gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-18 14:33:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(fleet): route remaining fleet dispatches through getProxyTarget for pilot-agent nodes (#1152)

Browse Source 
* fix(fleet): route remaining fleet dispatches through getProxyTarget for pilot-agent nodes

PR #1123 migrated POST /api/fleet/nodes/:id/update to use
NodeRegistry.getProxyTarget so pilot-agent rows (no api_url / api_token)
participate in remote update via the tunnel loopback. The same bug shape
lived on at ten sibling fleet-dispatch sites: each read node.api_url and
node.api_token directly, returning "Remote node not configured." against
pilots, or silently filtered pilot rows out of a fan-out loop.

Migrate every remaining fleet-wide remote dispatch to the same pattern:

- routes/fleet.ts: fleet-stop, fleet-prune, prune/estimate, snapshot
  restore (4 sites) -> getProxyTarget + mode-aware error copy +
  conditional Authorization header
- routes/imageUpdates.ts: fleet status + fleet refresh (2 sites) -> swap
  n.api_url filter for getProxyTarget != null and use target.apiUrl, so
  pilot rows appear in the aggregated image-updates view instead of
  being silently excluded
- utils/snapshot-capture.ts: captureRemoteNodeFiles (1 site) -> same
  pattern; CaptureNode interface gains required mode field so the
  thrown error message picks the pilot-tunnel copy automatically
- services/SecretsService.ts: resolveEnvFileRemote, readEnvRemote,
  writeEnvRemote (3 sites) -> same pattern; thrown errors now use the
  shared formatNoTargetError helper instead of leaking api_url/api_token
  field names

Extract the previously-private noTargetMessage helper from fleet.ts
into utils/remoteTarget.ts as formatNoTargetError so SecretsService,
snapshot-capture, and the fleet routes share one copy of the
mode-aware error string.

Add 10 regression tests in fleet-pilot-dispatch-parity.test.ts covering
each migrated route + the snapshot-capture utility: dispatch through
the loopback target with no Authorization header for pilots, and a
mode-aware error when the tunnel is disconnected.

FleetSyncService (4 additional sites) carries an api_url-anchored
targetIdentity in the wire protocol; pilot support there needs a
protocol-level identity decision and stays as a separate follow-up.

* fix(fleet): throw tunnel-disconnected error from resolveEnvFileRemote

Codex audit flagged that resolveEnvFileRemote returned null when
getProxyTarget was null. That predates the parity migration but the
migration was the right place to fix it: the null flowed through
readExistingEnv into previewPushDiff / executePush as "env file not
found", which is wrong (the env exists, the node is unreachable).

Throwing formatNoTargetError(node) here lets the existing catch arms
in previewPushDiff (lines 450-453) surface reachable=false with the
tunnel-disconnected message on the right axis, and executePush picks
up the same shape via its outer catch.

Also drop overstated coverage claims from the parity test header
(snapshot restore + SecretsService were never actually exercised in
this file, only structurally identical via tsc), and fix two describe
labels that read /api/labels/* instead of the mounted /api/fleet/labels/*.
This commit is contained in:
Anso
2026-05-22 00:30:51 -04:00
committed by GitHub
parent 60f893a81f
commit 2f2401df68
6 changed files with 468 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/SecretsService.ts
+22 -10
View File
@@ -4,8 +4,10 @@ import { CryptoService } from './CryptoService';
import { DatabaseService, type BlueprintSelector, type Node, type SecretRow, type SecretVersionRow, type SecretPushStatus } from './DatabaseService';
import { FileSystemService } from './FileSystemService';
import { NodeLabelService } from './NodeLabelService';
import { NodeRegistry } from './NodeRegistry';
import { resolveAllEnvFilePaths } from '../routes/stacks';
import { getErrorMessage } from '../utils/errors';
import { formatNoTargetError } from '../utils/remoteTarget';
export type SecretKv = Record<string, string>;
export type DiffStatus = 'added' | 'changed' | 'removed' | 'unchanged';
@@ -212,9 +214,16 @@ async function resolveEnvFileLocal(nodeId: number, stackName: string, basename:
}
async function resolveEnvFileRemote(node: Node, stackName: string, basename: string): Promise<ResolvedEnvFile | null> {
if (!node.api_url || !node.api_token) return null;
const baseUrl = node.api_url.replace(/\/$/, '');
const headers = { Authorization: `Bearer ${node.api_token}` };
// Throw on a null target so previewPushDiff / executePush surface the
// tunnel-disconnected (or proxy-not-configured) reason on the right
// axis. Returning null here would flow up through readExistingEnv as
// "env file not found", which is wrong: we know the env exists, we
// just cannot reach the node.
const target = NodeRegistry.getInstance().getProxyTarget(node.id);
if (!target) throw new Error(formatNoTargetError(node));
const baseUrl = target.apiUrl.replace(/\/$/, '');
const headers: Record<string, string> = {};
if (target.apiToken) headers.Authorization = `Bearer ${target.apiToken}`;
const res = await fetch(`${baseUrl}/api/stacks/${encodeURIComponent(stackName)}/envs`, {
headers,
signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -251,9 +260,11 @@ async function writeEnvLocal(nodeId: number, absolutePath: string, content: stri
}
async function readEnvRemote(node: Node, stackName: string, absolutePath: string): Promise<string> {
if (!node.api_url || !node.api_token) throw new Error('node has no api_url or api_token');
const baseUrl = node.api_url.replace(/\/$/, '');
const headers = { Authorization: `Bearer ${node.api_token}` };
const target = NodeRegistry.getInstance().getProxyTarget(node.id);
if (!target) throw new Error(formatNoTargetError(node));
const baseUrl = target.apiUrl.replace(/\/$/, '');
const headers: Record<string, string> = {};
if (target.apiToken) headers.Authorization = `Bearer ${target.apiToken}`;
const url = new URL(`${baseUrl}/api/stacks/${encodeURIComponent(stackName)}/env`);
if (absolutePath !== '.env') url.searchParams.set('file', absolutePath);
const res = await fetch(url.toString(), {
@@ -266,12 +277,13 @@ async function readEnvRemote(node: Node, stackName: string, absolutePath: string
}
async function writeEnvRemote(node: Node, stackName: string, absolutePath: string, content: string): Promise<void> {
if (!node.api_url || !node.api_token) throw new Error('node has no api_url or api_token');
const baseUrl = node.api_url.replace(/\/$/, '');
const headers = {
Authorization: `Bearer ${node.api_token}`,
const target = NodeRegistry.getInstance().getProxyTarget(node.id);
if (!target) throw new Error(formatNoTargetError(node));
const baseUrl = target.apiUrl.replace(/\/$/, '');
const headers: Record<string, string> = {
'Content-Type': 'application/json',
};
if (target.apiToken) headers.Authorization = `Bearer ${target.apiToken}`;
const url = new URL(`${baseUrl}/api/stacks/${encodeURIComponent(stackName)}/env`);
if (absolutePath !== '.env') url.searchParams.set('file', absolutePath);
const res = await fetch(url.toString(), {