@celilo/cli 0.27.0 → 1.1.0

package/src/services/web-route-cleanup.test.ts

@@ -1,250 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import type { RunResult, Runner } from '@celilo/capabilities';
-import { eq } from 'drizzle-orm';
-import type { DbClient } from '../db/client';
-import { capabilities, moduleConfigs, modules, webRoutes } from '../db/schema';
-import { setupTestDatabase } from '../test-utils/setup-test-db';
-import type { RouteReconcileWaitResult } from './celilo-events';
-import { cleanupWebRoutesForModule } from './web-route-cleanup';
-
-const CADDY_IP = '10.0.10.10';
-
-const CLEAN_RECONCILE: RouteReconcileWaitResult = {
-  events: 1,
-  succeeded: 1,
-  failed: 0,
-  timedOut: false,
-  noDispatcher: false,
-};
-
-function createRecordingRunner(result: Partial<RunResult> = {}): Runner & { calls: string[] } {
-  const calls: string[] = [];
-  const runner = ((cmd: string) => {
-    calls.push(cmd);
-    return { ok: true, stdout: '', stderr: '', ...result } as RunResult;
-  }) as Runner & { calls: string[] };
-  runner.calls = calls;
-  return runner;
-}
-
-describe('cleanupWebRoutesForModule', () => {
-  let dir: string;
-  let db: DbClient;
-
-  async function seedModule(id: string): Promise<void> {
-    db.insert(modules)
-      .values({
-        id,
-        name: id,
-        version: '1.0.0',
-        manifestData: {},
-        sourcePath: `/tmp/${id}`,
-      })
-      .run();
-  }
-
-  async function seedCaddyProvider(): Promise<void> {
-    await seedModule('caddy');
-    db.insert(capabilities)
-      .values({ moduleId: 'caddy', capabilityName: 'public_web', version: '3.0.0', data: {} })
-      .run();
-    db.insert(moduleConfigs)
-      .values({
-        moduleId: 'caddy',
-        key: 'target_ip',
-        value: `${CADDY_IP}/24`,
-        valueJson: JSON.stringify(`${CADDY_IP}/24`),
-      })
-      .run();
-  }
-
-  function seedRoute(
-    moduleId: string,
-    slug: string,
-    path: string,
-    type: 'static' | 'reverse_proxy',
-  ) {
-    db.insert(webRoutes)
-      .values({
-        slug,
-        moduleId,
-        type,
-        path,
-        hostname: 'iamtheinternet.org',
-        targetHost: type === 'reverse_proxy' ? '10.0.20.5' : null,
-        targetPort: type === 'reverse_proxy' ? 8080 : null,
-      })
-      .run();
-  }
-
-  beforeEach(async () => {
-    dir = mkdtempSync(join(tmpdir(), 'wrc-'));
-    const dbPath = join(dir, 'celilo.db');
-    process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
-  });
-
-  afterEach(() => {
-    db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch {
-      /* ignore */
-    }
-  });
-
-  test('deletes routes, reclaims the asset root, and emits the reconcile', async () => {
-    await seedCaddyProvider();
-    await seedModule('hello-foo');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-
-    const run = createRecordingRunner();
-    let emittedFor: string | undefined;
-
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'hello-foo',
-      db,
-      run,
-      emitAndWait: async (triggeredBy) => {
-        emittedFor = triggeredBy;
-        return CLEAN_RECONCILE;
-      },
-    });
-
-    expect(result.routesRemoved).toBe(1);
-    expect(result.assetDirsRemoved).toEqual(['/srv/www/foo']);
-    expect(result.warnings).toEqual([]);
-    expect(emittedFor).toBe('hello-foo');
-
-    expect(run.calls).toHaveLength(1);
-    expect(run.calls[0]).toContain(`root@${CADDY_IP}`);
-    expect(run.calls[0]).toContain('rm -rf');
-    expect(run.calls[0]).toContain('/srv/www/foo');
-
-    const remaining = db.select().from(webRoutes).where(eq(webRoutes.moduleId, 'hello-foo')).all();
-    expect(remaining).toHaveLength(0);
-  });
-
-  test('leaves other modules routes alone', async () => {
-    await seedCaddyProvider();
-    await seedModule('hello-foo');
-    await seedModule('hello-bar');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-    seedRoute('hello-bar', 'bar', '/bar', 'static');
-
-    const run = createRecordingRunner();
-    await cleanupWebRoutesForModule({
-      moduleId: 'hello-foo',
-      db,
-      run,
-      emitAndWait: async () => CLEAN_RECONCILE,
-    });
-
-    const survivors = db.select().from(webRoutes).all();
-    expect(survivors.map((r) => r.moduleId)).toEqual(['hello-bar']);
-    // Only /srv/www/foo is touched — the sibling's asset root must survive.
-    expect(run.calls.join('\n')).not.toContain('/srv/www/bar');
-  });
-
-  test('no-ops when the module owns no routes (its on_uninstall already ran)', async () => {
-    await seedCaddyProvider();
-    await seedModule('celilo-website');
-
-    const run = createRecordingRunner();
-    let emitted = false;
-
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'celilo-website',
-      db,
-      run,
-      emitAndWait: async () => {
-        emitted = true;
-        return CLEAN_RECONCILE;
-      },
-    });
-
-    expect(result).toEqual({ routesRemoved: 0, assetDirsRemoved: [], warnings: [] });
-    expect(run.calls).toHaveLength(0);
-    // No redundant reconcile on every module removal.
-    expect(emitted).toBe(false);
-  });
-
-  test('skips the remote rm for reverse-proxy routes (no assets on the host)', async () => {
-    await seedCaddyProvider();
-    await seedModule('forgejo');
-    seedRoute('forgejo', 'forgejo', '/git', 'reverse_proxy');
-
-    const run = createRecordingRunner();
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'forgejo',
-      db,
-      run,
-      emitAndWait: async () => CLEAN_RECONCILE,
-    });
-
-    expect(result.routesRemoved).toBe(1);
-    expect(run.calls).toHaveLength(0);
-  });
-
-  test('still deletes routes when the asset rm fails', async () => {
-    await seedCaddyProvider();
-    await seedModule('hello-foo');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-
-    const run = createRecordingRunner({ ok: false, stderr: 'host unreachable' });
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'hello-foo',
-      db,
-      run,
-      emitAndWait: async () => CLEAN_RECONCILE,
-    });
-
-    expect(result.routesRemoved).toBe(1);
-    expect(result.assetDirsRemoved).toEqual([]);
-    expect(result.warnings.join(' ')).toMatch(/Failed to remove \/srv\/www\/foo/);
-    expect(db.select().from(webRoutes).all()).toHaveLength(0);
-  });
-
-  test('warns when no provider is deployed to clean assets from', async () => {
-    await seedModule('hello-foo');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-
-    const run = createRecordingRunner();
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'hello-foo',
-      db,
-      run,
-      emitAndWait: async () => CLEAN_RECONCILE,
-    });
-
-    expect(result.routesRemoved).toBe(1);
-    expect(run.calls).toHaveLength(0);
-    expect(result.warnings.join(' ')).toMatch(/No public_web provider host found/);
-  });
-
-  test('warns — but does not throw — when the provider never reconciles', async () => {
-    await seedCaddyProvider();
-    await seedModule('hello-foo');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-
-    const result = await cleanupWebRoutesForModule({
-      moduleId: 'hello-foo',
-      db,
-      run: createRecordingRunner(),
-      emitAndWait: async () => ({
-        events: 1,
-        succeeded: 0,
-        failed: 0,
-        timedOut: false,
-        noDispatcher: true,
-      }),
-    });
-
-    expect(result.routesRemoved).toBe(1);
-    expect(result.warnings.join(' ')).toMatch(/no event dispatcher is running/);
-  });
-});

package/src/services/web-route-cleanup.ts

@@ -1,144 +0,0 @@
-/**
- * Route cleanup on module removal — the consumer half of ISS-0035.
- *
- * `register_route` / `unregister_routes` emit `public_web.routes_changed`, and
- * the provider's `reconcile_routes` subscription re-renders its config from
- * `web_routes`. But `unregister_routes` is only reachable from a module's own
- * `on_uninstall` teardown script, and most consumers don't define one —
- * celilo-website, celilo-registry, celilo-apt-repo and celilo-mgmt all publish
- * a site and have no teardown. For those, `module remove` deleted the route
- * rows through the FK cascade on `modules.id` and emitted NOTHING, so the
- * provider never learned the route was gone: the rendered Caddyfile kept a site
- * block for a module that no longer exists, and `/srv/www/<slug>` was orphaned.
- *
- * The fix lives here rather than in each module's teardown script for the usual
- * reason: one call site in `performModuleRemove` covers every consumer and
- * can't be forgotten by the next one. Modules that DO define an `on_uninstall`
- * calling `unregister_routes` still win — their hook runs first and this
- * becomes a no-op (zero owned routes).
- *
- * Everything here is best-effort. A failed asset `rm` or an undelivered
- * reconcile is reported as a warning, never a thrown error: a stuck provider is
- * no reason to strand a module in a half-removed state.
- */
-
-import { execRunner, runAppCommand, shellEscape } from '@celilo/capabilities';
-import type { Runner } from '@celilo/capabilities';
-import { eq } from 'drizzle-orm';
-import type { DbClient } from '../db/client';
-import { capabilities, webRoutes } from '../db/schema';
-import { loadHookConfigMap } from '../hooks/load-hook-config';
-import { emitWebRoutesChangedAndWait } from './celilo-events';
-
-export interface WebRouteCleanupResult {
-  routesRemoved: number;
-  /** Asset roots actually deleted from the provider host. */
-  assetDirsRemoved: string[];
-  /** Non-fatal problems, for the caller to log. Never thrown. */
-  warnings: string[];
-}
-
-export interface WebRouteCleanupDeps {
-  moduleId: string;
-  db: DbClient;
-  /** Injectable remote runner — tests pass a mock. */
-  run?: Runner;
-  /** Injectable event emit + wait — tests pass a stub. */
-  emitAndWait?: typeof emitWebRoutesChangedAndWait;
-}
-
-/**
- * The provider host that owns `/srv/www` — the same `config.target_ip` the
- * public_web capability uses for its asset uploads.
- */
-async function resolvePublicWebHostIp(db: DbClient): Promise<string | undefined> {
-  const providers = db
-    .select()
-    .from(capabilities)
-    .where(eq(capabilities.capabilityName, 'public_web'))
-    .all();
-  const provider = providers[0];
-  if (!provider) return undefined;
-
-  const config = await loadHookConfigMap(provider.moduleId, db);
-  // target_ip may carry a CIDR suffix; the capability strips it the same way.
-  return String(config.target_ip ?? '').split('/')[0] || undefined;
-}
-
-/**
- * Delete a module's web routes, reclaim its static asset roots, and tell the
- * provider to reconcile. Returns counts + warnings; never throws.
- */
-export async function cleanupWebRoutesForModule(
-  deps: WebRouteCleanupDeps,
-): Promise<WebRouteCleanupResult> {
-  const { moduleId, db, run = execRunner, emitAndWait = emitWebRoutesChangedAndWait } = deps;
-
-  const owned = db.select().from(webRoutes).where(eq(webRoutes.moduleId, moduleId)).all();
-  if (owned.length === 0) {
-    // Either the module never registered a route, or its own on_uninstall
-    // already called unregister_routes (which emitted and reconciled). Nothing
-    // to do — and importantly, no event, so we don't trigger a redundant
-    // reconcile on every module removal.
-    return { routesRemoved: 0, assetDirsRemoved: [], warnings: [] };
-  }
-
-  const warnings: string[] = [];
-  const assetDirsRemoved: string[] = [];
-
-  const staticSlugs = owned.filter((r) => r.type === 'static').map((r) => r.slug);
-  if (staticSlugs.length > 0) {
-    const providerIp = await resolvePublicWebHostIp(db);
-    if (!providerIp) {
-      warnings.push(
-        `No public_web provider host found — left ${staticSlugs.length} asset dir(s) in /srv/www on disk`,
-      );
-    } else {
-      for (const slug of staticSlugs) {
-        const dir = `/srv/www/${slug}`;
-        // escape-hatch: reclaiming a consumer's static web root on the provider
-        // host. No capability owns asset-root teardown, and it is neither
-        // desired-state nor a service action.
-        const result = runAppCommand(
-          { ipv4_address: providerIp },
-          `rm -rf ${shellEscape(dir)}`,
-          run,
-          { timeoutMs: 30_000 },
-        );
-        if (result.ok) {
-          assetDirsRemoved.push(dir);
-        } else {
-          warnings.push(
-            `Failed to remove ${dir} on ${providerIp} (continuing): ${result.stderr || result.stdout || 'unknown'}`,
-          );
-        }
-      }
-    }
-  }
-
-  db.delete(webRoutes).where(eq(webRoutes.moduleId, moduleId)).run();
-
-  // Same signal a consumer's own unregister_routes emits. Unlike the deploy
-  // path (ISS-0081), an undelivered reconcile here is a warning, not a
-  // failure — removal must complete regardless.
-  const reconcile = await emitAndWait(moduleId);
-  if (reconcile.noDispatcher) {
-    warnings.push(
-      `Routes for ${moduleId} were deleted but no event dispatcher is running, so the public_web provider has not reconciled — it is still serving the removed route(s) until its next reconcile.`,
-    );
-  } else if (reconcile.timedOut) {
-    warnings.push(
-      `public_web provider did not confirm the route removal within the deadline (${reconcile.succeeded} ok, ${reconcile.failed} failed of ${reconcile.events} event(s)).`,
-    );
-  } else if (reconcile.failed > 0) {
-    warnings.push(
-      `public_web provider failed to apply the route removal (${reconcile.failed} delivery failure(s)) — it may still be serving the removed route(s).`,
-    );
-  } else if (reconcile.events > 0 && reconcile.succeeded === 0) {
-    warnings.push(
-      `Routes for ${moduleId} were deleted but NO provider reconciled — the provider has no reconcile_routes subscription, so the removed route(s) may still be served.`,
-    );
-  }
-
-  return { routesRemoved: owned.length, assetDirsRemoved, warnings };
-}