@metric-im/administrate 1.1.9 → 1.2.3

package/.claude/settings.local.json

@@ -1,16 +1,10 @@
 {
   "permissions": {
     "allow": [
-      "Read(//home/msprague/workspace/rootz/epistery/docs/**)",
-      "Read(//home/msprague/workspace/rootz/epistery/src/**)",
-      "Read(//home/msprague/workspace/rootz/epistery/**)",
-      "Read(//home/msprague/workspace/rootz/rhonda/node_modules/epistery/**)",
-      "Read(//home/msprague/workspace/rootz/rhonda/**)",
-      "Read(//home/msprague/workspace/metric-im/account-control/**)",
-      "Bash(sed:*)",
-      "Bash(git checkout:*)"
+      "Read(//home/msprague/workspace/sitewell/**)",
+      "Read(//home/msprague/workspace/rootz/data-wallet-demos/**)"
     ],
     "deny": [],
     "ask": []
   }
-}
+}

package/multisite.mjs

@@ -1,4 +1,5 @@
 import express from 'express';
+import compression from 'compression';
 import tls from 'tls';
 import { Config } from 'epistery';
 import moment from 'moment';
@@ -39,7 +40,9 @@ export class MultiSite {
             console.log('Emergency cleanup on exit...');
             Object.values(this.sites).forEach((site) => {
                 if (site.proc && !site.proc.killed) {
-                    site.proc.kill('SIGKILL');
+                    try { process.kill(-site.proc.pid, 'SIGKILL'); } catch(e) {
+                        try { site.proc.kill('SIGKILL'); } catch(e2) {}
+                    }
                 }
             });
         });
@@ -76,41 +79,27 @@ export class MultiSite {
     async cleanup() {
         console.log('Cleaning up spawned processes...');
 
-        // Set a global timeout for the entire cleanup process
-        const cleanupTimeout = setTimeout(() => {
-            console.log('Cleanup taking too long, forcing exit...');
-            process.exit(1);
-        }, 15000); // 15 second total timeout
-
-        const promises = Object.values(this.sites).map(async (site) => {
+        // Kill all process groups immediately — no grace period.
+        // systemd restart kills and relaunches in quick succession,
+        // so async waits just create orphans.
+        Object.values(this.sites).forEach((site) => {
             if (site.proc && !site.proc.killed) {
-                return new Promise((resolve) => {
-                    const timeout = setTimeout(() => {
-                        if (!site.proc.killed) {
-                            console.log(`Force killing ${site.name} after timeout`);
-                            site.proc.kill('SIGKILL');
-                        }
-                        resolve();
-                    }, 5000); // Reduced to 5 second timeout per process
-
-                    site.proc.kill('SIGTERM');
-
-                    site.proc.on('exit', () => {
-                        console.log(`${site.name} process terminated gracefully`);
-                        clearTimeout(timeout);
-                        resolve();
-                    });
-                });
+                const pid = site.proc.pid;
+                try {
+                    process.kill(-pid, 'SIGTERM');
+                    console.log(`Killed process group for ${site.name} (pgid ${pid})`);
+                } catch(e) {
+                    // Fallback to direct kill if process group kill fails
+                    try { site.proc.kill('SIGKILL'); } catch(e2) {}
+                    console.log(`Direct killed ${site.name} (pid ${pid})`);
+                }
             }
         });
 
-        await Promise.all(promises.filter(Boolean));
-
         // Clear all health check intervals
         this.healthCheckIntervals.forEach(interval => clearInterval(interval));
         this.healthCheckIntervals.clear();
 
-        clearTimeout(cleanupTimeout);
         console.log('All spawned processes cleaned up');
     }
 
@@ -133,9 +122,11 @@ export class MultiSite {
                     clearInterval(intervalId);
                     this.healthCheckIntervals.delete(site.name);
 
-                    // Mark the process as failed for cleanup
+                    // Kill the failed process group
                     if (site.proc && !site.proc.killed) {
-                        site.proc.kill('SIGTERM');
+                        try { process.kill(-site.proc.pid, 'SIGTERM'); } catch(e) {
+                            try { site.proc.kill('SIGTERM'); } catch(e2) {}
+                        }
                     }
                 }
             }
@@ -154,9 +145,11 @@ export class MultiSite {
                 this.healthCheckIntervals.delete(oldSite.name);
             }
 
-            // Kill old process
+            // Kill old process group
             if (oldSite.proc && !oldSite.proc.killed) {
-                oldSite.proc.kill('SIGTERM');
+                try { process.kill(-oldSite.proc.pid, 'SIGTERM'); } catch(e) {
+                    try { oldSite.proc.kill('SIGTERM'); } catch(e2) {}
+                }
             }
 
             // Remove from used ports
@@ -213,6 +206,17 @@ export class MultiSite {
         const instance = new MultiSite(app,options);
         instance.config = new Config();
 
+        // Compression and security headers for all responses
+        app.use(compression());
+        app.use((req, res, next) => {
+            res.set('X-Content-Type-Options', 'nosniff');
+            res.set('X-Frame-Options', 'SAMEORIGIN');
+            if (req.secure) {
+                res.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+            }
+            next();
+        });
+
         // spawn declared sites
         if (fs.existsSync(resolve('./sites'))) {
             instance.sites = (fs.readdirSync(resolve('./sites'))).reduce((result,hostName)=>{
@@ -242,8 +246,8 @@ export class MultiSite {
                 const payload = isBodyMethod ? req.body : null;
                 const clientIP = req.ip || req.connection.remoteAddress || req.headers['x-forwarded-for'];
 
-                // Debug logging for POST requests
-                if (method === 'POST') {
+                // Debug logging for POST requests (set DEBUG_PROXY=1 to enable)
+                if (method === 'POST' && process.env.DEBUG_PROXY) {
                     console.log(`[Proxy] ${method} ${target}`);
                     console.log(`[Proxy] Request body:`, req.body);
                     console.log(`[Proxy] Payload:`, payload);
@@ -381,7 +385,11 @@ export class Site {
         console.log(`Spawning site ${this.name} on port ${this.options.env.PORT}`);
 
         try {
-            this.proc = child_process.spawn('npm', commands, this.options);
+            this.proc = child_process.spawn('npm', commands, {
+                ...this.options,
+                detached: true,
+                stdio: ['ignore', 'pipe', 'pipe']
+            });
 
             this.proc.stdout.on('data', (data) => {
                 process.stdout.write(`${this.name}: ${data.toString()}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metric-im/administrate",
-  "version": "1.1.9",
+  "version": "1.2.3",
   "description": "Tools for site administration",
   "homepage": "https://github.com/metric-im/administrate#readme",
   "bugs": {
@@ -21,6 +21,7 @@
     "@metric-im/componentry": "^1.4.4",
     "acme-client": "^5.4.0",
     "axios": "^1.7.0",
+    "compression": "^1.8.1",
     "epistery": "^1.1.4",
     "express": "^5.1.0",
     "moment": "^2.30.1"

package/synchronize.mjs

@@ -5,6 +5,9 @@
  *  code will automatically remain in sync with the given branch of the
  *  given repository on Github.
  *
+ *  The repositoryPath must point to a directory with a .git/config
+ *  that already has the correct remote configured. No URL discovery
+ *  or override - git pulls from wherever .git/config says.
  */
 import fs from 'fs';
 import express from 'express';
@@ -12,35 +15,27 @@ import {resolve} from "path";
 import {spawn, exec} from 'child_process';
 
 export class Synchronize {
-  constructor(branch) {
-    this.repositoryPath = this.discoverRepositoryPath();
+  /**
+   * @param {string} repositoryPath - directory containing .git/config
+   * @param {string} [branch] - branch to track (default 'main')
+   * @param {function} [authorize] - async (req) => boolean, caller provides auth logic
+   */
+  constructor(repositoryPath, branch, authorize) {
+    if (!repositoryPath) throw new Error('repositoryPath is required');
+    this.repositoryPath = repositoryPath;
     this.branch = branch || 'main';
+    this.authorize = authorize;
     this.appName = this.getAppName();
   }
 
-  static attach(app,branch) {
-    const instance = new Synchronize(branch);
+  static attach(app, repositoryPath, branch, authorize) {
+    const instance = new Synchronize(repositoryPath, branch, authorize);
     app.use('/',instance.routes());
   }
 
-  discoverRepositoryPath() {
-    try {
-      const packageJsonPath = resolve(process.cwd(), 'package.json');
-      if (fs.existsSync(packageJsonPath)) {
-        const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
-        if (packageJson.repository) {
-          return process.cwd();
-        }
-      }
-    } catch (error) {
-      console.warn('Could not find repository path:', error.message);
-    }
-    return process.cwd(); // fallback to current directory
-  }
-
   getAppName() {
     try {
-      const packageJsonPath = resolve(this.repositoryPath || process.cwd(), 'package.json');
+      const packageJsonPath = resolve(this.repositoryPath, 'package.json');
       if (fs.existsSync(packageJsonPath)) {
         const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
         return packageJson.name;
@@ -48,16 +43,16 @@ export class Synchronize {
     } catch (error) {
       console.warn('Could not extract app name from package.json:', error.message);
     }
-
-    // Fallback: extract from repository path or current directory
-    const repoPath = this.repositoryPath || process.cwd();
-    return repoPath.split('/').pop();
+    return this.repositoryPath.split('/').pop();
   }
 
   routes() {
     const router = new express.Router();
     router.get(/^\/_update/, async (req, res) => {
       try {
+        if (this.authorize && !await this.authorize(req)) {
+          return res.status(403).json({success: false, error: 'Not authorized'});
+        }
         await this.update();
         res.json({success: true, message: 'Update completed successfully'});
       } catch (error) {
@@ -70,12 +65,12 @@ export class Synchronize {
     console.log(`Starting deployment update for ${this.repositoryPath} on branch ${this.branch}`);
 
     try {
-      // Pull latest changes from GitHub
+      // Pull latest changes - remote is defined in .git/config
       await this.executeCommand('git', ['fetch', 'origin', this.branch]);
       await this.executeCommand('git', ['reset', '--hard', `origin/${this.branch}`]);
 
       // Install/update dependencies
-      await this.executeCommand('npm', ['install']);
+      await this.executeCommand('npm', ['install', '--no-audit', '--no-fund']);
 
       // Restart the service using systemctl
       console.log(`Restarting service: ${this.appName}`);
@@ -91,12 +86,12 @@ export class Synchronize {
   executeCommand(command, args) {
     return new Promise((resolve, reject) => {
       console.log(`Executing: ${command} ${args.join(' ')}`);
-      const process = spawn(command, args, {
-        stdio: 'inherit',
-        cwd: this.repositoryPath || process.cwd()
+      const child = spawn(command, args, {
+        stdio: ['ignore', 'inherit', 'inherit'],
+        cwd: this.repositoryPath
       });
 
-      process.on('close', (code) => {
+      child.on('close', (code) => {
         if (code === 0) {
           resolve();
         } else {
@@ -104,7 +99,7 @@ export class Synchronize {
         }
       });
 
-      process.on('error', (error) => {
+      child.on('error', (error) => {
         reject(error);
       });
     });
@@ -125,13 +120,13 @@ export class Synchronize {
     });
   }
   static get Package() {
-    if (!Syncrhonize._Package) {
+    if (!Synchronize._Package) {
       let text = fs.readFileSync(resolve('./package.json'), 'utf8');
-      Syncrhonize._Package = JSON.parse(text.toString())
+      Synchronize._Package = JSON.parse(text.toString())
     }
-    return Syncrhonize._Package;
+    return Synchronize._Package;
   }
   static get Version() {
     return Synchronize.Package.version;
   }
-}
+}