@fluid-app/fluid-cli-droplets 0.1.198 → 0.1.199

package/src/manifest/publish.ts

@@ -0,0 +1,116 @@
+import { manifestDigest } from "./canonical.js";
+import type { Finding, Manifest } from "./validate.js";
+
+export class ManifestError extends Error {
+  constructor(
+    public code: string,
+    public exitCode = 1,
+    public details?: unknown,
+  ) {
+    super(code);
+  }
+}
+
+async function request(
+  url: string,
+  token: string,
+  body?: unknown,
+): Promise<Record<string, unknown>> {
+  let response: Response;
+  try {
+    response = await fetch(url, {
+      method: body === undefined ? "GET" : "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(30_000),
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+      },
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    });
+  } catch {
+    throw new ManifestError("Publisher request failed");
+  }
+  let result;
+  try {
+    result = await response.json();
+  } catch {
+    throw new ManifestError("Invalid publisher response");
+  }
+  if (!response.ok) {
+    const code = result?.error?.details?.code ?? `HTTP ${response.status}`;
+    throw new ManifestError(
+      code,
+      code === "widening_not_allowed" ? 3 : code === "manifest_invalid" ? 2 : 1,
+      code === "manifest_invalid" &&
+        Array.isArray(result?.error?.details?.details)
+        ? result.error.details.details.map(
+            ({ pointer, code, detail }: Finding) => ({ pointer, code, detail }),
+          )
+        : undefined,
+    );
+  }
+  return result;
+}
+
+/** Public: Publish or preview using only GitHub OIDC and a single-use grant. */
+export async function publishManifest(
+  manifest: Manifest,
+  baseUrl: string,
+  dryRun: boolean,
+  allowWidening: boolean,
+): Promise<Record<string, unknown>> {
+  const base = new URL(baseUrl);
+  if (
+    !(
+      (base.origin === "https://api.fluid.app" &&
+        !base.username &&
+        !base.password) ||
+      (["http:", "https:"].includes(base.protocol) &&
+        ["localhost", "127.0.0.1", "[::1]"].includes(base.hostname))
+    )
+  )
+    throw new ManifestError(
+      `Rejected publisher host ${base.hostname}; allowed: https://api.fluid.app; HTTP/HTTPS localhost, 127.0.0.1, [::1]`,
+    );
+  const required = [
+    "ACTIONS_ID_TOKEN_REQUEST_URL",
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+  ];
+  const missing = required.filter((key) => !process.env[key]);
+  if (process.env.GITHUB_ACTIONS !== "true")
+    missing.unshift("GITHUB_ACTIONS=true");
+  if (missing.length)
+    throw new ManifestError(
+      `Actions only: missing ${missing.join(", ")}; configure permissions: id-token: write`,
+    );
+  const digest = manifestDigest(manifest);
+  const oidcUrl = new URL(process.env.ACTIONS_ID_TOKEN_REQUEST_URL!);
+  oidcUrl.searchParams.set(
+    "audience",
+    "https://api.fluid.app/droplets/manifest",
+  );
+  const oidc = await request(
+    oidcUrl.toString(),
+    process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN!,
+  );
+  if (typeof oidc.value !== "string" || !oidc.value)
+    throw new ManifestError("Missing OIDC token");
+  const prefix = `${baseUrl.replace(/\/$/, "")}/api/droplets/v2026-10`;
+  const grant = await request(`${prefix}/publish-grants`, oidc.value, {
+    droplet_uuid: manifest.droplet,
+    digest,
+  });
+  const token = (grant.publish_grant as { token?: unknown } | undefined)?.token;
+  if (typeof token !== "string" || !token)
+    throw new ManifestError("Missing publish grant");
+  return request(
+    `${prefix}/manifest-publications${dryRun ? "?dry_run=true" : ""}`,
+    token,
+    {
+      manifest,
+      digest,
+      ...(dryRun || allowWidening ? { allow_widening: true } : {}),
+    },
+  );
+}

package/src/manifest/validate.ts

@@ -0,0 +1,163 @@
+import Ajv2020 from "ajv/dist/2020.js";
+import schema from "../../../../../apps/rails/config/droplet_manifest/v1.schema.json";
+
+export { schema };
+export const AUTHORITY =
+  "The server is authoritative and checks additional catalogs, scope ceilings and publisher identity.";
+export interface Finding {
+  pointer: string;
+  code: string;
+  detail: string;
+}
+export interface Manifest {
+  droplet: string;
+  version: string;
+  [key: string]: unknown;
+}
+const checkSchema = new Ajv2020({
+  allErrors: true,
+  strict: false,
+}).compile<Manifest>(schema);
+
+function compareVersion(a: string, b: string): number {
+  const split = (v: string) =>
+    v
+      .split("+")[0]!
+      .match(/^(\d+)\.(\d+)\.(\d+)(?:-(.*))?$/)!
+      .slice(1);
+  const aa = split(a),
+    bb = split(b);
+  const compare = (x: string, y: string): number => {
+    if (x === y) return 0;
+    const xn = /^\d+$/.test(x),
+      yn = /^\d+$/.test(y);
+    if (xn && yn) return BigInt(x) < BigInt(y) ? -1 : 1;
+    return xn !== yn ? (xn ? -1 : 1) : x < y ? -1 : 1;
+  };
+  for (let i = 0; i < 3; i++) {
+    const n = compare(aa[i]!, bb[i]!);
+    if (n) return n;
+  }
+  const ap = aa[3],
+    bp = bb[3];
+  if (ap === undefined || bp === undefined)
+    return ap === bp ? 0 : ap === undefined ? 1 : -1;
+  const ax = ap.split("."),
+    bx = bp.split(".");
+  for (let i = 0; i < Math.max(ax.length, bx.length); i++) {
+    if (ax[i] === undefined || bx[i] === undefined)
+      return ax.length < bx.length ? -1 : 1;
+    const n = compare(ax[i]!, bx[i]!);
+    if (n) return n;
+  }
+  return 0;
+}
+
+/** Public: Validate locally expressible manifest rules; the server checks the rest. */
+export function validateManifest(text: string): {
+  manifest?: Manifest;
+  errors: Finding[];
+} {
+  const errors: Finding[] = [];
+  const add = (pointer: string, code: string, detail = code) =>
+    errors.push({ pointer, code, detail });
+  if (Buffer.byteLength(text) > 256 * 1024) {
+    add("/", "manifest_too_large");
+    return { errors };
+  }
+  let value: unknown;
+  try {
+    value = JSON.parse(text);
+    const stack: Set<string>[] = [];
+    for (const token of text.matchAll(/"(?:[^"\\]|\\.)*"\s*:?|[{}]/g)) {
+      const t = token[0];
+      if (t === "{") stack.push(new Set());
+      else if (t === "}") stack.pop();
+      else if (t.endsWith(":")) {
+        const key: string = JSON.parse(t.slice(0, -1));
+        if (stack.at(-1)?.has(key)) throw new Error("duplicate key");
+        stack.at(-1)?.add(key);
+      }
+    }
+  } catch {
+    add("", "invalid_json", "Invalid JSON or duplicate object keys");
+    return { errors };
+  }
+  function walk(node: unknown, pointer: string): void {
+    if (
+      typeof node === "number" &&
+      (!Number.isFinite(node) || Math.abs(node) > Number.MAX_SAFE_INTEGER)
+    )
+      add(pointer, "invalid_number");
+    if (typeof node === "string" && !node.isWellFormed())
+      add(pointer, "invalid_json", "Invalid Unicode");
+    if (node && typeof node === "object")
+      for (const [key, item] of Object.entries(node)) {
+        if (!key.isWellFormed())
+          add(pointer, "invalid_json", "Invalid Unicode key");
+        walk(
+          item,
+          `${pointer}/${key.replaceAll("~", "~0").replaceAll("/", "~1")}`,
+        );
+      }
+    if (
+      typeof node === "string" &&
+      /^\/(webhooks\/\d+\/url_path|callbacks\/\d+\/url_path|embeds\/(detail_page|drop_zones\/\d+)|health\/path|lifecycle\/(install|uninstall|events)_webhook_path)$/.test(
+        pointer,
+      )
+    ) {
+      if (
+        !/^\/(?!\/)[^@\\?#\s]*$/.test(node) ||
+        /[^\x21-\x7e]|%(?![\da-f]{2})|[<>"{}|^`[\]]/i.test(node) ||
+        /%(2f|5c)/i.test(node) ||
+        /(?:^|\/)(?:\.|%2e){1,2}(?:\/|$)/i.test(node)
+      )
+        add(pointer, "invalid_path");
+    }
+  }
+  walk(value, "");
+  if (
+    value &&
+    typeof value === "object" &&
+    "manifest_version" in value &&
+    value.manifest_version !== 1
+  ) {
+    add("/manifest_version", "unsupported_manifest_version");
+    return { errors };
+  }
+  if (!checkSchema(value)) {
+    for (const e of checkSchema.errors ?? [])
+      add(e.instancePath, "schema_violation", e.message ?? e.keyword);
+    return { errors };
+  }
+  try {
+    const origin = new URL(String(value.origin));
+    if (
+      origin.protocol !== "https:" ||
+      origin.username ||
+      origin.password ||
+      !/^https:\/\/[^/]+$/.test(String(value.origin))
+    )
+      throw new Error();
+  } catch {
+    add("/origin", "origin_not_https");
+  }
+  if (
+    typeof value.min_supported_version === "string" &&
+    compareVersion(value.min_supported_version, value.version) > 0
+  )
+    add("/min_supported_version", "min_supported_version_exceeds_version");
+  for (const [field, key, code] of [
+    ["callbacks", "definition", "definition_not_unique"],
+    ["webhooks", "topic", "webhook_not_unique"],
+  ]) {
+    const seen = new Set<unknown>();
+    const rows = value[field!];
+    if (Array.isArray(rows))
+      rows.forEach((row: Record<string, unknown>, i) => {
+        if (seen.has(row[key!])) add(`/${field}/${i}/${key}`, code!);
+        seen.add(row[key!]);
+      });
+  }
+  return { manifest: errors.length ? undefined : value, errors };
+}

package/tsconfig.json

@@ -2,9 +2,13 @@
   "extends": "@fluid-app/typescript-config/base.json",
   "compilerOptions": {
     "outDir": "./dist",
-    "rootDir": "./src",
-    "incremental": false
+    "rootDir": "../../..",
+    "incremental": false,
+    "lib": ["ES2024", "DOM", "DOM.Iterable"]
   },
-  "include": ["src/**/*"],
+  "include": [
+    "src/**/*",
+    "../../../apps/rails/config/droplet_manifest/v1.schema.json"
+  ],
   "exclude": ["node_modules", "dist"]
 }