@faable/faable 4.18.5 → 4.19.0

package/dist/api/FaableApi.js

@@ -379,6 +379,13 @@ class FaableApi {
     async setDeployBranch(app_id, github_branch) {
         return data(this.client.post(`/app/${app_id}/deploy-branch`, { github_branch }));
     }
+    // The GitLab project (numeric id) whose CI may deploy the app keyless; null
+    // revokes it.
+    async setCiTrust(app_id, gitlab_project_id) {
+        return data(this.client.post(`/app/${app_id}/ci-trust`, {
+            gitlab_project_id
+        }));
+    }
     // null clears the platform override (faable.json's rootDir applies again).
     async setRootDir(app_id, root_dir) {
         return data(this.client.post(`/app/${app_id}/root-dir`, { root_dir }));

package/dist/api/context.js

@@ -38,6 +38,21 @@ const context = async (targetAppId) => {
             console.error("Error fetching token, configure 'permissions: id-token: write'");
         }
     }
+    else if (process.env.GITLAB_CI === "true" && process.env.FAABLE_ID_TOKEN) {
+        // GitLab CI: the job declares
+        //   id_tokens: { FAABLE_ID_TOKEN: { aud: https://faable.com } }
+        // and the app must trust its project (`deploy apps set --gitlab-project`).
+        // Without FAABLE_ID_TOKEN a GitLab job falls through to an API key or
+        // the local credentials, as before.
+        api = FaableApi.create({
+            authStrategy: oidc_strategy,
+            auth: {
+                idToken: process.env.FAABLE_ID_TOKEN,
+                appId: targetAppId,
+                provider: "gitlab",
+            },
+        });
+    }
     else {
         const store = new CredentialsStore();
         // Auto-refreshes an expired access token via the stored refresh_token.

package/dist/api/strategies/oidc.strategy.js

@@ -1,6 +1,31 @@
 import axios from 'axios';
 import { create_base_client } from '../base_client.js';
 
+// GitLab has no linked repository to infer the app from: the job names it
+// with `faable deploy --app`, and the api checks the app trusts the token's
+// project (`faable deploy apps set --gitlab-project <id>`).
+const exchangeGitlabOidcToken = async (gl_token, target_app_id) => {
+    if (!target_app_id) {
+        throw new Error("Keyless deploys from GitLab CI need the app: run `faable deploy --app <app_id>`.");
+    }
+    const client = create_base_client();
+    try {
+        const res = await client.post("/auth/gitlab-oidc", {
+            token: gl_token,
+            app_id: target_app_id,
+        });
+        const { access_token, app_id } = res.data;
+        return { access_token, app_id };
+    }
+    catch (err) {
+        if (axios.isAxiosError(err)) {
+            const status = err.response?.status;
+            const serverMessage = err.response?.data?.message;
+            throw new Error(`Faable OIDC token exchange failed (${status ?? "network error"})${serverMessage ? `: ${serverMessage}` : ""}`, { cause: err });
+        }
+        throw err;
+    }
+};
 const exchangeGithubOidcToken = async (gh_token, target_app_id) => {
     const client = create_base_client();
     try {
@@ -35,14 +60,16 @@ const exchangeGithubOidcToken = async (gh_token, target_app_id) => {
     }
 };
 const oidc_strategy = (config) => {
-    const { idToken, appId } = config;
+    const { idToken, appId, provider = "github" } = config;
     if (!idToken) {
         throw new Error("Missing idToken.");
     }
     let token_ex;
     const ensure = async () => {
         if (!token_ex)
-            token_ex = await exchangeGithubOidcToken(idToken, appId);
+            token_ex = await (provider === "gitlab"
+                ? exchangeGitlabOidcToken(idToken, appId)
+                : exchangeGithubOidcToken(idToken, appId));
         return token_ex;
     };
     return {

package/dist/commands/deploy/apps/set.js

@@ -31,16 +31,25 @@ const apps_set = {
         choices: MODES,
         description: 'push: every push deploys · ci: once CI tags a release · workflow: your own GitHub workflow runs faable deploy'
     })
-        .check(({ branch, rootDir, mode }) => {
+        .option('gitlab-project', {
+        type: 'string',
+        description: 'GitLab project ID (the number on its page) whose CI may deploy this app without an API key ("" revokes it)'
+    })
+        .check(({ branch, rootDir, mode, gitlabProject }) => {
         if (branch === undefined &&
             rootDir === undefined &&
-            mode === undefined) {
-            throw new Error('Nothing to change: pass --branch, --root-dir or --mode.');
+            mode === undefined &&
+            gitlabProject === undefined) {
+            throw new Error('Nothing to change: pass --branch, --root-dir, --mode or --gitlab-project.');
+        }
+        if (gitlabProject && !/^[0-9]+$/.test(String(gitlabProject))) {
+            throw new Error('--gitlab-project takes the numeric Project ID shown on the GitLab project page, not its path.');
         }
         return true;
     })
         .example('$0 deploy apps set --branch release', 'Deploy from "release"')
         .example('$0 deploy apps set --root-dir apps/web', 'A monorepo app')
+        .example('$0 deploy apps set --gitlab-project 12345678', 'Let that GitLab project deploy keyless')
         .showHelpOnFail(false),
     handler: async (args) => {
         const ctx = await requireApi();
@@ -60,6 +69,12 @@ const apps_set = {
             await ctx.api.setDeployMode(app_id, args.mode);
             log.info(`⚙️ Deploy mode: ${args.mode}`);
         }
+        if (args.gitlabProject !== undefined) {
+            await ctx.api.setCiTrust(app_id, String(args.gitlabProject) || null);
+            log.info(args.gitlabProject
+                ? `🦊 GitLab project ${args.gitlabProject} can deploy this app without an API key`
+                : '🦊 GitLab keyless deploys revoked');
+        }
         const app = await ctx.api.getApp(app_id);
         if (args.json)
             return print_json(app);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.18.5",
+  "version": "4.19.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",