@appsemble/node-utils 0.29.4 → 0.29.6

package/README.md

@@ -1,9 +1,9 @@
-# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.29.4/config/assets/logo.svg) Appsemble Node Utilities
+# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.29.6/config/assets/logo.svg) Appsemble Node Utilities
 
 > NodeJS utilities used by Appsemble internally.
 
 [![npm](https://img.shields.io/npm/v/@appsemble/node-utils)](https://www.npmjs.com/package/@appsemble/node-utils)
-[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.29.4/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.29.4)
+[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.29.6/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.29.6)
 [![Prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://prettier.io)
 
 ## Table of Contents
@@ -26,5 +26,5 @@ compatibility is not guaranteed.
 
 ## License
 
-[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.29.4/LICENSE.md) ©
+[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.29.6/LICENSE.md) ©
 [Appsemble](https://appsemble.com)

package/container/helpers.d.ts

@@ -0,0 +1,33 @@
+import { type ContainerEnvVar, type ContainerResourceProps, type ContainerResources } from '@appsemble/types';
+import { AppsV1Api, CoreV1Api, KubeConfig, type V1EnvVar } from '@kubernetes/client-node';
+export declare const maxCPU: number;
+export declare const maxMemoryGi: number;
+export declare const appIdLabel = "appId";
+export declare const resourceDefaults: ContainerResourceProps;
+export declare function getKubeConfig(): {
+    appsApi: AppsV1Api;
+    coreApi: CoreV1Api;
+    kubeconfig: KubeConfig;
+};
+export declare function getContainerNamespace(): string;
+export declare function formatServiceName(containerName: string, appName: string, appId: string): string;
+export declare function formatSecretName(appName: string, appId: string): string;
+export declare function handleKubernetesError(error: unknown): void;
+export declare function deleteResource(type: 'deployment' | 'secret' | 'service', namespace: string, name: string): Promise<void>;
+/**
+ * Accepts a url used to call a companion container.
+ *
+ * @param url Url for internal communication to a container.
+ * @returns the metadata used to form the url.
+ * @example input: `containername-appname-1.companion-containers.svc.cluster.local`
+ * result: containername-appname-1, 1, appname, appsemble, appsemble-or-namespace
+ */
+export declare function parseServiceUrl(url: string): {
+    deploymentName: string;
+    appId: string;
+    appName: string;
+    namespace: string;
+};
+export declare function validateContainerResources(resources: ContainerResources): ContainerResources;
+export declare function isWhitelisted(fullImageName: string): Boolean;
+export declare function formatEnv(input: ContainerEnvVar[], appName: string, appId: string): V1EnvVar[];

package/container/helpers.js

@@ -0,0 +1,179 @@
+var _a, _b;
+import { logger } from '@appsemble/node-utils';
+import { AppsV1Api, CoreV1Api, HttpError, KubeConfig, } from '@kubernetes/client-node';
+export const maxCPU = (_a = process.env.MAX_CONTAINER_CPU) !== null && _a !== void 0 ? _a : 3;
+// In gigabytes
+export const maxMemoryGi = (_b = process.env.MAX_CONTAINER_MEMORY) !== null && _b !== void 0 ? _b : 3;
+export const appIdLabel = 'appId';
+export const resourceDefaults = { memory: '128Mi', cpu: '0.1' };
+export function getKubeConfig() {
+    const kubeconfig = new KubeConfig();
+    kubeconfig.loadFromDefault();
+    const appsApi = kubeconfig.makeApiClient(AppsV1Api);
+    const coreApi = kubeconfig.makeApiClient(CoreV1Api);
+    return { appsApi, coreApi, kubeconfig };
+}
+export function getContainerNamespace() {
+    var _a;
+    return `companion-containers-${(_a = process.env.SERVICE_NAME) !== null && _a !== void 0 ? _a : 'appsemble'}`;
+}
+export function formatServiceName(containerName, appName, appId) {
+    const serviceName = `${containerName}-${appName}-${appId}`.replaceAll(' ', '-').toLowerCase();
+    return serviceName;
+}
+export function formatSecretName(appName, appId) {
+    return `${appName}-${appId}`.toLocaleLowerCase().replaceAll(' ', '-');
+}
+export function handleKubernetesError(error) {
+    if (error instanceof HttpError) {
+        const { statusCode } = error;
+        if (statusCode) {
+            logger.warn(`Kubernetes error with status code ${statusCode}:`);
+        }
+        logger.warn(error.body);
+        return;
+    }
+    logger.error(error);
+}
+export async function deleteResource(type, namespace, name) {
+    if (process.env.TEST) {
+        return;
+    }
+    const { appsApi, coreApi } = getKubeConfig();
+    try {
+        logger.silly(`Deleting ${type} '${name}' from namespace ${namespace} ... `);
+        switch (type) {
+            case 'deployment':
+                await appsApi.deleteNamespacedDeployment(name, namespace, undefined, undefined, undefined, undefined, 'Background');
+                break;
+            case 'service':
+                await coreApi.deleteNamespacedService(name, namespace);
+                break;
+            default:
+                await coreApi.deleteNamespacedSecret(name, namespace);
+        }
+        logger.verbose(`Deleted ${type} '${name}' from namespace ${namespace}`);
+    }
+    catch (error) {
+        handleKubernetesError(error);
+    }
+}
+/**
+ * Accepts a url used to call a companion container.
+ *
+ * @param url Url for internal communication to a container.
+ * @returns the metadata used to form the url.
+ * @example input: `containername-appname-1.companion-containers.svc.cluster.local`
+ * result: containername-appname-1, 1, appname, appsemble, appsemble-or-namespace
+ */
+export function parseServiceUrl(url) {
+    const elements = url.replace('http://', '').split('.');
+    const deploymentName = elements[0];
+    const namespace = elements[1];
+    const appId = deploymentName.split('-').pop();
+    const appName = deploymentName.replace(`-${appId}`, '');
+    return { deploymentName, appId, appName, namespace };
+}
+export function validateContainerResources(resources) {
+    // Validate Memory
+    if (!resources || !resources.limits) {
+        return { limits: resourceDefaults };
+    }
+    const result = resources;
+    if (resources.limits.memory) {
+        const unit = result.limits.memory.slice(-2);
+        const number = result.limits.memory.replace(unit, '');
+        const parsedValue = Number.parseFloat(number);
+        const conditionsMemory = [
+            Number.isNaN(parsedValue),
+            String(parsedValue) !== number,
+            parsedValue < 0,
+            unit !== 'Mi' && unit !== 'Gi',
+            unit === 'Gi' && parsedValue > maxMemoryGi,
+            unit === 'Mi' && parsedValue > maxMemoryGi * 1024,
+        ];
+        if (conditionsMemory.some(Boolean)) {
+            result.limits.memory = resourceDefaults.memory;
+        }
+    }
+    else {
+        result.limits.memory = resourceDefaults.memory;
+    }
+    if (resources.limits.cpu) {
+        const parsedValue = Number.parseFloat(resources.limits.cpu);
+        let cpu = 0;
+        const pattern = /\b([1-9]|[1-9]\d{1,2})m\b/;
+        if (pattern.test(resources.limits.cpu)) {
+            cpu = Number.parseFloat(resources.limits.cpu.slice(0, -1)) / 1000;
+        }
+        else if (!Number.isNaN(parsedValue)) {
+            if (String(parsedValue) === String(resources.limits.cpu)) {
+                cpu = parsedValue;
+            }
+            else {
+                result.limits.cpu = resourceDefaults.cpu;
+            }
+        }
+        if (cpu > maxCPU || cpu <= 0) {
+            result.limits.cpu = resourceDefaults.cpu;
+        }
+    }
+    else {
+        result.limits.cpu = resourceDefaults.cpu;
+    }
+    return result;
+}
+export function isWhitelisted(fullImageName) {
+    if (process.env.HOST !== 'https://appsemble.app') {
+        return true;
+    }
+    // Allowed registries
+    // Overwrite the default by setting the
+    // `WHITELIST_REGISTRIES` env variable
+    // As space separated list of domains
+    const whitelistRegistries = process.env.WHITELIST_REGISTRIES
+        ? process.env.WHITELIST_REGISTRIES.split(' ')
+        : ['registry.hub.docker.com/library/', 'docker.io/library/', 'registry.gitlab.com/appsemble/'];
+    let whitelisted = false;
+    const parts = fullImageName.split('/');
+    // If only image name is provided, it will be pulled from the official docker library
+    if (parts.length === 1) {
+        whitelisted = true;
+    }
+    else if (parts.length === 2) {
+        const [namespace] = parts;
+        // If namespace is 'library', it's an official image
+        if (namespace === 'library') {
+            whitelisted = true;
+        }
+    }
+    else if (whitelistRegistries.some((domain) => fullImageName.startsWith(domain))) {
+        whitelisted = true;
+    }
+    if (whitelisted) {
+        logger.silly(`Image ${fullImageName} found in a whitelisted repository`);
+    }
+    else {
+        logger.error(`Image ${fullImageName} is not in any whitelisted repository`);
+    }
+    return whitelisted;
+}
+export function formatEnv(input, appName, appId) {
+    const env = [];
+    if (input && input.length > 0) {
+        for (const entry of input) {
+            if (entry.useValueFromSecret) {
+                env.push({
+                    name: entry.name,
+                    valueFrom: {
+                        secretKeyRef: { key: entry.value, name: formatSecretName(appName, appId) },
+                    },
+                });
+                continue;
+            }
+            env.push({ name: entry.name, value: entry.value });
+        }
+    }
+    return env;
+}
+//# sourceMappingURL=helpers.js.map

package/container/index.d.ts

@@ -0,0 +1,5 @@
+export * from './helpers.js';
+export * from './operations.js';
+export * from './scale.js';
+export * from './specs.js';
+export * from './logs.js';

package/container/index.js

@@ -0,0 +1,6 @@
+export * from './helpers.js';
+export * from './operations.js';
+export * from './scale.js';
+export * from './specs.js';
+export * from './logs.js';
+//# sourceMappingURL=index.js.map

package/container/logs.d.ts

@@ -0,0 +1,2 @@
+import { type LogObject } from '@appsemble/types';
+export declare function getLogs(deploymentName: string, fromAppsemble?: boolean): Promise<LogObject[]>;

package/container/logs.js

@@ -0,0 +1,91 @@
+import { readFile } from 'node:fs/promises';
+import stream from 'node:stream';
+import { Log } from '@kubernetes/client-node';
+import { getContainerNamespace, getKubeConfig, handleKubernetesError } from './helpers.js';
+import { logger } from '../logger.js';
+function fetchLogs(namespace, podName, containerName) {
+    const { kubeconfig } = getKubeConfig();
+    const log = new Log(kubeconfig);
+    const logStream = new stream.PassThrough();
+    return new Promise((resolve, reject) => {
+        log
+            .log(namespace, podName, containerName || '', logStream)
+            .then(() => {
+            let logs = '';
+            logStream.on('data', (chunk) => {
+                logs += String(chunk);
+            });
+            logStream.on('end', () => {
+                resolve(logs);
+            });
+            logStream.on('error', (err) => {
+                reject(err);
+            });
+        })
+            .catch((err) => {
+            reject(err);
+        });
+    });
+}
+function filterLogEntries(entries, deploymentName, fromAppsemble) {
+    let res = entries;
+    if (fromAppsemble) {
+        res = entries.filter((e) => e.includes(deploymentName));
+    }
+    return res;
+}
+export async function getLogs(deploymentName, fromAppsemble) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    const { coreApi } = getKubeConfig();
+    let pods;
+    const containerNamespace = getContainerNamespace();
+    let appsembleNamespace = 'appsemble';
+    const appsembleServiceName = (_a = process.env.SERVICE_NAME) !== null && _a !== void 0 ? _a : 'appsemble';
+    logger.silly(`Using service name ${appsembleServiceName}`);
+    try {
+        const NAMESPACE_FILE_PATH = '/var/run/secrets/kubernetes.io/serviceaccount/namespace';
+        const namespace = await readFile(NAMESPACE_FILE_PATH, 'utf8');
+        appsembleNamespace = namespace.trim();
+    }
+    catch (error) {
+        logger.error('Error fetching namespace name. Using `appsemble` as default');
+        logger.error(error);
+    }
+    logger.silly(`Using namespace ${appsembleNamespace}`);
+    try {
+        pods = (await coreApi.listNamespacedPod(fromAppsemble ? appsembleNamespace : containerNamespace)).body;
+    }
+    catch (error) {
+        handleKubernetesError(error);
+        return [];
+    }
+    if (pods.items.length === 0) {
+        logger.warn(`No pods found for deployment ${deploymentName} in namespace ${containerNamespace}`);
+        return [];
+    }
+    const podLogs = [];
+    for (const pod of pods.items) {
+        if (((_c = (_b = pod.metadata) === null || _b === void 0 ? void 0 : _b.ownerReferences) === null || _c === void 0 ? void 0 : _c.find((r) => r.kind === 'ReplicaSet')) &&
+            ((_d = pod.status) === null || _d === void 0 ? void 0 : _d.phase) === 'Running') {
+            if (fromAppsemble && !((_e = pod.metadata) === null || _e === void 0 ? void 0 : _e.name.includes(appsembleServiceName))) {
+                continue;
+            }
+            if (!fromAppsemble && !((_f = pod.metadata) === null || _f === void 0 ? void 0 : _f.name.includes(deploymentName))) {
+                continue;
+            }
+            logger.silly(`Pod: ${(_g = pod.metadata) === null || _g === void 0 ? void 0 : _g.name}, status: ${pod.status}, deployment: ${deploymentName}`);
+            try {
+                const res = await fetchLogs(fromAppsemble ? appsembleNamespace : containerNamespace, (_h = pod.metadata) === null || _h === void 0 ? void 0 : _h.name, fromAppsemble ? 'appsemble' : deploymentName);
+                let entries = res.split('\n');
+                logger.silly(`Number of entries found for pod ${(_j = pod.metadata) === null || _j === void 0 ? void 0 : _j.name}: ${entries.length}`);
+                entries = filterLogEntries([...entries], deploymentName, fromAppsemble);
+                podLogs.push({ fromAppsemble, entries });
+            }
+            catch (error) {
+                handleKubernetesError(error);
+            }
+        }
+    }
+    return podLogs;
+}
+//# sourceMappingURL=logs.js.map

package/container/operations.d.ts

@@ -0,0 +1,15 @@
+import { type CompanionContainerDefinition } from '@appsemble/types';
+/**
+ * Creates or updates secret.
+ * Secret resource is named after the app name + id, where whitespace
+ * is replaced by '-'.
+ *
+ * @param secretName Key of the secret to be created
+ * @param value The secret value
+ * @param appName Name of the app
+ * @param appId Id of the app.
+ */
+export declare function updateNamespacedSecret(secretName: string, value: string, appName: string, appId: string): Promise<void>;
+export declare function deleteSecret(appName: string, appId: string, key?: string): Promise<void>;
+export declare function deleteCompanionContainers(serviceName: string): Promise<void>;
+export declare function updateCompanionContainers(definitions: CompanionContainerDefinition[], appName: string, appId: string, registry?: string): Promise<void>;

package/container/operations.js

@@ -0,0 +1,271 @@
+import { logger } from '@appsemble/node-utils';
+import { appIdLabel, deleteResource, formatEnv, formatSecretName, formatServiceName, getContainerNamespace, getKubeConfig, handleKubernetesError, isWhitelisted, validateContainerResources, } from './helpers.js';
+import { generateDeploymentAndServiceSpecs } from './specs.js';
+/**
+ * Creates or updates secret.
+ * Secret resource is named after the app name + id, where whitespace
+ * is replaced by '-'.
+ *
+ * @param secretName Key of the secret to be created
+ * @param value The secret value
+ * @param appName Name of the app
+ * @param appId Id of the app.
+ */
+export async function updateNamespacedSecret(secretName, value, appName, appId) {
+    var _a, _b;
+    // If testing, don't create Kubernetes resources
+    if (process.env.TEST) {
+        return;
+    }
+    const { coreApi } = getKubeConfig();
+    const namespace = getContainerNamespace();
+    const formattedName = formatSecretName(appName, appId);
+    const secretSpec = {
+        metadata: {
+            name: formattedName,
+            namespace,
+        },
+        data: { [secretName]: Buffer.from(value).toString('base64') },
+    };
+    let existing;
+    try {
+        existing = (await coreApi.readNamespacedSecret(formattedName, namespace)).body;
+    }
+    catch (error) {
+        handleKubernetesError(error);
+    }
+    if (existing) {
+        logger.silly(`Secret ${formattedName} already exists`);
+        if (!existing.data) {
+            existing.data = {};
+        }
+        existing.data[secretName] = Buffer.from(value).toString('base64');
+        try {
+            const { body: updatedSecret } = await coreApi.replaceNamespacedSecret(formattedName, namespace, existing);
+            logger.info(`Secret ${updatedSecret.metadata.name} updated successfully`);
+        }
+        catch (error) {
+            handleKubernetesError(error);
+        }
+        return;
+    }
+    try {
+        logger.verbose(`Creating secret ${(_a = secretSpec.metadata) === null || _a === void 0 ? void 0 : _a.name} ...`);
+        const { body: secret } = await coreApi.createNamespacedSecret(namespace, secretSpec);
+        logger.info(`Secret ${(_b = secret.metadata) === null || _b === void 0 ? void 0 : _b.name} created successfully`);
+    }
+    catch (error) {
+        handleKubernetesError(error);
+    }
+}
+export async function deleteSecret(appName, appId, key) {
+    var _a;
+    if (process.env.TEST) {
+        return;
+    }
+    const { coreApi } = getKubeConfig();
+    const namespace = getContainerNamespace();
+    const secretName = formatSecretName(appName, appId);
+    if (key) {
+        try {
+            const { body: secret } = await coreApi.readNamespacedSecret(secretName, namespace);
+            logger.verbose(`Deleteing key ${key} of secret ${secretName} from namespace ${namespace} ...`);
+            if (!(key in secret.data)) {
+                logger.warn(`Key ${key} does not exist on secret ${(_a = secret.metadata) === null || _a === void 0 ? void 0 : _a.name}`);
+                return;
+            }
+            delete secret.data[key];
+            await coreApi.replaceNamespacedSecret(secretName, namespace, secret);
+            logger.verbose(`Deleted key ${key} of secret ${secretName} from namespace ${namespace}.`);
+        }
+        catch (error) {
+            logger.error(`Error deleting ${key ? `key ${key} from` : ''} secret ${secretName}`);
+            handleKubernetesError(error);
+        }
+    }
+    else {
+        await deleteResource('secret', namespace, secretName);
+    }
+}
+export async function deleteCompanionContainers(serviceName) {
+    if (process.env.TEST) {
+        return;
+    }
+    const namespace = getContainerNamespace();
+    await deleteResource('service', namespace, serviceName);
+    await deleteResource('deployment', namespace, serviceName);
+}
+export async function updateCompanionContainers(definitions, appName, appId, registry) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t;
+    // If testing, don't create Kubernetes resources
+    if (process.env.TEST) {
+        return;
+    }
+    const { appsApi, coreApi } = getKubeConfig();
+    const namespace = getContainerNamespace();
+    let services;
+    logger.silly(`Listing services in namespace ${namespace} ...`);
+    try {
+        services = (await coreApi.listNamespacedService(namespace)).body;
+    }
+    catch (error) {
+        logger.error(`Error listing services in namespace ${namespace}`);
+        handleKubernetesError(error);
+        return;
+    }
+    // Update or create deployment and service
+    for (const def of definitions) {
+        const serviceName = formatServiceName(def.name, appName, appId);
+        const existing = (_a = services === null || services === void 0 ? void 0 : services.items) === null || _a === void 0 ? void 0 : _a.find((s) => s.metadata.name === serviceName);
+        // Update
+        if (existing) {
+            logger.verbose(`Updating resources for ${existing.metadata.name} in namespace ${namespace}`);
+            const patchOptions = [
+                (_b = existing.metadata) === null || _b === void 0 ? void 0 : _b.name,
+                namespace,
+                [
+                    {
+                        op: 'replace',
+                        path: '/metadata',
+                        value: { ...def.metadata, name: existing.metadata.name },
+                    },
+                    {
+                        op: 'replace',
+                        path: '/spec/ports/0/targetPort',
+                        value: (_c = def.port) !== null && _c !== void 0 ? _c : 8080,
+                    },
+                    {
+                        op: 'add',
+                        path: '/metadata/labels',
+                        value: { appId },
+                    },
+                ],
+                undefined,
+                undefined,
+                undefined,
+                undefined,
+                undefined,
+                { headers: { 'Content-Type': 'application/json-patch+json' } },
+            ];
+            // Update service
+            try {
+                const updatedService = await coreApi.patchNamespacedService(...patchOptions);
+                logger.info(`Service ${(_e = (_d = updatedService === null || updatedService === void 0 ? void 0 : updatedService.body) === null || _d === void 0 ? void 0 : _d.metadata) === null || _e === void 0 ? void 0 : _e.name} updated`);
+            }
+            catch (error) {
+                logger.error('Error updating service:');
+                handleKubernetesError(error);
+            }
+            // Update deployment
+            const resources = validateContainerResources(def.resources);
+            patchOptions[2] = [
+                {
+                    op: 'replace',
+                    path: '/metadata',
+                    value: { ...def.metadata, name: existing.metadata.name },
+                },
+                {
+                    op: 'replace',
+                    path: '/spec/template/spec/containers/0/ports/0/containerPort',
+                    value: (_f = def.port) !== null && _f !== void 0 ? _f : 8080,
+                },
+                {
+                    op: 'replace',
+                    path: '/spec/template/spec/containers/0/env',
+                    value: [...formatEnv(def.env, appName, appId)],
+                },
+                {
+                    op: 'add',
+                    path: '/metadata/labels',
+                    value: { appId },
+                },
+                {
+                    op: 'replace',
+                    path: '/spec/template/spec/containers/0/resources',
+                    value: resources,
+                },
+            ];
+            try {
+                const updatedDeployment = await appsApi.patchNamespacedDeployment(...patchOptions);
+                logger.info(`Deployment ${(_h = (_g = updatedDeployment === null || updatedDeployment === void 0 ? void 0 : updatedDeployment.body) === null || _g === void 0 ? void 0 : _g.metadata) === null || _h === void 0 ? void 0 : _h.name} updated`);
+            }
+            catch (error) {
+                logger.error('Error updating deployment:');
+                handleKubernetesError(error);
+            }
+            // Update pod
+            try {
+                const { body } = await coreApi.listNamespacedPod(namespace, undefined, undefined, undefined, undefined, `appId=${appId}`);
+                if (((_j = body === null || body === void 0 ? void 0 : body.items) === null || _j === void 0 ? void 0 : _j.length) === 0) {
+                    logger.silly(`Deployment ${serviceName} has 0 pods, skipping ...`);
+                    continue;
+                }
+                const pod = (_k = body === null || body === void 0 ? void 0 : body.items) === null || _k === void 0 ? void 0 : _k.find((i) => i.metadata.labels.app === existing.metadata.name);
+                // Set base labels, such as selector, pod name, pod hash
+                const props = {
+                    ...def.metadata,
+                    labels: {
+                        ...(def.metadata ? def.metadata.labels : null),
+                        app: pod.metadata.labels.app,
+                        'pod-template-hash': pod.metadata.labels['pod-template-hash'],
+                        appId,
+                    },
+                    name: pod.metadata.name,
+                };
+                patchOptions[0] = (_l = pod === null || pod === void 0 ? void 0 : pod.metadata) === null || _l === void 0 ? void 0 : _l.name;
+                patchOptions[2] = [
+                    {
+                        op: 'replace',
+                        path: '/metadata',
+                        value: props,
+                    },
+                ];
+                const updatedPod = await coreApi.patchNamespacedPod(...patchOptions);
+                logger.verbose(`Pod updated: ${(_o = (_m = updatedPod === null || updatedPod === void 0 ? void 0 : updatedPod.body) === null || _m === void 0 ? void 0 : _m.metadata) === null || _o === void 0 ? void 0 : _o.name}`);
+            }
+            catch (error) {
+                handleKubernetesError(error);
+            }
+        }
+        // Create
+        else {
+            const { deployment, service } = generateDeploymentAndServiceSpecs(def, serviceName, appName, appId, registry);
+            if (isWhitelisted(deployment.spec.template.spec.containers[0].image)) {
+                logger.verbose(`Creating resources in namespace ${namespace} ...`);
+                try {
+                    const deploymentObj = await appsApi.createNamespacedDeployment(namespace, deployment);
+                    logger.info(`Deployment created: ${(_q = (_p = deploymentObj.body) === null || _p === void 0 ? void 0 : _p.metadata) === null || _q === void 0 ? void 0 : _q.name}`);
+                }
+                catch (error) {
+                    handleKubernetesError(error);
+                    return;
+                }
+                try {
+                    const serviceObj = await coreApi.createNamespacedService(namespace, service);
+                    logger.info(`Service created: ${(_r = serviceObj.body.metadata) === null || _r === void 0 ? void 0 : _r.name}`);
+                }
+                catch (error) {
+                    handleKubernetesError(error);
+                }
+            }
+            else {
+                logger.error(`Image ${deployment.spec.template.spec.containers[0].image} is not in the repository whitelist!`);
+            }
+        }
+    }
+    // Delete companions removed from the definition
+    for (const service of services.items) {
+        if (service.spec.type === 'ExternalName') {
+            continue;
+        }
+        if (((_s = service.metadata) === null || _s === void 0 ? void 0 : _s.labels) &&
+            appIdLabel in service.metadata.labels &&
+            service.metadata.labels[appIdLabel] === appId) {
+            const existing = definitions.find((d) => formatServiceName(d.name, appName, appId) === service.metadata.name);
+            if (!existing) {
+                await deleteCompanionContainers((_t = service.metadata) === null || _t === void 0 ? void 0 : _t.name);
+            }
+        }
+    }
+}
+//# sourceMappingURL=operations.js.map

package/container/scale.d.ts

@@ -0,0 +1,4 @@
+export declare function scaleDeployment(namespace: string, deploymentName: string, replicas?: number): Promise<void>;
+export declare function stopIdleContainers(interval?: number): Promise<void>;
+export declare function waitForPodReadiness(namespace: string, appSelector: string, maxWait?: number): Promise<void>;
+export declare function setLastRequestAnnotation(namespace: string, deploymentName: string): Promise<void>;

package/container/scale.js

@@ -0,0 +1,117 @@
+import { logger } from '@appsemble/node-utils';
+import { getContainerNamespace, getKubeConfig, handleKubernetesError } from './helpers.js';
+export async function scaleDeployment(namespace, deploymentName, replicas = 0) {
+    const { appsApi } = getKubeConfig();
+    const patch = [];
+    patch.push({
+        op: 'replace',
+        path: '/spec/replicas',
+        value: replicas,
+    });
+    try {
+        logger.verbose(`Scaling deployment ${deploymentName} to ${replicas} replicas ... `);
+        await appsApi.patchNamespacedDeployment(deploymentName, namespace, patch, undefined, undefined, undefined, undefined, undefined, { headers: { 'Content-Type': 'application/json-patch+json' } });
+        logger.verbose(`Deployment ${deploymentName} scaled to ${replicas} replicas successfully `);
+    }
+    catch (error) {
+        handleKubernetesError(error);
+        throw error;
+    }
+}
+export async function stopIdleContainers(interval = 10) {
+    var _a;
+    const { appsApi } = getKubeConfig();
+    let deployments;
+    logger.verbose('Scaling containers');
+    try {
+        deployments = (await appsApi.listDeploymentForAllNamespaces()).body;
+    }
+    catch (error) {
+        handleKubernetesError(error);
+        return;
+    }
+    for (const deployment of deployments.items) {
+        const { annotations, name, namespace } = deployment.metadata;
+        if (((_a = deployment.metadata) === null || _a === void 0 ? void 0 : _a.namespace) !== getContainerNamespace() ||
+            deployment.spec.replicas === 0) {
+            continue;
+        }
+        const milliseconds = interval * 60 * 1000;
+        const now = new Date();
+        const lastCall = annotations.lastRequestTimestamp
+            ? new Date(annotations.lastRequestTimestamp)
+            : null;
+        // Set timestamp metadata if missing, and continue
+        if (!lastCall) {
+            const patch = [
+                {
+                    op: 'add',
+                    path: '/metadata/annotations',
+                    value: { lastRequestTimestamp: now.toISOString() },
+                },
+            ];
+            try {
+                logger.silly(`Updating metadata of deployment ${name}`);
+                await appsApi.patchNamespacedDeployment(name, namespace, patch, undefined, undefined, undefined, undefined, undefined, { headers: { 'Content-Type': 'application/json-patch+json' } });
+                logger.verbose(`Updated metadata of deployment ${name} successfully `);
+            }
+            catch (error) {
+                handleKubernetesError(error);
+            }
+            continue;
+        }
+        // If timestamp exists and is old enough, scale down
+        const diff = now.getTime() - lastCall.getTime();
+        if (Math.abs(diff) > milliseconds) {
+            await scaleDeployment(namespace, name, 0);
+        }
+    }
+}
+export async function waitForPodReadiness(namespace, appSelector, maxWait = 10000) {
+    var _a;
+    let isReady;
+    const interval = 500;
+    let elapsed = 0;
+    const { coreApi } = getKubeConfig();
+    while (!isReady) {
+        const pods = await coreApi.listNamespacedPod(namespace, undefined, undefined, undefined, undefined, `app=${appSelector}`);
+        if (pods.body.items.length > 0) {
+            isReady = (_a = pods.body) === null || _a === void 0 ? void 0 : _a.items.every((pod) => {
+                var _a, _b;
+                return (_b = (_a = pod.status) === null || _a === void 0 ? void 0 : _a.conditions) === null || _b === void 0 ? void 0 : _b.some((condition) => condition.type === 'Ready' && condition.status === 'True');
+            });
+        }
+        if (!isReady) {
+            logger.silly(`Waiting for ${appSelector} to be ready ...`);
+            await new Promise((resolve) => {
+                setTimeout(resolve, interval);
+            });
+            elapsed += interval;
+            if (elapsed >= maxWait) {
+                logger.warn(`Deployment ${appSelector} does not respond`);
+                return;
+            }
+        }
+    }
+}
+export async function setLastRequestAnnotation(namespace, deploymentName) {
+    const { appsApi } = getKubeConfig();
+    const now = new Date();
+    const patch = [
+        {
+            op: 'add',
+            path: '/metadata/annotations',
+            value: { lastRequestTimestamp: now.toISOString() },
+        },
+    ];
+    try {
+        logger.silly(`Setting 'lastRequestTimestamp' annotation of '${deploymentName}' to ${now.toISOString()}`);
+        await appsApi.patchNamespacedDeployment(deploymentName, namespace, patch, undefined, undefined, undefined, undefined, undefined, { headers: { 'Content-Type': 'application/json-patch+json' } });
+        logger.silly(`'LastRequestTimestamp' annotation of '${deploymentName}' updated successfully`);
+    }
+    catch (error) {
+        logger.warn('Could not set last request annotation:');
+        handleKubernetesError(error);
+    }
+}
+//# sourceMappingURL=scale.js.map

package/container/specs.d.ts

@@ -0,0 +1,17 @@
+import { type CompanionContainerDefinition } from '@appsemble/types';
+import { type V1Deployment, type V1Service } from '@kubernetes/client-node';
+/**
+ * Create the spec objects for a service, deployment, and pod.
+ * Use for a single companion container.
+ *
+ * @param definition Companion container properties.
+ * @param name Name to be used for the service and deployment objects.
+ * @param appName Name of the app.
+ * @param appId Id of the app creating the containers.
+ * @param registry The default container registry to be used.
+ * @returns `V1Service` and `V1Deployment` spec objects.
+ */
+export declare function generateDeploymentAndServiceSpecs(definition: CompanionContainerDefinition, name: string, appName: string, appId: string, registry?: string): {
+    service: V1Service;
+    deployment: V1Deployment;
+};

package/container/specs.js

@@ -0,0 +1,77 @@
+import { formatEnv, logger, resourceDefaults, validateContainerResources, } from '@appsemble/node-utils';
+/**
+ * Create the spec objects for a service, deployment, and pod.
+ * Use for a single companion container.
+ *
+ * @param definition Companion container properties.
+ * @param name Name to be used for the service and deployment objects.
+ * @param appName Name of the app.
+ * @param appId Id of the app creating the containers.
+ * @param registry The default container registry to be used.
+ * @returns `V1Service` and `V1Deployment` spec objects.
+ */
+export function generateDeploymentAndServiceSpecs(definition, name, appName, appId, registry) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    let { image, resources } = definition;
+    logger.silly(`Using image ${image} ${registry ? `from registry ${registry}` : ''}`);
+    if (registry && !image.includes('/')) {
+        // If registry ends with a '/'
+        image = `${registry.endsWith('/') ? registry.slice(0, -1) : registry}/${image}`;
+    }
+    const validatedResources = validateContainerResources(resources);
+    const env = formatEnv(definition.env, appName, appId);
+    // Env should have string keys!
+    const podTemplateSpec = {
+        metadata: {
+            ...definition.metadata,
+            labels: { app: name, ...(_a = definition.metadata) === null || _a === void 0 ? void 0 : _a.labels, appId },
+        },
+        spec: {
+            containers: [
+                {
+                    name,
+                    image,
+                    ports: [{ containerPort: (_b = definition.port) !== null && _b !== void 0 ? _b : 8080 }],
+                    env,
+                    resources: {
+                        limits: { ...validatedResources.limits },
+                        requests: { ...resourceDefaults },
+                    },
+                },
+            ],
+        },
+    };
+    // Define the Deployment specification
+    const deploymentSpec = {
+        replicas: 1,
+        selector: {
+            matchLabels: { app: name, appId },
+            ...(_c = definition.metadata) === null || _c === void 0 ? void 0 : _c.selector,
+        },
+        template: podTemplateSpec,
+    };
+    // Define the Deployment
+    const deployment = {
+        metadata: {
+            name,
+            ...definition.metadata,
+            labels: { ...(_d = definition.metadata) === null || _d === void 0 ? void 0 : _d.labels, appId },
+        },
+        spec: deploymentSpec,
+    };
+    // Default service type is ClusterIP
+    const serviceSpec = {
+        selector: { app: name, ...(_f = (_e = definition.metadata) === null || _e === void 0 ? void 0 : _e.selector) === null || _f === void 0 ? void 0 : _f.matchLabels, appId },
+        ports: [{ port: 80, targetPort: (_g = definition.port) !== null && _g !== void 0 ? _g : 8080 }],
+    };
+    const service = {
+        metadata: {
+            name,
+            ...definition.metadata,
+            labels: { ...(_h = definition.metadata) === null || _h === void 0 ? void 0 : _h.labels, appId },
+        },
+        spec: serviceSpec,
+    };
+    return { service, deployment };
+}
+//# sourceMappingURL=specs.js.map

package/index.d.ts

@@ -35,3 +35,4 @@ export * from './EmailQuotaExceededError.js';
 export * from './EmailError.js';
 export * from './UserPropertiesError.js';
 export * from './authentication.js';
+export * from './container/index.js';

package/index.js

@@ -35,4 +35,5 @@ export * from './EmailQuotaExceededError.js';
 export * from './EmailError.js';
 export * from './UserPropertiesError.js';
 export * from './authentication.js';
+export * from './container/index.js';
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsemble/node-utils",
-  "version": "0.29.4",
+  "version": "0.29.6",
   "description": "NodeJS utilities used by Appsemble internally.",
   "keywords": [
     "app",
@@ -38,10 +38,11 @@
     "test": "vitest"
   },
   "dependencies": {
-    "@appsemble/types": "0.29.4",
-    "@appsemble/utils": "0.29.4",
+    "@appsemble/types": "0.29.6",
+    "@appsemble/utils": "0.29.6",
     "@formatjs/fast-memoize": "^2.0.0",
     "@fortawesome/fontawesome-free": "^6.0.0",
+    "@kubernetes/client-node": "0.21.0",
     "@koa/cors": "^4.0.0",
     "@odata/parser": "^0.2.0",
     "@types/koa": "^2.0.0",

package/server/controllers/action.js

@@ -1,7 +1,7 @@
-import { assertKoaError, getRemapperContext, logger, throwKoaError, version, } from '@appsemble/node-utils';
+import { assertKoaError, createFormData, getContainerNamespace, getRemapperContext, logger, parseServiceUrl, scaleDeployment, setLastRequestAnnotation, throwKoaError, version, waitForPodReadiness, } from '@appsemble/node-utils';
 import { defaultLocale, remap } from '@appsemble/utils';
 import axios from 'axios';
-import { get, pick } from 'lodash-es';
+import { get, mapValues, pick } from 'lodash-es';
 import { EmailQuotaExceededError } from '../../EmailQuotaExceededError.js';
 /**
  * These response headers are forwarded when proxying requests.
@@ -49,12 +49,38 @@ async function handleNotify(ctx, app, action, options) {
     await sendNotifications({ app, to, title, body });
     ctx.status = 204;
 }
+function deserializeResource(data) {
+    // Extract the resource and assets from the JSON object
+    const { resource } = data;
+    const assets = data.assets;
+    // Function to replace asset placeholders with actual Blobs
+    const replaceAssets = (value) => {
+        if (Array.isArray(value)) {
+            return value.map(replaceAssets);
+        }
+        if (typeof value === 'string' && /^\d+$/.test(value)) {
+            return assets[Number(value)];
+        }
+        if (value && typeof value === 'object') {
+            return mapValues(value, replaceAssets);
+        }
+        return value;
+    };
+    // Replace placeholders and return the deserialized resource
+    return replaceAssets(resource);
+}
 async function handleRequestProxy(ctx, app, action, useBody, options) {
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     const { method, query, request: { body, headers }, user, } = ctx;
     let data;
     if (useBody) {
-        data = body;
+        if (Object.hasOwn(body, 'assets')) {
+            const deserializedBody = deserializeResource(body);
+            data = createFormData(deserializedBody.length === 1 ? deserializedBody[0] : deserializedBody);
+        }
+        else {
+            data = body;
+        }
     }
     else {
         try {
@@ -108,13 +134,41 @@ async function handleRequestProxy(ctx, app, action, useBody, options) {
     axiosConfig.validateStatus = () => true;
     axiosConfig.decompress = false;
     let response;
+    const urlPattern = /^http:\/\/(([\da-z-]+).){2}svc.cluster.local/;
+    // Restricting access to only the containers defined by the app
+    if (urlPattern.test(String(proxyUrl))) {
+        axiosConfig.url = axiosConfig.url.replace(axiosConfig.url.split('.')[1], getContainerNamespace());
+        const { appId } = parseServiceUrl(String(proxyUrl));
+        if (appId !== String(app.id)) {
+            throwKoaError(ctx, 403, 'Forbidden');
+        }
+    }
     logger.verbose(`Forwarding request to ${axios.getUri(axiosConfig)}`);
     try {
         response = await axios(axiosConfig);
     }
     catch (err) {
-        logger.error(err);
-        throwKoaError(ctx, 502, 'Bad Gateway');
+        // If request is sent to a companion container and fails
+        // Try to start it anew and retry the request
+        if (urlPattern.test(String(proxyUrl))) {
+            const { deploymentName, namespace } = parseServiceUrl(String(proxyUrl));
+            try {
+                await scaleDeployment(namespace, deploymentName, 1);
+                await waitForPodReadiness(namespace, deploymentName, (_d = process.env.POD_READINESS_TIMEOUT) !== null && _d !== void 0 ? _d : undefined);
+                response = await axios(axiosConfig);
+            }
+            catch {
+                logger.error(err);
+                throwKoaError(ctx, 502, 'Bad Gateway');
+            }
+            finally {
+                await setLastRequestAnnotation(namespace, deploymentName);
+            }
+        }
+        else {
+            logger.error(err);
+            throwKoaError(ctx, 502, 'Bad Gateway');
+        }
     }
     ctx.status = response.status;
     ctx.set(pick(response.headers, allowResponseHeaders));

package/server/types.d.ts

@@ -86,6 +86,7 @@ declare module 'koas-parameters' {
         memberEmail: string;
         trainingBlockId: number;
         trainingId: number;
+        container: string;
     }
     interface QueryParams {
         domains: string[];