@k2b/cloud 0.6.0-rc.0

package/src/api/sync-ops.ts

@@ -0,0 +1,79 @@
+import { Hono, type MiddlewareHandler } from "hono";
+import { readBoundedJson } from "../_internal/bounded-json";
+import { getApp, listApps } from "../_internal/registry";
+import { type AuthContext, auth, rejectReservedWorkloadCredential } from "../server";
+import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
+import { syncInvocationOperation } from "../services/identity/invocation-operations";
+import { normalizeInvocationRequestId, signInvocationToken } from "../services/identity/invocation-token";
+import { withActiveIdentitySigner } from "../services/identity/key-ring";
+
+type Dependencies = {
+  getApp?: typeof getApp;
+  listApps?: typeof listApps;
+  authenticate?: MiddlewareHandler<AuthContext>;
+  fetch?: (input: URL, init: RequestInit) => Promise<Response>;
+  signInvocation?: typeof signInvocationToken;
+  withActiveSigner?: typeof withActiveIdentitySigner;
+};
+
+/** Core owns the credential-bearing hop; targets receive only an operation-bound invocation. */
+export const createSyncOpsProxyRoutes = (dependencies: Dependencies = {}) =>
+  new Hono<AuthContext>()
+    .use(dependencies.authenticate ?? auth.requireRole("admin"))
+    .use(rejectReservedWorkloadCredential)
+    .use(auth.requireOAuthScope("admin"))
+    .get("/", async (c) => c.json({ apps: await (dependencies.listApps ?? listApps)() }, 200, { "cache-control": "no-store" }))
+    .all("/:appId/*", async (c) => {
+      const path = new URL(c.req.url).pathname.split(`/sync/${c.req.param("appId")}`)[1] ?? "";
+      const method = c.req.method;
+      const allowed =
+        method === "GET"
+          ? /^\/(resources|dead-letters|schedules)$/.test(path) ||
+            /^\/dead-letters\/(queue|job|topic)\/[^/]+(?:\/[^/]+)?$/.test(path) ||
+            /^\/schedules\/[^/]+\/[^/]+\/runs\/[^/]+$/.test(path)
+          : method === "POST"
+            ? /^\/dead-letters\/(queue|job)\/[^/]+\/requeue$/.test(path) ||
+              /^\/dead-letters\/topic\/[^/]+\/replay$/.test(path) ||
+              /^\/schedules\/[^/]+\/[^/]+\/run-now$/.test(path)
+            : method === "DELETE" && /^\/dead-letters\/(queue|job|topic)\/[^/]+\/[^/]+$/.test(path);
+      if (!allowed) return c.notFound();
+      const app = await (dependencies.getApp ?? getApp)(c.req.param("appId"));
+      if (!app) return c.json({ message: "App not found" }, 404);
+      const signal = AbortSignal.any([c.req.raw.signal, AbortSignal.timeout(35_000)]);
+      const operation = syncInvocationOperation(method, path);
+      const requestId = normalizeInvocationRequestId(c.req.header("x-request-id"));
+      let body: string | undefined;
+      if (method === "POST") {
+        const parsed = await readBoundedJson(c.req.raw, 16_384);
+        if (!parsed.ok) return c.json({ message: "Invalid request body" }, 400);
+        body = JSON.stringify(parsed.data);
+      }
+      try {
+        const signed = await (dependencies.withActiveSigner ?? withActiveIdentitySigner)(
+          "invocation",
+          (signer) =>
+            (dependencies.signInvocation ?? signInvocationToken)({
+              targetAppId: app.id,
+              callingAppId: "core",
+              operation,
+              schemaHash: null,
+              authority: invocationAuthorityFromRequest(auth.getAuthority(c)),
+              requestId,
+              signer,
+              issuer: signer.issuer,
+            }),
+          { signal, timeoutMs: 5_000 },
+        );
+        const headers = new Headers({ authorization: `Bearer ${signed.token}`, accept: "application/json" });
+        if (body !== undefined) headers.set("content-type", "application/json");
+        if (requestId) headers.set("x-request-id", requestId);
+        const target = new URL(`/_internal/sync${path}`, app.baseUrl);
+        target.search = new URL(c.req.url).search;
+        const response = await (dependencies.fetch ?? fetch)(target, { method, headers, body, signal, redirect: "manual" });
+        const result = await readBoundedJson(response, 4 * 1024 * 1024);
+        if (!result.ok) return c.json({ message: "Invalid Sync operations response" }, 502);
+        return Response.json(result.data, { status: response.status, headers: { "cache-control": "no-store" } });
+      } catch {
+        return c.json({ message: "Sync operations unavailable" }, 502);
+      }
+    });

package/src/api/widgets.ts

@@ -0,0 +1,143 @@
+import { Hono, type MiddlewareHandler } from "hono";
+import { readBoundedJson } from "../_internal/bounded-json";
+import { listWidgets } from "../_internal/registry";
+import { WIDGET_MAX_RESPONSE_BYTES, WidgetResponseSchema } from "../contracts/widgets";
+import { type AuthContext, auth, preferredLocale, rejectReservedWorkloadCredential } from "../server";
+import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
+import { widgetInvocationOperation } from "../services/identity/invocation-operations";
+import { normalizeInvocationRequestId, signInvocationToken } from "../services/identity/invocation-token";
+import { withActiveIdentitySigner } from "../services/identity/key-ring";
+import { logger } from "../services/logging";
+import { LOCALE_HEADER } from "../shared/locale";
+
+type WidgetRouteDependencies = {
+  listWidgets?: typeof listWidgets;
+  fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+  authenticate?: MiddlewareHandler<AuthContext>;
+  signInvocation?: typeof signInvocationToken;
+  withActiveSigner?: typeof withActiveIdentitySigner;
+  timeoutMs?: number;
+};
+
+export const WIDGET_PROXY_TIMEOUT_MS = 500;
+const log = logger("widgets");
+type WidgetRejectionReason =
+  | "upstream_timeout"
+  | "upstream_status"
+  | "too_large"
+  | "invalid_json"
+  | "invalid_schema"
+  | "deadline_exceeded"
+  | "request_cancelled"
+  | "operation_failed";
+
+const jsonError = (message: string, status: 502 | 504): Response =>
+  Response.json({ message }, { status, headers: { "content-type": "application/json" } });
+
+const waitWithin = <T>(value: Promise<T>, signal: AbortSignal): Promise<T> =>
+  new Promise<T>((resolve, reject) => {
+    const aborted = () => reject(signal.reason);
+    if (signal.aborted) return aborted();
+    signal.addEventListener("abort", aborted, { once: true });
+    value.then(
+      (result) => {
+        signal.removeEventListener("abort", aborted);
+        resolve(result);
+      },
+      (error) => {
+        signal.removeEventListener("abort", aborted);
+        reject(error);
+      },
+    );
+  });
+
+export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) => {
+  const registry = dependencies.listWidgets ?? listWidgets;
+  const fetchWidget = dependencies.fetch ?? globalThis.fetch;
+
+  return new Hono<AuthContext>()
+    .use(dependencies.authenticate ?? auth.requireRole("authenticated"))
+    .use(rejectReservedWorkloadCredential)
+    .use(auth.requireOAuthScope("read", "admin"))
+    .get("/widgets/v1/:appId/:widgetId", async (c) => {
+      const timeout = AbortSignal.timeout(dependencies.timeoutMs ?? WIDGET_PROXY_TIMEOUT_MS);
+      const signal = AbortSignal.any([c.req.raw.signal, timeout]);
+      const appId = c.req.param("appId");
+      const widgetId = c.req.param("widgetId");
+      const requestId = normalizeInvocationRequestId(c.req.header("x-request-id"));
+      let phase: "registry" | "signing" | "provider" | "response" = "registry";
+      const reject = (reason: WidgetRejectionReason, message: string, status: 502 | 504, upstreamStatus?: number): Response => {
+        log.warn("Widget proxy rejected response", {
+          appId: appId.slice(0, 80),
+          widgetId: widgetId.slice(0, 100),
+          phase,
+          reason,
+          ...(upstreamStatus === undefined ? {} : { upstreamStatus }),
+        });
+        return jsonError(message, status);
+      };
+      try {
+        const widget = (await waitWithin(registry(), signal)).find((entry) => entry.appId === appId && entry.widgetId === widgetId);
+        if (!widget) return c.json({ message: "Widget not found" }, 404);
+
+        phase = "signing";
+        const headers = await (async () => {
+          const signed = await waitWithin(
+            (dependencies.withActiveSigner ?? withActiveIdentitySigner)(
+              "invocation",
+              (signer) =>
+                (dependencies.signInvocation ?? signInvocationToken)({
+                  targetAppId: widget.appId,
+                  callingAppId: "core",
+                  operation: widgetInvocationOperation(widget.widgetId),
+                  schemaHash: null,
+                  authority: invocationAuthorityFromRequest(auth.getAuthority(c)),
+                  requestId,
+                  signer,
+                  issuer: signer.issuer,
+                }),
+              { signal, timeoutMs: dependencies.timeoutMs ?? WIDGET_PROXY_TIMEOUT_MS },
+            ),
+            signal,
+          );
+          return new Headers({ authorization: `Bearer ${signed.token}` });
+        })();
+
+        if (requestId) headers.set("x-request-id", requestId);
+        for (const name of ["traceparent", "tracestate"] as const) {
+          const value = c.req.header(name);
+          if (value) headers.set(name, value);
+        }
+        const locale = preferredLocale(c.req.raw.headers);
+        if (locale) headers.set(LOCALE_HEADER, locale);
+        headers.set("x-cloud-invocation-operation", widgetInvocationOperation(widget.widgetId));
+
+        const targetUrl = new URL(`/api/_internal/widgets/v1/${encodeURIComponent(widget.widgetId)}`, widget.url);
+        phase = "provider";
+        signal.throwIfAborted();
+        const response = await fetchWidget(targetUrl, { headers, signal });
+        if (response.status === 204 || response.status === 403) {
+          await response.body?.cancel();
+          return new Response(null, { status: response.status, headers: { "content-type": "application/json" } });
+        }
+        if (!response.ok) {
+          await response.body?.cancel();
+          return response.status === 504
+            ? reject("upstream_timeout", "Widget deadline exceeded", 504, response.status)
+            : reject("upstream_status", "Widget is unavailable", 502, response.status);
+        }
+        phase = "response";
+        const body = await readBoundedJson(response, WIDGET_MAX_RESPONSE_BYTES);
+        signal.throwIfAborted();
+        if (!body.ok) return reject(body.reason, "Widget returned invalid or oversized JSON", 502);
+        const parsed = WidgetResponseSchema.safeParse(body.data);
+        if (!parsed.success) return reject("invalid_schema", "Widget returned an invalid response", 502);
+        return Response.json(parsed.data, { headers: { "content-type": "application/json" } });
+      } catch (error) {
+        const isTimeout = timeout.aborted || (error instanceof Error && error.name === "TimeoutError");
+        return isTimeout
+          ? reject("deadline_exceeded", "Widget deadline exceeded", 504)
+          : reject(signal.aborted ? "request_cancelled" : "operation_failed", "Widget is unavailable", 502);
+      }
+    });
+};

package/src/browser/CloudResourceSearch.behavior.test.tsx

@@ -0,0 +1,74 @@
+import { describe, expect, test } from "bun:test";
+import { isServer, render } from "solid-js/web";
+import { createDomTestHarness } from "../../../ui/test/dom";
+import type { SearchItem } from "../api/search/schemas";
+
+const waitFor = async (condition: () => boolean, label: string) => {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    if (condition()) return;
+    await Bun.sleep(10);
+  }
+  throw new Error(`Timed out waiting for ${label}`);
+};
+
+const item = (id: string): SearchItem => ({
+  appId: "notebooks",
+  appName: "Notebooks",
+  appIcon: "ti ti-notebook",
+  readable: true,
+  ref: { type: "notebooks.note", id },
+  title: id,
+  href: `/app/notebooks/${id}`,
+  preview: `${id} preview`,
+});
+
+describe("CloudResourceSearch selection", () => {
+  if (isServer) {
+    test.skip("runs with browser export conditions", () => {});
+    return;
+  }
+
+  test("applies picker filters and returns the selected resource", async () => {
+    const dom = createDomTestHarness();
+    const originalFetch = globalThis.fetch;
+    const requests: string[] = [];
+    globalThis.fetch = (async (input) => {
+      requests.push(String(input));
+      return Response.json({
+        query: "",
+        count: 2,
+        apps: [{ id: "notebooks", name: "Notebooks", icon: "ti ti-notebook" }],
+        items: [item("existing"), item("selectable")],
+      });
+    }) as typeof fetch;
+
+    const { default: CloudResourceSearch } = await import("./CloudResourceSearch");
+    let selected: SearchItem | undefined;
+    const dispose = render(
+      () => (
+        <CloudResourceSearch
+          initialAppId="notebooks"
+          requireReader
+          excludeRefs={[{ type: "notebooks.note", id: "existing" }]}
+          onSelect={(item) => {
+            selected = item;
+          }}
+        />
+      ),
+      dom.root,
+    );
+
+    try {
+      await waitFor(() => dom.root.textContent?.includes("selectable preview") ?? false, "the filtered result");
+      expect(requests[0]).toBe("/api/search?provider_limit=10&app=notebooks&require_reader=true");
+      expect(dom.root.textContent).not.toContain("existing preview");
+
+      dom.root.querySelector<HTMLButtonElement>("section button")!.click();
+      expect(selected?.ref).toEqual({ type: "notebooks.note", id: "selectable" });
+    } finally {
+      dispose();
+      globalThis.fetch = originalFetch;
+      dom.cleanup();
+    }
+  });
+});