@hot-updater/server 1.0.0-rc.18 → 1.0.0-rc.21

package/src/handler.ts

@@ -1,302 +0,0 @@
-import type { MountedEndpoint } from "./assembly/assemblePlugins";
-import { HotUpdaterConfigError } from "./assembly/assemblePlugins";
-import { HotUpdaterSchemaMigrationRequiredError } from "./database/fence";
-import { ADMIN_ROUTES, createAdminRouteHandlers } from "./handlerAdminRoutes";
-import { HandlerBadRequestError } from "./handlerErrors";
-import { createReleaseCatalogRouteHandlers } from "./handlerReleaseCatalogRoutes";
-import type {
-  HandlerAPI,
-  HotUpdaterHandler,
-  HotUpdaterHandlers,
-  RouteHandler,
-} from "./handlerTypes";
-import { createVersionRouteHandlers } from "./handlerVersionRoutes";
-import { addRoute, createRouter, findRoute } from "./internalRouter";
-
-export type {
-  HandlerAPI,
-  HotUpdaterHandler,
-  HotUpdaterHandlers,
-} from "./handlerTypes";
-
-const withPrivateNoStore = (response: Response): Response => {
-  const headers = new Headers(response.headers);
-  headers.set("cache-control", "private, no-store");
-  return new Response(response.body, {
-    headers,
-    status: response.status,
-    statusText: response.statusText,
-  });
-};
-
-const errorResponse = (error: string, status: number): Response =>
-  Response.json(
-    { error },
-    {
-      headers: { "cache-control": "private, no-store" },
-      status,
-    },
-  );
-
-/** The client-route policy: the clientAuth of the plugin that provides it. */
-export interface ClientRoutePolicy {
-  /** Request headers the decision reads; added to `Vary` on cacheable responses. */
-  readonly varyHeaders: readonly string[];
-  readonly authenticate: (request: Request) => Promise<boolean>;
-}
-
-/** `/version` and storage downloads never pass through the client policy. */
-const PUBLIC_CLIENT_ROUTES = new Set(["version", "downloadStorageObject"]);
-
-export type RouteAccess = "public" | "client" | "admin";
-
-export interface HotUpdaterRoute {
-  readonly method: string;
-  readonly path: string;
-  readonly access: RouteAccess;
-}
-
-const routesOf = Symbol.for("@hot-updater/server/routes");
-
-/** Every mounted route, for the route snapshot. */
-export const listHotUpdaterRoutes = (
-  handlers: HotUpdaterHandlers,
-): readonly HotUpdaterRoute[] =>
-  (handlers as { readonly [routesOf]?: readonly HotUpdaterRoute[] })[
-    routesOf
-  ] ?? [];
-
-const withVary = (response: Response, varyHeaders: readonly string[]) => {
-  const cacheControl = response.headers.get("cache-control") ?? "";
-  if (
-    varyHeaders.length === 0 ||
-    cacheControl === "" ||
-    /private|no-store/u.test(cacheControl)
-  ) {
-    return response;
-  }
-  const headers = new Headers(response.headers);
-  headers.set(
-    "vary",
-    [response.headers.get("vary"), ...varyHeaders].filter(Boolean).join(", "),
-  );
-  return new Response(response.body, {
-    headers,
-    status: response.status,
-    statusText: response.statusText,
-  });
-};
-
-const createRequestHandler =
-  ({
-    api,
-    clientPolicy,
-    privateResponses = false,
-    routeHandlers,
-    router,
-  }: {
-    readonly api: HandlerAPI;
-    readonly clientPolicy?: ClientRoutePolicy;
-    readonly privateResponses?: boolean;
-    readonly routeHandlers: Record<string, RouteHandler>;
-    readonly router: ReturnType<typeof createRouter<string>>;
-  }): HotUpdaterHandler =>
-  async (request): Promise<Response> => {
-    try {
-      const match = findRoute(
-        router,
-        request.method,
-        new URL(request.url).pathname,
-      );
-      if (!match) {
-        return errorResponse("Not found", 404);
-      }
-
-      const guarded =
-        clientPolicy !== undefined && !PUBLIC_CLIENT_ROUTES.has(match.data);
-      if (guarded) {
-        let authenticated: boolean;
-        try {
-          authenticated = await clientPolicy.authenticate(request);
-        } catch {
-          return errorResponse("Service unavailable", 503);
-        }
-        if (!authenticated) {
-          return errorResponse("Unauthorized", 401);
-        }
-      }
-
-      const handler = routeHandlers[match.data];
-      if (!handler) {
-        return errorResponse("Handler not found", 500);
-      }
-      const response = await handler(match.params, request, api);
-      if (privateResponses) return withPrivateNoStore(response);
-      return guarded ? withVary(response, clientPolicy.varyHeaders) : response;
-    } catch (error) {
-      if (error instanceof HandlerBadRequestError) {
-        return errorResponse(error.message, 400);
-      }
-      if (error instanceof HotUpdaterSchemaMigrationRequiredError) {
-        console.error(error.message);
-        return errorResponse("Service unavailable", 503);
-      }
-      console.error("Hot Updater handler error:", error);
-      return Response.json(
-        { error: "Internal server error" },
-        {
-          headers: { "cache-control": "private, no-store" },
-          status: 500,
-        },
-      );
-    }
-  };
-
-const createDownloadStorageRouteHandler =
-  (
-    downloadStorageObject: (
-      token: string,
-      signature: string,
-    ) => Promise<Response | null>,
-  ): RouteHandler =>
-  async (params) => {
-    const token = params.token;
-    const signature = params.signature;
-    if (!token || !signature) {
-      return errorResponse("Not found", 404);
-    }
-    const response = await downloadStorageObject(token, signature);
-    if (!response) {
-      return errorResponse("Not found", 404);
-    }
-    const headers = new Headers(response.headers);
-    if (!headers.has("cache-control")) {
-      headers.set("cache-control", "public, max-age=31536000, immutable");
-    }
-    return new Response(response.body, {
-      headers,
-      status: response.status,
-      statusText: response.statusText,
-    });
-  };
-
-export interface HotUpdaterHandlersOptions {
-  readonly api: HandlerAPI;
-  /** Absent when `clientAccess` is `"public"`. */
-  readonly clientPolicy?: ClientRoutePolicy;
-  readonly downloadStorageObject?: (
-    token: string,
-    signature: string,
-  ) => Promise<Response | null>;
-  /** The plugins' endpoints; a route no plugin serves answers 404. */
-  readonly endpoints?: readonly MountedEndpoint[];
-  /** The ids of the plugins the server runs, which the admin `/version` lists. */
-  readonly plugins?: readonly string[];
-}
-
-export function createHotUpdaterHandlers({
-  api,
-  clientPolicy,
-  downloadStorageObject,
-  endpoints = [],
-  plugins = [],
-}: HotUpdaterHandlersOptions): HotUpdaterHandlers {
-  const routeHandlers: Record<string, RouteHandler> = {
-    ...createVersionRouteHandlers(plugins),
-    ...createReleaseCatalogRouteHandlers(),
-    ...createAdminRouteHandlers(),
-    ...(downloadStorageObject === undefined
-      ? {}
-      : {
-          downloadStorageObject: createDownloadStorageRouteHandler(
-            downloadStorageObject,
-          ),
-        }),
-  };
-
-  const routes: HotUpdaterRoute[] = [];
-  const shapes = new Map<string, string>();
-  const mount =
-    (router: ReturnType<typeof createRouter<string>>, admin: boolean) =>
-    (method: string, path: string, handler: string): void => {
-      const shape = `${admin ? "admin" : "client"} ${method} ${path.replaceAll(/:[^/]+/gu, ":")}`;
-      const taken = shapes.get(shape);
-      if (taken !== undefined) {
-        throw new HotUpdaterConfigError(
-          `${handler} (${method} ${path}) collides with ${taken} on handlers.${admin ? "admin" : "client"}.`,
-        );
-      }
-      shapes.set(shape, handler);
-      addRoute(router, method, path, handler);
-      routes.push({
-        method,
-        path,
-        access: admin
-          ? "admin"
-          : PUBLIC_CLIENT_ROUTES.has(handler)
-            ? "public"
-            : "client",
-      });
-    };
-  const clientRouter = createRouter<string>();
-  const addClientRoute = mount(clientRouter, false);
-  addClientRoute("GET", "/version", "version");
-  if (downloadStorageObject !== undefined) {
-    addClientRoute(
-      "GET",
-      "/storage/:token/:signature",
-      "downloadStorageObject",
-    );
-  }
-  addClientRoute(
-    "GET",
-    "/release-catalogs/app-version/:platform/:channelKey/:appVersion",
-    "appVersionReleaseCatalog",
-  );
-  addClientRoute(
-    "GET",
-    "/release-catalogs/fingerprint/:platform/:channelKey/:fingerprintHash",
-    "fingerprintReleaseCatalog",
-  );
-  addClientRoute(
-    "GET",
-    "/artifacts/v1/:targetBundleId/from/:currentBundleId",
-    "artifactV1",
-  );
-
-  const adminRouter = createRouter<string>();
-  const addAdminRoute = mount(adminRouter, true);
-  // The admin mount also reports the protocol, so a standalone client checks
-  // it where it calls, and the plugins, so a console shows only their features.
-  addAdminRoute("GET", "/version", "adminVersion");
-  for (const route of ADMIN_ROUTES) {
-    addAdminRoute(route.method, route.path, route.handler);
-  }
-  for (const endpoint of endpoints) {
-    const name = `plugin ${endpoint.plugin}: ${endpoint.method} ${endpoint.path}`;
-    routeHandlers[name] = (params, request) =>
-      endpoint.handler(request, params);
-    (endpoint.access === "admin" ? addAdminRoute : addClientRoute)(
-      endpoint.method,
-      endpoint.path,
-      name,
-    );
-  }
-
-  const handlers = {
-    client: createRequestHandler({
-      api,
-      ...(clientPolicy === undefined ? {} : { clientPolicy }),
-      routeHandlers,
-      router: clientRouter,
-    }),
-    admin: createRequestHandler({
-      api,
-      privateResponses: true,
-      routeHandlers,
-      router: adminRouter,
-    }),
-  };
-  Object.defineProperty(handlers, routesOf, { value: Object.freeze(routes) });
-  return Object.freeze(handlers);
-}

package/src/handlerAdminRoutes.spec.ts

@@ -1,183 +0,0 @@
-import {
-  ReleaseManagementError,
-  type Deployment,
-} from "@hot-updater/plugin-core";
-import { describe, expect, it, vi } from "vitest";
-
-import type { CoreApi } from "./core/api";
-import { createAdminRouteHandlers } from "./handlerAdminRoutes";
-import { HandlerBadRequestError } from "./handlerErrors";
-import type { HandlerAPI } from "./handlerTypes";
-
-const BASE = "http://localhost/hot-updater/admin";
-
-const apiWith = (core: Partial<CoreApi>) => ({ core }) as unknown as HandlerAPI;
-
-const post = (path: string, body: unknown) =>
-  new Request(`${BASE}${path}`, {
-    method: "POST",
-    body: JSON.stringify(body),
-    headers: { "content-type": "application/json" },
-  });
-
-const deployment: Deployment = {
-  bundle: {
-    id: "01900000-0000-7000-8000-000000000001",
-    platform: "ios",
-    gitCommitHash: null,
-    manifestStorageUri: "s3://bucket/manifest.json",
-    manifestFileHash: "hash",
-    assetBaseStorageUri: "s3://bucket/assets",
-  },
-  release: {
-    channel: "production",
-    enabled: true,
-    fingerprintHash: null,
-    message: null,
-    shouldForceUpdate: false,
-    targetAppVersion: "1.0.x",
-  },
-};
-
-describe("admin API protocol 2 routes", () => {
-  const routes = createAdminRouteHandlers();
-
-  it("deploys well-formed deployments through core", async () => {
-    const deploy = vi.fn(async () => []);
-
-    const response = await routes.deployReleases!(
-      {},
-      post("/releases", { deployments: [deployment] }),
-      apiWith({ deploy }),
-    );
-
-    expect(response.status).toBe(201);
-    expect(deploy).toHaveBeenCalledWith([deployment]);
-  });
-
-  it("deploys a stored bundle's new release through core", async () => {
-    const deploy = vi.fn(async () => []);
-    const stored = {
-      bundleId: deployment.bundle.id,
-      release: deployment.release,
-    };
-
-    const response = await routes.deployReleases!(
-      {},
-      post("/releases", { deployments: [stored] }),
-      apiWith({ deploy }),
-    );
-
-    expect(response.status).toBe(201);
-    expect(deploy).toHaveBeenCalledWith([stored]);
-  });
-
-  it.each([
-    ["no deployments", { deployments: [] }],
-    [
-      "both a bundle and a stored bundle id",
-      {
-        deployments: [{ ...deployment, bundleId: deployment.bundle.id }],
-      },
-    ],
-    [
-      "a bundle without an id",
-      {
-        deployments: [
-          { ...deployment, bundle: { ...deployment.bundle, id: "" } },
-        ],
-      },
-    ],
-    [
-      "an unknown platform",
-      {
-        deployments: [
-          { ...deployment, bundle: { ...deployment.bundle, platform: "web" } },
-        ],
-      },
-    ],
-    [
-      "a rollout outside 0–1000 cohorts",
-      {
-        deployments: [
-          {
-            ...deployment,
-            release: { ...deployment.release, rolloutCohortCount: 1001 },
-          },
-        ],
-      },
-    ],
-    [
-      "a release without its channel",
-      {
-        deployments: [
-          { ...deployment, release: { ...deployment.release, channel: 1 } },
-        ],
-      },
-    ],
-  ])("refuses %s before core runs", async (_case, body) => {
-    const deploy = vi.fn();
-
-    await expect(
-      routes.deployReleases!({}, post("/releases", body), apiWith({ deploy })),
-    ).rejects.toBeInstanceOf(HandlerBadRequestError);
-    expect(deploy).not.toHaveBeenCalled();
-  });
-
-  it("answers core's refusals with their codes", async () => {
-    const promoteRelease = vi.fn(async () => {
-      throw new ReleaseManagementError("VERSION_CONFLICT", "changed");
-    });
-
-    const response = await routes.promoteRelease!(
-      { id: "release-1" },
-      post("/releases/release-1/promote", { targetChannel: "beta" }),
-      apiWith({ promoteRelease }),
-    );
-
-    expect(response.status).toBe(409);
-    await expect(response.json()).resolves.toEqual({
-      code: "VERSION_CONFLICT",
-      error: "changed",
-    });
-  });
-
-  it("pages releases by key and names the next cursor on a full page", async () => {
-    const listReleases = vi.fn(async () => [{ id: "b" }, { id: "a" }]);
-
-    const response = await routes.listReleases!(
-      {},
-      new Request(`${BASE}/releases?limit=2&channelId=c&platform=ios`),
-      apiWith({ listReleases } as unknown as Partial<CoreApi>),
-    );
-
-    await expect(response.json()).resolves.toEqual({
-      data: [{ id: "b" }, { id: "a" }],
-      next: "a",
-    });
-    expect(listReleases).toHaveBeenCalledWith({
-      order: "desc",
-      limit: 2,
-      filter: { kind: "channelPlatform", channelId: "c", platform: "ios" },
-    });
-  });
-
-  it.each([
-    "bundleId=b&scopeKey=s",
-    "channelId=c",
-    "bundleId=b&enabled=true",
-    "limit=501",
-    "order=sideways",
-  ])("refuses the release list query %s", async (query) => {
-    const listReleases = vi.fn();
-
-    await expect(
-      routes.listReleases!(
-        {},
-        new Request(`${BASE}/releases?${query}`),
-        apiWith({ listReleases }),
-      ),
-    ).rejects.toBeInstanceOf(HandlerBadRequestError);
-    expect(listReleases).not.toHaveBeenCalled();
-  });
-});