@fabrika/provider-zerops 0.4.2 → 0.4.4

package/src/installation/deploy.ts

@@ -19,9 +19,9 @@
 //
 // ── What this command writes, and what it deliberately does not ───────────────────────────────────
 //
-// It writes the composed proxy manifest, the exact namespace planning source default, and the
-// per-installation configuration derived from the resolved public hosts (each service's own origin,
-// the origins it must know about, and the installation's environment name). **It writes no credential at all** — every
+// It composes the proxy manifest and ships it in the proxy's build archive. It writes the exact namespace
+// planning source default and the per-installation configuration derived from the resolved public hosts
+// (each service's own origin, the origins it must know about, and the installation's environment name). **It writes no credential at all** — every
 // secret an installation holds is `platform init`'s to place, and a deploy that cannot write one cannot
 // leak one. The two credentials this command HOLDS are the Zerops access token and the IAM admin key,
 // both from the environment, neither ever logged.
@@ -35,10 +35,14 @@
 // readiness gate.
 
 import { FABRIKA_SERVICE_TABLE_DIGEST, readEnvironmentName } from '@fabrika/auth-core'
+import { IAM_APP_ID, IAM_APP_SCHEMA } from '@fabrika/iam-contract'
 import type { SchemaReconciler } from '@fabrika/provider-contract'
 import { encodeProxyManifestJson, FABRIKA_PROXY_MANIFEST_JSON } from '@fabrika/proxy-core/manifest'
+import { assertServiceEnvValueFits } from '../api'
 import {
+	enableSubdomainAccessWhenHttp,
 	prepareZeropsDescriptor,
+	readableContent,
 	type Sleeper,
 	ZEROPS_ACTIVE,
 	ZEROPS_SERVICE_NOT_HTTP,
@@ -47,7 +51,10 @@ import {
 	ZeropsApiError,
 	type ZeropsNamespaceProxySource,
 	type ZeropsService,
+	type ZeropsServiceEnv,
 } from '../index'
+import { ZEROPS_PROXY_MANIFEST_PATH } from '../proxy-manifest-carrier'
+import { assertCheckerPublished, type CheckerPublication } from './checker-release'
 import type { PlatformDeployInput } from './deploy-options'
 import { PLATFORM_CONSOLE_APP_SCHEMA } from './generated/platform-console-schema'
 import { PLATFORM_PROXY_MANIFEST_TEMPLATE } from './generated/platform-proxy-manifest'
@@ -61,8 +68,8 @@ import {
 	validateInstallationSetups,
 } from './installation-source'
 import type { DeployLog } from './log'
-import { mergePlatformProxyManifest, readLiveProxyManifest } from './manifest'
 import { type IamOAuthConfig, platformIamOAuthConfig } from './mcp'
+import { archiveWithDataFile } from './platform-archive'
 import type { PreparedPlatformSource } from './platform-source'
 import { type PlatformUploadFetch, uploadPlatformArchive } from './platform-upload'
 import { platformProxyAppFor, type PlatformProxyComposition, platformServiceTableDigest, resolvePlatformProxyManifest } from './proxy-manifest'
@@ -139,6 +146,7 @@ export interface PlatformServiceDeployCollaborators {
 /** Everything `deployPlatform` reaches the outside world through. */
 export interface PlatformDeployCollaborators extends PlatformServiceDeployCollaborators {
 	readonly prepareSource: PlatformSourcePreparer
+	readonly checkerPublished: CheckerPublication
 	readonly reconcileSchema: SchemaReconciler
 }
 
@@ -146,6 +154,16 @@ export interface PlatformDeployCollaborators extends PlatformServiceDeployCollab
 export interface PlatformServiceDeployInput {
 	readonly source: PreparedPlatformSource
 	readonly dryRun: boolean
+	/** The proxy's manifest, which its archive carries as the one data file (ADR-0045); the proxy is refused without it. */
+	readonly proxyManifest?: string
+}
+
+/** The archive one service builds from: the snapshot, and for the proxy the snapshot plus its manifest. */
+const serviceArchive = async (service: ResolvedService, input: PlatformServiceDeployInput): Promise<Blob> => {
+	const snapshot = Bun.file(input.source.archivePath)
+	if (service.hostname !== PLATFORM_PROXY_SERVICE) return snapshot
+	if (input.proxyManifest === undefined) throw new Error('the proxy is built only with the manifest its archive carries')
+	return new Blob([archiveWithDataFile(await snapshot.bytes(), { path: ZEROPS_PROXY_MANIFEST_PATH, contents: input.proxyManifest })])
 }
 
 /** One resolved platform service. */
@@ -237,13 +255,16 @@ export const serviceOf = (services: ReadonlyMap<PlatformDeployService, ResolvedS
 	return service
 }
 
-/** Read one service's environment as a key → value map. Values are never logged. */
+/** One service's environment by key. A sensitive record carries no value. Values are never logged. */
+export type LiveServiceEnv = ReadonlyMap<string, ZeropsServiceEnv>
+
+/** Read one service's environment by key. */
 export const readServiceEnv = async (
 	serviceId: string,
 	{ api, signal }: Pick<PlatformServiceDeployCollaborators, 'api' | 'signal'>,
-): Promise<Map<string, string>> => {
+): Promise<LiveServiceEnv> => {
 	const variables = await api.listServiceEnv({ serviceId, signal })
-	return new Map(variables.map((variable) => [variable.key, variable.content]))
+	return new Map(variables.map((variable) => [variable.key, variable]))
 }
 
 /**
@@ -254,11 +275,11 @@ export const readServiceEnv = async (
  * `custom-domain` installation, where the domains are bound to the project balancer out of band and
  * publishing a subdomain would add a public address nobody asked for.
  */
-const resolvePlacement = (input: PlatformDeployInput, proxyEnv: ReadonlyMap<string, string>): PlatformPlacement => {
+const resolvePlacement = (input: PlatformDeployInput, proxyEnv: LiveServiceEnv): PlatformPlacement => {
 	if (input.hosts !== undefined) {
 		return { hosts: input.hosts, scheme: input.scheme, zeropsSubdomain: false }
 	}
-	const subdomains = proxyEnv.get(ZEROPS_SUBDOMAIN_VARIABLE)
+	const subdomains = readableContent(proxyEnv.get(ZEROPS_SUBDOMAIN_VARIABLE))
 	if (subdomains === undefined || subdomains.trim() === '') {
 		throw new Error(
 			'the proxy service publishes no Zerops subdomain — deploy it once so it has HTTP ports, or name every host '
@@ -281,7 +302,6 @@ const IAM_OAUTH_CONFIG = 'FABRIKA_IAM_OAUTH_CONFIG'
 const desiredServiceEnv = (
 	environment: string,
 	placement: PlatformPlacement,
-	manifestJson: string,
 	proxySource: ZeropsNamespaceProxySource,
 	oauthConfig: IamOAuthConfig | undefined,
 	controlTableDigest: string,
@@ -314,7 +334,6 @@ const desiredServiceEnv = (
 				// Compared byte-for-byte against a token's `iss`, so this is the PUBLIC issuer and not the
 				// private `iam:3000` the manifest dials — `readProxyEnv` canonicalizes it to an origin.
 				['FABRIKA_IAM_ISSUER', iamOrigin],
-				[FABRIKA_PROXY_MANIFEST_JSON, manifestJson],
 				['FABRIKA_PROXY_SESSION_OWNER_JSON', JSON.stringify({ issuer: iamOrigin, upstream: PRIVATE_IAM_UPSTREAM })],
 			]),
 		],
@@ -338,29 +357,56 @@ const desiredServiceEnv = (
 	])
 }
 
-/** Write only what differs. Returns the KEYS written — never a value, not even in a debug line. */
+/**
+ * Write only what differs. Returns the KEYS written — never a value, not even in a debug line.
+ *
+ * Nothing here is a credential, so everything is written readable. A record an older release wrote
+ * sensitive reads as different and is rewritten readable, which is what lets the next deploy compare it.
+ */
 const applyServiceEnv = async (
 	service: ResolvedService,
 	desired: ReadonlyMap<string, string>,
-	live: ReadonlyMap<string, string>,
+	live: LiveServiceEnv,
 	input: PlatformDeployInput,
 	collaborators: PlatformDeployCollaborators,
 ): Promise<string[]> => {
 	const written: string[] = []
 	for (const [key, value] of desired) {
-		if (live.get(key) === value) {
+		if (readableContent(live.get(key)) === value) {
 			continue
 		}
 		written.push(key)
+		// The client refuses it too; checking here lets a dry run report what the real write would refuse.
+		assertServiceEnvValueFits(key, value)
 		if (input.dryRun) {
 			continue
 		}
 		assertRunning(collaborators.signal)
-		await collaborators.api.putServiceEnv({ serviceId: service.id, key, value, signal: collaborators.signal })
+		await collaborators.api.putServiceEnv({ serviceId: service.id, key, value, sensitive: false, signal: collaborators.signal })
 	}
 	return written
 }
 
+/**
+ * Delete, unread, the manifest copy older releases wrote sensitive: nothing reads it, as each proxy version serves
+ * the file its own build wrote, and the platform proxy fronts only the platform's apps (ADR-0034). True if one existed.
+ */
+const removeLegacyProxyManifest = async (
+	proxyEnv: LiveServiceEnv,
+	input: PlatformDeployInput,
+	collaborators: PlatformDeployCollaborators,
+): Promise<boolean> => {
+	const legacy = proxyEnv.get(FABRIKA_PROXY_MANIFEST_JSON)
+	if (legacy === undefined) {
+		return false
+	}
+	if (!input.dryRun) {
+		assertRunning(collaborators.signal)
+		await collaborators.api.deleteServiceEnv({ envId: legacy.id, signal: collaborators.signal })
+	}
+	return true
+}
+
 /** Only a known rejection permits another request against the same reservation. */
 const triggerPipeline = async (
 	service: ResolvedService,
@@ -434,11 +480,12 @@ export const deployPlatformService = async (
 		return
 	}
 	prepareZeropsDescriptor(input.source.descriptor.contents, service.hostname)
+	const archive = await serviceArchive(service, input)
 	const reserved = await api.createAppVersion({ serviceId: service.id, name: input.source.commitSha, signal })
 	const appVersionId = reserved.id
 	log.info(`${service.hostname}: app-version ${appVersionId}, commit ${input.source.commitSha}, setup ${service.hostname}`)
 	try {
-		await uploadPlatformArchive(reserved.uploadUrl, input.source.archivePath, signal, collaborators.uploadFetch)
+		await uploadPlatformArchive(reserved.uploadUrl, archive, signal, collaborators.uploadFetch)
 		assertRunning(signal)
 	} catch {
 		await cleanupReservation(service, appVersionId, collaborators)
@@ -502,7 +549,8 @@ const deployConcurrently = async (
  * The decision is the READ-BACK and never the call returning: on an already-published service the
  * platform answers 2xx and then fails the process it hands back, and a freshly-enabled one can still
  * read `false` on the next read. Both live-verified. Runs on every deploy, so a subdomain someone
- * turned off in the GUI comes back, and throws rather than leaving the installation unreachable.
+ * turned off in the GUI comes back, and throws rather than leaving the installation unreachable. The
+ * HTTP ports lag a fresh ACTIVE version, so `serviceStackIsNotHttp` is retried for a bounded window first.
  */
 const ensureSubdomainAccess = async (
 	proxy: ResolvedService,
@@ -519,11 +567,11 @@ const ensureSubdomainAccess = async (
 		return
 	}
 	try {
-		await api.enableSubdomainAccess({ serviceId: proxy.id, signal })
+		await enableSubdomainAccessWhenHttp({ api, serviceId: proxy.id, sleep, signal })
 	} catch (error) {
 		if (error instanceof ZeropsApiError && error.code === ZEROPS_SERVICE_NOT_HTTP) {
 			throw new Error(
-				`the proxy cannot be published on a zerops.app subdomain: it exposes no deployed HTTP port (${ZEROPS_SERVICE_NOT_HTTP})`,
+				`the proxy cannot be published on a zerops.app subdomain: it still exposes no deployed HTTP port (${ZEROPS_SERVICE_NOT_HTTP}) minutes after its deploy`,
 			)
 		}
 		throw error
@@ -569,6 +617,7 @@ export const deployPlatform = async (
 	const source = await collaborators.prepareSource(input.sourceDir, collaborators.signal)
 	try {
 		validateInstallationSetups(source, PLATFORM_DEPLOY_ORDER)
+		await assertCheckerPublished(collaborators.checkerPublished, collaborators.signal)
 		await deployPreparedPlatform(input, collaborators, source)
 	} finally {
 		await source.dispose()
@@ -617,26 +666,18 @@ export const deployPreparedPlatform = async (
 			? 'MCP authoring: off'
 			: `MCP authoring: on, ${oauthConfig.clients.length} client(s), resource(s) ${oauthConfig.resources.map((entry) => entry.resource).join(', ')}`,
 	)
-	const merged = mergePlatformProxyManifest(platformManifest, readLiveProxyManifest(proxyEnv.get(FABRIKA_PROXY_MANIFEST_JSON)))
-	log.info(`${merged.manifest.apps.length} app(s): ${merged.manifest.apps.map((app) => app.id).join(', ')}`)
-	if (merged.carried.length > 0) {
-		log.info(`carried through from the live manifest: ${merged.carried.join(', ')}`)
-	}
-	for (const displaced of merged.superseded) {
-		log.warn(
-			`the live manifest entry \`${displaced.id}\` stood on the platform host ${displaced.host} and was replaced — `
-				+ 'that host now answers for the platform app that owns it',
-		)
-	}
+	log.info(`${platformManifest.apps.length} app(s): ${platformManifest.apps.map((app) => app.id).join(', ')}`)
 
 	log.step('Write the service environment')
 	const controlTableDigest = platformServiceTableDigest(platformManifest, platformProxyAppFor(PLATFORM_PROXY_MANIFEST_TEMPLATE, 'control').id)
-	const desired = desiredServiceEnv(environment, placement, encodeProxyManifestJson(merged.manifest), proxySource, oauthConfig, controlTableDigest)
+	const desired = desiredServiceEnv(environment, placement, proxySource, oauthConfig, controlTableDigest)
 	for (const hostname of PLATFORM_DEPLOY_ORDER) {
 		const service = serviceOf(services, hostname)
 		const live = hostname === PLATFORM_PROXY_SERVICE ? proxyEnv : await readServiceEnv(service.id, collaborators)
 		const keys = desired.get(hostname) ?? new Map<string, string>()
-		if (hostname === 'iam' && oauthConfig === undefined && (live.get(IAM_OAUTH_CONFIG) ?? '').trim() !== '') {
+		const liveOAuthConfig = live.get(IAM_OAUTH_CONFIG)
+		const oauthStillSet = liveOAuthConfig !== undefined && (liveOAuthConfig.sensitive || liveOAuthConfig.content.trim() !== '')
+		if (hostname === 'iam' && oauthConfig === undefined && oauthStillSet) {
 			log.warn(`iam: MCP authoring is off but ${IAM_OAUTH_CONFIG} is still set; IAM keeps issuing MCP tokens until it is removed`)
 		}
 		const written = await applyServiceEnv(service, keys, live, input, collaborators)
@@ -646,12 +687,19 @@ export const deployPreparedPlatform = async (
 				: `${hostname}: ${input.dryRun ? 'would write' : 'wrote'} ${written.join(', ')}`,
 		)
 	}
+	if (await removeLegacyProxyManifest(proxyEnv, input, collaborators)) {
+		log.info(
+			`${PLATFORM_PROXY_SERVICE}: ${input.dryRun ? 'would remove' : 'removed'} ${FABRIKA_PROXY_MANIFEST_JSON}, the copy of the manifest a `
+				+ 'release before this one kept there',
+		)
+	}
 
-	// EVERY deploy is after EVERY write. That is what makes the sequence fail closed: a manifest this
-	// command could not apply leaves the previous manifest in front of the previous code, never in front
-	// of new code — and `ENVIRONMENT` is in place before any service that refuses `local` restarts.
+	// EVERY deploy is after EVERY write, and the manifest rides in the proxy's own archive. That is what makes
+	// the sequence fail closed: a proxy build that does not go ACTIVE leaves the previous manifest in front of
+	// the previous code, because control builds only after it — and `ENVIRONMENT` is in place before any
+	// service that refuses `local` restarts.
 	log.step(`Deploy ${PLATFORM_CONCURRENT_DEPLOY.join(' + ')} together, then ${PLATFORM_SEQUENTIAL_DEPLOY.join(' → ')}`)
-	const buildInput = { source, dryRun: input.dryRun }
+	const buildInput = { source, dryRun: input.dryRun, proxyManifest: encodeProxyManifestJson(platformManifest) }
 	await deployConcurrently(services, buildInput, collaborators)
 	for (const hostname of PLATFORM_SEQUENTIAL_DEPLOY) {
 		await deployPlatformService(serviceOf(services, hostname), buildInput, collaborators)
@@ -669,11 +717,12 @@ export const deployPreparedPlatform = async (
 		log.info('custom-domain installation: the operator binds each domain to the project balancer; no subdomain is published')
 	}
 
-	log.step('Register the console with IAM')
+	log.step('Register the console and IAM with IAM')
 	const consoleApp = platformProxyAppFor(PLATFORM_PROXY_MANIFEST_TEMPLATE, 'control')
 	const consoleOrigin = platformOrigin(placement.scheme, placement.hosts.control)
 	if (input.dryRun) {
 		log.info(`would reconcile \`${consoleApp.id}\` and register its return origin ${consoleOrigin}`)
+		log.info(`would reconcile \`${IAM_APP_ID}\`'s own vocabulary`)
 	} else {
 		// The schema PUT is what REGISTERS the app, and `apps.setReturnOrigins` 404s for an app IAM has
 		// never heard of — so both travel in this one call, in that order (ADR-0022/ADR-0023).
@@ -686,6 +735,15 @@ export const deployPreparedPlatform = async (
 			signal,
 		})
 		log.info(`\`${consoleApp.id}\` reconciled; return origin ${consoleOrigin}`)
+		// IAM's own vocabulary, which `user-admin` is granted from (ADR-0058). It has no return origin.
+		await collaborators.reconcileSchema({
+			url: platformOrigin(placement.scheme, placement.hosts.iam),
+			app: IAM_APP_ID,
+			schema: IAM_APP_SCHEMA,
+			adminKey: input.iamAdminKey,
+			signal,
+		})
+		log.info(`\`${IAM_APP_ID}\` reconciled`)
 	}
 
 	log.step(input.dryRun ? 'Dry run complete — nothing was written' : 'Installation deployed')

package/src/installation/generated/platform-console-schema.ts

@@ -11,6 +11,7 @@
 import type { AppSchema } from '@fabrika/auth-core'
 
 export const PLATFORM_CONSOLE_APP_SCHEMA: AppSchema = {
+	displayName: 'Console',
 	scopes: [
 		{ type: 'app', label: 'App' },
 		{ type: 'environment', label: 'Environment' },
@@ -31,14 +32,29 @@ export const PLATFORM_CONSOLE_APP_SCHEMA: AppSchema = {
 		{ action: 'operations.manage', description: 'Manage Operations sources, alerts, and retention' },
 	],
 	roles: {
+		observer: {
+			name: 'Observer',
+			description: 'Read Operations errors and activity.',
+			permissions: ['operations.read'],
+		},
+		triager: {
+			name: 'Triager',
+			description: 'Read and triage Operations errors.',
+			permissions: ['operations.read', 'operations.triage'],
+		},
+		deployer: {
+			name: 'Deployer',
+			description: 'Trigger, read and cancel deploys (no registry, namespace or secret management).',
+			permissions: ['deploy.*'],
+		},
 		operator: {
 			name: 'Operator',
-			description: 'Trigger and read any deploy (no registry or secret management).',
+			description: 'Deploy, and read, triage and manage Operations (no registry or secret management).',
 			permissions: ['deploy.*', 'operations.*'],
 		},
 		admin: {
 			name: 'Admin',
-			description: 'Full access to every vozka action in every scope.',
+			description: 'Every console action in every scope.',
 			permissions: ['*'],
 		},
 	},

package/src/installation/generated/platform-proxy-manifest.ts

@@ -278,6 +278,16 @@ export const PLATFORM_PROXY_MANIFEST_TEMPLATE: PlatformProxyManifestTemplate = {
 						admission: null,
 						oauth: null,
 					},
+					{
+						id: 'github-setup',
+						kind: 'service',
+						method: 'GET',
+						path: '/api/source/github/setup/:connectionId',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
 					{
 						id: 'rpc',
 						kind: 'service',
@@ -453,6 +463,16 @@ export const PLATFORM_PROXY_MANIFEST_TEMPLATE: PlatformProxyManifestTemplate = {
 						admission: null,
 						oauth: null,
 					},
+					{
+						id: 'github-setup',
+						kind: 'service',
+						method: 'GET',
+						path: '/api/source/github/setup/:connectionId',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
 					{
 						id: 'rpc',
 						kind: 'service',