@aipt/idp-deploy 0.1.2

package/src/sources.mjs

@@ -0,0 +1,78 @@
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { doctorConfig, referencedFiles } from './config.mjs';
+import { invariant } from './errors.mjs';
+import { sha256 } from './hash.mjs';
+import { withInstanceLock, writeReceipt } from './operations.mjs';
+import { assertSafeRegularFile, atomicWrite, resolveContained } from './security.mjs';
+import { validateBenchSnapshot, validateDyytoSnapshot } from './source-contracts.mjs';
+
+export { validateBenchSnapshot, validateDyytoSnapshot } from './source-contracts.mjs';
+
+const MAX_SNAPSHOT_BYTES = 16 * 1024 * 1024;
+
+function targetDefinitions(root, source) {
+  const file = source === 'dyyto' ? 'dyyto-package-release-catalog.json' : 'bench-environment-snapshot.json';
+  const key = source === 'dyyto' ? 'DYYTO_CATALOG_FILE' : 'BENCH_SNAPSHOT_FILE';
+  const componentTargets = referencedFiles(root).filter((ref) => ['flow', 'portal'].includes(ref.scope) && ref.key === `${ref.scope.toUpperCase()}_${key}`);
+  invariant(componentTargets.length === 2, 'IDP_SOURCE_TARGETS_INVALID', `${source} Snapshot必须同时声明Flow与Portal文件目标`);
+  return [
+    { logical: `snapshots/${file}`, absolute: resolveContained(root, `snapshots/${file}`, '共享Snapshot') },
+    ...componentTargets.map((ref) => ({ logical: path.relative(root, ref.absolute), absolute: ref.absolute })),
+  ];
+}
+
+function capturePreimages(targets) {
+  return targets.map((target) => {
+    if (!fs.existsSync(target.absolute)) return { ...target, existed: false, bytes: null, digest: null };
+    assertSafeRegularFile(target.absolute, 0o600, { allowEmpty: true, role: target.logical });
+    const bytes = fs.readFileSync(target.absolute);
+    return { ...target, existed: true, bytes, digest: sha256(bytes) };
+  });
+}
+
+function currentDigest(entry) {
+  if (!fs.existsSync(entry.absolute)) return null;
+  assertSafeRegularFile(entry.absolute, 0o600, { allowEmpty: true, role: entry.logical });
+  return sha256(fs.readFileSync(entry.absolute));
+}
+
+export function importSourceSnapshot({ configRoot, source, bytes, receiptWriter = writeReceipt }) {
+  invariant(['dyyto', 'bench'].includes(source), 'IDP_SOURCE_UNKNOWN', 'source只能是dyyto或bench');
+  invariant(Buffer.byteLength(bytes) > 0 && Buffer.byteLength(bytes) <= MAX_SNAPSHOT_BYTES, 'IDP_SOURCE_SIZE_INVALID', 'Snapshot必须介于1 byte与16 MiB之间');
+  let document;
+  try { document = JSON.parse(Buffer.isBuffer(bytes) ? bytes.toString('utf8') : bytes); }
+  catch { invariant(false, 'IDP_SOURCE_JSON_INVALID', 'Snapshot不是有效JSON'); }
+  if (source === 'dyyto') validateDyytoSnapshot(document); else validateBenchSnapshot(document);
+  const normalized = Buffer.from(`${JSON.stringify(document, null, 2)}\n`);
+  invariant(normalized.byteLength <= MAX_SNAPSHOT_BYTES, 'IDP_SOURCE_SIZE_INVALID', 'Snapshot规范化后不能超过16 MiB');
+  const preliminary = doctorConfig(configRoot, { requireConfigured: false, profile: 'registry' });
+  return withInstanceLock(preliminary.root, preliminary.env, `sources:import:${source}`, () => {
+    const targets = targetDefinitions(preliminary.root, source);
+    for (const target of targets) fs.mkdirSync(path.dirname(target.absolute), { recursive: true, mode: 0o700 });
+    const preimages = capturePreimages(targets);
+    const generation = `${new Date().toISOString().replace(/[:.]/gu, '-')}-${sha256(normalized).slice(7, 19)}-${crypto.randomUUID().slice(0, 8)}`;
+    const history = resolveContained(preliminary.root, `snapshots/history/${source}/${generation}`, 'Snapshot Preimage代次');
+    fs.mkdirSync(history, { recursive: true, mode: 0o700 });
+    for (const entry of preimages) {
+      if (entry.existed) fs.writeFileSync(path.join(history, `${entry.logical.replaceAll('/', '__')}.preimage`), entry.bytes, { mode: 0o600, flag: 'wx' });
+    }
+    fs.writeFileSync(path.join(history, 'preimages.json'), `${JSON.stringify({ schemaVersion: 1, source, targets: preimages.map(({ logical, existed, digest }) => ({ logical, existed, digest })) }, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
+    const completed = [];
+    try {
+      for (const entry of preimages) {
+        invariant(currentDigest(entry) === entry.digest, 'IDP_SOURCE_PREIMAGE_CONFLICT', `${entry.logical}在导入期间被并发修改`);
+        atomicWrite(entry.absolute, normalized, 0o600);
+        completed.push(entry);
+      }
+      return receiptWriter(preliminary.env, 'source-snapshot-import', { source, snapshotDigest: source === 'dyyto' ? document.sourceDigest : document.snapshotDigest, targets: targets.map(({ logical }) => logical), preimageGeneration: generation });
+    } catch (error) {
+      for (const entry of completed.reverse()) {
+        invariant(currentDigest(entry) === sha256(normalized), 'IDP_SOURCE_RECOVERY_REQUIRED', `${entry.logical}在回滚前被并发修改，禁止静默覆盖`);
+        if (entry.existed) atomicWrite(entry.absolute, entry.bytes, 0o600); else fs.unlinkSync(entry.absolute);
+      }
+      throw error;
+    }
+  });
+}

package/src/workbench-projects.mjs

@@ -0,0 +1,118 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import YAML from 'yaml';
+import { IdpError, invariant } from './errors.mjs';
+import { hashFile, sha256, stableJson } from './hash.mjs';
+import { run } from './process.mjs';
+import { assertOutsideRepositories, assertSafeRegularFile, atomicWrite, canonicalPlannedDirectory, resolveContained, secureDirectoryRoot } from './security.mjs';
+
+const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
+
+function configRoot(root) { const canonical = secureDirectoryRoot(root, 'IDP_CONFIG_DIR'); assertOutsideRepositories(canonical, 'IDP_CONFIG_DIR'); return canonical; }
+function safeDirectory(candidate, role) {
+  invariant(path.isAbsolute(candidate ?? ''), 'IDP_WORKBENCH_PATH_NOT_ABSOLUTE', `${role}必须是绝对路径`);
+  const canonical = fs.realpathSync.native(candidate); const stat = fs.lstatSync(canonical);
+  invariant(stat.isDirectory() && !stat.isSymbolicLink(), 'IDP_WORKBENCH_PATH_INVALID', `${role}必须是普通目录`);
+  invariant(canonical !== path.parse(canonical).root && canonical !== fs.realpathSync.native(os.homedir()), 'IDP_WORKBENCH_PATH_TOO_BROAD', `${role}不能是根目录或HOME`);
+  return canonical;
+}
+
+export function initializeWorkbenchProjects({ configRoot: input }) {
+  const root = configRoot(input); const directory = resolveContained(root, 'workbench', '工作台配置目录'); secureDirectoryRoot(directory, '工作台配置目录', { create: true });
+  const candidate = path.join(directory, 'projects.candidate.json');
+  if (!fs.existsSync(candidate)) atomicWrite(candidate, `${JSON.stringify({ schemaVersion: 1, projects: [] }, null, 2)}\n`, 0o600);
+  return { schemaVersion: 'idp.workbench-project-candidate/v1', status: 'ready', candidate };
+}
+
+function readCandidate(root, file) {
+  invariant(path.isAbsolute(file ?? ''), 'IDP_WORKBENCH_CANDIDATE_NOT_ABSOLUTE', '--file必须是绝对路径');
+  const workbench = resolveContained(root, 'workbench', '工作台配置目录'); const candidate = fs.realpathSync.native(file);
+  const relative = path.relative(workbench, candidate); invariant(relative && !relative.startsWith('..') && !path.isAbsolute(relative), 'IDP_WORKBENCH_CANDIDATE_OUTSIDE_CONFIG', 'candidate必须位于IDP_CONFIG_DIR/workbench');
+  assertSafeRegularFile(candidate, 0o600, { allowEmpty: false, role: '工作台项目candidate' });
+  const value = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+  invariant(value.schemaVersion === 1 && Array.isArray(value.projects), 'IDP_WORKBENCH_CANDIDATE_INVALID', '工作台项目candidate版本无效');
+  const ids = new Set(); const roots = new Set();
+  const projects = value.projects.map((item) => {
+    invariant(ID.test(item?.id ?? '') && !ids.has(item.id), 'IDP_WORKBENCH_PROJECT_ID_INVALID', '项目id无效或重复'); ids.add(item.id);
+    const hostPath = safeDirectory(item.hostPath, `项目${item.id}`); invariant(!roots.has(hostPath), 'IDP_WORKBENCH_PROJECT_DUPLICATE', '项目宿主路径重复'); roots.add(hostPath);
+    const declaredBindings = Array.isArray(item.configBindings) ? item.configBindings : item.applicationConfigDir ? [{ relativePath: '.', applicationConfigDir: item.applicationConfigDir }] : [];
+    invariant(declaredBindings.length > 0, 'IDP_WORKBENCH_CONFIG_BINDING_REQUIRED', `项目${item.id}至少需要一个应用Config Binding`);
+    const relativePaths = new Set();
+    const configBindings = declaredBindings.map((binding, index) => {
+      const relativePath = binding?.relativePath === '.' ? '.' : path.posix.normalize(binding?.relativePath ?? '');
+      invariant(relativePath === '.' || (relativePath.length > 0 && !relativePath.startsWith('../') && !path.posix.isAbsolute(relativePath) && !relativePath.includes('\\')), 'IDP_WORKBENCH_PROJECT_RELATIVE_PATH_INVALID', `项目${item.id}的relativePath无效`);
+      invariant(!relativePaths.has(relativePath), 'IDP_WORKBENCH_PROJECT_RELATIVE_PATH_DUPLICATE', `项目${item.id}的relativePath重复`); relativePaths.add(relativePath);
+      const applicationRoot = fs.realpathSync.native(path.resolve(hostPath, relativePath));
+      invariant(applicationRoot === hostPath || applicationRoot.startsWith(`${hostPath}${path.sep}`), 'IDP_WORKBENCH_PROJECT_RELATIVE_PATH_ESCAPE', `项目${item.id}的应用路径逃逸项目目录`);
+      invariant(fs.existsSync(path.join(applicationRoot, 'project-capabilities.json')), 'IDP_WORKBENCH_APPLICATION_INVALID', `项目${item.id}的${relativePath}缺少project-capabilities.json`);
+      const applicationConfigDir = safeDirectory(binding.applicationConfigDir, `项目${item.id}/${relativePath} Config Dir`); assertOutsideRepositories(applicationConfigDir, `项目${item.id}/${relativePath} Config Dir`);
+      return { relativePath, applicationConfigDir, containerPath: relativePath === '.' ? `/workspaces/${item.id}` : `/workspaces/${item.id}/${relativePath}`, configDirectory: `/config/applications/${item.id}-${index}/local` };
+    });
+    return { id: item.id, hostPath, containerPath: `/workspaces/${item.id}`, configBindings };
+  });
+  return { candidate, projects };
+}
+
+export function createWorkbenchProjectsPlan({ configRoot: input, dyytoRoot, candidateFile, output, now = new Date().toISOString() }) {
+  const root = configRoot(input), dyyto = safeDirectory(dyytoRoot, 'Dyyto仓库');
+  invariant(fs.existsSync(path.join(dyyto, 'compose.yaml')), 'IDP_WORKBENCH_DYYTO_INVALID', 'Dyyto仓库缺少compose.yaml');
+  const candidate = readCandidate(root, candidateFile);
+  const core = { schemaVersion: 'idp.workbench-project-plan/v1', dyytoRoot: dyyto, dyytoComposeDigest: hashFile(path.join(dyyto, 'compose.yaml')), candidate: { path: candidate.candidate, digest: hashFile(candidate.candidate) }, projects: candidate.projects, createdAt: now };
+  const plan = { ...core, planId: sha256(stableJson(core)) };
+  const plans = resolveContained(root, 'plans/workbench-projects', '工作台Plan目录'); secureDirectoryRoot(plans, '工作台Plan目录', { create: true });
+  const target = canonicalPlannedDirectory(output, '工作台Plan输出'); const relative = path.relative(plans, target);
+  invariant(relative && !relative.startsWith('..') && !path.isAbsolute(relative) && !fs.existsSync(target), 'IDP_WORKBENCH_PLAN_OUTPUT_INVALID', 'Plan必须以新文件写入IDP_CONFIG_DIR/plans/workbench-projects');
+  atomicWrite(target, `${JSON.stringify(plan, null, 2)}\n`, 0o600); return plan;
+}
+
+function readPlan(root, file) {
+  invariant(path.isAbsolute(file ?? ''), 'IDP_WORKBENCH_PLAN_NOT_ABSOLUTE', '--plan必须是绝对路径'); const candidate = fs.realpathSync.native(file);
+  const plans = resolveContained(root, 'plans/workbench-projects', '工作台Plan目录'); const relative = path.relative(plans, candidate);
+  invariant(relative && !relative.startsWith('..') && !path.isAbsolute(relative), 'IDP_WORKBENCH_PLAN_OUTSIDE_CONFIG', 'Plan必须位于受管目录');
+  assertSafeRegularFile(candidate, 0o600, { allowEmpty: false, role: '工作台项目Plan' }); const plan = JSON.parse(fs.readFileSync(candidate, 'utf8')); const { planId, ...core } = plan;
+  invariant(plan.schemaVersion === 'idp.workbench-project-plan/v1' && sha256(stableJson(core)) === planId, 'IDP_WORKBENCH_PLAN_INVALID', '工作台项目Plan摘要无效'); return { plan, candidate };
+}
+
+function revalidate(plan) {
+  invariant(hashFile(path.join(plan.dyytoRoot, 'compose.yaml')) === plan.dyytoComposeDigest && hashFile(plan.candidate.path) === plan.candidate.digest, 'IDP_WORKBENCH_INPUT_CHANGED', 'Dyyto Compose或项目candidate已变化，请重新Plan');
+  for (const project of plan.projects) {
+    invariant(safeDirectory(project.hostPath, '项目目录') === project.hostPath, 'IDP_WORKBENCH_INPUT_CHANGED', '项目Binding路径已变化');
+    for (const binding of project.configBindings) invariant(safeDirectory(binding.applicationConfigDir, '应用Config Dir') === binding.applicationConfigDir, 'IDP_WORKBENCH_INPUT_CHANGED', '应用Config Binding路径已变化');
+  }
+}
+
+function rendered(plan, runtime) {
+  const bindingFile = path.join(runtime, 'project-bindings.json');
+  const compose = { services: { 'dyyto-workbench': { environment: { DYYTO_WORKBENCH_MODE: 'project-readonly', DYYTO_WORKBENCH_PROJECT_BINDINGS_FILE: '/var/lib/dyyto-workbench/project-bindings.json' }, volumes: [
+    { type: 'bind', source: bindingFile, target: '/var/lib/dyyto-workbench/project-bindings.json', read_only: true },
+    ...plan.projects.flatMap((project) => [{ type: 'bind', source: project.hostPath, target: project.containerPath, read_only: true }, ...project.configBindings.map((binding) => ({ type: 'bind', source: binding.applicationConfigDir, target: binding.configDirectory, read_only: true }))]),
+  ] } } };
+  const bindings = { schemaVersion: 1, repositories: plan.projects.map((project) => ({ id: project.id, containerPath: project.containerPath })), projects: plan.projects.flatMap((project) => project.configBindings.map((binding) => ({ id: `${project.id}:${binding.relativePath}`, containerPath: binding.containerPath, configDirectory: binding.configDirectory }))) };
+  return { bindingFile, bindings, compose };
+}
+
+export function applyWorkbenchProjectsPlan({ configRoot: input, planFile, runner = run }) {
+  const root = configRoot(input), { plan } = readPlan(root, planFile); revalidate(plan);
+  const runtime = resolveContained(root, 'runtime/workbench-projects', '工作台运行目录'); secureDirectoryRoot(runtime, '工作台运行目录', { create: true });
+  const output = rendered(plan, runtime), composeFile = path.join(runtime, 'compose.override.yaml'), stateFile = path.join(runtime, 'state.json');
+  const before = fs.existsSync(stateFile) ? fs.readFileSync(stateFile) : null;
+  if (before) atomicWrite(path.join(runtime, `preimage-${Date.now()}.json`), before, 0o600);
+  atomicWrite(output.bindingFile, `${JSON.stringify(output.bindings, null, 2)}\n`, 0o600); atomicWrite(composeFile, YAML.stringify(output.compose), 0o600);
+  runner('docker', ['compose', '--project-directory', plan.dyytoRoot, '--file', path.join(plan.dyytoRoot, 'compose.yaml'), '--file', composeFile, 'up', '-d', '--wait', '--remove-orphans'], { cwd: plan.dyytoRoot });
+  const mountTargets = [...plan.projects.map((project) => project.containerPath), ...plan.projects.flatMap((project) => project.configBindings.map((binding) => binding.configDirectory))];
+  const state = { schemaVersion: 'idp.workbench-project-runtime/v1', planId: plan.planId, dyytoRoot: plan.dyytoRoot, dyytoComposeFile: path.join(plan.dyytoRoot, 'compose.yaml'), composeFile, bindingFile: output.bindingFile, projects: output.bindings.projects, mountTargets };
+  atomicWrite(stateFile, `${JSON.stringify(state, null, 2)}\n`, 0o600); return { ...state, status: 'verified' };
+}
+
+export function verifyWorkbenchProjects({ configRoot: input, runner = run }) {
+  const root = configRoot(input), stateFile = resolveContained(root, 'runtime/workbench-projects/state.json', '工作台运行态'); assertSafeRegularFile(stateFile, 0o600, { allowEmpty: false, role: '工作台运行态' });
+  const state = JSON.parse(fs.readFileSync(stateFile, 'utf8'));
+  const containerId = runner('docker', ['compose', '--project-directory', state.dyytoRoot, '--file', state.dyytoComposeFile, '--file', state.composeFile, 'ps', '-q', 'dyyto-workbench'], { capture: true }).stdout.trim();
+  invariant(containerId.length > 0 && !containerId.includes('\n'), 'IDP_WORKBENCH_CONTAINER_NOT_FOUND', '未找到唯一的Dyyto工作台容器');
+  const result = runner('docker', ['inspect', containerId, '--format', '{{json .Mounts}}'], { capture: true });
+  const mounts = JSON.parse(result.stdout); for (const target of state.mountTargets) {
+    const source = mounts.find((mount) => mount.Destination === target); invariant(source && source.RW === false, 'IDP_WORKBENCH_MOUNT_NOT_READONLY', `${target}未以只读方式挂载`);
+  }
+  return { schemaVersion: 'idp.workbench-project-verification/v1', status: 'verified', planId: state.planId, projects: state.projects.map((item) => item.id) };
+}