"""Flask API for Attack Range Controller with OpenAPI documentation."""

import os

import sys

import time

import glob

import yaml

import threading

import traceback

import subprocess

import shutil

from datetime import datetime

from typing import Dict, Any, Optional, Tuple, List

from flask import jsonify, request

from flask_openapi3 import OpenAPI, Info, Tag

from flask_cors import CORS

from pydantic import ValidationError

# Add parent directory to path to import attack_range module

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from attack_range.attack_range_controller import AttackRangeController

from attack_range.build_status import can_retry_lab_phase, is_stale_lab_build

from attack_range.splunk_export import SplunkExportError, export_raw_events

from attack_range.utils import prepare_config_from_template, resolve_template_path, load_yaml_file, save_yaml_file, server_private_ip

from api.cloud_fields import get_cloud_fields_schema, get_gcp_zones_for_region

from api.models import (

HealthResponse,

BuildRequest,

BuildResponse,

DestroyRequest,

DestroyResponse,

OperationStatusResponse,

TemplateInfo,

ServerInfo,

TemplateListResponse,

TemplateContentResponse,

ConfigInfo,

ConfigListResponse,

ConfigContentResponse,

ErrorResponse,

AttackRangeIdPath,

TemplatePath,

CloudFieldsProviderPath,

ConfigIdPath,

AttackRangeListResponse,

ProviderAvailability,

ProviderCheckResponse,

SimulateRequest,

SimulateResponse,

ApplyRoleRequest,

ApplyRoleResponse,

SplunkExportRequest,

SplunkExportResponse,

ShareRequest,

ShareResponse,

UpdateNameRequest,

UpdateNameResponse,

)

# Disable macOS fork safety warning

os.environ["OBJC_DISABLE_INITIALIZE_FORK_SAFETY"] = "YES"

# Initialize Flask-OpenAPI3 app

info = Info(

title="Attack Range API",

version="1.0.0",

description="REST API for building and managing Attack Range infrastructure with automated OpenAPI documentation"

)

app = OpenAPI(__name__, info=info)

# Enable CORS for all routes

# Allow requests from localhost (for direct access) and from app container

CORS(app, resources={

r"/*": {

"origins": ["http://localhost:4321", "http://localhost:3000", "http://127.0.0.1:4321", "http://127.0.0.1:3000", "http://app:4321"],

"methods": ["GET", "POST", "PUT", "DELETE", "OPTIONS"],

"allow_headers": ["Content-Type", "Authorization"],

"supports_credentials": True

}

})

# Define tags for grouping endpoints

health_tag = Tag(name="Health", description="Health check endpoints")

attack_range_tag = Tag(name="Attack Range", description="Attack range build and destroy operations")

template_tag = Tag(name="Templates", description="Template management endpoints")

config_tag = Tag(name="Configs", description="Configuration management endpoints")

provider_tag = Tag(name="Providers", description="Cloud provider CLI availability endpoints")

# Directory paths

BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

TEMPLATES_DIR = os.path.join(BASE_DIR, "templates")

CONFIG_DIR = os.path.join(BASE_DIR, "config")

WIREGUARD_CONFIG_DIR = os.path.join(BASE_DIR, "wireguard_config")

# Global state for tracking running operations

running_operations: Dict[str, Dict[str, Any]] = {}

operations_lock = threading.RLock()

def check_cli_available(cli_command: str, version_flag: str = "--version") -> Tuple[bool, Optional[str]]:

"""

Check if a CLI command is available.

:param cli_command: CLI command name (e.g., 'aws', 'az', 'gcloud')

:param version_flag: Flag to check version (default: '--version')

:return: Tuple of (is_available, error_message)

"""

try:

# First, try to find the command in PATH

cmd_path = shutil.which(cli_command)

if not cmd_path:

return False, f"CLI command '{cli_command}' not found in PATH"

# Use the full path to the command

result = subprocess.run(

[cmd_path, version_flag],

capture_output=True,

text=True,

timeout=5,

check=False,

env=os.environ.copy()

)

if result.returncode == 0:

return True, None

else:

# Include stderr in error message if available

error_msg = f"Command '{cli_command}' returned non-zero exit code: {result.returncode}"

if result.stderr:

error_msg += f" - {result.stderr.strip()}"

return False, error_msg

except FileNotFoundError:

return False, f"CLI command '{cli_command}' not found in PATH"

except subprocess.TimeoutExpired:

return False, f"CLI command '{cli_command}' timed out"

except Exception as e:

return False, f"Error checking CLI '{cli_command}': {str(e)}"

def check_credentials_available(provider: str) -> Tuple[bool, Optional[str]]:

"""

Check if credentials are available for a cloud provider.

:param provider: Provider name ('aws', 'azure', 'gcp')

:return: Tuple of (has_credentials, error_message)

"""

try:

if provider.lower() == "aws":

# Check for AWS credentials

aws_creds_path = os.path.expanduser("~/.aws/credentials")

aws_config_path = os.path.expanduser("~/.aws/config")

if os.path.exists(aws_creds_path) or os.path.exists(aws_config_path):

# Also check if AWS CLI can authenticate

aws_cmd = shutil.which("aws")

if not aws_cmd:

return False, "AWS CLI not found in PATH"

result = subprocess.run(

[aws_cmd, "sts", "get-caller-identity"],

capture_output=True,

text=True,

timeout=10,

check=False,

env=os.environ.copy()

)

if result.returncode == 0:

return True, None

else:

error_msg = "AWS credentials found but authentication failed"

if result.stderr:

error_msg += f": {result.stderr.strip()}"

return False, error_msg

return False, "AWS credentials not found (~/.aws/credentials or ~/.aws/config)"

elif provider.lower() == "azure":

# Check for Azure credentials

azure_config_path = os.path.expanduser("~/.azure")

if os.path.exists(azure_config_path):

# Check if Azure CLI can authenticate

az_cmd = shutil.which("az")

if not az_cmd:

return False, "Azure CLI not found in PATH"

result = subprocess.run(

[az_cmd, "account", "show"],

capture_output=True,

text=True,

timeout=10,

check=False,

env=os.environ.copy()

)

if result.returncode == 0:

return True, None

else:

error_msg = "Azure credentials found but authentication failed"

if result.stderr:

error_msg += f": {result.stderr.strip()}"

return False, error_msg

return False, "Azure credentials not found (~/.azure)"

elif provider.lower() == "gcp":

# Check for GCP credentials

gcp_config_path = os.path.expanduser("~/.config/gcloud")

if os.path.exists(gcp_config_path):

# Check if gcloud can authenticate

gcloud_cmd = shutil.which("gcloud")

if not gcloud_cmd:

return False, "GCP CLI not found in PATH"

# Check for active accounts (case-insensitive)

result = subprocess.run(

[gcloud_cmd, "auth", "list"],

capture_output=True,

text=True,

timeout=10,

check=False,

env=os.environ.copy()

)

if result.returncode != 0:

error_msg = f"Failed to check GCP authentication: {result.stderr.strip() if result.stderr else 'Unknown error'}"

return False, error_msg

# Check for ACTIVE in output (case-insensitive)

stdout_upper = result.stdout.upper()

if "ACTIVE" in stdout_upper or "*" in result.stdout:

# Verify we can actually use the credentials by checking project

project_result = subprocess.run(

[gcloud_cmd, "config", "get-value", "project"],

capture_output=True,

text=True,

timeout=10,

check=False,

env=os.environ.copy()

)

if project_result.returncode == 0:

return True, None

# If project check fails, still consider it available if auth list shows active

# (project might not be set but auth is valid)

if "ACTIVE" in stdout_upper:

return True, None

# No active authentication found

error_msg = "GCP credentials found but no active authentication"

if result.stdout:

# Include a snippet of the auth list output for debugging

lines = result.stdout.strip().split('\n')

if len(lines) > 0:

error_msg += f" (found {len([l for l in lines if l.strip() and not l.startswith('Credentialed')])} account(s))"

return False, error_msg

return False, "GCP credentials not found (~/.config/gcloud)"

return False, f"Unknown provider: {provider}"

except Exception as e:

return False, f"Error checking credentials for {provider}: {str(e)}"

def get_provider_availability(test_missing: Optional[str] = None) -> list:

"""

Get availability status for all cloud providers.

This implementation no longer checks local CLI installation or credentials;

all providers are treated as available (unless simulated as missing for tests).

:param test_missing: Optional provider name to simulate as missing (for testing)

:return: List of ProviderAvailability objects

"""

providers_config = [

{"provider": "aws", "cli": "aws"},

{"provider": "azure", "cli": "az"},

{"provider": "gcp", "cli": "gcloud"},

]

results = []

for provider_config in providers_config:

provider = provider_config["provider"]

cli_command = provider_config["cli"]

# If testing missing provider, simulate it as unavailable

if test_missing and test_missing.lower() == provider.lower():

results.append(

ProviderAvailability(

provider=provider,

available=False,

cli_command=cli_command,

error_message=f"Simulated missing CLI for testing (test_missing={test_missing})",

)

)

else:

# Treat provider as available without performing any local CLI/credential checks

results.append(

ProviderAvailability(

provider=provider,

available=True,

cli_command=cli_command,

error_message=None,

)

)

return results

def get_templates() -> list:

"""Get list of all available templates."""

templates = []

if not os.path.exists(TEMPLATES_DIR):

return templates

# Scan templates directory

for provider in ["aws", "azure", "gcp"]:

provider_dir = os.path.join(TEMPLATES_DIR, provider)

if os.path.exists(provider_dir):

yml_files = glob.glob(os.path.join(provider_dir, "*.yml"))

for yml_file in yml_files:

# Load template to get description and architecture

description = None

architecture = None

try:

template_content = load_yaml_file(yml_file)

if template_content:

general = template_content.get("general")

if general and isinstance(general, dict):

description = general.get("description")

# Extract architecture information

attack_range = template_content.get("attack_range")

if attack_range and isinstance(attack_range, list):

servers = []

for server in attack_range:

if isinstance(server, dict):

# Determine OS type

os_type = None

if server.get("linux"):

os_type = "linux"

elif server.get("windows"):

os_type = "windows"

# Extract role names

roles = []

server_roles = server.get("roles", [])

if isinstance(server_roles, list):

for role in server_roles:

if isinstance(role, dict):

role_name = role.get("role")

if role_name:

roles.append(role_name)

elif isinstance(role, str):

roles.append(role)

servers.append(ServerInfo(

name=server.get("name", ""),

instance_type=server.get("instance_type"),

ip_last_octet=server.get("ip_last_octet"),

os_type=os_type,

roles=roles if roles else None,

zeek=server.get("zeek"),

zeek_monitor=server.get("zeek_monitor")

))

architecture = servers if servers else None

except Exception as e:

# If loading fails, continue without description/architecture

# Log error for debugging

import sys

print(f"Warning: Failed to load template from {yml_file}: {e}", file=sys.stderr)

import traceback

traceback.print_exc()

templates.append(TemplateInfo(

name=os.path.basename(yml_file),

provider=provider,

path=yml_file,

description=description,

architecture=architecture

))

return templates

# Note: load_yaml_file, save_yaml_file, and resolve_template_path are now imported from attack_range.utils

# Note: get_wireguard_config and update_config_status are now handled by the controller

def _is_lab_thread_alive(attack_range_id: str) -> bool:

with operations_lock:

op = running_operations.get(attack_range_id) or {}

thread = op.get("thread")

return bool(thread is not None and getattr(thread, "is_alive", lambda: False)())

def _mark_lab_playbook_error(attack_range_id: str, config_path: Optional[str], error: str) -> None:

"""Persist lab-playbook failure so the UI can offer destroy or retry."""

message = error or "Lab Ansible playbook failed."

if len(message) > 8000:

message = message[-8000:]

with operations_lock:

op = running_operations.get(attack_range_id)

if op is not None:

op["status"] = "error"

op["error"] = message

op["error_phase"] = "build_lab"

op["end_time"] = datetime.now().isoformat()

if config_path:

try:

config = load_yaml_file(config_path)

controller = AttackRangeController(config, config_path=config_path)

controller.config_manager.update_status(

"error", error=message, error_phase="build_lab"

)

except Exception:

_write_config_error_status(config_path, message, "build_lab")

def _reconcile_stale_lab_status(

attack_range_id: str,

operation_dict: Dict[str, Any],

config_path: Optional[str],

) -> Dict[str, Any]:

"""If lab Ansible exited without updating status, surface an error instead of build_lab."""

status = operation_dict.get("status")

if not is_stale_lab_build(status, _is_lab_thread_alive(attack_range_id)):

return operation_dict

error_msg = (

operation_dict.get("error")

or "Lab Ansible playbook failed or the build process exited unexpectedly."

)

_mark_lab_playbook_error(attack_range_id, config_path, error_msg)

operation_dict["status"] = "error"

operation_dict["error"] = error_msg

operation_dict["error_phase"] = "build_lab"

return operation_dict

def _attach_wireguard_config(

operation_dict: Dict[str, Any],

general: Optional[Dict[str, Any]],

attack_range_id: str,

) -> None:

"""Expose WireGuard config whenever the lab playbook can be started or retried."""

if not can_retry_lab_phase(operation_dict.get("status"), operation_dict.get("error_phase")):

return

general = general or {}

wireguard_config = general.get("wireguard_config")

if wireguard_config:

operation_dict["wireguard_config"] = wireguard_config

operation_dict["wireguard_config_path"] = os.path.join(

WIREGUARD_CONFIG_DIR, f"{attack_range_id}.conf"

)

return

wireguard_config_path = os.path.join(WIREGUARD_CONFIG_DIR, f"{attack_range_id}.conf")

if os.path.exists(wireguard_config_path):

operation_dict["wireguard_config_path"] = wireguard_config_path

try:

with open(wireguard_config_path, "r") as f:

operation_dict["wireguard_config"] = f.read()

except Exception:

pass

def get_config_path_from_attack_range_id(attack_range_id: str) -> Optional[str]:

"""Get config file path from attack_range_id."""

config_filename = f"{attack_range_id}.yml"

config_path = os.path.join(CONFIG_DIR, config_filename)

if os.path.exists(config_path):

return config_path

return None

def _write_config_error_status(config_path: str, error: str, error_phase: str) -> None:

"""Write error status into the config file without using the controller (e.g. when controller init fails)."""

try:

if not config_path or not os.path.exists(config_path):

return

config = load_yaml_file(config_path)

if "general" not in config:

config["general"] = {}

config["general"]["status"] = "error"

config["general"]["error"] = error

config["general"]["error_phase"] = error_phase

config["general"]["end_time"] = datetime.now().isoformat()

save_yaml_file(config_path, config)

except Exception:

pass

def _wait_abort_then_destroy(attack_range_id: str, config_path: str) -> None:

"""Wait for build to stop (abort or error), then run destroy. Used when user clicks Destroy during build."""

build_statuses = ("queued", "build_vpn", "build_lab")

for _ in range(45):

time.sleep(2)

with operations_lock:

cur = running_operations.get(attack_range_id)

s = (cur.get("status") if cur else None) or ""

if not s and config_path and os.path.exists(config_path):

try:

cfg = load_yaml_file(config_path)

s = cfg.get("general", {}).get("status") or ""

except Exception:

s = ""

if s not in build_statuses:

break

if not os.path.exists(config_path):

return

try:

config = load_yaml_file(config_path)

with operations_lock:

running_operations[attack_range_id] = {

"type": "destroy",

"status": "queued",

"created_time": datetime.now().isoformat(),

"attack_range_id": attack_range_id

}

# Pass current status (e.g. aborted/error) so we clear the range on destroy failure

run_destroy_operation(config, config_path, attack_range_id, previous_status=s or "")

except Exception:

pass

def _set_terraform_running(attack_range_id: str, running: bool) -> None:

"""Track whether Terraform is currently provisioning infrastructure for a build."""

with operations_lock:

op = running_operations.get(attack_range_id)

if op is not None:

op["terraform_running"] = running

def _is_terraform_running(attack_range_id: str) -> bool:

with operations_lock:

op = running_operations.get(attack_range_id)

return bool(op and op.get("terraform_running"))

def _is_abort_allowed(attack_range_id: str, status: str) -> bool:

build_statuses = ("queued", "build_vpn", "build_lab")

return status in build_statuses and not _is_terraform_running(attack_range_id)

def _check_abort_and_set_aborted(attack_range_id: str, config_path: Optional[str] = None) -> bool:

"""If abort_requested is set for this attack_range_id, set status to aborted and return True. Else return False."""

with operations_lock:

op = running_operations.get(attack_range_id)

if not op or not op.get("abort_requested"):

return False

if op.get("terraform_running"):

return False

running_operations[attack_range_id]["status"] = "aborted"

running_operations[attack_range_id]["end_time"] = datetime.now().isoformat()

path = config_path or op.get("config_path") or get_config_path_from_attack_range_id(attack_range_id)

if path and os.path.exists(path):

try:

config = load_yaml_file(path)

if "general" not in config:

config["general"] = {}

config["general"]["status"] = "aborted"

config["general"]["end_time"] = datetime.now().isoformat()

save_yaml_file(path, config)

except Exception:

pass

return True

def run_build_vpn_phase(config: Dict[str, Any], config_path: str, attack_range_id: str):

"""Run phase 1: Build VPN infrastructure (up to VPN config generation)."""

try:

if _check_abort_and_set_aborted(attack_range_id, config_path):

return

with operations_lock:

running_operations[attack_range_id]["status"] = "build_vpn"

running_operations[attack_range_id]["start_time"] = datetime.now().isoformat()

# Create controller with config

controller = AttackRangeController(config, config_path=config_path)

# Build VPN phase (handles all steps including status updates; checks abort between steps)

router_public_ip, wireguard_config = controller.build_vpn_phase(

attack_range_id,

abort_check=lambda: _check_abort_and_set_aborted(attack_range_id, config_path),

terraform_running_callback=lambda running: _set_terraform_running(attack_range_id, running),

)

wireguard_config_path = os.path.join(WIREGUARD_CONFIG_DIR, f"{attack_range_id}.conf")

# Update operation status

with operations_lock:

running_operations[attack_range_id]["status"] = "wait_for_vpn"

running_operations[attack_range_id]["attack_range_id"] = attack_range_id

running_operations[attack_range_id]["router_public_ip"] = router_public_ip

running_operations[attack_range_id]["wireguard_config"] = wireguard_config

running_operations[attack_range_id]["wireguard_config_path"] = wireguard_config_path

running_operations[attack_range_id]["config_path"] = config_path

except Exception as e:

is_aborted = "Build aborted" in str(e)

if not is_aborted:

with operations_lock:

running_operations[attack_range_id]["status"] = "error"

running_operations[attack_range_id]["end_time"] = datetime.now().isoformat()

running_operations[attack_range_id]["error"] = str(e)

running_operations[attack_range_id]["error_phase"] = "build_vpn"

running_operations[attack_range_id]["traceback"] = traceback.format_exc()

# Update error status in config file (via controller if available, else direct write)

try:

controller = AttackRangeController(config, config_path=config_path)

controller.config_manager.update_status("error", error=str(e), error_phase="build_vpn")

except Exception:

_write_config_error_status(config_path, str(e), "build_vpn")

def run_build_lab_phase(attack_range_id: str):

"""Run phase 2: Build lab infrastructure (after VPN connection)."""

try:

# Get config path from running_operations or from config file

with operations_lock:

config_path = running_operations[attack_range_id].get("config_path")

if not config_path:

config_path = get_config_path_from_attack_range_id(attack_range_id)

running_operations[attack_range_id]["status"] = "build_lab"

if config_path:

running_operations[attack_range_id]["config_path"] = config_path

if not config_path or not os.path.exists(config_path):

raise Exception("Config file not found for attack range")

# Load config

config = load_yaml_file(config_path)

controller = AttackRangeController(config, config_path=config_path)

abort_check = lambda: _check_abort_and_set_aborted(attack_range_id, config_path)

# Build lab phase (handles all steps including status updates)

controller.build_lab_phase(attack_range_id, abort_check=abort_check)

# Get router public IP

router_public_ip = controller.terraform_manager.get_output("router_public_ip")

# Update operation status

with operations_lock:

running_operations[attack_range_id]["status"] = "running"

running_operations[attack_range_id]["end_time"] = datetime.now().isoformat()

running_operations[attack_range_id]["result"] = {

"attack_range_id": attack_range_id,

"router_public_ip": router_public_ip,

"config_file": config_path

}

except (Exception, SystemExit) as e:

if isinstance(e, SystemExit) and e.code in (0, None):

raise

is_aborted = "Build aborted" in str(e)

if is_aborted:

return

config_path = None

with operations_lock:

op = running_operations.get(attack_range_id) or {}

config_path = op.get("config_path") or get_config_path_from_attack_range_id(attack_range_id)

op["traceback"] = traceback.format_exc()

running_operations[attack_range_id] = op

error_msg = str(e) if not isinstance(e, SystemExit) else "Lab Ansible playbook failed."

_mark_lab_playbook_error(attack_range_id, config_path, error_msg)

def run_destroy_operation(

config: Dict[str, Any],

config_path: Optional[str],

attack_range_id: str,

previous_status: str = "",

):

"""Run destroy operation in a separate thread. When previous_status is 'error' or 'failed', we still remove the config on destroy failure so the range is cleared."""

controller = None

try:

with operations_lock:

running_operations[attack_range_id]["status"] = "destroying"

running_operations[attack_range_id]["start_time"] = datetime.now().isoformat()

if config_path:

try:

controller = AttackRangeController(config, config_path=config_path)

controller.config_manager.update_status("destroying")

except Exception:

pass

if not controller:

controller = AttackRangeController(config, config_path=config_path)

controller.destroy()

if config_path and os.path.exists(config_path):

try:

os.remove(config_path)

except Exception as e:

controller.logger.warning(f"Failed to delete config file: {e}")

with operations_lock:

if attack_range_id in running_operations:

del running_operations[attack_range_id]

except Exception as e:

with operations_lock:

running_operations[attack_range_id]["status"] = "failed"

running_operations[attack_range_id]["end_time"] = datetime.now().isoformat()

running_operations[attack_range_id]["error"] = str(e)

running_operations[attack_range_id]["traceback"] = traceback.format_exc()

if config_path:

try:

c = AttackRangeController(config, config_path=config_path)

c.config_manager.update_status("failed", error=str(e))

except Exception:

pass

# If this was already a failed/errored/aborted range (e.g. build_vpn error), clear it so user can start fresh

if previous_status in ("error", "failed", "aborted") and config_path and os.path.exists(config_path):

try:

os.remove(config_path)

with operations_lock:

if attack_range_id in running_operations:

del running_operations[attack_range_id]

except Exception:

pass

# ============================================================================

# HEALTH ENDPOINTS

# ============================================================================

@app.get(

"/health",

tags=[health_tag],

responses={200: HealthResponse},

summary="Health check",

description="Check if the API is running and healthy"

)

def health():

"""Health check endpoint."""

return jsonify(HealthResponse(status="healthy", version="1.0.0").model_dump())

# ============================================================================

# ATTACK RANGE ENDPOINTS

# ============================================================================

@app.post(

"/attack-range/build",

tags=[attack_range_tag],

responses={202: BuildResponse, 400: ErrorResponse, 404: ErrorResponse, 500: ErrorResponse},

summary="Build attack range",

description="Build a new attack range (provide 'template') OR continue after VPN / retry the lab playbook after a lab-phase error (provide 'attack_range_id'). This is an asynchronous operation."

)

def build_attack_range(body: BuildRequest):

"""Build a new attack range or continue existing build."""

try:

import uuid

# Determine if this is a new build or continuation

is_continuation = body.attack_range_id is not None

is_new_build = body.template is not None

# Validate input: must provide either template (new build) or attack_range_id (continuation)

if not is_new_build and not is_continuation:

return jsonify(ErrorResponse(

message="Either 'template' (for new build) or 'attack_range_id' (to continue after VPN) must be provided"

).model_dump()), 400

if is_new_build and is_continuation:

return jsonify(ErrorResponse(

message="Cannot provide both 'template' and 'attack_range_id'. Use 'template' for new builds or 'attack_range_id' to continue."

).model_dump()), 400

# Handle continuation (Phase 2: Lab build after VPN connection)

if is_continuation:

attack_range_id = body.attack_range_id

# Check status from running_operations or config file

status = None

error_phase = None

config_path = None

with operations_lock:

if attack_range_id in running_operations:

status = running_operations[attack_range_id].get("status")

error_phase = running_operations[attack_range_id].get("error_phase")

config_path = running_operations[attack_range_id].get("config_path")

if not config_path:

config_path = get_config_path_from_attack_range_id(attack_range_id)

persisted = None

if config_path:

persisted = load_operation_from_config(config_path)

if persisted:

status = persisted.get("status") or status

error_phase = persisted.get("error_phase") or error_phase

with operations_lock:

if attack_range_id not in running_operations:

running_operations[attack_range_id] = persisted

running_operations[attack_range_id]["config_path"] = config_path

snapshot = _reconcile_stale_lab_status(

attack_range_id,

{"status": status, "error_phase": error_phase},

config_path,

)

status = snapshot.get("status")

error_phase = snapshot.get("error_phase")

if not status:

return jsonify(ErrorResponse(

message=f"No build found for attack_range_id: {attack_range_id}",

details="Make sure you started a build first"

).model_dump()), 404

if _is_lab_thread_alive(attack_range_id):

return jsonify(ErrorResponse(

message="Lab build is already in progress",

details="Wait for the current lab playbook to finish, then retry if it fails"

).model_dump()), 400

if not can_retry_lab_phase(status, error_phase):

return jsonify(ErrorResponse(

message=f"Cannot retry the lab playbook from status '{status}'",

details="Reconnect WireGuard and retry after a lab-phase error, or continue from wait_for_vpn"

).model_dump()), 400

# Ensure config_path is set in running_operations

if config_path:

with operations_lock:

if attack_range_id in running_operations:

running_operations[attack_range_id]["config_path"] = config_path

# Start phase 2 in a separate thread

thread = threading.Thread(

target=run_build_lab_phase,

args=(attack_range_id,)

)

thread.daemon = True

with operations_lock:

if attack_range_id not in running_operations:

running_operations[attack_range_id] = {

"type": "build",

"status": "build_lab",

"attack_range_id": attack_range_id,

"config_path": config_path,

}

running_operations[attack_range_id]["status"] = "build_lab"

running_operations[attack_range_id]["thread"] = thread

thread.start()

return jsonify(BuildResponse(

status="accepted",

message=f"Continuing build (lab phase) for attack range: {attack_range_id}",

attack_range_id=attack_range_id,

phase="lab"

).model_dump()), 202

# Handle new build (Phase 1: VPN setup)

else:

# Prepare config from template using shared utility

try:

config, config_path, attack_range_id = prepare_config_from_template(

body.template,

TEMPLATES_DIR,

CONFIG_DIR,

generate_id=True,

cloud_overrides=body.cloud_overrides,

general_overrides=body.general_overrides

)

# Extract template name from config (already set by prepare_config_from_template)

template_name = config.get("general", {}).get("name")

except FileNotFoundError as e:

return jsonify(ErrorResponse(

message="Template not found",

details=str(e)

).model_dump()), 404

except Exception as e:

return jsonify(ErrorResponse(

message="Failed to prepare config from template",

details=str(e)

).model_dump()), 500

# Initialize operation state (keyed by attack_range_id)

with operations_lock:

running_operations[attack_range_id] = {

"type": "build",

"status": "queued",

"created_time": datetime.now().isoformat(),

"attack_range_id": attack_range_id,

"template_name": template_name

}

# Status is already set to "queued" by prepare_config_from_template

# Start phase 1 in a separate thread

thread = threading.Thread(

target=run_build_vpn_phase,

args=(config, config_path, attack_range_id)

)

thread.daemon = True

thread.start()

return jsonify(BuildResponse(

status="accepted",

message=f"Build operation started (VPN phase). Attack Range ID: {attack_range_id}",

attack_range_id=attack_range_id,

phase="vpn"

).model_dump()), 202

except Exception as e:

return jsonify(ErrorResponse(

message="Failed to start build operation",

details=str(e)

).model_dump()), 500

@app.post(

"/attack-range/destroy",

tags=[attack_range_tag],

responses={202: DestroyResponse, 400: ErrorResponse, 404: ErrorResponse, 500: ErrorResponse},

summary="Destroy attack range",

description="Destroy an existing attack range infrastructure by attack_range_id."

)

def destroy_attack_range(body: DestroyRequest):

"""Destroy an attack range. If a build is in progress, requests abort and waits for it to stop, then runs destroy."""

try:

attack_range_id = body.attack_range_id

config_filename = f"{attack_range_id}.yml" if not attack_range_id.endswith('.yml') else attack_range_id

config_path = os.path.join(CONFIG_DIR, config_filename)

if not os.path.exists(config_path):

return jsonify(ErrorResponse(

message=f"Config file not found for attack_range_id: {attack_range_id}",

details="Make sure the attack range exists"

).model_dump()), 404

# If a build is in progress, request abort and run "wait for abort then destroy" in a thread

build_statuses = ("queued", "build_vpn", "build_lab")

with operations_lock:

current = running_operations.get(attack_range_id)

status = (current.get("status") if current else None) or ""

if not status and os.path.exists(config_path):

config_for_status = load_yaml_file(config_path)

status = config_for_status.get("general", {}).get("status") or ""

if status in build_statuses:

if _is_terraform_running(attack_range_id):

return jsonify(ErrorResponse(

message="Cannot destroy while Terraform is provisioning infrastructure",

details="Wait for Terraform to finish, then retry destroy or abort"

).model_dump()), 400

with operations_lock:

op = running_operations.get(attack_range_id)

if op:

op["abort_requested"] = True

# Run wait-for-abort-then-destroy in background; return 202 immediately

thread = threading.Thread(

target=_wait_abort_then_destroy,

args=(attack_range_id, config_path)

)

thread.daemon = True

thread.start()

return jsonify(DestroyResponse(

status="accepted",

message=f"Build abort requested; destroy will run when build stops. Attack Range ID: {attack_range_id}"

).model_dump()), 202

# Remember if we're cleaning up an already-failed/errored range (so we can clear it even when destroy fails)

previous_status = status.strip().lower() if status else ""

config = load_yaml_file(config_path)

config_attack_range_id = config.get("general", {}).get("attack_range_id")

if config_attack_range_id and config_attack_range_id != attack_range_id:

return jsonify(ErrorResponse(

message=f"attack_range_id mismatch. Expected: {attack_range_id}, Found in config: {config_attack_range_id}"

).model_dump()), 400

with operations_lock:

running_operations[attack_range_id] = {

"type": "destroy",

"status": "queued",

"created_time": datetime.now().isoformat(),

"attack_range_id": attack_range_id

}

try:

controller = AttackRangeController(config, config_path=config_path)

controller.config_manager.update_status("destroying")

except Exception:

pass

thread = threading.Thread(

target=run_destroy_operation,

args=(config, config_path, attack_range_id, previous_status)

)

thread.daemon = True

thread.start()

return jsonify(DestroyResponse(