@boxxy/server 0.1.4 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxxy/server",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "The boxxy server: the API behind its three doors, and the runner loop",
   "homepage": "https://github.com/zgeoff/boxxy/tree/main/apps/server#readme",
   "bugs": "https://github.com/zgeoff/boxxy/issues",
@@ -32,19 +32,19 @@
     "typecheck": "tsrs --noEmit"
   },
   "dependencies": {
-    "@boxxy/caller-proof-imp": "0.1.4",
-    "@boxxy/closeout": "0.1.4",
-    "@boxxy/content-hash": "0.1.4",
-    "@boxxy/contract": "0.1.4",
-    "@boxxy/dispatch": "0.1.4",
-    "@boxxy/forge-github": "0.1.4",
-    "@boxxy/model": "0.1.4",
-    "@boxxy/notifier-atc": "0.1.4",
-    "@boxxy/pepys": "0.1.4",
-    "@boxxy/planning": "0.1.4",
-    "@boxxy/rules": "0.1.4",
-    "@boxxy/store-sqlite": "0.1.4",
-    "@boxxy/worker-atc": "0.1.4",
+    "@boxxy/caller-proof-imp": "0.1.5",
+    "@boxxy/closeout": "0.1.5",
+    "@boxxy/content-hash": "0.1.5",
+    "@boxxy/contract": "0.1.5",
+    "@boxxy/dispatch": "0.1.5",
+    "@boxxy/forge-github": "0.1.5",
+    "@boxxy/model": "0.1.5",
+    "@boxxy/notifier-atc": "0.1.5",
+    "@boxxy/pepys": "0.1.5",
+    "@boxxy/planning": "0.1.5",
+    "@boxxy/rules": "0.1.5",
+    "@boxxy/store-sqlite": "0.1.5",
+    "@boxxy/worker-atc": "0.1.5",
     "@modelcontextprotocol/server": "2.4.0",
     "@orpc/client": "2.0.0-beta.50",
     "@orpc/mcp": "2.0.0-beta.50",

package/src/config/read-trusted-issuers.ts

@@ -1,25 +1,36 @@
-import { readdir } from 'node:fs/promises';
+import { readdir, stat } from 'node:fs/promises';
 import path from 'node:path';
 
 export type IssuersAnswer =
   | { readonly kind: 'read'; readonly issuers: readonly unknown[] }
   | { readonly kind: 'invalid'; readonly message: string };
 
-// The trust documents, one per file of each folder, as parsed JSON in name order. The adapter
-// checks their shape; this reads them only.
+// The trust documents, one per regular file of each folder, as parsed JSON in name order. The
+// adapter checks their shape; this reads them only. Folders that hold no document refuse, so a
+// configured but empty mount never starts a server that refuses every session in silence.
 export async function readTrustedIssuers(folders: readonly string[]): Promise<IssuersAnswer> {
   const issuers: unknown[] = [];
 
   for (const folder of folders) {
-    const files = await readFileNames(folder);
+    const names = await readEntryNames(folder);
 
-    if (files === null) {
+    if (names === null) {
       return { kind: 'invalid', message: `no trusted issuers folder at ${folder}` };
     }
 
-    for (const name of files) {
+    for (const name of names) {
       const file = path.join(folder, name);
 
+      const entry = await readEntryKind(file);
+
+      if (entry === 'missing') {
+        return { kind: 'invalid', message: `the trust document at ${file} points nowhere` };
+      }
+
+      if (entry === 'other') {
+        continue;
+      }
+
       const text = await Bun.file(file).text();
 
       const json = parseJSON(text);
@@ -32,23 +43,38 @@ export async function readTrustedIssuers(folders: readonly string[]): Promise<Is
     }
   }
 
+  if (issuers.length === 0) {
+    return { kind: 'invalid', message: `no trust document in ${folders.join(', ')}` };
+  }
+
   return { kind: 'read', issuers };
 }
 
-// null: the folder does not exist
-async function readFileNames(folder: string): Promise<string[] | null> {
+// null: the folder does not exist. A Kubernetes volume keeps its real files under `..data` and
+// `..<timestamp>` and shows each key as a symlink beside them, so `..` names are skipped.
+async function readEntryNames(folder: string): Promise<string[] | null> {
   try {
-    const entries = await readdir(folder, { withFileTypes: true });
+    const names = await readdir(folder);
 
-    return entries
-      .filter((entry) => entry.isFile())
-      .map((entry) => entry.name)
+    return names
+      .filter((name) => !name.startsWith('..'))
       .toSorted((left, right) => left.localeCompare(right));
   } catch {
     return null;
   }
 }
 
+// `stat` follows a symlink to its target; a symlink that points nowhere is `missing`
+async function readEntryKind(file: string): Promise<'file' | 'other' | 'missing'> {
+  try {
+    const stats = await stat(file);
+
+    return stats.isFile() ? 'file' : 'other';
+  } catch {
+    return 'missing';
+  }
+}
+
 function parseJSON(text: string): unknown {
   try {
     const value: unknown = JSON.parse(text);