@git.zone/cli 2.23.0 → 2.25.0

package/ts/mod_services/classes.serviceconfiguration.ts

@@ -2,6 +2,20 @@ import * as plugins from './mod.plugins.js';
 import * as helpers from './helpers.js';
 import { logger } from '../gitzone.logging.js';
 import { DockerContainer } from './classes.dockercontainer.js';
+import { getServiceDataDirectory } from './classes.servicedatamarker.js';
+import {
+  readServiceOptions,
+  resolveMongoAuth,
+  writeMongodbAuthOption,
+  type TServiceOptionSource,
+} from './classes.serviceoptions.js';
+
+/** Hosts that are considered local for the purposes of the no-auth guard. */
+const localMongoHosts = ['localhost', '127.0.0.1', '::1'];
+
+export const isLocalMongoHost = (hostArg: string): boolean => {
+  return localMongoHosts.includes(hostArg.trim().toLowerCase());
+};
 
 export interface IServiceConfig {
   PROJECT_NAME: string;
@@ -11,6 +25,12 @@ export interface IServiceConfig {
   MONGODB_USER: string;
   MONGODB_PASS: string;
   MONGODB_URL: string;
+  /**
+   * When false, mongod runs without authentication and is published on
+   * loopback only. Opt-in, for runtimes whose `node:crypto` cannot complete a
+   * SCRAM handshake (notably Deno). Defaults to true.
+   */
+  MONGODB_AUTH_ENABLED: boolean;
   S3_HOST: string;
   S3_PORT: string;
   S3_CONSOLE_PORT: string;
@@ -30,30 +50,60 @@ export class ServiceConfiguration {
   private configPath: string;
   private config!: IServiceConfig;
   private docker: DockerContainer;
-  
+  /** Where the effective MongoDB auth mode came from. */
+  private mongoAuthSource: TServiceOptionSource = 'default';
+
   constructor() {
     this.configPath = plugins.path.join(process.cwd(), '.nogit', 'env.json');
     this.docker = new DockerContainer();
   }
-  
+
   /**
    * Load or create the configuration
    */
   public async loadOrCreate(): Promise<IServiceConfig> {
     await this.ensureNogitDirectory();
-    
+
     if (await this.configExists()) {
       await this.loadConfig();
       await this.updateMissingFields();
     } else {
       await this.createDefaultConfig();
     }
-    
+
+    // A committed declaration in .smartconfig.json overrides the local runtime
+    // value, so a fresh checkout reproduces the declared setup.
+    await this.applyDeclaredServiceOptions();
+
     // Sync ports from existing Docker containers if they exist
     await this.syncPortsFromDocker();
-    
+
     return this.config;
   }
+
+  /**
+   * Fold `@git.zone/cli.serviceOptions` into the runtime configuration.
+   */
+  private async applyDeclaredServiceOptions(): Promise<void> {
+    const declaredOptions = await readServiceOptions(process.cwd());
+    const resolved = resolveMongoAuth(declaredOptions, this.config.MONGODB_AUTH_ENABLED);
+    this.mongoAuthSource = resolved.source;
+
+    if (this.config.MONGODB_AUTH_ENABLED !== resolved.authEnabled) {
+      this.config.MONGODB_AUTH_ENABLED = resolved.authEnabled;
+      this.updateDerivedFields();
+      await this.saveConfig();
+      logger.log(
+        'note',
+        `📍 MongoDB auth ${resolved.authEnabled ? 'enabled' : 'disabled'} by .smartconfig.json declaration`,
+      );
+    }
+  }
+
+  /** Where the effective MongoDB auth mode came from. */
+  public getMongoAuthSource(): TServiceOptionSource {
+    return this.mongoAuthSource;
+  }
   
   /**
    * Get the current configuration
@@ -61,6 +111,73 @@ export class ServiceConfiguration {
   public getConfig(): IServiceConfig {
     return this.config;
   }
+
+  /**
+   * Whether mongod should enforce authentication. Defaults to true; only an
+   * explicit `false` in `.nogit/env.json` disables it.
+   */
+  public isMongoAuthEnabled(): boolean {
+    return this.config.MONGODB_AUTH_ENABLED !== false;
+  }
+
+  /**
+   * Build MONGODB_URL from the current fields.
+   *
+   * Credentials are omitted entirely when auth is disabled, so the stored URL
+   * never advertises a username that mongod would not accept.
+   */
+  private buildMongoUrl(): string {
+    const credentials = this.isMongoAuthEnabled()
+      ? `${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@`
+      : '';
+    const authQuery = this.isMongoAuthEnabled() ? '?authSource=admin' : '';
+    return `mongodb://${credentials}${this.config.MONGODB_HOST}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}${authQuery}`;
+  }
+
+  /**
+   * Recompute every derived field from the primitive ones.
+   */
+  private updateDerivedFields(): void {
+    this.config.MONGODB_URL = this.buildMongoUrl();
+    this.config.S3_ENDPOINT = this.config.S3_HOST;
+    this.config.ELASTICSEARCH_URL = `http://${this.config.ELASTICSEARCH_USER}:${this.config.ELASTICSEARCH_PASS}@${this.config.ELASTICSEARCH_HOST}:${this.config.ELASTICSEARCH_PORT}`;
+  }
+
+  /**
+   * Refuse an unauthenticated mongod that would be reachable off-host.
+   *
+   * Disabling auth is only defensible while the database is bound to loopback.
+   * Rather than trusting the operator to keep MONGODB_HOST local, this fails
+   * closed on the combination.
+   */
+  public assertMongoExposureIsSafe(): void {
+    if (this.isMongoAuthEnabled()) {
+      return;
+    }
+    if (!isLocalMongoHost(this.config.MONGODB_HOST)) {
+      throw new Error(
+        `Refusing to run MongoDB without authentication on non-local host "${this.config.MONGODB_HOST}". ` +
+          'Set MONGODB_HOST to localhost in .nogit/env.json, or re-enable auth with ' +
+          '`gitzone services auth mongodb on`.',
+      );
+    }
+  }
+
+  /**
+   * Persist the MongoDB auth mode.
+   *
+   * Written to both `.smartconfig.json` (the committed declaration, so a fresh
+   * checkout or CI reproduces it) and `.nogit/env.json` (the resolved runtime
+   * value consumed by tooling). Writing both keeps them from drifting.
+   */
+  public async setMongoAuthEnabled(enabledArg: boolean): Promise<void> {
+    this.config.MONGODB_AUTH_ENABLED = enabledArg;
+    this.updateDerivedFields();
+    this.assertMongoExposureIsSafe();
+    await this.saveConfig();
+    await writeMongodbAuthOption(enabledArg, process.cwd());
+    this.mongoAuthSource = enabledArg ? 'default' : 'declared';
+  }
   
   /**
    * Save the configuration to file
@@ -132,6 +249,7 @@ export class ServiceConfiguration {
       MONGODB_USER: mongoUser,
       MONGODB_PASS: mongoPass,
       MONGODB_URL: `mongodb://${mongoUser}:${mongoPass}@${mongoHost}:${mongoPortStr}/${mongoName}?authSource=admin`,
+      MONGODB_AUTH_ENABLED: true,
       S3_HOST: s3Host,
       S3_PORT: s3PortStr,
       S3_CONSOLE_PORT: s3ConsolePort.toString(),
@@ -202,9 +320,15 @@ export class ServiceConfiguration {
       updated = true;
     }
     
+    if (this.config.MONGODB_AUTH_ENABLED === undefined) {
+      this.config.MONGODB_AUTH_ENABLED = true;
+      fieldsAdded.push('MONGODB_AUTH_ENABLED');
+      updated = true;
+    }
+
     // Always update MONGODB_URL based on current settings
     const oldUrl = this.config.MONGODB_URL;
-    this.config.MONGODB_URL = `mongodb://${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@${this.config.MONGODB_HOST}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?authSource=admin`;
+    this.config.MONGODB_URL = this.buildMongoUrl();
     if (oldUrl !== this.config.MONGODB_URL) {
       fieldsAdded.push('MONGODB_URL');
       updated = true;
@@ -254,7 +378,9 @@ export class ServiceConfiguration {
       updated = true;
     }
     
-    if (!this.config.S3_USESSL) {
+    // `undefined`, not falsy: a stored `false` is a valid value, and treating it
+    // as missing made every run report S3_USESSL as newly added.
+    if (this.config.S3_USESSL === undefined) {
       this.config.S3_USESSL = false;
       fieldsAdded.push('S3_USESSL');
       updated = true;
@@ -313,7 +439,11 @@ export class ServiceConfiguration {
    */
   public getMongoConnectionString(useNetworkIp: boolean = false): string {
     const host = useNetworkIp ? '${networkIp}' : this.config.MONGODB_HOST;
-    return `mongodb://${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@${host}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?authSource=admin&directConnection=true`;
+    const credentials = this.isMongoAuthEnabled()
+      ? `${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@`
+      : '';
+    const authQuery = this.isMongoAuthEnabled() ? 'authSource=admin&' : '';
+    return `mongodb://${credentials}${host}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?${authQuery}directConnection=true`;
   }
   
   /**
@@ -328,13 +458,16 @@ export class ServiceConfiguration {
   }
 
   /**
-   * Get data directories
+   * Get data directories.
+   *
+   * Derived through `getServiceDataDirectory` so that creation here and
+   * reclamation in `ServicePruner` can never disagree about the shape.
    */
   public getDataDirectories() {
     return {
-      mongo: plugins.path.join(process.cwd(), '.nogit', 'mongodata'),
-      minio: plugins.path.join(process.cwd(), '.nogit', 'miniodata'),
-      elasticsearch: plugins.path.join(process.cwd(), '.nogit', 'esdata')
+      mongo: getServiceDataDirectory(process.cwd(), 'mongodb'),
+      minio: getServiceDataDirectory(process.cwd(), 'minio'),
+      elasticsearch: getServiceDataDirectory(process.cwd(), 'elasticsearch')
     };
   }
   
@@ -400,11 +533,7 @@ export class ServiceConfiguration {
     }
 
     if (updated) {
-      // Update derived fields
-      this.config.MONGODB_URL = `mongodb://${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@${this.config.MONGODB_HOST}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?authSource=admin`;
-      this.config.S3_ENDPOINT = this.config.S3_HOST;
-      this.config.ELASTICSEARCH_URL = `http://${this.config.ELASTICSEARCH_USER}:${this.config.ELASTICSEARCH_PASS}@${this.config.ELASTICSEARCH_HOST}:${this.config.ELASTICSEARCH_PORT}`;
-
+      this.updateDerivedFields();
       await this.saveConfig();
       logger.log('ok', '✅ Configuration synced with Docker containers');
     }
@@ -470,11 +599,7 @@ export class ServiceConfiguration {
     }
 
     if (updated) {
-      // Update derived fields
-      this.config.MONGODB_URL = `mongodb://${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@${this.config.MONGODB_HOST}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?authSource=admin`;
-      this.config.S3_ENDPOINT = this.config.S3_HOST;
-      this.config.ELASTICSEARCH_URL = `http://${this.config.ELASTICSEARCH_USER}:${this.config.ELASTICSEARCH_PASS}@${this.config.ELASTICSEARCH_HOST}:${this.config.ELASTICSEARCH_PORT}`;
-
+      this.updateDerivedFields();
       await this.saveConfig();
     }
 
@@ -504,11 +629,7 @@ export class ServiceConfiguration {
     this.config.S3_CONSOLE_PORT = s3ConsolePort.toString();
     this.config.ELASTICSEARCH_PORT = esPort;
 
-    // Update derived fields
-    this.config.MONGODB_URL = `mongodb://${this.config.MONGODB_USER}:${this.config.MONGODB_PASS}@${this.config.MONGODB_HOST}:${this.config.MONGODB_PORT}/${this.config.MONGODB_NAME}?authSource=admin`;
-    this.config.S3_ENDPOINT = this.config.S3_HOST;
-    this.config.ELASTICSEARCH_URL = `http://${this.config.ELASTICSEARCH_USER}:${this.config.ELASTICSEARCH_PASS}@${this.config.ELASTICSEARCH_HOST}:${this.config.ELASTICSEARCH_PORT}`;
-
+    this.updateDerivedFields();
     await this.saveConfig();
 
     logger.log('ok', '✅ New port configuration:');

package/ts/mod_services/classes.servicedatamarker.ts

@@ -0,0 +1,228 @@
+import * as plugins from './mod.plugins.js';
+
+/**
+ * Canonical service identifiers used across mod_services.
+ *
+ * These intentionally mirror the values stored in `@git.zone/cli.services`.
+ * That configuration array is a *deployment* input consumed by
+ * `@git.zone/tsdeploy` (`deriveRequiredCapabilities`), so the strings and the
+ * array shape must never change here.
+ */
+export type TServiceName = 'mongodb' | 'minio' | 'elasticsearch';
+
+export const serviceNames: TServiceName[] = ['mongodb', 'minio', 'elasticsearch'];
+
+/** Owner recorded in markers and container labels. */
+export const serviceDataOwner = '@git.zone/cli';
+
+/** Value of the `git.zone.tool` label on containers created by `gitzone services`. */
+export const serviceToolLabel = 'gitzone-services';
+
+/** Marker file name, stored in `<projectPath>/.nogit/`. */
+export const serviceDataMarkerFile = '.gitzone-services.json';
+
+/**
+ * Directory basename used below `.nogit/` for each service's bind-mounted data.
+ * This mapping is the only shape `gitzone services` ever creates, and prune
+ * refuses to touch anything that does not match it exactly.
+ */
+export const serviceDataDirectoryNames: { [key in TServiceName]: string } = {
+  mongodb: 'mongodata',
+  minio: 'miniodata',
+  elasticsearch: 'esdata',
+};
+
+/**
+ * Image used to run each service, and therefore the image available to perform
+ * a privileged cleanup of that service's data directory: if the data exists,
+ * the service ran, so its image is present locally.
+ */
+export const serviceImages: { [key in TServiceName]: string } = {
+  mongodb: 'mongo:7.0',
+  minio: 'minio/minio',
+  elasticsearch: 'elasticsearch:8.11.0',
+};
+
+export interface IServiceDataMarkerEntry {
+  service: TServiceName;
+  path: string;
+}
+
+export interface IServiceDataMarker {
+  owner: string;
+  kind: 'service-data';
+  schemaVersion: 1;
+  projectPath: string;
+  safeToPrune: true;
+  createdAt: string;
+  dataDirectories: IServiceDataMarkerEntry[];
+}
+
+const isPlainObject = (value: unknown): value is Record<string, any> => {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+};
+
+/** Absolute path of the marker file for a project. */
+export const getServiceDataMarkerPath = (projectPathArg: string): string => {
+  return plugins.path.join(plugins.path.resolve(projectPathArg), '.nogit', serviceDataMarkerFile);
+};
+
+/**
+ * Expected absolute data directory path for a service in a project.
+ * `mod_services` must always derive data paths through this helper so that
+ * creation and reclamation agree on a single shape.
+ */
+export const getServiceDataDirectory = (
+  projectPathArg: string,
+  serviceArg: TServiceName,
+): string => {
+  return plugins.path.join(
+    plugins.path.resolve(projectPathArg),
+    '.nogit',
+    serviceDataDirectoryNames[serviceArg],
+  );
+};
+
+/**
+ * True only when `candidatePathArg` is exactly one of the three data
+ * directories `gitzone services` creates for `projectPathArg`.
+ *
+ * This is an allowlist, not a denylist: any path that is not byte-for-byte one
+ * of the expected resolved paths is rejected. It is the last line of defence
+ * before a recursive delete.
+ */
+export const isSafeServiceDataPath = (
+  projectPathArg: string,
+  candidatePathArg: string,
+): boolean => {
+  const candidate = plugins.path.resolve(candidatePathArg);
+  for (const service of serviceNames) {
+    if (getServiceDataDirectory(projectPathArg, service) === candidate) {
+      return true;
+    }
+  }
+  return false;
+};
+
+/** Validate an unknown value as a usable marker. */
+export const isValidServiceDataMarker = (markerArg: unknown): markerArg is IServiceDataMarker => {
+  if (!isPlainObject(markerArg)) {
+    return false;
+  }
+  if (markerArg.owner !== serviceDataOwner) {
+    return false;
+  }
+  if (markerArg.kind !== 'service-data') {
+    return false;
+  }
+  if (markerArg.schemaVersion !== 1) {
+    return false;
+  }
+  if (markerArg.safeToPrune !== true) {
+    return false;
+  }
+  if (typeof markerArg.projectPath !== 'string' || !markerArg.projectPath) {
+    return false;
+  }
+  if (!Array.isArray(markerArg.dataDirectories)) {
+    return false;
+  }
+  for (const entry of markerArg.dataDirectories) {
+    if (!isPlainObject(entry)) {
+      return false;
+    }
+    if (!serviceNames.includes(entry.service)) {
+      return false;
+    }
+    if (typeof entry.path !== 'string' || !entry.path) {
+      return false;
+    }
+  }
+  return true;
+};
+
+/** Read and validate the marker for a project, or undefined when absent/invalid. */
+export const readServiceDataMarker = async (
+  projectPathArg: string,
+): Promise<IServiceDataMarker | undefined> => {
+  const markerPath = getServiceDataMarkerPath(projectPathArg);
+  try {
+    if (!(await plugins.smartfs.file(markerPath).exists())) {
+      return undefined;
+    }
+    const content = (await plugins.smartfs.file(markerPath).encoding('utf8').read()) as string;
+    const parsed = JSON.parse(content);
+    return isValidServiceDataMarker(parsed) ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+/**
+ * Record that `gitzone services` owns a data directory for this project.
+ *
+ * The marker lives in `.nogit/` rather than inside the bind-mounted data
+ * directory itself, so it can never confuse mongod, MinIO or Elasticsearch at
+ * runtime. Entries are merged so enabling a service later does not drop the
+ * claim on previously created directories.
+ */
+export const recordServiceDataDirectory = async (
+  projectPathArg: string,
+  serviceArg: TServiceName,
+): Promise<void> => {
+  const projectPath = plugins.path.resolve(projectPathArg);
+  const dataPath = getServiceDataDirectory(projectPath, serviceArg);
+  const existingMarker = await readServiceDataMarker(projectPath);
+
+  const entries: IServiceDataMarkerEntry[] = existingMarker
+    ? existingMarker.dataDirectories.filter((entry) => entry.service !== serviceArg)
+    : [];
+  entries.push({ service: serviceArg, path: dataPath });
+  entries.sort((entryA, entryB) => entryA.service.localeCompare(entryB.service));
+
+  const marker: IServiceDataMarker = {
+    owner: serviceDataOwner,
+    kind: 'service-data',
+    schemaVersion: 1,
+    projectPath,
+    safeToPrune: true,
+    createdAt: existingMarker?.createdAt || new Date().toISOString(),
+    dataDirectories: entries,
+  };
+
+  const markerPath = getServiceDataMarkerPath(projectPath);
+  await plugins.smartfs.directory(plugins.path.dirname(markerPath)).recursive().create();
+  await plugins.smartfs
+    .file(markerPath)
+    .encoding('utf8')
+    .write(`${JSON.stringify(marker, null, 2)}\n`);
+};
+
+/**
+ * Labels applied to every container `gitzone services` creates.
+ *
+ * Mirrors the `git.zone.*` namespace already established by
+ * `@git.zone/tsdocker` so prune logic can identify tool-owned resources
+ * without ever matching on image or bare name.
+ */
+export const getServiceContainerLabels = (optionsArg: {
+  projectPath: string;
+  service: TServiceName;
+  dataPath: string;
+}): { [key: string]: string } => {
+  return {
+    'git.zone.tool': serviceToolLabel,
+    'git.zone.service': optionsArg.service,
+    'git.zone.project-path': plugins.path.resolve(optionsArg.projectPath),
+    'git.zone.data-path': plugins.path.resolve(optionsArg.dataPath),
+    'git.zone.safe-to-prune': 'true',
+  };
+};
+
+/** True when a container's labels prove `gitzone services` created it. */
+export const isServiceOwnedByLabels = (labelsArg: { [key: string]: string }): boolean => {
+  return (
+    labelsArg['git.zone.tool'] === serviceToolLabel &&
+    labelsArg['git.zone.safe-to-prune'] === 'true'
+  );
+};