@aopslabs/aops-server 0.2.0 → 0.2.2

package/scripts/container-start.mjs

@@ -0,0 +1,106 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { applyCommunityStrictPgSchema } from "@aopslabs/aops-pg-bootstrap";
+
+import {
+  resolveCommunityHostOptionsFromEnvironment,
+  runCommunityHost,
+} from "./community-host.mjs";
+
+function nonEmpty(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function port(value, fallback, label) {
+  const candidate = nonEmpty(value) || String(fallback);
+  if (!/^[1-9]\d{0,4}$/.test(candidate) || Number(candidate) > 65535) {
+    throw new Error(`aops_container_${label}_port_invalid`);
+  }
+  return candidate;
+}
+
+export function normalizeContainerPostgresUrl(value, tlsPolicy = "require") {
+  const candidate = nonEmpty(value);
+  let parsed;
+  try {
+    parsed = new URL(candidate);
+  } catch {
+    throw new Error("aops_container_postgresql_url_required");
+  }
+  if (
+    (parsed.protocol !== "postgres:" && parsed.protocol !== "postgresql:") ||
+    !parsed.hostname || !parsed.username || !parsed.password || !parsed.pathname.slice(1) ||
+    parsed.search || parsed.hash
+  ) {
+    throw new Error("aops_container_postgresql_url_invalid");
+  }
+  const tls = nonEmpty(tlsPolicy).toLowerCase() || "require";
+  if (tls === "disable") parsed.searchParams.set("sslmode", "disable");
+  else if (tls === "require") {
+    parsed.searchParams.set("sslmode", "require");
+    parsed.searchParams.set("uselibpqcompat", "true");
+  } else if (tls === "verify-full") parsed.searchParams.set("sslmode", "verify-full");
+  else throw new Error("aops_container_postgresql_tls_invalid");
+  return parsed.toString();
+}
+
+function migrationInputs() {
+  const packageRoot = path.resolve(import.meta.dirname, "..");
+  const packagePolicy = path.join(import.meta.dirname, "community-migration-policy-package-v1.json");
+  const sourcePolicy = path.join(import.meta.dirname, "community-migration-policy-v1.json");
+  const packaged = existsSync(packagePolicy);
+  const policyPath = packaged ? packagePolicy : sourcePolicy;
+  return {
+    policy: JSON.parse(readFileSync(policyPath, "utf8")),
+    workspaceRoot: packaged ? packageRoot : path.resolve(packageRoot, "../.."),
+  };
+}
+
+export function resolveContainerRuntimeEnvironment(env = process.env) {
+  const internalPort = port(env.AOPS_PORT, 5900, "internal");
+  if (internalPort !== "5900") throw new Error("aops_container_internal_port_required:5900");
+  const publicPort = port(env.AOPS_PUBLIC_PORT, 5900, "public");
+  const configuredAuth = nonEmpty(env.AOPS_AUTH_PROVIDER).toLowerCase() || "trusted-local";
+  if (configuredAuth !== "trusted-local") throw new Error("aops_container_trusted_local_required");
+  return {
+    ...env,
+    NODE_ENV: "production",
+    AOPS_PG_URL: normalizeContainerPostgresUrl(env.AOPS_PG_URL, env.AOPS_POSTGRES_TLS),
+    AOPS_DB_BOOTSTRAP_MODE: "explicit",
+    AOPS_AUTH_PROVIDER: "trusted-local",
+    AOPS_SERVER_EXPOSURE: "container",
+    COMMUNITY_PORT: internalPort,
+    AOPS_COMMUNITY_PUBLIC_PORT: publicPort,
+  };
+}
+
+export async function runContainerServer(
+  env = process.env,
+  dependencies = {},
+) {
+  const runtimeEnv = resolveContainerRuntimeEnvironment(env);
+  const hostEnv = env === process.env ? Object.assign(process.env, runtimeEnv) : runtimeEnv;
+  const migration = migrationInputs();
+  const logs = [];
+  const receipt = await (dependencies.migrate ?? applyCommunityStrictPgSchema)({
+    repoUrl: runtimeEnv.AOPS_PG_URL,
+    workspaceRoot: migration.workspaceRoot,
+    policy: migration.policy,
+    logs,
+  });
+  process.stderr.write(
+    `[aops-container] PostgreSQL ${receipt.migrationPlan.action}; pending=${receipt.migrationPlan.pendingMigrations.length}\n`,
+  );
+  const host = dependencies.host ?? runCommunityHost;
+  return host(resolveCommunityHostOptionsFromEnvironment(hostEnv), hostEnv);
+}
+
+const isMain = typeof process.argv[1] === "string" && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMain) {
+  runContainerServer().catch((error) => {
+    process.stderr.write(`[aops-container] ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  });
+}