@bugmole/cli 0.4.0

package/src/registry-worker/gitlab/checks.ts

@@ -0,0 +1,349 @@
+// GitLab merge request checks: unlike GitHub, there is no Bugmole-operated
+// app to install. Each binding brings its own project access token (scope
+// `api`) and a per-binding webhook secret, generated when the binding is
+// created and shown once so it can be pasted into the project's webhook
+// settings. The webhook posts straight to the registry — there's no shared
+// operator secret to verify, so no dashboard hop is needed the way GitHub's
+// is.
+import { fetchGitlabProject, GitlabApiError, normalizeGitlabHost, postCommitStatus, validGitlabHost, type GitlabFetchEnv } from "../../integrations/gitlab.js";
+import type { Env, Principal } from "../core.js";
+import { constantTimeEqual, memberOfProject, newId, randomToken, requestJson, response } from "../core.js";
+import { runChangedHooks, runService, type InternalRunFields } from "../hooks.js";
+import { auditProject } from "../org/audit.js";
+import { enqueue, PermanentDeliveryError, registerOutboxHandler } from "../notifications/outbox.js";
+import { openSecret, sealSecret } from "../notifications/secrets.js";
+import { previewUrl } from "../repo-triggers.js";
+import { detachedContext, matchPath, registerPublicRoutes, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
+import { prChecksOn } from "../github/checks.js";
+import { digging, molesFound } from "../../runtime/mole-voice.js";
+
+const TRIGGERS = new Set(["merge_request"]);
+const PROJECT_PATH = /^[A-Za-z0-9_.-]{1,100}(?:\/[A-Za-z0-9_.-]{1,100})+$/;
+const SHA = /^[0-9a-f]{40}$/;
+
+type Binding = {
+  id: string;
+  project_id: string;
+  gitlab_host: string;
+  gitlab_project_id: number;
+  gitlab_project_path: string;
+  access_token_ciphertext: string;
+  access_token_iv: string;
+  webhook_secret_ciphertext: string;
+  webhook_secret_iv: string;
+  plan_ids_json: string | null;
+  environment_id: string | null;
+  trigger: "merge_request";
+  base_url_template: string | null;
+  execution_mode: "self" | "cloud";
+  created_by: string;
+};
+
+function gitlabEnv(env: Env): GitlabFetchEnv {
+  return env as Env & GitlabFetchEnv;
+}
+
+function dashboard(env: Env): string {
+  return (env.DASHBOARD_URL || "https://app.bugmole.com").replace(/\/$/, "");
+}
+
+function webhookUrl(env: Env, bindingId: string): string {
+  return `${(env.REGISTRY_PUBLIC_URL || "https://api.bugmole.com").replace(/\/$/, "")}/api/gitlab/webhook?binding=${bindingId}`;
+}
+
+async function publishedPlans(env: Env, projectId: string, only: string[] | null): Promise<string[]> {
+  const rows = await env.DB.prepare("SELECT plan_id AS planId FROM plan_drafts WHERE project_id = ? ORDER BY plan_id").bind(projectId).all<{ planId: string }>();
+  const all = rows.results.map((row) => row.planId);
+  return only ? all.filter((planId) => only.includes(planId)) : all;
+}
+
+async function startRun(env: Env, binding: Binding, planId: string, idempotencyKey: string, internal: InternalRunFields): Promise<string | null> {
+  if (!runService.create) throw new Error("Run creation isn't wired");
+  const principal: Principal = { aegisId: binding.created_by, projectIds: [], scopes: ["*"] };
+  const request = new Request("https://registry.internal/gitlab", {
+    method: "POST",
+    body: JSON.stringify({ planId, idempotencyKey, executionMode: binding.execution_mode, ...(binding.environment_id ? { environmentId: binding.environment_id } : {}) }),
+  });
+  const created = await runService.create(request, env, principal, binding.project_id, detachedContext(), internal);
+  const body = await created.json().catch(() => ({})) as { run?: { id: string }; error?: string };
+  if (!created.ok || !body.run) {
+    console.warn(`[gitlab] couldn't start ${planId} for ${binding.gitlab_project_path}: ${body.error ?? created.status}`);
+    return null;
+  }
+  // A new run (201) gets an initial status; a repeat delivery (200) already has one.
+  if (created.status === 201) await enqueue(env, "gitlab.status.update", { runId: body.run.id }, { dedupeKey: `gl-status:${body.run.id}:pending` });
+  return body.run.id;
+}
+
+// --- Merge request events ---------------------------------------------------------------------
+
+export type GitlabMergeRequestEvent = {
+  gitlabProjectId: number;
+  action: string;
+  hasCommit: boolean;
+  iid: number;
+  sha: string;
+  branch?: string;
+};
+
+/** GitLab's "Merge Request Hook" payload; only the fields Bugmole acts on. */
+export function parseMergeRequestEvent(body: Record<string, unknown> | null): GitlabMergeRequestEvent | null {
+  if (!body || body.object_kind !== "merge_request") return null;
+  const project = body.project as Record<string, unknown> | undefined;
+  const attrs = body.object_attributes as Record<string, unknown> | undefined;
+  const gitlabProjectId = Number(project?.id);
+  if (!Number.isInteger(gitlabProjectId) || gitlabProjectId <= 0) return null;
+  const action = typeof attrs?.action === "string" ? attrs.action : "";
+  const iid = Number(attrs?.iid);
+  if (!Number.isInteger(iid) || iid <= 0) return null;
+  const lastCommit = attrs?.last_commit as Record<string, unknown> | undefined;
+  const sha = typeof lastCommit?.id === "string" ? lastCommit.id.toLowerCase() : "";
+  if (!SHA.test(sha)) return null;
+  const branch = typeof attrs?.source_branch === "string" ? attrs.source_branch : undefined;
+  // "update" fires for label/description edits too; `oldrev` is only present when a commit was pushed.
+  return { gitlabProjectId, action, hasCommit: attrs?.oldrev !== undefined, iid, sha, branch };
+}
+
+function shouldRun(event: GitlabMergeRequestEvent): boolean {
+  return event.action === "open" || event.action === "reopen" || (event.action === "update" && event.hasCommit);
+}
+
+export async function handleMergeRequestEvent(env: Env, binding: Binding, event: GitlabMergeRequestEvent): Promise<{ started: string[] }> {
+  if (!shouldRun(event) || !(await prChecksOn(env, binding.project_id))) return { started: [] };
+  let baseUrl: string | undefined;
+  if (binding.base_url_template) {
+    const url = previewUrl(binding.base_url_template, { number: event.iid, sha: event.sha, branch: event.branch });
+    if (!url) return { started: [] };
+    baseUrl = url;
+  }
+  const started: string[] = [];
+  const plans = await publishedPlans(env, binding.project_id, binding.plan_ids_json ? JSON.parse(binding.plan_ids_json) as string[] : null);
+  for (const planId of plans) {
+    const id = await startRun(env, binding, planId, `gl:${binding.id}:${event.sha}:${planId}`, {
+      triggerSource: "merge_request",
+      repoFullName: binding.gitlab_project_path,
+      commitSha: event.sha,
+      prNumber: event.iid,
+      gitlabBindingId: binding.id,
+      environmentBaseUrl: baseUrl,
+    });
+    if (id) started.push(id);
+  }
+  return { started };
+}
+
+// --- Commit statuses ---------------------------------------------------------------------------
+//
+// GitLab has no persistent check-run id to create then update: posting a new
+// status with the same `name` for the same commit replaces the previous one.
+
+type RunForStatus = {
+  id: string; projectId: string; planId: string; status: string; sha: string | null; bindingId: string | null;
+  passed: number | null; failed: number | null; baseUrl: string | null;
+};
+
+async function runForStatus(env: Env, runId: string): Promise<RunForStatus | null> {
+  return env.DB.prepare(`
+    SELECT id, project_id AS projectId, plan_id AS planId, status, commit_sha AS sha, gitlab_binding_id AS bindingId,
+           steps_passed AS passed, steps_failed AS failed, environment_base_url AS baseUrl
+    FROM runs WHERE id = ?
+  `).bind(runId).first<RunForStatus>();
+}
+
+function statusFor(run: RunForStatus): { state: "pending" | "running" | "success" | "failed" | "canceled"; description: string } {
+  if (run.status === "queued") return { state: "pending", description: "Waiting for a runner." };
+  if (run.status === "running") return { state: "running", description: digging(run.baseUrl) };
+  if (run.status === "cancelled") return { state: "canceled", description: "Cancelled." };
+  const state = run.status === "success" ? "success" : "failed";
+  const on = run.baseUrl ? ` on ${run.baseUrl}` : "";
+  const found = state === "success" || (run.failed ?? 0) > 0 ? `${molesFound(state === "success" ? 0 : run.failed ?? 0)}: ` : "";
+  return { state, description: `${found}${run.passed ?? 0} step(s) passed, ${run.failed ?? 0} failed${on}.` };
+}
+
+async function deliver(work: () => Promise<unknown>): Promise<void> {
+  try {
+    await work();
+  } catch (error) {
+    // A revoked token or removed project (401/403/404/422) won't start working on a retry.
+    if (error instanceof GitlabApiError && [401, 403, 404, 422].includes(error.status)) throw new PermanentDeliveryError(error.message);
+    throw error;
+  }
+}
+
+registerOutboxHandler("gitlab.status.update", async (env, payload: { runId: string }) => {
+  const run = await runForStatus(env, payload.runId);
+  if (!run?.sha || !run.bindingId) return;
+  const binding = await env.DB.prepare("SELECT * FROM project_gitlab_bindings WHERE id = ?").bind(run.bindingId).first<Binding>();
+  if (!binding) return;
+  const token = await openSecret(env, binding.access_token_ciphertext, binding.access_token_iv);
+  const { state, description } = statusFor(run);
+  await deliver(() => postCommitStatus(gitlabEnv(env), binding.gitlab_host, token, binding.gitlab_project_id, run.sha!, {
+    state,
+    name: `Bugmole: ${run.planId}`,
+    description,
+    target_url: `${dashboard(env)}/runs?${new URLSearchParams({ project: run.projectId, run: run.id })}`,
+  }));
+});
+
+runChangedHooks.push(async (env, event) => {
+  const run = await env.DB.prepare("SELECT gitlab_binding_id AS bindingId FROM runs WHERE id = ?").bind(event.runId).first<{ bindingId: string | null }>();
+  if (!run?.bindingId) return;
+  // One update per state; the handler always sends the run's latest state.
+  await enqueue(env, "gitlab.status.update", { runId: event.runId }, { dedupeKey: `gl-status:${event.runId}:${event.status}` });
+});
+
+// --- Routes ----------------------------------------------------------------------------------
+
+function validProjectPath(path: string): boolean {
+  return PROJECT_PATH.test(path) && !path.split("/").some((part) => part === "." || part === "..");
+}
+
+async function listBindings({ env, principal }: AuthedRouteContext, projectId: string): Promise<Response> {
+  if (!(await memberOfProject(env, principal, projectId))) return response({ error: "Project scope is not allowed" }, 403);
+  const rows = await env.DB.prepare(`
+    SELECT id, gitlab_host AS gitlabHost, gitlab_project_id AS gitlabProjectId, gitlab_project_path AS gitlabProjectPath,
+           plan_ids_json AS planIds, environment_id AS environmentId, trigger, base_url_template AS baseUrlTemplate,
+           execution_mode AS executionMode, enabled, created_at AS createdAt
+    FROM project_gitlab_bindings WHERE project_id = ? ORDER BY created_at ASC
+  `).bind(projectId).all<Record<string, unknown> & { planIds: string | null; enabled: number }>();
+  return response({
+    available: await prChecksOn(env, projectId),
+    bindings: rows.results.map((row) => ({
+      ...row,
+      planIds: row.planIds ? JSON.parse(row.planIds) : null,
+      enabled: Boolean(row.enabled),
+      webhookUrl: webhookUrl(env, String(row.id)),
+    })),
+  });
+}
+
+async function saveBinding({ env, principal, request }: AuthedRouteContext, projectId: string, bindingId?: string): Promise<Response> {
+  if (!(await memberOfProject(env, principal, projectId, "project.manage"))) return response({ error: "Project scope is not allowed" }, 403);
+  if (request.method === "DELETE") {
+    const deleted = await env.DB.prepare("DELETE FROM project_gitlab_bindings WHERE id = ? AND project_id = ?").bind(bindingId, projectId).run();
+    if ((deleted.meta?.changes ?? 0) === 0) return response({ error: "Not found" }, 404);
+    await auditProject(env, principal, projectId, { action: "gitlab.checks_removed", targetType: "gitlab_binding", targetId: bindingId }, request);
+    return response({ deleted: true });
+  }
+  if (!(await prChecksOn(env, projectId))) {
+    return response({ error: "Merge request checks are included in Team and Business.", code: "plan_feature", feature: "prChecks", upgradeUrl: "/billing" }, 402);
+  }
+  const body = await requestJson(request);
+  const host = normalizeGitlabHost(typeof body?.host === "string" ? body.host : undefined);
+  const projectPath = typeof body?.projectPath === "string" ? body.projectPath.trim().replace(/^\/+|\/+$/g, "") : "";
+  const accessToken = typeof body?.accessToken === "string" ? body.accessToken.trim() : "";
+  const trigger = body?.trigger ?? "merge_request";
+  const planIds = body?.planIds === null || body?.planIds === undefined ? null : body.planIds;
+  const template = typeof body?.baseUrlTemplate === "string" && body.baseUrlTemplate.trim() ? body.baseUrlTemplate.trim() : null;
+  const executionMode = body?.executionMode ?? "cloud";
+  const environmentId = typeof body?.environmentId === "string" && body.environmentId ? body.environmentId : null;
+  const enabled = body?.enabled === undefined ? true : body.enabled === true;
+  if (!validGitlabHost(host) || !validProjectPath(projectPath)) return response({ error: "host and projectPath (group/project) are required" }, 422);
+  if (typeof trigger !== "string" || !TRIGGERS.has(trigger)) return response({ error: "trigger must be merge_request" }, 422);
+  if (executionMode !== "cloud" && executionMode !== "self") return response({ error: "executionMode must be cloud or self" }, 422);
+  if (planIds !== null && (!Array.isArray(planIds) || !planIds.every((entry) => typeof entry === "string"))) {
+    return response({ error: "planIds must be a list of plan ids, or null for all" }, 422);
+  }
+  if (template && !previewUrl(template, { number: 1, sha: "0".repeat(40), branch: "main" })) {
+    return response({ error: "The preview URL template must be an http(s) address; it can use {number}, {sha}, {short_sha} and {branch}" }, 422);
+  }
+  if (environmentId) {
+    const environment = await env.DB.prepare("SELECT id FROM project_environments WHERE project_id = ? AND id = ?").bind(projectId, environmentId).first();
+    if (!environment) return response({ error: "Environment not found in this project" }, 422);
+  }
+  if (!accessToken && !bindingId) return response({ error: "accessToken is required to connect a new project" }, 422);
+  let gitlabProjectId: number;
+  let gitlabProjectPath = projectPath;
+  let sealedToken: { ciphertext: string; iv: string } | null = null;
+  if (accessToken) {
+    let project;
+    try {
+      project = await fetchGitlabProject(gitlabEnv(env), host, accessToken, projectPath);
+    } catch {
+      return response({ error: `Couldn't reach ${projectPath} on ${host} with that token. Check the project path and that the token has the "api" scope.` }, 422);
+    }
+    gitlabProjectId = project.id;
+    gitlabProjectPath = project.path_with_namespace;
+    sealedToken = await sealSecret(env, accessToken);
+  } else {
+    const current = await env.DB.prepare("SELECT gitlab_project_id AS id, gitlab_project_path AS path FROM project_gitlab_bindings WHERE id = ? AND project_id = ?")
+      .bind(bindingId, projectId).first<{ id: number; path: string }>();
+    if (!current) return response({ error: "Not found" }, 404);
+    gitlabProjectId = current.id;
+    gitlabProjectPath = current.path;
+  }
+  const id = bindingId ?? newId("glbind");
+  let webhookSecretPlaintext: string | null = null;
+  if (bindingId) {
+    const setToken = sealedToken ? ", access_token_ciphertext = ?, access_token_iv = ?" : "";
+    const updated = await env.DB.prepare(`
+      UPDATE project_gitlab_bindings SET gitlab_host = ?, gitlab_project_id = ?, gitlab_project_path = ?, trigger = ?, plan_ids_json = ?, base_url_template = ?,
+        execution_mode = ?, environment_id = ?, enabled = ?${setToken}
+      WHERE id = ? AND project_id = ?
+    `).bind(
+      host, gitlabProjectId, gitlabProjectPath, trigger, planIds ? JSON.stringify(planIds) : null, template, executionMode, environmentId, enabled ? 1 : 0,
+      ...(sealedToken ? [sealedToken.ciphertext, sealedToken.iv] : []),
+      bindingId, projectId,
+    ).run();
+    if ((updated.meta?.changes ?? 0) === 0) return response({ error: "Not found" }, 404);
+  } else {
+    webhookSecretPlaintext = randomToken(24);
+    const sealedSecret = await sealSecret(env, webhookSecretPlaintext);
+    try {
+      await env.DB.prepare(`
+        INSERT INTO project_gitlab_bindings (id, project_id, gitlab_host, gitlab_project_id, gitlab_project_path, access_token_ciphertext, access_token_iv,
+          webhook_secret_ciphertext, webhook_secret_iv, plan_ids_json, environment_id, trigger, base_url_template, execution_mode, enabled, created_by)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).bind(
+        id, projectId, host, gitlabProjectId, gitlabProjectPath, sealedToken!.ciphertext, sealedToken!.iv, sealedSecret.ciphertext, sealedSecret.iv,
+        planIds ? JSON.stringify(planIds) : null, environmentId, trigger, template, executionMode, enabled ? 1 : 0, principal.aegisId,
+      ).run();
+    } catch {
+      return response({ error: "This GitLab project already runs checks for that trigger" }, 409);
+    }
+  }
+  await auditProject(env, principal, projectId, {
+    action: bindingId ? "gitlab.checks_updated" : "gitlab.checks_added", targetType: "gitlab_binding", targetId: id, data: { projectPath: gitlabProjectPath, trigger },
+  }, request);
+  return response({
+    binding: { id, host, gitlabProjectId, gitlabProjectPath, trigger, planIds, baseUrlTemplate: template, executionMode, environmentId, enabled },
+    webhookUrl: webhookUrl(env, id),
+    ...(webhookSecretPlaintext ? { webhookSecret: webhookSecretPlaintext } : {}),
+  }, bindingId ? 200 : 201);
+}
+
+async function rotateWebhookSecret({ env, principal, request }: AuthedRouteContext, projectId: string, bindingId: string): Promise<Response> {
+  if (!(await memberOfProject(env, principal, projectId, "project.manage"))) return response({ error: "Project scope is not allowed" }, 403);
+  const binding = await env.DB.prepare("SELECT id FROM project_gitlab_bindings WHERE id = ? AND project_id = ?").bind(bindingId, projectId).first();
+  if (!binding) return response({ error: "Not found" }, 404);
+  const secret = randomToken(24);
+  const sealed = await sealSecret(env, secret);
+  await env.DB.prepare("UPDATE project_gitlab_bindings SET webhook_secret_ciphertext = ?, webhook_secret_iv = ? WHERE id = ?").bind(sealed.ciphertext, sealed.iv, bindingId).run();
+  await auditProject(env, principal, projectId, { action: "gitlab.webhook_secret_rotated", targetType: "gitlab_binding", targetId: bindingId }, request);
+  return response({ webhookUrl: webhookUrl(env, bindingId), webhookSecret: secret });
+}
+
+registerRoutes(async (context) => {
+  const { url, request } = context;
+  let params = matchPath(url.pathname, "/api/projects/:projectId/gitlab-bindings");
+  if (params && request.method === "GET") return listBindings(context, params.projectId);
+  if (params && request.method === "POST") return saveBinding(context, params.projectId);
+  params = matchPath(url.pathname, "/api/projects/:projectId/gitlab-bindings/:bindingId");
+  if (params && (request.method === "PATCH" || request.method === "DELETE")) return saveBinding(context, params.projectId, params.bindingId);
+  params = matchPath(url.pathname, "/api/projects/:projectId/gitlab-bindings/:bindingId/rotate-webhook-secret");
+  if (params && request.method === "POST") return rotateWebhookSecret(context, params.projectId, params.bindingId);
+  return null;
+});
+
+registerPublicRoutes(async ({ request, env, url }) => {
+  if (url.pathname !== "/api/gitlab/webhook" || request.method !== "POST") return null;
+  const bindingId = url.searchParams.get("binding") ?? "";
+  const token = request.headers.get("x-gitlab-token") ?? "";
+  const binding = await env.DB.prepare("SELECT * FROM project_gitlab_bindings WHERE id = ? AND enabled = 1").bind(bindingId).first<Binding>();
+  if (!binding) return response({ error: "Unknown binding" }, 404);
+  const expected = await openSecret(env, binding.webhook_secret_ciphertext, binding.webhook_secret_iv);
+  if (!token || !constantTimeEqual(token, expected)) return response({ error: "Invalid webhook token" }, 401);
+  const event = parseMergeRequestEvent(await requestJson(request));
+  if (!event || event.gitlabProjectId !== binding.gitlab_project_id) return response({ started: [] });
+  return response(await handleMergeRequestEvent(env, binding, event));
+});

package/src/registry-worker/hooks.ts

@@ -0,0 +1,54 @@
+// Extension points on the run and task lifecycle, so feature modules (cloud
+// dispatch, metering, notifications) react without growing index.ts.
+import type { Env } from "./core.js";
+
+/** Work Bugmole Cloud can execute: a test run, or a discovery task. */
+export type CloudJobKind = "run" | "task";
+
+export type RunQueued = { runId: string; projectId: string; workspaceId: string | null; executionMode: "self" | "cloud" };
+export type RunChanged = {
+  runId: string;
+  projectId: string;
+  workspaceId: string | null;
+  executionMode: string;
+  status: string;
+  previousStatus: string;
+  terminal: boolean;
+  /** Set when the cloud dispatcher itself changed the run, so its own hooks don't dispatch again. */
+  fromDispatcher?: boolean;
+};
+
+export type TaskQueued = { taskId: string; projectId: string; workspaceId: string | null; executionMode: "self" | "cloud" };
+export type TaskChanged = Omit<RunChanged, "runId"> & { taskId: string };
+
+/** A progress update or heartbeat of unfinished cloud-capable work. */
+export type JobHeartbeat = { kind: CloudJobKind; id: string; projectId: string; workspaceId: string | null; executionMode: string };
+/** Tells a still-running worker to stop (usage cap, time limit). */
+export type StopSignal = { reason: string; message: string };
+
+export const runQueuedHooks: Array<(env: Env, event: RunQueued) => Promise<void>> = [];
+export const runChangedHooks: Array<(env: Env, event: RunChanged) => Promise<void>> = [];
+export const taskQueuedHooks: Array<(env: Env, event: TaskQueued) => Promise<void>> = [];
+export const taskChangedHooks: Array<(env: Env, event: TaskChanged) => Promise<void>> = [];
+/** Checked on every progress update and heartbeat of unfinished work. */
+export const heartbeatChecks: Array<(env: Env, job: JobHeartbeat) => Promise<StopSignal | null>> = [];
+/** Fired after a workspace's plan changes (checkout, downgrade, cancellation, lapse). */
+export type PlanChanged = { workspaceId: string; from: string; to: string };
+export const planChangedHooks: Array<(env: Env, event: PlanChanged) => Promise<void>> = [];
+
+/** Run details only Bugmole's own integrations may set (a pull request's preview URL and commit). */
+export type InternalRunFields = {
+  environmentBaseUrl?: string;
+  triggerSource?: string;
+  repoFullName?: string;
+  commitSha?: string;
+  prNumber?: number;
+  githubInstallationId?: number;
+  gitlabBindingId?: string;
+};
+export type RunCreator = (request: Request, env: Env, principal: import("./core.js").Principal, projectId: string, ctx: ExecutionContext, internal?: InternalRunFields) => Promise<Response>;
+/** Set by index.ts, so integrations can create runs through the same checks as the API. */
+export const runService: { create?: RunCreator } = {};
+
+/** The registry's own request handler, set by index.ts, for callers that act as a user in-process (hosted MCP). */
+export const registryDispatch: { fetch?: (request: Request, env: import("./core.js").Env, ctx: ExecutionContext) => Promise<Response> } = {};