it back with one change,
  // because Headscale's approve_routes replaces the whole set.
  const toggleRoute = useMutation({
    mutationFn: ({ id, route, approved }: { id: string; route: string; approved: boolean }) =>
      post(`/offscale/_officer/nodes/${id}/routes`, { route, approved }),
    onSuccess: invalidate,
  });

  const expire = useMutation({
    mutationFn: (id: string) => post(`/offscale/_officer/nodes/${id}/expire`),
    onSuccess: invalidate,
  });

  const remove = useMutation({
    mutationFn: (id: string) => del(`/offscale/_officer/nodes/${id}`),
    onSuccess: invalidate,
  });

  return {
    nodes: query.data?.nodes ?? EMPTY_NODES,
    isLoading: query.isLoading,
    error: query.error,
    rename,
    setTags,
    moveToUser,
    toggleRoute,
    expire,
    remove,
  };
}

export function useHeadscaleUsers() {
  const { get, post, delete: del } = useClient();
  const qc = useQueryClient();
  const invalidate = () => qc.invalidateQueries({ queryKey: ['headscale'] });

  const query = useQuery({
    queryKey: USERS_KEY,
    queryFn: () => get<{ users: HeadscaleUserWithCounts[] }>('/offscale/_officer/users'),
    staleTime: 30_000,
  });

  const create = useMutation({
    mutationFn: (input: { name: string; displayName?: string; email?: string }) =>
      post('/offscale/_officer/users', input),
    onSuccess: invalidate,
  });

  const rename = useMutation({
    mutationFn: ({ id, name }: { id: string; name: string }) => post(`/offscale/_officer/users/${id}/rename`, { name }),
    onSuccess: invalidate,
  });

  const remove = useMutation({
    mutationFn: (id: string) => del(`/offscale/_officer/users/${id}`),
    onSuccess: invalidate,
  });

  return {
    users: query.data?.users ?? EMPTY_USERS,
    isLoading: query.isLoading,
    error: query.error,
    create,
    rename,
    remove,
  };
}

export type CreateKeyInput = {
  userId: string;
  reusable: boolean;
  ephemeral: boolean;
  expirationDays: number;
  aclTags: string[];
};

export function useHeadscaleKeys() {
  const { get, post, delete: del } = useClient();
  const qc = useQueryClient();
  const invalidate = () => qc.invalidateQueries({ queryKey: KEYS_KEY });

  const query = useQuery({
    queryKey: KEYS_KEY,
    queryFn: () => get<{ keys: HeadscalePreAuthKey[] }>('/offscale/_officer/keys'),
    staleTime: 30_000,
  });

  // The response carries the only copy of the secret that will ever exist. It is returned to the caller
  // (not merged into the list cache) so the view can show it once and deliberately drop it.
  const create = useMutation({
    mutationFn: (input: CreateKeyInput) =>
      post<{ key: HeadscalePreAuthKey; secretShownOnce: boolean }>('/offscale/_officer/keys', input),
    onSuccess: invalidate,
  });

  const expire = useMutation({
    mutationFn: (id: string) => post(`/offscale/_officer/keys/${id}/expire`),
    onSuccess: invalidate,
  });

  const remove = useMutation({
    mutationFn: (id: string) => del(`/offscale/_officer/keys/${id}`),
    onSuccess: invalidate,
  });

  return {
    keys: query.data?.keys ?? EMPTY_KEYS,
    isLoading: query.isLoading,
    error: query.error,
    create,
    expire,
    remove,
  };
}