@caelo-cms/provisioning 0.10.46 → 0.10.48

package/src/azure-front-door.test.ts

@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The public site on every provider is object storage behind the provider's
+ * CDN, with no edge compute on the request path (CLAUDE.md §11.B Tier 1).
+ * Epic #676 removed the per-provider A/B edge routers; these checks keep them
+ * from coming back and pin the Azure primary domain to its Front Door
+ * endpoint. Stack checks are pure-string, like the other stack tests.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { azureFrontDoorDnsRecords } from "./azure-front-door.js";
+
+const stackDir = (provider: string) => resolve(import.meta.dir, `../stacks/${provider}`);
+const stack = (provider: string) => readFileSync(`${stackDir(provider)}/index.ts`, "utf8");
+
+describe("azureFrontDoorDnsRecords", () => {
+  const records = azureFrontDoorDnsRecords({
+    domain: "example.com",
+    endpointHostName: "caeloproduction-site-abc123.z01.azurefd.net",
+    validationToken: "tok-123",
+  });
+
+  it("points the primary domain at the Front Door endpoint", () => {
+    expect(records).toContainEqual(
+      expect.objectContaining({
+        hostname: "example.com",
+        type: "CNAME",
+        value: "caeloproduction-site-abc123.z01.azurefd.net",
+      }),
+    );
+  });
+
+  it("publishes the managed-certificate validation token", () => {
+    expect(records).toContainEqual(
+      expect.objectContaining({ hostname: "_dnsauth.example.com", type: "TXT", value: "tok-123" }),
+    );
+  });
+
+  it("refuses an endpoint without a hostname instead of emitting a dangling record", () => {
+    expect(() =>
+      azureFrontDoorDnsRecords({
+        domain: "example.com",
+        endpointHostName: "",
+        validationToken: "t",
+      }),
+    ).toThrow(/no hostName/);
+  });
+
+  it("refuses a custom domain without a validation token", () => {
+    expect(() =>
+      azureFrontDoorDnsRecords({
+        domain: "example.com",
+        endpointHostName: "x.azurefd.net",
+        validationToken: "",
+      }),
+    ).toThrow(/no validation token/);
+  });
+});
+
+describe("azure stack — static site behind Front Door", () => {
+  const src = stack("azure");
+
+  it("builds its DNS records from the Front Door endpoint and custom domain", () => {
+    expect(src).toContain("new azure.cdn.AFDEndpoint(");
+    expect(src).toContain("new azure.cdn.AFDCustomDomain(");
+    expect(src).toMatch(
+      /pulumi\s*\.all\(\[frontDoorEndpoint\.hostName, siteDomain\.validationProperties\]\)[\s\S]*?azureFrontDoorDnsRecords\(/,
+    );
+  });
+
+  it("routes the custom domain to the static-website origin", () => {
+    expect(src).toContain("new azure.storage.StorageAccountStaticWebsite(");
+    expect(src).toMatch(
+      /new azure\.cdn\.Route\([\s\S]*?customDomains: \[\{ id: siteDomain\.id \}\]/,
+    );
+  });
+
+  it("keeps owning the published $web container and edge-caches the route", () => {
+    expect(src).toMatch(/new azure\.storage\.BlobContainer\([\s\S]*?containerName: "\$web"/);
+    expect(src).toMatch(/new azure\.cdn\.Route\([\s\S]*?cacheConfiguration: \{/);
+  });
+
+  it("exposes no Container App to the public internet", () => {
+    expect(src).toContain("external: false");
+    expect(src).not.toMatch(/external:\s*(true|args\.)/);
+  });
+});
+
+describe("aws stack — edge-log sink", () => {
+  const src = stack("aws");
+
+  it("delivers CloudFront access logs to the log group it reports as the sink", () => {
+    expect(src).toMatch(
+      /new aws\.cloudwatch\.LogDeliverySource\([\s\S]*?logType: "ACCESS_LOGS",\s*resourceArn: distribution\.arn/,
+    );
+    expect(src).toContain("destinationResourceArn: edgeLogGroup.arn");
+    expect(src).toMatch(/cloudwatch:\/\/us-east-1\/\$\{edgeLogGroup\.name\}/);
+  });
+});
+
+describe.each(["aws", "azure", "gcp", "gcp-firebase", "self-hosted"])(
+  "%s stack — no edge router",
+  (provider) => {
+    const src = stack(provider);
+
+    it("runs no edge compute for the public site", () => {
+      expect(src).not.toContain("edge-router");
+      expect(src).not.toContain("lambdaFunctionAssociations");
+      expect(src).not.toContain("ab-routing.json");
+    });
+
+    it("ships no edge handler source", () => {
+      expect(existsSync(`${stackDir(provider)}/edge-handler.ts`)).toBe(false);
+    });
+  },
+);

package/src/azure-front-door.ts

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * DNS records the Azure stack asks the operator's registrar to hold.
+ *
+ * The public site is served by Azure Front Door (CLAUDE.md §11.B Tier 1:
+ * object storage + edge CDN + managed TLS, no compute on the request path),
+ * so the primary domain points at the Front Door endpoint, and Front Door's
+ * managed certificate needs the `_dnsauth` TXT record to prove domain
+ * ownership before it issues.
+ */
+
+import type { DnsRecord } from "./adapter.js";
+
+/** Inputs the Azure stack resolves from its Front Door resources. */
+export interface AzureFrontDoorDnsInputs {
+  /** The site's primary domain (`caelo-azure:domain`). */
+  readonly domain: string;
+  /** `AFDEndpoint.hostName`, e.g. `caelo-prod-abc123.z01.azurefd.net`. */
+  readonly endpointHostName: string;
+  /** `AFDCustomDomain.validationProperties.validationToken`. */
+  readonly validationToken: string;
+}
+
+/**
+ * The records for the primary domain: a CNAME to the Front Door endpoint and
+ * the TXT record that validates the custom domain for its managed certificate.
+ *
+ * @throws when the endpoint hostname or validation token is empty — a record
+ * pointing at nothing would read fine in the DNS guidance page and then fail
+ * at the registrar (no fallbacks pre-1.0, CLAUDE.md §2).
+ */
+export function azureFrontDoorDnsRecords(input: AzureFrontDoorDnsInputs): DnsRecord[] {
+  if (input.endpointHostName.length === 0) {
+    throw new Error("azure-front-door: the Front Door endpoint has no hostName yet");
+  }
+  if (input.validationToken.length === 0) {
+    throw new Error(
+      `azure-front-door: the custom domain ${input.domain} has no validation token yet`,
+    );
+  }
+  return [
+    {
+      hostname: input.domain,
+      type: "CNAME",
+      value: input.endpointHostName,
+      purpose: "Primary domain → Azure Front Door endpoint (static site)",
+    },
+    {
+      hostname: `_dnsauth.${input.domain}`,
+      type: "TXT",
+      value: input.validationToken,
+      purpose: "Validates the primary domain for Front Door's managed TLS certificate",
+    },
+  ];
+}

package/src/bootstrap-token.ts

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * P14 — owner bootstrap token. cms-provision generates one at first
+ * `up`; the operator visits /setup?token=<…> to create the first
+ * Owner. Single-use, 24h TTL.
+ */
+
+export interface BootstrapToken {
+  readonly token: string;
+  readonly expiresAt: string;
+}
+
+export function generateBootstrapToken(): BootstrapToken {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const token = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+  const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
+  return { token, expiresAt };
+}

package/src/caddy.ts

@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * P14 — Caddyfile generator.
+ *
+ * Reads the `domains` table + the deploy targets and emits a
+ * deterministic Caddyfile string. The CLI's `regenerate-caddy`
+ * sub-command writes this to `/etc/caddy/Caddyfile` and runs
+ * `caddy reload`.
+ *
+ * Per-vhost shape:
+ *   <hostname> {
+ *     # admin   → reverse_proxy localhost:5173
+ *     # public  → root + try_files (static), with /api/* → gateway
+ *     tls <ownerEmail>
+ *   }
+ *
+ * Staging vhosts force `X-Robots-Tag: noindex`.
+ *
+ * Public vhosts mark content-hashed build outputs (fonts, plugin
+ * bundles — `CONTENT_HASHED_PATH_PATTERN` in @caelo-cms/shared)
+ * `immutable` for a year. Everything else keeps Caddy's file_server
+ * default (no Cache-Control; ETag + Last-Modified for revalidation),
+ * so pages and slug-addressed media are never pinned in caches. The
+ * matcher also requires the file to exist (`file`), so a 404 for a
+ * hashed URL (an old page requesting an asset the new build dropped)
+ * is never cached for a year.
+ *
+ * `.ico` files (theme favicons) are served as `image/x-icon`, the one
+ * icon MIME the media library stores and `<link rel="icon" type>`
+ * declares. file_server only fills Content-Type when no earlier handler
+ * set it, so the `header` line wins over the host's mime.types name.
+ */
+
+import { CONTENT_HASHED_PATH_PATTERN, IMMUTABLE_CACHE_CONTROL } from "@caelo-cms/shared";
+
+export interface CaddyDomainSpec {
+  readonly hostname: string;
+  readonly kind: "admin" | "public";
+  readonly env: "production" | "staging";
+}
+
+export interface CaddyfileSpec {
+  readonly ownerEmail: string;
+  readonly publicSiteRoot: string; // absolute path on disk
+  readonly stagingSiteRoot: string;
+  readonly adminPort: number;
+  readonly gatewayPort: number;
+  readonly domains: ReadonlyArray<CaddyDomainSpec>;
+}
+
+export function generateCaddyfile(spec: CaddyfileSpec): string {
+  const blocks: string[] = [];
+
+  // Global options.
+  blocks.push(`{
+  email ${spec.ownerEmail}
+}
+`);
+
+  for (const d of spec.domains) {
+    blocks.push(vhost(d, spec));
+  }
+
+  // Localhost dev fallback when no domains are configured (so a fresh
+  // `cms-provision` produces a working Caddyfile even pre-DNS).
+  if (spec.domains.length === 0) {
+    blocks.push(`# No domains configured yet — cms-provision regenerate-caddy
+# will overwrite this file when you add one at /settings/domains.
+:8081 {
+  reverse_proxy localhost:${spec.adminPort}
+}
+`);
+  }
+
+  return blocks.join("\n");
+}
+
+function vhost(d: CaddyDomainSpec, spec: CaddyfileSpec): string {
+  const noindex = d.env === "staging" ? `\n  header X-Robots-Tag "noindex"` : "";
+  if (d.kind === "admin") {
+    return `${d.hostname} {${noindex}
+  reverse_proxy localhost:${spec.adminPort}
+}
+`;
+  }
+  // public — API routes go to the gateway,
+  // the rest serves static files. Locale variants serve from a
+  const root = d.env === "staging" ? spec.stagingSiteRoot : spec.publicSiteRoot;
+  return `${d.hostname} {${noindex}
+  root * ${root}
+  @content_hashed {
+    path_regexp content_hashed ${CONTENT_HASHED_PATH_PATTERN}
+    file
+  }
+  header @content_hashed Cache-Control "${IMMUTABLE_CACHE_CONTROL}"
+  @ico path *.ico
+  header @ico Content-Type "image/x-icon"
+  handle /api/* {
+    reverse_proxy localhost:${spec.gatewayPort}
+  }
+  handle /admin/* {
+    reverse_proxy localhost:${spec.adminPort}
+  }
+  handle {
+    file_server {
+      try_files {path} {path}/index.html /index.html
+    }
+  }
+}
+`;
+}

package/src/cdn-copy.ts

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * P15 — per-provider CDN-copy adapter contract.
+ *
+ * P7 ships the `media_assets.usage_count` threshold + the `media.set_cdn`
+ * op that flips a per-asset boolean. P15 wires the actual edge-pin
+ * operation per provider:
+ *   - AWS  → CloudFront cache invalidation + warmer request.
+ *   - GCP  → set Cache-Control metadata on the GCS object so Cloud CDN
+ *           respects the long TTL.
+ *   - Azure → Front Door purge + warm endpoint.
+ *
+ * The redeploy-orchestrator's `cdnCopyTick()` (currently a no-op for
+ * cloud installs) drains the per-asset CDN-pin queue using the adapter
+ * registered for the active provider.
+ *
+ * Each provider's stack publishes a `CdnCopyAdapter` instance via its
+ * Pulumi outputs (the actual implementation is dynamically imported by
+ * the orchestrator at runtime so `@caelo-cms/provisioning` doesn't pull in
+ * `@aws-sdk/...`/`@google-cloud/...`/`@azure/...` as static deps). The
+ * interface defined here is the only thing both sides agree on.
+ */
+
+export interface CdnCopyAdapter {
+  /**
+   * Mark the asset at `assetKey` (object key in primary storage) as
+   * CDN-cached. Returns the public CDN URL — admin uses this as the
+   * canonical URL for the asset thereafter.
+   */
+  pin(assetKey: string): Promise<string>;
+  /** Reverse — drop from CDN edge cache. */
+  unpin(assetKey: string): Promise<void>;
+}
+
+/**
+ * No-op adapter for self-hosted installs (Caddy serves directly from
+ * disk; no separate CDN tier). Returns the input asset key as a relative
+ * URL so callers don't have to special-case the no-CDN case.
+ */
+export const selfHostedCdnCopy: CdnCopyAdapter = {
+  async pin(assetKey) {
+    return `/media/${assetKey}`;
+  },
+  async unpin() {
+    // no-op
+  },
+};
+
+/**
+ * Resolves the right adapter per `process.env.CAELO_PROVIDER`. Lazy
+ * dynamic-imports the per-provider implementation so a self-hosted
+ * install never loads the cloud SDKs.
+ *
+ * Returns `selfHostedCdnCopy` ONLY for `provider==='self-hosted'` or an
+ * unset env (treated as self-hosted). For `gcp`/`aws`/`azure`, the
+ * matching `cdn-copy-<gcs|aws|azure>.ts` file MUST exist in this
+ * directory — those land with the per-provider PRs. Per CLAUDE.md §2
+ * "no fallbacks pre-1.0" we deliberately do NOT silently degrade to
+ * the self-hosted no-op when the file is missing: a missing module is
+ * a deploy bug + the orchestrator tick should crash loudly so the
+ * operator notices instead of silently dropping CDN-pin requests.
+ */
+export async function loadCdnCopyAdapter(provider?: string): Promise<CdnCopyAdapter> {
+  switch (provider) {
+    case "gcp":
+      // biome-ignore lint/suspicious/noExplicitAny: opt-in dynamic import
+      return ((await import("./cdn-copy-gcs.js" as string)) as any).gcsCloudCdnPin;
+    case "gcp-firebase":
+      // v0.3.0 — Firebase Hosting manages CDN caching natively (each
+      // deploy creates an immutable version + the CDN's freshness is
+      // dictated by Firebase Hosting headers). There's no per-asset
+      // "pin to edge" API; this adapter is effectively a no-op that
+      // returns the same shape as self-hosted.
+      return selfHostedCdnCopy;
+    case "aws":
+      // biome-ignore lint/suspicious/noExplicitAny: opt-in dynamic import
+      return ((await import("./cdn-copy-aws.js" as string)) as any).s3CloudfrontPrewarm;
+    case "azure":
+      // biome-ignore lint/suspicious/noExplicitAny: opt-in dynamic import
+      return ((await import("./cdn-copy-azure.js" as string)) as any).azureBlobCdnPrefetch;
+    case undefined:
+    case "":
+    case "self-hosted":
+      return selfHostedCdnCopy;
+    default:
+      throw new Error(
+        `loadCdnCopyAdapter: unknown CAELO_PROVIDER='${provider}'. Expected one of: self-hosted | gcp | gcp-firebase | aws | azure.`,
+      );
+  }
+}

package/src/cert-wait.test.ts

@@ -0,0 +1,194 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import { type CertProbe, domainMappingProbe, lbCertProbe, waitForCert } from "./cert-wait.js";
+import type { GcloudResult } from "./gcloud.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+
+/** A fake clock the injected sleep advances. */
+function clock() {
+  let t = 0;
+  return {
+    now: () => t,
+    sleep: async (ms: number) => {
+      t += ms;
+    },
+    elapsed: () => t,
+  };
+}
+
+function probes(...seq: CertProbe[]) {
+  let i = 0;
+  return async () => seq[Math.min(i++, seq.length - 1)] as CertProbe;
+}
+
+describe("waitForCert", () => {
+  it("returns once the probe reports ready, reporting each new detail once", async () => {
+    const c = clock();
+    const updates: string[] = [];
+    const r = await waitForCert({
+      probe: probes(
+        { state: "pending", detail: "waiting for DNS" },
+        { state: "pending", detail: "waiting for DNS" },
+        { state: "pending", detail: "issuing" },
+        { state: "ready" },
+      ),
+      timeoutMs: 60_000,
+      intervalMs: 10_000,
+      onUpdate: (d) => updates.push(d),
+      ...c,
+    });
+    expect(r).toEqual({ ok: true });
+    expect(updates).toEqual(["waiting for DNS", "issuing"]);
+    expect(c.elapsed()).toBe(30_000);
+  });
+
+  it("times out with the last detail instead of waiting forever", async () => {
+    const c = clock();
+    const r = await waitForCert({
+      probe: probes({ state: "pending", detail: "CertificateProvisioned: DNS not set" }),
+      timeoutMs: 25_000,
+      intervalMs: 10_000,
+      ...c,
+    });
+    expect(r).toEqual({
+      ok: false,
+      reason: "timeout",
+      lastDetail: "CertificateProvisioned: DNS not set",
+    });
+    // Probed at 0, 10s, 20s, 25s (the deadline) — never slept past it.
+    expect(c.elapsed()).toBe(25_000);
+  });
+
+  it("stops at once when gcloud fails, since waiting cannot fix that", async () => {
+    const c = clock();
+    const r = await waitForCert({
+      probe: probes({ state: "error", error: "PERMISSION_DENIED" }),
+      timeoutMs: 60_000,
+      intervalMs: 10_000,
+      ...c,
+    });
+    expect(r).toEqual({ ok: false, reason: "error", error: "PERMISSION_DENIED" });
+    expect(c.elapsed()).toBe(0);
+  });
+});
+
+const target = { hostname: "admin.example.com", region: "europe-west1", projectId: "p" };
+
+describe("domainMappingProbe", () => {
+  it("is ready when the mapping's Ready condition is True", async () => {
+    const calls: string[][] = [];
+    const run = async (args: string[]) => {
+      calls.push(args);
+      return ok(JSON.stringify({ status: { conditions: [{ type: "Ready", status: "True" }] } }));
+    };
+    expect(await domainMappingProbe(run, target)).toEqual({ state: "ready" });
+    expect(calls[0]).toEqual([
+      "beta",
+      "run",
+      "domain-mappings",
+      "describe",
+      "--domain=admin.example.com",
+      "--region=europe-west1",
+      "--project=p",
+      "--format=json",
+    ]);
+  });
+
+  it("reports the certificate condition's message while pending", async () => {
+    const run = async () =>
+      ok(
+        JSON.stringify({
+          status: {
+            conditions: [
+              { type: "Ready", status: "Unknown", message: "not ready" },
+              {
+                type: "CertificateProvisioned",
+                status: "Unknown",
+                message: "Certificate issuance pending. Add the DNS record.",
+              },
+              { type: "DomainRoutable", status: "True" },
+            ],
+          },
+        }),
+      );
+    expect(await domainMappingProbe(run, target)).toEqual({
+      state: "pending",
+      detail: "CertificateProvisioned: Certificate issuance pending. Add the DNS record.",
+    });
+  });
+
+  it("is pending (not ready) before Google reports any condition", async () => {
+    const run = async () => ok(JSON.stringify({ status: {} }));
+    expect((await domainMappingProbe(run, target)).state).toBe("pending");
+  });
+
+  it("surfaces a gcloud failure as an error", async () => {
+    const run = async () => fail("ERROR: (gcloud) You do not currently have an active account");
+    const r = await domainMappingProbe(run, target);
+    expect(r.state).toBe("error");
+  });
+});
+
+describe("lbCertProbe", () => {
+  const list = (certs: unknown[]) => async () => ok(JSON.stringify(certs));
+  const lb = { projectId: "p", hostname: "admin.example.com" };
+
+  it("is ready when the admin's own certificate is ACTIVE although the main domain's is not", async () => {
+    const r = await lbCertProbe(
+      list([
+        {
+          name: "combined",
+          managed: {
+            status: "PROVISIONING",
+            domainStatus: { "example.com": "FAILED_NOT_VISIBLE", "admin.example.com": "ACTIVE" },
+          },
+        },
+        {
+          name: "admin-only",
+          managed: { status: "ACTIVE", domainStatus: { "admin.example.com": "ACTIVE" } },
+        },
+      ]),
+      lb,
+    );
+    expect(r).toEqual({ state: "ready" });
+  });
+
+  it("does not count a domain that is ACTIVE on a certificate that is not served yet", async () => {
+    const r = await lbCertProbe(
+      list([
+        {
+          name: "combined",
+          managed: {
+            status: "PROVISIONING",
+            domainStatus: { "example.com": "FAILED_NOT_VISIBLE", "admin.example.com": "ACTIVE" },
+          },
+        },
+      ]),
+      lb,
+    );
+    expect(r).toEqual({ state: "pending", detail: "combined: admin.example.com ACTIVE" });
+  });
+
+  it("is ready for installs that only have the combined certificate, once it is ACTIVE", async () => {
+    const r = await lbCertProbe(
+      list([
+        {
+          name: "combined",
+          managed: {
+            status: "ACTIVE",
+            domainStatus: { "example.com": "ACTIVE", "admin.example.com": "ACTIVE" },
+          },
+        },
+      ]),
+      lb,
+    );
+    expect(r).toEqual({ state: "ready" });
+  });
+
+  it("is pending when no certificate lists the host", async () => {
+    expect((await lbCertProbe(list([]), lb)).state).toBe("pending");
+  });
+});