@nocobase/app-plugin-releases 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/server/services/releases.js

@@ -26,6 +26,11 @@ import { decryptText, encryptText } from './secrets.js';
 import { DEFAULT_INITIAL_ADMIN, INITIAL_ADMIN_PATHS, PUBLIC_ORIGIN_PATH, SAMPLE_DATA_PATH, appVariableView, assertVariableName, assertVariableValue, configValueAt, decodeVariablesManifest, generateVariable, hasRealValue, isSecretName, parseVariablesManifest, randomPassword, resolveVariables, } from './variables.js';
 import { APP_ID_PATTERN, assertAppId, assertPagination, normalizeLabels, normalizeName, normalizeRuntimePolicy, releaseArtifactKey, } from './validation.js';
 const DEFAULT_STARTUP_WAIT_MS = 5_000;
+/** `<appId>-<version>.tar.gz`, with anything but letters, digits, `.`, `_` and `-` replaced. */
+export function archiveFileName(appId, version) {
+    const safe = (text) => text.replace(/[^A-Za-z0-9._-]+/gu, '_').replace(/^\.+/u, '') || 'release';
+    return `${safe(appId)}-${safe(version)}.tar.gz`;
+}
 export class ReleasesService {
     options;
     diagnostic;
@@ -118,7 +123,7 @@ export class ReleasesService {
                 : {}),
         };
     }
-    async createApp(caller, input) {
+    async createApp(caller, input, options = {}) {
         this.options.guard.requireCreate(caller);
         if (!input || typeof input.id !== 'string')
             throw new ReleasesError('An App ID is required.', 'INVALID_APP_ID', 'INVALID_ARGUMENT');
@@ -147,28 +152,32 @@ export class ReleasesService {
                 if (await this.findApp(id))
                     throw new ReleasesError('Application ID is unavailable. Choose a different ID.', 'APP_EXISTS', 'ALREADY_EXISTS');
                 await this.assertEnvironmentCapacity(environment);
-                await this.query()
-                    .insertInto('relApps')
-                    .values({
-                    id,
-                    environmentId: environment.id,
-                    name,
-                    description: typeof input.description === 'string' && input.description.trim()
-                        ? input.description.trim()
-                        : null,
-                    currentDeploymentId: null,
-                    enabled: false,
-                    activation: policy.activation,
-                    idleStopMinutes: policy.idleStopMinutes,
-                    dormantAfterHours: policy.dormantAfterHours,
-                    labels: JSON.stringify(labels),
-                    previewOf,
-                    createdBy: caller.userId,
-                    createdVia: caller.kind,
-                    createdAt: now,
-                    updatedAt: now,
-                })
-                    .execute();
+                await this.options.database.transaction(async (connection) => {
+                    await connection.query
+                        .insertInto('relApps')
+                        .values({
+                        id,
+                        environmentId: environment.id,
+                        name,
+                        description: typeof input.description === 'string' &&
+                            input.description.trim()
+                            ? input.description.trim()
+                            : null,
+                        currentDeploymentId: null,
+                        enabled: false,
+                        activation: policy.activation,
+                        idleStopMinutes: policy.idleStopMinutes,
+                        dormantAfterHours: policy.dormantAfterHours,
+                        labels: JSON.stringify(labels),
+                        previewOf,
+                        createdBy: caller.userId,
+                        createdVia: caller.kind,
+                        createdAt: now,
+                        updatedAt: now,
+                    })
+                        .execute();
+                    await options.initialize?.(connection, id);
+                });
             });
         }
         catch (error) {
@@ -271,6 +280,48 @@ export class ReleasesService {
         const images = await this.artifacts.imagesOf([release.id]);
         return releaseView(release, images.get(release.id) ?? []);
     }
+    /**
+     * Several Apps' summaries in one batched read (one runtime status call per environment), for the assembling
+     * application: no caller is checked. Unknown ids are left out; the rest keep the order asked.
+     */
+    async summarizeApps(appIds) {
+        const ids = [...new Set(appIds)];
+        if (ids.length === 0)
+            return [];
+        const rows = await this.query()
+            .selectFrom('relApps')
+            .selectAll()
+            .where('id', 'in', ids)
+            .execute();
+        const byId = new Map(rows.map(decodeApp).map((app) => [app.id, app]));
+        const apps = ids.flatMap((id) => {
+            const app = byId.get(id);
+            return app ? [app] : [];
+        });
+        return this.summarize(apps);
+    }
+    /**
+     * A release's archive, to download: `view` on the App. An image release has none (`RELEASE_HAS_NO_ARCHIVE`), and an
+     * archive missing from the disk is `RELEASE_ARCHIVE_NOT_FOUND`. The stream is opened last, so a refusal never touches
+     * the disk.
+     */
+    async openArchive(caller, appId, releaseId) {
+        const app = await this.requireApp(appId);
+        await this.options.guard.requireApp(caller, 'view', app);
+        const release = await this.requireRelease(appId, releaseId);
+        const key = release.artifactKey;
+        if (!key)
+            throw new ReleasesError('This release is a set of images and has no archive to download.', 'RELEASE_HAS_NO_ARCHIVE', 'FAILED_PRECONDITION');
+        // A local disk opens its file lazily, so a missing archive would fail only after the response headers went out.
+        if (!(await this.disk.exists(key)))
+            throw notFound('Archive', 'RELEASE_ARCHIVE_NOT_FOUND', releaseId);
+        return {
+            stream: await this.disk.getStream(key),
+            size: release.size,
+            checksum: release.checksum,
+            fileName: archiveFileName(app.id, release.version),
+        };
+    }
     /**
      * Registers an image CI built and pushed, by digest, as a release of `version` (an image release, which Docker
      * environments pull). It needs `upload` on the App, as uploading an archive does. The same digest again answers its
@@ -930,7 +981,6 @@ export class ReleasesService {
      * not report every App as stopped or a finished deployment as still running.
      */
     async restore() {
-        await this.clearExpiredInitialAdmins().catch((error) => this.diagnostic.warn('Failed to clear expired first administrators', error));
         const interrupted = (await this.query()
             .selectFrom('relDeployments')
             .selectAll()
@@ -1201,15 +1251,14 @@ export class ReleasesService {
     }
     /**
      * The first administrator the App's first deployment generated, for a person who may deploy it: until someone
-     * says it is saved, and for 24 hours (a preview App's until the App goes).
+     * says it is saved or the App is removed.
      */
     async readInitialAdmin(caller, appId) {
         const app = await this.requireApp(appId);
         await this.requireInitialAdminReader(caller, app);
-        await this.clearExpiredInitialAdmins();
         const found = await this.initialAdminOf(app);
         if (!found)
-            throw new ReleasesError('This App has no first administrator to show: it was saved, it expired, or the application did not generate one.', 'INITIAL_ADMIN_UNAVAILABLE', 'NOT_FOUND');
+            throw new ReleasesError('This App has no first administrator to show: it was saved or the application did not generate one.', 'INITIAL_ADMIN_UNAVAILABLE', 'NOT_FOUND');
         return found;
     }
     /** Forgets the generated first administrator once someone has saved it. */
@@ -1227,16 +1276,6 @@ export class ReleasesService {
             .where('initialAdmin', 'is not', null)
             .execute();
     }
-    /** Clears the first administrators whose 24 hours are over. */
-    async clearExpiredInitialAdmins(now = new Date()) {
-        await this.query()
-            .updateTable('relDeployments')
-            .set({ initialAdmin: null })
-            .where('initialAdmin', 'is not', null)
-            .where('initialAdminExpiresAt', 'is not', null)
-            .where('initialAdminExpiresAt', '<=', now)
-            .execute();
-    }
     async requireInitialAdminReader(caller, app) {
         // A password a person copies: never an agent's or a key's, whatever they may deploy.
         if (caller.kind !== 'human' &&
@@ -1253,18 +1292,14 @@ export class ReleasesService {
             .where('initialAdmin', 'is not', null)
             .orderBy('createdAt', 'desc')
             .execute();
-        const now = new Date();
         for (const deployment of rows.map(decodeDeployment)) {
-            if (deployment.initialAdminExpiresAt &&
-                deployment.initialAdminExpiresAt <= now)
-                continue;
             const admin = this.openInitialAdmin(deployment);
             if (!admin)
                 continue;
             return {
                 deploymentId: deployment.id,
                 ...admin,
-                expiresAt: iso(deployment.initialAdminExpiresAt),
+                expiresAt: null,
             };
         }
         return null;
@@ -1434,7 +1469,6 @@ export class ReleasesService {
         for (const [name, variable] of plan.oneShot)
             generated[name] = generateVariable(variable.generate);
         let initialAdmin = null;
-        let initialAdminExpiresAt = null;
         if (plan.initialAdmin) {
             const password = (await this.earlierInitialAdmin(app))?.password ?? randomPassword();
             generated[plan.initialAdmin.name] = password;
@@ -1444,10 +1478,6 @@ export class ReleasesService {
                 password,
             };
             initialAdmin = encryptText(JSON.stringify(admin), [deploymentId], this.options.secrets, 'initial-admin');
-            // A preview App's goes with the preview; any other's is deleted after a day.
-            initialAdminExpiresAt = app.previewOf
-                ? null
-                : new Date(Date.now() + INITIAL_ADMIN_TTL_MS);
         }
         const resolved = resolveVariables({
             manifest: release.variables,
@@ -1465,7 +1495,6 @@ export class ReleasesService {
                 : encryptText(JSON.stringify(resolved.env), [deploymentId], this.options.secrets, 'deployment-env'),
             variablesFingerprint: release.variables || names.length > 0 ? resolved.fingerprint : null,
             initialAdmin,
-            initialAdminExpiresAt,
         };
     }
     /**
@@ -2333,8 +2362,6 @@ export class ReleasesService {
         return this.options.database.connection().query;
     }
 }
-// --- Variables --------------------------------------------------------------------------------------------------
-const INITIAL_ADMIN_TTL_MS = 24 * 60 * 60 * 1000;
 /** A variable's value from the App or the environment, when one of them sets it. */
 function suppliedValue(context, name) {
     return (context.appVariables.find((variable) => variable.name === name)?.value ??
@@ -2689,7 +2716,6 @@ function decodeDeployment(row) {
         env: nullableString(row.env),
         variablesFingerprint: nullableString(row.variablesFingerprint),
         initialAdmin: nullableString(row.initialAdmin),
-        initialAdminExpiresAt: decodeOptionalDate(row.initialAdminExpiresAt),
         initialAdminSavedBy: nullableString(row.initialAdminSavedBy),
         initialAdminSavedAt: decodeOptionalDate(row.initialAdminSavedAt),
         createdAt: decodeDate(row.createdAt),