@cloud-cli/on 1.59.0 → 1.60.0

package/README.md

@@ -174,18 +174,21 @@ npx @cloud-cli/on [command] [options]
 | ---- | ------------ | --------------------- | ---------------------- | ------------------------------------------------ |
 | `-h` | `--help`     | —                     | -                      | Prints CLI help message and exits.               |
 | `-c` | `--config`   | `./runner.config.mjs` | `RUNNER_CONFIG_FILE`   | Path to JavaScript configuration file.           |
-| `-d` | `--database` | -                     | `RUNNER_DATABASE_URL`  | SQLite database file path or HTTP URL.           |
+| `-d` | `--database` | -                     | `DATABASE_URL`        | Node.js ES module URL exporting the database API. |
 | `-p` | `--port`     | `11235`               | `PORT`                 | Port for the Ingress HTTP server.                |
 | `-k` | `--workers`  | `5`                   | `RUNNER_WORKERS`       | Maximum concurrent jobs on this node.            |
 |      |              |                       | `RUNNER_ADMIN_SECRET`  | Admin token to refresh secrets via API           |
 |      |              |                       | `RUNNER_WORKER_SECRET` | Worker token for job events and secret retrieval |
+|      |              |                       | `RUNNER_OIDC_PROVIDER_URL` | OIDC issuer URL, for example `https://auth.api.apphor.de` |
+|      |              |                       | `RUNNER_OIDC_CLIENT_ID` | Registered OIDC client identifier                 |
+|      |              |                       | `RUNNER_OIDC_CLIENT_SECRET` | Registered OIDC client secret                 |
 |      |              |                       | `RUNNER_SERVER_URL`    | Webhook server URL used by workers.              |
 |      |              |                       | `RUNNER_TAGS`          | Comma-separated worker capability tags.          |
 |      |              |                       | `RUNNER_VAPID_PUBLIC_KEY`  | Public key for background Web Push notifications. |
 |      |              |                       | `RUNNER_VAPID_PRIVATE_KEY` | Private key for background Web Push notifications. |
 |      |              |                       | `RUNNER_VAPID_SUBJECT`      | VAPID contact, such as `mailto:admin@example.com`. |
 
-Set `RUNNER_ADMIN_SECRET` only on the HTTP server for dashboard and management APIs. Set the same non-empty `RUNNER_WORKER_SECRET` on the server and every worker to publish job-status refresh events and retrieve job-scoped secrets. The dashboard workflow APIs accept either Bearer authentication or HTTP Basic authentication with username `admin` and the admin secret.
+Set `RUNNER_ADMIN_SECRET` only on the HTTP server for dashboard and management APIs. Set the same non-empty `RUNNER_WORKER_SECRET` on the server and every worker to publish job-status refresh events and retrieve job-scoped secrets. When the three `RUNNER_OIDC_*` values are configured, `/auth/login` enables browser sign-in, the browser uses the same bearer-token API path as external consumers, authenticated users can read logs, and the API token settings page issues and revokes scoped tokens through the OIDC provider. Register `https://your-runner-host/auth/callback` as the OIDC redirect URI. The dashboard workflow APIs accept either Bearer authentication or HTTP Basic authentication with username `admin` and the admin secret.
 
 ### Secrets
 
@@ -312,12 +315,12 @@ The Ingress Gateway listens for incoming HTTP requests and serves the live web U
    AST evaluation explicitly blocks access to dangerous JS properties (`constructor`, `__proto__`, `prototype`).
 3. **Payload Size Guard:**
    The Ingress server enforces a strict 5MB payload limit to prevent Out-Of-Memory (OOM) denial-of-service attacks.
-4. **Single-operator API authentication:**
-   Workflow validation, publishing, secret management, and job details require `RUNNER_ADMIN_SECRET` over HTTPS. Workers use the separate `RUNNER_WORKER_SECRET` only for lifecycle events and secrets of jobs they have claimed.
+4. **Scoped API authentication:**
+   Workflow validation, publishing, and secret management require `RUNNER_ADMIN_SECRET` over HTTPS. OIDC sessions and provider-issued scoped tokens can read job logs when granted `logs:read`. Workers use the separate `RUNNER_WORKER_SECRET` only for lifecycle events and secrets of jobs they have claimed.
 
 ## systemd Deployment
 
-Install the unit files from `systemd/` and create root-owned environment files in `/etc/on/`: `server.env` for `RUNNER_DATABASE_URL`, `RUNNER_SERVER_URL`, `RUNNER_ADMIN_SECRET`, and `RUNNER_WORKER_SECRET`; `scheduler.env` for `RUNNER_DATABASE_URL`; and `worker.env` for `RUNNER_DATABASE_URL`, `RUNNER_SERVER_URL`, `RUNNER_WORKER_SECRET`, `RUNNER_TAGS`, and `RUNNER_TMP`. Workers receive only `RUNNER_WORKER_SECRET`; the admin secret stays on the HTTP server. The supplied units run as root because the systemd execution driver creates transient system services. Use `systemctl edit` for per-machine overrides.
+Install the unit files from `systemd/` and create root-owned environment files in `/etc/on/`: `server.env` for `DATABASE_URL`, `RUNNER_SERVER_URL`, `RUNNER_ADMIN_SECRET`, `RUNNER_WORKER_SECRET`, and the three `RUNNER_OIDC_*` values; `scheduler.env` for `DATABASE_URL`; and `worker.env` for `DATABASE_URL`, `RUNNER_SERVER_URL`, `RUNNER_WORKER_SECRET`, `RUNNER_TAGS`, and `RUNNER_TMP`. Workers receive only `RUNNER_WORKER_SECRET`; the admin and OIDC secrets stay on the HTTP server. The supplied units run as root because the systemd execution driver creates transient system services. Use `systemctl edit` for per-machine overrides.
 
 Place the server master key in `/etc/on/credentials/on-master-key` with root-only permissions. `runner-server.service` exposes it privately through systemd's credentials directory. Start the primary control plane with `systemctl enable --now runner.target`; enable `runner-worker.service` separately on worker machines. Use `systemctl edit runner-worker.service` for machine-specific labels and paths.
 

package/dist/config.d.ts

@@ -1,4 +1,4 @@
-import { RunnerConfig, UserRunnerConfig } from './types.js';
+import type { RunnerConfig, UserRunnerConfig } from './types.js';
 export declare function loadConfig(values: any): Promise<RunnerConfig | null>;
 export declare function resolveConfig(configFromFile: UserRunnerConfig, configFromCli: UserRunnerConfig): RunnerConfig;
 export declare function printHelp(): void;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG5D,wBAAsB,UAAU,CAAC,MAAM,KAAA,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAmBrE;AAED,wBAAgB,aAAa,CAAC,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,GAAG,YAAY,CAyB7G;AAED,wBAAgB,SAAS,SAsBxB;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAuB9F"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGjE,wBAAsB,UAAU,CAAC,MAAM,KAAA,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAuBrE;AAED,wBAAgB,aAAa,CAAC,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,GAAG,YAAY,CAkC7G;AAED,wBAAgB,SAAS,SAuBxB;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAuB9F"}

package/dist/db-client-BvMkK1lx.js

@@ -0,0 +1,8 @@
+//#region src/db-client.ts
+var e = process.env.DATABASE_URL;
+if (!e) throw Error("DATABASE_URL is required");
+var t = await import(e), n = t.default || t;
+if (!n || typeof n.get != "function" || typeof n.run != "function" || typeof n.all != "function" || typeof n.exec != "function") throw Error(`Database module ${e} does not expose get, run, all, and exec`);
+n.get.bind(n), n.run.bind(n), n.all.bind(n), n.exec.bind(n), typeof n.pragma == "function" && n.pragma.bind(n), typeof n.transaction == "function" && n.transaction.bind(n), typeof n.schema == "function" && n.schema.bind(n), typeof n.clone == "function" && n.clone.bind(n);
+//#endregion
+export { n as t };

package/dist/db-client.d.ts

@@ -1,17 +1,11 @@
-declare function query(method: 'get' | 'run' | 'all' | 'exec', statement: string, data?: Array<string | number | null>, pragma?: string[]): Promise<any>;
-export declare const get: (statement: string, data?: (string | number | null)[] | undefined, pragma?: string[] | undefined) => Promise<any>;
-export declare const run: (statement: string, data?: (string | number | null)[] | undefined, pragma?: string[] | undefined) => Promise<any>;
-export declare const all: (statement: string, data?: (string | number | null)[] | undefined, pragma?: string[] | undefined) => Promise<any>;
-export declare const exec: (statement: string, data?: (string | number | null)[] | undefined, pragma?: string[] | undefined) => Promise<any>;
-export declare function pragma(p: any): void;
-declare const _default: {
-    query: typeof query;
-    get: (statement: string, data?: (string | number | null)[] | undefined, pragma?: string[] | undefined) => Promise<any>;
-    run: (statement: string, data?: (string | number | null)[] | undefined, pragma?: string[] | undefined) => Promise<any>;
-    all: (statement: string, data?: (string | number | null)[] | undefined, pragma?: string[] | undefined) => Promise<any>;
-    exec: (statement: string, data?: (string | number | null)[] | undefined, pragma?: string[] | undefined) => Promise<any>;
-    pragma: typeof pragma;
-};
-export default _default;
-export declare function setUrl(u: any): void;
+declare const db: any;
+export declare const get: any;
+export declare const run: any;
+export declare const all: any;
+export declare const exec: any;
+export declare const pragma: any;
+export declare const transaction: any;
+export declare const schema: any;
+export declare const clone: any;
+export default db;
 //# sourceMappingURL=db-client.d.ts.map

package/dist/db-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-client.d.ts","sourceRoot":"","sources":["../src/db-client.ts"],"names":[],"mappings":"AAGA,iBAAe,KAAK,CAClB,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,EACtC,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EACpC,MAAM,WAAU,gBA8BjB;AAED,eAAO,MAAM,GAAG,mHAA0B,CAAC;AAC3C,eAAO,MAAM,GAAG,mHAA0B,CAAC;AAC3C,eAAO,MAAM,GAAG,mHAA0B,CAAC;AAC3C,eAAO,MAAM,IAAI,mHAA2B,CAAC;AAE7C,wBAAgB,MAAM,CAAC,CAAC,KAAA,QAIvB;;;;;;;;;AAED,wBAAsD;AAEtD,wBAAgB,MAAM,CAAC,CAAC,KAAA,QAEvB"}
+{"version":3,"file":"db-client.d.ts","sourceRoot":"","sources":["../src/db-client.ts"],"names":[],"mappings":"AAKA,QAAA,MAAM,EAAE,KAA2B,CAAC;AAMpC,eAAO,MAAM,GAAG,KAAkB,CAAC;AACnC,eAAO,MAAM,GAAG,KAAkB,CAAC;AACnC,eAAO,MAAM,GAAG,KAAkB,CAAC;AACnC,eAAO,MAAM,IAAI,KAAmB,CAAC;AACrC,eAAO,MAAM,MAAM,KAAyE,CAAC;AAC7F,eAAO,MAAM,WAAW,KAA6E,CAAC;AACtG,eAAO,MAAM,MAAM,KAAmE,CAAC;AACvF,eAAO,MAAM,KAAK,KAAiE,CAAC;AAEpF,eAAe,EAAE,CAAC"}

package/dist/events-BoODn7MY.js

@@ -0,0 +1,56 @@
+//#region src/events.ts
+var e = class {
+	clients = /* @__PURE__ */ new Map();
+	nextId = 1;
+	maxClients = 1e3;
+	subscribe(e, t) {
+		if (this.clients.size >= this.maxClients) {
+			t.writeHead(503, {
+				"Content-Type": "application/json",
+				"Retry-After": "5"
+			}), t.end(JSON.stringify({ error: "Too many event stream clients" }));
+			return;
+		}
+		t.writeHead(200, {
+			"Cache-Control": "no-cache, no-transform",
+			Connection: "keep-alive",
+			"Content-Type": "text/event-stream",
+			"X-Accel-Buffering": "no"
+		}), t.write("retry: 2000\n\n");
+		let n = setInterval(() => t.write(": heartbeat\n\n"), 3e4);
+		n.unref(), this.clients.set(t, n), e.once("close", () => {
+			clearInterval(n), this.clients.delete(t);
+		});
+	}
+	publish(e, t = {}) {
+		let n = `id: ${this.nextId++}\nevent: ${e}\ndata: ${JSON.stringify(t)}\n\n`;
+		for (let [e, t] of this.clients) e.write(n) || (clearInterval(t), this.clients.delete(e), e.end());
+	}
+	close() {
+		for (let [e, t] of this.clients) clearInterval(t), e.end();
+		this.clients.clear();
+	}
+};
+async function t(e, t, n, r) {
+	let i = await fetch(new URL("/api/events", e), {
+		headers: { Accept: "text/event-stream" },
+		signal: t
+	});
+	if (!i.ok || !i.body) throw Error(`Event stream failed with HTTP ${i.status}`);
+	r?.();
+	let a = new TextDecoder(), o = "";
+	for await (let e of i.body) {
+		o += a.decode(e, { stream: !0 }).replaceAll("\r\n", "\n");
+		let t = o.indexOf("\n\n");
+		for (; t !== -1;) {
+			let e = o.slice(0, t);
+			o = o.slice(t + 2), t = o.indexOf("\n\n");
+			let r = e.match(/^event: (.+)$/m)?.[1];
+			if (!r) continue;
+			let i = e.match(/^data: (.*)$/m)?.[1];
+			n(r, i ? JSON.parse(i) : {});
+		}
+	}
+}
+//#endregion
+export { t as n, e as t };

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAWA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC"}