refactor: move system-image promotion to domains/ec2/image

Move images_promote.go and its tests from admin to domains/ec2/image:
SystemOwnerAlias, PromoteImageOpts/PromoteImageResult, PromoteSystemImage,
GetAMIMetadata and the private snapshot reader. Storage, ordering, errors and
promotion behaviour are unchanged; the daemon, gateway/spx and operator CLI
callers import ec2image. admin now holds only account IDs and key generators.

spinifex/admin/accounts.go

@@ -1,6 +1,6 @@
 // Package admin holds what non-operator code still needs from the former admin
-// package: default account identifiers and AWS credential generators (awaiting
-// IAM owners) and system-image promotion (awaiting domains/ec2/image).
+// package: default account identifiers and AWS credential generators,
+// awaiting IAM owners.
 package admin
 
 import (

spinifex/daemon/daemon_handlers_image.go

@@ -7,7 +7,6 @@ import (
 	"log/slog"
 
 	"github.com/aws/aws-sdk-go/service/ec2"
-	"github.com/mulgadc/spinifex/spinifex/admin"
 	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
@@ -16,14 +15,14 @@ import (
 )
 
 func (d *Daemon) handleSpinifexPromoteImage(msg *nats.Msg) string {
-	promoteImage := func(_ context.Context, input *admin.PromoteImageOpts, _ string) (*admin.PromoteImageResult, error) {
+	promoteImage := func(_ context.Context, input *ec2image.PromoteImageOpts, _ string) (*ec2image.PromoteImageResult, error) {
 		store := objectstore.NewS3ObjectStoreFromConfig(
 			netaddr.DialTarget(d.config.Predastore.Host),
 			d.config.Predastore.Region,
 			d.config.Predastore.AccessKey,
 			d.config.Predastore.SecretKey,
 		)
-		return admin.PromoteSystemImage(store, d.config.Predastore.Bucket, *input)
+		return ec2image.PromoteSystemImage(store, d.config.Predastore.Bucket, *input)
 	}
 	return handleNATSRequest(d.node, promoteImage)(msg)
 }

spinifex/domains/ec2/image/images_promote.go

@@ -1,4 +1,4 @@
-package admin
+package image
 
 import (
 	"context"

spinifex/domains/ec2/image/images_promote_test.go

@@ -1,4 +1,4 @@
-package admin
+package image
 
 import (
 	"bytes"

spinifex/gateway/spx/promote_image.go

@@ -5,12 +5,12 @@ import (
 	"github.com/mulgadc/spinifex/spinifex/foundation/messaging/nats"
 	"time"
 
-	"github.com/mulgadc/spinifex/spinifex/admin"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/nats-io/nats.go"
 )
 
 // PromoteImage publishes a promotion request to the spinifex.image.promote NATS
-// topic and waits for the daemon to call admin.PromoteSystemImage and reply.
-func PromoteImage(ctx context.Context, nc *nats.Conn, imageID, accountID string) (*admin.PromoteImageResult, error) {
-	return natsmsg.NATSRequest[admin.PromoteImageResult](ctx, nc, "spinifex.image.promote", admin.PromoteImageOpts{ImageID: imageID}, 30*time.Second, accountID)
+// topic and waits for the daemon to call ec2image.PromoteSystemImage and reply.
+func PromoteImage(ctx context.Context, nc *nats.Conn, imageID, accountID string) (*ec2image.PromoteImageResult, error) {
+	return natsmsg.NATSRequest[ec2image.PromoteImageResult](ctx, nc, "spinifex.image.promote", ec2image.PromoteImageOpts{ImageID: imageID}, 30*time.Second, accountID)
 }

spinifex/operator/cli/admin.go

@@ -32,6 +32,7 @@ import (
 	legacyadmin "github.com/mulgadc/spinifex/spinifex/admin"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	ec2vpc "github.com/mulgadc/spinifex/spinifex/domains/ec2/vpc"
 	"github.com/mulgadc/spinifex/spinifex/domains/network/host"
 	awsidentifiers "github.com/mulgadc/spinifex/spinifex/foundation/aws/identifiers"
@@ -1122,7 +1123,7 @@ func runimagesPromoteCmd(cmd *cobra.Command, args []string) {
 	bucket := node.Predastore.Bucket
 
 	// Read current metadata for the confirmation prompt.
-	meta, err := legacyadmin.GetAMIMetadata(store, bucket, imageID)
+	meta, err := ec2image.GetAMIMetadata(store, bucket, imageID)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "Failed to inspect AMI:", err)
 		os.Exit(1)
@@ -1133,7 +1134,7 @@ func runimagesPromoteCmd(cmd *cobra.Command, args []string) {
 	fmt.Printf("  Image ID:       %s\n", imageID)
 	fmt.Printf("  Name:           %s\n", meta.Name)
 	fmt.Printf("  Current owner:  %s\n", meta.ImageOwnerAlias)
-	fmt.Printf("  New owner:      %s\n", legacyadmin.SystemOwnerAlias)
+	fmt.Printf("  New owner:      %s\n", ec2image.SystemOwnerAlias)
 	if !meta.CreationDate.IsZero() {
 		fmt.Printf("  Created:        %s\n", meta.CreationDate.UTC().Format("2006-01-02T15:04:05Z"))
 	}
@@ -1150,12 +1151,12 @@ func runimagesPromoteCmd(cmd *cobra.Command, args []string) {
 		}
 	}
 
-	if _, err := legacyadmin.PromoteSystemImage(store, bucket, legacyadmin.PromoteImageOpts{ImageID: imageID}); err != nil {
+	if _, err := ec2image.PromoteSystemImage(store, bucket, ec2image.PromoteImageOpts{ImageID: imageID}); err != nil {
 		fmt.Fprintln(os.Stderr, "Promote failed:", err)
 		os.Exit(1)
 	}
 
-	fmt.Printf("✅ Promoted %s to system image (owner: %s).\n", imageID, legacyadmin.SystemOwnerAlias)
+	fmt.Printf("✅ Promoted %s to system image (owner: %s).\n", imageID, ec2image.SystemOwnerAlias)
 }
 
 func runimagesDescribeCmd(cmd *cobra.Command, args []string) {
@@ -1180,7 +1181,7 @@ func runimagesDescribeCmd(cmd *cobra.Command, args []string) {
 		node.Predastore.SecretKey,
 	)
 
-	meta, err := legacyadmin.GetAMIMetadata(store, node.Predastore.Bucket, imageID)
+	meta, err := ec2image.GetAMIMetadata(store, node.Predastore.Bucket, imageID)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "Failed to describe AMI:", err)
 		os.Exit(1)