@celilo/cli 0.13.3 → 0.14.0

package/src/services/trusted-sources.ts

@@ -0,0 +1,159 @@
+/**
+ * Trusted-source registry — the DB-backed `TrustedSourceStore` for the
+ * `firewall` capability, and the composition of the trusted-subnet set the
+ * renderer consumes.
+ *
+ * A trusted source is an ORIGIN subnet permitted to initiate into every managed
+ * zone (the admin VPN's client range being the motivating case). It is not a
+ * port forward, so `exposeService` cannot express it — which is why the VPN's
+ * rules belonged to no module and every converge removed them.
+ */
+
+import type {
+  RegisterTrustedSourceRequest,
+  TrustedSource,
+  TrustedSourceStore,
+} from '@celilo/capabilities';
+import { and, eq } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { trustedSources } from '../db/schema';
+
+/**
+ * Build the store bound to the module that will call through the capability.
+ * `registeredBy` is stamped here, not supplied by the provider, so a
+ * registration can never be attributed to the wrong module.
+ */
+export function buildTrustedSourceStore(db: DbClient, registeredBy: string): TrustedSourceStore {
+  return {
+    list(firewallIp: string): TrustedSource[] {
+      return db
+        .select()
+        .from(trustedSources)
+        .where(eq(trustedSources.firewallIp, firewallIp))
+        .all()
+        .map((r) => ({
+          subnet: r.subnet,
+          description: r.description,
+          registeredBy: r.registeredBy,
+        }));
+    },
+
+    add(firewallIp: string, source: RegisterTrustedSourceRequest): void {
+      // Idempotent upsert on (firewall, subnet) — matches buildPortForwardStore.
+      db.delete(trustedSources)
+        .where(
+          and(eq(trustedSources.firewallIp, firewallIp), eq(trustedSources.subnet, source.subnet)),
+        )
+        .run();
+      db.insert(trustedSources)
+        .values({
+          firewallIp,
+          subnet: source.subnet,
+          description: source.description,
+          registeredBy,
+        })
+        .run();
+    },
+
+    remove(firewallIp: string, subnet: string): void {
+      db.delete(trustedSources)
+        .where(and(eq(trustedSources.firewallIp, firewallIp), eq(trustedSources.subnet, subnet)))
+        .run();
+    },
+  };
+}
+
+/** Where a trusted subnet came from — reach into every tier must be attributable. */
+export type TrustedSubnetOrigin = 'derived-control-plane' | 'registered' | 'operator-override';
+
+export interface TrustedSubnetEntry {
+  subnet: string;
+  origin: TrustedSubnetOrigin;
+  /** Module id for `registered`; undefined for the derived and override origins. */
+  registeredBy?: string;
+  description?: string;
+}
+
+/**
+ * The operator's explicit trusted sources, as a comma-separated CIDR list in
+ * system config. ADDITIVE rather than replacing the derived control-plane
+ * subnet: dropping control-plane trust would block the SSH celilo uses to run
+ * every hook and converge, so an operator cannot strand celilo's own management
+ * by naming a subnet here.
+ */
+export const TRUSTED_SUBNETS_CONFIG_KEY = 'firewall.trusted_subnets';
+
+export function parseOperatorTrustedSubnets(raw: string | undefined): string[] {
+  if (!raw) return [];
+  return raw
+    .split(',')
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0);
+}
+
+/**
+ * Compose the trusted-subnet set from its three origins, deduped by subnet with
+ * the FIRST origin winning (derived beats registered beats override), so the
+ * report names the strongest claim on a subnet rather than an arbitrary one.
+ *
+ * With nothing registered and no override this returns exactly the derived
+ * control-plane subnet — the property that makes composing safe to ship ahead of
+ * any module that registers.
+ */
+export function composeTrustedSubnets(inputs: {
+  controlPlaneSubnet?: string;
+  registered: TrustedSource[];
+  operatorOverride: string[];
+}): TrustedSubnetEntry[] {
+  const entries: TrustedSubnetEntry[] = [];
+  const seen = new Set<string>();
+  const push = (entry: TrustedSubnetEntry): void => {
+    if (seen.has(entry.subnet)) return;
+    seen.add(entry.subnet);
+    entries.push(entry);
+  };
+
+  if (inputs.controlPlaneSubnet) {
+    push({ subnet: inputs.controlPlaneSubnet, origin: 'derived-control-plane' });
+  }
+  for (const source of inputs.registered) {
+    push({
+      subnet: source.subnet,
+      origin: 'registered',
+      registeredBy: source.registeredBy,
+      description: source.description,
+    });
+  }
+  for (const subnet of inputs.operatorOverride) {
+    push({ subnet, origin: 'operator-override' });
+  }
+  return entries;
+}
+
+/** The registered trusted sources for one firewall. Read-only; no binding needed. */
+export function listTrustedSourcesFor(db: DbClient, firewallIp: string): TrustedSource[] {
+  return db
+    .select()
+    .from(trustedSources)
+    .where(eq(trustedSources.firewallIp, firewallIp))
+    .all()
+    .map((r) => ({
+      subnet: r.subnet,
+      description: r.description,
+      registeredBy: r.registeredBy,
+    }));
+}
+
+/** All registered trusted sources, across every firewall — for reporting. */
+export function listAllTrustedSources(db: DbClient): Array<TrustedSource & { firewallIp: string }> {
+  return db
+    .select()
+    .from(trustedSources)
+    .all()
+    .map((r) => ({
+      firewallIp: r.firewallIp,
+      subnet: r.subnet,
+      description: r.description,
+      registeredBy: r.registeredBy,
+    }));
+}

package/src/services/update/orchestrator.test.ts

@@ -82,6 +82,7 @@ const cleanAudit: AuditDeps = {
   secretsDecryptable: { results: [] },
   servicesReachable: { results: [] },
   machinesReachable: { results: [] },
+  trustedSources: { firewalls: [] },
 };
 
 describe('consumerSkipReason', () => {

package/src/templates/generator.ts

@@ -916,35 +916,12 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
     };
   }
 
-  // Execution: Store derived variables in module_configs
-  // Variables with derive_from are resolved in the context but not stored in module_configs.
-  // Store them so hooks and host_vars can access them.
-  if (manifest.variables?.owns) {
-    for (const variable of manifest.variables.owns) {
-      if (!variable.derive_from) continue;
-      const derivedValue = context.selfConfig[variable.name];
-      if (derivedValue === undefined) continue;
-
-      const existing = db
-        .select()
-        .from(moduleConfigs)
-        .where(and(eq(moduleConfigs.moduleId, moduleId), eq(moduleConfigs.key, variable.name)))
-        .get();
-
-      if (!existing) {
-        // Insert-only (not upsert) — derived values only seed on first
-        // generate; subsequent runs preserve whatever the user has set.
-        // Routes through upsertModuleConfig anyway because the helper
-        // is the only path that maintains the valueJson invariant.
-        upsertModuleConfig(
-          db,
-          moduleId,
-          variable.name,
-          derivedValue as string | number | boolean | unknown[] | Record<string, unknown>,
-        );
-      }
-    }
-  }
+  // NOTE: derived variables are NOT persisted here. `buildResolutionContext`
+  // (called above) already wrote them at variables/context.ts, so the
+  // insert-only block that used to live here could never fire — it read as a
+  // second, competing persistence policy while being unreachable. The single
+  // write lives in context.ts; see openspec/changes/derived-value-recomputation
+  // for the plan to remove it there too.
 
   // Execution: Resolve capability 'imports' variables into module_configs
   // This makes capability-derived values available in host_vars for Ansible