@celilo/cli 0.27.0 → 1.0.0

package/src/services/trusted-sources.test.ts

@@ -40,27 +40,63 @@ describe('trusted-source store', () => {
 
   it('stamps registeredBy from the binding, not the caller', () => {
     const store = buildTrustedSourceStore(db, 'wireguard');
-    store.add(FW, { subnet: VPN, description: 'admin VPN clients' });
+    store.replace(FW, { subnets: [VPN], description: 'admin VPN clients' });
 
     expect(store.list(FW)).toEqual([
       { subnet: VPN, description: 'admin VPN clients', registeredBy: 'wireguard' },
     ]);
   });
 
-  it('upserts by subnet — registering twice yields one row', () => {
+  it('replace is idempotent — declaring the same set twice yields one row', () => {
     const store = buildTrustedSourceStore(db, 'wireguard');
-    store.add(FW, { subnet: VPN, description: 'first' });
-    store.add(FW, { subnet: VPN, description: 'second' });
+    store.replace(FW, { subnets: [VPN], description: 'first' });
+    store.replace(FW, { subnets: [VPN], description: 'second' });
 
     expect(store.list(FW)).toHaveLength(1);
     expect(store.list(FW)[0].description).toBe('second');
   });
 
-  it('removes by subnet and leaves other firewalls alone', () => {
-    buildTrustedSourceStore(db, 'wireguard').add(FW, { subnet: VPN, description: 'vpn' });
-    buildTrustedSourceStore(db, 'other').add('10.0.0.1', { subnet: VPN, description: 'elsewhere' });
+  // D5b: the set is DECLARED, so changing an admin VPN's client subnet revokes
+  // the old one's reach. It used to keep reaching every zone forever.
+  it('a subnet left out of a later declaration loses its reach', () => {
+    const store = buildTrustedSourceStore(db, 'wireguard');
+    store.replace(FW, { subnets: [VPN, '10.9.9.0/24'], description: 'vpn' });
+    store.replace(FW, { subnets: [VPN], description: 'vpn' });
 
-    buildTrustedSourceStore(db, 'wireguard').remove(FW, VPN);
+    expect(store.list(FW).map((s) => s.subnet)).toEqual([VPN]);
+  });
+
+  it('an empty declaration withdraws the consumer’s whole set', () => {
+    const store = buildTrustedSourceStore(db, 'wireguard');
+    store.replace(FW, { subnets: [VPN], description: 'vpn' });
+    store.replace(FW, { subnets: [], description: 'vpn' });
+
+    expect(store.list(FW)).toEqual([]);
+  });
+
+  // D5a, the refcount case: the owner is in the unique index, so two modules
+  // trusting the same subnet are two rows and one withdrawing does not revoke
+  // the other's reach.
+  it('two consumers trusting the same subnet are two rows; one withdrawing leaves the other', () => {
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [VPN], description: 'vpn' });
+    buildTrustedSourceStore(db, 'other').replace(FW, { subnets: [VPN], description: 'also vpn' });
+    expect(listTrustedSourcesFor(db, FW)).toHaveLength(2);
+
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [], description: 'vpn' });
+
+    expect(listTrustedSourcesFor(db, FW)).toEqual([
+      { subnet: VPN, description: 'also vpn', registeredBy: 'other' },
+    ]);
+  });
+
+  it('withdrawing on one firewall leaves other firewalls alone', () => {
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [VPN], description: 'vpn' });
+    buildTrustedSourceStore(db, 'other').replace('10.0.0.1', {
+      subnets: [VPN],
+      description: 'elsewhere',
+    });
+
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [], description: 'vpn' });
 
     expect(buildTrustedSourceStore(db, 'wireguard').list(FW)).toEqual([]);
     expect(buildTrustedSourceStore(db, 'other').list('10.0.0.1')).toHaveLength(1);
@@ -69,9 +105,9 @@ describe('trusted-source store', () => {
   it('reads one firewall’s registrations without a module binding', () => {
     // Trust registered against one firewall is not trust granted by another —
     // the read is scoped, and the reader needs no identity to look.
-    buildTrustedSourceStore(db, 'wireguard').add(FW, { subnet: VPN, description: 'vpn' });
-    buildTrustedSourceStore(db, 'other').add('10.0.0.1', {
-      subnet: '172.16.9.0/24',
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [VPN], description: 'vpn' });
+    buildTrustedSourceStore(db, 'other').replace('10.0.0.1', {
+      subnets: ['172.16.9.0/24'],
       description: 'elsewhere',
     });
 
@@ -80,7 +116,7 @@ describe('trusted-source store', () => {
   });
 
   it('reports every registration across firewalls, with who registered it', () => {
-    buildTrustedSourceStore(db, 'wireguard').add(FW, { subnet: VPN, description: 'vpn' });
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [VPN], description: 'vpn' });
 
     expect(listAllTrustedSources(db)).toEqual([
       { firewallIp: FW, subnet: VPN, description: 'vpn', registeredBy: 'wireguard' },
@@ -104,7 +140,10 @@ describe('the render input excludes registrations; the reporting view includes t
     process.env.CELILO_DB_PATH = dbPath;
     db = await setupTestDatabase(dbPath);
     db.insert(systemConfig).values({ key: 'network.internal.subnet', value: CONTROL_PLANE }).run();
-    buildTrustedSourceStore(db, 'wireguard').add(FW, { subnet: VPN, description: 'admin VPN' });
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, {
+      subnets: [VPN],
+      description: 'admin VPN',
+    });
   });
   afterEach(() => {
     db.$client.close();

package/src/services/trusted-sources.ts

@@ -38,31 +38,41 @@ export function buildTrustedSourceStore(db: DbClient, registeredBy: string): Tru
         }));
     },
 
-    add(firewallIp: string, source: RegisterTrustedSourceRequest): void {
-      // Idempotent upsert on (firewall, subnet) — matches buildPortForwardStore.
+    replace(firewallIp: string, source: RegisterTrustedSourceRequest): void {
+      // The consumer's COMPLETE set for this firewall (D5b), scoped to its own
+      // rows: a subnet it trusted before and omits now loses its reach, and a
+      // subnet another module also trusts keeps it. Changing an admin VPN's
+      // client subnet used to leave the old one reaching every zone forever.
       db.delete(trustedSources)
         .where(
-          and(eq(trustedSources.firewallIp, firewallIp), eq(trustedSources.subnet, source.subnet)),
+          and(
+            eq(trustedSources.firewallIp, firewallIp),
+            eq(trustedSources.registeredBy, registeredBy),
+          ),
         )
         .run();
-      db.insert(trustedSources)
-        .values({
-          firewallIp,
-          subnet: source.subnet,
-          description: source.description,
-          registeredBy,
-        })
-        .run();
-    },
 
-    remove(firewallIp: string, subnet: string): void {
-      db.delete(trustedSources)
-        .where(and(eq(trustedSources.firewallIp, firewallIp), eq(trustedSources.subnet, subnet)))
+      if (source.subnets.length === 0) return;
+
+      db.insert(trustedSources)
+        .values(
+          source.subnets.map((subnet) => ({
+            firewallIp,
+            subnet,
+            description: source.description,
+            registeredBy,
+          })),
+        )
         .run();
     },
   };
 }
 
+/** Drop every trusted source a departing module owns, across every firewall. */
+export function deleteTrustedSourcesForModule(db: DbClient, moduleId: string): void {
+  db.delete(trustedSources).where(eq(trustedSources.registeredBy, moduleId)).run();
+}
+
 /** Where a trusted subnet came from — reach into every tier must be attributable. */
 export type TrustedSubnetOrigin = 'derived-control-plane' | 'registered' | 'operator-override';
 

package/src/test-utils/cli-context.ts

@@ -351,9 +351,22 @@ export class CLIContext {
       new Promise<CommandResponse>((resolve, reject) => {
         this.pendingResponses.set(id, { resolve, reject });
       }),
-      // Timeout promise
+      // Timeout promise. Name the command and the actual elapsed time, not
+      // just the budget — a bare "timed out after 30000ms" reads as a hang
+      // in the command under test, indistinguishable from a real deploy
+      // defect. `Date.now() - startTime` at fire time is normally ~= timeout,
+      // but under CI load the event loop can be too busy to run this
+      // callback promptly, so a MUCH larger elapsed-than-budget is itself a
+      // load signal, not a fluke to explain away (celilo#804).
       new Promise<CommandResponse>((_, reject) =>
-        setTimeout(() => reject(new Error(`Command timed out after ${timeout}ms`)), timeout),
+        setTimeout(() => {
+          const elapsed = Date.now() - startTime;
+          reject(
+            new Error(
+              `Command #${id} "${command}" timed out after ${timeout}ms (elapsed ${elapsed}ms)`,
+            ),
+          );
+        }, timeout),
       ),
     ]);
 

package/src/services/web-route-cleanup.test.ts

@@ -1,250 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import type { RunResult, Runner } from '@celilo/capabilities';
-import { eq } from 'drizzle-orm';
-import type { DbClient } from '../db/client';
-import { capabilities, moduleConfigs, modules, webRoutes } from '../db/schema';
-import { setupTestDatabase } from '../test-utils/setup-test-db';
-import type { RouteReconcileWaitResult } from './celilo-events';
-import { cleanupWebRoutesForModule } from './web-route-cleanup';
-
-const CADDY_IP = '10.0.10.10';
-
-const CLEAN_RECONCILE: RouteReconcileWaitResult = {
-  events: 1,
-  succeeded: 1,
-  failed: 0,
-  timedOut: false,
-  noDispatcher: false,
-};
-
-function createRecordingRunner(result: Partial<RunResult> = {}): Runner & { calls: string[] } {
-  const calls: string[] = [];
-  const runner = ((cmd: string) => {
-    calls.push(cmd);
-    return { ok: true, stdout: '', stderr: '', ...result } as RunResult;
-  }) as Runner & { calls: string[] };
-  runner.calls = calls;
-  return runner;
-}
-
-describe('cleanupWebRoutesForModule', () => {
-  let dir: string;
-  let db: DbClient;
-
-  async function seedModule(id: string): Promise<void> {
-    db.insert(modules)
-      .values({
-        id,
-        name: id,
-        version: '1.0.0',
-        manifestData: {},
-        sourcePath: `/tmp/${id}`,
-      })
-      .run();
-  }
-
-  async function seedCaddyProvider(): Promise<void> {
-    await seedModule('caddy');
-    db.insert(capabilities)
-      .values({ moduleId: 'caddy', capabilityName: 'public_web', version: '3.0.0', data: {} })
-      .run();
-    db.insert(moduleConfigs)
-      .values({
-        moduleId: 'caddy',
-        key: 'target_ip',
-        value: `${CADDY_IP}/24`,
-        valueJson: JSON.stringify(`${CADDY_IP}/24`),
-      })
-      .run();
-  }
-
-  function seedRoute(
-    moduleId: string,
-    slug: string,
-    path: string,
-    type: 'static' | 'reverse_proxy',
-  ) {
-    db.insert(webRoutes)
-      .values({
-        slug,
-        moduleId,
-        type,
-        path,
-        hostname: 'iamtheinternet.org',
-        targetHost: type === 'reverse_proxy' ? '10.0.20.5' : null,
-        targetPort: type === 'reverse_proxy' ? 8080 : null,
-      })
-      .run();
-  }
-
-  beforeEach(async () => {
-    dir = mkdtempSync(join(tmpdir(), 'wrc-'));
-    const dbPath = join(dir, 'celilo.db');
-    process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
-  });
-
-  afterEach(() => {
-    db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch {
-      /* ignore */
-    }
-  });
-
-  test('deletes routes, reclaims the asset root, and emits the reconcile', async () => {
-    await seedCaddyProvider();
-    await seedModule('hello-foo');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-
-    const run = createRecordingRunner();
-    let emittedFor: string | undefined;
-
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'hello-foo',
-      db,
-      run,
-      emitAndWait: async (triggeredBy) => {
-        emittedFor = triggeredBy;
-        return CLEAN_RECONCILE;
-      },
-    });
-
-    expect(result.routesRemoved).toBe(1);
-    expect(result.assetDirsRemoved).toEqual(['/srv/www/foo']);
-    expect(result.warnings).toEqual([]);
-    expect(emittedFor).toBe('hello-foo');
-
-    expect(run.calls).toHaveLength(1);
-    expect(run.calls[0]).toContain(`root@${CADDY_IP}`);
-    expect(run.calls[0]).toContain('rm -rf');
-    expect(run.calls[0]).toContain('/srv/www/foo');
-
-    const remaining = db.select().from(webRoutes).where(eq(webRoutes.moduleId, 'hello-foo')).all();
-    expect(remaining).toHaveLength(0);
-  });
-
-  test('leaves other modules routes alone', async () => {
-    await seedCaddyProvider();
-    await seedModule('hello-foo');
-    await seedModule('hello-bar');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-    seedRoute('hello-bar', 'bar', '/bar', 'static');
-
-    const run = createRecordingRunner();
-    await cleanupWebRoutesForModule({
-      moduleId: 'hello-foo',
-      db,
-      run,
-      emitAndWait: async () => CLEAN_RECONCILE,
-    });
-
-    const survivors = db.select().from(webRoutes).all();
-    expect(survivors.map((r) => r.moduleId)).toEqual(['hello-bar']);
-    // Only /srv/www/foo is touched — the sibling's asset root must survive.
-    expect(run.calls.join('\n')).not.toContain('/srv/www/bar');
-  });
-
-  test('no-ops when the module owns no routes (its on_uninstall already ran)', async () => {
-    await seedCaddyProvider();
-    await seedModule('celilo-website');
-
-    const run = createRecordingRunner();
-    let emitted = false;
-
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'celilo-website',
-      db,
-      run,
-      emitAndWait: async () => {
-        emitted = true;
-        return CLEAN_RECONCILE;
-      },
-    });
-
-    expect(result).toEqual({ routesRemoved: 0, assetDirsRemoved: [], warnings: [] });
-    expect(run.calls).toHaveLength(0);
-    // No redundant reconcile on every module removal.
-    expect(emitted).toBe(false);
-  });
-
-  test('skips the remote rm for reverse-proxy routes (no assets on the host)', async () => {
-    await seedCaddyProvider();
-    await seedModule('forgejo');
-    seedRoute('forgejo', 'forgejo', '/git', 'reverse_proxy');
-
-    const run = createRecordingRunner();
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'forgejo',
-      db,
-      run,
-      emitAndWait: async () => CLEAN_RECONCILE,
-    });
-
-    expect(result.routesRemoved).toBe(1);
-    expect(run.calls).toHaveLength(0);
-  });
-
-  test('still deletes routes when the asset rm fails', async () => {
-    await seedCaddyProvider();
-    await seedModule('hello-foo');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-
-    const run = createRecordingRunner({ ok: false, stderr: 'host unreachable' });
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'hello-foo',
-      db,
-      run,
-      emitAndWait: async () => CLEAN_RECONCILE,
-    });
-
-    expect(result.routesRemoved).toBe(1);
-    expect(result.assetDirsRemoved).toEqual([]);
-    expect(result.warnings.join(' ')).toMatch(/Failed to remove \/srv\/www\/foo/);
-    expect(db.select().from(webRoutes).all()).toHaveLength(0);
-  });
-
-  test('warns when no provider is deployed to clean assets from', async () => {
-    await seedModule('hello-foo');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-
-    const run = createRecordingRunner();
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'hello-foo',
-      db,
-      run,
-      emitAndWait: async () => CLEAN_RECONCILE,
-    });
-
-    expect(result.routesRemoved).toBe(1);
-    expect(run.calls).toHaveLength(0);
-    expect(result.warnings.join(' ')).toMatch(/No public_web provider host found/);
-  });
-
-  test('warns — but does not throw — when the provider never reconciles', async () => {
-    await seedCaddyProvider();
-    await seedModule('hello-foo');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'hello-foo',
-      db,
-      run: createRecordingRunner(),
-      emitAndWait: async () => ({
-        events: 1,
-        succeeded: 0,
-        failed: 0,
-        timedOut: false,
-        noDispatcher: true,
-      }),
-    });
-
-    expect(result.routesRemoved).toBe(1);
-    expect(result.warnings.join(' ')).toMatch(/no event dispatcher is running/);
-  });
-});

package/src/services/web-route-cleanup.ts

@@ -1,144 +0,0 @@
-/**
- * Route cleanup on module removal — the consumer half of ISS-0035.
- *
- * `register_route` / `unregister_routes` emit `public_web.routes_changed`, and
- * the provider's `reconcile_routes` subscription re-renders its config from
- * `web_routes`. But `unregister_routes` is only reachable from a module's own
- * `on_uninstall` teardown script, and most consumers don't define one —
- * celilo-website, celilo-registry, celilo-apt-repo and celilo-mgmt all publish
- * a site and have no teardown. For those, `module remove` deleted the route
- * rows through the FK cascade on `modules.id` and emitted NOTHING, so the
- * provider never learned the route was gone: the rendered Caddyfile kept a site
- * block for a module that no longer exists, and `/srv/www/<slug>` was orphaned.
- *
- * The fix lives here rather than in each module's teardown script for the usual
- * reason: one call site in `performModuleRemove` covers every consumer and
- * can't be forgotten by the next one. Modules that DO define an `on_uninstall`
- * calling `unregister_routes` still win — their hook runs first and this
- * becomes a no-op (zero owned routes).
- *
- * Everything here is best-effort. A failed asset `rm` or an undelivered
- * reconcile is reported as a warning, never a thrown error: a stuck provider is
- * no reason to strand a module in a half-removed state.
- */
-
-import { execRunner, runAppCommand, shellEscape } from '@celilo/capabilities';
-import type { Runner } from '@celilo/capabilities';
-import { eq } from 'drizzle-orm';
-import type { DbClient } from '../db/client';
-import { capabilities, webRoutes } from '../db/schema';
-import { loadHookConfigMap } from '../hooks/load-hook-config';
-import { emitWebRoutesChangedAndWait } from './celilo-events';
-
-export interface WebRouteCleanupResult {
-  routesRemoved: number;
-  /** Asset roots actually deleted from the provider host. */
-  assetDirsRemoved: string[];
-  /** Non-fatal problems, for the caller to log. Never thrown. */
-  warnings: string[];
-}
-
-export interface WebRouteCleanupDeps {
-  moduleId: string;
-  db: DbClient;
-  /** Injectable remote runner — tests pass a mock. */
-  run?: Runner;
-  /** Injectable event emit + wait — tests pass a stub. */
-  emitAndWait?: typeof emitWebRoutesChangedAndWait;
-}
-
-/**
- * The provider host that owns `/srv/www` — the same `config.target_ip` the
- * public_web capability uses for its asset uploads.
- */
-async function resolvePublicWebHostIp(db: DbClient): Promise<string | undefined> {
-  const providers = db
-    .select()
-    .from(capabilities)
-    .where(eq(capabilities.capabilityName, 'public_web'))
-    .all();
-  const provider = providers[0];
-  if (!provider) return undefined;
-
-  const config = await loadHookConfigMap(provider.moduleId, db);
-  // target_ip may carry a CIDR suffix; the capability strips it the same way.
-  return String(config.target_ip ?? '').split('/')[0] || undefined;
-}
-
-/**
- * Delete a module's web routes, reclaim its static asset roots, and tell the
- * provider to reconcile. Returns counts + warnings; never throws.
- */
-export async function cleanupWebRoutesForModule(
-  deps: WebRouteCleanupDeps,
-): Promise<WebRouteCleanupResult> {
-  const { moduleId, db, run = execRunner, emitAndWait = emitWebRoutesChangedAndWait } = deps;
-
-  const owned = db.select().from(webRoutes).where(eq(webRoutes.moduleId, moduleId)).all();
-  if (owned.length === 0) {
-    // Either the module never registered a route, or its own on_uninstall
-    // already called unregister_routes (which emitted and reconciled). Nothing
-    // to do — and importantly, no event, so we don't trigger a redundant
-    // reconcile on every module removal.
-    return { routesRemoved: 0, assetDirsRemoved: [], warnings: [] };
-  }
-
-  const warnings: string[] = [];
-  const assetDirsRemoved: string[] = [];
-
-  const staticSlugs = owned.filter((r) => r.type === 'static').map((r) => r.slug);
-  if (staticSlugs.length > 0) {
-    const providerIp = await resolvePublicWebHostIp(db);
-    if (!providerIp) {
-      warnings.push(
-        `No public_web provider host found — left ${staticSlugs.length} asset dir(s) in /srv/www on disk`,
-      );
-    } else {
-      for (const slug of staticSlugs) {
-        const dir = `/srv/www/${slug}`;
-        // escape-hatch: reclaiming a consumer's static web root on the provider
-        // host. No capability owns asset-root teardown, and it is neither
-        // desired-state nor a service action.
-        const result = runAppCommand(
-          { ipv4_address: providerIp },
-          `rm -rf ${shellEscape(dir)}`,
-          run,
-          { timeoutMs: 30_000 },
-        );
-        if (result.ok) {
-          assetDirsRemoved.push(dir);
-        } else {
-          warnings.push(
-            `Failed to remove ${dir} on ${providerIp} (continuing): ${result.stderr || result.stdout || 'unknown'}`,
-          );
-        }
-      }
-    }
-  }
-
-  db.delete(webRoutes).where(eq(webRoutes.moduleId, moduleId)).run();
-
-  // Same signal a consumer's own unregister_routes emits. Unlike the deploy
-  // path (ISS-0081), an undelivered reconcile here is a warning, not a
-  // failure — removal must complete regardless.
-  const reconcile = await emitAndWait(moduleId);
-  if (reconcile.noDispatcher) {
-    warnings.push(
-      `Routes for ${moduleId} were deleted but no event dispatcher is running, so the public_web provider has not reconciled — it is still serving the removed route(s) until its next reconcile.`,
-    );
-  } else if (reconcile.timedOut) {
-    warnings.push(
-      `public_web provider did not confirm the route removal within the deadline (${reconcile.succeeded} ok, ${reconcile.failed} failed of ${reconcile.events} event(s)).`,
-    );
-  } else if (reconcile.failed > 0) {
-    warnings.push(
-      `public_web provider failed to apply the route removal (${reconcile.failed} delivery failure(s)) — it may still be serving the removed route(s).`,
-    );
-  } else if (reconcile.events > 0 && reconcile.succeeded === 0) {
-    warnings.push(
-      `Routes for ${moduleId} were deleted but NO provider reconciled — the provider has no reconcile_routes subscription, so the removed route(s) may still be served.`,
-    );
-  }
-
-  return { routesRemoved: owned.length, assetDirsRemoved, warnings };
-}