mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-25 09:46:47 +00:00
Anso
381ed2a91f
* feat: add Admiral Hardened Build channel and business assurance surfaces Introduce Studio Saelix entitlement-backed Hardened Build switching, a single-flight image operation coordinator, Recovery Vault naming, Admiral Account settings, and typed Fleet update failures while preserving Community custom-repo and targetless pull-current updates. * fix: harden image-op paths and clear CI CodeQL/pilot flake Validate operation IDs before filesystem use, use hostname checks in Fleet fetch mocks, sanitize registry probe logs, and swallow expected TCP teardown errors in the pilot reverse-route post-handshake test. * fix: sanitize image-op docker config write and probe logs Allowlist-copy registry host keys and base64 auth before writing the temp DOCKER_CONFIG, and log registry probe failures with a fixed message so CodeQL no longer flags network-to-file and log-injection mediums. * fix: address Admiral Hardened Build audit blockers Expose imageChannel so hardened Fleet peers still POST for typed rejection, claim community updates before 202, terminalize helper failures, gate Hardened on paid, and align support/docs/e2e wording. * fix: terminalize image ops on helper survival and aborted claims * fix: prevent recreating persist from overwriting helper-exit failure * test: assert helper-exit failure lands before recreating persist * fix: keep current pointer when acknowledging a stale image operation
57 lines
2.4 KiB
TypeScript
57 lines
2.4 KiB
TypeScript
import { Router, type Request, type Response } from 'express';
|
|
import { getActiveCapabilities, getSenchoVersion } from '../services/CapabilityRegistry';
|
|
import { classifyImageChannel } from '../helpers/imageChannel';
|
|
import { isRepinBlocked } from '../helpers/selfUpdateCompose';
|
|
import { MeshService } from '../services/MeshService';
|
|
import SelfUpdateService from '../services/SelfUpdateService';
|
|
|
|
// Captured at boot. Exposed via /api/health and /api/meta so the Fleet update
|
|
// overlay can distinguish a brand-new process from the old one still mid-pull.
|
|
const processStartedAt = Date.now();
|
|
|
|
export const metaRouter = Router();
|
|
|
|
// Public health endpoint (no auth). Used by Docker HEALTHCHECK and uptime monitors.
|
|
// The `mesh.dataPlane` block reports whether `MeshService.setupMeshNetwork`
|
|
// completed successfully; an `ok: false` value means cross-node mesh routing
|
|
// is disabled on this node and the operator should consult the activity log
|
|
// or set `SENCHO_MESH_SUBNET` to a free /24 and restart the container.
|
|
metaRouter.get('/health', (_req: Request, res: Response): void => {
|
|
res.json({
|
|
status: 'ok',
|
|
uptime: process.uptime(),
|
|
startedAt: processStartedAt,
|
|
mesh: {
|
|
dataPlane: MeshService.getInstance().getDataPlaneStatus(),
|
|
},
|
|
});
|
|
});
|
|
|
|
// Public meta endpoint. Returns this instance's version and supported
|
|
// capabilities. No auth required (like /health). Used by remote nodes during
|
|
// connection tests.
|
|
//
|
|
// Image-pin fields are intentionally limited to the non-sensitive subset:
|
|
// `imagePinKind` (a bounded enum), `updateBlocked` (a boolean), and
|
|
// `imageChannel` (community|hardened|unknown). The full composeImageRef is
|
|
// NEVER exposed here because this endpoint is public and the ref can carry a
|
|
// private registry/repository name.
|
|
metaRouter.get('/meta', async (_req: Request, res: Response): Promise<void> => {
|
|
const selfUpdate = SelfUpdateService.getInstance();
|
|
const updateError = selfUpdate.getLastError();
|
|
const pin = await selfUpdate.getPinInfo({ cacheOnly: true });
|
|
const updateBlocked = pin ? isRepinBlocked(pin.pinKind) : false;
|
|
res.json({
|
|
version: getSenchoVersion(),
|
|
capabilities: getActiveCapabilities(),
|
|
startedAt: processStartedAt,
|
|
experimental: process.env.SENCHO_EXPERIMENTAL === 'true',
|
|
...(pin ? {
|
|
imagePinKind: pin.pinKind,
|
|
imageChannel: classifyImageChannel(pin.composeImageRef),
|
|
} : {}),
|
|
updateBlocked,
|
|
...(updateError ? { updateError: 'update_failed' } : {}),
|
|
});
|
|
});
|