@alchemy.run/fly 2.0.0-beta.85 → 2.0.0-beta.86

package/src/replicas.ts

@@ -653,6 +653,8 @@ export const leaseSnapshot = Effect.fn(function* (
     (machine) =>
       Effect.gen(function* () {
         if (!machine.id || machine.host_status === "unreachable") return;
+        // Already deleted by this operation (a scale-down retired it).
+        if (leases.wasRemoved(machine.id)) return;
         const id = machine.id;
         yield* leases.acquire([id]).pipe(
           Effect.tap(() => Effect.sync(() => leased.add(id))),
@@ -670,7 +672,7 @@ export const leaseSnapshot = Effect.fn(function* (
   ).pipe(Effect.timeout("30 seconds"));
   const observed: FlyMachine[] = [];
   for (const machine of ordered) {
-    if (!machine.id) continue;
+    if (!machine.id || leases.wasRemoved(machine.id)) continue;
     if (machine.host_status === "unreachable") {
       observed.push(machine);
       continue;
@@ -1187,7 +1189,17 @@ const reconcileLeasedReplicas = Effect.fn(function* (
           skip_launch: input.skipLaunch === true ? true : undefined,
           min_secrets_version: input.minSecretsVersion,
         })
-        .pipe(Effect.catchTag("Conflict", () => Effect.undefined));
+        .pipe(
+          // A storage host out of capacity may still have made the Machine;
+          // names are unique per App, so a retry that made it before hits
+          // Conflict and the listing below finds it.
+          Effect.retry({
+            while: (error) => error._tag === "StorageHostCapacity",
+            schedule: Schedule.spaced("5 seconds"),
+            times: 6,
+          }),
+          Effect.catchTag("Conflict", () => Effect.undefined),
+        );
       current =
         created ??
         (yield* listMachinesByApp(input.appName).pipe(
@@ -1478,3 +1490,52 @@ export const observeReplicaSet = Effect.fn(function* (input: {
     };
   return undefined;
 });
+
+/**
+ * The Machines a lookup names: those whose name (or Alchemy base name) is
+ * `name`, or `name-N` for a replica, or every Machine in the App when
+ * `name` is omitted. Of an Alchemy deployment, only the newest generation
+ * that finished rolling out counts; a Machine without that metadata
+ * counts as it is. `undefined` when nothing in the App matches.
+ */
+export const lookupReplicaSet = Effect.fn(function* (input: { appName: string; name?: string }) {
+  const named = (yield* listMachinesByApp(input.appName)).filter((machine) => {
+    if (input.name === undefined) return true;
+    const base = machine.config?.metadata?.[alchemyMetadataKeys.baseName];
+    return (
+      base === input.name ||
+      machine.name === input.name ||
+      (base === undefined && machine.name?.startsWith(`${input.name}-`) === true)
+    );
+  });
+  const active = named.filter((machine) => {
+    const phase = machine.config?.metadata?.[alchemyMetadataKeys.phase];
+    return (phase === undefined || phase === "active") && machine.cordoned !== true;
+  });
+  const sequenceOf = (machine: FlyMachine) =>
+    Number(machine.config?.metadata?.[alchemyMetadataKeys.sequence] ?? 0);
+  const newest = Math.max(0, ...active.map(sequenceOf));
+  const listed = active
+    .filter((machine) => sequenceOf(machine) === newest)
+    .sort((a, b) => replicaIndexOf(a) - replicaIndexOf(b));
+  if (listed.length === 0) return undefined;
+  const volumesById = new Map<string, FlyVolume>();
+  for (const machine of listed) {
+    for (const mount of machine.config?.mounts ?? []) {
+      const volumeId = mount.volume;
+      if (volumeId === undefined || volumesById.has(volumeId)) continue;
+      const volume = yield* getVolumeById(input.appName, volumeId);
+      if (volume !== undefined) volumesById.set(volumeId, volume);
+    }
+  }
+  const replicas = listed.map((machine) => toReplica(machine, volumesById));
+  return toReplicaSet(
+    replicas,
+    input.appName,
+    listed[0]?.config?.metadata?.[alchemyMetadataKeys.baseName] ??
+      input.name ??
+      replicas[0]?.name ??
+      "",
+    listed[0]?.config?.services,
+  );
+});

package/src/rpc.ts

@@ -1,13 +1,18 @@
 import * as crypto from "node:crypto";
 import type { HttpEffect } from "alchemy/Http";
 import { RPC_PATH_PREFIX, serveRpc } from "alchemy/Rpc";
+import * as Clock from "effect/Clock";
+import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import { HttpServerRequest } from "effect/http/HttpServerRequest";
 import * as HttpServerResponse from "effect/http/HttpServerResponse";
 
-/** Machine env var holding the Service's caller token. */
-export const RPC_TOKEN_ENV = "ALCHEMY_FLY_RPC_TOKEN";
+/**
+ * Machine env var holding the Apps allowed to call the Service's methods,
+ * comma-separated: the Apps of the Services that bind it.
+ */
+export const RPC_CALLERS_ENV = "ALCHEMY_FLY_RPC_CALLERS";
 /** Machine env var holding the organization callers must belong to. */
 export const RPC_ORG_ENV = "ALCHEMY_FLY_ORG";
 /**
@@ -15,8 +20,6 @@ export const RPC_ORG_ENV = "ALCHEMY_FLY_ORG";
  * Requests on it must come from Fly's private network.
  */
 export const BINDING_PORT_ENV = "ALCHEMY_FLY_BINDING_PORT";
-/** Request header carrying the caller token. */
-export const RPC_TOKEN_HEADER = "x-alchemy-rpc-token";
 /** Published port Alchemy adds when a Service has no plain-HTTP port. */
 export const DEFAULT_BINDING_PORT = 7780;
 
@@ -26,21 +29,16 @@ const FLY_SRC_SIGNATURE_HEADER = "fly-src-signature";
 const FLY_SRC_PUBLIC_KEY = "/.fly/fly-src.pub";
 /** DER prefix that wraps a raw 32-byte ed25519 key as SubjectPublicKeyInfo. */
 const ED25519_SPKI_PREFIX = "302a300506032b6570032100";
-/** Oldest accepted `Fly-Src` timestamp, in seconds. */
-const MAX_FLY_SRC_AGE_SECONDS = 300;
+/**
+ * Oldest accepted `Fly-Src` timestamp, in seconds. The signature covers
+ * only the header, so a short window limits replay; Fly suggests 10s, and
+ * the rest allows for clock skew between its proxy and the Machine.
+ */
+const MAX_FLY_SRC_AGE_SECONDS = 30;
 
 const header = (headers: Record<string, string | undefined>, name: string): string =>
   headers[name] ?? "";
 
-const tokensEqual = (left: string, right: string): boolean => {
-  if (left.length !== right.length) return false;
-  let mismatch = 0;
-  for (let i = 0; i < left.length; i++) {
-    mismatch |= left.charCodeAt(i) ^ right.charCodeAt(i);
-  }
-  return mismatch === 0;
-};
-
 let publicKey: crypto.KeyObject | undefined;
 
 /** Load Fly's `Fly-Src` verification key once per instance. */
@@ -64,40 +62,42 @@ const loadPublicKey = Effect.gen(function* () {
 });
 
 /**
- * Whether the request carries a valid `Fly-Src` signature from Fly's proxy
- * for a caller in `org`. Fly adds the header only to requests that arrive
- * over its private network, so a public request can never pass.
+ * The calling App named by a valid `Fly-Src` signature from Fly's proxy for
+ * a caller in `org`, or `undefined`. Fly adds the header only to requests
+ * that arrive over its private network and signs who sent them, so a public
+ * request can never pass and no caller can claim another App.
  */
 export const verifyFlySrc = (headers: Record<string, string | undefined>, org: string) =>
   Effect.gen(function* () {
     const source = header(headers, FLY_SRC_HEADER);
     const signature = header(headers, FLY_SRC_SIGNATURE_HEADER);
-    if (source.length === 0 || signature.length === 0 || org.length === 0) return false;
+    if (source.length === 0 || signature.length === 0 || org.length === 0) return undefined;
     const key = yield* loadPublicKey;
-    if (key === undefined) return false;
+    if (key === undefined) return undefined;
     const valid = yield* Effect.try(() =>
       crypto.verify(null, Buffer.from(source), key, Buffer.from(signature, "base64")),
     ).pipe(Effect.orElseSucceed(() => false));
-    if (!valid) return false;
+    if (!valid) return undefined;
     const fields = Object.fromEntries(
       source.split(";").map((pair) => {
         const at = pair.indexOf("=");
         return [pair.slice(0, at), pair.slice(at + 1)];
       }),
     );
-    const now = yield* Effect.sync(() => Date.now() / 1000);
+    const now = (yield* Clock.currentTimeMillis) / 1000;
     const age = now - Number(fields.ts);
-    return fields.org === org && age >= -60 && age <= MAX_FLY_SRC_AGE_SECONDS;
+    const fresh = age >= -MAX_FLY_SRC_AGE_SECONDS && age <= MAX_FLY_SRC_AGE_SECONDS;
+    return fields.org === org && fresh && fields.app ? fields.app : undefined;
   });
 
 const unauthorized = HttpServerResponse.text("Unauthorized", { status: 401 });
 
 /**
  * Serve a Service's RPC methods on `/__rpc__/*` and everything else with
- * `fallback`. RPC calls must carry the Service's caller token and a valid
- * `Fly-Src` signature from the Service's organization. Every request on the
- * port Alchemy added for bindings must carry the `Fly-Src` signature, so
- * that port never answers the public internet.
+ * `fallback`. RPC calls must carry a valid `Fly-Src` signature from the
+ * Service's organization naming an App that binds the Service. Every
+ * request on the port Alchemy added for bindings must carry the `Fly-Src`
+ * signature, so that port never answers the public internet.
  */
 export const serveFlyRpc = <Req = never>(
   shape: Record<string, unknown>,
@@ -107,23 +107,20 @@ export const serveFlyRpc = <Req = never>(
     const request = yield* HttpServerRequest;
     const headers = request.headers as Record<string, string | undefined>;
     const isRpc = request.url.includes(RPC_PATH_PREFIX);
-    const env = yield* Effect.sync(() => ({
-      bindingPort: process.env[BINDING_PORT_ENV] ?? "",
-      org: process.env[RPC_ORG_ENV] ?? "",
-      token: process.env[RPC_TOKEN_ENV] ?? "",
-    }));
+    const readEnv = (name: string) => Config.String(name).pipe(Effect.orElseSucceed(() => ""));
+    const env = {
+      bindingPort: yield* readEnv(BINDING_PORT_ENV),
+      org: yield* readEnv(RPC_ORG_ENV),
+      callers: yield* readEnv(RPC_CALLERS_ENV),
+    };
     const bindingPort = env.bindingPort;
     const onBindingPort =
       bindingPort.length > 0 && header(headers, "fly-forwarded-port") === bindingPort;
     if (!isRpc && !onBindingPort) return yield* fallback;
-    if (!(yield* verifyFlySrc(headers, env.org))) return unauthorized;
-    if (isRpc) {
-      const expected = env.token;
-      const provided = header(headers, RPC_TOKEN_HEADER);
-      if (expected.length === 0 || provided.length === 0 || !tokensEqual(provided, expected)) {
-        return unauthorized;
-      }
-    }
+    const caller = yield* verifyFlySrc(headers, env.org);
+    if (caller === undefined) return unauthorized;
+    // Methods answer only the Apps of the Services that bind this one.
+    if (isRpc && !env.callers.split(",").includes(caller)) return unauthorized;
     return yield* serveRpc(shape, fallback);
   });