@moretea-labs/forge 1.7.0 → 1.7.2

package/src/runtime/plugins/app-store-connect-adapter.ts

@@ -1,5 +1,5 @@
 import { createPrivateKey, sign } from 'crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { accessSync, constants as fsConstants, existsSync, mkdirSync, promises as fsPromises, readFileSync, statSync, writeFileSync } from 'fs';
 import { dirname, join } from 'path';
 import { CONTROLLER_SCOPE_REPO_ID, controllerSystemRoot } from '../../cli/repositories/controller-home';
 import type {
@@ -19,6 +19,8 @@ const CONFIG_ROOT = '.forge/plugins';
 const LEGACY_CONFIG_ROOT = '.repo-harness/plugins';
 const API_BASE_URL = 'https://api.appstoreconnect.apple.com';
 const DEFAULT_TIMEOUT_MS = 60_000;
+const PRIVATE_KEY_READ_MAX_ATTEMPTS = 4;
+const PRIVATE_KEY_READ_RETRY_BASE_MS = 10;
 
 type AppStoreConnectProviderKind = 'mock' | 'app-store-connect-api';
 
@@ -154,20 +156,82 @@ function envValue(name: string): string | undefined {
   return stringValue(process.env[name]);
 }
 
-function privateKeyMaterial(config: AppStoreConnectPluginConfig): { key?: string; source?: string; warning?: string } {
+interface AppStoreConnectPrivateKeyReference {
+  available: boolean;
+  source?: string;
+  warning?: string;
+}
+
+function privateKeyPathReference(path: string, source: string): AppStoreConnectPrivateKeyReference {
+  if (!existsSync(path)) {
+    return { available: false, source, warning: 'Configured App Store Connect private key path does not exist.' };
+  }
+  try {
+    if (!statSync(path).isFile()) {
+      return { available: false, source, warning: 'Configured App Store Connect private key path is not a regular file.' };
+    }
+    accessSync(path, fsConstants.R_OK);
+    return { available: true, source };
+  } catch {
+    // Capability discovery and auth_status are metadata reads. They must never
+    // synchronously consume secret bytes just to decide whether a credential
+    // reference is usable; filesystem contention (including macOS EDEADLK)
+    // therefore degrades readiness instead of escaping as a raw read error.
+    return { available: false, source, warning: 'Configured App Store Connect private key path is not readable.' };
+  }
+}
+
+function privateKeyReference(config: AppStoreConnectPluginConfig): AppStoreConnectPrivateKeyReference {
   const inline = envValue('FORGE_ASC_PRIVATE_KEY');
-  if (inline) return { key: inline.replace(/\\n/g, '\n'), source: 'env:FORGE_ASC_PRIVATE_KEY' };
+  if (inline) return { available: true, source: 'env:FORGE_ASC_PRIVATE_KEY' };
   const envKeyPath = envValue('FORGE_ASC_PRIVATE_KEY_PATH');
-  if (envKeyPath) {
-    return existsSync(envKeyPath)
-      ? { key: readFileSync(envKeyPath, 'utf-8'), source: 'env:FORGE_ASC_PRIVATE_KEY_PATH' }
-      : { source: 'env:FORGE_ASC_PRIVATE_KEY_PATH', warning: 'Configured App Store Connect private key path does not exist.' };
-  }
-  if (config.privateKeyPath) {
-    return existsSync(config.privateKeyPath)
-      ? { key: readFileSync(config.privateKeyPath, 'utf-8'), source: 'config:privateKeyPath' }
-      : { source: 'config:privateKeyPath', warning: 'Configured App Store Connect private key path does not exist.' };
+  if (envKeyPath) return privateKeyPathReference(envKeyPath, 'env:FORGE_ASC_PRIVATE_KEY_PATH');
+  if (config.privateKeyPath) return privateKeyPathReference(config.privateKeyPath, 'config:privateKeyPath');
+  return { available: false };
+}
+
+function fsErrorCode(error: unknown): string | undefined {
+  if (!error || typeof error !== 'object' || !('code' in error)) return undefined;
+  const code = (error as { code?: unknown }).code;
+  return typeof code === 'string' ? code : undefined;
+}
+
+async function readPrivateKeyFile(path: string, source: string): Promise<{ key?: string; source: string; warning?: string }> {
+  for (let attempt = 1; attempt <= PRIVATE_KEY_READ_MAX_ATTEMPTS; attempt += 1) {
+    try {
+      return { key: await fsPromises.readFile(path, 'utf-8'), source };
+    } catch (error) {
+      const code = fsErrorCode(error);
+      if (code === 'ENOENT') {
+        return { source, warning: 'Configured App Store Connect private key path does not exist.' };
+      }
+      if (code === 'EDEADLK' && attempt < PRIVATE_KEY_READ_MAX_ATTEMPTS) {
+        await new Promise((resolve) => setTimeout(resolve, PRIVATE_KEY_READ_RETRY_BASE_MS * attempt));
+        continue;
+      }
+      if (code === 'EDEADLK') {
+        throw new AssistantPluginError(
+          'PLUGIN_PROVIDER_UNAVAILABLE',
+          'App Store Connect private key is temporarily unavailable because the filesystem is busy.',
+          { retryable: true, details: { credentialSource: source, code } },
+        );
+      }
+      throw new AssistantPluginError(
+        'PLUGIN_AUTH_REQUIRED',
+        'Configured App Store Connect private key could not be read.',
+        { retryable: false, details: { credentialSource: source, code } },
+      );
+    }
   }
+  throw new AssistantPluginError('PLUGIN_PROVIDER_UNAVAILABLE', 'App Store Connect private key is temporarily unavailable.', { retryable: true });
+}
+
+async function privateKeyMaterial(config: AppStoreConnectPluginConfig): Promise<{ key?: string; source?: string; warning?: string }> {
+  const inline = envValue('FORGE_ASC_PRIVATE_KEY');
+  if (inline) return { key: inline.replace(/\\n/g, '\n'), source: 'env:FORGE_ASC_PRIVATE_KEY' };
+  const envKeyPath = envValue('FORGE_ASC_PRIVATE_KEY_PATH');
+  if (envKeyPath) return readPrivateKeyFile(envKeyPath, 'env:FORGE_ASC_PRIVATE_KEY_PATH');
+  if (config.privateKeyPath) return readPrivateKeyFile(config.privateKeyPath, 'config:privateKeyPath');
   return {};
 }
 
@@ -188,12 +252,12 @@ function resolveAuth(config: AppStoreConnectPluginConfig): AppStoreConnectAuthSt
 
   const issuerId = envValue('FORGE_ASC_ISSUER_ID') ?? config.issuerId;
   const keyId = envValue('FORGE_ASC_KEY_ID') ?? config.keyId;
-  const key = privateKeyMaterial(config);
+  const key = privateKeyReference(config);
   const errors: string[] = [];
   const warnings: string[] = key.warning ? [key.warning] : [];
   if (!issuerId) errors.push('Set FORGE_ASC_ISSUER_ID or configure issuer_id.');
   if (!keyId) errors.push('Set FORGE_ASC_KEY_ID or configure key_id.');
-  if (!key.key) errors.push('Set FORGE_ASC_PRIVATE_KEY, FORGE_ASC_PRIVATE_KEY_PATH, or configure private_key_path.');
+  if (!key.available) errors.push('Set FORGE_ASC_PRIVATE_KEY, FORGE_ASC_PRIVATE_KEY_PATH, or configure private_key_path.');
 
   return {
     provider: 'app-store-connect-api',
@@ -269,10 +333,10 @@ function derSignatureToJose(signature: Buffer): string {
   return Buffer.concat([derIntegerToJose(r), derIntegerToJose(s)]).toString('base64url');
 }
 
-function createJwt(config: AppStoreConnectPluginConfig): string {
+async function createJwt(config: AppStoreConnectPluginConfig): Promise<string> {
   const issuerId = envValue('FORGE_ASC_ISSUER_ID') ?? config.issuerId;
   const keyId = envValue('FORGE_ASC_KEY_ID') ?? config.keyId;
-  const key = privateKeyMaterial(config).key;
+  const key = (await privateKeyMaterial(config)).key;
   if (!issuerId || !keyId || !key) throw new AssistantPluginError('PLUGIN_AUTH_REQUIRED', 'App Store Connect API credentials are incomplete.', { retryable: false });
 
   const issuedAt = Math.floor(Date.now() / 1000);
@@ -298,7 +362,7 @@ async function apiRequest<T>(config: AppStoreConnectPluginConfig, options: {
     const response = await fetch(url, {
       method: options.method ?? 'GET',
       headers: {
-        authorization: `Bearer ${createJwt(config)}`,
+        authorization: `Bearer ${await createJwt(config)}`,
         accept: 'application/json',
         ...(options.body === undefined ? {} : { 'content-type': 'application/json' }),
       },
@@ -807,20 +871,21 @@ export async function executeAppStoreConnectPluginAction(input: AssistantPluginA
 
   if (config.provider === 'mock') return mockResponse(input.actionId, input.args, config);
   const auth = resolveAuth(config);
+  if (input.actionId === 'auth_status') {
+    return {
+      ready: config.enabled && auth.ready,
+      provider: auth.provider,
+      issuerId: auth.issuerId ? 'configured' : undefined,
+      keyId: auth.keyId ? 'configured' : undefined,
+      credentialSource: auth.credentialSource,
+      errors: auth.errors,
+      warnings: auth.warnings,
+      userFacingStatus: userFacingAscStatus(config, auth),
+    };
+  }
   if (!config.enabled || !auth.ready) throw new AssistantPluginError('PLUGIN_NOT_READY', 'App Store Connect plugin is not ready.', { retryable: false, details: { enabled: config.enabled, errors: auth.errors } });
 
   switch (input.actionId) {
-    case 'auth_status':
-      return {
-        ready: auth.ready,
-        provider: auth.provider,
-        issuerId: auth.issuerId ? 'configured' : undefined,
-        keyId: auth.keyId ? 'configured' : undefined,
-        credentialSource: auth.credentialSource,
-        errors: auth.errors,
-        warnings: auth.warnings,
-        userFacingStatus: userFacingAscStatus(config, auth),
-      };
     case 'list_apps':
       return apiRequest(config, { path: '/v1/apps', query: { 'filter[bundleId]': stringValue(input.args.bundle_id), 'filter[name]': stringValue(input.args.name), limit: limit(input.args.limit) } });
     case 'list_bundle_ids':