@cloudbase/manager-node 5.7.1-beta.1 → 5.8.0-beta.0

package/lib/deploy/function/cam-preflight.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = void 0;
+exports.isCamPermissionError = isCamPermissionError;
+exports.runImagePullAuthPreflight = runImagePullAuthPreflight;
+const types_1 = require("../types");
+/**
+ * 镜像拉取授权 Preflight（涉及 CAM，scope: cloud）
+ *
+ * SCF 拉取镜像由服务角色 SCF_QcsRole 代理，个人版镜像要求该角色绑定
+ * QcloudAccessForSCFRoleInPullImage 策略。本模块在 image 策略部署前：
+ *   1. 探测该角色与策略是否就绪；
+ *   2. 缺失且允许时，自动绑定「唯一白名单策略」补齐（绝不放大到其它策略）；
+ *   3. 当前身份无 CAM 权限时不硬失败，降级为结构化指引 + 一键授权链接兜底。
+ *
+ * 安全边界（对应 security_rules 的 AuthZ / 最小权限）：
+ * - 自动授权只允许绑定 REQUIRED_IMAGE_PULL_POLICY 这一条部署必需的预置策略；
+ * - 不代用户创建角色、不绑定任何白名单外策略；
+ * - 探测/授权失败一律走降级，不阻断到无法给出可操作指引。
+ */
+/** SCF 拉取镜像使用的服务角色 */
+exports.SCF_PULL_IMAGE_ROLE = 'SCF_QcsRole';
+/** 拉取个人版镜像所需的唯一预置策略（自动授权白名单，仅此一条） */
+exports.REQUIRED_IMAGE_PULL_POLICY = 'QcloudAccessForSCFRoleInPullImage';
+/** 官方一键授权链接，作为无 CAM 权限时的兜底指引 */
+exports.IMAGE_PULL_GRANT_URL = 'https://console.cloud.tencent.com/cam/role/grant' +
+    `?roleName=${exports.SCF_PULL_IMAGE_ROLE}&policyName=${exports.REQUIRED_IMAGE_PULL_POLICY}` +
+    '&principal=eyJzZXJ2aWNlIjoic2NmLnFjbG91ZC5jb20ifQ%3D%3D';
+/** 判断错误是否为 CAM 权限不足 */
+function isCamPermissionError(error) {
+    const code = typeof (error === null || error === void 0 ? void 0 : error.code) === 'string' ? error.code : '';
+    const message = typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' ? error.message : '';
+    const haystack = `${code} ${message}`.toLowerCase();
+    return (haystack.includes('unauthorizedoperation') ||
+        haystack.includes('no permission') ||
+        haystack.includes('not authorized') ||
+        haystack.includes('cam_unauthorized'));
+}
+/** 判断错误是否为角色不存在 */
+function isRoleNotFoundError(error) {
+    const code = typeof (error === null || error === void 0 ? void 0 : error.code) === 'string' ? error.code : '';
+    const message = typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' ? error.message : '';
+    const haystack = `${code} ${message}`.toLowerCase();
+    return haystack.includes('notfound') || haystack.includes('not exist') || haystack.includes('rolenotexist');
+}
+function pass(id, summary) {
+    return { id, status: 'pass', summary };
+}
+function warn(id, summary, remediation) {
+    return { id, status: 'warn', summary, remediation };
+}
+function fail(id, summary, options = {}) {
+    return { id, status: 'fail', summary, remediation: options.remediation, detail: options.detail };
+}
+function buildReport(checks) {
+    return {
+        scope: 'cloud',
+        strategy: 'image',
+        ready: !checks.some(item => item.status === 'fail'),
+        checks
+    };
+}
+/** 是否需要执行镜像拉取授权检查 */
+function needsImagePullAuth(config) {
+    var _a;
+    if (config.type !== 'HTTP') {
+        return false;
+    }
+    // image：已有个人版镜像；local：本地构建推送的也是个人版镜像，SCF 拉取同样需要该授权
+    if (config.buildStrategy === 'image') {
+        // 联合类型已按 buildStrategy 收窄为 INormalizedHttpImageConfig，可直接访问顶层与 imageConfig 字段
+        const imageType = ((_a = config.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) || config.imageType;
+        return imageType === 'personal';
+    }
+    if (config.buildStrategy === 'local' || config.buildStrategy === 'cloud') {
+        // local/cloud 个人版先行：构建推送的默认是个人版镜像，SCF 拉取同样需要该授权；
+        // 未显式指定 imageType 时视为 personal；企业版另行处理
+        const imageType = config.imageType;
+        return imageType === undefined || imageType === 'personal';
+    }
+    return false;
+}
+/** 无 CAM 读权限时的降级检查项：无法自查，转手动指引 */
+function unverifiableCheck() {
+    return warn(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_AUTH_UNVERIFIABLE, `当前身份无 CAM 权限，无法自动校验或补齐 ${exports.SCF_PULL_IMAGE_ROLE} 的拉镜像授权`, `若个人版镜像拉取失败，请用具备 CAM 权限的账号访问一键授权链接完成授权：${exports.IMAGE_PULL_GRANT_URL}`);
+}
+/**
+ * 执行镜像拉取授权 Preflight
+ *
+ * @param service CAM 能力适配（无则视为无法校验，直接降级为提示）
+ * @param config 规范化部署配置
+ * @param autoGrant 是否允许自动补齐授权（默认 true）
+ * @returns scope 为 cloud 的检查报告，聚合全部结论
+ */
+async function runImagePullAuthPreflight(service, config, autoGrant = true) {
+    if (!needsImagePullAuth(config)) {
+        return buildReport([]);
+    }
+    // 无 CAM 适配能力：不阻断，仅提示手动授权入口
+    if (!service) {
+        return buildReport([unverifiableCheck()]);
+    }
+    const checks = [];
+    let roleDetail;
+    try {
+        roleDetail = await service.getRoleWithPolicies(exports.SCF_PULL_IMAGE_ROLE);
+    }
+    catch (error) {
+        if (isCamPermissionError(error)) {
+            // 无 CAM 读权限，无法自查，降级为提示（warn，不阻断部署尝试）
+            return buildReport([unverifiableCheck()]);
+        }
+        if (isRoleNotFoundError(error)) {
+            // 角色不存在属于真实前置缺失，不自动创建角色，给出可操作指引
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_ROLE_MISSING, `缺少服务角色 ${exports.SCF_PULL_IMAGE_ROLE}`, {
+                remediation: `请访问一键授权链接创建角色并授予拉镜像策略：${exports.IMAGE_PULL_GRANT_URL}`
+            }));
+            return buildReport(checks);
+        }
+        // 其它未知错误同样降级为提示，避免因 CAM 波动阻断部署
+        return buildReport([unverifiableCheck()]);
+    }
+    const attached = roleDetail.attachedPolicyNames || [];
+    if (attached.includes(exports.REQUIRED_IMAGE_PULL_POLICY)) {
+        checks.push(pass(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_POLICY_MISSING, `${exports.SCF_PULL_IMAGE_ROLE} 已具备拉镜像策略 ${exports.REQUIRED_IMAGE_PULL_POLICY}`));
+        return buildReport(checks);
+    }
+    // 未绑定拉镜像策略
+    if (!autoGrant) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_POLICY_MISSING, `${exports.SCF_PULL_IMAGE_ROLE} 缺少拉镜像策略 ${exports.REQUIRED_IMAGE_PULL_POLICY}`, {
+            remediation: `已关闭自动授权（autoGrant=false）。请访问一键授权链接手动授予：${exports.IMAGE_PULL_GRANT_URL}`
+        }));
+        return buildReport(checks);
+    }
+    // 自动授权：只绑定唯一白名单策略
+    try {
+        await service.attachPolicyByName(exports.SCF_PULL_IMAGE_ROLE, exports.REQUIRED_IMAGE_PULL_POLICY);
+        checks.push(pass(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_AUTH_GRANTED, `已自动为 ${exports.SCF_PULL_IMAGE_ROLE} 绑定拉镜像策略 ${exports.REQUIRED_IMAGE_PULL_POLICY}`));
+        return buildReport(checks);
+    }
+    catch (error) {
+        if (isCamPermissionError(error)) {
+            // 无 CAM 写权限：不硬失败，降级为可操作指引 + 兜底链接
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_CAM_PERMISSION_DENIED, `当前身份无 CAM 授权权限，无法自动为 ${exports.SCF_PULL_IMAGE_ROLE} 补齐拉镜像策略`, {
+                remediation: `请用具备 CAM 权限的账号（如主账号）访问一键授权链接完成授权：${exports.IMAGE_PULL_GRANT_URL}`,
+                detail: error === null || error === void 0 ? void 0 : error.message
+            }));
+            return buildReport(checks);
+        }
+        // 其它授权错误同样给出结构化失败与指引
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_POLICY_MISSING, `自动绑定拉镜像策略 ${exports.REQUIRED_IMAGE_PULL_POLICY} 失败`, {
+            remediation: `请访问一键授权链接手动授予：${exports.IMAGE_PULL_GRANT_URL}`,
+            detail: error === null || error === void 0 ? void 0 : error.message
+        }));
+        return buildReport(checks);
+    }
+}

package/lib/deploy/function/cloud-build-service.js

@@ -0,0 +1,191 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCloudBuildService = createCloudBuildService;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const error_1 = require("../../error");
+const utils_1 = require("../../utils");
+const http_request_1 = require("../../utils/http-request");
+const types_1 = require("../types");
+/**
+ * 基于 CloudAppService 的云端构建能力适配器
+ *
+ * 将 CloudApp custom 构建相关的 API/IO 逐一映射为 CloudImageBuilder 所需的
+ * ICloudBuildService 接口，使builder 与具体传输/网络实现解耦、便于测试替换。
+ *
+ * 步骤对应构建方案「阶段 A」（https://iwiki.woa.com/p/4020519533）：
+ * - packContext：打包源码目录为临时 ZIP（复用 compressToZip）
+ * - getCosInfo：DescribeCloudAppCosInfo（DeployType:custom）取上传凭证与UnixTimestamp
+ * - uploadZip：PUT 上传到 COS，携带服务端返回的全部 UploadHeaders
+ * - createBuild：CreateCloudApp（DeployType:custom）触发容器内 build+push
+ * - getVersionStatus：DescribeCloudAppVersion 查询分步状态与产物
+ */
+const CUSTOM_DEPLOY_TYPE = 'custom';
+const CUSTOM_BUILD_TYPE = 'zip';
+/** 云端构建打包默认忽略项，避免上传无关文件或本地环境密钥 */
+const DEFAULT_IGNORE = [
+    'node_modules/**',
+    '.venv/**',
+    '**/.venv/**',
+    'venv/**',
+    '**/venv/**',
+    '__pycache__/**',
+    '**/__pycache__/**',
+    '*.pyc',
+    '**/*.pyc',
+    '.pytest_cache/**',
+    '**/.pytest_cache/**',
+    '.mypy_cache/**',
+    '**/.mypy_cache/**',
+    '.ruff_cache/**',
+    '**/.ruff_cache/**',
+    '.coverage',
+    '**/.coverage',
+    'htmlcov/**',
+    '**/htmlcov/**',
+    '.git/**',
+    '.DS_Store',
+    '**/.DS_Store',
+    '**/.env',
+    // 保留 .env.example/.env.sample/.env.template，其余 .env.* 默认视为本地环境密钥
+    '**/.env.!(example|sample|template)'
+];
+/**
+ * 由CloudAppService 构造 ICloudBuildService实现
+ */
+function createCloudBuildService(cloudApp, options = {}) {
+    const ignore = [...DEFAULT_IGNORE, ...(options.ignore || [])];
+    return {
+        async packContext(cwd, extraEntries) {
+            if (!fs_1.default.existsSync(cwd) || !fs_1.default.statSync(cwd).isDirectory()) {
+                throw new error_1.CloudBaseError(`构建上下文目录不存在或不是目录：${cwd}`, {
+                    code: types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID
+                });
+            }
+            const zipPath = path_1.default.join(os_1.default.tmpdir(), `fn-cloud-build-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`);
+            const injectedEntries = (extraEntries || []).map(entry => ({
+                zipPath: entry.zipPath.replace(/\\/g, '/').replace(/^\.\//, ''),
+                content: entry.content,
+                mode: entry.mode
+            }));
+            // 源码中若存在与 SDK 注入文件同名的路径，必须从 glob 中排除，
+            // 避免 ZIP 出现重复 entry 后由解压顺序决定最终执行内容。
+            const contextIgnore = [
+                ...ignore,
+                ...injectedEntries.map(entry => entry.zipPath)
+            ];
+            // 把 SDK 注入的辅助文件（如 push 脚本）随源码一起打进zip，
+            // 通过临时文件注入，绝不写入用户源码目录。
+            try {
+                await (0, utils_1.compressToZip)({
+                    dirPath: cwd,
+                    outputPath: zipPath,
+                    ignore: contextIgnore,
+                    extraEntries: injectedEntries
+                });
+            }
+            catch (error) {
+                try {
+                    if (fs_1.default.existsSync(zipPath)) {
+                        fs_1.default.unlinkSync(zipPath);
+                    }
+                }
+                catch (_a) {
+                    // 清理未完成的临时 ZIP 失败不覆盖原始打包错误
+                }
+                const original = error instanceof Error ? error : new Error(String(error));
+                throw new error_1.CloudBaseError(`打包云端构建上下文失败：${original.message}`, {
+                    code: types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID,
+                    original
+                });
+            }
+            return zipPath;
+        },
+        async getCosInfo(serviceName) {
+            const res = await cloudApp.describeCosInfo({
+                deployType: CUSTOM_DEPLOY_TYPE,
+                serviceName,
+                suffix: '.zip'
+            });
+            return {
+                uploadUrl: res.UploadUrl,
+                uploadHeaders: (res.UploadHeaders || []).map(h => ({
+                    key: h.Key,
+                    value: h.Value
+                })),
+                unixTimestamp: res.UnixTimestamp
+            };
+        },
+        async uploadZip(cosInfo, zipPath) {
+            const zipSize = fs_1.default.statSync(zipPath).size;
+            // 必须携带服务端返回的全部 UploadHeaders，缺失会导致 COS 鉴权失败
+            const headers = {
+                'Content-Type': 'application/zip',
+                'Content-Length': String(zipSize)
+            };
+            for (const h of cosInfo.uploadHeaders) {
+                headers[h.key] = h.value;
+            }
+            const response = await (0, http_request_1.fetchStream)(cosInfo.uploadUrl, {
+                method: 'PUT',
+                body: fs_1.default.createReadStream(zipPath),
+                headers
+            });
+            if (!response.ok) {
+                let detail = '';
+                try {
+                    const text = await response.text();
+                    detail = text ? ` - ${text.substring(0, 500)}` : '';
+                }
+                catch (_a) {
+                    // 解析响应体失败不影响主错误抛出
+                }
+                throw new error_1.CloudBaseError(`上传源码到 COS 失败：${response.status} ${response.statusText}${detail}`, { code: types_1.FUNCTION_DEPLOY_ERROR.CLOUD_UPLOAD_FAILED });
+            }
+        },
+        async createBuild(input) {
+            const res = await cloudApp.createApp({
+                deployType: CUSTOM_DEPLOY_TYPE,
+                serviceName: input.serviceName,
+                buildType: CUSTOM_BUILD_TYPE,
+                source: {
+                    type: CUSTOM_BUILD_TYPE,
+                    // 原样回填 DescribeCloudAppCosInfo 返回的时间戳，指向刚上传的源码包
+                    cosTimestamp: input.cosTimestamp,
+                    cosSuffix: '.zip'
+                },
+                env: input.env,
+                secrets: input.secrets,
+                customSteps: input.customSteps
+            });
+            return { buildId: res.BuildId, versionName: res.VersionName, requestId: res.RequestId };
+        },
+        async getVersionStatus(serviceName, versionName) {
+            const res = await cloudApp.describeAppVersion({
+                deployType: CUSTOM_DEPLOY_TYPE,
+                serviceName,
+                versionName
+            });
+            return {
+                status: res.Status,
+                steps: res.Steps,
+                artifacts: res.Artifacts,
+                requestId: res.RequestId
+            };
+        },
+        async cleanup(zipPath) {
+            if (zipPath && fs_1.default.existsSync(zipPath)) {
+                fs_1.default.unlinkSync(zipPath);
+            }
+        },
+        delay(ms) {
+            return new Promise(resolve => {
+                setTimeout(resolve, ms);
+            });
+        }
+    };
+}