openc3 7.3.0 → 7.4.1

data/lib/openc3/models/bridge_model.rb

@@ -0,0 +1,133 @@
+# encoding: ascii-8bit
+
+# Copyright 2026 OpenC3, Inc.
+# All Rights Reserved.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See LICENSE.md for more details.
+#
+# This file may also be used under the terms of a commercial license
+# if purchased from OpenC3, Inc.
+
+require 'openc3/models/model'
+require 'openc3/models/microservice_model'
+require 'base64'
+require 'json'
+require 'securerandom'
+
+module OpenC3
+  # Stores the identity of a named Iroh bridge (the bridge_microservice hub).
+  #
+  # A bridge is the COSMOS-side Iroh server that openc3-app and host interfaces
+  # connect to. This model stores the bridge's Iroh public key (its EndpointId)
+  # and most recent connection ticket, plus the authorized openc3-app control
+  # identity (app_public_key) recorded during enrollment. The bridge's own
+  # private key lives in the secrets store, never here.
+  #
+  # This Ruby model mirrors the Python BridgeModel (same scoped primary key and
+  # JSON shape) so the openc3cli `bridgeenroll` command can read and update the
+  # same records the Python BridgeMicroservice maintains.
+  class BridgeModel < Model
+    PRIMARY_KEY = 'openc3_bridges'
+    ENROLLMENT_CODE_TTL_SECONDS = 10 * 60
+
+    attr_accessor :public_key
+    attr_accessor :ticket
+    attr_accessor :app_public_key
+    attr_accessor :enroll_code
+    attr_accessor :enroll_code_generated_at
+    attr_accessor :port
+
+    # The bridge stack (bridge_microservice.py) is Python and runs from the core
+    # library regardless of the interfaces bridged through it.
+    def self.bridge_python_bin
+      ENV['OPENC3_PYTHON_BIN'] || '/openc3/python/.venv/bin/python'
+    end
+
+    BRIDGE_WORK_DIR = '/openc3/python/openc3/microservices'
+
+    # Build (but do not create) the MicroserviceModel for a bridge_microservice
+    # hub named `bridge_name` in `scope`. Centralizes the cmd/work_dir/options so
+    # ScopeModel, the DEFAULT-bridge migration, and InterfaceModel stay in sync.
+    def self.build_microservice(bridge_name:, scope:, parent: nil, shard: 0, plugin: nil)
+      microservice_name = "#{scope}__BRIDGE__#{bridge_name.to_s.upcase}"
+      MicroserviceModel.new(
+        name: microservice_name,
+        cmd: [bridge_python_bin, 'bridge_microservice.py', microservice_name],
+        work_dir: BRIDGE_WORK_DIR,
+        options: [['BRIDGE_NAME', bridge_name.to_s.upcase]],
+        parent: parent,
+        shard: shard.to_i,
+        plugin: plugin,
+        scope: scope
+      )
+    end
+
+    # NOTE: The following three class methods are reimplemented (like other
+    # scoped models) so the ModelController and Model class methods work.
+    def self.get(name:, scope:)
+      super("#{scope}__#{PRIMARY_KEY}", name: name)
+    end
+
+    def self.names(scope:)
+      super("#{scope}__#{PRIMARY_KEY}")
+    end
+
+    def self.all(scope:)
+      super("#{scope}__#{PRIMARY_KEY}")
+    end
+    # END NOTE
+
+    def initialize(
+      name:,
+      scope:,
+      public_key: nil,
+      ticket: nil,
+      app_public_key: nil,
+      enroll_code: nil,
+      enroll_code_generated_at: nil,
+      port: nil,
+      updated_at: nil,
+      plugin: nil
+    )
+      super("#{scope}__#{PRIMARY_KEY}", name: name, updated_at: updated_at, plugin: plugin, scope: scope)
+      @public_key = public_key
+      @ticket = ticket
+      @app_public_key = app_public_key
+      @enroll_code = enroll_code
+      @enroll_code_generated_at = enroll_code_generated_at
+      @port = port
+    end
+
+    def as_json(*_a)
+      {
+        'name' => @name,
+        'scope' => @scope,
+        'updated_at' => @updated_at,
+        'plugin' => @plugin,
+        'public_key' => @public_key,
+        'ticket' => @ticket,
+        'app_public_key' => @app_public_key,
+        'enroll_code' => @enroll_code,
+        'enroll_code_generated_at' => @enroll_code_generated_at,
+        'port' => @port
+      }
+    end
+
+    # Generate a one-time manual-enrollment code, store it on this bridge, and
+    # return a token (base64 JSON of bridge name + hub ticket + code) that a
+    # remote openc3-app pastes to enroll. Requires the bridge to be up (ticket
+    # present). The code is redeemed once over the api/enroll ALPN.
+    def generate_enrollment_token
+      raise "Bridge '#{@name}' has no ticket yet; is its bridge_microservice running?" if @ticket.nil? || @ticket.empty?
+
+      @enroll_code = SecureRandom.hex(16)
+      @enroll_code_generated_at = Time.now.to_i
+      update()
+      payload = { 'v' => 1, 'bridge' => @name, 'ticket' => @ticket, 'code' => @enroll_code }
+      Base64.urlsafe_encode64(JSON.generate(payload), padding: false)
+    end
+  end
+end

data/lib/openc3/models/config_keyword_model.rb

@@ -0,0 +1,63 @@
+# encoding: ascii-8bit
+
+# Copyright 2026 OpenC3, Inc.
+# All Rights Reserved.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See LICENSE.md for more details.
+#
+# This file may also be used under the terms of a commercial license
+# if purchased from OpenC3, Inc.
+
+require 'openc3/utilities/secrets'
+
+# Mixin providing plugin.txt keyword handling shared by the models the operator
+# turns into running containers (InterfaceModel / RouterModel and
+# MicroserviceModel). Including classes must initialize @ports to an Array.
+module OpenC3
+  module ConfigKeywordModel
+    # Parse a PORT keyword, appending [number, protocol] to @ports.
+    def parse_port(parser, keyword, parameters)
+      usage = "PORT <Number> <Protocol (Optional)"
+      parser.verify_num_parameters(1, 2, usage)
+      begin
+        @ports << [Integer(parameters[0])]
+      rescue # In case Integer fails
+        raise ConfigParser::Error.new(parser, "Port must be an integer: #{parameters[0]}", usage)
+      end
+      protocol = ConfigParser.handle_nil(parameters[1])
+      if protocol
+        # Per https://kubernetes.io/docs/concepts/services-networking/service/#protocol-support
+        if %w(TCP UDP SCTP).include?(protocol.upcase)
+          @ports[-1] << protocol.upcase
+        else
+          raise ConfigParser::Error.new(parser, "Unknown port protocol: #{parameters[1]}", usage)
+        end
+      else
+        @ports[-1] << 'TCP'
+      end
+    end
+
+    # Validate a SECRET / BRIDGE_SECRET definition. FILE type paths are restricted
+    # to Secrets.secret_file_dir to prevent reading or overwriting arbitrary files.
+    def validate_secret(parser, keyword, parameters)
+      type = parameters[0].to_s.upcase
+      unless ['ENV', 'FILE'].include?(type)
+        raise ConfigParser::Error.new(parser, "Unknown secret type '#{parameters[0]}' for #{keyword}. Must be ENV or FILE.")
+      end
+      # Normalize in place so the stored secret matches what the operator and
+      # Secrets.setup match on, both of which compare against 'ENV' / 'FILE' and
+      # use the path exactly as given.
+      parameters[0] = type
+      if type == 'FILE'
+        begin
+          parameters[2] = Secrets.validate_file_path(parameters[2])
+        rescue ArgumentError => error
+          raise ConfigParser::Error.new(parser, "#{keyword} #{error.message}")
+        end
+      end
+    end
+  end
+end

data/lib/openc3/models/gem_model.rb

@@ -22,6 +22,7 @@ require 'rubygems'
 require 'rubygems/uninstaller'
 require 'tempfile'
 require 'openc3/utilities/process_manager'
+require 'openc3/utilities/rubygems_url'
 require 'openc3/api/api'
 require 'pathname'
 
@@ -34,8 +35,8 @@ module OpenC3
     extend Api
 
     def self.names
-      if Dir.exist?("#{ENV['GEM_HOME']}/gems")
-        result = Pathname.new("#{ENV['GEM_HOME']}/gems").children.select { |c| c.directory? }.collect { |p| File.basename(p) + '.gem' }
+      if Dir.exist?("#{ENV.fetch('GEM_HOME', nil)}/gems")
+        result = Pathname.new("#{ENV.fetch('GEM_HOME', nil)}/gems").children.select { |c| c.directory? }.collect { |p| File.basename(p) + '.gem' }
       else
         result = []
       end
@@ -43,9 +44,9 @@ module OpenC3
     end
 
     def self.get(name)
-      path = "#{ENV['GEM_HOME']}/cosmoscache/#{name}"
+      path = "#{ENV.fetch('GEM_HOME', nil)}/cosmoscache/#{name}"
       return path if File.exist?(path)
-      path = "#{ENV['GEM_HOME']}/cache/#{name}"
+      path = "#{ENV.fetch('GEM_HOME', nil)}/cache/#{name}"
       return path if File.exist?(path)
       raise "Gem '#{name}' not found"
     end
@@ -54,8 +55,8 @@ module OpenC3
       if File.file?(gem_file_path)
         gem_filename = File.basename(gem_file_path)
         # Put into cosmoscache folder that we control
-        FileUtils.mkdir_p("#{ENV['GEM_HOME']}/cosmoscache") unless Dir.exist?("#{ENV['GEM_HOME']}/cosmoscache")
-        FileUtils.cp(gem_file_path, "#{ENV['GEM_HOME']}/cosmoscache/#{File.basename(gem_file_path)}")
+        FileUtils.mkdir_p("#{ENV.fetch('GEM_HOME', nil)}/cosmoscache") unless Dir.exist?("#{ENV.fetch('GEM_HOME', nil)}/cosmoscache")
+        FileUtils.cp(gem_file_path, "#{ENV.fetch('GEM_HOME', nil)}/cosmoscache/#{File.basename(gem_file_path)}")
         if gem_install
           Logger.info "Installing gem: #{gem_filename}"
           result = OpenC3::ProcessManager.instance.spawn(["ruby", "/openc3/bin/openc3cli", "geminstall", gem_filename, scope], "package_install", gem_filename, Time.now + 3600.0, scope: scope)
@@ -79,9 +80,11 @@ module OpenC3
         rubygems_url = get_setting('rubygems_url', scope: scope)
       rescue
         # If Redis isn't running try the ENV, then simply rubygems.org
-        rubygems_url = ENV['RUBYGEMS_URL']
-        rubygems_url ||= 'https://rubygems.org'
+        rubygems_url = ENV.fetch('RUBYGEMS_URL', RubygemsUrl::DEFAULT)
       end
+      # The url comes from a user-writable setting or ENV so validate it before
+      # using it as a Gem source
+      rubygems_url = RubygemsUrl.validate(rubygems_url) if rubygems_url
       Gem.sources = [rubygems_url] if rubygems_url
       Gem.done_installing_hooks.clear
       begin
@@ -92,7 +95,7 @@ module OpenC3
         Gem.install(gem_file_path, "> 0.pre", build_args: ['--no-document, --without development,test'], prerelease: true, domain: :both)
       end
     rescue => e
-      message = "Gem file #{gem_file_path} error installing to #{ENV['GEM_HOME']}\n#{e.formatted}"
+      message = "Gem file #{gem_file_path} error installing to #{ENV.fetch('GEM_HOME', nil)}\n#{e.formatted}"
       Logger.error message
       raise e
     end

data/lib/openc3/models/host_interface_microservice_model.rb

@@ -0,0 +1,114 @@
+# encoding: ascii-8bit
+
+# Copyright 2026 OpenC3, Inc.
+# All Rights Reserved.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See LICENSE.md for more details.
+#
+# This file may also be used under the terms of a commercial license
+# if purchased from OpenC3, Inc.
+
+require 'openc3/models/model'
+
+module OpenC3
+  # Captures the information openc3-app needs to spawn a COSMOS interface on the
+  # host computer (outside Docker) so it can reach hardware such as serial ports
+  # that aren't available inside a container. A host microservice performs raw
+  # data transfer and basic functionality only; complex processing (protocols,
+  # target definitions) stays on the Docker side of COSMOS. The host side speaks
+  # Iroh back to openc3-app which forwards the data into COSMOS through the named
+  # bridge_microservice relay.
+  #
+  # This model is written by InterfaceModel#deploy for bridged interfaces (those
+  # configured with the BRIDGE keyword) and read by openc3-app. It is deliberately
+  # kept separate from MicroserviceModel so it is NOT run by the normal COSMOS
+  # microservice operator.
+  class HostInterfaceMicroserviceModel < Model
+    PRIMARY_KEY = 'openc3_host_interface_microservices'
+
+    # The real interface class and its parameters, e.g. ['serial_interface.py', ...]
+    attr_accessor :config_params
+    attr_accessor :work_dir
+    attr_accessor :env
+    attr_accessor :options
+    attr_accessor :secret_options
+    attr_accessor :protocols
+    attr_accessor :secrets
+    attr_accessor :container
+    attr_accessor :needs_dependencies
+    # The bridge (bridge_microservice relay) this host interface routes through.
+    attr_accessor :bridge_name
+    # The Iroh ALPN stream name (the interface name) used to route data back to
+    # openc3-app and on to the matching COSMOS bridge_interface.
+    attr_accessor :stream
+
+    # NOTE: The following three class methods are reimplemented (like other
+    # scoped models) so the ModelController and Model class methods work.
+    def self.get(name:, scope:)
+      super("#{scope}__#{PRIMARY_KEY}", name: name)
+    end
+
+    def self.names(scope:)
+      super("#{scope}__#{PRIMARY_KEY}")
+    end
+
+    def self.all(scope:)
+      super("#{scope}__#{PRIMARY_KEY}")
+    end
+    # END NOTE
+
+    def initialize(
+      name:,
+      bridge_name:,
+      stream:,
+      config_params: [],
+      work_dir: '.',
+      env: {},
+      options: [],
+      secret_options: [],
+      protocols: [],
+      secrets: [],
+      container: nil,
+      needs_dependencies: false,
+      updated_at: nil,
+      plugin: nil,
+      scope:
+    )
+      super("#{scope}__#{PRIMARY_KEY}", name: name, updated_at: updated_at, plugin: plugin, scope: scope)
+      @bridge_name = bridge_name
+      @stream = stream
+      @config_params = config_params
+      @work_dir = work_dir
+      @env = env
+      @options = options
+      @secret_options = secret_options
+      @protocols = protocols
+      @secrets = secrets
+      @container = container
+      @needs_dependencies = needs_dependencies
+    end
+
+    def as_json(*a)
+      {
+        'name' => @name,
+        'scope' => @scope,
+        'bridge_name' => @bridge_name,
+        'stream' => @stream,
+        'config_params' => @config_params,
+        'work_dir' => @work_dir,
+        'env' => @env,
+        'options' => @options,
+        'secret_options' => @secret_options,
+        'protocols' => @protocols,
+        'secrets' => @secrets.as_json(*a),
+        'container' => @container,
+        'needs_dependencies' => @needs_dependencies,
+        'plugin' => @plugin,
+        'updated_at' => @updated_at
+      }
+    end
+  end
+end