@engenty/wizards-runtime 0.7.8 → 0.7.9

package/apps/runtime/dist/clients.js

@@ -0,0 +1,118 @@
+import { env } from "./env.js";
+import { allowed } from "./limits.js";
+import { managed } from "./manage.js";
+/**
+ * The clients of the public run API: who starts runs here (docs/content/dev/api.md,
+ * docs/plans/api-clients.md). A client names itself in the `x-wizards-client` header: `web` (the
+ * runner in a browser), `app` (the mobile app), `cli`, or the id of a client registered at the
+ * Manage-App. The id is no secret: it carries the terms, the limits and the revocation of a
+ * client, not its proof. The run keeps it.
+ *
+ * A managed runtime fetches the list of clients from its Manage-App at the start and once an
+ * hour, and keeps the last list when a fetch fails. Without a list every client may start runs:
+ * the Manage-App being down must not close the wizards. A runtime that runs alone fetches
+ * nothing and refuses nothing — its API is the person's own.
+ */
+export const CLIENT_HEADER = "x-wizards-client";
+/** The clients this repository ships: the runner, the mobile app, the command line. */
+export const OWN_CLIENTS = ["web", "app", "cli"];
+const ID = /^[a-z0-9][a-z0-9-]{0,63}$/;
+/** The client a request names, or null when it names none or a malformed one. */
+export function clientOf(c) {
+    const id = c.req.header(CLIENT_HEADER)?.trim().toLowerCase() ?? "";
+    return ID.test(id) ? id : null;
+}
+let list = null;
+/** The list in force; tests set it, a managed runtime fetches it. */
+export function setClientList(next) {
+    list = next;
+}
+const HOUR = 3600_000;
+/**
+ * Why `client` may not start a run now, or null when it may. Counts the try against the
+ * client's hourly cap, so call it once per start.
+ */
+export function clientRefused(client) {
+    if (!list) {
+        return null;
+    }
+    const known = list.clients.find((c) => c.id === client);
+    const cap = known ? known.runsPerHour : list.unknown.runsPerHour;
+    if (known ? known.revoked : !list.unknown.allow) {
+        return {
+            status: 403,
+            code: "client_refused",
+            note: "clientRefused",
+        };
+    }
+    if (cap !== null && !allowed(`client:${client ?? "unknown"}`, cap, HOUR)) {
+        return {
+            status: 429,
+            code: "client_limit",
+            note: "clientLimit",
+        };
+    }
+    return null;
+}
+/** The list as the Manage-App sends it, checked; throws on a shape this runtime does not know. */
+export function parseClientList(body) {
+    const raw = body;
+    if (!Array.isArray(raw?.clients)) {
+        throw new Error("no clients");
+    }
+    const clients = raw.clients.map((c) => {
+        if (typeof c?.id !== "string" || !ID.test(c.id)) {
+            throw new Error("bad client id");
+        }
+        return {
+            id: c.id,
+            name: typeof c.name === "string" ? c.name : c.id,
+            runsPerHour: typeof c.runsPerHour === "number" && c.runsPerHour >= 0 ? c.runsPerHour : null,
+            revoked: c.revoked === true,
+        };
+    });
+    const unknown = (raw.unknown ?? {});
+    return {
+        clients,
+        unknown: {
+            allow: unknown.allow !== false,
+            runsPerHour: typeof unknown.runsPerHour === "number" && unknown.runsPerHour >= 0
+                ? unknown.runsPerHour
+                : null,
+        },
+    };
+}
+/**
+ * Fetches the Manage-App's list. A Manage-App without the call (404) means no list: everything
+ * may start runs. Any other failure keeps the list from before.
+ */
+export async function loadClientList() {
+    if (!managed) {
+        return;
+    }
+    try {
+        const res = await fetch(`${env.manage.url}/v1/clients`, {
+            headers: { authorization: `Bearer ${env.manage.serviceKey}` },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (res.status === 404) {
+            list = null;
+            return;
+        }
+        if (!res.ok) {
+            throw new Error(`HTTP ${res.status}`);
+        }
+        list = parseClientList(await res.json());
+    }
+    catch (err) {
+        console.warn(`[clients] the Manage-App's client list was not read: ${err.message}`);
+    }
+}
+/** A managed runtime: the list now, and again every hour. */
+export function startClientChecks() {
+    if (!managed) {
+        return;
+    }
+    void loadClientList();
+    setInterval(() => void loadClientList(), HOUR).unref();
+}

package/apps/runtime/dist/db/client.js

@@ -21,8 +21,10 @@ function open(url, authToken) {
 }
 async function prepare(client, url) {
     if (url.startsWith("file:")) {
-        await client.execute("PRAGMA journal_mode = WAL");
+        // The wait first: studio, doors and runner share the files, and switching to WAL waits
+        // too while another process recovers the log after a restart.
         await client.execute("PRAGMA busy_timeout = 5000");
+        await client.execute("PRAGMA journal_mode = WAL");
     }
     await client.execute("PRAGMA foreign_keys = ON");
 }
@@ -52,6 +54,28 @@ function tenantUrl(id, dbUrl) {
     }
     return `file:${join(env.dataDir, "tenants", `${id}.db`)}`;
 }
+function isBusy(err) {
+    for (let e = err; e; e = e.cause) {
+        if (String(e.code ?? "").startsWith("SQLITE_BUSY")) {
+            return true;
+        }
+    }
+    return false;
+}
+/** `fn` again while another process holds the database: 1, 2, 4, 8 and 16 seconds apart. */
+async function whileBusy(fn) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            if (attempt >= 5 || !isBusy(err)) {
+                throw err;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** attempt));
+        }
+    }
+}
 async function openTenant(id) {
     let row = await controlDb.query.tenant.findFirst({ where: eq(control.tenant.id, id) });
     if (!row) {
@@ -61,10 +85,20 @@ async function openTenant(id) {
     const url = tenantUrl(id, row.dbUrl);
     const client = open(url, url.startsWith("file:") ? "" : env.tenantDbAuthToken);
     clients.set(id, client);
-    await prepare(client, url);
     const db = makeTenantDb(client);
     // Every database is brought to the current schema when it is first opened.
-    await migrate(db, { migrationsFolder: migrationsFolder("tenant") });
+    try {
+        await whileBusy(async () => {
+            await prepare(client, url);
+            await migrate(db, { migrationsFolder: migrationsFolder("tenant") });
+        });
+    }
+    catch (err) {
+        // The next use opens it afresh (tenantDb forgets the failed attempt).
+        clients.delete(id);
+        client.close();
+        throw err;
+    }
     for (const hook of openHooks) {
         await hook(id, client);
     }

package/apps/runtime/dist/db/migrations/tenant/0017_run_client.sql

@@ -0,0 +1 @@
+ALTER TABLE `run` ADD `client` text;