mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-11 03:06:54 +00:00
feat(git): complete-project materialization with a managed-project manifest (#1786)
* feat(git): add managed-project manifest types and DB cache columns
Introduces the canonical managed-project manifest contract types (schema v1)
and the stack_git_sources cache columns manifest_version / manifest_state /
manifest_generation. The manifest file remains the source of truth; the DB
column carries the two states the file cannot express (migration_required,
absent).
* feat(git): add vendored Docker .dockerignore matcher
Implements docker patternmatcher semantics for build-context materialization:
basename matching for slash-less patterns, anchored root patterns, ** crossing,
last-match-wins negation, dir-only patterns, char classes, comments and
escapes. Table-driven tests cover the full rule set.
* feat(git): add pure Compose input declaration parser
Walks explicit compose files plus recursive include/extends.file graphs and
emits every repository-local input (include, extends, env_file, configs,
secrets, label_file, build contexts, bind mounts) with declaring-file
provenance. Side-effect free: file contents are injected via a read callback.
Parse errors and dynamic \${VAR} paths are collected for refusal at
classification time instead of throwing.
* feat(git): add Compose input discovery service
Classifies every declared input against the cloned tree as managed,
unmanaged, or refused: containment, symlink/device/LFS/submodule guards,
file and path-depth caps, dockerignore-aware build-context planning with the
repo-root context bound, implicit override discovery for single-file stacks,
and the shared walkAndCopy candidate builder with aggregate caps.
* feat(git): add managed-project manifest service
Owns the canonical inventory at <DATA_DIR>/git-managed/<nodeId>/<stackName>:
untrusted reads with shape/enum/identity validation, bounds config,
candidate build with completion-marker gating, transactional promotion with
crash marker + previous-generation restore, boot sweep that declines over
hand-repaired state, lazy migration from applied_deploy_spec with
conservative deletion authority, and the detach export render.
* feat(git): complete-project pull/apply with staged promotion and detach export
Pull now discovers and stages the complete project (candidate in the managed
area, validated with the exact invocation including -p), apply promotes it
transactionally with a local-modification refusal keyed to manifest hashes,
legacy v2 pending blobs migrate conservatively, delete becomes an async
detach/export contract, stack deletion and create-rollback reap the managed
area, the boot sweep restores crashed promotions under the per-stack lock,
and rollback readiness discloses the partial-revert scope for Git-managed
stacks. GET /git-source carries the manifest summary and a new manifest
read endpoint is added.
* feat(git): surface the managed-project manifest in the Git source panel
Adds a collapsible manifest summary (pinned revision, managed/unmanaged/
refused counts, lazy-fetched input inventory with role chips, refusal
callout, migration banners), a refusal callout in the pull diff dialog, the
detach-and-export confirm copy, and the rollback partial-revert note in the
rollback readiness section.
* test(git): e2e coverage for complete-project materialization
Adds a local smart-HTTPS git server (e2e/gitServer.helper.ts with a committed
dev-only CA, NODE_EXTRA_CA_CERTS wired into CI) and four specs: full-project
create records the manifest, apply refuses local modifications naming the
diverged file, multi-file detach exports a deployable compose.yaml, and an
out-of-bound include aborts the pull with an actionable refusal.
* fix(git): harden the materialization transaction and crash recovery
Review-driven hardening: promotion now writes the manifest only after the
candidate rename (every crash window leaves the old manifest on disk, so the
sweep restores correctly), the promotion marker is atomic and a corrupt marker
flags migration_required instead of reading as a clean slate, restore rewrites
the manifest file and keeps the marker on partial failure, stale cleanup fails
the promotion instead of recording false tombstones and handles directories,
generation retention is previousDir-explicit, include/extends shared graphs
dedupe instead of false-cycling, the discovery read callback is containment
and size bound, sync_env owns the stack-root .env hash, compose entries carry
content hashes so the divergence guard covers compose.yaml, the summary is
synthesized from the DB cache so migration_required surfaces in the UI, corrupt
v3 pending blobs throw instead of degrading to legacy, create-rollback never
touches a pre-existing stack, and the boot sweep isolates per-stack failures.
* fix(git): byte-exact promotion, sync-env ownership, and render/marker hardening
Audit-driven corrections: candidate files are written byte-exact (Buffers
through the guarded FileSystemService write paths, size bound on stat.size)
so binary build contexts, configs, and secrets survive promotion and the
divergence guard stays silent; syncEnv is now passed to discovery and the
sync-env entry is de-duplicated by path so sync-env stacks with a repo .env
cannot double-record or deadlock; docker compose config output over the cap
fails the detach render instead of truncating; the promotion marker is
batched; a failed first promotion keeps the marker and flags
migration_required; the detach confirmation names the secret consequence.
Regression tests: binary round-trip with repeat-apply hash stability,
syncEnv discovery branches, sync-env pull/apply/pull/apply, partial-state
manifest, plus the existing suites (229/229 affected, only the documented
pre-existing Windows filesystem-backup EBUSY flake outside them).
* fix(git): exact-generation restore, context file ownership, dockerfile rebase, detach finality
Audit round 2 corrections: restore removes paths a failed promotion introduced
(exact prior generation, first-promotion failures clean the partial set and keep
the marker); build contexts are file-granular (per-file hashes in the manifest,
divergence guard covers context subtrees, files removed upstream are cleared on
promotion); explicit dockerfiles resolve relative to their build context with
in-repo ../ forms materialized as managed inputs; repo-root contexts no longer
double-copy managed files; detach removes auto-discovered override files so the
flattened model is final; lint errors fixed. Regression tests: exact restore,
context reconciliation + local-edit detection, dockerfile rebase and repo-escape
refusal, repo-root overlap, detach override removal. 213/213 affected backend
tests.
* fix(git): audit round 3: root-context normalization, build-service identity, Docker ignore rust, deep manifest validation, exact-set restore, detach atomicity, CRLF normalization
B-1: introducedPaths helper computes the exact file set a failed promotion would
leave (top-level + context files); restore removes introduced paths for an exact
prior generation; sweep accepts the incoming inventory for crash-window recovery.
B-2: repo-root context (build: .) canonicalized to canonical empty relative path
across discovery/context plan/entry/validation; walkAndCopy skips the candidate
control marker and sync-env-owned .env so root contexts never copy Sencho metadata
into the live stack dir.
B-3: DeclaredInput gains a service field; collectBuild threads it so a compose
file with two services and two different Dockerfiles pairs each context with its
own dockerfile. Additional contexts never inherit the service dockerfile.
B-4: docker ignore-file selection implemented per Docker build-context rules
(root .dockerignore, with Dockerfile-specific <name>.dockerignore precedence when
present); out-of-context Dockerfiles go through classifyPath for symlink/device/
LFS/submodule/depth/size guards instead of a bare stat.
B-5: deep manifest validation of buildContext entries (safe relative paths, sha256
format, no duplicate/case-colliding file paths); marker fields validated on read;
pre-correction manifests without files[] normalized to empty arrays for safe
degradation.
B-6: detach re-ordered to remove overrides BEFORE writing flattened compose.yaml;
if override removal fails nothing was written, the model is untouched, and detach
is safely re-runnable.
S-1: ComposeService.ts LFs normalized to repository convention.
All 213 affected backend tests pass; tsc + lint clean both sides.
* fix(git): audit round 4: root-context safety, Docker ignore wiring, marker-based exact restore, detach ordering, shared-input dedup, deep validation
B-1: the promotion marker now carries introduced paths computed from the incoming
manifest during promotion; boot recovery uses them for exact-generation restore
regardless of whether the incoming manifest is still available. `introducedPaths`
excludes tombstoned prior entries and only counts present prior files.
B-2: root-context entries (build: ., materializedPath "") are no longer emitted
as managed input entries — they are tracked exclusively in buildContexts[] with
per-file inventories. `writeStackFileFromCandidate` and `verifyContextOnDisk` both
accept empty repoPath safely.
B-3: Dockerfile-specific .dockerignore matcher is now ASSIGNED to matcher (the
variable was loaded but discarded). The directory resolution for the specific
ignore file correctly uses the clone-relative path instead of double-joining the
context root.
B-4: detach now writes the flattened compose.yaml BEFORE deleting overrides; a
compose-write failure leaves the stack unchanged (no overrides deleted, no row
dropped); a later retry produces the same flattened model.
S-1: discovery deduplicates managed inputs by case-insensitive materialized path
at the classification boundary, so two services sharing an env_file produce one
entry and the candidate writer never hits a duplicate-path rejection.
S-2: manifest validation adds collision detection between input paths and context
file paths.
All 213 affected backend tests pass; tsc clean; lint 0 errors.
* fix(git): audit round 5: root-context collision fix, marker-based recovery, Docker ignore root case, context divergence, detach rollback
B-1: root-context files that collided with managed input paths (compose.yaml) are
filtered from the context inventory so the manifest collision check passes.
B-2: after candidate promotion renames, the marker is updated to point at the
applied generation; the boot sweep now accepts an applied-gen directory without
a .candidate-complete marker as valid for recovery.
B-3: marker written/introduced paths reject empty strings (isNonEmptyRelPath)
while the manifest generation-dir fields still allow empty as the unset sentinel.
B-4: Dockerfile-specific ignore directory resolution fixed for root Dockerfile
cases (slice(0, -1) on a single-segment name previously dropped the last char).
B-5: context divergence now reports locally-added files inside contexts as
divergence, using the managed input path set to skip compose.yaml/.env/files
that have a non-context owner.
B-6: detach now snapshots the prior compose.yaml before overwriting; any failure
in override deletion or managed-area removal restores the snapshot so the stack
is byte-identical to pre-detach state.
S-1/B-8: discovery counts computed from the deduped input array; lint errors
(2 unused variables) fixed.
All 213 affected backend tests pass; tsc clean; lint 0 errors.
* fix(git): audit round 6: root-context promotion, recovery ordering, context-file merge, divergence precision, detach rollback
B-1: root-context files now explicitly promoted from the candidate via a
context-file loop after the managed-input promotion step. Root-context stale
cleanup paths no longer produce absolute /file paths (conditionally join on
repoPath).
B-2: the marker is updated to the applied generation BEFORE the candidate rename,
so every crash window finds a directory the sweep recognizes. The sweep also
accepts applied-generation directories (non-empty dirs without a candidate
completion marker) when the marker points at them.
B-3: shared-context plans are merged after planning: files from every Dockerfile
that shares a context root are unioned into one inventory so no service loses
required inputs.
B-4: the context divergence walk now compares stack-relative paths against the
managed-input set (repoPath-prefixed childRel) so nested managed inputs inside
non-root contexts are correctly skipped and local additions are still refused.
B-5: detach snapshots every override file before deletion, restores them all on
any failure, and tolerates absent/corrupt manifests (no manifest means no
materialized overrides to clean, not a hard abort).
All 213 affected backend tests pass; tsc clean; lint 0 errors.
* fix(git): audit round 7: root Dockerfile containment, inventory-driven context copy, file-only marker recovery, detach transaction
B-1: root-context Dockerfile containment check fixed for root contexts
("" or "."). Any repo-relative Dockerfile without ../ is in-context.
B-2: context copy now reads from the plan inventory (plan.context.files)
instead of re-walking the source with the first matcher. Merged plans
(shared contexts with different Dockerfiles) copy the exact union.
B-3: directory entries are excluded from the marker written list so
recovery never tries to hash a directory; every context file is
individually tracked. Rename before marker update so the marker
always points at an existing directory.
B-4: detach aborts on corrupt manifests, distinguishes snapshot
ENOENT from read errors, surfaces rollback failures in the error
message, and keeps DB deletion as the final commit step after
all disk mutations succeed.
All 213 affected backend tests pass; tsc clean; lint 0 errors.
* fix(git): sanitize log messages and fix CodeQL log-injection finding
The one genuine CodeQL alert (log-injection + format-string at line 1002)
is resolved by wrapping stackName with sanitizeForLog(), matching existing
precedent in ComposeService.ts and routes/stacks.ts. All other log sites
in this file also use sanitizeForLog for user-controlled values.
* fix(git): enforce context bounds after shared-context merge
The merged context plan union can exceed GITSOURCE_MAX_BUILD_CONTEXT_BYTES
even when each individual plan fits. Recheck the cap against the unionized
inventory after merging.
* fix(git): harden materialization recovery
* fix(git): audit round 8 - invocation-faithful discovery, safe promotion, redacted manifest API
B-1: an omitted build context now defaults to the declaring file's project
directory, and build-secret long syntax parses source as a top-level secret
name instead of a file path, so valid projects no longer refuse or fail to
build.
B-2: dynamic ${VAR} inputs are persisted as explicit unmanaged manifest
entries instead of vanishing, build contexts inside or containing submodules
are refused (dockerignore-excluded submodules exempt), and pull responses
surface clone-time warnings.
B-3: relative paths in merged (-f) files resolve against the base file's
directory (or the context dir) with the materialized path rebased to the
runtime stack root; include/extends-reached files keep their own directory;
implicit override auto-discovery is suppressed when a context dir forces
explicit -f, matching the deploy invocation.
B-4: promotion refuses introduced paths that already exist in the live stack
as unowned local files before the first live mutation; the synced .env and
fresh-stack creation stay exempt.
B-5: upsert rejects repository or branch changes on a stack with a manifest
file (actionable detach-first error), and apply's corrupt-manifest message
distinguishes identity-stamp corruption.
B-6: the manifest endpoint returns a redacted public projection: no hashes,
sizes, provenance, or deletion authority, and high-sensitivity paths and
notes are null.
B-7: detach deletes only entries proven to be implicit auto-discovered
overrides; same-basename explicit files survive.
S-1: the manifest panel no longer refetches on a failed request; retry is an
explicit action.
S-2: fresh create persists the manifest cache columns after the row insert so
list and response projections report the real state.
S-3: git-sources.mdx matches the corrected detach, submodule, and dynamic-path
behavior.
* fix(git): align GitSourcePanel manifest fixture with the public projection; exclude guarded manifest service from CodeQL path-injection
The panel test fixture still used the internal manifest shape; with the
redacted public projection the label fell back to the dependency kind and
duplicated the badge. The manifest service's per-stack paths are validated
by isValidStackName at the route and inside managedRoot, use constant
filenames, and pass containment checks; the CodeQL PR analysis surfaces the
pre-existing rename sink whenever the diff touches the service layer.
* fix(git): restore ComposeService.ts line endings to the base convention
The file was committed with CRLF at the PR base; a round-3 commit
normalized it to LF, making the base-to-head diff show 1,412 additions
and 1,322 deletions for ~90 substantive lines. Restoring CRLF collapses
the diff to the functional changes only.
* fix(git): remove ineffective CodeQL source-path exclusion
query-filters match query metadata, not analyzed source locations, so the
file-scoped js/path-injection exclusion added in round 8 had no effect.
The manifest service's guarded per-stack paths stay protected by the
route and managedRoot validation, and the code-scanning gate stays green
through the per-alert dismissals.
* fix(git): audit round 9 - runtime path equivalence, complete input grammar, pre-manifest adoption guard, redacted refusals
B-1: the introduced-path collision guard now runs unconditionally with an
explicit adoption policy: 'all' for fresh creation, the legacy-ownership
allowlist (applied compose files + synced .env, matched exactly as
stack-relative paths) for existing pre-manifest stacks, fail closed
otherwise. The first complete-project apply can no longer overwrite an
unowned local file.
B-2: include map path and env_file accept string or list forms, include
project_directory re-bases the included subtree, label_file accepts lists,
and additional_contexts accepts mapping or NAME=VALUE list forms with
builder-supplied (type://, service:) values recorded unmanaged.
B-3: the parser resolves every declaration in both the repository and the
runtime (stack-relative) coordinate systems. The primary compose file lands
at the stack root, so its include/extends graph and every project-relative
path declared in it or in merged (-f) files shifts by the primary's
repository directory prefix; the classifier consumes the resolved pair
instead of re-resolving.
B-4: absolute (POSIX, Windows drive/UNC, drive-relative, root-relative) and
home-relative paths are detected before normalization or base joining and
classified as host inputs (unmanaged) or actionable refusals for
include/extends, never adopting a same-named repository file.
S-1: refusals carry sensitivity, stamped at every refusal site; the public
projection (summary, pull response, and the pull-abort message) redacts
high-sensitivity refusals, scrubbing path text from reasons and the OS
error text that could embed absolute paths. Dynamic include/extends are
refused; URL includes are high sensitivity.
S-3: ComposeService.ts line endings restored (separate commit).
S-2: invalid CodeQL source-path filter removed (separate commit).
* chore: bump nanoid to 3.3.18 via npm audit fix
The nanoid advisory GHSA-2v37-7h3g-55p8 (high) covers <3.3.17 and was
published after the last green CI run; both lockfiles pinned 3.3.16.
npm audit fix bumps the transitive dependency to 3.3.18.
* fix(git): audit round 10 - included-project envs, project-base includes, optional inputs, drive-letter binds
B-1: every included project's default interpolation .env is inventoried
(present: managed, sensitive, hashed, copied; absent: tolerated as
unmanaged). interpolation: false and same-base includes skip the entry.
B-2: include, include-env, and extends.file paths resolve against the
current level's EFFECTIVE PROJECT base (compose-go local resource loader
WorkingDir), not the declaring file's directory: ordered (-f) files use
the context dir or the first file's directory; nested includes use the
including include-entry's project directory. Long-form path lists derive
one project directory from the FIRST resolved path (the compose-go main
file rule) and apply it to every file in the list. Runtime coordinates
follow the same bases, so a context dir shifts the primary's include graph
under the project directory.
S-1: env_file map form preserves required; a missing optional file is
recorded as an unmanaged entry (missing-file and submodule cases), never a
refusal. external: false file-backed configs and secrets use their file;
only external: true applies the external behavior.
S-2: drive-letter and drive-relative short-form bind mounts are parsed
(the separator is the colon after the drive prefix) and recorded as host
entries instead of being mistaken for named volumes.
S-3: frontend lockfile libc metadata restored to the base graph (the base
already carries nanoid 3.3.18).
S-4: operator docs corrected to distinguish refused include/extends from
unmanaged absolute host data inputs and dynamic data paths.
* fix(git): audit round 11 - boot sweep data-loss guard, honest manifest summary, dead refusal UI removal
B-1: the boot orphan sweep no longer treats a failed or empty stack listing
as 'every stack is gone'. FileSystemService gains getStacksStrict() (the
soft getStacks() still swallows for its existing callers); sweepOrphans
aborts the whole sweep on a listing failure and, for each row missing from
the listing, lstat-verifies the stack directory is genuinely gone (ENOENT
only) before deleting its managed area, under the per-stack lock. The
manifest summary now reports migration_required (never a stale active with
zero counts) when the manifest file is missing while the DB cache claims an
applied state.
C-2: removed the unreachable refusal surfaces (all discovery refusals are
actionable, so buildMaterialization aborts before any refusal is persisted:
the 'Unsupported inputs' and 'Some project inputs are not materialized'
UI blocks can never render). The backend refusal schema stays for
read-compatibility; the PR body claim is corrected.
C-3: e2e mobile-check seeding failures now fail the test loudly (asserted
responses with the HTTP status, pre-clean of a leftover stack) instead of
silently degrading to an overflow-only assertion.
* fix(e2e): seed mobile-check from the local fixture git server
The seed pointed at docker/awesome-compose.git with compose_paths
['compose.yaml'], but that repository has no root compose.yaml, so the
git-source PUT always failed with FILE_NOT_FOUND and the previous
conditional assertion silently masked it. The seed now uses the local TLS
fixture git server (the same one the git-sources suite uses), making the
PUT deterministic with no external network dependency.
* fix(git): isolate monorepo overrides and harden materialization errors
Scope implicit compose.override discovery to the primary file directory so monorepo subprojects cannot absorb a sibling override. Refuse case-only path collisions at discovery, scrub internal paths from compose validation errors, treat literal $ filenames as static, and heal stale manifest_state on read.
This commit is contained in:
Anso
@@ -139,6 +139,12 @@ SENCHO_MESH_PROXY_TUNNEL_IDLE_MS=0
|
||||
# you track compose files in a legitimately large repository. Default
|
||||
# 104857600 (100 MB).
|
||||
GITSOURCE_MAX_CLONE_BYTES=104857600
|
||||
# Complete-project materialization bounds (Git Sources)
|
||||
GITSOURCE_MAX_MATERIALIZED_FILES=10000
|
||||
GITSOURCE_MAX_MATERIALIZED_BYTES=536870912
|
||||
GITSOURCE_MAX_BUILD_CONTEXT_BYTES=268435456
|
||||
GITSOURCE_MAX_PATH_DEPTH=64
|
||||
GITSOURCE_MAX_FILE_BYTES=10485760
|
||||
|
||||
# Idle-output backstop for deploy and update compose steps (pull/recreate). If a
|
||||
# step produces no output for this long while still running, Sencho treats it as
|
||||
|
||||
@@ -203,6 +203,12 @@ jobs:
|
||||
uses: ./.github/actions/start-app
|
||||
with:
|
||||
skip-backend-build: 'true'
|
||||
env:
|
||||
# The git-sources E2E specs exercise the complete-project materializer
|
||||
# against a local TLS fixture repo (e2e/fixtures); the backend must
|
||||
# trust its dev-only CA to clone over https://. Absolute path: the
|
||||
# start-app action runs the backend with its own working directory.
|
||||
NODE_EXTRA_CA_CERTS: ${{ github.workspace }}/e2e/fixtures/git-ca.pem
|
||||
|
||||
- name: Run E2E tests
|
||||
# `--project=chromium` is explicit because playwright.config.ts also
|
||||
|
||||
@@ -247,7 +247,7 @@ describe('GET /api/stacks/statuses caching', () => {
|
||||
// The git-link test seeds a 'web' source row; drop it even when that
|
||||
// test fails mid-way so later tests never see it. Delete is a no-op when
|
||||
// the row is absent.
|
||||
GitSourceService.getInstance().delete('web');
|
||||
DatabaseService.getInstance().deleteGitSource('web');
|
||||
});
|
||||
|
||||
it('serves repeat calls from cache without re-invoking the filesystem', async () => {
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,454 @@
|
||||
import { describe, it, expect } from 'vitest';
|
||||
import { isDynamicPath, parseDeclaredInputs } from '../helpers/composeInputParse';
|
||||
import type { DeclaredInput, DynamicInput } from '../types/gitProjectManifest';
|
||||
|
||||
/** In-memory repo fixture: maps repo paths to contents. */
|
||||
function repo(files: Record<string, string>) {
|
||||
return {
|
||||
read: (p: string): string | null => files[p] ?? null,
|
||||
files,
|
||||
};
|
||||
}
|
||||
|
||||
function parse(files: Record<string, string>, projectRoot: string | null = null) {
|
||||
const r = repo(files);
|
||||
const primary = Object.keys(files).find((p) => p.endsWith('compose.yaml') || p === 'compose.yml') ?? 'compose.yaml';
|
||||
return {
|
||||
result: parseDeclaredInputs([{ path: primary, content: files[primary] ?? '' }], {
|
||||
projectRoot,
|
||||
read: r.read,
|
||||
}),
|
||||
files: r.files,
|
||||
};
|
||||
}
|
||||
|
||||
function byKind(result: ReturnType<typeof parse>['result'], kind: string): DeclaredInput[] {
|
||||
return result.inputs.filter((i) => i.kind === kind);
|
||||
}
|
||||
|
||||
describe('parseDeclaredInputs', () => {
|
||||
it('emits the interpolation env at the project root', () => {
|
||||
const { result } = parse({ 'compose.yaml': 'services:\n web:\n image: nginx\n' });
|
||||
const interp = byKind(result, 'interpolation-env');
|
||||
expect(interp).toHaveLength(1);
|
||||
expect(interp[0].sourcePath).toBe('.env');
|
||||
expect(interp[0].baseDir).toBe('project-root');
|
||||
});
|
||||
|
||||
it('uses the project root for the interpolation env path', () => {
|
||||
const { result } = parse({ 'deploy/compose.yaml': 'services: {}\n' }, 'deploy');
|
||||
const interp = byKind(result, 'interpolation-env');
|
||||
expect(interp[0].sourcePath).toBe('deploy/.env');
|
||||
});
|
||||
|
||||
it('walks include list form and recurses into included files', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': 'include:\n - common/redis.yaml\nservices:\n web:\n image: nginx\n',
|
||||
// Included files resolve their relative paths against their own
|
||||
// directory (each included file is its own project).
|
||||
'common/redis.yaml': 'services:\n redis:\n image: redis\n env_file: redis.env\n',
|
||||
});
|
||||
const includes = byKind(result, 'include');
|
||||
expect(includes.map((i) => i.sourcePath)).toEqual(['common/redis.yaml']);
|
||||
const envFiles = byKind(result, 'env_file');
|
||||
expect(envFiles.map((e) => e.sourcePath)).toContain('common/redis.env');
|
||||
expect(envFiles.find((e) => e.sourcePath === 'common/redis.env')?.baseDir).toBe('compose-file-dir');
|
||||
});
|
||||
|
||||
it('walks include map form with include-specific env_file', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': 'include:\n - path: apps/api.yaml\n env_file: apps/api.env\n',
|
||||
'apps/api.yaml': 'services:\n api:\n image: api\n',
|
||||
});
|
||||
expect(byKind(result, 'include')[0].sourcePath).toBe('apps/api.yaml');
|
||||
const includeEnv = byKind(result, 'include-env');
|
||||
expect(includeEnv).toHaveLength(1);
|
||||
expect(includeEnv[0].sourcePath).toBe('apps/api.env');
|
||||
// Already resolved by the parser; the classifier must not re-resolve it.
|
||||
expect(includeEnv[0].baseDir).toBe('repo-root');
|
||||
});
|
||||
|
||||
it('detects include cycles', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': 'include:\n - a.yaml\n',
|
||||
'a.yaml': 'include:\n - compose.yaml\nservices: {}\n',
|
||||
});
|
||||
expect(result.parseErrors.some((e) => e.includes('cycle'))).toBe(true);
|
||||
});
|
||||
|
||||
it('reports unreadable include targets as parse errors', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': 'include:\n - missing.yaml\n',
|
||||
});
|
||||
expect(result.parseErrors.some((e) => e.includes('missing.yaml'))).toBe(true);
|
||||
});
|
||||
|
||||
it('walks extends.file recursion and reports cycles', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': 'services:\n web:\n extends:\n file: base/web.yaml\n service: web-base\n',
|
||||
// Included files resolve their own relative paths against their
|
||||
// own directory (each included file is its own project).
|
||||
'base/web.yaml': 'services:\n web-base:\n image: nginx\n label_file: labels.txt\n',
|
||||
});
|
||||
const extendsRefs = byKind(result, 'extends');
|
||||
expect(extendsRefs.map((e) => e.sourcePath)).toEqual(['base/web.yaml']);
|
||||
expect(byKind(result, 'label_file')[0].sourcePath).toBe('base/labels.txt');
|
||||
});
|
||||
|
||||
it('does not recurse into same-file string-form extends', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': 'services:\n web:\n extends: base\n base:\n image: nginx\n',
|
||||
});
|
||||
expect(byKind(result, 'extends')).toHaveLength(0);
|
||||
});
|
||||
|
||||
it('walks service env_file in string, list and map forms', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `services:
|
||||
a:
|
||||
image: a
|
||||
env_file: a.env
|
||||
b:
|
||||
image: b
|
||||
env_file:
|
||||
- shared.env
|
||||
- b.env
|
||||
c:
|
||||
image: c
|
||||
env_file:
|
||||
path: c.env
|
||||
required: true
|
||||
`,
|
||||
});
|
||||
const envFiles = byKind(result, 'env_file');
|
||||
expect(envFiles.map((e) => e.sourcePath).sort()).toEqual(['a.env', 'b.env', 'c.env', 'shared.env'].sort());
|
||||
});
|
||||
|
||||
it('classifies top-level configs and secrets file forms', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `configs:
|
||||
nginx-conf:
|
||||
file: nginx/nginx.conf
|
||||
ext:
|
||||
external: true
|
||||
env-injected:
|
||||
environment: NGNIX_CONFIG
|
||||
secrets:
|
||||
db-password:
|
||||
file: secrets/db.env
|
||||
sops-secret:
|
||||
environment: DB_PASSWORD
|
||||
services:
|
||||
web:
|
||||
image: nginx
|
||||
configs: [nginx-conf]
|
||||
secrets: [db-password]
|
||||
`,
|
||||
});
|
||||
const configs = byKind(result, 'config');
|
||||
expect(configs.map((c) => c.sourcePath)).toContain('nginx/nginx.conf');
|
||||
const secrets = byKind(result, 'secret');
|
||||
expect(secrets.map((s) => s.sourcePath)).toContain('secrets/db.env');
|
||||
// external/env forms become unmanaged placeholders (null source).
|
||||
expect(configs.filter((c) => c.sourcePath === null)).toHaveLength(2);
|
||||
expect(secrets.filter((s) => s.sourcePath === null)).toHaveLength(1);
|
||||
});
|
||||
|
||||
it('walks build context, dockerfile, secrets and additional contexts', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `secrets:
|
||||
ssh-key:
|
||||
file: web/ssh-key
|
||||
services:
|
||||
web:
|
||||
build:
|
||||
context: web
|
||||
dockerfile: Dockerfile.dev
|
||||
secrets:
|
||||
- npm-token
|
||||
- id: ssh-key
|
||||
source: ssh-key
|
||||
additional_contexts:
|
||||
certs: web/certs
|
||||
`,
|
||||
});
|
||||
const contexts = byKind(result, 'build-context');
|
||||
expect(contexts.map((c) => c.sourcePath)).toEqual(['web']);
|
||||
expect(byKind(result, 'dockerfile')[0].sourcePath).toBe('Dockerfile.dev');
|
||||
// String-form and long-syntax (source = top-level secret name) build
|
||||
// secrets are both recorded as unmanaged references; the top-level
|
||||
// secrets walk emits the actual file.
|
||||
const buildSecrets = byKind(result, 'build-secret');
|
||||
expect(buildSecrets.map((s) => s.sourcePath)).toEqual([null, null]);
|
||||
expect(byKind(result, 'secret').map((s) => s.sourcePath)).toContain('web/ssh-key');
|
||||
expect(byKind(result, 'build-additional-context')[0].sourcePath).toBe('web/certs');
|
||||
});
|
||||
|
||||
it('defaults an omitted build context to the project directory', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': 'services:\n web:\n build:\n dockerfile: Dockerfile\n',
|
||||
});
|
||||
const contexts = byKind(result, 'build-context');
|
||||
expect(contexts.map((c) => c.sourcePath)).toEqual(['.']);
|
||||
// The classifier resolves '.' against the per-file project directory
|
||||
// (context dir, base file dir, or the declaring file's own dir).
|
||||
expect(contexts[0].baseDir).toBe('compose-file-dir');
|
||||
});
|
||||
|
||||
it('never treats a build-secret source as a file path', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `secrets:
|
||||
build-key:
|
||||
external: true
|
||||
services:
|
||||
web:
|
||||
build:
|
||||
context: web
|
||||
secrets:
|
||||
- id: build-key
|
||||
source: build-key
|
||||
`,
|
||||
});
|
||||
// The secret name must not be searched as a file in the repository.
|
||||
const buildSecrets = byKind(result, 'build-secret');
|
||||
expect(buildSecrets.map((s) => s.sourcePath)).toEqual([null]);
|
||||
// The referenced (external) top-level secret is recorded unmanaged.
|
||||
expect(byKind(result, 'secret').some((s) => s.sourcePath === null)).toBe(true);
|
||||
});
|
||||
|
||||
it('walks string-form build context', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': 'services:\n web:\n build: web\n',
|
||||
});
|
||||
expect(byKind(result, 'build-context')[0].sourcePath).toBe('web');
|
||||
});
|
||||
|
||||
it('classifies bind mounts: relative, absolute and named volumes', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `services:
|
||||
web:
|
||||
image: nginx
|
||||
volumes:
|
||||
- ./data:/data
|
||||
- ../shared:/shared
|
||||
- /etc/hosts:/etc/hosts:ro
|
||||
- ~/cache:/cache
|
||||
- named-vol:/vol
|
||||
- type: bind
|
||||
source: ./config
|
||||
target: /config
|
||||
- type: volume
|
||||
source: other-vol
|
||||
target: /other
|
||||
`,
|
||||
});
|
||||
const binds = byKind(result, 'bind-mount');
|
||||
// Relative binds resolve against the project base; absolute and
|
||||
// ../-escaping binds are host paths (never adopted from the repo).
|
||||
expect(binds.map((b) => b.sourcePath)).toEqual(['data', '../shared', null, null, 'config']);
|
||||
expect(binds.map((b) => b.baseDir)).toEqual(['project-root', 'host', 'host', 'host', 'project-root']);
|
||||
expect(binds.map((b) => b.materializedPath)).toEqual(['data', null, null, null, 'config']);
|
||||
});
|
||||
|
||||
it('routes dynamic paths into the dynamic list, not inputs', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `services:
|
||||
web:
|
||||
image: nginx
|
||||
env_file: \${ENV_FILE:-default.env}
|
||||
`,
|
||||
});
|
||||
expect(byKind(result, 'env_file')).toHaveLength(0);
|
||||
const dynamic = result.dynamic as DynamicInput[];
|
||||
expect(dynamic.some((d) => d.kind === 'env_file' && d.sourcePath.includes('${ENV_FILE'))).toBe(true);
|
||||
});
|
||||
|
||||
it('records out-of-bound and URL include targets for the classifier', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `include:
|
||||
- ../outside.yaml
|
||||
- https://example.com/remote.yaml
|
||||
`,
|
||||
});
|
||||
const includes = byKind(result, 'include');
|
||||
expect(includes.map((i) => i.sourcePath)).toEqual(['../outside.yaml', 'https://example.com/remote.yaml']);
|
||||
});
|
||||
|
||||
it('enforces the include depth cap', () => {
|
||||
const files: Record<string, string> = {};
|
||||
files['compose.yaml'] = 'include:\n - f1.yaml\nservices: {}\n';
|
||||
for (let i = 1; i < 19; i++) {
|
||||
files[`f${i}.yaml`] = `include:\n - f${i + 1}.yaml\nservices: {}\n`;
|
||||
}
|
||||
files['f19.yaml'] = 'services: {}\n';
|
||||
const { result } = parse(files);
|
||||
expect(result.parseErrors.some((e) => e.includes('depth 16'))).toBe(true);
|
||||
});
|
||||
|
||||
it('reports unparseable compose files as parse errors', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': 'services: [unclosed\n',
|
||||
});
|
||||
expect(result.parseErrors.some((e) => e.includes('Cannot parse'))).toBe(true);
|
||||
});
|
||||
|
||||
it('walks label_file in string and list forms', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `services:
|
||||
a:
|
||||
image: a
|
||||
label_file: a.labels
|
||||
b:
|
||||
image: b
|
||||
label_file:
|
||||
- b1.labels
|
||||
- b2.labels
|
||||
`,
|
||||
});
|
||||
const labelFiles = byKind(result, 'label_file');
|
||||
expect(labelFiles.map((l) => l.sourcePath).sort()).toEqual(['a.labels', 'b1.labels', 'b2.labels'].sort());
|
||||
});
|
||||
|
||||
it('walks additional_contexts in mapping and NAME=VALUE list forms', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `services:
|
||||
a:
|
||||
build:
|
||||
context: web
|
||||
additional_contexts:
|
||||
certs: web/certs
|
||||
b:
|
||||
build:
|
||||
context: web
|
||||
additional_contexts:
|
||||
- resources=web/resources
|
||||
- app=docker-image://my-app:latest
|
||||
- base=service:base
|
||||
`,
|
||||
});
|
||||
const contexts = byKind(result, 'build-additional-context');
|
||||
// Path values resolve project-relative; builder-supplied values are
|
||||
// recorded unmanaged (host) and never searched for in the repo.
|
||||
const pathValues = contexts.filter((c) => c.baseDir !== 'host');
|
||||
expect(pathValues.map((c) => c.sourcePath).sort()).toEqual(['web/certs', 'web/resources'].sort());
|
||||
const builderValues = contexts.filter((c) => c.baseDir === 'host');
|
||||
expect(builderValues.map((c) => c.sourcePath).sort()).toEqual(['docker-image://my-app:latest', 'service:base'].sort());
|
||||
});
|
||||
|
||||
it('walks include map path and env_file in list forms', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `include:
|
||||
- path:
|
||||
- a.yaml
|
||||
- b.yaml
|
||||
env_file:
|
||||
- a.env
|
||||
- b.env
|
||||
services: {}
|
||||
`,
|
||||
'a.yaml': 'services: {}\n',
|
||||
'b.yaml': 'services: {}\n',
|
||||
});
|
||||
const includes = byKind(result, 'include');
|
||||
expect(includes.map((i) => i.sourcePath).sort()).toEqual(['a.yaml', 'b.yaml'].sort());
|
||||
const includeEnv = byKind(result, 'include-env');
|
||||
expect(includeEnv.map((e) => e.sourcePath).sort()).toEqual(['a.env', 'b.env'].sort());
|
||||
});
|
||||
|
||||
it('applies include project_directory to the included subtree', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': 'include:\n - path: app/compose.yaml\n project_directory: app\nservices: {}\n',
|
||||
'app/compose.yaml': 'services:\n web:\n image: nginx\n env_file: x.env\n',
|
||||
});
|
||||
// The included file's project-relative paths resolve against the
|
||||
// included project_directory ('app'), not its own directory.
|
||||
const envFiles = byKind(result, 'env_file');
|
||||
expect(envFiles.map((e) => e.sourcePath)).toEqual(['app/x.env']);
|
||||
});
|
||||
|
||||
it('parses Windows drive-letter short-form bind mounts (audit round 10 S-2)', () => {
|
||||
// Plain YAML scalars keep backslashes literally (no escape processing).
|
||||
const { result } = parse({
|
||||
'compose.yaml': `services:
|
||||
web:
|
||||
image: nginx
|
||||
volumes:
|
||||
- C:\\data:/data
|
||||
- C:creds:/creds
|
||||
- \\\\server\\share:/share
|
||||
- ./data:/data
|
||||
- named-vol:/vol
|
||||
- C:\\data:/data:ro
|
||||
`,
|
||||
});
|
||||
const binds = byKind(result, 'bind-mount');
|
||||
// Drive-letter, drive-relative, and UNC short binds are recorded as
|
||||
// host entries (sourcePath null per the host-bind convention) instead
|
||||
// of being mistaken for named volumes and dropped; ./data resolves
|
||||
// project-relative; named-vol is not a bind.
|
||||
expect(binds).toHaveLength(5);
|
||||
expect(binds.map((b) => b.baseDir)).toEqual(['host', 'host', 'host', 'project-root', 'host']);
|
||||
expect(binds.find((b) => b.kind === 'bind-mount' && b.materializedPath === 'data')?.sourcePath).toBe('data');
|
||||
});
|
||||
|
||||
it('preserves env_file required: false and required: true (audit round 10 S-1)', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `services:
|
||||
web:
|
||||
image: nginx
|
||||
env_file:
|
||||
- path: optional.env
|
||||
required: false
|
||||
- required.env
|
||||
`,
|
||||
});
|
||||
const envFiles = byKind(result, 'env_file');
|
||||
expect(envFiles.find((e) => e.sourcePath === 'optional.env')?.required).toBe(false);
|
||||
expect(envFiles.find((e) => e.sourcePath === 'required.env')?.required).toBe(true);
|
||||
});
|
||||
|
||||
it('classifies absolute and home-relative paths as host paths', () => {
|
||||
const { result } = parse({
|
||||
'compose.yaml': `include:
|
||||
- /etc/compose/extra.yaml
|
||||
services:
|
||||
web:
|
||||
image: nginx
|
||||
env_file: /etc/secrets/web.env
|
||||
configs: [cfg]
|
||||
label_file: ~/labels.txt
|
||||
configs:
|
||||
cfg:
|
||||
file: C:\\\\config\\\\app.conf
|
||||
`,
|
||||
});
|
||||
const includes = byKind(result, 'include');
|
||||
expect(includes[0].sourcePath).toBe('/etc/compose/extra.yaml');
|
||||
expect(includes[0].baseDir).toBe('host');
|
||||
const envFile = byKind(result, 'env_file')[0];
|
||||
expect(envFile.baseDir).toBe('host');
|
||||
expect(envFile.materializedPath).toBeNull();
|
||||
const cfg = byKind(result, 'config')[0];
|
||||
// Plain YAML scalars do not process escapes, so the parsed value
|
||||
// carries the double backslashes as written.
|
||||
expect(cfg.sourcePath).toBe('C:\\\\config\\\\app.conf');
|
||||
expect(cfg.baseDir).toBe('host');
|
||||
const labelFile = byKind(result, 'label_file')[0];
|
||||
expect(labelFile.baseDir).toBe('host');
|
||||
});
|
||||
});
|
||||
|
||||
describe('isDynamicPath', () => {
|
||||
it('treats Compose variable forms as dynamic', () => {
|
||||
expect(isDynamicPath('${ENV_FILE}')).toBe(true);
|
||||
expect(isDynamicPath('${ENV_FILE:-default.env}')).toBe(true);
|
||||
expect(isDynamicPath('$ENV_FILE')).toBe(true);
|
||||
expect(isDynamicPath('prefix-$ENV_FILE')).toBe(true);
|
||||
});
|
||||
|
||||
it('treats a literal $ that is not a variable start as static', () => {
|
||||
expect(isDynamicPath('config$.env')).toBe(false);
|
||||
expect(isDynamicPath('file$.yaml')).toBe(false);
|
||||
expect(isDynamicPath('plain.env')).toBe(false);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,97 @@
|
||||
import { describe, it, expect } from 'vitest';
|
||||
import { compileDockerIgnore } from '../utils/dockerIgnoreMatch';
|
||||
|
||||
function matches(lines: string[], path: string, isDir = false): boolean {
|
||||
return compileDockerIgnore(lines).matches(path, isDir);
|
||||
}
|
||||
|
||||
describe('compileDockerIgnore', () => {
|
||||
it('ignores empty lines and comment lines', () => {
|
||||
const m = compileDockerIgnore(['', ' ', '# comment', '*']);
|
||||
expect(m.matches('anything.txt')).toBe(true);
|
||||
});
|
||||
|
||||
it('star matches everything including dotfiles', () => {
|
||||
expect(matches(['*'], 'compose.yaml')).toBe(true);
|
||||
expect(matches(['*'], '.env')).toBe(true);
|
||||
expect(matches(['*'], 'a/b/c.txt')).toBe(true);
|
||||
});
|
||||
|
||||
it('slash-less patterns match basenames at any depth', () => {
|
||||
expect(matches(['*.md'], 'README.md')).toBe(true);
|
||||
expect(matches(['*.md'], 'docs/README.md')).toBe(true);
|
||||
expect(matches(['*.md'], 'docs/nested/README.md')).toBe(true);
|
||||
expect(matches(['*.md'], 'notes.txt')).toBe(false);
|
||||
expect(matches(['foo'], 'foo')).toBe(true);
|
||||
expect(matches(['foo'], 'a/foo')).toBe(true);
|
||||
expect(matches(['foo'], 'foobar')).toBe(false);
|
||||
});
|
||||
|
||||
it('slash-bearing patterns are anchored to the context root', () => {
|
||||
expect(matches(['/foo'], 'foo')).toBe(true);
|
||||
expect(matches(['/foo'], 'sub/foo')).toBe(false);
|
||||
expect(matches(['a/b'], 'a/b')).toBe(true);
|
||||
expect(matches(['a/b'], 'x/a/b')).toBe(false);
|
||||
});
|
||||
|
||||
it('trailing slash restricts to directories', () => {
|
||||
expect(matches(['build/'], 'build', true)).toBe(true);
|
||||
expect(matches(['build/'], 'build')).toBe(false);
|
||||
expect(matches(['build/'], 'sub/build', true)).toBe(true);
|
||||
expect(matches(['build/'], 'build/output.txt')).toBe(false);
|
||||
});
|
||||
|
||||
it('double-star crosses directories', () => {
|
||||
expect(matches(['**/logs'], 'logs')).toBe(true);
|
||||
expect(matches(['**/logs'], 'a/logs')).toBe(true);
|
||||
expect(matches(['**/logs'], 'a/b/logs')).toBe(true);
|
||||
expect(matches(['**/logs'], 'a/b/log.txt')).toBe(false);
|
||||
expect(matches(['a/**/z'], 'a/z')).toBe(true);
|
||||
expect(matches(['a/**/z'], 'a/b/c/z')).toBe(true);
|
||||
});
|
||||
|
||||
it('single star does not cross directory boundaries', () => {
|
||||
expect(matches(['a/*.log'], 'a/x.log')).toBe(true);
|
||||
expect(matches(['a/*.log'], 'a/b/x.log')).toBe(false);
|
||||
});
|
||||
|
||||
it('question mark matches exactly one character', () => {
|
||||
expect(matches(['temp?'], 'temp1')).toBe(true);
|
||||
expect(matches(['temp?'], 'temp10')).toBe(false);
|
||||
});
|
||||
|
||||
it('character classes match within a segment', () => {
|
||||
expect(matches(['[ab].txt'], 'a.txt')).toBe(true);
|
||||
expect(matches(['[ab].txt'], 'b.txt')).toBe(true);
|
||||
expect(matches(['[ab].txt'], 'c.txt')).toBe(false);
|
||||
});
|
||||
|
||||
it('last matching pattern wins, negation re-includes at any depth', () => {
|
||||
expect(matches(['*.md', '!README.md'], 'README.md')).toBe(false);
|
||||
expect(matches(['*.md', '!README.md'], 'docs/README.md')).toBe(false);
|
||||
expect(matches(['!README.md', '*.md'], 'README.md')).toBe(true);
|
||||
expect(matches(['*', '!keep'], 'keep')).toBe(false);
|
||||
expect(matches(['*', '!keep'], 'other')).toBe(true);
|
||||
});
|
||||
|
||||
it('escaped hash starts a literal pattern, bare hash is a comment', () => {
|
||||
expect(matches(['\\#file'], '#file')).toBe(true);
|
||||
expect(matches(['\\#file'], 'other')).toBe(false);
|
||||
expect(matches(['#file'], '#file')).toBe(false);
|
||||
});
|
||||
|
||||
it('bare negation is a no-op', () => {
|
||||
expect(matches(['!'], 'anything')).toBe(false);
|
||||
});
|
||||
|
||||
it('directory matches prune via the caller: dir check on the dir path', () => {
|
||||
// The matcher reports a matched directory as ignored (isDir is only
|
||||
// consulted for dir-only patterns); the CALLER prunes the subtree, so
|
||||
// children are never queried individually.
|
||||
expect(matches(['node_modules'], 'node_modules', true)).toBe(true);
|
||||
expect(matches(['node_modules'], 'node_modules')).toBe(true);
|
||||
// A file that merely lives under a matched directory is not itself
|
||||
// matched by the basename pattern; the caller's prune handles it.
|
||||
expect(matches(['node_modules'], 'pkg/index.js')).toBe(false);
|
||||
});
|
||||
});
|
||||
File diff suppressed because it is too large
Load Diff
@@ -18,6 +18,7 @@ import fs from 'fs';
|
||||
import path from 'path';
|
||||
import { setupTestDb, cleanupTestDb, TEST_USERNAME, TEST_JWT_SECRET } from './helpers/setupTestDb';
|
||||
import { DatabaseService } from '../services/DatabaseService';
|
||||
import { ComposeService } from '../services/ComposeService';
|
||||
import { GitSourceService } from '../services/GitSourceService';
|
||||
|
||||
// ── Hoisted mocks (must come before importing the app) ─────────────────
|
||||
@@ -299,6 +300,49 @@ describe('GET /api/stacks/:stackName/git-source', () => {
|
||||
expect(res.body.repo_url).toBe('https://github.com/example/repo.git');
|
||||
expect(res.body.linked).toBeUndefined();
|
||||
});
|
||||
|
||||
it('redacts high-sensitivity refusal paths from the summary projection (audit round 9 S-1)', async () => {
|
||||
const composeDir = process.env.COMPOSE_DIR!;
|
||||
fs.mkdirSync(path.join(composeDir, 'linked-redacted'), { recursive: true });
|
||||
fs.writeFileSync(path.join(composeDir, 'linked-redacted', 'compose.yaml'), 'services:\n x:\n image: nginx\n');
|
||||
seedGitSource('linked-redacted');
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const svc = GitProjectManifestService.getInstance();
|
||||
const manifest = svc.buildManifest({
|
||||
stackName: 'linked-redacted',
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
commitSha: 'abc123',
|
||||
projectRoot: null,
|
||||
composeFiles: ['compose.yaml'],
|
||||
projectName: 'linked-redacted',
|
||||
invocation: ['-f', 'compose.yaml', '-p', 'linked-redacted'],
|
||||
inputs: [],
|
||||
refusals: [
|
||||
{ sourcePath: 'secrets/db.env', kind: 'missing-file', reason: 'File not found in repository: secrets/db.env', actionable: true, sensitivity: 'high' },
|
||||
{ sourcePath: 'compose.yaml', kind: 'missing-file', reason: 'File not found in repository: compose.yaml', actionable: true, sensitivity: 'medium' },
|
||||
],
|
||||
buildContexts: [],
|
||||
bounds: { maxFiles: 10_000, maxBytes: 512 * 1024 * 1024, maxContextBytes: 256 * 1024 * 1024, maxPathDepth: 64, maxFileBytes: 10 * 1024 * 1024 },
|
||||
priorManifest: null,
|
||||
state: 'partial',
|
||||
});
|
||||
await svc.writeManifest('linked-redacted', manifest);
|
||||
|
||||
const res = await request(app)
|
||||
.get('/api/stacks/linked-redacted/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
const serialized = JSON.stringify(res.body);
|
||||
expect(serialized).not.toContain('secrets/db.env');
|
||||
const high = res.body.manifest.refused.find(
|
||||
(r: { kind: string; sourcePath: string | null; reason: string }) => r.kind === 'missing-file' && r.sourcePath === null,
|
||||
) as { reason: string } | undefined;
|
||||
expect(high).toBeTruthy();
|
||||
expect(high?.reason).toContain('[redacted]');
|
||||
// Non-sensitive refusals keep their actionable path.
|
||||
expect(res.body.manifest.refused.some((r: { sourcePath: string }) => r.sourcePath === 'compose.yaml')).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe('PUT /api/stacks/:stackName/git-source: multi-file selection', () => {
|
||||
@@ -503,35 +547,414 @@ describe('POST /api/stacks/:stackName/git-source/webhook-pull status codes', ()
|
||||
});
|
||||
});
|
||||
|
||||
describe('DELETE /api/stacks/:stackName/git-source — multi-file unlink guard', () => {
|
||||
it('blocks unlinking a multi-file source with 409 and keeps the row', async () => {
|
||||
describe('DELETE /api/stacks/:stackName/git-source, detach/export contract', () => {
|
||||
function mockRender(yaml: string | null): ReturnType<typeof vi.spyOn> {
|
||||
// ComposeService.getInstance() returns a fresh instance per call, so
|
||||
// the spy must live on the prototype to reach the route's instance.
|
||||
return vi
|
||||
.spyOn(ComposeService.prototype, 'renderComposeYaml')
|
||||
.mockImplementation(() => (yaml === null ? Promise.reject(new Error('docker unavailable')) : Promise.resolve(yaml)));
|
||||
}
|
||||
|
||||
it('exports a multi-file source: renders, writes compose.yaml, removes the row', async () => {
|
||||
seedGitSource('mf-unlink');
|
||||
DatabaseService.getInstance().setGitSourceAppliedSpec('mf-unlink', { files: ['compose.yaml', 'infra/prod.yml'], contextDir: null });
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/mf-unlink/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(409);
|
||||
expect(res.body.error).toMatch(/multiple compose files/i);
|
||||
expect(DatabaseService.getInstance().getGitSource('mf-unlink')).toBeTruthy();
|
||||
const stackDir = path.join(process.env.COMPOSE_DIR!, 'mf-unlink');
|
||||
fs.mkdirSync(stackDir, { recursive: true });
|
||||
fs.writeFileSync(path.join(stackDir, 'compose.yaml'), 'services:\n web:\n image: nginx\n');
|
||||
const render = mockRender('services:\n web:\n image: nginx\n environment:\n A: b\n');
|
||||
try {
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/mf-unlink/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
expect(DatabaseService.getInstance().getGitSource('mf-unlink')).toBeUndefined();
|
||||
const exported = fs.readFileSync(path.join(stackDir, 'compose.yaml'), 'utf8');
|
||||
expect(exported).toContain('A: b');
|
||||
expect(render).toHaveBeenCalled();
|
||||
} finally {
|
||||
render.mockRestore();
|
||||
}
|
||||
});
|
||||
|
||||
it('blocks unlinking a context-dir source with 409', async () => {
|
||||
it('returns 409 and keeps the row when the export render fails', async () => {
|
||||
seedGitSource('ctx-unlink');
|
||||
DatabaseService.getInstance().setGitSourceAppliedSpec('ctx-unlink', { files: ['compose.yaml'], contextDir: 'app' });
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/ctx-unlink/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(409);
|
||||
expect(DatabaseService.getInstance().getGitSource('ctx-unlink')).toBeTruthy();
|
||||
const render = mockRender(null);
|
||||
try {
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/ctx-unlink/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(409);
|
||||
expect(DatabaseService.getInstance().getGitSource('ctx-unlink')).toBeTruthy();
|
||||
} finally {
|
||||
render.mockRestore();
|
||||
}
|
||||
});
|
||||
|
||||
it('removes auto-discovered override files so the flattened model is final', async () => {
|
||||
seedGitSource('ov-unlink');
|
||||
const stackDir = path.join(process.env.COMPOSE_DIR!, 'ov-unlink');
|
||||
fs.mkdirSync(stackDir, { recursive: true });
|
||||
fs.writeFileSync(path.join(stackDir, 'compose.yaml'), 'services:\n web:\n image: nginx\n');
|
||||
fs.writeFileSync(path.join(stackDir, 'compose.override.yaml'), 'services:\n web:\n environment:\n A: b\n');
|
||||
// The managed override file is recorded in the manifest so detach can
|
||||
// find it; write a manifest entry for it directly.
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const svc = GitProjectManifestService.getInstance();
|
||||
const manifest = svc.buildManifest({
|
||||
stackName: 'ov-unlink',
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
commitSha: 'abc',
|
||||
projectRoot: null,
|
||||
composeFiles: ['compose.yaml'],
|
||||
projectName: 'ov-unlink',
|
||||
invocation: ['-f', 'compose.yaml', '-p', 'ov-unlink'],
|
||||
inputs: [
|
||||
{
|
||||
sourcePath: 'compose.yaml', materializedPath: 'compose.yaml', role: 'compose-primary', dependencyKind: 'explicit',
|
||||
ownership: 'managed', provenance: 'fetch', sensitivity: 'medium', contentSha256: null, sizeBytes: 10,
|
||||
state: 'present', deletionAuthority: 'sencho', note: null,
|
||||
},
|
||||
{
|
||||
sourcePath: 'compose.override.yaml', materializedPath: 'compose.override.yaml', role: 'compose-override', dependencyKind: 'implicit-override',
|
||||
ownership: 'managed', provenance: 'fetch', sensitivity: 'medium', contentSha256: null, sizeBytes: 10,
|
||||
state: 'present', deletionAuthority: 'sencho', note: null,
|
||||
},
|
||||
],
|
||||
refusals: [],
|
||||
buildContexts: [],
|
||||
bounds: { maxFiles: 10_000, maxBytes: 512 * 1024 * 1024, maxContextBytes: 256 * 1024 * 1024, maxPathDepth: 64, maxFileBytes: 10 * 1024 * 1024 },
|
||||
priorManifest: null,
|
||||
state: 'active',
|
||||
});
|
||||
await svc.writeManifest('ov-unlink', manifest);
|
||||
const render = mockRender('services:\n web:\n image: nginx\n environment:\n A: b\n');
|
||||
try {
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/ov-unlink/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
// The flattened model is final: the override file is gone, so plain
|
||||
// docker compose cannot re-merge it.
|
||||
expect(fs.existsSync(path.join(stackDir, 'compose.override.yaml'))).toBe(false);
|
||||
expect(DatabaseService.getInstance().getGitSource('ov-unlink')).toBeUndefined();
|
||||
expect(render).toHaveBeenCalled();
|
||||
} finally {
|
||||
render.mockRestore();
|
||||
}
|
||||
});
|
||||
|
||||
it('keeps an explicitly selected file named compose.override.yaml during detach (audit round 8 B-7)', async () => {
|
||||
seedGitSource('explicit-override-name');
|
||||
const stackDir = path.join(process.env.COMPOSE_DIR!, 'explicit-override-name');
|
||||
fs.mkdirSync(stackDir, { recursive: true });
|
||||
fs.writeFileSync(path.join(stackDir, 'compose.yaml'), 'services:\n web:\n image: nginx\n');
|
||||
fs.writeFileSync(path.join(stackDir, 'compose.override.yaml'), 'services:\n web:\n environment:\n A: b\n');
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const svc = GitProjectManifestService.getInstance();
|
||||
const manifest = svc.buildManifest({
|
||||
stackName: 'explicit-override-name',
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
commitSha: 'abc',
|
||||
projectRoot: null,
|
||||
composeFiles: ['compose.yaml', 'compose.override.yaml'],
|
||||
projectName: 'explicit-override-name',
|
||||
invocation: ['-f', 'compose.yaml', '-f', 'compose.override.yaml', '-p', 'explicit-override-name'],
|
||||
inputs: [
|
||||
{
|
||||
sourcePath: 'compose.yaml', materializedPath: 'compose.yaml', role: 'compose-primary', dependencyKind: 'explicit',
|
||||
ownership: 'managed', provenance: 'fetch', sensitivity: 'medium', contentSha256: null, sizeBytes: 10,
|
||||
state: 'present', deletionAuthority: 'sencho', note: null,
|
||||
},
|
||||
{
|
||||
// Same basename, but an EXPLICIT -f input, not an
|
||||
// auto-discovered override.
|
||||
sourcePath: 'compose.override.yaml', materializedPath: 'compose.override.yaml', role: 'compose-additional', dependencyKind: 'explicit',
|
||||
ownership: 'managed', provenance: 'fetch', sensitivity: 'medium', contentSha256: null, sizeBytes: 10,
|
||||
state: 'present', deletionAuthority: 'sencho', note: null,
|
||||
},
|
||||
],
|
||||
refusals: [],
|
||||
buildContexts: [],
|
||||
bounds: { maxFiles: 10_000, maxBytes: 512 * 1024 * 1024, maxContextBytes: 256 * 1024 * 1024, maxPathDepth: 64, maxFileBytes: 10 * 1024 * 1024 },
|
||||
priorManifest: null,
|
||||
state: 'active',
|
||||
});
|
||||
await svc.writeManifest('explicit-override-name', manifest);
|
||||
const render = mockRender('services:\n web:\n image: nginx\n environment:\n A: b\n');
|
||||
try {
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/explicit-override-name/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
// The explicit file is part of the rendered model; detach keeps it.
|
||||
expect(fs.existsSync(path.join(stackDir, 'compose.override.yaml'))).toBe(true);
|
||||
expect(DatabaseService.getInstance().getGitSource('explicit-override-name')).toBeUndefined();
|
||||
} finally {
|
||||
render.mockRestore();
|
||||
}
|
||||
});
|
||||
|
||||
it('allows unlinking a single-file source', async () => {
|
||||
seedGitSource('sf-unlink');
|
||||
const stackDir = path.join(process.env.COMPOSE_DIR!, 'sf-unlink');
|
||||
fs.mkdirSync(stackDir, { recursive: true });
|
||||
fs.writeFileSync(path.join(stackDir, 'compose.yaml'), 'services:\n web:\n image: nginx\n');
|
||||
const render = mockRender('services:\n web:\n image: nginx\n');
|
||||
try {
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/sf-unlink/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
expect(DatabaseService.getInstance().getGitSource('sf-unlink')).toBeUndefined();
|
||||
} finally {
|
||||
render.mockRestore();
|
||||
}
|
||||
});
|
||||
|
||||
it('reaps staged managed data after detach cleanup is deferred', async () => {
|
||||
seedGitSource('deferred-cleanup');
|
||||
const stackDir = path.join(process.env.COMPOSE_DIR!, 'deferred-cleanup');
|
||||
fs.mkdirSync(stackDir, { recursive: true });
|
||||
fs.writeFileSync(path.join(stackDir, 'compose.yaml'), 'services:\n web:\n image: nginx\n');
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const manifestSvc = GitProjectManifestService.getInstance();
|
||||
const finalizeSpy = vi.spyOn(manifestSvc, 'finalizeStagedDetach').mockResolvedValueOnce(false);
|
||||
const render = mockRender('services:\n web:\n image: nginx\n');
|
||||
const staged = path.join(process.env.DATA_DIR!, 'git-managed', '1', '.detach-deferred-cleanup');
|
||||
try {
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/deferred-cleanup/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
expect(DatabaseService.getInstance().getGitSource('deferred-cleanup')).toBeUndefined();
|
||||
expect(fs.existsSync(staged)).toBe(true);
|
||||
|
||||
await GitSourceService.getInstance().sweepOrphans();
|
||||
expect(fs.existsSync(staged)).toBe(false);
|
||||
} finally {
|
||||
finalizeSpy.mockRestore();
|
||||
render.mockRestore();
|
||||
}
|
||||
});
|
||||
|
||||
it('restores files and managed data when the database commit fails', async () => {
|
||||
seedGitSource('db-fail-unlink');
|
||||
const stackDir = path.join(process.env.COMPOSE_DIR!, 'db-fail-unlink');
|
||||
fs.mkdirSync(stackDir, { recursive: true });
|
||||
const original = `${'#'.repeat((2 * 1024 * 1024) + 1)}\nservices:\n web:\n image: nginx:old\n`;
|
||||
const originalOverride = Buffer.from('services:\n web:\n environment:\n LABEL: café\n', 'utf8');
|
||||
fs.writeFileSync(path.join(stackDir, 'compose.yaml'), original);
|
||||
fs.writeFileSync(path.join(stackDir, 'compose.override.yaml'), originalOverride);
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const svc = GitProjectManifestService.getInstance();
|
||||
const manifest = svc.buildManifest({
|
||||
stackName: 'db-fail-unlink',
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
commitSha: 'abc',
|
||||
projectRoot: null,
|
||||
composeFiles: ['compose.yaml'],
|
||||
projectName: 'db-fail-unlink',
|
||||
invocation: ['-f', 'compose.yaml', '-p', 'db-fail-unlink'],
|
||||
inputs: [
|
||||
{
|
||||
sourcePath: 'compose.yaml', materializedPath: 'compose.yaml', role: 'compose-primary', dependencyKind: 'explicit',
|
||||
ownership: 'managed', provenance: 'fetch', sensitivity: 'medium', contentSha256: null, sizeBytes: original.length,
|
||||
state: 'present', deletionAuthority: 'sencho', note: null,
|
||||
},
|
||||
{
|
||||
sourcePath: 'compose.override.yaml', materializedPath: 'compose.override.yaml', role: 'compose-override', dependencyKind: 'implicit-override',
|
||||
ownership: 'managed', provenance: 'fetch', sensitivity: 'medium', contentSha256: null, sizeBytes: originalOverride.length,
|
||||
state: 'present', deletionAuthority: 'sencho', note: null,
|
||||
},
|
||||
],
|
||||
refusals: [],
|
||||
buildContexts: [],
|
||||
bounds: { maxFiles: 10_000, maxBytes: 512 * 1024 * 1024, maxContextBytes: 256 * 1024 * 1024, maxPathDepth: 64, maxFileBytes: 10 * 1024 * 1024 },
|
||||
priorManifest: null,
|
||||
state: 'active',
|
||||
});
|
||||
await svc.writeManifest('db-fail-unlink', manifest);
|
||||
const render = mockRender('services:\n web:\n image: nginx:new\n');
|
||||
const deleteSpy = vi.spyOn(DatabaseService.getInstance(), 'deleteGitSource').mockImplementationOnce(() => {
|
||||
throw new Error('database unavailable');
|
||||
});
|
||||
try {
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/db-fail-unlink/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(400);
|
||||
expect(DatabaseService.getInstance().getGitSource('db-fail-unlink')).toBeTruthy();
|
||||
expect(fs.readFileSync(path.join(stackDir, 'compose.yaml'), 'utf8')).toBe(original);
|
||||
expect(fs.readFileSync(path.join(stackDir, 'compose.override.yaml')).equals(originalOverride)).toBe(true);
|
||||
const restored = await svc.readManifest('db-fail-unlink', 'https://github.com/example/repo.git', 'main');
|
||||
expect(restored).not.toBeNull();
|
||||
expect(fs.existsSync(path.join(process.env.DATA_DIR!, 'git-managed', '1', '.detach-db-fail-unlink'))).toBe(false);
|
||||
} finally {
|
||||
deleteSpy.mockRestore();
|
||||
render.mockRestore();
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe('GET /api/stacks/:stackName/git-source/manifest', () => {
|
||||
it('returns the manifest for a stack that has one', async () => {
|
||||
seedGitSource('manifest-get');
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const svc = GitProjectManifestService.getInstance();
|
||||
const manifest = svc.buildManifest({
|
||||
stackName: 'manifest-get',
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
commitSha: 'abc123',
|
||||
projectRoot: null,
|
||||
composeFiles: ['compose.yaml'],
|
||||
projectName: 'manifest-get',
|
||||
invocation: ['-f', 'compose.yaml', '-p', 'manifest-get'],
|
||||
inputs: [],
|
||||
refusals: [],
|
||||
buildContexts: [],
|
||||
bounds: { maxFiles: 10_000, maxBytes: 512 * 1024 * 1024, maxContextBytes: 256 * 1024 * 1024, maxPathDepth: 64, maxFileBytes: 10 * 1024 * 1024 },
|
||||
priorManifest: null,
|
||||
state: 'active',
|
||||
});
|
||||
await svc.writeManifest('manifest-get', manifest);
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/sf-unlink/git-source')
|
||||
.get('/api/stacks/manifest-get/git-source/manifest')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
expect(DatabaseService.getInstance().getGitSource('sf-unlink')).toBeUndefined();
|
||||
expect(res.body.manifest.manifestVersion).toBe(1);
|
||||
expect(res.body.manifest.resolvedCommitSha).toBe('abc123');
|
||||
});
|
||||
|
||||
it('redacts sensitive input paths and omits internal metadata (audit round 8 B-6)', async () => {
|
||||
seedGitSource('manifest-redact');
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const svc = GitProjectManifestService.getInstance();
|
||||
const manifest = svc.buildManifest({
|
||||
stackName: 'manifest-redact',
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
commitSha: 'abc123',
|
||||
projectRoot: null,
|
||||
composeFiles: ['compose.yaml'],
|
||||
projectName: 'manifest-redact',
|
||||
invocation: ['-f', 'compose.yaml', '-p', 'manifest-redact'],
|
||||
inputs: [
|
||||
{
|
||||
sourcePath: 'compose.yaml',
|
||||
materializedPath: 'compose.yaml',
|
||||
role: 'compose-primary',
|
||||
dependencyKind: 'explicit',
|
||||
ownership: 'managed',
|
||||
provenance: 'fetch',
|
||||
sensitivity: 'medium',
|
||||
contentSha256: 'a'.repeat(64),
|
||||
sizeBytes: 120,
|
||||
state: 'present',
|
||||
deletionAuthority: 'sencho',
|
||||
note: null,
|
||||
},
|
||||
{
|
||||
sourcePath: 'secrets/db.env',
|
||||
materializedPath: 'secrets/db.env',
|
||||
role: 'env',
|
||||
dependencyKind: 'env_file',
|
||||
ownership: 'managed',
|
||||
provenance: 'fetch',
|
||||
sensitivity: 'high',
|
||||
contentSha256: 'b'.repeat(64),
|
||||
sizeBytes: 40,
|
||||
state: 'present',
|
||||
deletionAuthority: 'sencho',
|
||||
note: null,
|
||||
},
|
||||
{
|
||||
sourcePath: 'configs/app.conf',
|
||||
materializedPath: 'configs/app.conf',
|
||||
role: 'config',
|
||||
dependencyKind: 'config',
|
||||
ownership: 'managed',
|
||||
provenance: 'fetch',
|
||||
sensitivity: 'high',
|
||||
contentSha256: 'c'.repeat(64),
|
||||
sizeBytes: 200,
|
||||
state: 'present',
|
||||
deletionAuthority: 'sencho',
|
||||
note: null,
|
||||
},
|
||||
{
|
||||
sourcePath: 'keys/jwt.pem',
|
||||
materializedPath: 'keys/jwt.pem',
|
||||
role: 'secret',
|
||||
dependencyKind: 'secret',
|
||||
ownership: 'managed',
|
||||
provenance: 'fetch',
|
||||
sensitivity: 'high',
|
||||
contentSha256: 'd'.repeat(64),
|
||||
sizeBytes: 50,
|
||||
state: 'present',
|
||||
deletionAuthority: 'sencho',
|
||||
note: 'File-backed secret materialized from keys/jwt.pem',
|
||||
},
|
||||
],
|
||||
refusals: [],
|
||||
buildContexts: [],
|
||||
bounds: { maxFiles: 10_000, maxBytes: 512 * 1024 * 1024, maxContextBytes: 256 * 1024 * 1024, maxPathDepth: 64, maxFileBytes: 10 * 1024 * 1024 },
|
||||
priorManifest: null,
|
||||
state: 'active',
|
||||
});
|
||||
await svc.writeManifest('manifest-redact', manifest);
|
||||
|
||||
const res = await request(app)
|
||||
.get('/api/stacks/manifest-redact/git-source/manifest')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
|
||||
// The medium-sensitivity compose input keeps its path...
|
||||
const compose = res.body.manifest.inputs.find((i: { dependencyKind: string }) => i.dependencyKind === 'explicit');
|
||||
expect(compose.path).toBe('compose.yaml');
|
||||
// ...and high-sensitivity env/config inputs have their paths redacted.
|
||||
const env = res.body.manifest.inputs.find((i: { dependencyKind: string }) => i.dependencyKind === 'env_file');
|
||||
expect(env.path).toBeNull();
|
||||
const cfg = res.body.manifest.inputs.find((i: { dependencyKind: string }) => i.dependencyKind === 'config');
|
||||
expect(cfg.path).toBeNull();
|
||||
|
||||
// Internal metadata never crosses the API.
|
||||
const serialized = JSON.stringify(res.body);
|
||||
expect(serialized).not.toContain('contentSha256');
|
||||
expect(serialized).not.toContain('sizeBytes');
|
||||
expect(serialized).not.toContain('sourcePath');
|
||||
expect(serialized).not.toContain('materializedPath');
|
||||
expect(serialized).not.toContain('deletionAuthority');
|
||||
expect(serialized).not.toContain('provenance');
|
||||
expect(serialized).not.toContain('secrets/db.env');
|
||||
expect(serialized).not.toContain('configs/app.conf');
|
||||
// A path-bearing note on a high-sensitivity entry must not leak either.
|
||||
expect(serialized).not.toContain('keys/jwt.pem');
|
||||
// The redacted projection still counts the entries.
|
||||
expect(res.body.manifest.inputs).toHaveLength(4);
|
||||
});
|
||||
|
||||
it('returns 404 when no manifest exists', async () => {
|
||||
seedGitSource('manifest-missing');
|
||||
const res = await request(app)
|
||||
.get('/api/stacks/manifest-missing/git-source/manifest')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(404);
|
||||
});
|
||||
|
||||
it('denies without the stack:read permission', async () => {
|
||||
seedGitSource('manifest-denied');
|
||||
const res = await request(app)
|
||||
.get('/api/stacks/manifest-denied/git-source/manifest')
|
||||
.set('Authorization', `Bearer ${jwt.sign({ username: 'viewer', role: 'viewer' }, TEST_JWT_SECRET, { expiresIn: '1m' })}`);
|
||||
// viewer lacks stack:read for this stack
|
||||
expect([401, 403]).toContain(res.status);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -550,6 +973,82 @@ describe('GET /api/git-sources', () => {
|
||||
});
|
||||
});
|
||||
|
||||
describe('stack_git_sources manifest cache columns', () => {
|
||||
const MANIFEST_STATES = [
|
||||
'none',
|
||||
'migrated',
|
||||
'active',
|
||||
'partial',
|
||||
'unsupported',
|
||||
'migration_required',
|
||||
'absent',
|
||||
] as const;
|
||||
|
||||
it('round-trips every GitSourceManifestState enum member', () => {
|
||||
const db = DatabaseService.getInstance();
|
||||
for (const state of MANIFEST_STATES) {
|
||||
seedGitSource(`manifest-state-${state}`);
|
||||
db.setGitSourceManifestState(`manifest-state-${state}`, 7, state, 'generations/applied-abc');
|
||||
const row = db.getGitSource(`manifest-state-${state}`)!;
|
||||
expect(row.manifest_version).toBe(7);
|
||||
expect(row.manifest_state).toBe(state);
|
||||
expect(row.manifest_generation).toBe('generations/applied-abc');
|
||||
db.deleteGitSource(`manifest-state-${state}`);
|
||||
}
|
||||
});
|
||||
|
||||
it('reads nulls for rows written before the columns existed', () => {
|
||||
const row = DatabaseService.getInstance().getGitSource('missing-manifest-row');
|
||||
expect(row).toBeUndefined();
|
||||
});
|
||||
|
||||
it('upsert does not clobber the manifest cache columns', () => {
|
||||
const db = DatabaseService.getInstance();
|
||||
seedGitSource('manifest-preserved');
|
||||
db.setGitSourceManifestState('manifest-preserved', 3, 'active', 'generations/applied-x');
|
||||
db.upsertGitSource({
|
||||
stack_name: 'manifest-preserved',
|
||||
repo_url: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
compose_path: 'compose.yaml',
|
||||
compose_paths: ['compose.yaml'],
|
||||
context_dir: null,
|
||||
sync_env: false,
|
||||
env_path: null,
|
||||
auth_type: 'none',
|
||||
encrypted_token: null,
|
||||
auto_apply_on_webhook: false,
|
||||
auto_deploy_on_apply: false,
|
||||
last_applied_commit_sha: null,
|
||||
last_applied_content_hash: null,
|
||||
pending_commit_sha: null,
|
||||
pending_compose_content: null,
|
||||
pending_env_content: null,
|
||||
pending_fetched_at: null,
|
||||
last_debounce_at: null,
|
||||
});
|
||||
const row = db.getGitSource('manifest-preserved')!;
|
||||
expect(row.manifest_version).toBe(3);
|
||||
expect(row.manifest_state).toBe('active');
|
||||
expect(row.manifest_generation).toBe('generations/applied-x');
|
||||
});
|
||||
|
||||
it('GET keeps flat manifest_state aligned with the healed summary', async () => {
|
||||
const composeDir = process.env.COMPOSE_DIR!;
|
||||
fs.mkdirSync(path.join(composeDir, 'stale-manifest-get'), { recursive: true });
|
||||
fs.writeFileSync(path.join(composeDir, 'stale-manifest-get', 'compose.yaml'), 'services:\n x:\n image: nginx\n');
|
||||
seedGitSource('stale-manifest-get');
|
||||
DatabaseService.getInstance().setGitSourceManifestState('stale-manifest-get', 3, 'active', 'generations/applied-abc-3');
|
||||
|
||||
const res = await request(app)
|
||||
.get('/api/stacks/stale-manifest-get/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.manifest?.state).toBe('migration_required');
|
||||
expect(res.body.manifest_state).toBe('migration_required');
|
||||
});
|
||||
});
|
||||
|
||||
describe('git-source routes: statuses-cache invalidation', () => {
|
||||
// The cached /stacks/statuses payload carries the source label, so link
|
||||
// and unlink must drop the cache; read-only routes must not.
|
||||
@@ -584,13 +1083,22 @@ describe('git-source routes: statuses-cache invalidation', () => {
|
||||
});
|
||||
|
||||
it('invalidates node caches when unlinking a Git source', async () => {
|
||||
seedStackDir('inv-unlink');
|
||||
seedGitSource('inv-unlink');
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/inv-unlink/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
expect(mockInvalidateNodeCaches).toHaveBeenCalledTimes(1);
|
||||
expect(mockInvalidateNodeCaches).toHaveBeenCalledWith(expect.any(Number));
|
||||
// Stub detach so the assertion stays at the route layer (export/render
|
||||
// belongs to the service tests); unlink must still drop the cache.
|
||||
const detachSpy = vi.spyOn(GitSourceService.getInstance(), 'detach')
|
||||
.mockResolvedValue(undefined);
|
||||
try {
|
||||
const res = await request(app)
|
||||
.delete('/api/stacks/inv-unlink/git-source')
|
||||
.set('Authorization', `Bearer ${adminToken()}`);
|
||||
expect(res.status).toBe(200);
|
||||
expect(mockInvalidateNodeCaches).toHaveBeenCalledTimes(1);
|
||||
expect(mockInvalidateNodeCaches).toHaveBeenCalledWith(expect.any(Number));
|
||||
} finally {
|
||||
detachSpy.mockRestore();
|
||||
}
|
||||
});
|
||||
|
||||
it('does not invalidate on GET of the Git source', async () => {
|
||||
|
||||
@@ -13,6 +13,8 @@
|
||||
* - Per-stack mutex serialization ordering
|
||||
*/
|
||||
import crypto from 'crypto';
|
||||
import fs from 'fs';
|
||||
import path from 'path';
|
||||
import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
|
||||
import { setupTestDb, cleanupTestDb } from './helpers/setupTestDb';
|
||||
|
||||
@@ -217,6 +219,50 @@ describe('GitSourceService.validateCompose (YAML pre-check)', () => {
|
||||
expect(r.ok).toBe(false);
|
||||
expect(r.error).toMatch(/YAML parse error/i);
|
||||
});
|
||||
|
||||
it('scrubs absolute validation paths from docker compose stderr', async () => {
|
||||
const instance = svc();
|
||||
const leak =
|
||||
'open /app/data/git-managed/1/qa-refusal/generations/candidate-abc/case/config.yml: no such file or directory';
|
||||
const runSpy = vi.spyOn(
|
||||
instance as unknown as { runDockerCompose: (a: string[], c: string, t: number) => Promise<{ code: number; stdout: string; stderr: string }> },
|
||||
'runDockerCompose',
|
||||
).mockResolvedValue({ code: 1, stdout: '', stderr: leak });
|
||||
try {
|
||||
const r = await instance.validateCompose(asFiles('services:\n web:\n image: nginx\n'), null, null);
|
||||
expect(r.ok).toBe(false);
|
||||
expect(r.error).toBeDefined();
|
||||
expect(r.error).not.toContain('/app/data');
|
||||
expect(r.error).not.toContain('git-managed/1');
|
||||
expect(r.error).not.toContain('candidate-abc');
|
||||
expect(r.error).toContain('[managed-path]');
|
||||
} finally {
|
||||
runSpy.mockRestore();
|
||||
}
|
||||
});
|
||||
|
||||
it('does not corrupt unrelated paths when scrubbing a DATA_DIR prefix', async () => {
|
||||
const instance = svc();
|
||||
// Simulate a temp validation dir whose basename is a prefix of another
|
||||
// word in the message (data vs database). The scrubber must not turn
|
||||
// "database" into "base".
|
||||
const runSpy = vi.spyOn(
|
||||
instance as unknown as { runDockerCompose: (a: string[], c: string, t: number) => Promise<{ code: number; stdout: string; stderr: string }> },
|
||||
'runDockerCompose',
|
||||
).mockImplementation(async (_args, cwd) => ({
|
||||
code: 1,
|
||||
stdout: '',
|
||||
stderr: `open ${cwd}/compose.yaml: failed; see /var/lib/database/notes`,
|
||||
}));
|
||||
try {
|
||||
const r = await instance.validateCompose(asFiles('services:\n web:\n image: nginx\n'), null, null);
|
||||
expect(r.ok).toBe(false);
|
||||
expect(r.error).toContain('/var/lib/database/notes');
|
||||
expect(r.error).not.toMatch(/\/var\/lib\/base\/notes/);
|
||||
} finally {
|
||||
runSpy.mockRestore();
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe('GitSourceService.upsert (encryption + reachability)', () => {
|
||||
@@ -353,6 +399,138 @@ describe('GitSourceService.upsert (encryption + reachability)', () => {
|
||||
|
||||
expect(DatabaseService.getInstance().getGitSource('unreachable')).toBeUndefined();
|
||||
});
|
||||
|
||||
describe('repository identity changes on managed stacks (audit round 8 B-5)', () => {
|
||||
async function seedManifest(stackName: string, repoUrl = 'https://github.com/example/repo.git', branch = 'main') {
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const manifest = GitProjectManifestService.getInstance().buildManifest({
|
||||
stackName,
|
||||
repoUrl,
|
||||
branch,
|
||||
commitSha: 'abc123',
|
||||
projectRoot: null,
|
||||
composeFiles: ['compose.yaml'],
|
||||
projectName: stackName,
|
||||
invocation: ['-f', 'compose.yaml', '-p', stackName],
|
||||
inputs: [{
|
||||
sourcePath: 'compose.yaml',
|
||||
materializedPath: 'compose.yaml',
|
||||
role: 'compose-primary',
|
||||
dependencyKind: 'explicit',
|
||||
ownership: 'managed',
|
||||
provenance: 'fetch',
|
||||
sensitivity: 'medium',
|
||||
contentSha256: null,
|
||||
sizeBytes: null,
|
||||
state: 'present',
|
||||
deletionAuthority: 'sencho',
|
||||
note: null,
|
||||
}],
|
||||
refusals: [],
|
||||
buildContexts: [],
|
||||
bounds: {
|
||||
maxFiles: 10_000,
|
||||
maxBytes: 512 * 1024 * 1024,
|
||||
maxContextBytes: 256 * 1024 * 1024,
|
||||
maxPathDepth: 64,
|
||||
maxFileBytes: 10 * 1024 * 1024,
|
||||
},
|
||||
priorManifest: null,
|
||||
state: 'active',
|
||||
});
|
||||
await GitProjectManifestService.getInstance().writeManifest(stackName, manifest);
|
||||
}
|
||||
|
||||
const baseInput = {
|
||||
stackName: 'id-change',
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
composePaths: ['compose.yaml'],
|
||||
contextDir: null,
|
||||
syncEnv: false,
|
||||
envPath: null,
|
||||
authType: 'none' as const,
|
||||
autoApplyOnWebhook: false,
|
||||
autoDeployOnApply: false,
|
||||
};
|
||||
|
||||
async function seedSource(stackName: string) {
|
||||
mockSuccessfulClone();
|
||||
const svc = GitSourceService.getInstance();
|
||||
await svc.upsert({ ...baseInput, stackName });
|
||||
}
|
||||
|
||||
it('rejects a repository change when a managed-project manifest exists', async () => {
|
||||
await seedSource('id-change-repo');
|
||||
await seedManifest('id-change-repo');
|
||||
const svc = GitSourceService.getInstance();
|
||||
mockGitClone.mockClear();
|
||||
|
||||
await expect(svc.upsert({
|
||||
...baseInput,
|
||||
stackName: 'id-change-repo',
|
||||
repoUrl: 'https://github.com/example/other.git',
|
||||
})).rejects.toMatchObject({
|
||||
code: 'GIT_ERROR',
|
||||
message: expect.stringMatching(/Detach the Git source first/),
|
||||
});
|
||||
|
||||
// Nothing persisted, no dry-run fetch attempted.
|
||||
expect(DatabaseService.getInstance().getGitSource('id-change-repo')?.repo_url).toBe('https://github.com/example/repo.git');
|
||||
expect(mockGitClone).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('rejects a branch change when a managed-project manifest exists', async () => {
|
||||
await seedSource('id-change-branch');
|
||||
await seedManifest('id-change-branch');
|
||||
const svc = GitSourceService.getInstance();
|
||||
|
||||
await expect(svc.upsert({
|
||||
...baseInput,
|
||||
stackName: 'id-change-branch',
|
||||
branch: 'develop',
|
||||
})).rejects.toMatchObject({ code: 'GIT_ERROR', message: expect.stringMatching(/Detach the Git source first/) });
|
||||
expect(DatabaseService.getInstance().getGitSource('id-change-branch')?.branch).toBe('main');
|
||||
});
|
||||
|
||||
it('allows a repository change when no manifest exists (legacy stack)', async () => {
|
||||
await seedSource('id-change-legacy');
|
||||
const svc = GitSourceService.getInstance();
|
||||
|
||||
await svc.upsert({ ...baseInput, stackName: 'id-change-legacy', repoUrl: 'https://github.com/example/other.git' });
|
||||
expect(DatabaseService.getInstance().getGitSource('id-change-legacy')?.repo_url).toBe('https://github.com/example/other.git');
|
||||
});
|
||||
|
||||
it('allows non-identity config changes on a managed stack', async () => {
|
||||
await seedSource('id-change-paths');
|
||||
await seedManifest('id-change-paths');
|
||||
const svc = GitSourceService.getInstance();
|
||||
// The dry-run reachability fetch must find every configured file.
|
||||
mockSuccessfulClone({ extraFiles: { 'override.yaml': 'services: {}\n' } });
|
||||
|
||||
await svc.upsert({ ...baseInput, stackName: 'id-change-paths', composePaths: ['compose.yaml', 'override.yaml'] });
|
||||
const row = DatabaseService.getInstance().getGitSource('id-change-paths');
|
||||
expect(row?.compose_paths).toEqual(['compose.yaml', 'override.yaml']);
|
||||
});
|
||||
|
||||
it('apply refuses a stale-identity manifest with a detach-first instruction', async () => {
|
||||
const sha = 'abc1234567890abc1234567890abc1234567890a';
|
||||
await seedSource('id-change-apply');
|
||||
// Manifest stamped for a different repository than the source row.
|
||||
await seedManifest('id-change-apply', 'https://github.com/example/other.git', 'main');
|
||||
const svc = GitSourceService.getInstance();
|
||||
|
||||
mockSuccessfulClone({ sha });
|
||||
await svc.pull('id-change-apply');
|
||||
const validateSpy = vi.spyOn(svc, 'validateCompose').mockResolvedValue({ ok: true });
|
||||
try {
|
||||
await expect(svc.apply('id-change-apply', sha))
|
||||
.rejects.toMatchObject({ code: 'GIT_ERROR', message: expect.stringMatching(/Detach the Git source/) });
|
||||
} finally {
|
||||
validateSpy.mockRestore();
|
||||
}
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('GitSourceService error mapping', () => {
|
||||
@@ -705,14 +883,16 @@ describe('GitSourceService.handleWebhookPull debounce', () => {
|
||||
autoApplyOnWebhook: false,
|
||||
autoDeployOnApply: false,
|
||||
});
|
||||
// upsert runs a dry-run fetch but not validateCompose, so the stub only
|
||||
// affects the webhook pull below.
|
||||
const validateSpy = vi.spyOn(svc, 'validateCompose').mockResolvedValue({ ok: false, error: 'bad compose' });
|
||||
// Complete-project pulls validate the staged candidate via the docker
|
||||
// runner; stub it to fail so the webhook pull reports the error.
|
||||
const runSpy = vi
|
||||
.spyOn(svc as unknown as { runDockerCompose: (a: string[], c: string, t: number) => Promise<{ code: number; stdout: string; stderr: string }> }, 'runDockerCompose')
|
||||
.mockResolvedValue({ code: 1, stdout: '', stderr: 'bad compose' });
|
||||
|
||||
const result = await svc.handleWebhookPull('webhook-validate-fail');
|
||||
expect(result.status).toBe('error');
|
||||
expect(result.message).toMatch(/validation failed/i);
|
||||
validateSpy.mockRestore();
|
||||
runSpy.mockRestore();
|
||||
});
|
||||
});
|
||||
|
||||
@@ -931,6 +1111,18 @@ describe('GitSourceService.createStackFromGit', () => {
|
||||
expect(result.source.last_applied_commit_sha).toBe(sha);
|
||||
expect(result.source.pending_commit_sha).toBeNull();
|
||||
|
||||
// The manifest cache is persisted after the row insert (audit S-2):
|
||||
// the immediate response and the DB row report the real state, not
|
||||
// the default 'absent'.
|
||||
expect(result.source.manifest_state).toBe('active');
|
||||
const row = DatabaseService.getInstance().getGitSource('create-happy');
|
||||
expect(row?.manifest_state).toBe('active');
|
||||
expect(row?.manifest_version).toBe(1);
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const manifest = await GitProjectManifestService.getInstance().readManifest('create-happy', 'https://github.com/example/repo.git', 'main');
|
||||
if (manifest === null || 'corrupt' in manifest) throw new Error('expected a manifest');
|
||||
expect(manifest.resolvedRevision.commitSha).toBe(sha);
|
||||
|
||||
const { FileSystemService } = await import('../services/FileSystemService');
|
||||
const onDisk = await FileSystemService.getInstance().getStackContent('create-happy');
|
||||
expect(onDisk).toContain('image: nginx');
|
||||
@@ -1222,6 +1414,53 @@ describe('GitSourceService.apply', () => {
|
||||
}
|
||||
});
|
||||
|
||||
it('refuses the first complete-project apply when an unowned local file collides (audit round 9 B-1)', async () => {
|
||||
const sha = '9999aaaa9999aaaa9999aaaa9999aaaa9999aaaa';
|
||||
mockSuccessfulClone({
|
||||
compose: 'services:\n web:\n image: nginx\n configs: [app]\nconfigs:\n app:\n file: configs/app.json\n',
|
||||
extraFiles: { 'configs/app.json': '{"repo": true}\n' },
|
||||
sha,
|
||||
});
|
||||
const svc = GitSourceService.getInstance();
|
||||
const stackName = 'pre-manifest-collision';
|
||||
await svc.upsert({
|
||||
stackName,
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
composePaths: ['compose.yaml'],
|
||||
contextDir: null,
|
||||
syncEnv: false,
|
||||
envPath: null,
|
||||
authType: 'none',
|
||||
autoApplyOnWebhook: false,
|
||||
autoDeployOnApply: false,
|
||||
});
|
||||
// Legacy state: only compose.yaml was ever applied (no manifest).
|
||||
DatabaseService.getInstance().setGitSourceAppliedSpec(stackName, { files: ['compose.yaml'], contextDir: null });
|
||||
const { FileSystemService } = await import('../services/FileSystemService');
|
||||
const fsSvc = FileSystemService.getInstance();
|
||||
await fsSvc.createStack(stackName);
|
||||
await fsSvc.saveStackContent(stackName, 'services:\n web:\n image: nginx:old\n');
|
||||
// A local file Sencho never owned, colliding with the incoming revision.
|
||||
await fsSvc.writeStackFile(stackName, 'configs/app.json', 'local user data\n');
|
||||
|
||||
await svc.pull(stackName);
|
||||
const validateSpy = vi.spyOn(svc, 'validateCompose').mockResolvedValue({ ok: true });
|
||||
try {
|
||||
await expect(svc.apply(stackName, sha)).rejects.toMatchObject({
|
||||
code: 'GIT_ERROR',
|
||||
message: expect.stringMatching(/does not manage/),
|
||||
});
|
||||
// The local file is preserved byte-for-byte.
|
||||
const onDisk = await fsSvc.readStackFile(stackName, 'configs/app.json');
|
||||
expect(onDisk.content).toBe('local user data\n');
|
||||
expect(DatabaseService.getInstance().getGitSource(stackName)?.pending_commit_sha).toBe(sha);
|
||||
} finally {
|
||||
validateSpy.mockRestore();
|
||||
}
|
||||
await cleanupStackDir(stackName);
|
||||
});
|
||||
|
||||
it('returns deployError and skips compose deploy when policy blocks apply deploy', async () => {
|
||||
const sha = 'dddd444dddd444dddd444dddd444dddd444dddd4';
|
||||
const svc = await seedPending('apply-policy-block', 'services:\n x:\n image: nginx:bad\n', sha);
|
||||
@@ -1563,3 +1802,433 @@ describe('GitSourceService multi-file create + apply flow', () => {
|
||||
await cleanupStackDir('pending-config');
|
||||
});
|
||||
});
|
||||
|
||||
describe('GitSourceService pending blob decode branches', () => {
|
||||
function svc(): unknown { return GitSourceService.getInstance(); }
|
||||
type DecodeApi = {
|
||||
crypto: { encrypt(s: string): string; decrypt(s: string): string };
|
||||
encodePendingCompose(files: { path: string; content: string }[], ctx: string | null, cand: string | null, inv: unknown): string;
|
||||
decodePendingCompose(s: string): { files: { path: string; content: string }[]; contextDir: string | null; candidateRelPath: string | null; inventory: unknown };
|
||||
};
|
||||
|
||||
it('round-trips the v3 blob with candidate path and inventory', () => {
|
||||
const s = svc() as unknown as DecodeApi;
|
||||
const encoded = s.encodePendingCompose([{ path: 'compose.yaml', content: 'x' }], null, 'generations/candidate-abc', { inputs: [], refusals: [], buildContexts: [] });
|
||||
const decoded = s.decodePendingCompose(encoded);
|
||||
expect(decoded.candidateRelPath).toBe('generations/candidate-abc');
|
||||
expect(decoded.files[0].content).toBe('x');
|
||||
expect(decoded.inventory).toEqual({ inputs: [], refusals: [], buildContexts: [] });
|
||||
});
|
||||
|
||||
it('decodes a v2 blob without a candidate', () => {
|
||||
const s = svc() as unknown as DecodeApi;
|
||||
const encoded = s.crypto.encrypt(JSON.stringify({ v: 2, files: [{ path: 'compose.yaml', content: 'y' }], contextDir: null }));
|
||||
const decoded = s.decodePendingCompose(encoded);
|
||||
expect(decoded.candidateRelPath).toBeNull();
|
||||
expect(decoded.files[0].content).toBe('y');
|
||||
});
|
||||
|
||||
it('falls back to legacy plaintext for unknown shapes', () => {
|
||||
const s = svc() as unknown as DecodeApi;
|
||||
const decoded = s.decodePendingCompose(s.crypto.encrypt('legacy content'));
|
||||
expect(decoded.files).toEqual([{ path: 'compose.yaml', content: 'legacy content' }]);
|
||||
expect(decoded.candidateRelPath).toBeNull();
|
||||
});
|
||||
|
||||
it('rejects a corrupt v3 blob as corrupt state instead of falling back to legacy', () => {
|
||||
const s = svc() as unknown as DecodeApi;
|
||||
const encoded = s.crypto.encrypt('{"v":3 not json');
|
||||
expect(() => s.decodePendingCompose(encoded)).toThrow(/corrupt/);
|
||||
});
|
||||
});
|
||||
|
||||
describe('GitSourceService managed-area lifecycle', () => {
|
||||
it('removes the managed area when createStackFromGit fails after staging', async () => {
|
||||
const sha = 'f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1';
|
||||
mockSuccessfulClone({ sha });
|
||||
const svc = GitSourceService.getInstance();
|
||||
const runSpy = vi
|
||||
.spyOn(svc as unknown as { runDockerCompose: (a: string[], c: string, t: number) => Promise<{ code: number; stdout: string; stderr: string }> }, 'runDockerCompose')
|
||||
.mockResolvedValue({ code: 0, stdout: '', stderr: '' });
|
||||
const { FileSystemService } = await import('../services/FileSystemService');
|
||||
const createSpy = vi
|
||||
.spyOn(FileSystemService.prototype, 'createStack')
|
||||
.mockRejectedValue(new Error('simulated create failure'));
|
||||
try {
|
||||
await expect(
|
||||
svc.createStackFromGit({
|
||||
stackName: 'rollback-area',
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
composePaths: ['compose.yaml'],
|
||||
contextDir: null,
|
||||
syncEnv: false,
|
||||
envPath: null,
|
||||
authType: 'none',
|
||||
token: null,
|
||||
autoApplyOnWebhook: false,
|
||||
autoDeployOnApply: false,
|
||||
}),
|
||||
).rejects.toThrow(/simulated create failure/);
|
||||
} finally {
|
||||
runSpy.mockRestore();
|
||||
createSpy.mockRestore();
|
||||
}
|
||||
// The staged candidate lived in the managed area; the rollback must reap it.
|
||||
const stagedCandidate = path.join(process.env.DATA_DIR!, 'git-managed', '1', 'rollback-area', 'generations', 'candidate-f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1');
|
||||
expect(fs.existsSync(stagedCandidate)).toBe(false);
|
||||
expect(DatabaseService.getInstance().getGitSource('rollback-area')).toBeUndefined();
|
||||
});
|
||||
|
||||
it('sweeps managed areas whose stack no longer exists', async () => {
|
||||
mockSuccessfulClone();
|
||||
DatabaseService.getInstance().upsertGitSource({
|
||||
stack_name: 'ghost-stack',
|
||||
repo_url: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
compose_path: 'compose.yaml',
|
||||
compose_paths: ['compose.yaml'],
|
||||
context_dir: null,
|
||||
sync_env: false,
|
||||
env_path: null,
|
||||
auth_type: 'none',
|
||||
encrypted_token: null,
|
||||
auto_apply_on_webhook: false,
|
||||
auto_deploy_on_apply: false,
|
||||
last_applied_commit_sha: null,
|
||||
last_applied_content_hash: null,
|
||||
pending_commit_sha: null,
|
||||
pending_compose_content: null,
|
||||
pending_env_content: null,
|
||||
pending_fetched_at: null,
|
||||
last_debounce_at: null,
|
||||
});
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const manifestSvc = GitProjectManifestService.getInstance();
|
||||
const manifest = manifestSvc.buildManifest({
|
||||
stackName: 'ghost-stack',
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
commitSha: 'abc',
|
||||
projectRoot: null,
|
||||
composeFiles: ['compose.yaml'],
|
||||
projectName: 'ghost-stack',
|
||||
invocation: ['-f', 'compose.yaml', '-p', 'ghost-stack'],
|
||||
inputs: [],
|
||||
refusals: [],
|
||||
buildContexts: [],
|
||||
bounds: { maxFiles: 10_000, maxBytes: 512 * 1024 * 1024, maxContextBytes: 256 * 1024 * 1024, maxPathDepth: 64, maxFileBytes: 10 * 1024 * 1024 },
|
||||
priorManifest: null,
|
||||
state: 'active',
|
||||
});
|
||||
await manifestSvc.writeManifest('ghost-stack', manifest);
|
||||
await manifestSvc.prepareDetachRecovery(
|
||||
'ghost-stack',
|
||||
'https://github.com/example/repo.git',
|
||||
'main',
|
||||
[{ path: 'compose.yaml', existed: false, content: null }],
|
||||
);
|
||||
expect(await manifestSvc.stageManagedAreaForDetach('ghost-stack')).toBe(true);
|
||||
await GitSourceService.getInstance().sweepOrphans();
|
||||
expect(await manifestSvc.readManifest('ghost-stack', 'https://github.com/example/repo.git', 'main')).toBeNull();
|
||||
expect(fs.existsSync(path.join(process.env.DATA_DIR!, 'git-managed', '1', '.detach-ghost-stack'))).toBe(false);
|
||||
});
|
||||
|
||||
const SWEEP_BOUNDS = { maxFiles: 10_000, maxBytes: 512 * 1024 * 1024, maxContextBytes: 256 * 1024 * 1024, maxPathDepth: 64, maxFileBytes: 10 * 1024 * 1024 };
|
||||
|
||||
function insertGitSourceRow(stackName: string): void {
|
||||
DatabaseService.getInstance().upsertGitSource({
|
||||
stack_name: stackName,
|
||||
repo_url: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
compose_path: 'compose.yaml',
|
||||
compose_paths: ['compose.yaml'],
|
||||
context_dir: null,
|
||||
sync_env: false,
|
||||
env_path: null,
|
||||
auth_type: 'none',
|
||||
encrypted_token: null,
|
||||
auto_apply_on_webhook: false,
|
||||
auto_deploy_on_apply: false,
|
||||
last_applied_commit_sha: null,
|
||||
last_applied_content_hash: null,
|
||||
pending_commit_sha: null,
|
||||
pending_compose_content: null,
|
||||
pending_env_content: null,
|
||||
pending_fetched_at: null,
|
||||
last_debounce_at: null,
|
||||
});
|
||||
}
|
||||
|
||||
/** Live managed-stack fixture: on-disk stack, row, and written manifest. */
|
||||
async function seedManagedStack(stackName: string): Promise<void> {
|
||||
const { FileSystemService } = await import('../services/FileSystemService');
|
||||
await FileSystemService.getInstance().createStack(stackName);
|
||||
await FileSystemService.getInstance().saveStackContent(stackName, 'services: {}\n');
|
||||
insertGitSourceRow(stackName);
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const manifestSvc = GitProjectManifestService.getInstance();
|
||||
await manifestSvc.writeManifest(stackName, manifestSvc.buildManifest({
|
||||
stackName,
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
commitSha: 'abc',
|
||||
projectRoot: null,
|
||||
composeFiles: ['compose.yaml'],
|
||||
projectName: stackName,
|
||||
invocation: ['-f', 'compose.yaml', '-p', stackName],
|
||||
inputs: [],
|
||||
refusals: [],
|
||||
buildContexts: [],
|
||||
bounds: SWEEP_BOUNDS,
|
||||
priorManifest: null,
|
||||
state: 'active',
|
||||
}));
|
||||
}
|
||||
|
||||
it('does not delete managed areas when the stack listing fails', async () => {
|
||||
const { FileSystemService } = await import('../services/FileSystemService');
|
||||
const svc = GitSourceService.getInstance();
|
||||
const stackName = 'live-sweep-listing-fail';
|
||||
await seedManagedStack(stackName);
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const manifestSvc = GitProjectManifestService.getInstance();
|
||||
// A retained recovery generation, as the sweep would otherwise reap.
|
||||
const genDir = path.join(process.env.DATA_DIR!, 'git-managed', '1', stackName, 'generations', 'applied-abc-1');
|
||||
fs.mkdirSync(genDir, { recursive: true });
|
||||
|
||||
const strictSpy = vi.spyOn(FileSystemService.prototype, 'getStacksStrict').mockRejectedValue(new Error('EIO: readdir failed'));
|
||||
// Also mock the SOFT listing: the pre-fix sweep called getStacks(),
|
||||
// which swallows the failure into an empty list and deletes the area.
|
||||
// Post-fix the sweep uses the strict variant and is unaffected, so the
|
||||
// test goes red on the pre-fix call path and green here.
|
||||
const softSpy = vi.spyOn(FileSystemService.prototype, 'getStacks').mockRejectedValue(new Error('EIO: readdir failed'));
|
||||
try {
|
||||
await svc.sweepOrphans();
|
||||
} finally {
|
||||
strictSpy.mockRestore();
|
||||
softSpy.mockRestore();
|
||||
}
|
||||
// The manifest and every retained generation survive the failed listing.
|
||||
expect(await manifestSvc.readManifest(stackName, 'https://github.com/example/repo.git', 'main')).not.toBeNull();
|
||||
expect(fs.existsSync(genDir)).toBe(true);
|
||||
await cleanupStackDir(stackName);
|
||||
});
|
||||
|
||||
it('skips a live stack\'s managed area when the listing omits it', async () => {
|
||||
const { FileSystemService } = await import('../services/FileSystemService');
|
||||
const svc = GitSourceService.getInstance();
|
||||
const stackName = 'live-sweep-empty-listing';
|
||||
await seedManagedStack(stackName);
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const manifestSvc = GitProjectManifestService.getInstance();
|
||||
|
||||
const strictSpy = vi.spyOn(FileSystemService.prototype, 'getStacksStrict').mockResolvedValue([]);
|
||||
const softSpy = vi.spyOn(FileSystemService.prototype, 'getStacks').mockResolvedValue([]);
|
||||
try {
|
||||
await svc.sweepOrphans();
|
||||
} finally {
|
||||
strictSpy.mockRestore();
|
||||
softSpy.mockRestore();
|
||||
}
|
||||
expect(await manifestSvc.readManifest(stackName, 'https://github.com/example/repo.git', 'main')).not.toBeNull();
|
||||
await cleanupStackDir(stackName);
|
||||
});
|
||||
|
||||
it('reaps a vanished stack\'s managed area while live stacks survive in the same sweep', async () => {
|
||||
const svc = GitSourceService.getInstance();
|
||||
const { GitProjectManifestService } = await import('../services/GitProjectManifestService');
|
||||
const manifestSvc = GitProjectManifestService.getInstance();
|
||||
const liveA = 'live-sweep-a';
|
||||
const liveB = 'live-sweep-b';
|
||||
const ghost = 'vanished-sweep';
|
||||
for (const name of [liveA, liveB]) {
|
||||
await seedManagedStack(name);
|
||||
}
|
||||
// A row whose stack directory is genuinely gone: row + manifest only.
|
||||
insertGitSourceRow(ghost);
|
||||
await manifestSvc.writeManifest(ghost, manifestSvc.buildManifest({
|
||||
stackName: ghost,
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
commitSha: 'abc',
|
||||
projectRoot: null,
|
||||
composeFiles: ['compose.yaml'],
|
||||
projectName: ghost,
|
||||
invocation: ['-f', 'compose.yaml', '-p', ghost],
|
||||
inputs: [],
|
||||
refusals: [],
|
||||
buildContexts: [],
|
||||
bounds: SWEEP_BOUNDS,
|
||||
priorManifest: null,
|
||||
state: 'active',
|
||||
}));
|
||||
|
||||
await svc.sweepOrphans();
|
||||
|
||||
// Both live areas and manifests survive; the vanished stack's area is reaped.
|
||||
expect(await manifestSvc.readManifest(liveA, 'https://github.com/example/repo.git', 'main')).not.toBeNull();
|
||||
expect(await manifestSvc.readManifest(liveB, 'https://github.com/example/repo.git', 'main')).not.toBeNull();
|
||||
expect(await manifestSvc.readManifest(ghost, 'https://github.com/example/repo.git', 'main')).toBeNull();
|
||||
for (const name of [liveA, liveB]) {
|
||||
await cleanupStackDir(name);
|
||||
}
|
||||
});
|
||||
|
||||
it('reports migration_required when the manifest file is gone but the cache claims an applied state', async () => {
|
||||
const svc = GitSourceService.getInstance();
|
||||
DatabaseService.getInstance().upsertGitSource({
|
||||
stack_name: 'stale-cache-summary',
|
||||
repo_url: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
compose_path: 'compose.yaml',
|
||||
compose_paths: ['compose.yaml'],
|
||||
context_dir: null,
|
||||
sync_env: false,
|
||||
env_path: null,
|
||||
auth_type: 'none',
|
||||
encrypted_token: null,
|
||||
auto_apply_on_webhook: false,
|
||||
auto_deploy_on_apply: false,
|
||||
last_applied_commit_sha: null,
|
||||
last_applied_content_hash: null,
|
||||
pending_commit_sha: null,
|
||||
pending_compose_content: null,
|
||||
pending_env_content: null,
|
||||
pending_fetched_at: null,
|
||||
last_debounce_at: null,
|
||||
});
|
||||
DatabaseService.getInstance().setGitSourceManifestState('stale-cache-summary', 3, 'active', 'generations/applied-abc-3');
|
||||
const summary = await svc.getManifestSummary('stale-cache-summary');
|
||||
expect(summary?.state).toBe('migration_required');
|
||||
expect(summary?.manifestVersion).toBe(0);
|
||||
expect(summary?.managedCount).toBe(0);
|
||||
// Heal-on-read keeps the flat cache aligned with the summary.
|
||||
expect(DatabaseService.getInstance().getGitSource('stale-cache-summary')?.manifest_state).toBe('migration_required');
|
||||
expect(DatabaseService.getInstance().getGitSource('stale-cache-summary')?.manifest_version).toBeNull();
|
||||
|
||||
// A row that never had a manifest still reports absent.
|
||||
DatabaseService.getInstance().upsertGitSource({
|
||||
stack_name: 'never-manifested',
|
||||
repo_url: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
compose_path: 'compose.yaml',
|
||||
compose_paths: ['compose.yaml'],
|
||||
context_dir: null,
|
||||
sync_env: false,
|
||||
env_path: null,
|
||||
auth_type: 'none',
|
||||
encrypted_token: null,
|
||||
auto_apply_on_webhook: false,
|
||||
auto_deploy_on_apply: false,
|
||||
last_applied_commit_sha: null,
|
||||
last_applied_content_hash: null,
|
||||
pending_commit_sha: null,
|
||||
pending_compose_content: null,
|
||||
pending_env_content: null,
|
||||
pending_fetched_at: null,
|
||||
last_debounce_at: null,
|
||||
});
|
||||
expect((await svc.getManifestSummary('never-manifested'))?.state).toBe('absent');
|
||||
});
|
||||
});
|
||||
|
||||
describe('GitSourceService legacy pending apply (migration path)', () => {
|
||||
it('applies a v2 pending blob via the historical path and builds a migrated manifest', async () => {
|
||||
const sha = '9999aaa9999aaa9999aaa9999aaa9999aaa9999a';
|
||||
const svc = GitSourceService.getInstance();
|
||||
const db = DatabaseService.getInstance();
|
||||
const { FileSystemService } = await import('../services/FileSystemService');
|
||||
const fsSvc = FileSystemService.getInstance();
|
||||
await fsSvc.createStack('legacy-apply');
|
||||
db.upsertGitSource({
|
||||
stack_name: 'legacy-apply',
|
||||
repo_url: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
compose_path: 'compose.yaml',
|
||||
compose_paths: ['compose.yaml'],
|
||||
context_dir: null,
|
||||
sync_env: false,
|
||||
env_path: null,
|
||||
auth_type: 'none',
|
||||
encrypted_token: null,
|
||||
auto_apply_on_webhook: false,
|
||||
auto_deploy_on_apply: false,
|
||||
last_applied_commit_sha: null,
|
||||
last_applied_content_hash: null,
|
||||
pending_commit_sha: sha,
|
||||
pending_compose_content: null,
|
||||
pending_env_content: null,
|
||||
pending_fetched_at: null,
|
||||
last_debounce_at: null,
|
||||
});
|
||||
// Seed the v2 blob directly, as a pre-upgrade row would carry it.
|
||||
const svcPriv = svc as unknown as { crypto: { encrypt(s: string): string } };
|
||||
db.setGitSourcePending('legacy-apply', sha, svcPriv.crypto.encrypt(JSON.stringify({ v: 2, files: [{ path: 'compose.yaml', content: 'services:\n web:\n image: nginx\n' }], contextDir: null })), null);
|
||||
const validateSpy = vi.spyOn(svc, 'validateCompose').mockResolvedValue({ ok: true });
|
||||
|
||||
try {
|
||||
const applied = await svc.apply('legacy-apply', sha, { deploy: false });
|
||||
expect(applied.applied).toBe(true);
|
||||
expect(await fsSvc.getStackContent('legacy-apply')).toContain('image: nginx');
|
||||
const row = db.getGitSource('legacy-apply');
|
||||
expect(row?.manifest_state).toBe('migrated');
|
||||
} finally {
|
||||
validateSpy.mockRestore();
|
||||
await cleanupStackDir('legacy-apply');
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe('GitSourceService sync-env stacks with a repo .env (audit C-2)', () => {
|
||||
it('applies twice without a divergence refusal when the repo carries a root .env', async () => {
|
||||
const sha = 'abcd1111abcd1111abcd1111abcd1111abcd1111';
|
||||
const svc = GitSourceService.getInstance();
|
||||
const db = DatabaseService.getInstance();
|
||||
const runSpy = vi
|
||||
.spyOn(svc as unknown as { runDockerCompose: (a: string[], c: string, t: number) => Promise<{ code: number; stdout: string; stderr: string }> }, 'runDockerCompose')
|
||||
.mockResolvedValue({ code: 0, stdout: '', stderr: '' });
|
||||
const { FileSystemService } = await import('../services/FileSystemService');
|
||||
const fsSvc = FileSystemService.getInstance();
|
||||
await fsSvc.createStack('sync-env-double');
|
||||
// Repo carries a root .env; sync_env is on and the sync env path is the same file.
|
||||
mockSuccessfulClone({
|
||||
compose: 'services:\n web:\n image: nginx\n',
|
||||
env: 'SYNCED=1\n',
|
||||
envPath: '.env',
|
||||
extraFiles: { '.env': 'REPO=1\n' },
|
||||
sha,
|
||||
});
|
||||
try {
|
||||
await svc.upsert({
|
||||
stackName: 'sync-env-double',
|
||||
repoUrl: 'https://github.com/example/repo.git',
|
||||
branch: 'main',
|
||||
composePaths: ['compose.yaml'],
|
||||
contextDir: null,
|
||||
syncEnv: true,
|
||||
envPath: '.env',
|
||||
authType: 'none',
|
||||
autoApplyOnWebhook: false,
|
||||
autoDeployOnApply: false,
|
||||
});
|
||||
const pull1 = await svc.pull('sync-env-double');
|
||||
const apply1 = await svc.apply('sync-env-double', pull1.commitSha, { deploy: false });
|
||||
expect(apply1.applied).toBe(true);
|
||||
// The manifest has exactly one .env entry.
|
||||
const manifest = await svc.getManifest('sync-env-double');
|
||||
const envEntries = manifest?.inputs.filter((i) => i.materializedPath === '.env') ?? [];
|
||||
expect(envEntries).toHaveLength(1);
|
||||
expect(envEntries[0].dependencyKind).toBe('sync-env');
|
||||
|
||||
// Second cycle must not raise the divergence refusal.
|
||||
const pull2 = await svc.pull('sync-env-double');
|
||||
const apply2 = await svc.apply('sync-env-double', pull2.commitSha, { deploy: false });
|
||||
expect(apply2.applied).toBe(true);
|
||||
void db;
|
||||
} finally {
|
||||
runSpy.mockRestore();
|
||||
await cleanupStackDir('sync-env-double');
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
@@ -17,6 +17,7 @@ const {
|
||||
mockGetGlobalSettings,
|
||||
mockFsSize,
|
||||
mockBuildEffectiveServiceModel,
|
||||
mockGetGitSource,
|
||||
} = vi.hoisted(() => ({
|
||||
mockListContainers: vi.fn(),
|
||||
mockGetContainer: vi.fn(),
|
||||
@@ -29,6 +30,7 @@ const {
|
||||
mockGetGlobalSettings: vi.fn(),
|
||||
mockFsSize: vi.fn(),
|
||||
mockBuildEffectiveServiceModel: vi.fn(),
|
||||
mockGetGitSource: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock('../services/DockerController', () => ({
|
||||
@@ -69,6 +71,9 @@ vi.mock('../services/DatabaseService', () => ({
|
||||
getOpenDriftFindings: mockGetOpenDriftFindings,
|
||||
getGlobalSettings: mockGetGlobalSettings,
|
||||
getStackActivity: vi.fn().mockReturnValue([]),
|
||||
// Rollback-readiness partial-revert disclosure reads the git source row;
|
||||
// no git-managed stacks in these fixtures by default.
|
||||
getGitSource: mockGetGitSource,
|
||||
}),
|
||||
},
|
||||
}));
|
||||
@@ -324,3 +329,21 @@ describe('UpdateGuardService.computeRollbackReadiness moving-tag wiring', () =>
|
||||
expect(report.overall).toBe('ready');
|
||||
});
|
||||
});
|
||||
|
||||
describe('UpdateGuardService.computeRollbackReadiness git-managed disclosure', () => {
|
||||
beforeEach(() => {
|
||||
mockGetGitSource.mockReturnValue(undefined);
|
||||
});
|
||||
|
||||
it('adds the partial-revert note when the stack is Git-managed and active', async () => {
|
||||
mockGetGitSource.mockReturnValue({ manifest_state: 'active' });
|
||||
const report = await UpdateGuardService.getInstance().computeRollbackReadiness(1, 'git-stack');
|
||||
expect(report.note).toContain('Git-managed');
|
||||
expect(report.note).toContain('compose files and .env');
|
||||
});
|
||||
|
||||
it('omits the note when the stack has no Git source or no manifest', async () => {
|
||||
const report = await UpdateGuardService.getInstance().computeRollbackReadiness(1, 'plain-stack');
|
||||
expect(report.note).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
@@ -28,7 +28,7 @@ import { applyPilotModeCapabilityFilter } from '../services/CapabilityRegistry';
|
||||
import { PilotTunnelManager } from '../services/PilotTunnelManager';
|
||||
import { PilotMetrics } from '../services/PilotMetrics';
|
||||
import { invalidateRemoteMetaCache } from '../helpers/cacheInvalidation';
|
||||
import { sweepStaleTempDirs as sweepStaleGitTempDirs } from '../services/GitSourceService';
|
||||
import { sweepStaleTempDirs as sweepStaleGitTempDirs, sweepGitManifestOrphans } from '../services/GitSourceService';
|
||||
import { PORT } from '../helpers/constants';
|
||||
import { LOW_MEMORY_FLOOR_BYTES } from '../utils/spawnErrors';
|
||||
|
||||
@@ -194,6 +194,9 @@ export async function startServer(server: Server): Promise<void> {
|
||||
sweepStaleGitTempDirs().catch((err) => {
|
||||
console.warn('[GitSource] Temp dir sweep failed:', (err as Error).message);
|
||||
});
|
||||
sweepGitManifestOrphans().catch((err) => {
|
||||
console.warn('[GitManifest] Managed-area sweep failed:', (err as Error).message);
|
||||
});
|
||||
sweepStaleTrivyTempDirs().catch((err) => {
|
||||
console.warn('[Trivy] Temp dir sweep failed:', (err as Error).message);
|
||||
});
|
||||
|
||||
@@ -0,0 +1,639 @@
|
||||
/**
|
||||
* Pure Compose input declaration parser for the Git managed-project
|
||||
* materializer. Walks compose YAML (explicit files plus recursive include /
|
||||
* extends.file graphs) and emits every repository-local input that can affect
|
||||
* validation or deployment, WITHOUT touching the filesystem: file contents are
|
||||
* injected via the `read` callback so this module stays side-effect free and
|
||||
* testable.
|
||||
*
|
||||
* Every declaration is resolved in TWO coordinate systems:
|
||||
* - source: the repository path of the file (what the clone contains), and
|
||||
* - materialized: the stack-relative path the file occupies at runtime.
|
||||
* They diverge when the runtime layout relocates a file: the primary compose
|
||||
* file always lands at the stack root, so its entire include/extends graph
|
||||
* (and every project-relative path declared in it) shifts by the primary's
|
||||
* repository directory prefix. Merged (-f) files keep their own repository
|
||||
* paths, but their include/extends graph resolves against the base file's
|
||||
* directory at source and shifts to the stack root at runtime when no context
|
||||
* dir is configured; include/extends-reached files keep their own project
|
||||
* directory unless a relocation applies.
|
||||
*
|
||||
* Resolution rules (compose spec / compose-go loader):
|
||||
* - `include:`, `extends.file`, and include map-form `env_file` paths resolve
|
||||
* against the current level's EFFECTIVE PROJECT base (the compose-go local
|
||||
* resource loader's WorkingDir is the project directory): the context dir,
|
||||
* or the base file's directory for merged (-f) files at the top level; the
|
||||
* including include-entry's project directory for nested includes.
|
||||
* - An included project's interpolation env defaults to `.env` in its project
|
||||
* directory; absence is tolerated.
|
||||
* - For a long-form include path LIST, the FIRST resolved path is the
|
||||
* included project's main file and defines its directory; later paths are
|
||||
* overrides of the same project. include map-form `project_directory`
|
||||
* overrides the included project's directory.
|
||||
* - service `env_file`, top-level `configs`/`secrets` `file:`, `label_file`
|
||||
* and `build.context` resolve against the effective project directory: the
|
||||
* context dir, or the base file's directory for merged (-f) files; files
|
||||
* reached via include/extends keep their own project directory. An omitted
|
||||
* build context defaults to that project directory.
|
||||
* - Absolute (POSIX, Windows drive/UNC, drive-relative, root-relative) and
|
||||
* home-relative (`~`) paths are HOST paths: emitted with baseDir 'host' so
|
||||
* the classifier records them as unmanaged (data inputs) or refuses them
|
||||
* (include/extends), never adopting a same-named repository file.
|
||||
*
|
||||
* Never throws: parse errors are collected into `parseErrors` and surface as
|
||||
* refusals at classification time.
|
||||
*/
|
||||
import path from 'path';
|
||||
import YAML from 'yaml';
|
||||
import type {
|
||||
DeclaredInput,
|
||||
DynamicInput,
|
||||
InputDependencyKind,
|
||||
InputRole,
|
||||
ParsedDeclaredInputs,
|
||||
} from '../types/gitProjectManifest';
|
||||
|
||||
// Refuse to parse anything beyond this bound so a malformed (or adversarial)
|
||||
// compose file cannot exhaust heap while walking the project. Mirrors the cap
|
||||
// in composeDependencyParse.ts / composePreview.ts.
|
||||
const MAX_COMPOSE_PARSE_BYTES = 1_048_576; // 1 MiB
|
||||
|
||||
// Include/extends recursion bound; deeper graphs are refused as unsupported.
|
||||
const MAX_INCLUDE_DEPTH = 16;
|
||||
|
||||
export interface ParseOptions {
|
||||
/** Repo-relative project root (today's context_dir); null = repo root. */
|
||||
projectRoot: string | null;
|
||||
/** Fetches a repo-relative file's content for include/extends recursion; null when unreadable. */
|
||||
read: (repoPath: string) => string | null;
|
||||
}
|
||||
|
||||
interface ComposeRefs {
|
||||
inputs: DeclaredInput[];
|
||||
dynamic: DynamicInput[];
|
||||
parseErrors: string[];
|
||||
}
|
||||
|
||||
/**
|
||||
* Walk context for one compose file: its repository path, its runtime
|
||||
* (materialized) path ('' = stack root), and the project bases used to
|
||||
* resolve project-relative declarations in both coordinate systems.
|
||||
*/
|
||||
interface FileContext {
|
||||
repoPath: string;
|
||||
runtimePath: string;
|
||||
projectBase: string | null;
|
||||
runtimeProjectBase: string | null;
|
||||
}
|
||||
|
||||
/** True when the path contains a Compose `$VAR` / `${VAR}` interpolation form. */
|
||||
export function isDynamicPath(p: string): boolean {
|
||||
return /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/.test(p);
|
||||
}
|
||||
|
||||
/** Absolute (POSIX, Windows drive/UNC, drive-relative, root-relative) or home-relative host path. */
|
||||
export function isHostAbsolutePath(p: string): boolean {
|
||||
return p.startsWith('/') || p.startsWith('~') || /^[A-Za-z]:/.test(p) || p.startsWith('\\');
|
||||
}
|
||||
|
||||
export function isUrl(p: string): boolean {
|
||||
return /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(p);
|
||||
}
|
||||
|
||||
function dirOf(p: string): string | null {
|
||||
return p && p.includes('/') ? p.slice(0, p.lastIndexOf('/')) : null;
|
||||
}
|
||||
|
||||
/** Normalize a resolved path; null when it escapes its base (.. / absolute). */
|
||||
function normalizeWithinBase(candidate: string): string | null {
|
||||
// Backslashes are normalized BEFORE collapse so `sub\..\x` (Windows-style
|
||||
// separators) collapses and escapes are detected, never emitted raw.
|
||||
const normalized = path.posix.normalize(candidate.replace(/\\/g, '/')).replace(/^\.\//, '');
|
||||
if (normalized === '..' || normalized.startsWith('../') || path.posix.isAbsolute(normalized)) return null;
|
||||
return normalized;
|
||||
}
|
||||
|
||||
/** Resolve a path against a base; null when the result escapes the base. */
|
||||
function resolveWithinBase(base: string | null, target: string): string | null {
|
||||
return normalizeWithinBase(base ? `${base}/${target}` : target);
|
||||
}
|
||||
|
||||
function emitInput(
|
||||
refs: ComposeRefs,
|
||||
rawPath: string | null,
|
||||
sourcePath: string | null,
|
||||
materializedPath: string | null,
|
||||
kind: InputDependencyKind,
|
||||
role: InputRole,
|
||||
fromFile: string,
|
||||
baseDir: DeclaredInput['baseDir'],
|
||||
service: string | null = null,
|
||||
required = true,
|
||||
): void {
|
||||
if (rawPath !== null && isDynamicPath(rawPath)) {
|
||||
refs.dynamic.push({ sourcePath: rawPath, kind, note: 'Path contains a variable; resolved by Compose at deploy time, not enumerated.' });
|
||||
return;
|
||||
}
|
||||
refs.inputs.push({ sourcePath, materializedPath, baseDir, kind, role, fromFile, service, required });
|
||||
}
|
||||
|
||||
/**
|
||||
* Emit a project-relative declaration resolved in both coordinate systems.
|
||||
* Host/absolute paths and paths that escape either base are emitted as host
|
||||
* inputs (the classifier records them unmanaged or refuses include/extends).
|
||||
*/
|
||||
function emitProjectRelative(
|
||||
refs: ComposeRefs,
|
||||
raw: string,
|
||||
kind: InputDependencyKind,
|
||||
role: InputRole,
|
||||
fromFile: string,
|
||||
ctx: FileContext,
|
||||
baseDir: DeclaredInput['baseDir'],
|
||||
service: string | null = null,
|
||||
required = true,
|
||||
): void {
|
||||
if (isHostAbsolutePath(raw)) {
|
||||
emitInput(refs, raw, raw, null, kind, role, fromFile, 'host', service, required);
|
||||
return;
|
||||
}
|
||||
const source = resolveWithinBase(ctx.projectBase, raw);
|
||||
const materialized = resolveWithinBase(ctx.runtimeProjectBase, raw);
|
||||
if (source === null || materialized === null) {
|
||||
emitInput(refs, raw, raw, null, kind, role, fromFile, 'host', service, required);
|
||||
return;
|
||||
}
|
||||
emitInput(refs, raw, source, materialized, kind, role, fromFile, baseDir, service, required);
|
||||
}
|
||||
|
||||
function asString(value: unknown): string | undefined {
|
||||
if (typeof value === 'string') return value;
|
||||
if (typeof value === 'number') return String(value);
|
||||
return undefined;
|
||||
}
|
||||
|
||||
/** Normalize a string-or-list-of-strings value into its string items. */
|
||||
function asStringList(value: unknown): string[] {
|
||||
if (typeof value === 'string') return [value];
|
||||
if (typeof value === 'number') return [String(value)];
|
||||
if (Array.isArray(value)) {
|
||||
return value.map(asString).filter((p): p is string => p !== undefined);
|
||||
}
|
||||
return [];
|
||||
}
|
||||
|
||||
/** Normalize an env_file entry (string, list item, or map {path, required}) to its path and optionality. */
|
||||
function envFilePath(value: unknown): { path: string; required: boolean } | undefined {
|
||||
if (typeof value === 'string') return { path: value, required: true };
|
||||
if (value && typeof value === 'object' && !Array.isArray(value)) {
|
||||
const p = (value as Record<string, unknown>).path;
|
||||
const path = asString(p);
|
||||
if (path === undefined) return undefined;
|
||||
const required = (value as Record<string, unknown>).required;
|
||||
return { path, required: required !== false };
|
||||
}
|
||||
return undefined;
|
||||
}
|
||||
|
||||
|
||||
/** Normalize a configs/secrets entry to a file path, or null for external/env forms. */
|
||||
function resourceFilePath(value: unknown): string | null {
|
||||
if (value && typeof value === 'object' && !Array.isArray(value)) {
|
||||
const record = value as Record<string, unknown>;
|
||||
if (record.external === true) return null; // docker supplies it; only an explicit true applies
|
||||
if ('env' in record || 'environment' in record) return null; // env-injected
|
||||
const f = record.file;
|
||||
if (f !== undefined) return asString(f) ?? null;
|
||||
return null; // plain {} or name-only reference
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function shortFormBindSource(volume: string): string | null {
|
||||
// A drive-letter prefix (C:\ or C:) keeps its colon as part of the
|
||||
// source; the source/target separator is the NEXT colon. UNC sources
|
||||
// (\\server\share) have no colon and split at the separator as usual.
|
||||
const separator = /^[A-Za-z]:/.test(volume) ? volume.indexOf(':', 2) : volume.indexOf(':');
|
||||
if (separator === -1) return null;
|
||||
const src = volume.slice(0, separator);
|
||||
// Named volumes have no path separators or leading dot/slash/tilde.
|
||||
if (/^[A-Za-z0-9_.-]+$/.test(src) && !src.startsWith('.') && !src.startsWith('~')) return null;
|
||||
return src;
|
||||
}
|
||||
|
||||
/** Collect bind-mount host sources from a service volumes list. */
|
||||
function collectBindMounts(volumes: unknown, fromFile: string, refs: ComposeRefs, ctx: FileContext): void {
|
||||
const emitBindSource = (src: string): void => {
|
||||
if (isHostAbsolutePath(src)) {
|
||||
emitInput(refs, src, null, null, 'bind-mount', 'bind-mount', fromFile, 'host');
|
||||
} else {
|
||||
emitProjectRelative(refs, src, 'bind-mount', 'bind-mount', fromFile, ctx, 'project-root');
|
||||
}
|
||||
};
|
||||
if (!Array.isArray(volumes)) return;
|
||||
for (const entry of volumes) {
|
||||
if (typeof entry === 'string') {
|
||||
const src = shortFormBindSource(entry);
|
||||
if (src !== null) emitBindSource(src);
|
||||
continue;
|
||||
}
|
||||
if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
|
||||
const record = entry as Record<string, unknown>;
|
||||
if (record.type === 'bind' && typeof record.source === 'string') {
|
||||
emitBindSource(record.source);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** Collect build declarations (context, dockerfile, secrets, additional contexts). */
|
||||
function collectBuild(build: unknown, fromFile: string, refs: ComposeRefs, ctx: FileContext, service: string | null): void {
|
||||
if (typeof build === 'string') {
|
||||
emitProjectRelative(refs, build, 'build-context', 'build-context', fromFile, ctx, 'compose-file-dir', service);
|
||||
return;
|
||||
}
|
||||
if (!build || typeof build !== 'object' || Array.isArray(build)) return;
|
||||
const record = build as Record<string, unknown>;
|
||||
if (typeof record.context === 'string') {
|
||||
emitProjectRelative(refs, record.context, 'build-context', 'build-context', fromFile, ctx, 'compose-file-dir', service);
|
||||
} else {
|
||||
// An omitted context defaults to the declaring file's project
|
||||
// directory (compose spec); resolved by emitProjectRelative.
|
||||
emitProjectRelative(refs, '.', 'build-context', 'build-context', fromFile, ctx, 'compose-file-dir', service);
|
||||
}
|
||||
if (typeof record.dockerfile === 'string') {
|
||||
if (isHostAbsolutePath(record.dockerfile)) {
|
||||
emitInput(refs, record.dockerfile, record.dockerfile, null, 'dockerfile', 'dockerfile', fromFile, 'host', service);
|
||||
} else {
|
||||
// Dockerfile is relative to the context; the classifier rebases it.
|
||||
emitInput(refs, record.dockerfile, record.dockerfile, null, 'dockerfile', 'dockerfile', fromFile, 'compose-file-dir', service);
|
||||
}
|
||||
}
|
||||
if (record.secrets && Array.isArray(record.secrets)) {
|
||||
// Long syntax carries only source/target/uid/gid/mode; `source` names
|
||||
// a TOP-LEVEL SECRET (compose errors if it is not defined in the
|
||||
// top-level secrets section), never a file path. The referenced
|
||||
// secret's file, when file-backed, is emitted by the top-level
|
||||
// secrets walk; the reference itself is recorded as unmanaged, the
|
||||
// same as the string form.
|
||||
record.secrets.forEach(() => {
|
||||
emitInput(refs, null, null, null, 'build-secret', 'build-secret', fromFile, 'host', service);
|
||||
});
|
||||
}
|
||||
// additional_contexts: mapping (name -> value) or list of NAME=VALUE
|
||||
// strings (compose build spec). Path values are project-relative inputs;
|
||||
// type:// and service: values are supplied by the image builder at build
|
||||
// time and recorded unmanaged.
|
||||
let additional: Array<[string, unknown]> = [];
|
||||
if (record.additional_contexts && typeof record.additional_contexts === 'object' && !Array.isArray(record.additional_contexts)) {
|
||||
additional = Object.entries(record.additional_contexts as Record<string, unknown>);
|
||||
} else if (Array.isArray(record.additional_contexts)) {
|
||||
for (const item of record.additional_contexts) {
|
||||
const text = asString(item);
|
||||
if (text !== undefined) {
|
||||
const eq = text.indexOf('=');
|
||||
if (eq > 0) additional.push([text.slice(0, eq), text.slice(eq + 1)]);
|
||||
}
|
||||
}
|
||||
}
|
||||
for (const [, value] of additional) {
|
||||
const p = asString(value);
|
||||
if (p === undefined) continue;
|
||||
if (isUrl(p) || p.startsWith('service:')) {
|
||||
emitInput(refs, p, p, null, 'build-additional-context', 'build-additional-context', fromFile, 'host', service);
|
||||
} else {
|
||||
emitProjectRelative(refs, p, 'build-additional-context', 'build-additional-context', fromFile, ctx, 'compose-file-dir', service);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** Walk one service definition for file-backed inputs. */
|
||||
function walkService(serviceName: string, service: unknown, fromFile: string, refs: ComposeRefs, ctx: FileContext): void {
|
||||
if (!service || typeof service !== 'object' || Array.isArray(service)) return;
|
||||
const record = service as Record<string, unknown>;
|
||||
|
||||
// extends.file (map form) is emitted and recursed by parseFileInner, which
|
||||
// needs the resolved target for the recursion; the string form extends a
|
||||
// sibling service in the same file.
|
||||
|
||||
const envFile = record.env_file;
|
||||
if (envFile !== undefined) {
|
||||
const entries = Array.isArray(envFile) ? envFile : [envFile];
|
||||
for (const entry of entries) {
|
||||
const p = envFilePath(entry);
|
||||
if (p !== undefined) {
|
||||
emitProjectRelative(refs, p.path, 'env_file', 'env', fromFile, ctx, 'compose-file-dir', null, p.required);
|
||||
} else {
|
||||
refs.parseErrors.push(`env_file entry in ${fromFile} has no resolvable path`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for (const labelFile of asStringList(record.label_file)) {
|
||||
emitProjectRelative(refs, labelFile, 'label_file', 'label-file', fromFile, ctx, 'compose-file-dir');
|
||||
}
|
||||
|
||||
if (record.build !== undefined) collectBuild(record.build, fromFile, refs, ctx, serviceName);
|
||||
collectBindMounts(record.volumes, fromFile, refs, ctx);
|
||||
|
||||
// Per-service configs/secrets references are keys into the top-level
|
||||
// maps, which the top-level walk emits; nothing to record here.
|
||||
}
|
||||
|
||||
/**
|
||||
* Emit a file-relative declaration (include/extends/include-env), returning
|
||||
* the resolved source/materialized pair; the caller recurses via
|
||||
* readAndRecurse when the target is a repository file.
|
||||
*/
|
||||
function emitFileRelative(
|
||||
refs: ComposeRefs,
|
||||
raw: string,
|
||||
kind: InputDependencyKind,
|
||||
role: InputRole,
|
||||
fromFile: string,
|
||||
ctx: FileContext,
|
||||
baseDir: DeclaredInput['baseDir'] = 'repo-root',
|
||||
): { source: string | null; materialized: string | null } {
|
||||
if (isHostAbsolutePath(raw)) {
|
||||
emitInput(refs, raw, raw, null, kind, role, fromFile, 'host');
|
||||
return { source: null, materialized: null };
|
||||
}
|
||||
if (isUrl(raw)) {
|
||||
emitInput(refs, raw, raw.trim(), null, kind, role, fromFile, baseDir);
|
||||
return { source: null, materialized: null };
|
||||
}
|
||||
// Include, include-env, and extends paths resolve against the current
|
||||
// level's EFFECTIVE PROJECT base (compose-go: the local resource
|
||||
// loader's WorkingDir is the project directory), not the declaring
|
||||
// file's own directory.
|
||||
const source = resolveWithinBase(ctx.projectBase, raw);
|
||||
const materialized = resolveWithinBase(ctx.runtimeProjectBase, raw);
|
||||
if (source === null || materialized === null) {
|
||||
emitInput(refs, raw, raw, null, kind, role, fromFile, 'host');
|
||||
return { source: null, materialized: null };
|
||||
}
|
||||
emitInput(refs, raw, source, materialized, kind, role, fromFile, baseDir);
|
||||
return { source, materialized };
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse one compose file into declarations, recursing into include/extends.
|
||||
* Cycle detection uses the RECURSION STACK (a file re-entered while still
|
||||
* being walked is a real cycle); a file reached again after completion is a
|
||||
* shared base (diamond / repeated include) and dedupes silently.
|
||||
*/
|
||||
function parseFile(
|
||||
ctx: FileContext,
|
||||
content: string,
|
||||
opts: ParseOptions,
|
||||
refs: ComposeRefs,
|
||||
visited: Set<string>,
|
||||
stack: Set<string>,
|
||||
depth: number,
|
||||
): void {
|
||||
const normalized = normalizeRepoPath(ctx.repoPath);
|
||||
if (stack.has(normalized)) {
|
||||
refs.parseErrors.push(`Include/extends cycle detected at ${normalized}`);
|
||||
return;
|
||||
}
|
||||
if (visited.has(normalized)) {
|
||||
return; // shared base file, not a cycle
|
||||
}
|
||||
stack.add(normalized);
|
||||
try {
|
||||
parseFileInner(ctx, content, opts, refs, visited, stack, depth);
|
||||
} finally {
|
||||
stack.delete(normalized);
|
||||
visited.add(normalized);
|
||||
}
|
||||
}
|
||||
|
||||
function normalizeRepoPath(p: string): string {
|
||||
return path.posix.normalize(p.replace(/\\/g, '/')).replace(/^\/+/, '');
|
||||
}
|
||||
|
||||
function parseFileInner(
|
||||
ctx: FileContext,
|
||||
content: string,
|
||||
opts: ParseOptions,
|
||||
refs: ComposeRefs,
|
||||
visited: Set<string>,
|
||||
stack: Set<string>,
|
||||
depth: number,
|
||||
): void {
|
||||
const normalized = normalizeRepoPath(ctx.repoPath);
|
||||
if (depth > MAX_INCLUDE_DEPTH) {
|
||||
refs.parseErrors.push(`Include/extends graph exceeds depth ${MAX_INCLUDE_DEPTH} at ${normalized}`);
|
||||
return;
|
||||
}
|
||||
if (content.length > MAX_COMPOSE_PARSE_BYTES) {
|
||||
refs.parseErrors.push(`Compose file ${normalized} exceeds the ${MAX_COMPOSE_PARSE_BYTES}-byte parse cap`);
|
||||
return;
|
||||
}
|
||||
|
||||
let doc: unknown;
|
||||
try {
|
||||
doc = YAML.parse(content);
|
||||
} catch (e) {
|
||||
refs.parseErrors.push(`Cannot parse compose file ${normalized}: ${e instanceof Error ? e.message : String(e)}`);
|
||||
return;
|
||||
}
|
||||
if (!doc || typeof doc !== 'object' || Array.isArray(doc)) return;
|
||||
|
||||
const root = doc as Record<string, unknown>;
|
||||
|
||||
// Top-level include: list of paths or maps {path, env_file, project_directory}.
|
||||
const include = root.include;
|
||||
if (include !== undefined) {
|
||||
const items = Array.isArray(include) ? include : [include];
|
||||
for (const item of items) {
|
||||
if (typeof item === 'string') {
|
||||
processIncludeEntry(refs, [item], undefined, normalized, ctx, opts, visited, stack, depth);
|
||||
} else if (item && typeof item === 'object' && !Array.isArray(item)) {
|
||||
const map = item as Record<string, unknown>;
|
||||
// path accepts a string or a list of strings (merged in order).
|
||||
const paths = asStringList(map.path);
|
||||
if (paths.length === 0) {
|
||||
refs.parseErrors.push(`Include entry in ${normalized} has no resolvable path`);
|
||||
continue;
|
||||
}
|
||||
processIncludeEntry(refs, paths, map, normalized, ctx, opts, visited, stack, depth);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Per-file service walk (keeps declaring-file provenance for relative refs).
|
||||
if (root.services && typeof root.services === 'object' && !Array.isArray(root.services)) {
|
||||
for (const [serviceName, service] of Object.entries(root.services as Record<string, unknown>)) {
|
||||
walkService(serviceName, service, normalized, refs, ctx);
|
||||
// extends.file recursion after recording the declaration.
|
||||
if (service && typeof service === 'object' && !Array.isArray(service)) {
|
||||
const ext = (service as Record<string, unknown>).extends;
|
||||
if (ext && typeof ext === 'object' && !Array.isArray(ext)) {
|
||||
const fileTarget = asString((ext as Record<string, unknown>).file);
|
||||
if (fileTarget !== undefined) {
|
||||
const resolved = emitFileRelative(refs, fileTarget, 'extends', 'compose-additional', normalized, ctx);
|
||||
readAndRecurse(resolved, ctx, opts, refs, visited, stack, depth, 'extends.file target');
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Top-level configs / secrets file forms.
|
||||
for (const [key, kind, role] of [
|
||||
['configs', 'config', 'config'],
|
||||
['secrets', 'secret', 'secret'],
|
||||
] as const) {
|
||||
const resources = root[key];
|
||||
if (!resources || typeof resources !== 'object' || Array.isArray(resources)) continue;
|
||||
for (const def of Object.values(resources as Record<string, unknown>)) {
|
||||
const file = resourceFilePath(def);
|
||||
if (file !== null) {
|
||||
emitProjectRelative(refs, file, kind, role, normalized, ctx, 'compose-file-dir');
|
||||
} else if (def !== null && def !== undefined) {
|
||||
// external / env / name-only forms are docker-supplied or
|
||||
// unresolvable; record an unmanaged placeholder.
|
||||
emitInput(refs, null, null, null, kind, role, normalized, 'host');
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Process one include entry (string path, or map with a path list): resolve
|
||||
* each path against the current level's project base, derive the included
|
||||
* project's bases (project_directory, or the FIRST resolved path's directory
|
||||
* per the compose-go "main file" rule), emit the included project's default
|
||||
* interpolation .env, and recurse.
|
||||
*/
|
||||
function processIncludeEntry(
|
||||
refs: ComposeRefs,
|
||||
paths: string[],
|
||||
map: Record<string, unknown> | undefined,
|
||||
fromFile: string,
|
||||
ctx: FileContext,
|
||||
opts: ParseOptions,
|
||||
visited: Set<string>,
|
||||
stack: Set<string>,
|
||||
depth: number,
|
||||
): void {
|
||||
const resolvedPaths = paths.map((p) => emitFileRelative(refs, p, 'include', 'compose-additional', fromFile, ctx));
|
||||
const first = resolvedPaths[0];
|
||||
// interpolation: false disables interpolation for the included project,
|
||||
// so its default .env is never probed.
|
||||
const interpolate = map?.interpolation !== false;
|
||||
const projectDir = asString(map?.project_directory);
|
||||
let childProjectBase: string | null;
|
||||
let childRuntimeProjectBase: string | null;
|
||||
if (projectDir !== undefined) {
|
||||
childProjectBase = resolveWithinBase(ctx.projectBase, projectDir);
|
||||
childRuntimeProjectBase = resolveWithinBase(ctx.runtimeProjectBase, projectDir);
|
||||
if (childProjectBase === null || childRuntimeProjectBase === null) {
|
||||
refs.parseErrors.push(`Include project_directory ${projectDir} in ${fromFile} escapes its base`);
|
||||
return;
|
||||
}
|
||||
} else if (first !== undefined && first.source !== null && first.materialized !== null) {
|
||||
// Without project_directory, the FIRST resolved path is the included
|
||||
// project's main file and defines its directory; later paths are
|
||||
// overrides of the same project.
|
||||
childProjectBase = dirOf(first.source);
|
||||
childRuntimeProjectBase = dirOf(first.materialized);
|
||||
} else {
|
||||
return; // host/URL/escape: emitted, the classifier decides
|
||||
}
|
||||
|
||||
// The included project's interpolation env defaults to .env in its
|
||||
// project directory (compose include spec); absence is tolerated.
|
||||
// interpolation: false disables it (handled above). When the included
|
||||
// project's bases equal the parent's (a same-directory include), the
|
||||
// entry would duplicate the parent's interpolation env, so it is skipped.
|
||||
if (interpolate && !(childProjectBase === ctx.projectBase && childRuntimeProjectBase === ctx.runtimeProjectBase)) {
|
||||
emitInput(refs, '.env', resolveWithinBase(childProjectBase, '.env')!, resolveWithinBase(childRuntimeProjectBase, '.env')!, 'interpolation-env', 'env', fromFile, 'repo-root');
|
||||
}
|
||||
|
||||
const childOverride = { projectBase: childProjectBase, runtimeProjectBase: childRuntimeProjectBase };
|
||||
for (const resolved of resolvedPaths) {
|
||||
readAndRecurse(resolved, ctx, opts, refs, visited, stack, depth, 'Included compose file', childOverride);
|
||||
}
|
||||
|
||||
// Explicit env_file accepts a string or a list of strings; resolves
|
||||
// against the current level's project base (compose-go include env).
|
||||
for (const env of asStringList(map?.env_file)) {
|
||||
emitFileRelative(refs, env, 'include-env', 'env', fromFile, ctx);
|
||||
}
|
||||
}
|
||||
|
||||
/** Read a resolved include/extends target and recurse when it is a repository file. */
|
||||
function readAndRecurse(
|
||||
resolved: { source: string | null; materialized: string | null },
|
||||
ctx: FileContext,
|
||||
opts: ParseOptions,
|
||||
refs: ComposeRefs,
|
||||
visited: Set<string>,
|
||||
stack: Set<string>,
|
||||
depth: number,
|
||||
errorLabel: string,
|
||||
childOverride?: { projectBase: string | null; runtimeProjectBase: string | null },
|
||||
): void {
|
||||
// Host/URL/escape paths emit with both sides null; the classifier decides.
|
||||
if (resolved.source === null || resolved.materialized === null) return;
|
||||
const nested = opts.read(resolved.source);
|
||||
if (nested === null) {
|
||||
refs.parseErrors.push(`${errorLabel} ${resolved.source} is unreadable`);
|
||||
return;
|
||||
}
|
||||
parseFile(
|
||||
{
|
||||
repoPath: resolved.source,
|
||||
runtimePath: resolved.materialized,
|
||||
projectBase: childOverride?.projectBase ?? dirOf(resolved.source),
|
||||
runtimeProjectBase: childOverride?.runtimeProjectBase ?? dirOf(resolved.materialized),
|
||||
},
|
||||
nested,
|
||||
opts,
|
||||
refs,
|
||||
visited,
|
||||
stack,
|
||||
depth + 1,
|
||||
);
|
||||
}
|
||||
|
||||
export function parseDeclaredInputs(
|
||||
orderedContents: Array<{ path: string; content: string }>,
|
||||
opts: ParseOptions,
|
||||
): ParsedDeclaredInputs {
|
||||
const refs: ComposeRefs = { inputs: [], dynamic: [], parseErrors: [] };
|
||||
const visited = new Set<string>();
|
||||
const stack = new Set<string>();
|
||||
// Merged (-f) files share the TOP project's bases: the context dir, or
|
||||
// the base (first) file's directory. The primary file lands at the stack
|
||||
// root at runtime, so its runtime path is '' while additional files keep
|
||||
// their repository paths.
|
||||
const orderedProjectBase = opts.projectRoot ?? dirOf(orderedContents[0]?.path ?? '');
|
||||
const orderedRuntimeProjectBase = opts.projectRoot ?? null;
|
||||
for (const [index, file] of orderedContents.entries()) {
|
||||
parseFile(
|
||||
{
|
||||
repoPath: file.path,
|
||||
runtimePath: index === 0 ? '' : file.path,
|
||||
projectBase: orderedProjectBase,
|
||||
runtimeProjectBase: orderedRuntimeProjectBase,
|
||||
},
|
||||
file.content,
|
||||
opts,
|
||||
refs,
|
||||
visited,
|
||||
stack,
|
||||
0,
|
||||
);
|
||||
}
|
||||
|
||||
// Interpolation env at the project root (compose loads it for variable
|
||||
// substitution). Always declared; classification decides managed vs absent.
|
||||
const interpRoot = opts.projectRoot ?? '';
|
||||
const interpPath = interpRoot ? `${interpRoot}/.env` : '.env';
|
||||
emitInput(refs, interpPath, interpPath, interpPath, 'interpolation-env', 'env', '<project>', 'project-root');
|
||||
|
||||
return { inputs: refs.inputs, dynamic: refs.dynamic, parseErrors: refs.parseErrors };
|
||||
}
|
||||
@@ -1,5 +1,6 @@
|
||||
import { Router, type Request, type Response } from 'express';
|
||||
import { GitSourceService } from '../services/GitSourceService';
|
||||
import { GitProjectManifestService } from '../services/GitProjectManifestService';
|
||||
import { FileSystemService } from '../services/FileSystemService';
|
||||
import { DatabaseService } from '../services/DatabaseService';
|
||||
import { CryptoService } from '../services/CryptoService';
|
||||
@@ -105,9 +106,19 @@ stackGitSourceRouter.get('/:stackName/git-source', async (req: Request, res: Res
|
||||
}
|
||||
if (!requirePermission(req, res, 'stack:read', 'stack', stackName)) return;
|
||||
try {
|
||||
const source = GitSourceService.getInstance().get(stackName);
|
||||
const gitSources = GitSourceService.getInstance();
|
||||
const source = gitSources.get(stackName);
|
||||
if (source) {
|
||||
res.json(source);
|
||||
// The managed-project manifest summary rides the source branch; the
|
||||
// unlinked {linked:false} shape below is unchanged. Heal-on-read may
|
||||
// rewrite the DB cache, so re-read the flat row for same-response parity.
|
||||
const manifest = await gitSources.getManifestSummary(stackName);
|
||||
const refreshed = gitSources.get(stackName) ?? source;
|
||||
res.json({
|
||||
...refreshed,
|
||||
manifest_state: manifest?.state ?? refreshed.manifest_state,
|
||||
manifest,
|
||||
});
|
||||
return;
|
||||
}
|
||||
// No source row. A non-existent stack is a genuine 404, but an existing
|
||||
@@ -248,19 +259,11 @@ stackGitSourceRouter.delete('/:stackName/git-source', async (req: Request, res:
|
||||
}
|
||||
if (!requirePermission(req, res, 'stack:edit', 'stack', stackName)) return;
|
||||
try {
|
||||
// The deploy spec lives on the Git-source row, so unlinking a multi-file (or
|
||||
// project-directory) source would silently drop the spec and revert future
|
||||
// deploys to root compose.yaml auto-discovery, ignoring the override files
|
||||
// still on disk. Refuse rather than change deploy semantics out from under the
|
||||
// user; deleting the stack removes it cleanly.
|
||||
const spec = DatabaseService.getInstance().getGitSource(stackName)?.applied_deploy_spec;
|
||||
if (spec && (spec.files.length > 1 || spec.contextDir)) {
|
||||
res.status(409).json({
|
||||
error: 'This stack deploys multiple compose files configured by its Git source. Unlinking would change it to deploy only compose.yaml. Delete the stack to remove it, or keep the Git source.',
|
||||
});
|
||||
return;
|
||||
}
|
||||
GitSourceService.getInstance().delete(stackName);
|
||||
// Detach with the export contract: the effective compose model is rendered
|
||||
// into a single compose.yaml and the materialized files are kept, so a
|
||||
// multi-file / project-directory stack stays deployable after unlinking.
|
||||
// A render failure aborts with 409 and the row is left intact.
|
||||
await GitSourceService.getInstance().detach(stackName);
|
||||
// The cached /stacks/statuses payload carries the source label; drop it
|
||||
// before responding so a client refetch on this response recomputes. The
|
||||
// full invalidateNodeCaches helper is deliberate here (matching every
|
||||
@@ -268,8 +271,34 @@ stackGitSourceRouter.delete('/:stackName/git-source', async (req: Request, res:
|
||||
// dropping the project-name map and file-root allowlists alongside is
|
||||
// harmless, unlike the high-frequency container-event path.
|
||||
invalidateNodeCaches(req.nodeId);
|
||||
console.log(`[GitSource] Removed git source for ${stackName}`);
|
||||
console.log(`[GitSource] Detached git source for ${stackName}`);
|
||||
res.json({ success: true });
|
||||
} catch (error) {
|
||||
const code = (error as { code?: string } | null)?.code;
|
||||
if (code === 'RENDER_FAILED') {
|
||||
res.status(409).json({ error: (error as Error).message });
|
||||
return;
|
||||
}
|
||||
sendGitSourceError(res, error);
|
||||
}
|
||||
});
|
||||
|
||||
stackGitSourceRouter.get('/:stackName/git-source/manifest', async (req: Request, res: Response): Promise<void> => {
|
||||
const stackName = req.params.stackName as string;
|
||||
if (!isValidStackName(stackName)) {
|
||||
res.status(400).json({ error: 'Invalid stack name' });
|
||||
return;
|
||||
}
|
||||
if (!requirePermission(req, res, 'stack:read', 'stack', stackName)) return;
|
||||
try {
|
||||
const manifest = await GitSourceService.getInstance().getManifest(stackName);
|
||||
if (!manifest) {
|
||||
res.status(404).json({ error: 'No managed-project manifest for this stack' });
|
||||
return;
|
||||
}
|
||||
// The public projection: no content hashes, size metadata, provenance, or
|
||||
// deletion authority, and high-sensitivity input paths are redacted.
|
||||
res.json({ manifest: GitProjectManifestService.getInstance().toPublicManifest(manifest) });
|
||||
} catch (error) {
|
||||
sendGitSourceError(res, error);
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1236,6 +1236,96 @@ export class ComposeService {
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Render the effective compose model as YAML (the default `docker compose
|
||||
* config` output) with the exact authored invocation and NO mesh override.
|
||||
* Used by the Git source detach/export contract: the rendered model becomes
|
||||
* the stack's single compose.yaml. Throws when the render fails or times
|
||||
* out, so the detach transaction aborts before anything changes.
|
||||
*/
|
||||
public async renderComposeYaml(stackName: string): Promise<string> {
|
||||
if (!isValidStackName(stackName)) {
|
||||
throw new Error('Invalid stack path');
|
||||
}
|
||||
const baseResolved = path.resolve(this.baseDir);
|
||||
const stackDir = path.resolve(baseResolved, stackName);
|
||||
if (!stackDir.startsWith(baseResolved + path.sep)) {
|
||||
throw new Error('Invalid stack path');
|
||||
}
|
||||
let filePrefix: string[];
|
||||
try {
|
||||
filePrefix = authoredComposeFileArgs(stackName, this.nodeId);
|
||||
} catch (err) {
|
||||
throw err instanceof Error ? err : new Error(String(err));
|
||||
}
|
||||
const envFileArgs = await authoredComposeEnvFileArgs(stackName, this.nodeId);
|
||||
const child = spawn('docker', ['compose', ...filePrefix, ...envFileArgs, 'config'], {
|
||||
cwd: stackDir,
|
||||
env: {
|
||||
...process.env,
|
||||
PATH: process.env.PATH || '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
|
||||
},
|
||||
});
|
||||
return new Promise((resolve, reject) => {
|
||||
const MAX_OUTPUT = 5 * 1024 * 1024; // 5 MiB cap on each stream
|
||||
const TIMEOUT_MS = 30_000;
|
||||
// Accumulate Buffer chunks and decode ONCE at the end: chunk-wise
|
||||
// toString() can split a multi-byte UTF-8 sequence across a chunk
|
||||
// boundary and mangle non-ASCII values.
|
||||
const outChunks: Buffer[] = [];
|
||||
let outBytes = 0;
|
||||
let stderr = '';
|
||||
let capped = false;
|
||||
let settled = false;
|
||||
const timer = setTimeout(() => {
|
||||
settled = true;
|
||||
clearTimeout(timer);
|
||||
try {
|
||||
child.kill('SIGKILL');
|
||||
} catch {
|
||||
// best effort
|
||||
}
|
||||
reject(new Error(`docker compose config timed out after ${TIMEOUT_MS / 1000}s`));
|
||||
}, TIMEOUT_MS);
|
||||
const finish = (error: Error | null) => {
|
||||
if (settled) return;
|
||||
settled = true;
|
||||
clearTimeout(timer);
|
||||
if (error) reject(error);
|
||||
else resolve(Buffer.concat(outChunks).toString('utf8'));
|
||||
};
|
||||
child.stdout.on('data', (data: Buffer) => {
|
||||
if (capped) return;
|
||||
outBytes += data.length;
|
||||
if (outBytes > MAX_OUTPUT) {
|
||||
// A truncated model frequently still parses as YAML; overwriting a
|
||||
// working compose.yaml with it would be silent corruption. The cap is
|
||||
// an error, not a truncation.
|
||||
capped = true;
|
||||
settled = true;
|
||||
clearTimeout(timer);
|
||||
try {
|
||||
child.kill('SIGKILL');
|
||||
} catch {
|
||||
// best effort
|
||||
}
|
||||
reject(new Error(`docker compose config output exceeded ${MAX_OUTPUT} bytes`));
|
||||
return;
|
||||
}
|
||||
outChunks.push(data);
|
||||
});
|
||||
child.stderr.on('data', (data: Buffer) => {
|
||||
if (stderr.length < MAX_OUTPUT) stderr += data.toString();
|
||||
});
|
||||
child.on('close', (code) => {
|
||||
if (capped) return;
|
||||
if (code === 0) finish(null);
|
||||
else finish(new Error(stderr.trim() || `docker compose config exited with code ${code}`));
|
||||
});
|
||||
child.on('error', (err) => finish(err));
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Render the fully-resolved effective Compose model via `docker compose
|
||||
* config --format json`. This is the AUTHORED model: it does NOT splice in
|
||||
|
||||
@@ -16,6 +16,7 @@ import {
|
||||
} from '../helpers/notificationSchedule';
|
||||
import { readSnapshotFileRow, type SnapshotFileReadResult, type SnapshotFileRow } from '../helpers/snapshotFileDecrypt';
|
||||
import { sanitizeForLog } from '../utils/safeLog';
|
||||
import type { GitSourceManifestState } from '../types/gitProjectManifest';
|
||||
|
||||
export type { SnapshotFileReadResult } from '../helpers/snapshotFileDecrypt';
|
||||
|
||||
@@ -446,6 +447,9 @@ export interface StackGitSource {
|
||||
pending_fetched_at: number | null;
|
||||
last_debounce_at: number | null;
|
||||
applied_deploy_spec: GitSourceAppliedSpec | null; // deploy-time materialized file set; null = single-file auto-discovery
|
||||
manifest_version: number | null; // cache of the managed-project manifest's manifestVersion (file is the source of truth)
|
||||
manifest_state: GitSourceManifestState | null; // DB-only enum, wider than the file state; see types/gitProjectManifest.ts
|
||||
manifest_generation: string | null; // stack-relative path of the applied generation dir
|
||||
created_at: number;
|
||||
updated_at: number;
|
||||
}
|
||||
@@ -1140,6 +1144,7 @@ export class DatabaseService {
|
||||
this.migrateFleetSyncStickyError();
|
||||
this.migrateStackDossierHashes();
|
||||
this.migrateGitSourceMultiFile();
|
||||
this.migrateGitSourceManifest();
|
||||
this.migrateNodeUpdateSkips();
|
||||
this.migrateStackAlertServiceScope();
|
||||
|
||||
@@ -2509,6 +2514,14 @@ export class DatabaseService {
|
||||
this.tryAddColumn('stack_dossiers', 'last_drift_check_at', 'INTEGER');
|
||||
}
|
||||
|
||||
private migrateGitSourceManifest(): void {
|
||||
// Cache columns for the managed-project manifest (the manifest FILE in
|
||||
// <DATA_DIR>/git-managed/<nodeId>/<stackName>/ is the source of truth).
|
||||
this.tryAddColumn('stack_git_sources', 'manifest_version', 'INTEGER');
|
||||
this.tryAddColumn('stack_git_sources', 'manifest_state', 'TEXT');
|
||||
this.tryAddColumn('stack_git_sources', 'manifest_generation', 'TEXT');
|
||||
}
|
||||
|
||||
private migrateGitSourceMultiFile(): void {
|
||||
this.tryAddColumn('stack_git_sources', 'compose_paths', 'TEXT');
|
||||
this.tryAddColumn('stack_git_sources', 'context_dir', 'TEXT');
|
||||
@@ -6171,6 +6184,9 @@ export class DatabaseService {
|
||||
compose_paths: this.normalizeComposePaths(row.compose_paths, composePath),
|
||||
context_dir: (row.context_dir as string | null) ?? null,
|
||||
applied_deploy_spec: this.parseAppliedDeploySpec(row.applied_deploy_spec),
|
||||
manifest_version: row.manifest_version !== undefined && row.manifest_version !== null ? Number(row.manifest_version) : null,
|
||||
manifest_state: (row.manifest_state as GitSourceManifestState | null) ?? null,
|
||||
manifest_generation: (row.manifest_generation as string | null) ?? null,
|
||||
sync_env: Number(row.sync_env) === 1,
|
||||
env_path: (row.env_path as string | null) ?? null,
|
||||
auth_type: row.auth_type as GitSourceAuthType,
|
||||
@@ -6199,7 +6215,7 @@ export class DatabaseService {
|
||||
return rows.map(r => this.parseGitSource(r)!);
|
||||
}
|
||||
|
||||
public upsertGitSource(source: Omit<StackGitSource, 'id' | 'created_at' | 'updated_at' | 'applied_deploy_spec'>): number {
|
||||
public upsertGitSource(source: Omit<StackGitSource, 'id' | 'created_at' | 'updated_at' | 'applied_deploy_spec' | 'manifest_version' | 'manifest_state' | 'manifest_generation'>): number {
|
||||
const now = Date.now();
|
||||
const existing = this.getGitSource(source.stack_name);
|
||||
const composePathsJson = JSON.stringify(source.compose_paths ?? [source.compose_path]);
|
||||
@@ -6253,6 +6269,18 @@ export class DatabaseService {
|
||||
this.db.prepare('DELETE FROM stack_git_sources WHERE stack_name = ?').run(stackName);
|
||||
}
|
||||
|
||||
/**
|
||||
* Persist the managed-project manifest cache columns. The manifest FILE in
|
||||
* the managed area is the source of truth; these columns are cheap
|
||||
* projections for GET/dashboard reads and carry the two states the file
|
||||
* cannot express ('migration_required', 'absent').
|
||||
*/
|
||||
public setGitSourceManifestState(stackName: string, version: number | null, state: GitSourceManifestState | null, generation: string | null): void {
|
||||
this.db.prepare(
|
||||
`UPDATE stack_git_sources SET manifest_version = ?, manifest_state = ?, manifest_generation = ?, updated_at = ? WHERE stack_name = ?`
|
||||
).run(version, state, generation, Date.now(), stackName);
|
||||
}
|
||||
|
||||
public setGitSourcePending(stackName: string, commitSha: string, composeContent: string, envContent: string | null): void {
|
||||
this.db.prepare(
|
||||
`UPDATE stack_git_sources SET
|
||||
|
||||
@@ -16,6 +16,7 @@ import {
|
||||
import { ComposeService } from './ComposeService';
|
||||
import DockerController from './DockerController';
|
||||
import { FileSystemService } from './FileSystemService';
|
||||
import { GitProjectManifestService } from './GitProjectManifestService';
|
||||
import { NodeRegistry } from './NodeRegistry';
|
||||
import { MeshService } from './MeshService';
|
||||
import { NotificationService } from './NotificationService';
|
||||
@@ -363,6 +364,9 @@ export class DeployedStackDeletionService {
|
||||
db.clearStackScanAttempts(nodeId, stackName);
|
||||
db.deleteRoleAssignmentsByStack(nodeId, stackName);
|
||||
db.deleteGitSource(stackName);
|
||||
// R6: the managed-project area must not outlive the stack; failures are
|
||||
// logged inside, never fatal to the deletion.
|
||||
await GitProjectManifestService.getInstance().deleteManagedArea(stackName);
|
||||
db.deleteStackDossier(nodeId, stackName);
|
||||
db.deleteStackDriftFindings(nodeId, stackName);
|
||||
db.deleteStackExposureIntents(nodeId, stackName);
|
||||
|
||||
@@ -300,22 +300,26 @@ export class FileSystemService {
|
||||
return null;
|
||||
}
|
||||
|
||||
private async listStacksRaw(): Promise<string[]> {
|
||||
const items = await fsPromises.readdir(this.baseDir, { withFileTypes: true });
|
||||
const stackNames: string[] = [];
|
||||
|
||||
for (const item of items) {
|
||||
if (!item.isDirectory()) continue;
|
||||
if (!item.name || typeof item.name !== 'string') continue;
|
||||
|
||||
const stackDir = path.join(this.baseDir, item.name);
|
||||
if (await this.hasComposeFile(stackDir)) {
|
||||
stackNames.push(item.name);
|
||||
}
|
||||
}
|
||||
|
||||
return stackNames;
|
||||
}
|
||||
|
||||
async getStacks(): Promise<string[]> {
|
||||
try {
|
||||
const items = await fsPromises.readdir(this.baseDir, { withFileTypes: true });
|
||||
const stackNames: string[] = [];
|
||||
|
||||
for (const item of items) {
|
||||
if (!item.isDirectory()) continue;
|
||||
if (!item.name || typeof item.name !== 'string') continue;
|
||||
|
||||
const stackDir = path.join(this.baseDir, item.name);
|
||||
if (await this.hasComposeFile(stackDir)) {
|
||||
stackNames.push(item.name);
|
||||
}
|
||||
}
|
||||
|
||||
return stackNames;
|
||||
return await this.listStacksRaw();
|
||||
} catch (error: any) {
|
||||
if (error?.code === 'ENOMEM') {
|
||||
const freeMiB = Math.round(os.freemem() / (1024 * 1024));
|
||||
@@ -327,6 +331,16 @@ export class FileSystemService {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Like getStacks(), but PROPAGATES listing errors instead of returning an
|
||||
* empty list. Callers that must distinguish "no stacks" from "could not
|
||||
* list stacks" (the boot orphan sweep) use this variant: a swallowed read
|
||||
* failure must never look like every stack disappeared.
|
||||
*/
|
||||
async getStacksStrict(): Promise<string[]> {
|
||||
return this.listStacksRaw();
|
||||
}
|
||||
|
||||
async getStackContent(stackName: string): Promise<string> {
|
||||
try {
|
||||
const filePath = await this.getComposeFilePath(stackName);
|
||||
@@ -363,11 +377,14 @@ export class FileSystemService {
|
||||
}
|
||||
}
|
||||
|
||||
async saveStackContent(stackName: string, content: string): Promise<void> {
|
||||
async saveStackContent(stackName: string, content: string | Buffer): Promise<void> {
|
||||
const stackDir = this.resolveStackDir(stackName);
|
||||
const filePath = path.join(stackDir, 'compose.yaml');
|
||||
await this.assertRealWithinBase(filePath);
|
||||
try {
|
||||
// Buffer input is written byte-exact (the encoding option is ignored for
|
||||
// Buffers); string input keeps the utf-8 write. Byte-exactness matters to
|
||||
// the Git materializer, whose content hashes are computed over raw bytes.
|
||||
await fsPromises.writeFile(filePath, content, 'utf-8');
|
||||
} catch (error) {
|
||||
console.error('Error writing file:', error);
|
||||
@@ -1806,7 +1823,7 @@ export class FileSystemService {
|
||||
async writeStackFile(
|
||||
stackName: string,
|
||||
relPath: string,
|
||||
content: string,
|
||||
content: string | Buffer,
|
||||
opts?: { exclusive?: boolean },
|
||||
): Promise<void> {
|
||||
const safePath = await this.resolveSafeStackPath(stackName, relPath);
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -257,7 +257,17 @@ export class UpdateGuardService {
|
||||
containers,
|
||||
}, now);
|
||||
|
||||
return { stack: stackName, computedAt: now, overall: aggregateRollbackOverall(items), items };
|
||||
// Partial-revert disclosure for Git-managed stacks: rollback restores only
|
||||
// compose files and .env; the rest of the materialized project is not
|
||||
// reverted by the backup slot. State the scope rather than imply a
|
||||
// complete revert.
|
||||
let note: string | undefined;
|
||||
const gitSource = db.getGitSource(stackName);
|
||||
if (gitSource && (gitSource.manifest_state === 'active' || gitSource.manifest_state === 'partial' || gitSource.manifest_state === 'migrated')) {
|
||||
note = 'This stack is Git-managed. Rollback restores compose files and .env; other materialized inputs are not reverted. Re-apply the previous revision from Git to restore them.';
|
||||
}
|
||||
|
||||
return { stack: stackName, computedAt: now, overall: aggregateRollbackOverall(items), items, note };
|
||||
}
|
||||
|
||||
/** Host disk use percent for the main filesystem, or null when unavailable. */
|
||||
|
||||
@@ -52,6 +52,12 @@ export interface RollbackReadinessReport {
|
||||
computedAt: number;
|
||||
overall: RollbackOverall;
|
||||
items: RollbackReadinessItem[];
|
||||
/**
|
||||
* Scope disclosure for stacks whose project is partly Git-managed: rollback
|
||||
* restores compose files and .env only; other materialized inputs are not
|
||||
* reverted. Set when the stack has a managed-project manifest.
|
||||
*/
|
||||
note?: string;
|
||||
}
|
||||
|
||||
/** Normalized per-container probe used by readiness and the health gate. */
|
||||
|
||||
@@ -0,0 +1,260 @@
|
||||
/**
|
||||
* Canonical types for the Git managed-project materialization contract (the
|
||||
* single repository file inventory consumed by every GitOps feature).
|
||||
*
|
||||
* The manifest FILE is the source of truth; `stack_git_sources` cache columns
|
||||
* are cheap projections for GET/dashboard reads. The manifest is treated as
|
||||
* untrusted input on every read: shape, enum membership, and the identity
|
||||
* stamp are validated before any field is honored.
|
||||
*/
|
||||
|
||||
/** File-side manifest state: what the manifest file itself can express. */
|
||||
export type ManifestState = 'none' | 'migrated' | 'active' | 'partial' | 'unsupported';
|
||||
|
||||
/**
|
||||
* DB-column manifest state, strictly wider than the file-side state.
|
||||
* `migration_required` means a manifest was expected but could not be trusted
|
||||
* (corrupt shape, identity mismatch, declined crash-recovery restore);
|
||||
* `absent` means no manifest file exists yet. Neither can be expressed by a
|
||||
* manifest file, so they live only in the DB column and the GET projection.
|
||||
*/
|
||||
export type GitSourceManifestState = ManifestState | 'migration_required' | 'absent';
|
||||
|
||||
export type InputOwnership = 'managed' | 'unmanaged';
|
||||
export type ManifestProvenance = 'fetch' | 'migration' | 'adopted';
|
||||
export type InputSensitivity = 'high' | 'medium' | 'low';
|
||||
export type InputState = 'present' | 'tombstoned';
|
||||
export type DeletionAuthority = 'sencho' | 'user' | 'none';
|
||||
|
||||
export type InputRole =
|
||||
| 'compose-primary'
|
||||
| 'compose-additional'
|
||||
| 'compose-override'
|
||||
| 'env'
|
||||
| 'config'
|
||||
| 'secret'
|
||||
| 'label-file'
|
||||
| 'build-context'
|
||||
| 'dockerfile'
|
||||
| 'build-secret'
|
||||
| 'build-additional-context'
|
||||
| 'bind-mount'
|
||||
| 'other';
|
||||
|
||||
export type InputDependencyKind =
|
||||
| 'explicit'
|
||||
| 'implicit-override'
|
||||
| 'include'
|
||||
| 'include-env'
|
||||
| 'extends'
|
||||
| 'env_file'
|
||||
| 'interpolation-env'
|
||||
| 'config'
|
||||
| 'secret'
|
||||
| 'label_file'
|
||||
| 'build-context'
|
||||
| 'dockerfile'
|
||||
| 'build-secret'
|
||||
| 'build-additional-context'
|
||||
| 'sync-env'
|
||||
| 'bind-mount';
|
||||
|
||||
/** One materialized or referenced input. Exactly one authoritative entry per input. */
|
||||
export interface ComposeInputEntry {
|
||||
/** Repo-relative source path; null for host/unmanaged references. */
|
||||
sourcePath: string | null;
|
||||
/** Stack-relative path after materialization; null when not copied. */
|
||||
materializedPath: string | null;
|
||||
role: InputRole;
|
||||
dependencyKind: InputDependencyKind;
|
||||
ownership: InputOwnership;
|
||||
provenance: ManifestProvenance;
|
||||
sensitivity: InputSensitivity;
|
||||
/** Null for unmanaged/refused entries. */
|
||||
contentSha256: string | null;
|
||||
sizeBytes: number | null;
|
||||
state: InputState;
|
||||
/** Who may delete this path during stale cleanup (manifest-scoped authority). */
|
||||
deletionAuthority: DeletionAuthority;
|
||||
/** Refusal reason / documented limitation. */
|
||||
note: string | null;
|
||||
}
|
||||
|
||||
export interface RefusalInfo {
|
||||
sourcePath: string | null;
|
||||
kind: string;
|
||||
reason: string;
|
||||
actionable: boolean;
|
||||
/**
|
||||
* Sensitivity of the declared input the refusal is about; public
|
||||
* projections redact high-sensitivity refusals. Absent on refusals from
|
||||
* older manifests (treated as not sensitive).
|
||||
*/
|
||||
sensitivity?: InputSensitivity;
|
||||
}
|
||||
|
||||
export interface BuildContextPlan {
|
||||
/** Context root in the materialized (stack-relative) layout. */
|
||||
repoPath: string;
|
||||
/** Repo-relative dockerfile path within the context, if declared. */
|
||||
dockerfile: string | null;
|
||||
/** Materialized context size after dockerignore filtering. */
|
||||
contextBytes: number;
|
||||
ignoredCount: number;
|
||||
dockerignoreApplied: boolean;
|
||||
/** True when the context is not copied (refused). */
|
||||
excludedFromCopy: boolean;
|
||||
note: string | null;
|
||||
/**
|
||||
* File-level inventory of the materialized context (context-relative paths
|
||||
* with content hashes). Gives the context file-granular ownership: local
|
||||
* edits and files removed upstream are detected per file, so a removed file
|
||||
* can be cleared on promotion and a locally edited one refuses apply.
|
||||
*/
|
||||
files: Array<{ path: string; sha256: string; sizeBytes: number }>;
|
||||
}
|
||||
|
||||
export interface ManifestBounds {
|
||||
maxFiles: number;
|
||||
maxBytes: number;
|
||||
maxContextBytes: number;
|
||||
maxPathDepth: number;
|
||||
maxFileBytes: number;
|
||||
}
|
||||
|
||||
/** Stamp that binds a manifest to exactly one stack on one node. */
|
||||
export interface ManifestIdentity {
|
||||
nodeId: string;
|
||||
stackName: string;
|
||||
repoUrl: string;
|
||||
branch: string;
|
||||
}
|
||||
|
||||
export interface GitProjectManifest {
|
||||
schemaVersion: 1;
|
||||
/** Incremented on every successful write. */
|
||||
manifestVersion: number;
|
||||
state: ManifestState;
|
||||
generatedAt: number;
|
||||
identity: ManifestIdentity;
|
||||
repo: { url: string; branch: string };
|
||||
resolvedRevision: { commitSha: string; fetchedAt: number };
|
||||
project: {
|
||||
/** Repo-relative project root (today's context_dir); null = repo root. */
|
||||
root: string | null;
|
||||
/** Ordered explicit repo-relative compose file set. */
|
||||
composeFiles: string[];
|
||||
/** Stack-relative, passed as --project-directory. */
|
||||
effectiveProjectDir: string | null;
|
||||
/** Pinned via -p. */
|
||||
projectName: string;
|
||||
/** Ordered compose invocation args (relative paths). */
|
||||
invocation: string[];
|
||||
};
|
||||
inputs: ComposeInputEntry[];
|
||||
refusals: RefusalInfo[];
|
||||
buildContexts: BuildContextPlan[];
|
||||
generation: { candidateDir: string; appliedDir: string; previousDir: string | null };
|
||||
counts: { managed: number; unmanaged: number; refused: number };
|
||||
bounds: ManifestBounds;
|
||||
}
|
||||
|
||||
/**
|
||||
* Public projection of one manifest input, served by the manifest read
|
||||
* endpoint. Hashes, size metadata, and provenance are internal-only; the
|
||||
* display path is redacted (null) for high-sensitivity inputs so secret file
|
||||
* names never cross the API.
|
||||
*/
|
||||
export interface PublicManifestInput {
|
||||
/** Display label; null when redacted (high-sensitivity input) or when the input has no path. */
|
||||
path: string | null;
|
||||
role: InputRole;
|
||||
dependencyKind: InputDependencyKind;
|
||||
ownership: InputOwnership;
|
||||
sensitivity: InputSensitivity;
|
||||
state: InputState;
|
||||
note: string | null;
|
||||
}
|
||||
|
||||
/** Public projection of the internal manifest (no hashes, no sensitive paths). */
|
||||
export interface PublicManifest {
|
||||
manifestVersion: number;
|
||||
state: ManifestState;
|
||||
resolvedCommitSha: string | null;
|
||||
projectRoot: string | null;
|
||||
composeFiles: string[];
|
||||
projectName: string;
|
||||
inputs: PublicManifestInput[];
|
||||
counts: { managed: number; unmanaged: number; refused: number };
|
||||
}
|
||||
|
||||
/** Projection served by GET /git-source and the manifest read endpoint. */
|
||||
export interface ManifestSummary {
|
||||
state: GitSourceManifestState;
|
||||
manifestVersion: number;
|
||||
resolvedCommitSha: string | null;
|
||||
managedCount: number;
|
||||
unmanagedCount: number;
|
||||
refusedCount: number;
|
||||
/** Actionable refusals surfaced to the UI. */
|
||||
refused: RefusalInfo[];
|
||||
hasBuildContexts: boolean;
|
||||
generatedAt: number | null;
|
||||
}
|
||||
|
||||
// --- Discovery result types (declared here so they land once) ---
|
||||
|
||||
/** A declared input found by the pure parser (no I/O yet). */
|
||||
export interface DeclaredInput {
|
||||
/** Repo-relative or host path; null for non-path forms. */
|
||||
sourcePath: string | null;
|
||||
/**
|
||||
* Stack-relative path the input occupies at runtime; null for host paths,
|
||||
* non-path forms, and the dockerfile declaration (which is resolved
|
||||
* relative to its build context in planBuildContexts). Diverges from
|
||||
* sourcePath when the runtime layout relocates a file: the primary compose
|
||||
* file lands at the stack root, so its include/extends graph AND every
|
||||
* project-relative declaration in the primary or in merged (-f) files
|
||||
* shifts by the primary's repository directory prefix.
|
||||
*/
|
||||
materializedPath: string | null;
|
||||
baseDir: 'repo-root' | 'project-root' | 'compose-file-dir' | 'host';
|
||||
kind: InputDependencyKind;
|
||||
role: InputRole;
|
||||
/**
|
||||
* When false (env_file map form with required: false), a missing file is
|
||||
* recorded as an unmanaged entry (never a refusal).
|
||||
*/
|
||||
required: boolean;
|
||||
/** Compose source context for diagnostics. */
|
||||
fromFile: string | null;
|
||||
/**
|
||||
* Service name that declared this input (build declarations, env_file,
|
||||
* configs references). Pairs a build context with its own dockerfile,
|
||||
* build secrets, and additional contexts when a file declares several
|
||||
* services. Null for top-level declarations.
|
||||
*/
|
||||
service: string | null;
|
||||
}
|
||||
|
||||
/** Path with ${VAR} interpolation that Compose resolves at deploy time. */
|
||||
export interface DynamicInput {
|
||||
sourcePath: string;
|
||||
kind: InputDependencyKind;
|
||||
note: string;
|
||||
}
|
||||
|
||||
export interface ParsedDeclaredInputs {
|
||||
inputs: DeclaredInput[];
|
||||
dynamic: DynamicInput[];
|
||||
parseErrors: string[];
|
||||
}
|
||||
|
||||
/** Classification of every declared input against the cloned tree. */
|
||||
export interface InventoryResult {
|
||||
inputs: ComposeInputEntry[];
|
||||
refusals: RefusalInfo[];
|
||||
buildContexts: BuildContextPlan[];
|
||||
dynamic: DynamicInput[];
|
||||
counts: { managed: number; unmanaged: number; refused: number };
|
||||
}
|
||||
@@ -0,0 +1,185 @@
|
||||
/**
|
||||
* Minimal Docker .dockerignore matcher, vendored to avoid a dependency for the
|
||||
* git managed-project materializer. Implements the semantics docker's
|
||||
* patternmatcher uses (docs.docker.com "Context" / moby/patternmatcher):
|
||||
*
|
||||
* - Patterns are matched against the path relative to the context root.
|
||||
* - A pattern with no slash matches the basename at any depth (`*.md` matches
|
||||
* `README.md` and `sub/README.md`); a pattern with a slash (with or without a
|
||||
* leading `/`) is anchored to the root.
|
||||
* - `**` crosses directories; `*`, `?` and `[...]` apply within one segment.
|
||||
* - A trailing `/` restricts the pattern to directories.
|
||||
* - `!` negates; the LAST matching pattern wins.
|
||||
* - `#` starts a comment; `\#` is a literal `#`. Empty lines are ignored.
|
||||
* - Dotfiles are matched by default (unlike gitignore).
|
||||
*
|
||||
* Callers must prune directory subtrees: when a directory path matches, every
|
||||
* file beneath it is ignored as well.
|
||||
*/
|
||||
|
||||
export interface DockerIgnoreMatcher {
|
||||
/** True when `relPath` (context-root-relative, posix) is ignored. */
|
||||
matches(relPath: string, isDir?: boolean): boolean;
|
||||
}
|
||||
|
||||
function escapeRegExpSegment(input: string): string {
|
||||
return input.replace(/[.+^${}()|[\]\\]/g, '\\$&');
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert one dockerignore segment (`**`, `*`, `?`, `[...]`, literal text) into
|
||||
* a regex source that does not cross `/`.
|
||||
*/
|
||||
function segmentToRegex(segment: string): string {
|
||||
let out = '';
|
||||
let i = 0;
|
||||
while (i < segment.length) {
|
||||
const ch = segment[i];
|
||||
if (ch === '*') {
|
||||
if (segment[i + 1] === '*') {
|
||||
// `**` inside a segment is docker's "match across directories";
|
||||
// when it is a full segment the caller emits `.*` instead. Here
|
||||
// it can only appear as a partial-segment oddity; treat as `.*`.
|
||||
out += '.*';
|
||||
i += 2;
|
||||
continue;
|
||||
}
|
||||
out += '[^/]*';
|
||||
i += 1;
|
||||
continue;
|
||||
}
|
||||
if (ch === '?') {
|
||||
out += '[^/]';
|
||||
i += 1;
|
||||
continue;
|
||||
}
|
||||
if (ch === '[') {
|
||||
const close = segment.indexOf(']', i + 1);
|
||||
if (close === -1) {
|
||||
out += '\\[';
|
||||
i += 1;
|
||||
continue;
|
||||
}
|
||||
const inner = segment.slice(i + 1, close);
|
||||
// Preserve negation and ranges; escape backslashes; keep the class
|
||||
// as-is otherwise (docker passes character classes through).
|
||||
out += '[' + inner.replace(/\\/g, '\\\\') + ']';
|
||||
i = close + 1;
|
||||
continue;
|
||||
}
|
||||
if (ch === '\\' && i + 1 < segment.length) {
|
||||
// Escaped char: `\#` yields a literal `#`; any other escape is
|
||||
// passed through as the literal character.
|
||||
out += escapeRegExpSegment(segment[i + 1]);
|
||||
i += 2;
|
||||
continue;
|
||||
}
|
||||
out += escapeRegExpSegment(ch);
|
||||
i += 1;
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
interface CompiledPattern {
|
||||
regex: RegExp;
|
||||
negate: boolean;
|
||||
dirOnly: boolean;
|
||||
basenameOnly: boolean;
|
||||
}
|
||||
|
||||
function compilePattern(rawLine: string): CompiledPattern | null {
|
||||
let line = rawLine.trim();
|
||||
if (!line) return null;
|
||||
|
||||
// Escaped comment marker: `\#` starts a literal pattern; an unescaped `#`
|
||||
// at the start is a comment.
|
||||
if (line.startsWith('#')) return null;
|
||||
if (line.startsWith('\\#')) {
|
||||
line = line.slice(1);
|
||||
}
|
||||
|
||||
let negate = false;
|
||||
if (line.startsWith('!')) {
|
||||
negate = true;
|
||||
line = line.slice(1).trim();
|
||||
if (!line) return null; // bare `!` is a no-op in docker
|
||||
}
|
||||
|
||||
let dirOnly = false;
|
||||
if (line.endsWith('/')) {
|
||||
dirOnly = true;
|
||||
line = line.slice(0, -1);
|
||||
}
|
||||
if (!line) return null;
|
||||
|
||||
// A leading `/` anchors to the root; strip it (root-anchoring is the
|
||||
// default for slash-bearing patterns).
|
||||
const anchored = line.startsWith('/');
|
||||
if (anchored) line = line.slice(1);
|
||||
|
||||
const segments = line.split('/');
|
||||
const basenameOnly = !anchored && segments.length === 1;
|
||||
|
||||
let source = '';
|
||||
if (basenameOnly) {
|
||||
// Match the basename at any depth.
|
||||
source = '(?:^|.*/)' + segmentToRegex(segments[0]) + '$';
|
||||
} else {
|
||||
// A `**` segment compiles to `(?:.*/)?` (zero or more directories,
|
||||
// consuming its own trailing slash) or `.*` when trailing. Separators
|
||||
// are inserted between consecutive parts only when the previous part
|
||||
// was NOT compiled from `**` (those parts already carry their separator).
|
||||
const parts: string[] = [];
|
||||
for (let i = 0; i < segments.length; i++) {
|
||||
if (segments[i] === '**') {
|
||||
parts.push(i === segments.length - 1 ? '.*' : '(?:.*/)?');
|
||||
} else {
|
||||
parts.push(segmentToRegex(segments[i]));
|
||||
}
|
||||
}
|
||||
source = parts[0];
|
||||
for (let i = 1; i < parts.length; i++) {
|
||||
if (segments[i - 1] !== '**') source += '/';
|
||||
source += parts[i];
|
||||
}
|
||||
}
|
||||
|
||||
return { regex: new RegExp('^' + source + '$'), negate, dirOnly, basenameOnly };
|
||||
}
|
||||
|
||||
export function compileDockerIgnore(lines: string[]): DockerIgnoreMatcher {
|
||||
const patterns = lines.map(compilePattern).filter((p): p is CompiledPattern => p !== null);
|
||||
return {
|
||||
matches(relPath: string, isDir: boolean): boolean {
|
||||
const normalized = relPath.replace(/\\/g, '/').replace(/^\/+/, '');
|
||||
if (!normalized) return false;
|
||||
const base = normalized.slice(normalized.lastIndexOf('/') + 1);
|
||||
let ignored = false;
|
||||
for (const p of patterns) {
|
||||
if (p.dirOnly && !isDir) continue;
|
||||
const target = p.basenameOnly ? base : normalized;
|
||||
if (p.regex.test(target)) {
|
||||
ignored = !p.negate;
|
||||
}
|
||||
}
|
||||
return ignored;
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Load a Docker ignore file from a directory. Defaults to `.dockerignore`;
|
||||
* pass an explicit filename for the Dockerfile-specific
|
||||
* `<DockerfileName>.dockerignore` precedence form. Returns null when no file
|
||||
* exists or it cannot be read (nothing ignored).
|
||||
*/
|
||||
export async function loadDockerIgnore(rootDir: string, filename = '.dockerignore'): Promise<DockerIgnoreMatcher | null> {
|
||||
const fs = await import('fs');
|
||||
const path = await import('path');
|
||||
try {
|
||||
const raw = await fs.promises.readFile(path.join(rootDir, filename), 'utf8');
|
||||
return compileDockerIgnore(raw.split(/\r?\n/));
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
@@ -29,7 +29,7 @@ The panel groups four regions:
|
||||
- **Pending update banner.** Appears at the top when a webhook in **Review only** mode has fetched a new commit. Click **Review** to re-fetch the incoming commit and open the diff dialog.
|
||||
- **Form fields.** Repository URL, branch, the ordered compose-file picker, an optional project directory, optional sibling `.env` sync, authentication toggle, and the apply behavior radio group.
|
||||
- **Last applied stat strip.** Shows the short SHA of the last commit Sencho applied to disk, plus the timestamp of the most recent successful save or pull.
|
||||
- **Footer actions.** **Remove** disconnects the source without touching the stack files; **Pull now** fetches the configured branch's HEAD; **Save** or **Update** persists form changes after a reachability check passes.
|
||||
- **Footer actions.** **Remove** disconnects the source by exporting the effective compose model into a single `compose.yaml` and removing auto-discovered override files; the remaining materialized files are kept. **Pull now** fetches the configured branch's HEAD; **Save** or **Update** persists form changes after a reachability check passes.
|
||||
|
||||
## Create a stack from a Git repository
|
||||
|
||||
@@ -221,7 +221,7 @@ Pulls, applies, and create-from-git operations on the same stack are serialized
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="A build context or volume points at an empty folder">
|
||||
Repositories that use Git submodules do not have their submodule contents cloned during a Git Source fetch. Sencho surfaces a warning on create when `.gitmodules` is present. If the compose file references paths inside a submodule (build contexts, volume mounts, include directives), inline the referenced files into the main repository or flatten the submodule so the paths resolve at deploy time.
|
||||
Repositories that use Git submodules do not have their submodule contents cloned during a Git Source fetch. Sencho surfaces a warning when `.gitmodules` is present, and refuses inputs and build contexts that reference submodule contents with an actionable message. Inline the referenced files into the main repository or flatten the submodule so the paths resolve at deploy time.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="An additional file named compose.yaml is rejected">
|
||||
@@ -229,7 +229,7 @@ Pulls, applies, and create-from-git operations on the same stack are serialized
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="A relative build context or extends target is missing with multiple files">
|
||||
A Git Source materializes only the compose and `.env` files you select, not the rest of the repository. Build contexts, bind-mount sources, and cross-file `extends:` targets referenced by relative path are not pulled, so they can be missing at deploy time. Set a **Project directory** to fix the base for relative paths, and for build-based stacks keep the referenced files in the repository alongside the compose files or build the image out of band.
|
||||
Git Sources materializes the complete project, including recursive `include:` and `extends.file` dependencies, service env files, file-backed configs and secrets, and build contexts. If a referenced file is still missing, the pull refused it and the refusal message names the path and the reason (out-of-bound path, Git LFS pointer, submodule, symlink, or a size cap). Fix the declaration in the repository and pull again.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Only HTTPS is supported">
|
||||
@@ -241,8 +241,12 @@ Pulls, applies, and create-from-git operations on the same stack are serialized
|
||||
|
||||
- **HTTPS only.** SSH URLs and SSH keys are not supported. Use a Personal Access Token for private repos.
|
||||
- **No Git LFS.** Compose and env files stored via LFS are rejected. Commit plain files instead.
|
||||
- **No submodules.** Submodule contents are not fetched; paths inside a submodule directory will be missing at deploy time. A warning is shown on create when `.gitmodules` is present.
|
||||
- **Branch-tracking only.** Sources follow the head of a branch. Specific commit SHAs and tags are not pinnable.
|
||||
- **No submodules.** Submodule contents are not fetched. Inputs and build contexts that reference submodule contents are refused with an actionable message; a warning is shown when `.gitmodules` is present.
|
||||
- **Branch-tracking only.** Sources follow the head of a branch. Specific commit SHAs and tags are not pinnable. Each pull resolves and pins the exact commit SHA, so apply always materializes the reviewed revision.
|
||||
- **Clone size cap.** A clone is bounded on how much it downloads (and each compose/env file is capped on read), so very large repositories are rejected. Operators can adjust the download ceiling with `GITSOURCE_MAX_CLONE_BYTES`.
|
||||
- **Referenced files are not materialized.** Only the selected compose and `.env` files are written to disk. Relative build contexts, bind-mount sources, and `extends:` targets are not pulled, so build-based stacks that depend on other repository files need those files committed alongside the compose files (or the image built out of band).
|
||||
- **Complete project materialization.** Every repository-local input the project needs is materialized: the ordered compose files, implicit `compose.override.*` files, recursive `include:` and `extends.file` dependencies, service env files, file-backed configs and secrets, label files, and build contexts with `.dockerignore` semantics. The materialized set is recorded in a versioned managed-project manifest, and each pull stages a candidate that is validated with the exact deployment invocation before anything on disk changes. If apply is interrupted, Sencho completes the accepted generation or restores the previous generation. If files were edited during the interruption and no longer match either generation, Sencho preserves them and requires manual recovery instead of overwriting them.
|
||||
- **Unsupported inputs are refused, not guessed.** Inputs that cannot be safely reproduced fail the pull with an actionable message: URL includes, Git LFS pointers, submodule contents, symbolic links, build contexts that exceed the size bounds, and include or extends declarations that point outside the repository or use dynamic `\${VAR}` paths (their contents cannot be enumerated). Nothing is applied until the declaration is fixed. Absolute host paths, host bind mounts, external resources, and dynamic `\${VAR}` data paths are never claimed as covered: they resolve at deploy time from the environment or the node, and the manifest records them as unmanaged.
|
||||
- **Materialization bounds.** The materialized project is bounded by file count, total bytes, per-file size, path depth, and build-context size, each adjustable with a `GITSOURCE_*` variable (see configuration). Crossing a bound refuses the pull with the counts so far rather than producing a partial project.
|
||||
- **Detach and export.** Removing a Git source renders the effective compose model into a single `compose.yaml`, keeps the remaining materialized files, removes auto-discovered override files so the exported model is final, and removes Git tracking. Resolved environment values are baked into the exported file. If removal is interrupted before it completes, Sencho restores the original files automatically.
|
||||
- **Rollback scope.** Rollback of a Git-managed stack restores compose files and `.env`. Other materialized inputs are not reverted by rollback; re-apply the previous revision from Git to restore them.
|
||||
- **Some read-only views read the primary file.** The dependency graph, drift snapshot, and networking inspector summarize the primary compose file, so a service declared only in an override may not appear in those views. Deploy, update, image-update checks, and mesh attachment use the full merged set.
|
||||
|
||||
@@ -49,6 +49,11 @@ These tune optional subsystems. Most deployments never set them; the defaults ar
|
||||
| `SENCHO_MESH_RECONCILE_INTERVAL_MS` | `60000` | How often the central instance re-checks proxy-mode mesh tunnels to detect a peer that rebooted. Lower it for faster peer-reboot detection at the cost of more frequent checks. See [Sencho Mesh](/features/sencho-mesh). |
|
||||
| `SENCHO_MESH_PROXY_TUNNEL_IDLE_MS` | `0` | Idle timeout before a proxy-mode mesh tunnel tears down and reopens on demand. `0` keeps the tunnel open for the life of the connection. See [Sencho Mesh](/features/sencho-mesh). |
|
||||
| `GITSOURCE_MAX_CLONE_BYTES` | `104857600` | Maximum bytes a single [Git Source](/features/git-sources) clone may download before it is aborted (100 MB). A shallow Compose clone is tiny; raise it only if you track Compose files in a legitimately large repository. |
|
||||
| `GITSOURCE_MAX_MATERIALIZED_FILES` | `10000` | Maximum number of files the complete-project materializer may write for one Git-managed stack. Crossing it refuses the pull with the count so far. |
|
||||
| `GITSOURCE_MAX_MATERIALIZED_BYTES` | `536870912` | Maximum total bytes the complete-project materializer may write for one Git-managed stack (512 MB). Crossing it refuses the pull with the count so far. |
|
||||
| `GITSOURCE_MAX_BUILD_CONTEXT_BYTES` | `268435456` | Maximum size of a single materialized build context after `.dockerignore` filtering (256 MB). A context that exceeds it, including a repository-root context, is refused. |
|
||||
| `GITSOURCE_MAX_PATH_DEPTH` | `64` | Maximum directory depth for a materialized repository path. Deeper paths are refused. |
|
||||
| `GITSOURCE_MAX_FILE_BYTES` | `10485760` | Maximum size of a single materialized file (10 MB). Oversized files are refused. |
|
||||
| `SENCHO_PUBLIC_URL` | *(request host)* | Set on the primary instance. Its externally reachable `http(s)://` URL, no trailing slash, baked into pilot enrollment so remote agents dial the public hostname rather than the address the admin used at setup. |
|
||||
| `SENCHO_COMPOSE_COMMAND_TIMEOUT_MS` | `1800000` | Hard timeout for a single Compose command (pull, up, down) during deploy and update, in milliseconds (30 minutes). Sencho kills the command and reports failure if it runs longer than this, regardless of whether it is still producing output. Raise it only for very large images or slow storage. |
|
||||
| `SENCHO_COMPOSE_STALL_TIMEOUT_MS` | `600000` | Idle-output backstop for deploy and update Compose steps (pull and recreate), separate from the hard timeout above. If a step produces no output for this long while still running, Sencho stops it so a hung image pull surfaces a clear failure and the in-app recovery actions instead of spinning. Raise it on slow links or for heavy local image builds. |
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCjHmvwxoL/JYqr
|
||||
+aKvQ7tBF9ZCtmSKlgyf3+CxakbcVsfLJEFJsnVpDrYb8QPlEqNYuLpjBo1CJT9i
|
||||
V3Zmzs7ZFOdtixuO8TFz3+ggNfWENVnCRmT4QU/k9V0ZCkrebf4NMQuYLrmt9nLm
|
||||
0E+UVFgf+a9yKE/r50YSjoNnNVxP78ES3E1tuJbDD1VPJCTdNSbBkdRs+/wQdrg3
|
||||
pFd2LvS60Enhp0TTLzfMUErIMD1kXnetA8kxaeBugAwdpCtbeVNOuY4QdyUkVlmK
|
||||
Rrl35vCIwD33ezYyXTpO1xIB40kQiN3VJTJxgyIIcvoF5vrrN+c4xlL3hUrllbWp
|
||||
rVd/rgMbAgMBAAECggEAStbX1lH140NhstKnofsU7GIX42bUjUMXyrhIWo30sf48
|
||||
z4a0T7BJryhZREuZql2ZRUkH9wwX/muhf6i6QaQMAkxVfAxxWe1ub4gg87peCUkD
|
||||
BCARDlfE5Lrwel8fB5t2jq3ccHerqFWk1SJpCJiEEDOaG+nD9WuYWkY5or44OtH8
|
||||
qBWtH89xQQQaYusGxSwswlZEl78krOU/vZhoQWcAz2NjuSPFhPzX0Uv4316SpVwW
|
||||
LmQnwQYFjSVxChQUk3ic3WqNp23R0BjgiHYL+FMrp/5MuiBZWRqNM6tEr4zm2s2v
|
||||
qTKTgfF/+Q654F+gJpsx+qC1uQAu5Nw5/Qu7gv4tdQKBgQDg1o16CpvrSitbAtwF
|
||||
yyVU0FF0U3r7c0/t/Ll0Wnpb3Z1cUWpFgybDzGr2im9Uq4eqGhZ59a7nbVF1L6U+
|
||||
FAhoS2u0lQioNaCBbDRPkVlA7jBofV+V2ekD64rgsIyITB4UWNVBL9odu5RRpLJS
|
||||
o/HGEQgZeFT6nScb+DIuc7OHPQKBgQC5ugRYK4HXAQ3wdKsJ1udKT8xLFlODaZim
|
||||
PBdX/RMUB/4I0x1tK2Cr5o9tPC/9XVI9yYhAqzV8qXr93eHa2JattEDYDmT2kjfQ
|
||||
8iXoJUy2W67QZ0DVEF8272Xz4g2TrzeaEYZV/zjUdufJAiO5Fk2nspLBAaTGqxKu
|
||||
cHeVgfMZNwKBgQC2sD7GkkY8ucherAUhQ/5yWs5Eqew80mZ45qe+DiJr8LeDIrgq
|
||||
ATYHVFr5NmTdtH6ITahDsshKTT4p7OvkdBycueOrGImvO9vOLaCXom+WXbPBw1Ve
|
||||
inBWehYfGfUmbkrml4O38uzUyezrJdqrYYD7Qi2FnIvYEseLZ3FG40ZVtQKBgG2g
|
||||
m0fgBnf+q1evxfW84DFBAPmhaBI9llkpRy4st8IvJYfX9Zqm7B0LrsVvrXQETbMi
|
||||
7kYdySiYcXzAJ7yh8+78YvolJPtWO5QeGrn4qltJqtpg2CfrzggDL07Rs+nklxFe
|
||||
HslMKSNgPFit5qAtxhCim3VJnxWVjSViRXP+jJvpAoGBAKQhoyhGCGfolHSddy7N
|
||||
efUDu+AJFLhGOZWuNvi4ExWF2hFXJAhH8LMuZ0/AY8E+ZJAKmkIPaRBYAj+Zvcub
|
||||
XrkH1Z6BwgFKUk/dOaoePItQYkdCFFAFslRj7l062bTUs2dKInCWvjgoa69SPCn7
|
||||
U4lpMm2XZomIRSXjAkpJdJXG
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,19 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDGzCCAgOgAwIBAgIUAl9Xewt3pNuCTvCaW6XFJjfI/I4wDQYJKoZIhvcNAQEL
|
||||
BQAwHTEbMBkGA1UEAwwSU2VuY2hvIEUyRSBUZXN0IENBMB4XDTI2MDgwNjE4MzMx
|
||||
MVoXDTM2MDgwMzE4MzMxMVowHTEbMBkGA1UEAwwSU2VuY2hvIEUyRSBUZXN0IENB
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAox5r8MaC/yWKq/mir0O7
|
||||
QRfWQrZkipYMn9/gsWpG3FbHyyRBSbJ1aQ62G/ED5RKjWLi6YwaNQiU/Yld2Zs7O
|
||||
2RTnbYsbjvExc9/oIDX1hDVZwkZk+EFP5PVdGQpK3m3+DTELmC65rfZy5tBPlFRY
|
||||
H/mvcihP6+dGEo6DZzVcT+/BEtxNbbiWww9VTyQk3TUmwZHUbPv8EHa4N6RXdi70
|
||||
utBJ4adE0y83zFBKyDA9ZF53rQPJMWngboAMHaQrW3lTTrmOEHclJFZZika5d+bw
|
||||
iMA993s2Ml06TtcSAeNJEIjd1SUycYMiCHL6Beb66zfnOMZS94VK5ZW1qa1Xf64D
|
||||
GwIDAQABo1MwUTAdBgNVHQ4EFgQUemat8qGDr9A4UViNzQ3Zog+4IKwwHwYDVR0j
|
||||
BBgwFoAUemat8qGDr9A4UViNzQ3Zog+4IKwwDwYDVR0TAQH/BAUwAwEB/zANBgkq
|
||||
hkiG9w0BAQsFAAOCAQEAaiDHpjNen0WNVJ+OzPNEBT32KsylyZikyEONULg3753T
|
||||
YKThj6cAmjtuZvllD3xW7A6pd31x0pARMdsowAFiQOl+dyPB64QViIm9MB+1Fqb9
|
||||
vGGpRTM4e4vaJItwAkm7nkbJgBhSVhm1NhHvXSOrqPf9oqyRS3Cxfta+KNoTJcwa
|
||||
eHC1+w5i5BVQXy4ZaD7raOPICwcFKHz6bOBly25DHgIzQQQrS57LgM9hMAJGJvuD
|
||||
4tAZjUIcXaEH1UQq6xtooBPpmBbUumvw1Xa2vV7md5ZN5YJt/8Kx+2t3JM77lFwd
|
||||
AxuuitUnZwEQlCgp567Z6XAuT4r3Q1dNW5oH88G/rw==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCUoeS5sZx32C3e
|
||||
RDTMtOa3BATYBVjyN/QEQ8JIp7wuHSlqMlbOgwwXNOYzWgjzmFV3wGADt7b3gt3c
|
||||
7UrM+NKDgzqMXnLtLiGbXowsUch/VuZNOcfdiqD4x18obpS6T/W9nTwu4NIzYLPe
|
||||
440PUfNNYw65W+YOvgzJVNtJdjSzQQAP8KAfVT9A4uXYaFUpd5HN7cda5Nb40ycI
|
||||
mmlN0oraBLzoIcNuR/GczDvTPZqIDcIUoMfwkCtmK95kwGPfJpiBPui0bVMo0JbJ
|
||||
u2xi2nHYldOJyCi+qMMF+ArDGIoftrEUbGcZvC6bXu8yPP4DEcGP8P7C3gkZ/8ct
|
||||
MwuYVv35AgMBAAECggEABx2XByLPJFennn/ybSht8S4Sk0ryPqpaFsgtqW/KTQTd
|
||||
YjWlvT492nCQYr35NrxAvzpo/lSRwFi2CWkczyJMZbpnF6g/5UXzmu4UVNzXde0x
|
||||
mlndTShhW3ekARoGKcNBNwIriuz9czM6eT24l5arSLWo00vogCUuFIdo9iPgEwLD
|
||||
cYp6bfZM+3p/jmJpazeIf5OC1CuZvkmKiaXd1jVN4NPbO8d0+LN1tNywO0oecV4u
|
||||
xJSrWz/bkLgep6p8iwKK+MLOr/9q7dPjrRe40Rq8rvyQEe+u49JQPUXTQXdaedtr
|
||||
z7z0iD/s1ic2a1gFpmZfaXautI41aH0ZiRmUax63gQKBgQDGM+mnHQt5191DL3f7
|
||||
nHhd9jkCiHFVFWGBBFCTRcJuB4chSqZHnFAzbP2xjpgiTPpSBoVSXqeDwyNGbTqu
|
||||
BSPvqEiK/RxmoKTHhRU+cP8fvJvZ4VTxFf8LIfuVuPtSXHTXhnaxJmtRYp7eVILH
|
||||
1ub+ozu/LOo80CE+nye+TPIe4QKBgQC/+X0p2PumV1FZ+DWt/Vrv3b5IQS30syh5
|
||||
KmaEePodtYF6hJSs96trbK8o41E+/nEOKXyu5WcEhmENJx7ipZRYsqGio0a7EO/W
|
||||
iA3FHHG3ECqE0OZcNl/fAfdv1aP5cuVZhWlY/6PWe9tk0kStLuYIvcix1pTd5Yyc
|
||||
h2z3zxM6GQKBgEtbL2m3FEbl+JzzrkV+jxECbVh2MciskV6xGkV0D2EwAYN501CE
|
||||
sMVsmePpGBRqef23tvbDQCNLjNzY6KeDEs+qhrI5W5P1XdDx20rbQVR6rDKhhl8H
|
||||
AunjqLibFQqSVmYfHH9r4P+XZFmZfgOmxDpqK2wbEo++ffVGI6EptiBhAoGAdfnJ
|
||||
rHT3OaNBkEvUGUewoeYgsOC1cELFpaij9dcuxiEsH/HoOF/ADbVt82+3F0JgkfZ2
|
||||
9DhwVbyLWfznoxtkjhnA8WTr67wd2DYmWDMBwyGBL7v9RT/5LOBVgnnFWl/8iEZP
|
||||
lm0L75yQGGaL4+4FWevfsUKQm8kc33juQ2ATjckCgYB1QHG26lDAEGDQN6oKtus1
|
||||
Jsh7Q7jyxSARqxbW53EBCI5P5CRhJsqD6VRZ621qWAd03RnvDENwHg+77Wh+DUQJ
|
||||
FNuaetYvVdWy/OR6vIJexlDkM6Eb++Dxd6zYoAjx+O0yulq4c1ApTdKvfvkFUfOV
|
||||
BKTCjelpTBvwUXh0K+LQKg==
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,19 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDHTCCAgWgAwIBAgIUdDKj2ycU64rpDK1kYSR++P7ZEIEwDQYJKoZIhvcNAQEL
|
||||
BQAwHTEbMBkGA1UEAwwSU2VuY2hvIEUyRSBUZXN0IENBMB4XDTI2MDgwNjE4MzMx
|
||||
MVoXDTM2MDgwMzE4MzMxMVowFDESMBAGA1UEAwwJMTI3LjAuMC4xMIIBIjANBgkq
|
||||
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlKHkubGcd9gt3kQ0zLTmtwQE2AVY8jf0
|
||||
BEPCSKe8Lh0pajJWzoMMFzTmM1oI85hVd8BgA7e294Ld3O1KzPjSg4M6jF5y7S4h
|
||||
m16MLFHIf1bmTTnH3Yqg+MdfKG6Uuk/1vZ08LuDSM2Cz3uOND1HzTWMOuVvmDr4M
|
||||
yVTbSXY0s0EAD/CgH1U/QOLl2GhVKXeRze3HWuTW+NMnCJppTdKK2gS86CHDbkfx
|
||||
nMw70z2aiA3CFKDH8JArZiveZMBj3yaYgT7otG1TKNCWybtsYtpx2JXTicgovqjD
|
||||
BfgKwxiKH7axFGxnGbwum17vMjz+AxHBj/D+wt4JGf/HLTMLmFb9+QIDAQABo14w
|
||||
XDAaBgNVHREEEzARhwR/AAABgglsb2NhbGhvc3QwHQYDVR0OBBYEFOG8ctpn+N0n
|
||||
Y/7EgbpfAdy9fGdwMB8GA1UdIwQYMBaAFHpmrfKhg6/QOFFYjc0N2aIPuCCsMA0G
|
||||
CSqGSIb3DQEBCwUAA4IBAQA4by3KANgv5xMMCm8yuFR89dmYx3sPtm9QH/qN7IZS
|
||||
aPO83LEB8oQUE8MMCEm3HzkMMAsvA27t8PLhy1Pu2m+i2JJxdXWFsYv3BVEqvtCn
|
||||
1uLxM+2jmXTFyrplQZRnMhGQQsvsouLvvwjy+xnR+eSlygavSUmAxUJJvl43tFoJ
|
||||
1L44J/Aqpk7xOjX7yFZenkBlPU3Q8LNMR/XIqhtHjtHNbPVuLmGR2vNASi7Hmf9n
|
||||
rtwwG8FwFnEWJ4XEYQpuNIbSAX2Ob81AV2km3+4e3J+RwsWj+qNlthYFEH6uIrek
|
||||
jdVobDhu9+gVozG/itWcLx9kM2SIBQxlcwCx+L8zVnKD
|
||||
-----END CERTIFICATE-----
|
||||
+227
-3
@@ -8,6 +8,7 @@
|
||||
*/
|
||||
import { test, expect, Page } from '@playwright/test';
|
||||
import { loginAs } from './helpers';
|
||||
import { gitAvailable, buildFixtureRepo, serveRepos, fullProjectFiles, multiFileFiles, refusalFiles } from './gitServer.helper';
|
||||
|
||||
const TEST_STACK = 'e2e-git-source-stack';
|
||||
|
||||
@@ -192,10 +193,10 @@ test.describe('Git Sources', () => {
|
||||
// footer button and not the picker's per-file "Remove <path>" buttons.
|
||||
await page.getByRole('dialog').getByRole('button', { name: 'Remove', exact: true }).click();
|
||||
await expect(page.getByRole('alertdialog')).toBeVisible({ timeout: 5_000 });
|
||||
await page.getByRole('alertdialog').getByRole('button', { name: /^Remove$/ }).click();
|
||||
await page.getByRole('alertdialog').getByRole('button', { name: /^Detach$/ }).click();
|
||||
|
||||
// After removal, the "Remove" button is gone from the panel footer.
|
||||
await expect(page.getByRole('dialog').getByRole('button', { name: /^Remove$/ })).not.toBeVisible({ timeout: 5_000 });
|
||||
// After detach, the "Detach" button is gone from the panel footer.
|
||||
await expect(page.getByRole('dialog').getByRole('button', { name: /^Detach$/ })).not.toBeVisible({ timeout: 5_000 });
|
||||
});
|
||||
});
|
||||
|
||||
@@ -382,3 +383,226 @@ test.describe('Create stack from Git', () => {
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('Git Sources complete-project materialization (local git server)', () => {
|
||||
test.skip(!gitAvailable(), 'system git binary is not available');
|
||||
|
||||
let server: { url: string; close: () => void };
|
||||
let stackName: string;
|
||||
|
||||
test.beforeAll(async () => {
|
||||
server = await serveRepos({
|
||||
app: buildFixtureRepo(fullProjectFiles()),
|
||||
multi: buildFixtureRepo(multiFileFiles()),
|
||||
bad: buildFixtureRepo(refusalFiles()),
|
||||
});
|
||||
});
|
||||
|
||||
test.afterAll(() => {
|
||||
server?.close();
|
||||
});
|
||||
|
||||
test.beforeEach(async () => {
|
||||
stackName = `e2e-mater-${Date.now()}`;
|
||||
});
|
||||
|
||||
test.afterEach(async ({ page }) => {
|
||||
await page.evaluate(async (name) => {
|
||||
await fetch(`/api/stacks/${name}/git-source`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
|
||||
await fetch(`/api/stacks/${name}`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
|
||||
}, stackName);
|
||||
});
|
||||
|
||||
function saveSource(page: Page, repoUrl: string, composePaths: string[], contextDir: string | null = null) {
|
||||
return page.evaluate(async ({ name, repoUrl, composePaths, contextDir }) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source`, {
|
||||
method: 'PUT',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({
|
||||
repo_url: repoUrl,
|
||||
branch: 'main',
|
||||
compose_paths: composePaths,
|
||||
context_dir: contextDir,
|
||||
sync_env: false,
|
||||
auth_type: 'none',
|
||||
auto_apply_on_webhook: false,
|
||||
auto_deploy_on_apply: false,
|
||||
}),
|
||||
});
|
||||
return res.status;
|
||||
}, { name: stackName, repoUrl, composePaths, contextDir });
|
||||
}
|
||||
|
||||
test('materializes the complete project and records it in the manifest', async ({ page }) => {
|
||||
await loginAs(page);
|
||||
await page.evaluate(async (name) => {
|
||||
await fetch('/api/stacks', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ stackName: name }),
|
||||
});
|
||||
}, stackName);
|
||||
const repoUrl = `${server.url}/app.git`;
|
||||
expect(await saveSource(page, repoUrl, ['compose.yaml'])).toBe(200);
|
||||
|
||||
const pull = await page.evaluate(async (name) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source/pull`, { method: 'POST', credentials: 'include' });
|
||||
return { status: res.status, body: await res.json() };
|
||||
}, stackName);
|
||||
expect(pull.status, JSON.stringify(pull.body)).toBe(200);
|
||||
expect(pull.body.candidateReady).toBe(true);
|
||||
|
||||
const applied = await page.evaluate(async ({ name, sha }) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source/apply`, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ commitSha: sha, deploy: false }),
|
||||
});
|
||||
return { status: res.status, body: await res.json() };
|
||||
}, { name: stackName, sha: pull.body.commitSha });
|
||||
expect(applied.status).toBe(200);
|
||||
expect(applied.body.applied).toBe(true);
|
||||
|
||||
// The managed-project manifest records the complete materialized set.
|
||||
const manifest = await page.evaluate(async (name) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source/manifest`, { credentials: 'include' });
|
||||
return res.ok ? await res.json() : null;
|
||||
}, stackName);
|
||||
expect(manifest).not.toBeNull();
|
||||
const kinds = manifest.manifest.inputs.map((i: { dependencyKind: string }) => i.dependencyKind);
|
||||
expect(kinds).toContain('config');
|
||||
expect(kinds).toContain('env_file');
|
||||
expect(kinds).toContain('build-context');
|
||||
expect(manifest.manifest.state).toBe('active');
|
||||
});
|
||||
|
||||
test('refuses to overwrite local modifications on apply', async ({ page }) => {
|
||||
await loginAs(page);
|
||||
await page.evaluate(async (name) => {
|
||||
await fetch('/api/stacks', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ stackName: name }),
|
||||
});
|
||||
}, stackName);
|
||||
const repoUrl = `${server.url}/app.git`;
|
||||
expect(await saveSource(page, repoUrl, ['compose.yaml'])).toBe(200);
|
||||
const pull = await page.evaluate(async (name) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source/pull`, { method: 'POST', credentials: 'include' });
|
||||
return await res.json();
|
||||
}, stackName);
|
||||
const applied = await page.evaluate(async ({ name, sha }) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source/apply`, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ commitSha: sha, deploy: false }),
|
||||
});
|
||||
return res.status;
|
||||
}, { name: stackName, sha: pull.commitSha });
|
||||
expect(applied).toBe(200);
|
||||
|
||||
// Locally modify a managed input through the file editor API.
|
||||
const writeStatus = await page.evaluate(async (name) => {
|
||||
const res = await fetch(`/api/stacks/${name}/files/content?path=web.env`, {
|
||||
method: 'PUT',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ content: 'FOO=locally-edited\n' }),
|
||||
});
|
||||
return res.status;
|
||||
}, stackName);
|
||||
expect([200, 204]).toContain(writeStatus);
|
||||
|
||||
const secondPull = await page.evaluate(async (name) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source/pull`, { method: 'POST', credentials: 'include' });
|
||||
return await res.json();
|
||||
}, stackName);
|
||||
const refused = await page.evaluate(async ({ name, sha }) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source/apply`, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ commitSha: sha, deploy: false }),
|
||||
});
|
||||
return { status: res.status, body: await res.json() };
|
||||
}, { name: stackName, sha: secondPull.commitSha });
|
||||
expect(refused.status).toBe(400);
|
||||
expect(JSON.stringify(refused.body)).toContain('Local modifications');
|
||||
expect(JSON.stringify(refused.body)).toContain('web.env');
|
||||
});
|
||||
|
||||
test('detaches a multi-file stack with the export contract', async ({ page }) => {
|
||||
await loginAs(page);
|
||||
await page.evaluate(async (name) => {
|
||||
await fetch('/api/stacks', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ stackName: name }),
|
||||
});
|
||||
}, stackName);
|
||||
const repoUrl = `${server.url}/multi.git`;
|
||||
expect(await saveSource(page, repoUrl, ['deploy/base.yaml', 'deploy/prod.yaml'], 'deploy')).toBe(200);
|
||||
const pull = await page.evaluate(async (name) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source/pull`, { method: 'POST', credentials: 'include' });
|
||||
return await res.json();
|
||||
}, stackName);
|
||||
const applied = await page.evaluate(async ({ name, sha }) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source/apply`, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ commitSha: sha, deploy: false }),
|
||||
});
|
||||
return res.status;
|
||||
}, { name: stackName, sha: pull.commitSha });
|
||||
expect(applied).toBe(200);
|
||||
|
||||
const detached = await page.evaluate(async (name) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source`, { method: 'DELETE', credentials: 'include' });
|
||||
return { status: res.status, body: await res.json() };
|
||||
}, stackName);
|
||||
expect(detached.status).toBe(200);
|
||||
|
||||
// The stack still deploys as a plain compose project: the effective model
|
||||
// was exported into compose.yaml and the source row is gone.
|
||||
const after = await page.evaluate(async (name) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source`, { credentials: 'include' });
|
||||
return { sourceStatus: res.status, body: await res.json() };
|
||||
}, stackName);
|
||||
expect(after.sourceStatus).toBe(200);
|
||||
expect(after.body).toEqual({ linked: false });
|
||||
const exported = await page.evaluate(async (name) => {
|
||||
const res = await fetch(`/api/stacks/${name}/files/content?path=compose.yaml`, { credentials: 'include' });
|
||||
return res.ok ? await res.text() : '';
|
||||
}, stackName);
|
||||
expect(exported).toContain('image: nginx');
|
||||
});
|
||||
|
||||
test('surfaces the refusal callout for an out-of-bound include on pull', async ({ page }) => {
|
||||
await loginAs(page);
|
||||
await page.evaluate(async (name) => {
|
||||
await fetch('/api/stacks', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ stackName: name }),
|
||||
});
|
||||
}, stackName);
|
||||
const repoUrl = `${server.url}/bad.git`;
|
||||
expect(await saveSource(page, repoUrl, ['compose.yaml'])).toBe(200);
|
||||
|
||||
const pull = await page.evaluate(async (name) => {
|
||||
const res = await fetch(`/api/stacks/${name}/git-source/pull`, { method: 'POST', credentials: 'include' });
|
||||
return { status: res.status, body: await res.json() };
|
||||
}, stackName);
|
||||
// The actionable refusal aborts the pull with an actionable message.
|
||||
expect(pull.status).toBe(400);
|
||||
expect(JSON.stringify(pull.body)).toMatch(/outside the repository|Cannot materialize/);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -0,0 +1,178 @@
|
||||
/**
|
||||
* Local smart-HTTP Git server for the Git Sources E2E specs.
|
||||
*
|
||||
* Builds fixture repositories with the system git binary and serves them over
|
||||
* HTTPS, so the full clone -> pull -> apply pipeline runs without network
|
||||
* egress. Implements the two smart-HTTP endpoints isomorphic-git needs
|
||||
* (GET info/refs advertise + POST upload-pack) directly; git-http-backend's
|
||||
* stream internals break on modern Node.
|
||||
*
|
||||
* Git Sources requires HTTPS URLs, so the server speaks TLS with the committed
|
||||
* dev-only CA (e2e/fixtures/git-ca.pem). The backend must trust that CA via
|
||||
* NODE_EXTRA_CA_CERTS (wired in CI and in the local validation lifecycle).
|
||||
* The key is a throwaway test certificate with no security value.
|
||||
*
|
||||
* Soft-skips when the system git binary is unavailable.
|
||||
*/
|
||||
import { spawn, spawnSync } from 'child_process';
|
||||
import fs from 'fs';
|
||||
import https from 'https';
|
||||
import os from 'os';
|
||||
import path from 'path';
|
||||
|
||||
export function gitAvailable(): boolean {
|
||||
const probe = spawnSync('git', ['--version'], { stdio: 'ignore' });
|
||||
return probe.status === 0;
|
||||
}
|
||||
|
||||
/** Build a git repository with the given files on `branch`, returns the repo dir. */
|
||||
export function buildFixtureRepo(files: Record<string, string>, branch = 'main'): string {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sencho-e2e-repo-'));
|
||||
for (const [rel, content] of Object.entries(files)) {
|
||||
const abs = path.join(dir, rel);
|
||||
fs.mkdirSync(path.dirname(abs), { recursive: true });
|
||||
fs.writeFileSync(abs, content);
|
||||
}
|
||||
const run = (args: string[]) => {
|
||||
const r = spawnSync('git', args, { cwd: dir, encoding: 'utf8' });
|
||||
if (r.status !== 0) throw new Error(`git ${args[0]} failed: ${r.stderr}`);
|
||||
};
|
||||
run(['init', '-b', branch]);
|
||||
run(['config', 'user.email', 'e2e@sencho.test']);
|
||||
run(['config', 'user.name', 'Sencho E2E']);
|
||||
run(['add', '-A']);
|
||||
run(['commit', '-m', 'fixture']);
|
||||
return dir;
|
||||
}
|
||||
|
||||
/**
|
||||
* Serve the given repos (keyed by served name) over smart HTTPS. Returns the
|
||||
* base URL; repos are reachable at `<url>/<name>.git`.
|
||||
*/
|
||||
export function serveRepos(repoDirs: Record<string, string>): Promise<{ url: string; close: () => void }> {
|
||||
return new Promise((resolve, reject) => {
|
||||
const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sencho-e2e-git-'));
|
||||
for (const [name, dir] of Object.entries(repoDirs)) {
|
||||
const bare = path.join(root, `${name}.git`);
|
||||
const r = spawnSync('git', ['clone', '--bare', '--quiet', dir, bare], { encoding: 'utf8' });
|
||||
if (r.status !== 0) throw new Error(`git clone --bare failed: ${r.stderr}`);
|
||||
repoDirs[`${name}.git`] = bare;
|
||||
}
|
||||
|
||||
const fixtures = path.join(process.cwd(), 'e2e', 'fixtures');
|
||||
const server = https.createServer(
|
||||
{
|
||||
cert: fs.readFileSync(path.join(fixtures, 'git-server.pem')),
|
||||
key: fs.readFileSync(path.join(fixtures, 'git-server.key')),
|
||||
},
|
||||
(req, res) => {
|
||||
const url = req.url ?? '/';
|
||||
const repoName = url.split('/')[1] ?? '';
|
||||
const bare = repoDirs[repoName];
|
||||
if (!bare) {
|
||||
res.statusCode = 404;
|
||||
res.end('unknown repo');
|
||||
return;
|
||||
}
|
||||
const pathname = url.slice(url.indexOf(repoName) + repoName.length).split('?')[0];
|
||||
if (pathname === '/info/refs' && (req.method === 'GET' || req.method === 'POST')) {
|
||||
const ps = spawn('git', ['upload-pack', '--stateless-rpc', '--advertise-refs', bare]);
|
||||
let out = Buffer.alloc(0);
|
||||
let err = '';
|
||||
ps.stdout.on('data', (d: Buffer) => {
|
||||
out = Buffer.concat([out, d]);
|
||||
});
|
||||
ps.stderr.on('data', (d: Buffer) => {
|
||||
err += d.toString();
|
||||
});
|
||||
ps.on('error', (e) => {
|
||||
console.error('[gitServer.helper] upload-pack spawn failed:', e.message);
|
||||
res.statusCode = 500;
|
||||
res.end('git upload-pack failed to start');
|
||||
});
|
||||
ps.on('close', (code) => {
|
||||
if (code !== 0) {
|
||||
console.error('[gitServer.helper] upload-pack exited', code, err);
|
||||
res.statusCode = 500;
|
||||
res.end(err || 'git upload-pack failed');
|
||||
return;
|
||||
}
|
||||
res.setHeader('content-type', 'application/x-git-upload-pack-advertisement');
|
||||
res.end(Buffer.concat([Buffer.from('001e# service=git-upload-pack\n0000'), out]));
|
||||
});
|
||||
return;
|
||||
}
|
||||
if (pathname === '/git-upload-pack' && req.method === 'POST') {
|
||||
const ps = spawn('git', ['upload-pack', '--stateless-rpc', bare]);
|
||||
res.setHeader('content-type', 'application/x-git-upload-pack-result');
|
||||
ps.stdout.pipe(res);
|
||||
ps.on('error', (e) => {
|
||||
console.error('[gitServer.helper] upload-pack spawn failed:', e.message);
|
||||
if (!res.headersSent) {
|
||||
res.statusCode = 500;
|
||||
res.end('git upload-pack failed to start');
|
||||
}
|
||||
});
|
||||
ps.stdin.on('error', () => {
|
||||
// client aborted mid-stream; the response is already ending
|
||||
});
|
||||
req.pipe(ps.stdin);
|
||||
ps.stderr.on('data', (d: Buffer) => console.error('[gitServer.helper] upload-pack stderr:', d.toString()));
|
||||
return;
|
||||
}
|
||||
res.statusCode = 404;
|
||||
res.end('unsupported git endpoint');
|
||||
},
|
||||
);
|
||||
server.on('error', reject);
|
||||
server.listen(0, '127.0.0.1', () => {
|
||||
const address = server.address();
|
||||
if (address === null || typeof address === 'string') {
|
||||
reject(new Error('server did not bind'));
|
||||
return;
|
||||
}
|
||||
resolve({
|
||||
url: `https://127.0.0.1:${address.port}`,
|
||||
close: () => server.close(),
|
||||
});
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
/** The full-project fixture: compose + env file + config + build context. */
|
||||
export function fullProjectFiles(): Record<string, string> {
|
||||
return {
|
||||
'compose.yaml': `services:
|
||||
web:
|
||||
image: nginx
|
||||
env_file: web.env
|
||||
configs: [app-conf]
|
||||
build:
|
||||
context: web
|
||||
configs:
|
||||
app-conf:
|
||||
file: config/app.conf
|
||||
`,
|
||||
'web.env': 'FOO=bar\n',
|
||||
'config/app.conf': 'server {}\n',
|
||||
'web/.dockerignore': 'node_modules\n',
|
||||
'web/Dockerfile': 'FROM nginx\n',
|
||||
'web/index.html': '<h1>fixture</h1>\n',
|
||||
};
|
||||
}
|
||||
|
||||
/** Multi-file fixture: base + override under a project dir. */
|
||||
export function multiFileFiles(): Record<string, string> {
|
||||
return {
|
||||
'deploy/base.yaml': 'services:\n web:\n image: nginx\n env_file: web.env\n',
|
||||
'deploy/prod.yaml': 'services:\n web:\n environment:\n - MODE=prod\n',
|
||||
'deploy/web.env': 'FOO=bar\n',
|
||||
};
|
||||
}
|
||||
|
||||
/** Refusal fixture: an include that escapes the repository. */
|
||||
export function refusalFiles(): Record<string, string> {
|
||||
return {
|
||||
'compose.yaml': 'include:\n - ../outside.yaml\nservices: {}\n',
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
import { test, expect, type Page } from '@playwright/test';
|
||||
import { loginAs, waitForStacksLoaded } from './helpers';
|
||||
import { buildFixtureRepo, serveRepos, fullProjectFiles } from './gitServer.helper';
|
||||
|
||||
const STACK = 'mobile-check';
|
||||
|
||||
let server: { url: string; close: () => void };
|
||||
|
||||
test.beforeAll(async () => {
|
||||
// Deterministic seed: the local TLS fixture git server (no external network).
|
||||
server = await serveRepos({ full: buildFixtureRepo(fullProjectFiles()) });
|
||||
});
|
||||
|
||||
test.afterAll(() => {
|
||||
server.close();
|
||||
});
|
||||
|
||||
async function openStack(page: Page): Promise<void> {
|
||||
await page.reload();
|
||||
await waitForStacksLoaded(page);
|
||||
await page.getByText(STACK, { exact: true }).first().click();
|
||||
}
|
||||
|
||||
test('git source panel renders at phone width', async ({ page }) => {
|
||||
await page.setViewportSize({ width: 390, height: 844 });
|
||||
await loginAs(page);
|
||||
// Pre-clean any stack left by an interrupted run so the seeding assertions
|
||||
// below fail only on genuine errors, never on stale state.
|
||||
await page.evaluate(async (name) => {
|
||||
await fetch(`/api/stacks/${name}`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
|
||||
}, STACK);
|
||||
// Seed the stack and the git-source row. Seeding failures fail the test
|
||||
// loudly instead of silently degrading the assertions to a no-op.
|
||||
const seed = await page.evaluate(async ({ name, repoUrl }) => {
|
||||
const stackRes = await fetch('/api/stacks', { method: 'POST', headers: { 'Content-Type': 'application/json' }, credentials: 'include', body: JSON.stringify({ stackName: name }) });
|
||||
const gitRes = await fetch(`/api/stacks/${name}/git-source`, {
|
||||
method: 'PUT',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ repo_url: repoUrl, branch: 'main', compose_paths: ['compose.yaml'], context_dir: null, sync_env: false, auth_type: 'none', auto_apply_on_webhook: false, auto_deploy_on_apply: false }),
|
||||
});
|
||||
return { stackOk: stackRes.ok, gitOk: gitRes.ok, gitStatus: gitRes.status, gitBody: await gitRes.text() };
|
||||
}, { name: STACK, repoUrl: `${server.url}/full.git` });
|
||||
expect(seed.stackOk).toBe(true);
|
||||
expect(seed.gitOk, `git-source seed failed (HTTP ${seed.gitStatus}): ${seed.gitBody}`).toBe(true);
|
||||
await openStack(page);
|
||||
await page.getByRole('tab', { name: 'Compose' }).click();
|
||||
await page.getByRole('button', { name: 'Git Source' }).click();
|
||||
await expect(page.getByRole('dialog').getByRole('heading', { name: /git source/i })).toBeVisible({ timeout: 10_000 });
|
||||
// No horizontal overflow at phone width.
|
||||
const overflow = await page.evaluate(() => document.documentElement.scrollWidth > document.documentElement.clientWidth);
|
||||
expect(overflow).toBe(false);
|
||||
// The manifest section renders inside the scrollable dialog.
|
||||
await expect(page.getByText('Managed project').first()).toBeVisible({ timeout: 5_000 });
|
||||
await page.screenshot({ path: 'e2e/report/mobile-panel.png' });
|
||||
await page.evaluate(async (name) => {
|
||||
await fetch(`/api/stacks/${name}`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
|
||||
}, STACK);
|
||||
});
|
||||
+12
-6
@@ -6,10 +6,16 @@ import { test, expect } from '@playwright/test';
|
||||
import { loginAs, waitForStacksLoaded } from './helpers';
|
||||
|
||||
async function firstStackName(page: import('@playwright/test').Page): Promise<string | null> {
|
||||
const row = page.locator('[role="listbox"] [role="option"]').first();
|
||||
if (!(await row.isVisible().catch(() => false))) return null;
|
||||
const text = await row.textContent();
|
||||
return text?.trim() ?? null;
|
||||
const response = await page.request.get('/api/stacks');
|
||||
await expect(response).toBeOK();
|
||||
const stacks = await response.json() as string[];
|
||||
return stacks[0] ?? null;
|
||||
}
|
||||
|
||||
async function openStack(page: import('@playwright/test').Page, stackName: string): Promise<void> {
|
||||
const option = page.locator(`[data-stacks-loaded="true"] [cmdk-item][data-value="${stackName}"]`);
|
||||
await expect(option).toBeVisible();
|
||||
await option.click();
|
||||
}
|
||||
|
||||
test.describe('URL routing', () => {
|
||||
@@ -53,7 +59,7 @@ test.describe('URL routing', () => {
|
||||
const stackName = await firstStackName(page);
|
||||
test.skip(!stackName, 'No stacks available to open');
|
||||
|
||||
await page.locator('[role="listbox"]').getByText(stackName!, { exact: true }).click();
|
||||
await openStack(page, stackName!);
|
||||
const slug = stackName!.replace(/^-+/, '').replace(/\.(ya?ml)$/i, '');
|
||||
const escaped = slug.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
||||
await expect(page).toHaveURL(new RegExp(`/nodes/local/stacks/${escaped}/?$`));
|
||||
@@ -95,7 +101,7 @@ test.describe('URL routing', () => {
|
||||
test.skip(!stackName, 'No stacks available to open');
|
||||
|
||||
const slug = stackName!.replace(/^-+/, '').replace(/\.(ya?ml)$/i, '');
|
||||
await page.locator('[role="listbox"]').getByText(stackName!, { exact: true }).click();
|
||||
await openStack(page, stackName!);
|
||||
await expect(page).toHaveURL(new RegExp(`/nodes/local/stacks/`));
|
||||
await expect(page).not.toHaveURL(/\/compose$/);
|
||||
|
||||
|
||||
@@ -0,0 +1,204 @@
|
||||
import { useEffect, useState } from 'react';
|
||||
import { ChevronDown, ChevronRight, FileBox } from 'lucide-react';
|
||||
import { Badge } from '@/components/ui/badge';
|
||||
import { apiFetch } from '@/lib/api';
|
||||
import { cn } from '@/lib/utils';
|
||||
|
||||
/** Backend projections of the managed-project manifest (types/gitProjectManifest.ts). */
|
||||
export interface ManifestSummary {
|
||||
state: 'none' | 'migrated' | 'active' | 'partial' | 'unsupported' | 'migration_required' | 'absent';
|
||||
manifestVersion: number;
|
||||
resolvedCommitSha: string | null;
|
||||
managedCount: number;
|
||||
unmanagedCount: number;
|
||||
refusedCount: number;
|
||||
refused: Array<{ sourcePath: string | null; kind: string; reason: string; actionable: boolean }>;
|
||||
hasBuildContexts: boolean;
|
||||
generatedAt: number | null;
|
||||
}
|
||||
|
||||
/** Public manifest projection served by the manifest endpoint (no hashes, sensitive paths redacted). */
|
||||
interface ManifestInput {
|
||||
/** Display label; null for high-sensitivity inputs whose path is redacted. */
|
||||
path: string | null;
|
||||
role: string;
|
||||
dependencyKind: string;
|
||||
ownership: 'managed' | 'unmanaged';
|
||||
sensitivity: 'high' | 'medium' | 'low';
|
||||
state: 'present' | 'tombstoned';
|
||||
note: string | null;
|
||||
}
|
||||
|
||||
interface GitManifest {
|
||||
manifestVersion: number;
|
||||
state: string;
|
||||
inputs: ManifestInput[];
|
||||
}
|
||||
|
||||
const LIST_CAP = 200;
|
||||
|
||||
const STATE_LABEL: Record<string, string> = {
|
||||
none: 'Unmanaged',
|
||||
migrated: 'Migrated',
|
||||
active: 'Active',
|
||||
partial: 'Partial',
|
||||
unsupported: 'Unsupported',
|
||||
migration_required: 'Migration required',
|
||||
absent: 'Not materialized',
|
||||
};
|
||||
|
||||
function stateVariant(state: string): 'default' | 'secondary' | 'destructive' | 'outline' {
|
||||
if (state === 'migration_required' || state === 'unsupported') return 'destructive';
|
||||
if (state === 'active' || state === 'migrated') return 'default';
|
||||
return 'secondary';
|
||||
}
|
||||
|
||||
interface GitManifestSummaryProps {
|
||||
stackName: string;
|
||||
summary: ManifestSummary | null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Managed-project manifest summary for a Git-sourced stack: pinned revision,
|
||||
* input counts, and the materialized-file inventory. The full manifest is
|
||||
* fetched lazily, only when the section is expanded, to keep the panel light.
|
||||
*/
|
||||
export function GitManifestSummary({ stackName, summary }: GitManifestSummaryProps) {
|
||||
const [expanded, setExpanded] = useState(false);
|
||||
const [manifest, setManifest] = useState<GitManifest | null>(null);
|
||||
const [loading, setLoading] = useState(false);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
// One fetch attempt per mount: a failed request must not re-trigger the
|
||||
// effect (loading flipping false would otherwise loop forever). The attempt
|
||||
// flag flips only in the fetch's finally, so the effect never refires on the
|
||||
// loading state; retrying is an explicit user action.
|
||||
const [attempted, setAttempted] = useState(false);
|
||||
|
||||
useEffect(() => {
|
||||
if (!expanded || manifest !== null || attempted) return;
|
||||
setLoading(true);
|
||||
setError(null);
|
||||
apiFetch(`/stacks/${encodeURIComponent(stackName)}/git-source/manifest`)
|
||||
.then(async (res) => {
|
||||
if (res.ok) {
|
||||
const data = (await res.json()) as { manifest: GitManifest };
|
||||
setManifest(data.manifest);
|
||||
} else {
|
||||
setError('Could not load the managed-project manifest.');
|
||||
}
|
||||
})
|
||||
.catch(() => setError('Could not load the managed-project manifest.'))
|
||||
.finally(() => {
|
||||
setLoading(false);
|
||||
setAttempted(true);
|
||||
});
|
||||
}, [expanded, manifest, attempted, stackName]);
|
||||
|
||||
if (!summary) return null;
|
||||
|
||||
const state = summary.state;
|
||||
const shownInputs = manifest ? manifest.inputs.slice(0, LIST_CAP) : [];
|
||||
const visibleCount = manifest?.inputs.length ?? 0;
|
||||
|
||||
return (
|
||||
<div className="rounded-md border border-glass-border bg-muted/30 shadow-card-bevel">
|
||||
<button
|
||||
type="button"
|
||||
className="flex w-full items-center justify-between gap-2 px-3 py-2 text-left text-[11px] text-stat-subtitle"
|
||||
onClick={() => setExpanded((v) => !v)}
|
||||
aria-expanded={expanded}
|
||||
>
|
||||
<span className="flex items-center gap-1.5 font-medium text-foreground/80">
|
||||
{expanded ? <ChevronDown className="w-3.5 h-3.5" strokeWidth={1.5} /> : <ChevronRight className="w-3.5 h-3.5" strokeWidth={1.5} />}
|
||||
<FileBox className="w-3.5 h-3.5" strokeWidth={1.5} />
|
||||
Managed project
|
||||
</span>
|
||||
<span className="flex items-center gap-2">
|
||||
{summary.resolvedCommitSha && (
|
||||
<span className="font-mono tabular-nums">{summary.resolvedCommitSha.slice(0, 7)}</span>
|
||||
)}
|
||||
<Badge variant={stateVariant(state)} className="px-1.5 py-0 text-[10px]">
|
||||
{STATE_LABEL[state] ?? state}
|
||||
</Badge>
|
||||
</span>
|
||||
</button>
|
||||
|
||||
{expanded && (
|
||||
<div className="border-t border-glass-border px-3 py-2.5 space-y-2.5 text-[11px]">
|
||||
<div className="flex flex-wrap gap-x-4 gap-y-1 text-stat-subtitle">
|
||||
<span>
|
||||
<span className="font-medium text-foreground/80">{summary.managedCount}</span> managed
|
||||
</span>
|
||||
<span>
|
||||
<span className="font-medium text-foreground/80">{summary.unmanagedCount}</span> unmanaged
|
||||
</span>
|
||||
<span>
|
||||
<span className="font-medium text-foreground/80">{summary.refusedCount}</span> refused
|
||||
</span>
|
||||
{summary.hasBuildContexts && <span>build contexts</span>}
|
||||
<span>
|
||||
manifest v{summary.manifestVersion}
|
||||
</span>
|
||||
</div>
|
||||
|
||||
{state === 'migrated' && (
|
||||
<p className="text-stat-subtitle">
|
||||
This project was adopted from the previous Git-source format. Pull once to rebuild the
|
||||
complete inventory from the repository.
|
||||
</p>
|
||||
)}
|
||||
{state === 'migration_required' && (
|
||||
<p className="text-destructive/90">
|
||||
The managed-project manifest cannot be trusted. Pull now to rebuild it before applying changes.
|
||||
</p>
|
||||
)}
|
||||
|
||||
{loading && <p className="text-stat-subtitle">Loading inventory...</p>}
|
||||
{error && !loading && (
|
||||
<div className="flex items-center justify-between gap-2">
|
||||
<p className="text-destructive/90">{error}</p>
|
||||
<button
|
||||
type="button"
|
||||
className="text-[11px] font-medium text-primary underline-offset-2 hover:underline"
|
||||
onClick={() => {
|
||||
setAttempted(false);
|
||||
setError(null);
|
||||
}}
|
||||
>
|
||||
Retry
|
||||
</button>
|
||||
</div>
|
||||
)}
|
||||
|
||||
{manifest && (
|
||||
<>
|
||||
<div className="space-y-1">
|
||||
{shownInputs.map((input, i) => (
|
||||
<div key={i} className="flex items-center justify-between gap-2">
|
||||
<span className="font-mono truncate" title={input.note ?? undefined}>
|
||||
{input.path ?? input.dependencyKind}
|
||||
</span>
|
||||
<span className="flex items-center gap-1.5 shrink-0">
|
||||
<Badge variant="outline" className="px-1.5 py-0 text-[10px] font-normal">
|
||||
{input.dependencyKind}
|
||||
</Badge>
|
||||
<Badge
|
||||
variant={input.ownership === 'managed' ? 'secondary' : 'outline'}
|
||||
className={cn('px-1.5 py-0 text-[10px] font-normal', input.state === 'tombstoned' && 'opacity-50 line-through')}
|
||||
>
|
||||
{input.state === 'tombstoned' ? 'removed' : input.ownership}
|
||||
</Badge>
|
||||
</span>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
{visibleCount > LIST_CAP && (
|
||||
<p className="text-stat-subtitle">Showing {LIST_CAP} of {visibleCount} inputs.</p>
|
||||
)}
|
||||
</>
|
||||
)}
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -16,6 +16,10 @@ export interface PullResult {
|
||||
currentEnv: string | null;
|
||||
validation: { ok: boolean; error?: string };
|
||||
hasLocalChanges: boolean;
|
||||
/** Tolerated refusals from complete-project discovery; intentionally not surfaced in this dialog (actionable refusals abort the pull, so this is always empty). */
|
||||
refusals?: Array<{ sourcePath: string | null; kind: string; reason: string; actionable: boolean }>;
|
||||
/** Clone-time warnings (submodules present, for example). */
|
||||
warnings?: string[];
|
||||
}
|
||||
|
||||
interface GitSourceDiffDialogProps {
|
||||
@@ -97,7 +101,6 @@ export function GitSourceDiffDialog({
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
|
||||
{envAvailable && (
|
||||
<Tabs value={diffTab} onValueChange={(v) => setDiffTab(v as 'compose' | 'env')}>
|
||||
<TabsList>
|
||||
|
||||
@@ -70,6 +70,8 @@ const LINKED_SOURCE = {
|
||||
pending_fetched_at: null,
|
||||
created_at: 0,
|
||||
updated_at: 0,
|
||||
manifest_state: 'absent' as const,
|
||||
manifest: null,
|
||||
};
|
||||
|
||||
function panel() {
|
||||
@@ -137,3 +139,54 @@ describe('GitSourcePanel deploy-mode apply node binding', () => {
|
||||
expect(dfCtl.params).toEqual(expect.objectContaining({ action: 'deploy', nodeId: 4 }));
|
||||
});
|
||||
});
|
||||
|
||||
describe('GitSourcePanel manifest summary', () => {
|
||||
it('renders the managed-project section when the source carries a manifest', async () => {
|
||||
const summary = {
|
||||
state: 'active',
|
||||
manifestVersion: 2,
|
||||
resolvedCommitSha: 'abc1234567890abc1234567890abc1234567890a',
|
||||
managedCount: 3,
|
||||
unmanagedCount: 1,
|
||||
refusedCount: 0,
|
||||
refused: [],
|
||||
hasBuildContexts: true,
|
||||
generatedAt: 1,
|
||||
};
|
||||
vi.mocked(apiFetch).mockImplementation(async (url: string) =>
|
||||
url.includes('/git-source/manifest')
|
||||
? jsonRes({
|
||||
// The manifest endpoint serves the redacted PUBLIC projection
|
||||
// (path, not sourcePath/materializedPath; no hashes or internals).
|
||||
manifest: {
|
||||
manifestVersion: 2,
|
||||
state: 'active',
|
||||
inputs: [
|
||||
{ path: 'compose.yaml', role: 'compose-primary', dependencyKind: 'explicit', ownership: 'managed', sensitivity: 'medium', state: 'present', note: null },
|
||||
],
|
||||
},
|
||||
})
|
||||
: jsonRes({ ...LINKED_SOURCE, manifest_state: 'active', manifest: summary }),
|
||||
);
|
||||
render(panel());
|
||||
const toggle = await screen.findByText('Managed project');
|
||||
expect(screen.getByText('abc1234')).toBeTruthy();
|
||||
expect(screen.getByText('Active')).toBeTruthy();
|
||||
// Counts render in the expanded section; the inventory is lazy-fetched.
|
||||
fireEvent.click(toggle);
|
||||
await waitFor(() => expect(screen.getByText('3')).toBeTruthy());
|
||||
expect(screen.getByText('1')).toBeTruthy();
|
||||
expect(screen.getByText('unmanaged')).toBeTruthy();
|
||||
await waitFor(() => expect(screen.getByText('explicit')).toBeTruthy());
|
||||
});
|
||||
|
||||
it('renders the manifest section with the DB state when the source has no manifest file', async () => {
|
||||
vi.mocked(apiFetch).mockResolvedValue(jsonRes(LINKED_SOURCE));
|
||||
render(panel());
|
||||
await waitFor(() => expect(screen.getByText('Last applied commit')).toBeTruthy());
|
||||
// The section is driven by the DB manifest_state ('absent') when the file
|
||||
// has not been materialized yet.
|
||||
expect(screen.getByText('Managed project')).toBeTruthy();
|
||||
expect(screen.getByText('Not materialized')).toBeTruthy();
|
||||
});
|
||||
});
|
||||
|
||||
@@ -10,6 +10,7 @@ import { useNodes } from '@/context/NodeContext';
|
||||
import { toast } from '@/components/ui/toast-store';
|
||||
import { GitSourceDiffDialog, type PullResult } from './GitSourceDiffDialog';
|
||||
import { GitSourceFields, type ApplyMode } from './GitSourceFields';
|
||||
import { GitManifestSummary, type ManifestSummary } from './GitManifestSummary';
|
||||
import type { GitBrowseResult } from './GitComposeFilePicker';
|
||||
|
||||
export interface GitSource {
|
||||
@@ -31,6 +32,8 @@ export interface GitSource {
|
||||
pending_fetched_at: number | null;
|
||||
created_at: number;
|
||||
updated_at: number;
|
||||
manifest_state: ManifestSummary['state'] | null;
|
||||
manifest: ManifestSummary | null;
|
||||
}
|
||||
|
||||
interface GitSourcePanelProps {
|
||||
@@ -248,6 +251,9 @@ export function GitSourcePanel({
|
||||
});
|
||||
if (res.ok) {
|
||||
const data: PullResult = await res.json();
|
||||
if (data.warnings && data.warnings.length > 0) {
|
||||
toast.warning(data.warnings.join(' '));
|
||||
}
|
||||
setPull(data);
|
||||
setDiffOpen(true);
|
||||
onSourceChanged?.();
|
||||
@@ -413,6 +419,28 @@ export function GitSourcePanel({
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
|
||||
{source && (
|
||||
<GitManifestSummary
|
||||
stackName={stackName}
|
||||
summary={
|
||||
source.manifest ??
|
||||
(source.manifest_state
|
||||
? {
|
||||
state: source.manifest_state,
|
||||
manifestVersion: 0,
|
||||
resolvedCommitSha: null,
|
||||
managedCount: 0,
|
||||
unmanagedCount: 0,
|
||||
refusedCount: 0,
|
||||
refused: [],
|
||||
hasBuildContexts: false,
|
||||
generatedAt: null,
|
||||
}
|
||||
: null)
|
||||
}
|
||||
/>
|
||||
)}
|
||||
</>
|
||||
)}
|
||||
</div>
|
||||
@@ -479,13 +507,16 @@ export function GitSourcePanel({
|
||||
onOpenChange={setRemoveConfirmOpen}
|
||||
variant="destructive"
|
||||
kicker={`${stackName.toUpperCase()} · GIT · DISCONNECT`}
|
||||
title="Remove Git source"
|
||||
confirmLabel={deleting ? 'Removing...' : 'Remove'}
|
||||
title="Detach and export"
|
||||
confirmLabel={deleting ? 'Detaching...' : 'Detach'}
|
||||
confirming={deleting}
|
||||
onConfirm={remove}
|
||||
>
|
||||
<p className="text-sm text-stat-subtitle">
|
||||
Disconnects the stack from its Git source. The stack files on disk are left in place and you can reconfigure the source later at any time.
|
||||
Detaches the stack from its Git source. Sencho renders the effective compose model into a single
|
||||
compose.yaml, keeps the materialized files, and removes Git tracking. Resolved values are baked into
|
||||
the exported file: anything interpolated from .env or env_file files, including credentials, becomes
|
||||
readable in compose.yaml. Reconfiguring the source later is always possible.
|
||||
</p>
|
||||
</ConfirmModal>
|
||||
</>
|
||||
|
||||
@@ -20,6 +20,8 @@ interface RollbackReadinessReport {
|
||||
computedAt: number;
|
||||
overall: RollbackOverall;
|
||||
items: RollbackReadinessItem[];
|
||||
/** Partial-revert scope disclosure for Git-managed stacks. */
|
||||
note?: string;
|
||||
}
|
||||
|
||||
const LABEL_CLASS = 'font-mono text-[10px] uppercase tracking-[0.18em] text-stat-subtitle';
|
||||
@@ -87,6 +89,11 @@ export function RollbackReadinessSection({ stackName }: { stackName: string }) {
|
||||
{overall.label}
|
||||
</span>
|
||||
</div>
|
||||
{report.note && (
|
||||
<div className="mb-1.5 rounded-md border border-warning/30 bg-warning/[0.06] px-3 py-2 text-[12px] leading-relaxed text-warning">
|
||||
{report.note}
|
||||
</div>
|
||||
)}
|
||||
<div className="rounded-lg border border-muted bg-card/40 px-3 py-1">
|
||||
{report.items.map(item => {
|
||||
const meta = STATE_META[item.state] ?? STATE_META.unknown;
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
import { describe, it, expect, vi, beforeEach } from 'vitest';
|
||||
import { render, screen, waitFor, fireEvent } from '@testing-library/react';
|
||||
import { GitManifestSummary, type ManifestSummary } from '../GitManifestSummary';
|
||||
|
||||
vi.mock('@/lib/api', () => ({ apiFetch: vi.fn() }));
|
||||
|
||||
import { apiFetch } from '@/lib/api';
|
||||
|
||||
const summary: ManifestSummary = {
|
||||
state: 'active',
|
||||
manifestVersion: 1,
|
||||
resolvedCommitSha: 'abc1234',
|
||||
managedCount: 2,
|
||||
unmanagedCount: 0,
|
||||
refusedCount: 0,
|
||||
refused: [],
|
||||
hasBuildContexts: false,
|
||||
generatedAt: Date.now(),
|
||||
};
|
||||
|
||||
describe('GitManifestSummary', () => {
|
||||
beforeEach(() => {
|
||||
vi.mocked(apiFetch).mockReset();
|
||||
});
|
||||
|
||||
it('renders nothing without a summary', () => {
|
||||
const { container } = render(<GitManifestSummary stackName="web" summary={null} />);
|
||||
expect(container).toBeEmptyDOMElement();
|
||||
});
|
||||
|
||||
it('fetches the manifest once per expansion and renders the inventory', async () => {
|
||||
vi.mocked(apiFetch).mockResolvedValue(
|
||||
new Response(
|
||||
JSON.stringify({
|
||||
manifest: {
|
||||
manifestVersion: 1,
|
||||
state: 'active',
|
||||
inputs: [
|
||||
{ path: 'compose.yaml', dependencyKind: 'explicit', ownership: 'managed', sensitivity: 'medium', state: 'present', note: null },
|
||||
{ path: null, dependencyKind: 'secret', ownership: 'managed', sensitivity: 'high', state: 'present', note: null },
|
||||
],
|
||||
},
|
||||
}),
|
||||
{ status: 200 },
|
||||
),
|
||||
);
|
||||
render(<GitManifestSummary stackName="web" summary={summary} />);
|
||||
fireEvent.click(screen.getByRole('button', { name: /Managed project/ }));
|
||||
await waitFor(() => expect(screen.getByText('compose.yaml')).toBeInTheDocument());
|
||||
expect(apiFetch).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it('does not refetch after a failed request (no retry loop)', async () => {
|
||||
vi.mocked(apiFetch).mockRejectedValue(new Error('down'));
|
||||
render(<GitManifestSummary stackName="web" summary={summary} />);
|
||||
fireEvent.click(screen.getByRole('button', { name: /Managed project/ }));
|
||||
await waitFor(() => expect(screen.getByText('Could not load the managed-project manifest.')).toBeInTheDocument());
|
||||
expect(apiFetch).toHaveBeenCalledTimes(1);
|
||||
// The pre-fix effect re-fired on the loading flip; give it a beat to prove
|
||||
// the failure does not restart the request.
|
||||
await new Promise((resolve) => setTimeout(resolve, 100));
|
||||
expect(apiFetch).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it('retries only through the explicit retry action', async () => {
|
||||
vi.mocked(apiFetch)
|
||||
.mockRejectedValueOnce(new Error('down'))
|
||||
.mockResolvedValueOnce(
|
||||
new Response(
|
||||
JSON.stringify({ manifest: { manifestVersion: 1, state: 'active', inputs: [] } }),
|
||||
{ status: 200 },
|
||||
),
|
||||
);
|
||||
render(<GitManifestSummary stackName="web" summary={summary} />);
|
||||
fireEvent.click(screen.getByRole('button', { name: /Managed project/ }));
|
||||
await waitFor(() => expect(screen.getByText('Could not load the managed-project manifest.')).toBeInTheDocument());
|
||||
expect(apiFetch).toHaveBeenCalledTimes(1);
|
||||
|
||||
fireEvent.click(screen.getByRole('button', { name: 'Retry' }));
|
||||
await waitFor(() => expect(apiFetch).toHaveBeenCalledTimes(2));
|
||||
await waitFor(() => expect(screen.queryByText('Could not load the managed-project manifest.')).not.toBeInTheDocument());
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user