@mriekki/project-forge 4.22.0 → 4.22.1

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.22.0",
+  "version": "4.22.1",
   "defaultProfile": "greenfield-project",
   "profiles": {
     "greenfield-project": {
@@ -21,7 +21,7 @@
       "canonicalDescriptor": "distributions/greenfield-workspace.json"
     },
     "deployment": {
-      "revision": "2258794181483747ed11a2c3c3226d6e66e1b9bb",
+      "revision": "39fbd69e7b81a93929f60d107dac18bb3f1c675c",
       "distribution": "greenfield-project",
       "descriptor": "assets/deployment/distribution.json",
       "sourceRoot": "assets/generated/deployment",

package/assets/generated/ASSEMBLY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.22.0",
+  "version": "4.22.1",
   "components": {
     "core": {
       "revision": "4c74c1801b82d3aa438447d392024d32ca5697b0",
@@ -361,7 +361,7 @@
       ]
     },
     "deployment": {
-      "revision": "2258794181483747ed11a2c3c3226d6e66e1b9bb",
+      "revision": "39fbd69e7b81a93929f60d107dac18bb3f1c675c",
       "distribution": "greenfield-project",
       "files": [
         {
@@ -442,7 +442,7 @@
         {
           "source": "src/project_forge_deployment/cloudflare_ingress_remote.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress_remote.py",
-          "sha256": "19de0d8c04b7ad0006b8bc341eabd52a5eaa50c0e0bacdc9edb856de101dd259"
+          "sha256": "665fe9aa209d3caa81332a7a4291159900ca457339c64dcd05169dfe35e8dc67"
         },
         {
           "source": "src/project_forge_deployment/cloudflare_route_apply.py",

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_ingress_remote.py

@@ -56,6 +56,23 @@ marker_value() {
     sed -n "s/^${key}=//p" "$MARKER" | head -n1
 }
 
+# Legacy markers can predate AUTHENTICATED_ORIGIN; an empty explicit value
+# or any other invalid mode must not be treated as an absent key.
+legacy_origin_mode() {
+    local mode
+    [[ -f "$MARKER" && ! -L "$MARKER" ]] || return 1
+    mode="$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)"
+    [[ "$mode" == false ]] && return 0
+    [[ -z "$mode" ]] && ! grep -q '^AUTHENTICATED_ORIGIN=' "$MARKER"
+}
+
+# The pinned root-run Caddy listener creates the Unix socket (0:0:0222).
+# cloudflared owns the containing 0700 directory, not the socket.
+auth_socket_metadata_valid() {
+    [[ -S "$AUTH_SOCKET" && ! -L "$AUTH_SOCKET" &&
+       "$(stat -c '%u:%g:%a' "$AUTH_SOCKET")" == "0:0:222" ]]
+}
+
 platform_ready() {
     [[ "$(docker inspect --format '{{.State.Status}}' "$CADDY_CONTAINER" 2>/dev/null || true)" == "running" ]] &&
     docker network inspect "$NETWORK_NAME" >/dev/null 2>&1
@@ -424,7 +441,7 @@ migration_inspect() {
             echo "Authenticated-origin migration recovery evidence is incomplete or changed." >&2
             exit 37
         fi
-    elif [[ "$mode" == false && ! -e "$MIGRATION_MARKER_BACKUP" &&
+    elif legacy_origin_mode && [[ ! -e "$MIGRATION_MARKER_BACKUP" &&
             ! -e "$MIGRATION_COMPOSE_BACKUP" && ! -e "$MIGRATION_RECEIPT" &&
             ! -e "$AUTH_ROOT" && ! -e "$AUTH_CADDY" ]]; then
         state=clean
@@ -469,7 +486,7 @@ migration_rollback_on_error() {
         fi
     done
     if [[ -e "$AUTH_SOCKET" ]]; then
-        if [[ -S "$AUTH_SOCKET" && "$(stat -c '%u:%g:%a' "$AUTH_SOCKET")" == "65532:65532:222" ]]; then
+        if auth_socket_metadata_valid; then
             rm -f "$AUTH_SOCKET"
         else
             rollback_failed=true
@@ -489,8 +506,8 @@ migration_rollback_on_error() {
 migrate_authenticated_origin() {
     local expected_route_digest="$EXPECTED" state path route_spec
     [[ "$AUTHENTICATED_ORIGIN" == true ]] || { echo "Authenticated-origin migration must opt in explicitly." >&2; exit 37; }
-    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready &&
-       "$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)" == false ]] || {
+    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready ]] &&
+        legacy_origin_mode || {
         echo "Authenticated-origin migration requires a ready legacy scope." >&2; exit 37;
     }
     [[ "$(route_inventory_digest)" == "$expected_route_digest" ]] || {
@@ -568,8 +585,8 @@ rollback_authenticated_origin() {
     cp -p "$MIGRATION_COMPOSE_BACKUP" "$COMPOSE_FILE.rollback.$$"
     mv -f "$COMPOSE_FILE.rollback.$$" "$COMPOSE_FILE"
     docker compose -f "$COMPOSE_FILE" up -d --force-recreate >/dev/null
-    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready &&
-       "$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)" == false ]] || {
+    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready ]] &&
+        legacy_origin_mode || {
         echo "Legacy connector did not become ready after authenticated-origin rollback." >&2; exit 38;
     }
     [[ -f "$AUTH_CADDY" && ! -L "$AUTH_CADDY" ]] || {
@@ -579,7 +596,7 @@ rollback_authenticated_origin() {
     docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null
     for path in "$AUTH_ROUTES"/*.caddy; do [[ -f "$path" ]] && rm -f "$path"; done
     if [[ -e "$AUTH_SOCKET" ]]; then
-        [[ -S "$AUTH_SOCKET" && "$(stat -c '%u:%g:%a' "$AUTH_SOCKET")" == "65532:65532:222" ]] || {
+        auth_socket_metadata_valid || {
             echo "Authenticated origin socket changed before rollback." >&2; exit 38;
         }
         rm -f "$AUTH_SOCKET"
@@ -602,9 +619,9 @@ verify_authenticated_origin() {
     local expected_route_digest="$EXPECTED" path route_spec
     [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready &&
        "$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)" == true &&
-       -S "$AUTH_SOCKET" && -d "$AUTH_ROOT" && ! -L "$AUTH_ROOT" &&
-       "$(stat -c '%u:%g:%a' "$AUTH_ROOT")" == "65532:65532:700" &&
-       "$(stat -c '%u:%g:%a' "$AUTH_SOCKET")" == "65532:65532:222" ]] || {
+       -d "$AUTH_ROOT" && ! -L "$AUTH_ROOT" &&
+       "$(stat -c '%u:%g:%a' "$AUTH_ROOT")" == "65532:65532:700" ]] &&
+        auth_socket_metadata_valid || {
         echo "Authenticated-origin socket or scope is not ready." >&2; exit 40;
     }
     [[ "$(route_inventory_digest)" == "$expected_route_digest" ]] || {
@@ -615,6 +632,7 @@ verify_authenticated_origin() {
     }
     path_overlap() {
         local left="${1%/}" right="${2%/}"
+        [[ -n "$left" && -n "$right" ]] || return 1
         [[ "$left" == "$right" || "$left" == "$right/"* || "$right" == "$left/"* ]]
     }
     local connector_id caddy_id mount_count other_id mounts source destination writable source_mount
@@ -623,6 +641,7 @@ verify_authenticated_origin() {
     mapfile -t mounts < <(docker inspect --format '{{range .Mounts}}{{printf "%s|%s|%t\n" .Source .Destination .RW}}{{end}}' "$CONTAINER")
     mount_count=0
     for source_mount in "${mounts[@]}"; do
+        [[ -n "$source_mount" ]] || continue
         IFS='|' read -r source destination writable <<< "$source_mount"
         if path_overlap "$source" "$AUTH_ROOT" || path_overlap "$destination" "/run/project-forge-origin"; then
             [[ "$source" == "$AUTH_ROOT" && "$destination" == "/run/project-forge-origin" &&
@@ -639,6 +658,7 @@ verify_authenticated_origin() {
         [[ -n "$other_id" && "$other_id" != "$connector_id" && "$other_id" != "$caddy_id" ]] || continue
         mapfile -t mounts < <(docker inspect --format '{{range .Mounts}}{{printf "%s|%s\n" .Source .Destination}}{{end}}' "$other_id")
         for source_mount in "${mounts[@]}"; do
+            [[ -n "$source_mount" ]] || continue
             IFS='|' read -r source destination <<< "$source_mount"
             if path_overlap "$source" "$AUTH_ROOT" ||
                path_overlap "$destination" "/run/project-forge-origin"; then
@@ -646,7 +666,7 @@ verify_authenticated_origin() {
                 exit 40
             fi
         done
-    done < <(docker ps -aq)
+    done < <(docker ps -aq --no-trunc)
     [[ -f "$AUTH_CADDY" && ! -L "$AUTH_CADDY" ]] &&
         grep -Fqx "    bind unix//data/authenticated/$SCOPE/origin.sock|0222" "$AUTH_CADDY" &&
         grep -Fqx "    import /data/authenticated/$SCOPE/routes/*.caddy" "$AUTH_CADDY" || {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.22.0",
+  "version": "4.22.1",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {