@git.zone/cli 2.22.0 → 2.24.0

package/ts/mod_services/classes.serviceconfiguration.ts

@@ -2,6 +2,14 @@ import * as plugins from './mod.plugins.js';
 import * as helpers from './helpers.js';
 import { logger } from '../gitzone.logging.js';
 import { DockerContainer } from './classes.dockercontainer.js';
+import { getServiceDataDirectory } from './classes.servicedatamarker.js';
+
+/** Hosts that are considered local for the purposes of the no-auth guard. */
+const localMongoHosts = ['localhost', '127.0.0.1', '::1'];
+
+export const isLocalMongoHost = (hostArg: string): boolean => {
+  return localMongoHosts.includes(hostArg.trim().toLowerCase());
+};
 
 export interface IServiceConfig {
   PROJECT_NAME: string;
@@ -11,6 +19,12 @@ export interface IServiceConfig {
   MONGODB_USER: string;
   MONGODB_PASS: string;
   MONGODB_URL: string;
+  /**
+   * When false, mongod runs without authentication and is published on
+   * loopback only. Opt-in, for runtimes whose `node:crypto` cannot complete a
+   * SCRAM handshake (notably Deno). Defaults to true.
+   */
+  MONGODB_AUTH_ENABLED: boolean;
   S3_HOST: string;
   S3_PORT: string;
   S3_CONSOLE_PORT: string;
@@ -61,6 +75,67 @@ export class ServiceConfiguration {
   public getConfig(): IServiceConfig {
     return this.config;
   }
+
+  /**
+   * Whether mongod should enforce authentication. Defaults to true; only an
+   * explicit `false` in `.nogit/env.json` disables it.
+   */
+  public isMongoAuthEnabled(): boolean {
+    return this.config.MONGODB_AUTH_ENABLED !== false;
+  }
+
+  /**
+   * Build MONGODB_URL from the current fields.
+   *
+   * Credentials are omitted entirely when auth is disabled, so the stored URL
+   * never advertises a username that mongod would not accept.
+   */
+  private buildMongoUrl(): string {
+    const credentials = this.isMongoAuthEnabled()
+      ? `${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@`
+      : '';
+    const authQuery = this.isMongoAuthEnabled() ? '?authSource=admin' : '';
+    return `mongodb://${credentials}${this.config.MONGODB_HOST}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}${authQuery}`;
+  }
+
+  /**
+   * Recompute every derived field from the primitive ones.
+   */
+  private updateDerivedFields(): void {
+    this.config.MONGODB_URL = this.buildMongoUrl();
+    this.config.S3_ENDPOINT = this.config.S3_HOST;
+    this.config.ELASTICSEARCH_URL = `http://${this.config.ELASTICSEARCH_USER}:${this.config.ELASTICSEARCH_PASS}@${this.config.ELASTICSEARCH_HOST}:${this.config.ELASTICSEARCH_PORT}`;
+  }
+
+  /**
+   * Refuse an unauthenticated mongod that would be reachable off-host.
+   *
+   * Disabling auth is only defensible while the database is bound to loopback.
+   * Rather than trusting the operator to keep MONGODB_HOST local, this fails
+   * closed on the combination.
+   */
+  public assertMongoExposureIsSafe(): void {
+    if (this.isMongoAuthEnabled()) {
+      return;
+    }
+    if (!isLocalMongoHost(this.config.MONGODB_HOST)) {
+      throw new Error(
+        `Refusing to run MongoDB without authentication on non-local host "${this.config.MONGODB_HOST}". ` +
+          'Set MONGODB_HOST to localhost in .nogit/env.json, or re-enable auth with ' +
+          '`gitzone services auth mongodb on`.',
+      );
+    }
+  }
+
+  /**
+   * Persist the MongoDB auth mode and recompute derived fields.
+   */
+  public async setMongoAuthEnabled(enabledArg: boolean): Promise<void> {
+    this.config.MONGODB_AUTH_ENABLED = enabledArg;
+    this.updateDerivedFields();
+    this.assertMongoExposureIsSafe();
+    await this.saveConfig();
+  }
   
   /**
    * Save the configuration to file
@@ -132,6 +207,7 @@ export class ServiceConfiguration {
       MONGODB_USER: mongoUser,
       MONGODB_PASS: mongoPass,
       MONGODB_URL: `mongodb://${mongoUser}:${mongoPass}@${mongoHost}:${mongoPortStr}/${mongoName}?authSource=admin`,
+      MONGODB_AUTH_ENABLED: true,
       S3_HOST: s3Host,
       S3_PORT: s3PortStr,
       S3_CONSOLE_PORT: s3ConsolePort.toString(),
@@ -202,9 +278,15 @@ export class ServiceConfiguration {
       updated = true;
     }
     
+    if (this.config.MONGODB_AUTH_ENABLED === undefined) {
+      this.config.MONGODB_AUTH_ENABLED = true;
+      fieldsAdded.push('MONGODB_AUTH_ENABLED');
+      updated = true;
+    }
+
     // Always update MONGODB_URL based on current settings
     const oldUrl = this.config.MONGODB_URL;
-    this.config.MONGODB_URL = `mongodb://${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@${this.config.MONGODB_HOST}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?authSource=admin`;
+    this.config.MONGODB_URL = this.buildMongoUrl();
     if (oldUrl !== this.config.MONGODB_URL) {
       fieldsAdded.push('MONGODB_URL');
       updated = true;
@@ -254,7 +336,9 @@ export class ServiceConfiguration {
       updated = true;
     }
     
-    if (!this.config.S3_USESSL) {
+    // `undefined`, not falsy: a stored `false` is a valid value, and treating it
+    // as missing made every run report S3_USESSL as newly added.
+    if (this.config.S3_USESSL === undefined) {
       this.config.S3_USESSL = false;
       fieldsAdded.push('S3_USESSL');
       updated = true;
@@ -313,7 +397,11 @@ export class ServiceConfiguration {
    */
   public getMongoConnectionString(useNetworkIp: boolean = false): string {
     const host = useNetworkIp ? '${networkIp}' : this.config.MONGODB_HOST;
-    return `mongodb://${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@${host}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?authSource=admin`;
+    const credentials = this.isMongoAuthEnabled()
+      ? `${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@`
+      : '';
+    const authQuery = this.isMongoAuthEnabled() ? 'authSource=admin&' : '';
+    return `mongodb://${credentials}${host}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?${authQuery}directConnection=true`;
   }
   
   /**
@@ -328,13 +416,16 @@ export class ServiceConfiguration {
   }
 
   /**
-   * Get data directories
+   * Get data directories.
+   *
+   * Derived through `getServiceDataDirectory` so that creation here and
+   * reclamation in `ServicePruner` can never disagree about the shape.
    */
   public getDataDirectories() {
     return {
-      mongo: plugins.path.join(process.cwd(), '.nogit', 'mongodata'),
-      minio: plugins.path.join(process.cwd(), '.nogit', 'miniodata'),
-      elasticsearch: plugins.path.join(process.cwd(), '.nogit', 'esdata')
+      mongo: getServiceDataDirectory(process.cwd(), 'mongodb'),
+      minio: getServiceDataDirectory(process.cwd(), 'minio'),
+      elasticsearch: getServiceDataDirectory(process.cwd(), 'elasticsearch')
     };
   }
   
@@ -349,8 +440,10 @@ export class ServiceConfiguration {
     const mongoStatus = await this.docker.getStatus(containers.mongo);
     if (mongoStatus !== 'not_exists') {
       const portMappings = await this.docker.getPortMappings(containers.mongo);
-      if (portMappings && portMappings['27017']) {
-        const dockerPort = portMappings['27017'];
+      // legacy containers map 27017; replica-set containers map port:port
+      const dockerPort =
+        portMappings && (portMappings['27017'] ?? Object.values(portMappings)[0]);
+      if (dockerPort) {
         if (this.config.MONGODB_PORT !== dockerPort) {
           logger.log('note', `📍 Syncing MongoDB port from Docker: ${dockerPort}`);
           this.config.MONGODB_PORT = dockerPort;
@@ -398,11 +491,7 @@ export class ServiceConfiguration {
     }
 
     if (updated) {
-      // Update derived fields
-      this.config.MONGODB_URL = `mongodb://${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@${this.config.MONGODB_HOST}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?authSource=admin`;
-      this.config.S3_ENDPOINT = this.config.S3_HOST;
-      this.config.ELASTICSEARCH_URL = `http://${this.config.ELASTICSEARCH_USER}:${this.config.ELASTICSEARCH_PASS}@${this.config.ELASTICSEARCH_HOST}:${this.config.ELASTICSEARCH_PORT}`;
-
+      this.updateDerivedFields();
       await this.saveConfig();
       logger.log('ok', '✅ Configuration synced with Docker containers');
     }
@@ -468,11 +557,7 @@ export class ServiceConfiguration {
     }
 
     if (updated) {
-      // Update derived fields
-      this.config.MONGODB_URL = `mongodb://${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@${this.config.MONGODB_HOST}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?authSource=admin`;
-      this.config.S3_ENDPOINT = this.config.S3_HOST;
-      this.config.ELASTICSEARCH_URL = `http://${this.config.ELASTICSEARCH_USER}:${this.config.ELASTICSEARCH_PASS}@${this.config.ELASTICSEARCH_HOST}:${this.config.ELASTICSEARCH_PORT}`;
-
+      this.updateDerivedFields();
       await this.saveConfig();
     }
 
@@ -502,11 +587,7 @@ export class ServiceConfiguration {
     this.config.S3_CONSOLE_PORT = s3ConsolePort.toString();
     this.config.ELASTICSEARCH_PORT = esPort;
 
-    // Update derived fields
-    this.config.MONGODB_URL = `mongodb://${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@${this.config.MONGODB_HOST}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?authSource=admin`;
-    this.config.S3_ENDPOINT = this.config.S3_HOST;
-    this.config.ELASTICSEARCH_URL = `http://${this.config.ELASTICSEARCH_USER}:${this.config.ELASTICSEARCH_PASS}@${this.config.ELASTICSEARCH_HOST}:${this.config.ELASTICSEARCH_PORT}`;
-
+    this.updateDerivedFields();
     await this.saveConfig();
 
     logger.log('ok', '✅ New port configuration:');

package/ts/mod_services/classes.servicedatamarker.ts

@@ -0,0 +1,228 @@
+import * as plugins from './mod.plugins.js';
+
+/**
+ * Canonical service identifiers used across mod_services.
+ *
+ * These intentionally mirror the values stored in `@git.zone/cli.services`.
+ * That configuration array is a *deployment* input consumed by
+ * `@git.zone/tsdeploy` (`deriveRequiredCapabilities`), so the strings and the
+ * array shape must never change here.
+ */
+export type TServiceName = 'mongodb' | 'minio' | 'elasticsearch';
+
+export const serviceNames: TServiceName[] = ['mongodb', 'minio', 'elasticsearch'];
+
+/** Owner recorded in markers and container labels. */
+export const serviceDataOwner = '@git.zone/cli';
+
+/** Value of the `git.zone.tool` label on containers created by `gitzone services`. */
+export const serviceToolLabel = 'gitzone-services';
+
+/** Marker file name, stored in `<projectPath>/.nogit/`. */
+export const serviceDataMarkerFile = '.gitzone-services.json';
+
+/**
+ * Directory basename used below `.nogit/` for each service's bind-mounted data.
+ * This mapping is the only shape `gitzone services` ever creates, and prune
+ * refuses to touch anything that does not match it exactly.
+ */
+export const serviceDataDirectoryNames: { [key in TServiceName]: string } = {
+  mongodb: 'mongodata',
+  minio: 'miniodata',
+  elasticsearch: 'esdata',
+};
+
+/**
+ * Image used to run each service, and therefore the image available to perform
+ * a privileged cleanup of that service's data directory: if the data exists,
+ * the service ran, so its image is present locally.
+ */
+export const serviceImages: { [key in TServiceName]: string } = {
+  mongodb: 'mongo:7.0',
+  minio: 'minio/minio',
+  elasticsearch: 'elasticsearch:8.11.0',
+};
+
+export interface IServiceDataMarkerEntry {
+  service: TServiceName;
+  path: string;
+}
+
+export interface IServiceDataMarker {
+  owner: string;
+  kind: 'service-data';
+  schemaVersion: 1;
+  projectPath: string;
+  safeToPrune: true;
+  createdAt: string;
+  dataDirectories: IServiceDataMarkerEntry[];
+}
+
+const isPlainObject = (value: unknown): value is Record<string, any> => {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+};
+
+/** Absolute path of the marker file for a project. */
+export const getServiceDataMarkerPath = (projectPathArg: string): string => {
+  return plugins.path.join(plugins.path.resolve(projectPathArg), '.nogit', serviceDataMarkerFile);
+};
+
+/**
+ * Expected absolute data directory path for a service in a project.
+ * `mod_services` must always derive data paths through this helper so that
+ * creation and reclamation agree on a single shape.
+ */
+export const getServiceDataDirectory = (
+  projectPathArg: string,
+  serviceArg: TServiceName,
+): string => {
+  return plugins.path.join(
+    plugins.path.resolve(projectPathArg),
+    '.nogit',
+    serviceDataDirectoryNames[serviceArg],
+  );
+};
+
+/**
+ * True only when `candidatePathArg` is exactly one of the three data
+ * directories `gitzone services` creates for `projectPathArg`.
+ *
+ * This is an allowlist, not a denylist: any path that is not byte-for-byte one
+ * of the expected resolved paths is rejected. It is the last line of defence
+ * before a recursive delete.
+ */
+export const isSafeServiceDataPath = (
+  projectPathArg: string,
+  candidatePathArg: string,
+): boolean => {
+  const candidate = plugins.path.resolve(candidatePathArg);
+  for (const service of serviceNames) {
+    if (getServiceDataDirectory(projectPathArg, service) === candidate) {
+      return true;
+    }
+  }
+  return false;
+};
+
+/** Validate an unknown value as a usable marker. */
+export const isValidServiceDataMarker = (markerArg: unknown): markerArg is IServiceDataMarker => {
+  if (!isPlainObject(markerArg)) {
+    return false;
+  }
+  if (markerArg.owner !== serviceDataOwner) {
+    return false;
+  }
+  if (markerArg.kind !== 'service-data') {
+    return false;
+  }
+  if (markerArg.schemaVersion !== 1) {
+    return false;
+  }
+  if (markerArg.safeToPrune !== true) {
+    return false;
+  }
+  if (typeof markerArg.projectPath !== 'string' || !markerArg.projectPath) {
+    return false;
+  }
+  if (!Array.isArray(markerArg.dataDirectories)) {
+    return false;
+  }
+  for (const entry of markerArg.dataDirectories) {
+    if (!isPlainObject(entry)) {
+      return false;
+    }
+    if (!serviceNames.includes(entry.service)) {
+      return false;
+    }
+    if (typeof entry.path !== 'string' || !entry.path) {
+      return false;
+    }
+  }
+  return true;
+};
+
+/** Read and validate the marker for a project, or undefined when absent/invalid. */
+export const readServiceDataMarker = async (
+  projectPathArg: string,
+): Promise<IServiceDataMarker | undefined> => {
+  const markerPath = getServiceDataMarkerPath(projectPathArg);
+  try {
+    if (!(await plugins.smartfs.file(markerPath).exists())) {
+      return undefined;
+    }
+    const content = (await plugins.smartfs.file(markerPath).encoding('utf8').read()) as string;
+    const parsed = JSON.parse(content);
+    return isValidServiceDataMarker(parsed) ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+/**
+ * Record that `gitzone services` owns a data directory for this project.
+ *
+ * The marker lives in `.nogit/` rather than inside the bind-mounted data
+ * directory itself, so it can never confuse mongod, MinIO or Elasticsearch at
+ * runtime. Entries are merged so enabling a service later does not drop the
+ * claim on previously created directories.
+ */
+export const recordServiceDataDirectory = async (
+  projectPathArg: string,
+  serviceArg: TServiceName,
+): Promise<void> => {
+  const projectPath = plugins.path.resolve(projectPathArg);
+  const dataPath = getServiceDataDirectory(projectPath, serviceArg);
+  const existingMarker = await readServiceDataMarker(projectPath);
+
+  const entries: IServiceDataMarkerEntry[] = existingMarker
+    ? existingMarker.dataDirectories.filter((entry) => entry.service !== serviceArg)
+    : [];
+  entries.push({ service: serviceArg, path: dataPath });
+  entries.sort((entryA, entryB) => entryA.service.localeCompare(entryB.service));
+
+  const marker: IServiceDataMarker = {
+    owner: serviceDataOwner,
+    kind: 'service-data',
+    schemaVersion: 1,
+    projectPath,
+    safeToPrune: true,
+    createdAt: existingMarker?.createdAt || new Date().toISOString(),
+    dataDirectories: entries,
+  };
+
+  const markerPath = getServiceDataMarkerPath(projectPath);
+  await plugins.smartfs.directory(plugins.path.dirname(markerPath)).recursive().create();
+  await plugins.smartfs
+    .file(markerPath)
+    .encoding('utf8')
+    .write(`${JSON.stringify(marker, null, 2)}\n`);
+};
+
+/**
+ * Labels applied to every container `gitzone services` creates.
+ *
+ * Mirrors the `git.zone.*` namespace already established by
+ * `@git.zone/tsdocker` so prune logic can identify tool-owned resources
+ * without ever matching on image or bare name.
+ */
+export const getServiceContainerLabels = (optionsArg: {
+  projectPath: string;
+  service: TServiceName;
+  dataPath: string;
+}): { [key: string]: string } => {
+  return {
+    'git.zone.tool': serviceToolLabel,
+    'git.zone.service': optionsArg.service,
+    'git.zone.project-path': plugins.path.resolve(optionsArg.projectPath),
+    'git.zone.data-path': plugins.path.resolve(optionsArg.dataPath),
+    'git.zone.safe-to-prune': 'true',
+  };
+};
+
+/** True when a container's labels prove `gitzone services` created it. */
+export const isServiceOwnedByLabels = (labelsArg: { [key: string]: string }): boolean => {
+  return (
+    labelsArg['git.zone.tool'] === serviceToolLabel &&
+    labelsArg['git.zone.safe-to-prune'] === 'true'
+  );
+};