@oondemand/oon-core-back 0.7.19 → 0.7.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.7.19",
+  "version": "0.7.21",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/core/middlewares/error.js

@@ -75,6 +75,20 @@ const errorMiddleware = (error, req, res, next) => {
     });
   }
 
+  // Erro comum com statusCode 4xx explícito (ex.: "Token inválido ou
+  // expirado." com 401): responde com esse status em vez de virar 500, para
+  // o cliente poder voltar ao login.
+  if (Number.isInteger(error.statusCode) && error.statusCode >= 400 && error.statusCode < 500) {
+    const code = typeof error.code === "string" && error.code ? error.code : `HTTP_${error.statusCode}`;
+    const message = String(error.message || "Requisição recusada.");
+    return helpers.sendErrorResponse({
+      res,
+      statusCode: error.statusCode,
+      error: { code, message, ...(requestId ? { requestId } : {}) },
+      message,
+    });
+  }
+
   const databaseFailure = databaseError(error);
   if (databaseFailure) {
     const { statusCode, ...details } = databaseFailure;

package/src/delivery/runtime.js

@@ -280,6 +280,27 @@ spec:
 ${customDomainIngress({ context, infra })}`;
 }
 
+/**
+ * F4.6: sem domínios ativos, o Ingress dos domínios personalizados sai. O
+ * publisher não tem permissão de delete (contrato do oon-k8s-infra), então
+ * só tenta remover quando o Ingress existe; se o cluster recusar, avisa e
+ * segue, e a remoção fica para quem administra o cluster.
+ */
+function removeStaleCustomDomainIngress(context, run = kubectl) {
+  if (customDomains(context).length) return "domains";
+  const name = `${context.appCode}-custom`;
+  const found = run(["-n", context.namespace, "get", "ingress", name, "--ignore-not-found", "-o", "name"], { capture: true });
+  if (!found) return "absent";
+  try {
+    run(["-n", context.namespace, "delete", "ingress", name], { capture: true });
+    return "deleted";
+  } catch (error) {
+    if (!/forbidden/i.test(error.message)) throw error;
+    console.warn(`[oon-delivery] Ingress ${context.namespace}/${name} sem domínio ativo não pôde ser removido (sem permissão de delete). Remova-o manualmente.`);
+    return "kept";
+  }
+}
+
 function copyPullSecret(namespace, infra) {
   const source = infra.REGISTRY_PULL_SECRET_NAME || "ghcr-oon";
   try {
@@ -389,8 +410,7 @@ function deployRuntime({ context, infra, imageDigest, resourceProfile = "small"
   copyPullSecret(context.namespace, infra);
   const imageRef = `${context.imageRepository}@${imageDigest}`;
   applyYaml(runtimeManifest({ context, infra, imageRef, profile: resourceProfile }));
-  // F4.6: sem domínios ativos, o Ingress dos domínios personalizados sai.
-  if (!customDomains(context).length) kubectl(["-n", context.namespace, "delete", "ingress", `${context.appCode}-custom`, "--ignore-not-found"]);
+  removeStaleCustomDomainIngress(context);
   kubectl(["-n", context.namespace, "rollout", "status", `deployment/${context.appCode}`, "--timeout=10m"]);
   return { infraVersion: infra.INFRA_SCHEMA_VERSION, imageRef };
 }
@@ -433,4 +453,4 @@ async function activateMember(context) {
   return data;
 }
 
-module.exports = { supportsSecretsV1: true, RESOURCE_PROFILES, MAX_REPLICAS, replicaCount, PERFORMANCE_MODES, performanceMode, MAX_CUSTOM_DOMAINS, customDomains, namespaceQuota, randomSecret, dnsLabel, kubernetesLabelValue, provisionMongo, validateMongoUri, baselineManifest, runtimeManifest, provisionRuntime, deployRuntime, waitHttp, activateMember };
+module.exports = { supportsSecretsV1: true, RESOURCE_PROFILES, MAX_REPLICAS, replicaCount, PERFORMANCE_MODES, performanceMode, MAX_CUSTOM_DOMAINS, customDomains, namespaceQuota, randomSecret, dnsLabel, kubernetesLabelValue, provisionMongo, validateMongoUri, baselineManifest, runtimeManifest, provisionRuntime, deployRuntime, removeStaleCustomDomainIngress, waitHttp, activateMember };