@cloudbase/manager-node 5.7.1-beta.1 → 5.8.0-beta.1

package/lib/deploy/function/cam-preflight.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TCR_PUSH_GRANT_URL = exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_TCR_PUSH_POLICY = exports.TCB_PUSH_ENTERPRISE_IMAGE_ROLE = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = void 0;
+exports.isCamPermissionError = isCamPermissionError;
+exports.runImagePullAuthPreflight = runImagePullAuthPreflight;
+const types_1 = require("../types");
+/**
+ * 镜像仓库授权 Preflight（涉及 CAM，scope: cloud）
+ *
+ * 镜像部署涉及两个职责不同的服务角色：
+ * - SCF_QcsRole：SCF 从个人版或企业版 TCR 拉取镜像；
+ * - TCB_QcsRole：CloudApp 云端构建向企业版 TCR 推送镜像。
+ *
+ * 本模块在部署前探测所需角色与策略；缺失且允许时，只自动绑定各场景明确列入
+ * 白名单的预置策略；当前身份无 CAM 权限时，则返回结构化指引和一键授权链接。
+ * 模块不会创建角色，也不会绑定白名单之外的策略。
+ */
+/** SCF 拉取镜像使用的服务角色 */
+exports.SCF_PULL_IMAGE_ROLE = 'SCF_QcsRole';
+/** SCF 拉取个人版或企业版 TCR 镜像所需的预置策略 */
+exports.REQUIRED_IMAGE_PULL_POLICY = 'QcloudAccessForSCFRoleInPullImage';
+/** CloudApp 云端构建向企业版 TCR 推送镜像使用的服务角色 */
+exports.TCB_PUSH_ENTERPRISE_IMAGE_ROLE = 'TCB_QcsRole';
+/** CloudApp 云端构建向企业版 TCR 推送镜像所需的预置策略 */
+exports.REQUIRED_TCR_PUSH_POLICY = 'QcloudAccessForTCBRoleInTCR';
+/** SCF 拉取镜像的一键授权链接 */
+exports.IMAGE_PULL_GRANT_URL = 'https://console.cloud.tencent.com/cam/role/grant' +
+    `?roleName=${exports.SCF_PULL_IMAGE_ROLE}&policyName=${exports.REQUIRED_IMAGE_PULL_POLICY}` +
+    '&principal=eyJzZXJ2aWNlIjoic2NmLnFjbG91ZC5jb20ifQ%3D%3D';
+/** 企业版 TCR 云端构建推送的一键授权链接 */
+exports.TCR_PUSH_GRANT_URL = 'https://console.cloud.tencent.com/cam/role/grant' +
+    `?roleName=${exports.TCB_PUSH_ENTERPRISE_IMAGE_ROLE}&policyName=${exports.REQUIRED_TCR_PUSH_POLICY}` +
+    '&principal=eyJzZXJ2aWNlIjoidGNiLmNsb3VkLnRlbmNlbnQuY29tIn0%3D';
+/** 判断错误是否为 CAM 权限不足 */
+function isCamPermissionError(error) {
+    const code = typeof (error === null || error === void 0 ? void 0 : error.code) === 'string' ? error.code : '';
+    const message = typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' ? error.message : '';
+    const haystack = `${code} ${message}`.toLowerCase();
+    return (haystack.includes('unauthorizedoperation') ||
+        haystack.includes('no permission') ||
+        haystack.includes('not authorized') ||
+        haystack.includes('cam_unauthorized'));
+}
+/** 判断错误是否为角色不存在 */
+function isRoleNotFoundError(error) {
+    const code = typeof (error === null || error === void 0 ? void 0 : error.code) === 'string' ? error.code : '';
+    const message = typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' ? error.message : '';
+    const haystack = `${code} ${message}`.toLowerCase();
+    return haystack.includes('notfound') || haystack.includes('not exist') || haystack.includes('rolenotexist');
+}
+function pass(id, summary) {
+    return { id, status: 'pass', summary };
+}
+function warn(id, summary, remediation) {
+    return { id, status: 'warn', summary, remediation };
+}
+function fail(id, summary, options = {}) {
+    return { id, status: 'fail', summary, remediation: options.remediation, detail: options.detail };
+}
+function buildReport(checks) {
+    return {
+        scope: 'cloud',
+        strategy: 'image',
+        ready: !checks.some(item => item.status === 'fail'),
+        checks
+    };
+}
+/** image/local/cloud 最终都需要 SCF 从镜像仓库拉取镜像 */
+function needsImagePullAuth(config) {
+    return (config.type === 'HTTP' &&
+        (config.buildStrategy === 'image' ||
+            config.buildStrategy === 'local' ||
+            config.buildStrategy === 'cloud'));
+}
+/** 只有企业版 cloud 策略需要 CloudApp 向企业版 TCR 推送镜像 */
+function needsEnterpriseTcrPushAuth(config) {
+    return (config.type === 'HTTP' &&
+        config.buildStrategy === 'cloud' &&
+        config.imageType === 'enterprise');
+}
+function resolveRequirements(config) {
+    const requirements = [];
+    if (needsImagePullAuth(config)) {
+        requirements.push({
+            roleName: exports.SCF_PULL_IMAGE_ROLE,
+            policyName: exports.REQUIRED_IMAGE_PULL_POLICY,
+            purpose: 'SCF 拉取 TCR 镜像',
+            grantUrl: exports.IMAGE_PULL_GRANT_URL,
+            roleMissingCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_ROLE_MISSING,
+            policyMissingCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_POLICY_MISSING,
+            grantedCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_AUTH_GRANTED,
+            unverifiableCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_AUTH_UNVERIFIABLE
+        });
+    }
+    if (needsEnterpriseTcrPushAuth(config)) {
+        requirements.push({
+            roleName: exports.TCB_PUSH_ENTERPRISE_IMAGE_ROLE,
+            policyName: exports.REQUIRED_TCR_PUSH_POLICY,
+            purpose: 'CloudApp 云端构建推送企业版 TCR 镜像',
+            grantUrl: exports.TCR_PUSH_GRANT_URL,
+            roleMissingCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_TCR_PUSH_ROLE_MISSING,
+            policyMissingCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_TCR_PUSH_POLICY_MISSING,
+            grantedCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_TCR_PUSH_AUTH_GRANTED,
+            unverifiableCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_TCR_PUSH_AUTH_UNVERIFIABLE
+        });
+    }
+    return requirements;
+}
+function unverifiableCheck(requirement) {
+    return warn(requirement.unverifiableCode, `当前身份无 CAM 权限，无法自动校验或补齐 ${requirement.roleName} 的${requirement.purpose}授权`, `若部署失败，请用具备 CAM 权限的账号访问一键授权链接完成授权：${requirement.grantUrl}`);
+}
+async function checkRequirement(service, requirement, autoGrant) {
+    if (!service) {
+        return unverifiableCheck(requirement);
+    }
+    let roleDetail;
+    try {
+        roleDetail = await service.getRoleWithPolicies(requirement.roleName);
+    }
+    catch (error) {
+        if (isCamPermissionError(error)) {
+            return unverifiableCheck(requirement);
+        }
+        if (isRoleNotFoundError(error)) {
+            return fail(requirement.roleMissingCode, `缺少服务角色 ${requirement.roleName}`, {
+                remediation: `请访问一键授权链接创建角色并授予 ${requirement.policyName}：${requirement.grantUrl}`
+            });
+        }
+        return unverifiableCheck(requirement);
+    }
+    const attached = roleDetail.attachedPolicyNames || [];
+    if (attached.includes(requirement.policyName)) {
+        return pass(requirement.policyMissingCode, `${requirement.roleName} 已具备${requirement.purpose}策略 ${requirement.policyName}`);
+    }
+    if (!autoGrant) {
+        return fail(requirement.policyMissingCode, `${requirement.roleName} 缺少${requirement.purpose}策略 ${requirement.policyName}`, {
+            remediation: `已关闭自动授权（autoGrant=false）。请访问一键授权链接手动授予：${requirement.grantUrl}`
+        });
+    }
+    try {
+        await service.attachPolicyByName(requirement.roleName, requirement.policyName);
+        return pass(requirement.grantedCode, `已自动为 ${requirement.roleName} 绑定${requirement.purpose}策略 ${requirement.policyName}`);
+    }
+    catch (error) {
+        if (isCamPermissionError(error)) {
+            return fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_CAM_PERMISSION_DENIED, `当前身份无 CAM 授权权限，无法自动为 ${requirement.roleName} 补齐${requirement.purpose}策略`, {
+                remediation: `请用具备 CAM 权限的账号（如主账号）访问一键授权链接完成授权：${requirement.grantUrl}`,
+                detail: error === null || error === void 0 ? void 0 : error.message
+            });
+        }
+        return fail(requirement.policyMissingCode, `自动绑定策略 ${requirement.policyName} 失败`, {
+            remediation: `请访问一键授权链接手动授予：${requirement.grantUrl}`,
+            detail: error === null || error === void 0 ? void 0 : error.message
+        });
+    }
+}
+/**
+ * 执行镜像仓库授权 Preflight。
+ *
+ * 企业版 cloud 策略会同时检查 SCF 拉取权限和 TCB 云端构建推送权限；
+ * 其他镜像策略只检查与自身相关的授权，不会额外要求 TCB 推送权限。
+ */
+async function runImagePullAuthPreflight(service, config, autoGrant = true) {
+    const requirements = resolveRequirements(config);
+    if (requirements.length === 0) {
+        return buildReport([]);
+    }
+    const checks = [];
+    for (const requirement of requirements) {
+        checks.push(await checkRequirement(service, requirement, autoGrant));
+    }
+    return buildReport(checks);
+}

package/lib/deploy/function/cloud-build-service.js

@@ -0,0 +1,191 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCloudBuildService = createCloudBuildService;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const error_1 = require("../../error");
+const utils_1 = require("../../utils");
+const http_request_1 = require("../../utils/http-request");
+const types_1 = require("../types");
+/**
+ * 基于 CloudAppService 的云端构建能力适配器
+ *
+ * 将 CloudApp custom 构建相关的 API/IO 逐一映射为 CloudImageBuilder 所需的
+ * ICloudBuildService 接口，使builder 与具体传输/网络实现解耦、便于测试替换。
+ *
+ * 步骤对应构建方案「阶段 A」（https://iwiki.woa.com/p/4020519533）：
+ * - packContext：打包源码目录为临时 ZIP（复用 compressToZip）
+ * - getCosInfo：DescribeCloudAppCosInfo（DeployType:custom）取上传凭证与UnixTimestamp
+ * - uploadZip：PUT 上传到 COS，携带服务端返回的全部 UploadHeaders
+ * - createBuild：CreateCloudApp（DeployType:custom）触发容器内 build+push
+ * - getVersionStatus：DescribeCloudAppVersion 查询分步状态与产物
+ */
+const CUSTOM_DEPLOY_TYPE = 'custom';
+const CUSTOM_BUILD_TYPE = 'zip';
+/** 云端构建打包默认忽略项，避免上传无关文件或本地环境密钥 */
+const DEFAULT_IGNORE = [
+    'node_modules/**',
+    '.venv/**',
+    '**/.venv/**',
+    'venv/**',
+    '**/venv/**',
+    '__pycache__/**',
+    '**/__pycache__/**',
+    '*.pyc',
+    '**/*.pyc',
+    '.pytest_cache/**',
+    '**/.pytest_cache/**',
+    '.mypy_cache/**',
+    '**/.mypy_cache/**',
+    '.ruff_cache/**',
+    '**/.ruff_cache/**',
+    '.coverage',
+    '**/.coverage',
+    'htmlcov/**',
+    '**/htmlcov/**',
+    '.git/**',
+    '.DS_Store',
+    '**/.DS_Store',
+    '**/.env',
+    // 保留 .env.example/.env.sample/.env.template，其余 .env.* 默认视为本地环境密钥
+    '**/.env.!(example|sample|template)'
+];
+/**
+ * 由CloudAppService 构造 ICloudBuildService实现
+ */
+function createCloudBuildService(cloudApp, options = {}) {
+    const ignore = [...DEFAULT_IGNORE, ...(options.ignore || [])];
+    return {
+        async packContext(cwd, extraEntries) {
+            if (!fs_1.default.existsSync(cwd) || !fs_1.default.statSync(cwd).isDirectory()) {
+                throw new error_1.CloudBaseError(`构建上下文目录不存在或不是目录：${cwd}`, {
+                    code: types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID
+                });
+            }
+            const zipPath = path_1.default.join(os_1.default.tmpdir(), `fn-cloud-build-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`);
+            const injectedEntries = (extraEntries || []).map(entry => ({
+                zipPath: entry.zipPath.replace(/\\/g, '/').replace(/^\.\//, ''),
+                content: entry.content,
+                mode: entry.mode
+            }));
+            // 源码中若存在与 SDK 注入文件同名的路径，必须从 glob 中排除，
+            // 避免 ZIP 出现重复 entry 后由解压顺序决定最终执行内容。
+            const contextIgnore = [
+                ...ignore,
+                ...injectedEntries.map(entry => entry.zipPath)
+            ];
+            // 把 SDK 注入的辅助文件（如 push 脚本）随源码一起打进zip，
+            // 通过临时文件注入，绝不写入用户源码目录。
+            try {
+                await (0, utils_1.compressToZip)({
+                    dirPath: cwd,
+                    outputPath: zipPath,
+                    ignore: contextIgnore,
+                    extraEntries: injectedEntries
+                });
+            }
+            catch (error) {
+                try {
+                    if (fs_1.default.existsSync(zipPath)) {
+                        fs_1.default.unlinkSync(zipPath);
+                    }
+                }
+                catch (_a) {
+                    // 清理未完成的临时 ZIP 失败不覆盖原始打包错误
+                }
+                const original = error instanceof Error ? error : new Error(String(error));
+                throw new error_1.CloudBaseError(`打包云端构建上下文失败：${original.message}`, {
+                    code: types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID,
+                    original
+                });
+            }
+            return zipPath;
+        },
+        async getCosInfo(serviceName) {
+            const res = await cloudApp.describeCosInfo({
+                deployType: CUSTOM_DEPLOY_TYPE,
+                serviceName,
+                suffix: '.zip'
+            });
+            return {
+                uploadUrl: res.UploadUrl,
+                uploadHeaders: (res.UploadHeaders || []).map(h => ({
+                    key: h.Key,
+                    value: h.Value
+                })),
+                unixTimestamp: res.UnixTimestamp
+            };
+        },
+        async uploadZip(cosInfo, zipPath) {
+            const zipSize = fs_1.default.statSync(zipPath).size;
+            // 必须携带服务端返回的全部 UploadHeaders，缺失会导致 COS 鉴权失败
+            const headers = {
+                'Content-Type': 'application/zip',
+                'Content-Length': String(zipSize)
+            };
+            for (const h of cosInfo.uploadHeaders) {
+                headers[h.key] = h.value;
+            }
+            const response = await (0, http_request_1.fetchStream)(cosInfo.uploadUrl, {
+                method: 'PUT',
+                body: fs_1.default.createReadStream(zipPath),
+                headers
+            });
+            if (!response.ok) {
+                let detail = '';
+                try {
+                    const text = await response.text();
+                    detail = text ? ` - ${text.substring(0, 500)}` : '';
+                }
+                catch (_a) {
+                    // 解析响应体失败不影响主错误抛出
+                }
+                throw new error_1.CloudBaseError(`上传源码到 COS 失败：${response.status} ${response.statusText}${detail}`, { code: types_1.FUNCTION_DEPLOY_ERROR.CLOUD_UPLOAD_FAILED });
+            }
+        },
+        async createBuild(input) {
+            const res = await cloudApp.createApp({
+                deployType: CUSTOM_DEPLOY_TYPE,
+                serviceName: input.serviceName,
+                buildType: CUSTOM_BUILD_TYPE,
+                source: {
+                    type: CUSTOM_BUILD_TYPE,
+                    // 原样回填 DescribeCloudAppCosInfo 返回的时间戳，指向刚上传的源码包
+                    cosTimestamp: input.cosTimestamp,
+                    cosSuffix: '.zip'
+                },
+                env: input.env,
+                secrets: input.secrets,
+                customSteps: input.customSteps
+            });
+            return { buildId: res.BuildId, versionName: res.VersionName, requestId: res.RequestId };
+        },
+        async getVersionStatus(serviceName, versionName) {
+            const res = await cloudApp.describeAppVersion({
+                deployType: CUSTOM_DEPLOY_TYPE,
+                serviceName,
+                versionName
+            });
+            return {
+                status: res.Status,
+                steps: res.Steps,
+                artifacts: res.Artifacts,
+                requestId: res.RequestId
+            };
+        },
+        async cleanup(zipPath) {
+            if (zipPath && fs_1.default.existsSync(zipPath)) {
+                fs_1.default.unlinkSync(zipPath);
+            }
+        },
+        delay(ms) {
+            return new Promise(resolve => {
+                setTimeout(resolve, ms);
+            });
+        }
+    };
+}