@kne/fastify-app-manager 0.1.3 → 0.1.5

package/README.md

@@ -117,7 +117,7 @@ deploy(versionId)
 
 | 特性 | 说明 |
 |------|------|
-| 版本上传 | Zip Slip 防护、条目数/体积上限、Fullstack 包格式校验、server 生产依赖安装 |
+| 版本上传 | Zip Slip 防护、条目数/体积上限、解压丢弃任意层级 `node_modules`、Fullstack 包格式校验、server 生产依赖安装 |
 | 短部署 | `deploy` / `start` / `restart` 立即返回 `deploying`，后台按 PM2 真实状态 + healthCheck 写回 `running`/`error`/`stopped` |
 | 生命周期 | `start` / `stop` / `restart` / `remove`；父应用重启后异步 `syncAllStatuses` 对齐 PM2 |
 | 双通道访问 | 自定义域名透明反代 + `/app/{name}` 剥前缀反代 |
@@ -196,7 +196,7 @@ await fastify.listen({ port: 3000 });
 | `healthCheckTimeoutMs` | number | 否 | `30000` | 探测总超时（毫秒） |
 | `healthCheckIntervalMs` | number | 否 | `1000` | 探测轮询间隔（毫秒） |
 | `maxZipSize` | number | 否 | `209715200` | zip 最大字节（200MB）；同步 multipart 限制 |
-| `maxZipEntries` | number | 否 | `20000` | zip 最大条目数 |
+| `maxZipEntries` | number | 否 | `20000` | zip 最大条目数（不含被丢弃的 `node_modules` 条目） |
 | `npmInstallTimeoutMs` | number | 否 | `600000` | `server` 目录 `npm install` 超时 |
 | `sseReplayLines` | number | 否 | `100` | SSE 连接时回放最近行数 |
 | `sseHeartbeatMs` | number | 否 | `15000` | SSE 心跳间隔 |
@@ -311,7 +311,7 @@ await fastify.listen({ port: 3000 });
 | version | string | 是 | 版本号；同应用内唯一 |
 | label | string | 否 | 版本说明 |
 
-成功返回 `appVersion` 记录（含 `artifactPath`、`hasMigration` 等）。包非法或 npm 失败时回滚产物并返回 400。
+成功返回 `appVersion` 记录（含 `artifactPath`、`hasMigration` 等）。包在临时目录完成解压、校验与 `npm install` 后才写入版本表，上传中或失败的包不会出现在版本列表；包非法或 npm 失败时清理临时目录并返回 400。版本号已存在返回 409；同版本号仅残留软删除记录时会先彻底清除再写入。
 
 ##### GET `{prefix}/app/version/list`
 

package/libs/services/app.js

@@ -1,5 +1,6 @@
 const fp = require('fastify-plugin');
 const path = require('node:path');
+const crypto = require('node:crypto');
 const fs = require('fs-extra');
 const portPool = require('../utils/portPool');
 const { mergeEnv, maskEnvForResponse, applyEnvPatch, mergePm2Config, normalizeSecretKeys, collectSecretKeys } = require('../utils/env');
@@ -184,41 +185,62 @@ module.exports = fp(async (fastify, options) => {
     if (!app) {
       httpError(404, `app ${name} not found; create it first`);
     }
-    const dup = await models.appVersion.findOne({ where: { appName: name, version } });
-    if (dup) {
+    // The (app_name, version) unique index also covers soft-deleted rows, so they must be purged before reuse.
+    const dup = await models.appVersion.findOne({ where: { appName: name, version }, paranoid: false });
+    if (dup && !dup.isSoftDeleted()) {
       httpError(409, `version ${version} already exists`);
     }
+    if (dup) {
+      await dup.destroy({ force: true });
+    }
 
-    const versionRow = await models.appVersion.create({
-      appName: name,
-      version,
-      label: label || null,
-      artifactPath: path.join(app.rootPath, 'versions', 'pending'),
-      hasMigration: false,
-      migrationPath: options.sqlPath
-    });
-
-    const artifactPath = path.join(app.rootPath, 'versions', String(versionRow.id));
+    // Prepare outside the version table so failed or in-progress uploads never appear in the version list.
+    const versionsDir = path.join(app.rootPath, 'versions');
+    const stagingPath = path.join(versionsDir, `.staging-${crypto.randomUUID()}`);
+    let prepared;
     try {
-      const prepared = await prepareVersionArtifact({
+      prepared = await prepareVersionArtifact({
         zipBuffer,
-        artifactPath,
+        artifactPath: stagingPath,
         maxZipSize: options.maxZipSize,
         maxZipEntries: options.maxZipEntries,
         npmInstallTimeoutMs: options.npmInstallTimeoutMs,
         sqlPath: options.sqlPath
       });
-      await versionRow.update({
-        artifactPath,
-        hasMigration: prepared.hasMigration,
-        migrationPath: prepared.migrationPath
-      });
-      return versionRow.toJSON();
     } catch (e) {
-      await fs.remove(artifactPath).catch(() => {});
-      await versionRow.destroy().catch(() => {});
+      await fs.remove(stagingPath).catch(() => {});
       httpError(400, e.message);
     }
+
+    let artifactPath = null;
+    try {
+      return await models.appVersion.sequelize.transaction(async transaction => {
+        const versionRow = await models.appVersion.create(
+          {
+            appName: name,
+            version,
+            label: label || null,
+            artifactPath: stagingPath,
+            hasMigration: prepared.hasMigration,
+            migrationPath: prepared.migrationPath
+          },
+          { transaction }
+        );
+        artifactPath = path.join(versionsDir, String(versionRow.id));
+        await fs.move(stagingPath, artifactPath);
+        await versionRow.update({ artifactPath }, { transaction });
+        return versionRow.toJSON();
+      });
+    } catch (e) {
+      await fs.remove(stagingPath).catch(() => {});
+      if (artifactPath) {
+        await fs.remove(artifactPath).catch(() => {});
+      }
+      if (e.name === 'SequelizeUniqueConstraintError') {
+        httpError(409, `version ${version} already exists`);
+      }
+      throw e;
+    }
   };
 
   const listVersions = async ({ name, perPage = 20, currentPage = 1 }) => {

package/libs/utils/zip.js

@@ -7,6 +7,10 @@ const isPathInside = (parent, child) => {
   return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
 };
 
+const normalizeEntryName = name => name.replace(/^[/\\]+/, '').replace(/\\/g, '/');
+
+const isNodeModulesEntry = name => normalizeEntryName(name).split('/').includes('node_modules');
+
 const extractZipSafe = async (zipBuffer, destDir, { maxZipSize, maxZipEntries }) => {
   if (!Buffer.isBuffer(zipBuffer)) {
     throw new Error('zip content must be a Buffer');
@@ -17,13 +21,14 @@ const extractZipSafe = async (zipBuffer, destDir, { maxZipSize, maxZipEntries })
 
   await fs.ensureDir(destDir);
   const zip = new AdmZip(zipBuffer);
-  const entries = zip.getEntries();
+  // Dependencies are reinstalled after extraction, so bundled node_modules are dropped before the entry limit applies.
+  const entries = zip.getEntries().filter(entry => !isNodeModulesEntry(entry.entryName));
   if (entries.length > maxZipEntries) {
     throw new Error(`zip has too many entries (${entries.length} > ${maxZipEntries})`);
   }
 
   for (const entry of entries) {
-    const entryName = entry.entryName.replace(/^[/\\]+/, '').replace(/\\/g, '/');
+    const entryName = normalizeEntryName(entry.entryName);
     if (!entryName || entryName.includes('\0')) {
       throw new Error('invalid zip entry name');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kne/fastify-app-manager",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Fastify 单机应用市场插件：版本上传、PM2 托管、路径/域名反代与日志 SSE",
   "main": "index.js",
   "scripts": {