@git.zone/cli 3.2.1 → 5.0.0

package/ts/mod_services/classes.serviceconfiguration.ts

@@ -9,6 +9,7 @@ import {
   writeMongodbAuthOption,
   type TServiceOptionSource,
 } from './classes.serviceoptions.js';
+import { withInterProcessLock } from './classes.interprocesslock.js';
 
 /** Hosts that are considered local for the purposes of the no-auth guard. */
 const localMongoHosts = ['localhost', '127.0.0.1', '::1'];
@@ -99,22 +100,6 @@ export const deriveS3BucketName = (projectNameArg: string): string => {
   return canonical;
 };
 
-export type TLegacyS3BucketRepair =
-  | { bucket: unknown; repaired: false }
-  | { bucket: string; repaired: true };
-
-/** Repair only the exact invalid value emitted by older GitZone releases. */
-export const repairLegacyGeneratedS3Bucket = (
-  projectNameArg: string,
-  bucketArg: unknown,
-): TLegacyS3BucketRepair => {
-  const legacyGeneratedBucket = `${projectNameArg}-documents`;
-  if (bucketArg !== legacyGeneratedBucket || isValidS3BucketName(bucketArg)) {
-    return { bucket: bucketArg, repaired: false };
-  }
-  return { bucket: deriveS3BucketName(projectNameArg), repaired: true };
-};
-
 export interface IServiceConfig {
   PROJECT_NAME: string;
   MONGODB_HOST: string;
@@ -131,9 +116,11 @@ export interface IServiceConfig {
   MONGODB_AUTH_ENABLED: boolean;
   S3_HOST: string;
   S3_PORT: string;
-  S3_CONSOLE_PORT: string;
+  S3_UI_PORT: string;
   S3_ACCESSKEY: string;
   S3_SECRETKEY: string;
+  S3_ADMIN_PASSWORD: string;
+  S3_REGION: string;
   S3_BUCKET: string;
   S3_ENDPOINT: string;
   S3_USESSL: boolean;
@@ -144,9 +131,75 @@ export interface IServiceConfig {
   ELASTICSEARCH_URL: string;
 }
 
+const runtimeStringFields: Array<keyof IServiceConfig> = [
+  'PROJECT_NAME',
+  'MONGODB_HOST',
+  'MONGODB_NAME',
+  'MONGODB_PORT',
+  'MONGODB_USER',
+  'MONGODB_PASS',
+  'MONGODB_URL',
+  'S3_HOST',
+  'S3_PORT',
+  'S3_UI_PORT',
+  'S3_ACCESSKEY',
+  'S3_SECRETKEY',
+  'S3_ADMIN_PASSWORD',
+  'S3_REGION',
+  'S3_BUCKET',
+  'S3_ENDPOINT',
+  'ELASTICSEARCH_HOST',
+  'ELASTICSEARCH_PORT',
+  'ELASTICSEARCH_USER',
+  'ELASTICSEARCH_PASS',
+  'ELASTICSEARCH_URL',
+];
+
+const runtimePortFields: Array<keyof IServiceConfig> = [
+  'MONGODB_PORT',
+  'S3_PORT',
+  'S3_UI_PORT',
+  'ELASTICSEARCH_PORT',
+];
+
+/** Validate the complete canonical env.json shape before runtime use or persistence. */
+export const assertCanonicalServiceRuntimeConfig: (
+  configArg: unknown,
+) => asserts configArg is IServiceConfig = (configArg) => {
+  if (typeof configArg !== 'object' || configArg === null || Array.isArray(configArg)) {
+    throw new Error('.nogit/env.json must contain a JSON object at its root.');
+  }
+  const config = configArg as Record<string, unknown>;
+  for (const field of runtimeStringFields) {
+    if (typeof config[field] !== 'string' || !(config[field] as string).trim()) {
+      throw new Error(`.nogit/env.json field ${field} must be a non-empty string.`);
+    }
+  }
+  if (typeof config.MONGODB_AUTH_ENABLED !== 'boolean') {
+    throw new Error('.nogit/env.json field MONGODB_AUTH_ENABLED must be a boolean.');
+  }
+  if (typeof config.S3_USESSL !== 'boolean') {
+    throw new Error('.nogit/env.json field S3_USESSL must be a boolean.');
+  }
+  for (const field of runtimePortFields) {
+    const rawPort = config[field];
+    if (typeof rawPort !== 'string' || !/^\d{1,5}$/u.test(rawPort)) {
+      throw new Error(`.nogit/env.json field ${field} must be a decimal port string.`);
+    }
+    const port = Number(rawPort);
+    if (!Number.isSafeInteger(port) || port < 1 || port > 65_535) {
+      throw new Error(`.nogit/env.json field ${field} is outside the TCP port range.`);
+    }
+  }
+  if (config.S3_PORT === config.S3_UI_PORT) {
+    throw new Error('.nogit/env.json S3 API and UI ports must differ.');
+  }
+};
+
 export class ServiceConfiguration {
   private configPath: string;
   private config!: IServiceConfig;
+  private persistedConfigSnapshot?: string;
   private docker: DockerContainer;
   /** Where the effective MongoDB auth mode came from. */
   private mongoAuthSource: TServiceOptionSource = 'default';
@@ -173,12 +226,20 @@ export class ServiceConfiguration {
     // value, so a fresh checkout reproduces the declared setup.
     await this.applyDeclaredServiceOptions();
 
-    // Sync ports from existing Docker containers if they exist
+    // Only non-S3 services retain legacy port synchronization. ObjectStorage
+    // configuration is authoritative and is reconciled on its guarded start path.
     await this.syncPortsFromDocker();
 
     return this.config;
   }
 
+  /** Reload and validate persisted runtime state without deriving or writing fields. */
+  public async reloadFromDisk(): Promise<IServiceConfig> {
+    await this.loadConfig();
+    assertCanonicalServiceRuntimeConfig(this.config);
+    return this.config;
+  }
+
   /**
    * Fold `@git.zone/cli.serviceOptions` into the runtime configuration.
    */
@@ -237,7 +298,6 @@ export class ServiceConfiguration {
    */
   private updateDerivedFields(): void {
     this.config.MONGODB_URL = this.buildMongoUrl();
-    this.config.S3_ENDPOINT = this.config.S3_HOST;
     this.config.ELASTICSEARCH_URL = `http://${this.config.ELASTICSEARCH_USER}:${this.config.ELASTICSEARCH_PASS}@${this.config.ELASTICSEARCH_HOST}:${this.config.ELASTICSEARCH_PORT}`;
   }
 
@@ -261,6 +321,38 @@ export class ServiceConfiguration {
     }
   }
 
+  /** Reject ObjectStorage's prohibited defaults and credential reuse before Docker mutation. */
+  public assertObjectStorageCredentialsAreSafe(): void {
+    const config = this.config;
+    for (const [name, value] of [
+      ['S3_ACCESSKEY', config.S3_ACCESSKEY],
+      ['S3_SECRETKEY', config.S3_SECRETKEY],
+      ['S3_ADMIN_PASSWORD', config.S3_ADMIN_PASSWORD],
+    ] as const) {
+      if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`${name} must be a non-empty string in .nogit/env.json.`);
+      }
+    }
+    if (config.S3_ACCESSKEY === 'admin' && config.S3_SECRETKEY === 'admin') {
+      throw new Error(
+        'ObjectStorage refuses the default S3 credentials. Set distinct non-default S3_ACCESSKEY and S3_SECRETKEY values in .nogit/env.json.',
+      );
+    }
+    if (config.S3_ADMIN_PASSWORD === 'admin') {
+      throw new Error(
+        'ObjectStorage refuses the default admin password. Set a non-default S3_ADMIN_PASSWORD in .nogit/env.json.',
+      );
+    }
+    if (
+      config.S3_ADMIN_PASSWORD === config.S3_ACCESSKEY ||
+      config.S3_ADMIN_PASSWORD === config.S3_SECRETKEY
+    ) {
+      throw new Error(
+        'S3_ADMIN_PASSWORD must be separate from S3_ACCESSKEY and S3_SECRETKEY in .nogit/env.json.',
+      );
+    }
+  }
+
   /**
    * Persist the MongoDB auth mode.
    *
@@ -281,10 +373,45 @@ export class ServiceConfiguration {
    * Save the configuration to file
    */
   public async saveConfig(): Promise<void> {
-    await plugins.smartfs
-      .file(this.configPath)
-      .encoding('utf8')
-      .write(JSON.stringify(this.config, null, 2));
+    assertCanonicalServiceRuntimeConfig(this.config);
+    await withInterProcessLock(
+      {
+        lockPath: `${this.configPath}.lock`,
+        description: 'Service runtime configuration',
+      },
+      async () => {
+        let currentSnapshot: string | undefined;
+        try {
+          currentSnapshot = await plugins.fs.readFile(this.configPath, 'utf8');
+        } catch (error) {
+          if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+            throw error;
+          }
+        }
+        if (currentSnapshot !== this.persistedConfigSnapshot) {
+          throw new Error(
+            'Refusing to overwrite .nogit/env.json because it changed after loading.',
+          );
+        }
+
+        const content = `${JSON.stringify(this.config, null, 2)}\n`;
+        const tempPath = `${this.configPath}.tmp-${process.pid}-${plugins.crypto
+          .randomBytes(12)
+          .toString('hex')}`;
+        try {
+          await plugins.fs.writeFile(tempPath, content, {
+            encoding: 'utf8',
+            flag: 'wx',
+            mode: 0o600,
+          });
+          await plugins.fs.rename(tempPath, this.configPath);
+          this.persistedConfigSnapshot = content;
+        } catch (error) {
+          await plugins.fs.rm(tempPath, { force: true }).catch(() => {});
+          throw new Error('Could not persist .nogit/env.json atomically.', { cause: error });
+        }
+      },
+    );
   }
   
   /**
@@ -310,7 +437,12 @@ export class ServiceConfiguration {
       .file(this.configPath)
       .encoding('utf8')
       .read()) as string;
-    this.config = JSON.parse(configContent);
+    const parsed = JSON.parse(configContent);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+      throw new Error('.nogit/env.json must contain a JSON object at its root.');
+    }
+    this.config = parsed as IServiceConfig;
+    this.persistedConfigSnapshot = configContent;
   }
   
   /**
@@ -320,11 +452,11 @@ export class ServiceConfiguration {
     const projectName = await helpers.getProjectName();
     const mongoPort = await helpers.getRandomAvailablePort();
     const s3Port = await helpers.getRandomAvailablePort();
-    let s3ConsolePort = s3Port + 1;
+    let s3UiPort = s3Port + 1;
 
-    // Ensure console port is also available
-    while (!(await helpers.isPortAvailable(s3ConsolePort))) {
-      s3ConsolePort++;
+    // Ensure management UI port is also available
+    while (!(await helpers.isPortAvailable(s3UiPort))) {
+      s3UiPort++;
     }
 
     const mongoUser = 'defaultadmin';
@@ -350,9 +482,11 @@ export class ServiceConfiguration {
       MONGODB_AUTH_ENABLED: true,
       S3_HOST: s3Host,
       S3_PORT: s3PortStr,
-      S3_CONSOLE_PORT: s3ConsolePort.toString(),
+      S3_UI_PORT: s3UiPort.toString(),
       S3_ACCESSKEY: 'defaultadmin',
       S3_SECRETKEY: 'defaultpass',
+      S3_ADMIN_PASSWORD: plugins.crypto.randomBytes(24).toString('base64url'),
+      S3_REGION: 'us-east-1',
       S3_BUCKET: deriveS3BucketName(projectName),
       S3_ENDPOINT: s3Host,
       S3_USESSL: false,
@@ -363,12 +497,13 @@ export class ServiceConfiguration {
       ELASTICSEARCH_URL: `http://${esUser}:${esPass}@${esHost}:${esPort}`
     };
 
+    assertCanonicalServiceRuntimeConfig(this.config);
     await this.saveConfig();
 
     logger.log('ok', '✅ Created .nogit/env.json with project defaults');
     logger.log('info', `📍 MongoDB port: ${mongoPort}`);
     logger.log('info', `📍 S3 API port: ${s3Port}`);
-    logger.log('info', `📍 S3 Console port: ${s3ConsolePort}`);
+    logger.log('info', `📍 S3 management UI port: ${s3UiPort}`);
     logger.log('info', `📍 Elasticsearch port: ${esPort}`);
   }
   
@@ -445,16 +580,16 @@ export class ServiceConfiguration {
       updated = true;
     }
     
-    if (!this.config.S3_CONSOLE_PORT) {
+    if (!this.config.S3_UI_PORT) {
       const s3Port = parseInt(this.config.S3_PORT);
-      let consolePort = s3Port + 1;
+      let uiPort = s3Port + 1;
       
-      while (!(await helpers.isPortAvailable(consolePort))) {
-        consolePort++;
+      while (!(await helpers.isPortAvailable(uiPort))) {
+        uiPort++;
       }
       
-      this.config.S3_CONSOLE_PORT = consolePort.toString();
-      fieldsAdded.push(`S3_CONSOLE_PORT(${consolePort})`);
+      this.config.S3_UI_PORT = uiPort.toString();
+      fieldsAdded.push(`S3_UI_PORT(${uiPort})`);
       updated = true;
     }
     
@@ -469,21 +604,11 @@ export class ServiceConfiguration {
       fieldsAdded.push('S3_SECRETKEY');
       updated = true;
     }
-    
+
     if (!this.config.S3_BUCKET) {
       this.config.S3_BUCKET = deriveS3BucketName(this.config.PROJECT_NAME);
       fieldsAdded.push('S3_BUCKET');
       updated = true;
-    } else {
-      const repair = repairLegacyGeneratedS3Bucket(
-        this.config.PROJECT_NAME,
-        this.config.S3_BUCKET,
-      );
-      if (repair.repaired) {
-        this.config.S3_BUCKET = repair.bucket;
-        fieldsAdded.push('S3_BUCKET(repaired legacy generated name)');
-        updated = true;
-      }
     }
     
     // `undefined`, not falsy: a stored `false` is a valid value, and treating it
@@ -494,10 +619,8 @@ export class ServiceConfiguration {
       updated = true;
     }
     
-    // Always update S3_ENDPOINT based on current settings
-    const oldEndpoint = this.config.S3_ENDPOINT;
-    this.config.S3_ENDPOINT = this.config.S3_HOST;
-    if (oldEndpoint !== this.config.S3_ENDPOINT) {
+    if (!this.config.S3_ENDPOINT) {
+      this.config.S3_ENDPOINT = this.config.S3_HOST;
       fieldsAdded.push('S3_ENDPOINT');
       updated = true;
     }
@@ -534,6 +657,7 @@ export class ServiceConfiguration {
       updated = true;
     }
 
+    assertCanonicalServiceRuntimeConfig(this.config);
     if (updated) {
       await this.saveConfig();
       logger.log('ok', `✅ Added missing fields: ${fieldsAdded.join(', ')}`);
@@ -560,7 +684,8 @@ export class ServiceConfiguration {
   public getContainerNames() {
     return {
       mongo: `${this.config.PROJECT_NAME}-mongodb`,
-      minio: `${this.config.PROJECT_NAME}-minio`,
+      objectstorage: `${this.config.PROJECT_NAME}-objectstorage`,
+      legacyMinio: `${this.config.PROJECT_NAME}-minio`,
       elasticsearch: `${this.config.PROJECT_NAME}-elasticsearch`
     };
   }
@@ -574,7 +699,7 @@ export class ServiceConfiguration {
   public getDataDirectories() {
     return {
       mongo: getServiceDataDirectory(process.cwd(), 'mongodb'),
-      minio: getServiceDataDirectory(process.cwd(), 'minio'),
+      objectstorage: getServiceDataDirectory(process.cwd(), 'objectstorage'),
       elasticsearch: getServiceDataDirectory(process.cwd(), 'elasticsearch')
     };
   }
@@ -602,30 +727,6 @@ export class ServiceConfiguration {
       }
     }
     
-    // Check MinIO container
-    const minioStatus = await this.docker.getStatus(containers.minio);
-    if (minioStatus !== 'not_exists') {
-      const portMappings = await this.docker.getPortMappings(containers.minio);
-      if (portMappings) {
-        if (portMappings['9000']) {
-          const dockerPort = portMappings['9000'];
-          if (this.config.S3_PORT !== dockerPort) {
-            logger.log('note', `📍 Syncing S3 API port from Docker: ${dockerPort}`);
-            this.config.S3_PORT = dockerPort;
-            updated = true;
-          }
-        }
-        if (portMappings['9001']) {
-          const dockerPort = portMappings['9001'];
-          if (this.config.S3_CONSOLE_PORT !== dockerPort) {
-            logger.log('note', `📍 Syncing S3 Console port from Docker: ${dockerPort}`);
-            this.config.S3_CONSOLE_PORT = dockerPort;
-            updated = true;
-          }
-        }
-      }
-    }
-
     // Check Elasticsearch container
     const esStatus = await this.docker.getStatus(containers.elasticsearch);
     if (esStatus !== 'not_exists') {
@@ -656,7 +757,6 @@ export class ServiceConfiguration {
 
     // Check if containers exist - if they do, ports are fine
     const mongoExists = await this.docker.exists(containers.mongo);
-    const minioExists = await this.docker.exists(containers.minio);
     const esExists = await this.docker.exists(containers.elasticsearch);
 
     // Only check port availability if containers don't exist
@@ -671,30 +771,6 @@ export class ServiceConfiguration {
       }
     }
 
-    if (!minioExists) {
-      const s3Port = parseInt(this.config.S3_PORT);
-      const s3ConsolePort = parseInt(this.config.S3_CONSOLE_PORT);
-
-      if (!(await helpers.isPortAvailable(s3Port))) {
-        logger.log('note', `⚠️  S3 API port ${s3Port} is in use, finding new port...`);
-        const newPort = await helpers.getRandomAvailablePort();
-        this.config.S3_PORT = newPort.toString();
-        logger.log('ok', `✅ New S3 API port: ${newPort}`);
-        updated = true;
-      }
-
-      if (!(await helpers.isPortAvailable(s3ConsolePort))) {
-        logger.log('note', `⚠️  S3 Console port ${s3ConsolePort} is in use, finding new port...`);
-        let newPort = parseInt(this.config.S3_PORT) + 1;
-        while (!(await helpers.isPortAvailable(newPort))) {
-          newPort++;
-        }
-        this.config.S3_CONSOLE_PORT = newPort.toString();
-        logger.log('ok', `✅ New S3 Console port: ${newPort}`);
-        updated = true;
-      }
-    }
-
     if (!esExists) {
       const esPort = parseInt(this.config.ELASTICSEARCH_PORT);
       if (!(await helpers.isPortAvailable(esPort))) {
@@ -713,6 +789,37 @@ export class ServiceConfiguration {
 
     return updated;
   }
+
+  /** Validate ObjectStorage host ports only after legacy/conflict checks pass. */
+  public async validateObjectStoragePorts(): Promise<boolean> {
+    let updated = false;
+    let s3Port = parseInt(this.config.S3_PORT);
+    if (!(await helpers.isPortAvailable(s3Port))) {
+      logger.log('note', `⚠️  S3 API port ${s3Port} is in use, finding new port...`);
+      s3Port = await helpers.getRandomAvailablePort();
+      this.config.S3_PORT = s3Port.toString();
+      logger.log('ok', `✅ New S3 API port: ${s3Port}`);
+      updated = true;
+    }
+
+    let uiPort = parseInt(this.config.S3_UI_PORT);
+    if (uiPort === s3Port || !(await helpers.isPortAvailable(uiPort))) {
+      logger.log('note', `⚠️  S3 management UI port ${uiPort} is in use, finding new port...`);
+      uiPort = s3Port + 1;
+      while (!(await helpers.isPortAvailable(uiPort))) {
+        uiPort++;
+      }
+      this.config.S3_UI_PORT = uiPort.toString();
+      logger.log('ok', `✅ New S3 management UI port: ${uiPort}`);
+      updated = true;
+    }
+
+    if (updated) {
+      this.updateDerivedFields();
+      await this.saveConfig();
+    }
+    return updated;
+  }
   
   /**
    * Force reconfigure all ports with new available ones
@@ -722,11 +829,11 @@ export class ServiceConfiguration {
 
     const mongoPort = await helpers.getRandomAvailablePort();
     const s3Port = await helpers.getRandomAvailablePort();
-    let s3ConsolePort = s3Port + 1;
+    let s3UiPort = s3Port + 1;
 
-    // Ensure console port is also available
-    while (!(await helpers.isPortAvailable(s3ConsolePort))) {
-      s3ConsolePort++;
+    // Ensure management UI port is also available
+    while (!(await helpers.isPortAvailable(s3UiPort))) {
+      s3UiPort++;
     }
 
     // Elasticsearch uses standard port 9200
@@ -734,7 +841,7 @@ export class ServiceConfiguration {
 
     this.config.MONGODB_PORT = mongoPort.toString();
     this.config.S3_PORT = s3Port.toString();
-    this.config.S3_CONSOLE_PORT = s3ConsolePort.toString();
+    this.config.S3_UI_PORT = s3UiPort.toString();
     this.config.ELASTICSEARCH_PORT = esPort;
 
     this.updateDerivedFields();
@@ -743,7 +850,7 @@ export class ServiceConfiguration {
     logger.log('ok', '✅ New port configuration:');
     logger.log('info', `  📍 MongoDB: ${mongoPort}`);
     logger.log('info', `  📍 S3 API: ${s3Port}`);
-    logger.log('info', `  📍 S3 Console: ${s3ConsolePort}`);
+    logger.log('info', `  📍 S3 management UI: ${s3UiPort}`);
     logger.log('info', `  📍 Elasticsearch: ${esPort}`);
   }
 }