@norskvideo/ctl-product-template-schema 0.1.60 → 0.1.62

package/index.js

@@ -601,11 +601,14 @@ const ProductTemplateFileSchema = z.object({
 // subpath) turns this into tar bytes at the paths below.
 //
 // `workflow`, `components` and `dashboards` are known top-level paths in the
-// v1 tar format. The runner detects studio in the compose stack and mounts
-// all three into the studio container automatically — products don't need
-// to declare the mounts.
+// v1 tar format. The runner detects studio in the compose stack and places
+// all three in the studio container automatically — products don't need
+// to declare the mounts. workflow.yml is COPIED into the working directory on
+// every launch (a single-file bind under /data is refused by OrbStack and
+// Docker Desktop); the template stays authoritative, so a Studio save of it
+// lasts only until the next launch.
 //
-//   workflow.yml         → /data/studio-save-files/workflow.yml (RO)
+//   workflow.yml         → /data/studio-save-files/workflow.yml (copied)
 //   components/<name>/   → /usr/src/app/plugins/<name>/         (RO)
 //   dashboards/<name>/   → /data/studio-save-files/<name>/dashboards/ (RO)
 //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-product-template-schema",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "type": "module",
   "repository": {
     "type": "git",
@@ -36,6 +36,10 @@
       "types": "./migration-socket.d.ts",
       "default": "./migration-socket.js"
     },
+    "./secret-references": {
+      "types": "./secret-references.d.ts",
+      "default": "./secret-references.js"
+    },
     "./product-channels": {
       "types": "./product-channels.d.ts",
       "default": "./product-channels.js"

package/secret-references.d.ts

@@ -0,0 +1,27 @@
+import { type Result } from "@norskvideo/ctl-foundation";
+export declare const SECRET_REFERENCE_PREFIX = "secretref:";
+/** The NodeInventory capability a worker advertises when it resolves secret
+ *  references, so placement can keep a job whose parameters hold one off an
+ *  older worker — which would hand the container the reference itself. */
+export declare const SECRET_REFERENCES_CAPABILITY = "norsk.io/secret-references";
+/** What a secret parameter's literal value is shown as wherever ctl prints
+ *  launch parameters back. */
+export declare const SECRET_PLACEHOLDER = "<secret>";
+export interface SecretReference {
+    provider: string;
+    key: string;
+}
+/** A value is a reference exactly when it carries the prefix. A malformed
+ *  reference is still a reference: it fails resolution rather than reaching a
+ *  container as a literal. */
+export declare function isSecretReference(value: string): boolean;
+export declare function parseSecretReference(value: string): Result<SecretReference, string>;
+export declare function secretReference(provider: string, key: string): string;
+/** Launch parameters as they may be shown: a parameter the template declares
+ *  `secret` has its literal value masked. A reference is shown as it is — it
+ *  is the point of a reference that it reveals nothing — and an empty value
+ *  stays visibly empty. */
+export declare function redactSecretParams(params: Record<string, string>, declared: readonly {
+    name: string;
+    secret?: boolean;
+}[]): Record<string, string>;

package/secret-references.js

@@ -0,0 +1,56 @@
+// Secret references: a launch parameter's value may name a secret instead of
+// carrying it, as `secretref:<provider>:<key>`. The worker that runs the
+// instance resolves the reference immediately before it writes the
+// container's environment, so a scheduler, its job store, its templates and
+// its backups only ever hold the reference (norsk-ctl ADR-0017).
+//
+// Shared by both ends: whoever builds launch parameters (a Manager front end,
+// a script) and the worker that resolves them. The provider names a resolver
+// configured on the worker; the key is that provider's business and may hold
+// colons, slashes or ciphertext.
+import { err, ok } from "@norskvideo/ctl-foundation";
+export const SECRET_REFERENCE_PREFIX = "secretref:";
+/** The NodeInventory capability a worker advertises when it resolves secret
+ *  references, so placement can keep a job whose parameters hold one off an
+ *  older worker — which would hand the container the reference itself. */
+export const SECRET_REFERENCES_CAPABILITY = "norsk.io/secret-references";
+/** What a secret parameter's literal value is shown as wherever ctl prints
+ *  launch parameters back. */
+export const SECRET_PLACEHOLDER = "<secret>";
+const PROVIDER_NAME = /^[a-z][a-z0-9-]*$/;
+/** A value is a reference exactly when it carries the prefix. A malformed
+ *  reference is still a reference: it fails resolution rather than reaching a
+ *  container as a literal. */
+export function isSecretReference(value) {
+    return value.startsWith(SECRET_REFERENCE_PREFIX);
+}
+export function parseSecretReference(value) {
+    if (!isSecretReference(value))
+        return err("not a secret reference");
+    const rest = value.slice(SECRET_REFERENCE_PREFIX.length);
+    const colon = rest.indexOf(":");
+    if (colon < 0)
+        return err(`a secret reference is ${SECRET_REFERENCE_PREFIX}<provider>:<key>`);
+    const provider = rest.slice(0, colon);
+    const key = rest.slice(colon + 1);
+    if (!PROVIDER_NAME.test(provider)) {
+        return err(`secret provider name '${provider}' must be lowercase letters, digits and dashes`);
+    }
+    if (key === "")
+        return err(`the secret reference for provider '${provider}' names no key`);
+    return ok({ provider, key });
+}
+export function secretReference(provider, key) {
+    return `${SECRET_REFERENCE_PREFIX}${provider}:${key}`;
+}
+/** Launch parameters as they may be shown: a parameter the template declares
+ *  `secret` has its literal value masked. A reference is shown as it is — it
+ *  is the point of a reference that it reveals nothing — and an empty value
+ *  stays visibly empty. */
+export function redactSecretParams(params, declared) {
+    const secret = new Set(declared.filter((p) => p.secret === true).map((p) => p.name));
+    return Object.fromEntries(Object.entries(params).map(([k, v]) => [
+        k,
+        secret.has(k) && v !== "" && !isSecretReference(v) ? SECRET_PLACEHOLDER : v,
+    ]));
+}

package/workdir-path.js

@@ -10,14 +10,19 @@
 // Two separate hazards, deliberately not conflated:
 //   escape    — `../../etc/x` writes outside the workdir. A hole.
 //   shadowing — a file written UNDER one of the runner's read-only bind
-//               mounts is on disk and invisible to the container. Not a
-//               security problem, but a miserable one to debug, so it is
-//               refused at upload time rather than discovered at runtime.
-/** Runner-managed read-only mount points inside the working directory
- *  (override-generator.ts). `workflow.yml` is a file mount; the other two are
- *  directory mounts, so anything beneath them is shadowed too. */
+//               mounts is on disk and invisible to the container, and a file
+//               at a path the launch writes itself is never the one used.
+//               Not a security problem, but a miserable one to debug, so it
+//               is refused at upload time rather than discovered at runtime.
+/** Files the launch writes into the working directory itself. The product
+ *  template's workflow.yml is copied to the path Studio's `server.document`
+ *  names on every launch (norsk-ctl's workflow-sync.ts; it used to be a
+ *  read-only single-file bind, which OrbStack and Docker Desktop refuse), so an
+ *  operator asset there is replaced or skipped and never opened. */
+const RUNNER_WRITTEN_FILES = ["studio-save-files/workflow.yml"];
+/** Runner-managed read-only directory mount points inside the working
+ *  directory (override-generator.ts); anything beneath them is shadowed. */
 const READONLY_MOUNTS = {
-    file: ["studio-save-files/workflow.yml"],
     dir: [".norsk"],
     /** `studio-save-files/<anything>/dashboards` — the per-workflow dashboard mount. */
     pattern: [/^studio-save-files\/[^/]+\/dashboards(\/|$)/],
@@ -46,9 +51,17 @@ export function checkWorkdirPath(raw) {
             message: `'${path}' lands under the read-only mount '${mount}', where it would be on disk but invisible to the container`,
         },
     });
-    for (const file of READONLY_MOUNTS.file)
-        if (path === file)
-            return shadowed(file);
+    for (const file of RUNNER_WRITTEN_FILES) {
+        if (path === file) {
+            return {
+                ok: false,
+                problem: {
+                    kind: "shadowed",
+                    message: `'${path}' is where each launch copies the product template's workflow.yml, so an asset there would never be the one Studio opens`,
+                },
+            };
+        }
+    }
     for (const dir of READONLY_MOUNTS.dir)
         if (path === dir || path.startsWith(`${dir}/`))
             return shadowed(dir);