@aopslabs/aops-server 0.2.0

package/build/server/chunks/aops-runtime-config-CHpDUCdE.js

@@ -0,0 +1,185 @@
+import { lstatSync, realpathSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { Pool } from 'pg';
+
+const COMMUNITY_PG_ENV_KEY = "AOPS_PG_URL";
+const COMMUNITY_PG_SCHEMA_TABLES = ["projects", "docman_documents", "projectman_kanban_boards", "chatv3-rooms", "sys_event_stores"];
+const codepointCompare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+function nonEmpty(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function assertNoAmbientPgEnv(processEnv) {
+  const forbidden = Object.keys(processEnv).filter((key) => /^PG[A-Z0-9_]+$/i.test(key) && nonEmpty(processEnv[key])).sort();
+  if (forbidden.length > 0) {
+    throw new Error(`community_pg_ambient_env_forbidden:${forbidden.join(",")}`);
+  }
+}
+function decodeUrlComponent(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    throw new Error("community_pg_url_invalid");
+  }
+}
+function isLoopbackPgHost(value) {
+  const host = value.trim().toLowerCase();
+  if (host === "localhost" || host === "::1") return true;
+  const match = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  return Boolean(match && match.slice(1).every((octet) => Number(octet) <= 255));
+}
+function parsePgTarget(value) {
+  const normalized = typeof value === "string" ? value.trim() : "";
+  if (!normalized) throw new Error("aops_pg_url_required");
+  let parsed;
+  try {
+    parsed = new URL(normalized);
+  } catch {
+    throw new Error("community_pg_url_invalid");
+  }
+  if (parsed.protocol !== "postgres:" && parsed.protocol !== "postgresql:" || parsed.hash) {
+    throw new Error("community_pg_url_invalid");
+  }
+  const host = parsed.hostname.startsWith("[") && parsed.hostname.endsWith("]") ? parsed.hostname.slice(1, -1) : parsed.hostname;
+  const port = parsed.port ? Number(parsed.port) : 5432;
+  const user = decodeUrlComponent(parsed.username);
+  const password = decodeUrlComponent(parsed.password);
+  const database = decodeUrlComponent(parsed.pathname.startsWith("/") ? parsed.pathname.slice(1) : parsed.pathname);
+  const entries = [...parsed.searchParams.entries()];
+  const uniqueQueryKeys = new Set(entries.map(([key]) => key));
+  const exactQuery = (expected) => entries.length === Object.keys(expected).length && uniqueQueryKeys.size === entries.length && entries.every(([key, entryValue]) => expected[key] === entryValue);
+  const loopback = isLoopbackPgHost(host);
+  let ssl;
+  if (entries.length === 0 && loopback) {
+    ssl = false;
+  } else if (exactQuery({ sslmode: "disable" })) {
+    ssl = false;
+  } else if (exactQuery({ sslmode: "require", uselibpqcompat: "true" })) {
+    ssl = { rejectUnauthorized: false };
+  } else if (exactQuery({ sslmode: "verify-full" })) {
+    ssl = { rejectUnauthorized: true };
+  } else if (entries.length === 2 && uniqueQueryKeys.size === entries.length && parsed.searchParams.get("sslmode") === "verify-full" && entries.every(([key]) => key === "sslmode" || key === "sslrootcert")) {
+    const rootCertInput = nonEmpty(parsed.searchParams.get("sslrootcert"));
+    if (!path.isAbsolute(rootCertInput)) throw new Error("community_pg_url_invalid");
+    let rootCertStats;
+    try {
+      rootCertStats = lstatSync(rootCertInput);
+    } catch {
+      throw new Error("community_pg_url_invalid");
+    }
+    if (!rootCertStats.isFile() || rootCertStats.isSymbolicLink() || rootCertStats.size < 1 || rootCertStats.size > 262144) {
+      throw new Error("community_pg_url_invalid");
+    }
+    const canonicalRootCert = realpathSync(rootCertInput);
+    if (path.resolve(canonicalRootCert) !== path.resolve(rootCertInput)) throw new Error("community_pg_url_invalid");
+    ssl = { rejectUnauthorized: true, ca: readFileSync(canonicalRootCert, "utf8") };
+  } else {
+    throw new Error("community_pg_url_invalid");
+  }
+  if (!host || !user || !password || !database || !Number.isInteger(port) || port < 1 || port > 65535 || /[\/\u0000-\u001f\u007f]/.test(database) || /[\u0000-\u001f\u007f]/.test(host + user + password)) {
+    throw new Error("community_pg_url_invalid");
+  }
+  return { host, port, user, password, database, ssl };
+}
+function redactPgTarget(target) {
+  const host = target.host.includes(":") ? `[${target.host}]` : target.host;
+  return `postgresql://${encodeURIComponent(target.user)}:***@${host}:${target.port}/${encodeURIComponent(target.database)}`;
+}
+function createPoolConfig(target) {
+  return {
+    host: target.host,
+    port: target.port,
+    user: target.user,
+    password: target.password,
+    database: target.database,
+    ssl: target.ssl,
+    application_name: "aops-community-probe",
+    options: "-c search_path=public",
+    connectionTimeoutMillis: 8e3,
+    query_timeout: 8e3,
+    statement_timeout: 8e3,
+    lock_timeout: 8e3,
+    idle_in_transaction_session_timeout: 8e3,
+    max: 1
+  };
+}
+function createCommunityPgPoolConfig(repoUrl, applicationName = "aops-community-probe") {
+  return {
+    ...createPoolConfig(parsePgTarget(repoUrl)),
+    application_name: applicationName
+  };
+}
+function resolveRuntime(processEnv = process.env) {
+  assertNoAmbientPgEnv(processEnv);
+  const repoUrl = nonEmpty(processEnv[COMMUNITY_PG_ENV_KEY]);
+  if (repoUrl) parsePgTarget(repoUrl);
+  return {
+    repoUrl,
+    repoDialect: repoUrl ? "pg" : null,
+    repoUrlSource: repoUrl ? "env" : "missing",
+    envPath: null,
+    envExists: false,
+    hostSettings: { logLevel: "info" },
+    logLevelSource: "default"
+  };
+}
+let resolvedRuntimeConfig = resolveRuntime();
+function getResolvedAopsServerRuntimeConfig() {
+  return resolvedRuntimeConfig;
+}
+function readRuntimeConfigAdmin() {
+  const runtime = getResolvedAopsServerRuntimeConfig();
+  const target = runtime.repoUrl ? parsePgTarget(runtime.repoUrl) : null;
+  return {
+    policy: { owner: "host", surface: "host-admin", writeMode: "process-env-read-only", dialectsAllowed: ["pg"], secretsMode: "redacted" },
+    locks: { repoUrl: runtime.repoUrl ? { source: "env", envKey: COMMUNITY_PG_ENV_KEY } : null },
+    effective: {
+      repoDialect: runtime.repoDialect,
+      repoUrlSource: runtime.repoUrlSource,
+      redactedRepoUrl: target ? redactPgTarget(target) : null,
+      editableRepoUrl: null
+    },
+    status: { ok: Boolean(runtime.repoUrl), issues: runtime.repoUrl ? [] : ["AOPS_PG_URL is required."], warnings: [] }
+  };
+}
+async function runRuntimeConfigAdminTargetProbe(processEnv = process.env) {
+  assertNoAmbientPgEnv(processEnv);
+  const repoUrl = nonEmpty(processEnv[COMMUNITY_PG_ENV_KEY]);
+  const target = parsePgTarget(repoUrl);
+  const pool = new Pool(createCommunityPgPoolConfig(repoUrl));
+  try {
+    const database = await pool.query("select current_database() as name");
+    const tables = await pool.query(
+      `select candidate.name
+         from unnest($1::text[]) as candidate(name)
+         join pg_catalog.pg_class c on c.relname = candidate.name and c.relkind in ('r', 'p')
+         join pg_catalog.pg_namespace n on n.oid = c.relnamespace and n.nspname = 'public'
+        where has_table_privilege(c.oid, 'SELECT')`,
+      [COMMUNITY_PG_SCHEMA_TABLES]
+    );
+    const existingRelations = tables.rows.map((row) => row.name).sort(codepointCompare);
+    const missingRelations = COMMUNITY_PG_SCHEMA_TABLES.filter((name) => !existingRelations.includes(name));
+    return {
+      target: { repoDialect: "pg", redactedRepoUrl: redactPgTarget(target) },
+      connection: { ok: true, databaseName: String(database.rows[0]?.name ?? "") || null, message: "Connected to configured PostgreSQL target." },
+      schema: { verificationLevel: "sentinel-relations-only", ready: false, sentinelsPresent: missingRelations.length === 0, configuredRelationCount: COMMUNITY_PG_SCHEMA_TABLES.length, existingRelationCount: existingRelations.length, existingRelations, missingRelations },
+      warnings: [
+        "Full domain migration readiness requires packaged bootstrap and runtime catalog smoke.",
+        ...missingRelations.length === 0 ? [] : [`Configured target is missing ${missingRelations.length} Community schema sentinel relation(s).`]
+      ]
+    };
+  } finally {
+    await pool.end().catch(() => void 0);
+  }
+}
+let activeProbe = null;
+async function testRuntimeConfigAdminTarget(processEnv = process.env) {
+  if (activeProbe) return activeProbe;
+  activeProbe = runRuntimeConfigAdminTargetProbe(processEnv);
+  try {
+    return await activeProbe;
+  } finally {
+    activeProbe = null;
+  }
+}
+
+export { getResolvedAopsServerRuntimeConfig as g, readRuntimeConfigAdmin as r, testRuntimeConfigAdminTarget as t };

package/build/server/chunks/auth-provider-C07OUlnz.js

@@ -0,0 +1,18 @@
+function resolveAuthProvider(processEnv = process.env) {
+  const configured = String(processEnv.AOPS_AUTH_PROVIDER ?? "trusted-local").trim().toLowerCase();
+  if (configured === "trusted-local") return configured;
+  if (configured === "authv2-jwt-session" || configured === "remote-session") {
+    throw new Error(
+      "aops_local_auth_provider_retired:use_trusted-local_or_configure_a_remote-session_target"
+    );
+  }
+  throw new Error("aops_auth_provider_invalid:use_trusted-local");
+}
+function getAuthProvider() {
+  return resolveAuthProvider();
+}
+function isTrustedLocalAuthProvider(authProvider = getAuthProvider()) {
+  return authProvider === "trusted-local";
+}
+
+export { getAuthProvider as g, isTrustedLocalAuthProvider as i };

package/build/server/chunks/canonical-text-order-DbXJJnFD.js

@@ -0,0 +1,5 @@
+function compareCanonicalText(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+export { compareCanonicalText as c };