publish-server: decouple build from submit via an admin /admin/build endpoint (#30)

We can't build a bundle for every submission. /api/submit now just validates +
records a 'submitted' case (no build) and returns 202. Building is an explicit,
admin-token-gated action: POST /admin/build (guards submitted|build_failed →
building → async buildAsync → pending|build_failed). The case page shows a
'Build bundles' button that POSTs id + token (token injected from the admin
dashboard URL, same pattern as approve/reject). adminApprove still guards on
pending. New status: submitted. e2e-managed drives submit → /admin/build →
pending → approve (11/11 pass).

Co-authored-by: Alex Godoroja <alex@vulturelabs.io>

Author: Alexgodoroja

cmd/publish-server/main.go

@@ -105,6 +105,7 @@ func main() {
 	mux.Handle("GET /static/", http.FileServer(http.FS(assets)))
 	mux.HandleFunc("GET /admin", s.adminList)
 	mux.HandleFunc("GET /admin/case", s.adminCase)
+	mux.HandleFunc("POST /admin/build", s.adminBuild)
 	mux.HandleFunc("POST /admin/approve", s.adminApprove)
 	mux.HandleFunc("POST /admin/reject", s.adminReject)
 
@@ -198,20 +199,56 @@ func (s *server) apiSubmit(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, 422, map[string]any{"errors": errs})
 		return
 	}
-	// Record a "building" case and return immediately — the 4-platform build can
-	// outlast the ingress (Cloudflare ~100s) timeout if done inline, which dropped
-	// the form's request (HTTP 524/000). The build runs in the background and the
-	// case flips to "pending" (or "build_failed") when it finishes; the admin
-	// board reflects the live status.
-	c, err := s.cases.CreateBuilding(sub)
+	// Record the submission WITHOUT building — we don't build a bundle for every
+	// submission. An admin triggers the build per case (POST /admin/build, e.g.
+	// the "Build bundles" button on the case page). Returns instantly.
+	c, err := s.cases.CreateSubmitted(sub)
 	if err != nil {
 		writeJSON(w, 409, map[string]any{"errors": []string{err.Error()}})
 		return
 	}
-	go s.buildAsync(c.CaseID, sub)
 	writeJSON(w, 202, map[string]any{"case_id": c.CaseID, "status": c.Status})
 }
 
+// adminBuild kicks off the async bundle build for a submitted (or previously
+// failed) case. Admin-token gated, same as approve/reject. The build runs in a
+// background goroutine; the case flips submitted/build_failed → building →
+// pending (or build_failed). Triggered by the "Build bundles" button on the
+// case page, which injects the admin token from the dashboard URL.
+func (s *server) adminBuild(w http.ResponseWriter, r *http.Request) {
+	if !s.adminOK(r) {
+		http.Error(w, "admin token required", http.StatusUnauthorized)
+		return
+	}
+	id := r.FormValue("id")
+	c, err := s.cases.Get(id)
+	if err != nil {
+		http.Error(w, "unknown case", 404)
+		return
+	}
+	switch c.Status {
+	case publish.StatusSubmitted, publish.StatusBuildFailed:
+		// ok to (re)build
+	case publish.StatusBuilding:
+		http.Error(w, "already building", http.StatusConflict)
+		return
+	default:
+		http.Error(w, fmt.Sprintf("case is %q — build only applies to submitted or build_failed cases", c.Status), http.StatusConflict)
+		return
+	}
+	if _, err := s.cases.SetStatus(id, publish.StatusBuilding, "build started"); err != nil {
+		http.Error(w, "could not start build: "+err.Error(), 500)
+		return
+	}
+	go s.buildAsync(id, c.Submission)
+	// Back to the case page (preserve the admin token), like approve/reject.
+	u := "/admin/case?id=" + id
+	if t := r.FormValue("token"); t != "" {
+		u += "&token=" + t
+	}
+	http.Redirect(w, r, u, http.StatusSeeOther)
+}
+
 // buildAsync builds the bundle for an already-recorded case and flips it to
 // pending, or marks it build_failed. Runs in its own goroutine so the submit
 // response is instant (no ingress timeout on the synchronous build).

cmd/publish-server/templates/case.html

@@ -56,6 +56,19 @@ <h1>{{.C.Submission.Listing.DisplayName}} <span class="soft">{{.C.Submission.Ver
   <div class="card review"><h2>Generated pilotctl</h2><pre>{{range .Commands}}{{.}}
 {{end}}</pre></div>
 
+  {{if or (eq (printf "%s" .C.Status) "submitted") (eq (printf "%s" .C.Status) "build_failed")}}
+  <div class="card review">
+    <h2>Build</h2>
+    <p class="muted" style="margin:0 0 8px">{{if eq (printf "%s" .C.Status) "build_failed"}}The last build failed — see the history below, then re-run it.{{else}}Submitted but not built yet. Build the per-platform bundles (runs in the background, ~a few seconds), then approve.{{end}}</p>
+    <form method="post" action="/admin/build">
+      <input type="hidden" name="id" value="{{.C.CaseID}}"><input type="hidden" name="token" value="{{.Token}}">
+      <button class="primary" type="submit">Build bundles</button>
+    </form>
+  </div>
+  {{else if eq (printf "%s" .C.Status) "building"}}
+  <div class="card review"><h2>Building…</h2><p class="muted">Bundles are building in the background — refresh in a few seconds.</p></div>
+  {{end}}
+
   {{if eq (printf "%s" .C.Status) "pending"}}
   <div class="card review">
     <h2>Approve</h2>

internal/publish/case.go

@@ -80,11 +80,11 @@ func (s *CaseStore) Create(sub Submission, b *Bundle, build BuildInfo) (*Case, e
 	return c, s.write(c)
 }
 
-// CreateBuilding records a case in the "building" state with NO bundle yet, so
-// the submit HTTP response can return immediately while the bundle builds in a
-// background goroutine (a 4-platform build can outlast an ingress timeout if
-// done synchronously). Refuses to clobber an already-approved id+version.
-func (s *CaseStore) CreateBuilding(sub Submission) (*Case, error) {
+// CreateSubmitted records a validated case in the "submitted" state with NO
+// bundle. Building is a SEPARATE, admin-triggered step (POST /admin/build) — we
+// don't build a bundle for every submission automatically. Refuses to clobber
+// an already-approved id+version.
+func (s *CaseStore) CreateSubmitted(sub Submission) (*Case, error) {
 	id := safeKey(sub.ID + "-" + sub.Version)
 	if existing, err := s.Get(id); err == nil && existing.Status == StatusApproved {
 		return nil, fmt.Errorf("%s v%s is already approved/published; bump the version", sub.ID, sub.Version)
@@ -95,8 +95,8 @@ func (s *CaseStore) CreateBuilding(sub Submission) (*Case, error) {
 	}
 	now := time.Now().UTC().Format(time.RFC3339)
 	c := &Case{
-		CaseID: id, Status: StatusBuilding, Submission: sub,
-		History:   []Event{{At: now, Status: StatusBuilding, Note: "submitted; building bundle"}},
+		CaseID: id, Status: StatusSubmitted, Submission: sub,
+		History:   []Event{{At: now, Status: StatusSubmitted, Note: "submitted; awaiting build"}},
 		CreatedAt: now, UpdatedAt: now,
 	}
 	return c, s.write(c)

internal/publish/helpers.go

@@ -6,7 +6,8 @@ import "strings"
 type Status string
 
 const (
-	StatusBuilding    Status = "building"     // submitted; bundle building asynchronously
+	StatusSubmitted   Status = "submitted"    // received + validated; not built yet (admin triggers the build)
+	StatusBuilding    Status = "building"     // bundle building asynchronously
 	StatusBuildFailed Status = "build_failed" // async build errored; see the case note
 	StatusPending     Status = "pending"      // built + awaiting admin review
 	StatusApproved    Status = "approved"

scripts/e2e-managed.sh

@@ -73,17 +73,18 @@ resp=$(curl -s -X POST "http://$PUB/api/submit" -H 'Content-Type: application/js
 case_id=$(echo "$resp" | sed -n 's/.*"case_id":"\([^"]*\)".*/\1/p')
 [ -n "$case_id" ] && pass "admin submit accepted (case $case_id)" || fail "submit failed: $resp"
 
-# submit builds the bundle ASYNCHRONOUSLY (returns 202 "building"); wait for the
-# case to reach "pending" before approving (approve guards on pending).
+# submit does NOT build — an admin triggers the build per case. Fire /admin/build,
+# then wait for the async build to reach "pending" before approving.
 CASE_JSON="$WORK/store/cases/${case_id}/case.json"
+curl -s -X POST "http://$PUB/admin/build" --data-urlencode "id=$case_id" --data-urlencode "token=dev-admin" >/dev/null
 st=""
 for _ in $(seq 1 90); do
   st=$(sed -n 's/.*"status": *"\([^"]*\)".*/\1/p' "$CASE_JSON" 2>/dev/null | head -1)
   [ "$st" = "pending" ] && break
   [ "$st" = "build_failed" ] && fail "async build failed: $(cat "$CASE_JSON")"
   sleep 1
 done
-[ "$st" = "pending" ] && pass "async build finished → pending" || fail "build did not reach pending (status=$st)"
+[ "$st" = "pending" ] && pass "admin build → pending" || fail "build did not reach pending (status=$st)"
 
 # ── 2. admin board: approve (registers with the broker) ─────────────────────
 # (publish trigger no-ops without a token; registration happens regardless.)