@fabrika/provider-zerops 0.0.26 → 0.3.1

package/src/service-references.ts

@@ -0,0 +1,28 @@
+/**
+ * `${<host>_<KEY>}` — Zerops resolves it across services regardless of `envIsolation`, so the host is the boundary.
+ * `${RUNTIME_<host>_<KEY>}`, the build-time bridge, counts as a reference to that host until measured otherwise.
+ */
+const SERVICE_REFERENCE = /\$\{(?:RUNTIME_)?([a-z0-9]{1,25})_[A-Za-z0-9_]+\}/g
+
+/** Namespace services every app in it may reference; the proxy is deliberately not one of them. */
+const SHARED_NAMESPACE_HOSTNAMES: readonly string[] = ['postgres']
+
+/** Hosts named by cross-service references in `text`, deduplicated, in order of first appearance. */
+export function serviceReferenceHosts(text: string): string[] {
+	const hosts: string[] = []
+	for (const match of text.matchAll(SERVICE_REFERENCE)) {
+		const host = match[1]
+		if (host !== undefined && !hosts.includes(host)) hosts.push(host)
+	}
+	return hosts
+}
+
+/** The hosts a service of this app may reference: its own declared hostnames plus the namespace's shared services. */
+export function allowedReferenceHosts(ownHostnames: readonly string[]): ReadonlySet<string> {
+	return new Set([...ownHostnames, ...SHARED_NAMESPACE_HOSTNAMES])
+}
+
+/** The first referenced host outside `allowed`, or null when every reference stays inside the app. */
+export function foreignReferenceHost(text: string, allowed: ReadonlySet<string>): string | null {
+	return serviceReferenceHosts(text).find((host) => !allowed.has(host)) ?? null
+}

package/src/source/constants.ts

@@ -0,0 +1,11 @@
+export const MAX_ID_LENGTH = 128
+
+export const SHA256_PATTERN = /^[a-f0-9]{64}$/
+
+export const COMMIT_SHA_PATTERN = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/
+
+export const ID_PATTERN = /^[A-Za-z0-9._:-]+$/
+
+export const GITHUB_OWNER_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?$/
+
+export const GITHUB_REPOSITORY_PATTERN = /^[a-z0-9._-]{1,100}$/

package/src/source/port.ts

@@ -0,0 +1,49 @@
+import type { ZeropsSourceRepository } from './types'
+
+/** A private source names its connection; an installation id alone never selects a credential (ADR-0029). */
+export interface ZeropsSourcePrivateBinding {
+	readonly connectionId: string
+	readonly installationId: number
+}
+
+export interface ZeropsSourceResolveInput {
+	readonly repository: ZeropsSourceRepository
+	readonly requestedRef: string
+	readonly expectedCommitSha?: string
+	readonly privateBinding?: ZeropsSourcePrivateBinding
+	readonly descriptorSha256: string
+	readonly signal: AbortSignal
+}
+
+export interface ZeropsSourceResolution {
+	readonly commitSha: string
+	readonly descriptorSha256: string
+}
+
+/** ADR-0045: platform archives are anonymous, tree-prechecked, keep relative symlinks. */
+export type ZeropsSourceArchive =
+	| { readonly kind: 'application'; readonly privateBinding?: ZeropsSourcePrivateBinding }
+	| { readonly kind: 'platform' }
+
+export interface ZeropsSourceUploadInput {
+	readonly repository: ZeropsSourceRepository
+	readonly commitSha: string
+	readonly descriptorSha256: string
+	readonly archive: ZeropsSourceArchive
+	/** A credential in transit: never logged, persisted, or returned in an error. */
+	readonly uploadUrl: string
+	readonly signal: AbortSignal
+}
+
+export interface ZeropsSourceUploadResult {
+	readonly commitSha: string
+	readonly descriptorSha256: string
+	readonly entryCount: number
+	readonly expandedBytes: number
+}
+
+/** The GitHub source the Zerops composition injects; Control implements it in process. Callers verify what it returns. */
+export interface ZeropsSourcePort {
+	resolve(input: ZeropsSourceResolveInput): Promise<ZeropsSourceResolution>
+	upload(input: ZeropsSourceUploadInput): Promise<ZeropsSourceUploadResult>
+}

package/src/source/types.ts

@@ -0,0 +1,4 @@
+export interface ZeropsSourceRepository {
+	owner: string
+	name: string
+}

package/src/source/validation.ts

@@ -0,0 +1,72 @@
+import { z } from 'zod'
+import { COMMIT_SHA_PATTERN, GITHUB_OWNER_PATTERN, GITHUB_REPOSITORY_PATTERN, ID_PATTERN, MAX_ID_LENGTH, SHA256_PATTERN } from './constants'
+import type { ZeropsSourceRepository } from './types'
+
+// Default Zod diagnostics can include rejected values and unknown keys, both of which may be secrets.
+export function parseSourceWire<T>(schema: z.ZodType<T, z.ZodTypeDef, unknown>, value: unknown, label: string): T {
+	const result = schema.safeParse(value)
+	if (result.success) return result.data
+	if (result.error.issues.some((issue) => issue.code === 'unrecognized_keys')) throw new Error(`${label} contains an unknown field`)
+	const domainIssue = result.error.issues.find((issue) => issue.code === 'custom')
+	throw new Error(`${label}: ${domainIssue?.message ?? 'invalid wire value'}`)
+}
+
+export const identifierSchema = z.string().min(1).max(MAX_ID_LENGTH).regex(ID_PATTERN)
+export const commitShaSchema = z.string().regex(COMMIT_SHA_PATTERN)
+export const sha256Schema = z.string().regex(SHA256_PATTERN)
+export const repositorySchema = z.object({
+	owner: z.string().min(1).max(39).regex(GITHUB_OWNER_PATTERN),
+	name: z.string().min(1).max(100).regex(GITHUB_REPOSITORY_PATTERN).refine((name) => name !== '.' && name !== '..', 'invalid repository name'),
+}).strict()
+
+export const rejectExplicitUndefined = (value: object, context: z.RefinementCtx): void => {
+	if (Object.values(value).some((entry) => entry === undefined)) {
+		context.addIssue({ code: 'custom', message: 'optional fields must be omitted instead of undefined' })
+	}
+}
+
+const repository = (value: unknown, label: string): ZeropsSourceRepository => parseSourceWire(repositorySchema, value, label)
+
+export const isZeropsUploadDestination = (value: string): boolean => {
+	if (!value.startsWith('https://proxy.app-prg1.zerops.io/api/rest/object-storage/upload?')) return false
+	let url: URL
+	try {
+		url = new URL(value)
+	} catch {
+		return false
+	}
+	return url.protocol === 'https:'
+		&& url.hostname === 'proxy.app-prg1.zerops.io'
+		&& url.pathname === '/api/rest/object-storage/upload'
+		&& url.username === ''
+		&& url.password === ''
+		&& url.port === ''
+		&& url.hash === ''
+		&& url.search !== ''
+}
+
+export function normalizeZeropsSourceRepository(repoUrl: string): ZeropsSourceRepository {
+	if (/\s/u.test(repoUrl) || /\p{Cc}/u.test(repoUrl)) {
+		throw new Error('source repository URL must be a canonical GitHub repository URL')
+	}
+	const candidate = repoUrl.startsWith('github.com/') ? `https://${repoUrl}` : repoUrl
+	let parsed: URL
+	try {
+		parsed = new URL(candidate)
+	} catch {
+		throw new Error('source repository URL must be a canonical GitHub repository URL')
+	}
+	if (
+		parsed.protocol !== 'https:' || parsed.hostname !== 'github.com' || parsed.port !== '' || parsed.username !== '' || parsed.password !== ''
+		|| parsed.search !== '' || parsed.hash !== ''
+	) {
+		throw new Error('source repository URL must be an HTTPS GitHub URL without credentials, port, query, or fragment')
+	}
+	const segments = parsed.pathname.split('/')
+	if (segments.length !== 3 || segments[0] !== '') throw new Error('source repository URL must identify one GitHub repository')
+	const owner = segments[1]
+	const rawName = segments[2]
+	if (owner === undefined || rawName === undefined) throw new Error('source repository URL must identify one GitHub repository')
+	const name = rawName.endsWith('.git') ? rawName.slice(0, -4) : rawName
+	return repository({ owner: owner.toLowerCase(), name: name.toLowerCase() }, 'source repository')
+}