@celilo/console-server 0.5.0 → 0.6.0

package/spa/index.html

@@ -4,7 +4,7 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>celilo</title>
-    <script type="module" crossorigin src="/assets/index-DJJXEYrW.js"></script>
+    <script type="module" crossorigin src="/assets/index-xOtoHA1j.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-eLF_dgP-.css">
   </head>
   <body>

package/src/main.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from 'bun:test';
+import { startFromEnv } from './main';
+
+/**
+ * The console used to fall back to the bare destination `celilo-api@celilo-mgr`
+ * when CELILO_API_DEST was unset. That name resolves only on celilo-mgr itself,
+ * so on the console's own box every /api read 502'd while `celilo module health`
+ * reported VERIFIED — it drives an OIDC login and never touches the upstream.
+ * celilo#1453.
+ *
+ * A silent fallback to an unreachable default is worse than no default: it turns
+ * a missing value into a runtime symptom three layers from its cause. So the
+ * behaviour under test is the REFUSAL, not the presence of a constant.
+ */
+const OIDC_ENV = {
+  OIDC_ISSUER: 'https://auth.example.test/application/o/console/',
+  OIDC_CLIENT_ID: 'console-web',
+  OIDC_CLIENT_SECRET: 'not-a-real-secret',
+};
+
+describe('startFromEnv — the upstream destination', () => {
+  test('refuses to start when CELILO_API_DEST is unset', () => {
+    expect(() => startFromEnv({ ...OIDC_ENV })).toThrow(/CELILO_API_DEST is not set/);
+  });
+
+  test('refuses to start when CELILO_API_DEST is empty', () => {
+    expect(() => startFromEnv({ ...OIDC_ENV, CELILO_API_DEST: '' })).toThrow(
+      /CELILO_API_DEST is not set/,
+    );
+  });
+
+  test('says what a usable destination looks like, so the message is actionable', () => {
+    // An error naming only the variable sends the reader to grep. This one has to
+    // carry the shape of the answer, because the shape IS the bug: a bare
+    // hostname looks correct and resolves nowhere.
+    expect(() => startFromEnv({ ...OIDC_ENV })).toThrow(/\.infra\.<domain>/);
+  });
+});

package/src/main.ts

@@ -23,8 +23,18 @@ import { type AuthGate, type AuthSubject, serve } from './serve';
  */
 const DEFAULT_IDENTITY_FILE = '/etc/celilo-web-console/id_ed25519';
 
-/** Matches `wellspring`'s `DEFAULT_ENDPOINT`, which is the fleet's convention. */
-const DEFAULT_DEST = 'celilo-api@celilo-mgr';
+// There is deliberately no DEFAULT_DEST. It used to be `celilo-api@celilo-mgr`,
+// borrowed from wellspring's DEFAULT_ENDPOINT — a bare name that resolves only on
+// celilo-mgr itself, via its own /etc/hosts. No system in the fleet carries a DNS
+// search domain, so on the console's own box it resolved nowhere, and the server
+// fell back to it silently whenever CELILO_API_DEST was unset. The result was
+// `ssh: Could not resolve hostname celilo-mgr` twice a second and a 502 on every
+// /api read, while `celilo module health` still reported VERIFIED because it
+// drives a login and never touches the upstream. celilo#1453.
+//
+// A missing destination is a misconfiguration, so it fails loudly. The fleet's
+// real name for a system is `<hostname>.infra.<domain>`, which technitium
+// registers for every system (on-system-event.ts:120).
 
 export interface OidcGateOptions {
   /** The `iss` claim exactly — for authentik, `https://auth.<domain>/application/o/<slug>/`. */
@@ -95,12 +105,17 @@ export function oidcGate(options: OidcGateOptions): AuthGate {
 }
 
 /** Read one required value, or say which one is missing and who writes it. */
-function required(env: Record<string, string | undefined>, name: string): string {
+const OIDC_UNSET =
+  "The console refuses to serve without an identity provider — see /etc/celilo-web-console-discovered.env, which the module's install hook writes once the OIDC client exists.";
+
+function required(
+  env: Record<string, string | undefined>,
+  name: string,
+  why: string = OIDC_UNSET,
+): string {
   const value = env[name];
   if (value === undefined || value === '') {
-    throw new Error(
-      `${name} is not set. The console refuses to serve without an identity provider — see /etc/celilo-web-console-discovered.env, which the module's install hook writes once the OIDC client exists.`,
-    );
+    throw new Error(`${name} is not set. ${why}`);
   }
   return value;
 }
@@ -126,7 +141,11 @@ export function startFromEnv(env: Record<string, string | undefined> = process.e
   );
   const server = serve({
     port: Number(env.PORT ?? 8443),
-    dest: env.CELILO_API_DEST ?? DEFAULT_DEST,
+    dest: required(
+      env,
+      'CELILO_API_DEST',
+      'The console has no celilo to read through. The module writes it into /etc/celilo-web-console.env from its `api_dest` config; it must be a resolvable destination such as celilo-api@celilo-mgr.infra.<domain>, never a bare hostname.',
+    ),
     identityFile: env.CELILO_IDENTITY_FILE ?? DEFAULT_IDENTITY_FILE,
     ...(env.CONSOLE_SPA_DIR ? { spaDir: env.CONSOLE_SPA_DIR } : {}),
     authenticate: login.authenticate,

package/src/serve.ts

@@ -16,6 +16,7 @@
  */
 
 import { join } from 'node:path';
+import { API_BASE_PATH } from '@celilo/console-protocol';
 import type { ServiceType } from '@celilo/console-protocol';
 import { CALLBACK_PATH } from './oidc-login';
 import { Upstream, type UpstreamOptions, UpstreamUnavailable } from './upstream';
@@ -267,7 +268,11 @@ export function createHandler(options: ServeOptions): (request: Request) => Prom
     // bundle even with every API call refused.
     const subject = await options.authenticate(request);
     if (subject === null) {
-      if (options.login && !url.pathname.startsWith('/api/') && url.pathname !== CALLBACK_PATH) {
+      if (
+        options.login &&
+        !url.pathname.startsWith(`${API_BASE_PATH}/`) &&
+        url.pathname !== CALLBACK_PATH
+      ) {
         return options.login.redirectToLogin(request);
       }
       return new Response('Unauthorized', {
@@ -276,8 +281,8 @@ export function createHandler(options: ServeOptions): (request: Request) => Prom
       });
     }
 
-    if (url.pathname.startsWith('/api/')) {
-      const name = url.pathname.slice('/api/'.length) as ApiName;
+    if (url.pathname.startsWith(`${API_BASE_PATH}/`)) {
+      const name = url.pathname.slice(API_BASE_PATH.length + 1) as ApiName;
       if (!SERVED.includes(name)) {
         return Response.json(
           { isSucc: false, err: { message: `Unknown verb: ${name}`, type: 'ApiError' } },

package/src/verbs.ts

@@ -81,7 +81,23 @@ interface CliClosure {
   truncated: boolean;
 }
 
-/** `celilo alerts --json`, verbatim. */
+/**
+ * `celilo alerts list --json`, verbatim — which is NOT the protocol's shape.
+ *
+ * Every timestamp is `unknown` deliberately. celilo stores them as Drizzle
+ * `mode: 'timestamp'` columns, so its rows hold `Date` objects and `--json`
+ * prints ISO STRINGS, while the protocol declares epoch ms (also deliberate:
+ * ages are computed against the server's `asOf`, so a skewed browser clock
+ * cannot answer "how long has this been firing" wrongly).
+ *
+ * Typing them `number` here declared a shape nobody checked. `upstream.read<T>`
+ * is a type ASSERTION, so the strings passed through onto the wire, the
+ * browser's own protocol validation rejected the payload, and the dock rendered
+ * one word — "unavailable" — for a fleet with six firing alerts (celilo#1455).
+ * `unknown` forces every one of them through `epochMs` below, which converts and
+ * VALIDATES at the ingest boundary, so an upstream shape change fails here
+ * naming the field instead of three layers away as a single word.
+ */
 interface CliAlert {
   id: string;
   key: string;
@@ -90,18 +106,45 @@ interface CliAlert {
   monitor: string | null;
   escalationPolicy: string | null;
   escalationStep: number;
-  nextEscalationAt: number | null;
-  firstFiredAt: number;
-  lastSeenAt: number;
+  nextEscalationAt: unknown;
+  firstFiredAt: unknown;
+  lastSeenAt: unknown;
   suppressedByAlertId: string | null;
   suppressedByWindowId: string | null;
   awaitingConfirmation: boolean;
   ackedBy: string | null;
-  ackedAt: number | null;
-  silencedUntil: number | null;
+  ackedAt: unknown;
+  silencedUntil: unknown;
   message: string;
 }
 
+const ALERTS_ARGV = ['alerts', 'list', '--json'] as const;
+
+/**
+ * An upstream timestamp as epoch ms, or a `malformed` failure naming the field.
+ *
+ * Accepts both forms on purpose: epoch ms is what the protocol wants and what an
+ * older or future celilo may print directly, and an ISO string is what today's
+ * Drizzle-serialised rows carry.
+ */
+function epochMs(value: unknown, field: string): number {
+  if (typeof value === 'number' && Number.isFinite(value)) return value;
+  if (typeof value === 'string') {
+    const parsed = Date.parse(value);
+    if (!Number.isNaN(parsed)) return parsed;
+  }
+  throw new UpstreamUnavailable(
+    'malformed',
+    ALERTS_ARGV,
+    `\`celilo alerts list --json\` returned ${field}=${JSON.stringify(value)}; expected epoch ms or an ISO timestamp.`,
+  );
+}
+
+/** As `epochMs`, for a field celilo legitimately leaves unset. */
+function epochMsOrNull(value: unknown, field: string): number | null {
+  return value === null || value === undefined ? null : epochMs(value, field);
+}
+
 /** `celilo person list --json`, verbatim. */
 interface CliPerson {
   name: string;
@@ -278,17 +321,17 @@ export async function readAlerts(upstream: Upstream, moduleId?: string): Promise
         state: alertState(row.state),
         severity: severity(row.severity),
         policy: row.escalationPolicy,
-        firstFiredAt: row.firstFiredAt,
-        lastSeenAt: row.lastSeenAt,
+        firstFiredAt: epochMs(row.firstFiredAt, 'firstFiredAt'),
+        lastSeenAt: epochMs(row.lastSeenAt, 'lastSeenAt'),
         suppressedByAlertId: row.suppressedByAlertId,
         suppressedByWindowId: row.suppressedByWindowId,
-        silencedUntil: row.silencedUntil,
+        silencedUntil: epochMsOrNull(row.silencedUntil, 'silencedUntil'),
         // `alerts --json` resolves the person to a name. There is no id on the
         // wire, so the name serves as both — which is what the console shows.
         ackedBy: row.ackedBy ? { id: row.ackedBy, name: row.ackedBy } : null,
-        ackedAt: row.ackedAt,
+        ackedAt: epochMsOrNull(row.ackedAt, 'ackedAt'),
         escalationStep: row.escalationStep,
-        nextEscalationAt: row.nextEscalationAt,
+        nextEscalationAt: epochMsOrNull(row.nextEscalationAt, 'nextEscalationAt'),
       }),
     ),
   };
@@ -467,5 +510,5 @@ export async function ackAlert(
     );
   }
 
-  return { ackedAt: acked.ackedAt, ackedByName: acked.ackedBy ?? person };
+  return { ackedAt: epochMs(acked.ackedAt, 'ackedAt'), ackedByName: acked.ackedBy ?? person };
 }