@envsync-cloud/deploy-cli 0.8.9 → 0.8.11

package/dist/index.js

@@ -4398,6 +4398,8 @@ function buildRuntimeEnv2(config, generated) {
   const hosts = domainMap(config.domain.root_domain);
   const bucketName = "envsync-bucket";
   const oss = isOssConfig(config);
+  const enterprise = !oss;
+  const license = config.license ?? {};
   return {
     NODE_ENV: "production",
     ENVSYNC_EDITION: oss ? "oss" : "enterprise",
@@ -4410,6 +4412,11 @@ function buildRuntimeEnv2(config, generated) {
     ENVSYNC_LICENSE_CERT_PATH: oss ? "" : "/etc/envsync/license/enterprise-cert.pem",
     ENVSYNC_LICENSE_KEY_PATH: oss ? "" : "/etc/envsync/license/enterprise-key.pem",
     ENVSYNC_LICENSE_ROOT_CA_CERT_PATH: oss ? "" : "/etc/envsync/license/root-ca.pem",
+    ENVSYNC_LICENSE_SERVER_URL: enterprise ? license.server_url ?? "" : "",
+    ENVSYNC_LICENSE_KEY: enterprise ? license.key ?? "" : "",
+    ENVSYNC_INSTALL_FINGERPRINT: enterprise ? license.install_fingerprint ?? "" : "",
+    ENVSYNC_LICENSE_LEASE_TTL_SECONDS: String(license.lease_ttl_seconds ?? 300),
+    ENVSYNC_STACK_NAME: config.services.stack_name,
     DB_AUTO_MIGRATE: "false",
     PORT: `${config.services.api_port}`,
     MANAGEMENT_API_PORT: `${config.services.management_api_port}`,
@@ -4728,8 +4735,9 @@ function renderApiMaintenanceConf() {
 function renderFrontendRuntimeConfig(config, generated) {
   const hosts = domainMap(config.domain.root_domain);
   const otelEndpoint = publicHttpsUrl(config, hosts.obs);
+  const managementApiEnabled = !isOssConfig(config);
   const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
-  const managementApiUrl = config.edition === "enterprise" ? publicHttpsUrl(config, hosts.manage_api) : "";
+  const managementApiUrl = managementApiEnabled ? publicHttpsUrl(config, hosts.manage_api) : "";
   return `window.__ENVSYNC_RUNTIME_CONFIG__ = ${JSON.stringify({
     apiBaseUrl: publicHttpsUrl(config, hosts.api),
     appBaseUrl: publicHttpsUrl(config, hosts.app),
@@ -5153,6 +5161,8 @@ var LICENSE_BUNDLE_FILE = path3.join(LICENSE_ROOT, "enterprise-license-bundle.js
 var LICENSE_CERT_FILE = path3.join(LICENSE_ROOT, "enterprise-cert.pem");
 var LICENSE_KEY_FILE = path3.join(LICENSE_ROOT, "enterprise-key.pem");
 var LICENSE_ROOT_CA_FILE = path3.join(LICENSE_ROOT, "root-ca.pem");
+var LICENSE_FILE_MODE = 420;
+var LICENSE_DIR_MODE = 493;
 var VERSIONS_LOCK = path3.join(DEPLOY_ROOT, "versions.lock.json");
 var STACK_FILE = path3.join(DEPLOY_ROOT, "docker-stack.yaml");
 var BOOTSTRAP_BASE_STACK_FILE = path3.join(DEPLOY_ROOT, "docker-stack.bootstrap.base.yaml");
@@ -5370,6 +5380,27 @@ function writeFileMaybe(target, content, mode) {
   }
   writeFile(target, content, mode);
 }
+function ensureEnterpriseLicenseFilesReadable() {
+  if (exists2(LICENSE_ROOT)) {
+    try {
+      fs3.chmodSync(LICENSE_ROOT, LICENSE_DIR_MODE);
+    } catch {
+      throw new Error(
+        `Cannot update directory mode for ${LICENSE_ROOT}. Fix by running: chmod ${LICENSE_DIR_MODE.toString(8)} ${LICENSE_ROOT}`
+      );
+    }
+  }
+  for (const filePath of [LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE]) {
+    if (!exists2(filePath)) continue;
+    try {
+      fs3.chmodSync(filePath, LICENSE_FILE_MODE);
+    } catch {
+      throw new Error(
+        `Cannot update file mode for ${filePath}. Fix by running: chmod ${LICENSE_FILE_MODE.toString(8)} ${filePath}`
+      );
+    }
+  }
+}
 function exists2(target) {
   return fs3.existsSync(target);
 }
@@ -5767,6 +5798,7 @@ function normalizeConfig(raw) {
       key: raw.license.key,
       install_fingerprint: raw.license.install_fingerprint ?? deterministicInstallFingerprint(rootDomain, stackName),
       certificate_bundle_file: raw.license.certificate_bundle_file,
+      lease_ttl_seconds: raw.license.lease_ttl_seconds,
       certificate_validity_days: raw.license.certificate_validity_days
     } : raw.edition === "oss" ? void 0 : {
       install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
@@ -7351,6 +7383,9 @@ async function cmdDeploy() {
   logSection("Deploy");
   const { config, generated } = loadState();
   logReleaseContext(config);
+  if (!isOssConfig2(config)) {
+    ensureEnterpriseLicenseFilesReadable();
+  }
   assertSwarmManager();
   assertBootstrapState(generated);
   if (!currentOptions.dryRun) {
@@ -7701,6 +7736,9 @@ async function cmdUpgrade(targetVersion) {
     ref: `v${desiredVersion}`
   };
   logReleaseContext(config);
+  if (!isOssConfig2(config) && !currentOptions.dryRun) {
+    ensureEnterpriseLicenseFilesReadable();
+  }
   config.images = {
     ...config.images,
     ...versionedImages(desiredVersion)
@@ -7792,16 +7830,25 @@ async function requestEnterpriseLicenseCertificate(config, route) {
   return parseEnterpriseLicenseBundle(body.bundle);
 }
 function writeEnterpriseLicenseBundle(bundle) {
-  writeFileMaybe(LICENSE_BUNDLE_FILE, JSON.stringify(bundle, null, 2) + "\n", 384);
-  writeFileMaybe(LICENSE_CERT_FILE, bundle.certificate_pem.endsWith("\n") ? bundle.certificate_pem : `${bundle.certificate_pem}
-`, 384);
-  writeFileMaybe(LICENSE_KEY_FILE, bundle.private_key_pem.endsWith("\n") ? bundle.private_key_pem : `${bundle.private_key_pem}
-`, 384);
+  writeFileMaybe(LICENSE_BUNDLE_FILE, JSON.stringify(bundle, null, 2) + "\n", LICENSE_FILE_MODE);
+  writeFileMaybe(
+    LICENSE_CERT_FILE,
+    bundle.certificate_pem.endsWith("\n") ? bundle.certificate_pem : `${bundle.certificate_pem}
+`,
+    LICENSE_FILE_MODE
+  );
+  writeFileMaybe(
+    LICENSE_KEY_FILE,
+    bundle.private_key_pem.endsWith("\n") ? bundle.private_key_pem : `${bundle.private_key_pem}
+`,
+    LICENSE_FILE_MODE
+  );
   writeFileMaybe(LICENSE_ROOT_CA_FILE, bundle.root_ca_pem.endsWith("\n") ? bundle.root_ca_pem : `${bundle.root_ca_pem}
-`, 420);
+`, LICENSE_FILE_MODE);
 }
 async function ensureEnterpriseCertificateBundle(config) {
   if (isOssConfig2(config)) return;
+  ensureEnterpriseLicenseFilesReadable();
   if (exists2(LICENSE_BUNDLE_FILE) && exists2(LICENSE_CERT_FILE) && exists2(LICENSE_KEY_FILE) && exists2(LICENSE_ROOT_CA_FILE)) {
     validateEnterpriseLicenseBundleFiles(config, false);
     return;
@@ -7860,6 +7907,7 @@ async function cmdLicense(action = "validate-cert") {
     logInfo("OSS deployments do not require license verification.");
     return;
   }
+  ensureEnterpriseLicenseFilesReadable();
   if (action === "issue-cert" || action === "renew-cert") {
     const route = action === "renew-cert" ? "renew" : "issue";
     if (currentOptions.dryRun) {
@@ -8101,6 +8149,7 @@ async function cmdRestore(archivePath, autoDeploy = false) {
   if (exists2(restoredLicenseRoot)) {
     fs3.rmSync(LICENSE_ROOT, { recursive: true, force: true });
     fs3.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
+    ensureEnterpriseLicenseFilesReadable();
   }
   const config = loadConfig();
   for (const volume of STACK_VOLUMES) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.9",
+  "version": "0.8.11",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {