@opentermsarchive/engine 16.0.0 → 16.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opentermsarchive/engine",
-  "version": "16.0.0",
+  "version": "16.0.2",
   "description": "Tracks and makes visible changes to the terms of online services",
   "homepage": "https://opentermsarchive.org",
   "bugs": {

package/scripts/dataset/export/index.js

@@ -20,7 +20,7 @@ const fs = fsApi.promises;
 const ARCHIVE_FORMAT = 'zip'; // for supported formats, see https://www.archiverjs.com/docs/archive-formats
 
 export default async function generate({ archivePath, releaseDate }) {
-  const versionsRepository = await RepositoryFactory.create(config.get('@opentermsarchive/engine.recorder.versions.storage')).initialize();
+  const versionsRepository = await RepositoryFactory.create(config.get('@opentermsarchive/engine.recorder.versions.storage'), { readOnly: true }).initialize(); // The export only reads the repository the tracker writes to
 
   const temporaryArchivePath = `${archivePath}${TEMPORARY_SUFFIX}`;
   const archive = await initializeArchive(temporaryArchivePath, path.basename(archivePath, path.extname(archivePath)));

package/src/archivist/collection/index.test.js

@@ -13,6 +13,7 @@ describe('Collection', () => {
   let metadataBackup;
   let getCollection;
   let collection;
+  let instanceCount = 0;
 
   before(async () => {
     try {
@@ -29,7 +30,7 @@ describe('Collection', () => {
   });
 
   beforeEach(async () => {
-    const { getCollection: reloadedGetCollection } = await import(`./index.js?t=${Date.now()}`); // Ensure a new instance is loaded for each test
+    const { getCollection: reloadedGetCollection } = await import(`./index.js?instance=${++instanceCount}`); // Ensure a new instance is loaded for each test, even when two tests start within the same millisecond
 
     getCollection = reloadedGetCollection;
   });

package/src/archivist/fetcher/fullDomFetcher.js

@@ -1,4 +1,5 @@
-import puppeteer from 'puppeteer-extra';
+import puppeteer from 'puppeteer';
+import { addExtra } from 'puppeteer-extra';
 import stealthPlugin from 'puppeteer-extra-plugin-stealth';
 import navigatorLanguages from 'puppeteer-extra-plugin-stealth/evasions/navigator.languages/index.js';
 import userAgentOverride from 'puppeteer-extra-plugin-stealth/evasions/user-agent-override/index.js';
@@ -39,7 +40,7 @@ export default async function fetch(url, cssSelectors, config) {
     page = await context.newPage();
     client = await page.createCDPSession();
 
-    await configurePage(page, config);
+    await configurePage(page, client, config);
 
     const selectors = [].concat(cssSelectors).filter(Boolean);
 
@@ -47,7 +48,7 @@ export default async function fetch(url, cssSelectors, config) {
     let handled = null;
 
     if (!selectors.length) { // CSS selectors are specified only for HTML content and omitted when fetching a PDF
-      ({ pdf, handled } = setupPdfInterception(client));
+      ({ pdf, handled } = await setupPdfInterception(client));
     }
 
     let response;
@@ -125,13 +126,13 @@ export async function launchHeadlessBrowser(language) {
   }
 
   const { locale, languages } = parseLanguage(language);
+  const puppeteerExtra = addExtra(puppeteer); // Fresh instance for each launch, as plugins registered on the shared instance accumulate across launches and their hooks would run once per copy on every page
   const stealth = stealthPlugin();
 
   stealth.enabledEvasions.delete('user-agent-override');
   stealth.enabledEvasions.delete('navigator.languages');
-  puppeteer.use(stealth);
-  puppeteer.use(userAgentOverride({ locale }));
-  puppeteer.use(navigatorLanguages({ languages }));
+  puppeteerExtra.use(stealth);
+  puppeteerExtra.use(navigatorLanguages({ languages }));
 
   const options = {
     args: [],
@@ -156,12 +157,21 @@ export async function launchHeadlessBrowser(language) {
     options.args.push('--disable-setuid-sandbox');
   }
 
-  browser = await puppeteer.launch(options);
+  const launchedBrowser = await puppeteerExtra.launch(options);
+
+  try {
+    launchedBrowser.userAgentOverride = await captureUserAgentOverride(launchedBrowser, locale); // Computed once since the user agent is the same for every page of the browser
+  } catch (error) {
+    await launchedBrowser.close().catch(() => {});
+    throw error;
+  }
 
   if (proxyCredentials) {
-    browser.proxyCredentials = proxyCredentials;
+    launchedBrowser.proxyCredentials = proxyCredentials;
   }
 
+  browser = launchedBrowser; // Set only once fully configured, so that no caller gets a browser without its user agent override
+
   return browser;
 }
 
@@ -184,22 +194,44 @@ function isValidHttpStatus(status) {
   return (status >= 200 && status < 300) || status === 304;
 }
 
-async function configurePage(page, config) {
+async function configurePage(page, client, config) {
   await page.setViewport({ width: 1920, height: 1080 }); // Realistic viewport to avoid detection based on default Puppeteer dimensions (800x600)
   await page.setDefaultNavigationTimeout(config.navigationTimeout);
+  await client.send('Network.setUserAgentOverride', browser.userAgentOverride);
 
   if (browser.proxyCredentials?.username && browser.proxyCredentials?.password) {
     await page.authenticate(browser.proxyCredentials);
   }
 }
 
-function setupPdfInterception(client) {
+async function captureUserAgentOverride(browser, locale) { // The stealth evasion sends the override without awaiting it, so a failure would crash the process on an unhandled rejection; running it once on a stand-in page records the override for the fetcher to send itself
+  const evasion = userAgentOverride({ locale });
+  let override;
+
+  await evasion.beforeLaunch({ headless: true }); // Otherwise the evasion leaves Accept-Language to browser preferences
+  await evasion.onPageCreated({ // The stand-in page exposes only what the evasion reads
+    browser: () => browser,
+    _client: () => ({
+      send: (method, params) => {
+        if (method === 'Network.setUserAgentOverride') {
+          override = params;
+        }
+      },
+    }),
+  });
+
+  if (!override?.userAgent) {
+    throw new Error('Could not capture the user agent override from the stealth user-agent-override evasion');
+  }
+
+  return override;
+}
+
+async function setupPdfInterception(client) {
   const pdf = { content: null, status: null };
   let onHandled;
   const handled = new Promise(resolve => { onHandled = resolve; });
 
-  client.send('Fetch.enable', { patterns: [{ urlPattern: '*', requestStage: 'Response' }] }); // Intercept all responses before Chrome processes them, allowing to capture PDF content before it's handled by the PDF viewer
-
   client.on('Fetch.requestPaused', async ({ requestId, resourceType, responseHeaders, responseStatusCode }) => {
     try {
       const contentType = responseHeaders?.find(header => header.name.toLowerCase() === 'content-type')?.value;
@@ -234,6 +266,8 @@ function setupPdfInterception(client) {
     }
   });
 
+  await client.send('Fetch.enable', { patterns: [{ urlPattern: '*', requestStage: 'Response' }] }); // Intercept all responses before Chrome processes them, allowing to capture PDF content before it is handled by the PDF viewer; enabled once the listener is registered so that no paused request is missed
+
   return { pdf, handled };
 }
 

package/src/archivist/fetcher/fullDomFetcher.test.js

@@ -17,7 +17,7 @@ use(chaiAsPromised);
 const dynamicHTML = '<!DOCTYPE html><html><head><title>Dynamic Page</title><script>setTimeout(() => { document.body.innerHTML += "<div class=\'dynamic\'>Loaded</div>"; }, 100);</script></head><body></body></html>';
 const delayedContentHTML = '<!DOCTYPE html><html><head><title>Delayed Content</title><script>setTimeout(() => { document.querySelector(".content").textContent = "Final content"; }, 100);</script></head><body><div class="content"></div></body></html>';
 const langEchoHTML = '<!DOCTYPE html><html><body><script>document.body.setAttribute("data-language", navigator.language); document.body.setAttribute("data-languages", navigator.languages.join(","));</script></body></html>';
-const stealthProbeHTML = '<!DOCTYPE html><html><body><script>document.body.setAttribute("data-webdriver", String(navigator.webdriver)); document.body.setAttribute("data-user-agent", navigator.userAgent); document.body.setAttribute("data-plugin-count", String(navigator.plugins.length)); document.body.setAttribute("data-viewport-width", String(window.innerWidth)); document.body.setAttribute("data-viewport-height", String(window.innerHeight)); (() => { const canvas = document.createElement("canvas"); const gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl"); if (!gl) { document.body.setAttribute("data-webgl-vendor", "none"); return; } const ext = gl.getExtension("WEBGL_debug_renderer_info"); document.body.setAttribute("data-webgl-vendor", ext ? gl.getParameter(ext.UNMASKED_VENDOR_WEBGL) : ""); document.body.setAttribute("data-webgl-renderer", ext ? gl.getParameter(ext.UNMASKED_RENDERER_WEBGL) : ""); })();</script></body></html>';
+const stealthProbeHTML = '<!DOCTYPE html><html><body><script>document.body.setAttribute("data-webdriver", String(navigator.webdriver)); document.body.setAttribute("data-user-agent", navigator.userAgent); document.body.setAttribute("data-platform", navigator.platform); document.body.setAttribute("data-ua-brands", navigator.userAgentData ? navigator.userAgentData.brands.map(entry => entry.brand).join(",") : ""); document.body.setAttribute("data-plugin-count", String(navigator.plugins.length)); document.body.setAttribute("data-viewport-width", String(window.innerWidth)); document.body.setAttribute("data-viewport-height", String(window.innerHeight)); (() => { const canvas = document.createElement("canvas"); const gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl"); if (!gl) { document.body.setAttribute("data-webgl-vendor", "none"); return; } const ext = gl.getExtension("WEBGL_debug_renderer_info"); document.body.setAttribute("data-webgl-vendor", ext ? gl.getParameter(ext.UNMASKED_VENDOR_WEBGL) : ""); document.body.setAttribute("data-webgl-renderer", ext ? gl.getParameter(ext.UNMASKED_RENDERER_WEBGL) : ""); })();</script></body></html>';
 
 describe('Full DOM Fetcher', function () {
   this.timeout(60000);
@@ -40,6 +40,11 @@ describe('Full DOM Fetcher', function () {
 
         response.writeHead(200, { 'Content-Type': 'text/html' }).write(`<!DOCTYPE html><html><body data-accept-language="${acceptLanguage}"></body></html>`);
       }
+      if (request.url === '/client-hints-header') {
+        const clientHintsBrands = request.headers['sec-ch-ua'] || '';
+
+        response.writeHead(200, { 'Content-Type': 'text/html' }).write(`<!DOCTYPE html><html><body>${clientHintsBrands}</body></html>`);
+      }
       if (request.url === '/lang-echo') {
         response.writeHead(200, { 'Content-Type': 'text/html' }).write(langEchoHTML);
       }
@@ -76,6 +81,16 @@ describe('Full DOM Fetcher', function () {
 
       expect(browser1).to.equal(browser2);
     });
+
+    it('registers plugin hooks once per launch', async () => {
+      const initialListenerCount = (await launchHeadlessBrowser('en')).listenerCount('targetcreated');
+
+      await stopHeadlessBrowser();
+
+      const relaunchedBrowser = await launchHeadlessBrowser('en');
+
+      expect(relaunchedBrowser.listenerCount('targetcreated')).to.equal(initialListenerCount);
+    });
   });
 
   describe('#fetch', () => {
@@ -136,6 +151,25 @@ describe('Full DOM Fetcher', function () {
         expect(content.equals(expectedPDFContent)).to.be.true;
       });
     });
+
+    context('when the user agent override cannot be applied', () => {
+      let browser;
+      let userAgentOverride;
+
+      before(async () => {
+        browser = await launchHeadlessBrowser('en');
+        ({ userAgentOverride } = browser);
+        browser.userAgentOverride = {}; // Rejected by Chrome since the user agent is mandatory
+      });
+
+      after(() => {
+        browser.userAgentOverride = userAgentOverride;
+      });
+
+      it('rejects with the protocol error', async () => {
+        await expect(fetch(`http://127.0.0.1:${SERVER_PORT}/dynamic`, [], config)).to.be.rejectedWith('Network.setUserAgentOverride');
+      });
+    });
   });
 
   describe('Language configuration', () => {
@@ -201,6 +235,23 @@ describe('Full DOM Fetcher', function () {
       expect(content).not.to.match(/HeadlessChrome/);
     });
 
+    it('removes HeadlessChrome from navigator.userAgentData brands', () => {
+      expect(content).to.match(/data-ua-brands="[^"]*Google Chrome[^"]*"/);
+      expect(content).not.to.match(/data-ua-brands="[^"]*Headless[^"]*"/);
+    });
+
+    it('sends the Sec-CH-UA header without HeadlessChrome', async () => {
+      const result = await fetch(`http://127.0.0.1:${SERVER_PORT}/client-hints-header`, [], config);
+
+      expect(result.content).to.match(/"Google Chrome";v="\d+"/);
+      expect(result.content).not.to.match(/Headless/);
+    });
+
+    it('does not expose a Linux host through navigator.platform', () => {
+      expect(content).to.match(/data-platform="[^"]+"/);
+      expect(content).not.to.match(/data-platform="Linux/);
+    });
+
     it('uses a realistic viewport instead of Puppeteer default', () => {
       expect(content).to.match(/data-viewport-width="1920"/);
       expect(content).to.match(/data-viewport-height="1080"/);

package/src/archivist/recorder/repositories/factory.js

@@ -4,15 +4,16 @@ import GitRepository from './git/index.js';
 import MongoRepository from './mongo/index.js';
 
 export default class RepositoryFactory {
-  static create(params) {
+  static create(params, { readOnly = false } = {}) {
     switch (params.type) {
     case 'git':
       return new GitRepository({
         ...params.git,
         path: path.resolve(process.cwd(), params.git.path),
+        readOnly,
       });
     case 'mongo':
-      return new MongoRepository(params.mongo);
+      return new MongoRepository({ ...params.mongo, readOnly });
     default:
       throw new Error(`Unknown storage repository configuration for type '${params.type}'`);
     }

package/src/archivist/recorder/repositories/git/git.js

@@ -17,14 +17,10 @@ export default class Git {
 
   async initialize() {
     if (!fsApi.existsSync(this.path)) {
-      await fs.mkdir(this.path, { recursive: true });
+      await fs.mkdir(this.path, { recursive: true }); // simple-git cannot be instantiated on a missing directory
     }
 
-    this.git = simpleGit(this.path, {
-      trimmed: true,
-      maxConcurrentProcesses: 1, // Concurrent runs on the same repository race the index and the commit-graph and can corrupt them
-    });
-
+    this.#connect();
     await this.git.init();
 
     return this.git
@@ -37,6 +33,21 @@ export default class Git {
       .addConfig('gc.writeCommitGraph', false); // Prevent automatic `git gc` from also writing the commit-graph: the engine writes it explicitly (see `writeCommitGraph`/`updateCommitGraph`), and a concurrent gc write races those, which can leave a stale `commit-graph.lock` and make subsequent operations fail
   }
 
+  open() {
+    if (!fsApi.existsSync(path.join(this.path, '.git'))) {
+      throw new Error(`Repository ${this.path} does not exist, it has to be created by a writer such as the tracker first`); // Without this check, git would silently walk up to an enclosing repository, such as the collection one
+    }
+
+    this.#connect();
+  }
+
+  #connect() {
+    this.git = simpleGit(this.path, {
+      trimmed: true,
+      maxConcurrentProcesses: 1, // Concurrent runs on the same repository race the index and the commit-graph and can corrupt them
+    });
+  }
+
   add(filePath) {
     return this.git.add(this.relativePath(filePath));
   }
@@ -129,6 +140,10 @@ export default class Git {
     return this.git.show(options);
   }
 
+  showBuffer(options) {
+    return this.git.showBuffer(options);
+  }
+
   async cleanUp() {
     await fs.rm(path.join(this.path, '.git', 'objects', 'info', 'commit-graph.lock'), { force: true }); // Remove a leftover commit-graph lock from a previous `commit-graph write` that was killed mid-write (e.g. the process was terminated during a deploy or restart). The commit-graph is a disposable cache rebuilt by `writeCommitGraph`, so clearing a stale lock is safe and prevents every subsequent run from failing.
     await this.git.reset('hard');
@@ -144,15 +159,6 @@ export default class Git {
     ]);
   }
 
-  restore(path, commit) {
-    return this.git.raw([
-      'restore',
-      '-s', commit, // Take the file contents from this specific commit rather than from the index
-      '--', // Everything after is a pathspec, not a revision or option
-      path,
-    ]);
-  }
-
   async destroyHistory() {
     await fs.rm(this.path, { recursive: true });
 

package/src/archivist/recorder/repositories/git/index.js

@@ -35,15 +35,22 @@ function canMatchRecordFilePath(...pathSegments) {
 }
 
 export default class GitRepository extends RepositoryInterface {
-  constructor({ path, author, publish, snapshotIdentiferTemplate }) {
+  constructor({ path, author, publish, snapshotIdentiferTemplate, readOnly = false }) {
     super();
     this.path = path;
     this.needsPublication = publish;
+    this.readOnly = readOnly; // Readers share the repository with the tracker, so they must never touch the working tree nor the commit-graph: both race the tracker, and the commit-graph write then fails with `commit-graph.lock: File exists`
     this.git = new Git({ path: this.path, author });
     this.snapshotIdentiferTemplate = snapshotIdentiferTemplate;
   }
 
   async initialize() {
+    if (this.readOnly) {
+      this.git.open();
+
+      return this;
+    }
+
     await this.git.initialize();
     await this.git.cleanUp(); // Drop all uncommitted changes and remove all leftover files that may be present if the process was killed aggressively
     await this.git.writeCommitGraph(); // Create or replace the commit graph with a new one to ensure it's fully consistent
@@ -52,6 +59,8 @@ export default class GitRepository extends RepositoryInterface {
   }
 
   async save(record) {
+    this.#assertWritable('save records');
+
     const { serviceId, termsType, documentId, fetchDate } = record;
 
     if (record.isFirstRecord === undefined || record.isFirstRecord === null) {
@@ -75,6 +84,10 @@ export default class GitRepository extends RepositoryInterface {
   }
 
   async finalize() {
+    if (this.readOnly) {
+      return;
+    }
+
     if (this.needsPublication) {
       await this.git.pushChanges();
     }
@@ -214,31 +227,20 @@ export default class GitRepository extends RepositoryInterface {
     }
   }
 
-  removeAll() {
-    return this.git.destroyHistory();
+  async removeAll() {
+    this.#assertWritable('remove records');
+
+    await this.git.destroyHistory();
   }
 
   async loadRecordContent(record) {
     const relativeFilePath = DataMapper.generateFilePath(record.serviceId, record.termsType, record.documentId, record.mimeType);
 
-    if (record.mimeType != mime.getType('pdf')) {
-      record.content = await this.git.show(`${record.id}:${relativeFilePath}`);
-
-      return;
-    }
-
-    // In case of PDF files, `git show` cannot be used as it converts PDF binary into strings that do not retain the original binary representation
-    // It is impossible to restore the original binary data from the resulting string
-    let pdfBuffer;
+    const objectPath = `${record.id}:${relativeFilePath}`;
 
-    try {
-      await this.git.restore(relativeFilePath, record.id); // Temporarily restore the PDF file to a specific commit
-      pdfBuffer = await fs.readFile(`${this.path}/${relativeFilePath}`); // …read the content
-    } finally {
-      await this.git.restore(relativeFilePath, 'HEAD'); // …and finally restore the file to its most recent state
-    }
-
-    record.content = pdfBuffer;
+    record.content = record.mimeType == mime.getType('pdf')
+      ? await this.git.showBuffer(objectPath) // Binary content is read straight from the object database, so nothing is ever written to the working tree shared with the tracker
+      : await this.git.show(objectPath);
   }
 
   getDiffStats(recordId) {
@@ -308,6 +310,12 @@ export default class GitRepository extends RepositoryInterface {
     return this.git.isTracked(`${this.path}/${DataMapper.generateFilePath(serviceId, termsType, documentId)}`);
   }
 
+  #assertWritable(operation) {
+    if (this.readOnly) {
+      throw new Error(`Cannot ${operation} in read-only repository ${this.path}`);
+    }
+  }
+
   async #toDomain(commit, { deferContentLoading } = {}) {
     if (!commit) {
       return null;

package/src/archivist/recorder/repositories/git/index.test.js

@@ -2,7 +2,8 @@ import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
-import { expect } from 'chai';
+import { expect, use } from 'chai';
+import chaiAsPromised from 'chai-as-promised';
 import config from 'config';
 import mime from 'mime';
 
@@ -14,6 +15,8 @@ import Git from './git.js';
 
 import GitRepository from './index.js';
 
+use(chaiAsPromised);
+
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 const RECORDER_PATH = path.resolve(__dirname, '../../../../..', config.get('@opentermsarchive/engine.recorder.versions.storage.git.path'));
@@ -2063,4 +2066,75 @@ describe('GitRepository', () => {
       });
     });
   });
+
+  context('when read-only', () => {
+    const UNTRACKED_FILE_PATH = `${RECORDER_PATH}/untracked-file.md`;
+    const COMMIT_GRAPH_PATH = `${RECORDER_PATH}/.git/objects/info/commit-graph`;
+
+    let writer;
+    let record;
+
+    before(async () => {
+      writer = new GitRepository({
+        ...config.get('@opentermsarchive/engine.recorder.versions.storage.git'),
+        path: RECORDER_PATH,
+      });
+
+      await writer.git.initialize(); // Bypass GitRepository#initialize, which writes the commit-graph, to check that the read-only repository does not write it either
+      fs.rmSync(COMMIT_GRAPH_PATH, { force: true });
+
+      record = await writer.save(new Version({
+        serviceId: SERVICE_PROVIDER_ID,
+        termsType: TERMS_TYPE,
+        content: CONTENT,
+        fetchDate: FETCH_DATE,
+        snapshotIds: [SNAPSHOT_ID],
+      }));
+
+      fs.writeFileSync(UNTRACKED_FILE_PATH, CONTENT);
+
+      subject = new GitRepository({
+        ...config.get('@opentermsarchive/engine.recorder.versions.storage.git'),
+        path: RECORDER_PATH,
+        readOnly: true,
+      });
+
+      await subject.initialize();
+      await subject.finalize();
+    });
+
+    after(() => writer.removeAll());
+
+    it('reads the records', async () => {
+      const records = await subject.findAll();
+
+      expect(records.map(({ id }) => id)).to.deep.equal([record.id]);
+    });
+
+    it('leaves uncommitted changes untouched', () => {
+      expect(fs.existsSync(UNTRACKED_FILE_PATH)).to.be.true;
+    });
+
+    it('does not write the commit-graph', () => {
+      expect(fs.existsSync(COMMIT_GRAPH_PATH)).to.be.false;
+    });
+
+    it('rejects saving records', async () => {
+      await expect(subject.save(record)).to.be.rejectedWith(Error, /read-only/);
+    });
+
+    it('rejects removing records', async () => {
+      await expect(subject.removeAll()).to.be.rejectedWith(Error, /read-only/);
+    });
+
+    it('rejects opening a missing repository', async () => {
+      const missingRepository = new GitRepository({
+        ...config.get('@opentermsarchive/engine.recorder.versions.storage.git'),
+        path: `${RECORDER_PATH}-missing`,
+        readOnly: true,
+      });
+
+      await expect(missingRepository.initialize()).to.be.rejectedWith(Error, /does not exist/);
+    });
+  });
 });

package/src/archivist/recorder/repositories/mongo/index.js

@@ -10,12 +10,13 @@ import RepositoryInterface from '../interface.js';
 import * as DataMapper from './dataMapper.js';
 
 export default class MongoRepository extends RepositoryInterface {
-  constructor({ database: databaseName, collection: collectionName, connectionURI }) {
+  constructor({ database: databaseName, collection: collectionName, connectionURI, readOnly = false }) {
     super();
 
     this.client = new MongoClient(connectionURI);
     this.databaseName = databaseName;
     this.collectionName = collectionName;
+    this.readOnly = readOnly;
   }
 
   async initialize() {
@@ -34,6 +35,8 @@ export default class MongoRepository extends RepositoryInterface {
   }
 
   async save(record) {
+    this.#assertWritable('save records');
+
     const { serviceId, termsType, documentId } = record;
 
     if (record.isFirstRecord === undefined || record.isFirstRecord === null) {
@@ -223,8 +226,16 @@ export default class MongoRepository extends RepositoryInterface {
     }
   }
 
-  removeAll() {
-    return this.collection.deleteMany();
+  async removeAll() {
+    this.#assertWritable('remove records');
+
+    await this.collection.deleteMany();
+  }
+
+  #assertWritable(operation) {
+    if (this.readOnly) {
+      throw new Error(`Cannot ${operation} in read-only repository ${this.databaseName}.${this.collectionName}`);
+    }
   }
 
   async loadRecordContent(record) {

package/src/archivist/recorder/repositories/mongo/index.test.js

@@ -2,7 +2,8 @@ import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
-import { expect } from 'chai';
+import { expect, use } from 'chai';
+import chaiAsPromised from 'chai-as-promised';
 import config from 'config';
 import mime from 'mime';
 import { MongoClient, ObjectId } from 'mongodb';
@@ -12,6 +13,8 @@ import Version from '../../version.js';
 
 import MongoRepository from './index.js';
 
+use(chaiAsPromised);
+
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 const { connectionURI } = config.get('@opentermsarchive/engine.recorder.snapshots.storage.mongo');
@@ -1944,4 +1947,27 @@ describe('MongoRepository', () => {
       });
     });
   });
+
+  context('when read-only', () => {
+    before(() => {
+      subject = new MongoRepository({
+        ...config.get('@opentermsarchive/engine.recorder.versions.storage.mongo'),
+        readOnly: true,
+      });
+    });
+
+    it('rejects saving records', async () => {
+      await expect(subject.save(new Version({
+        serviceId: SERVICE_PROVIDER_ID,
+        termsType: TERMS_TYPE,
+        content: CONTENT,
+        fetchDate: FETCH_DATE,
+        snapshotIds: [SNAPSHOT_ID],
+      }))).to.be.rejectedWith(Error, /read-only/);
+    });
+
+    it('rejects removing records', async () => {
+      await expect(subject.removeAll()).to.be.rejectedWith(Error, /read-only/);
+    });
+  });
 });

package/src/collection-api/routes/index.js

@@ -39,8 +39,8 @@ export default async function apiRouter(basePath) {
   const services = await Services.load();
   const collection = await getCollection();
   const versionsStorageConfig = config.get('@opentermsarchive/engine.recorder.versions.storage');
-  const versionsRepository = await RepositoryFactory.create(versionsStorageConfig).initialize();
-  const snapshotsRepository = await RepositoryFactory.create(config.get('@opentermsarchive/engine.recorder.snapshots.storage')).initialize();
+  const versionsRepository = await RepositoryFactory.create(versionsStorageConfig, { readOnly: true }).initialize(); // The API only reads the repositories the tracker writes to
+  const snapshotsRepository = await RepositoryFactory.create(config.get('@opentermsarchive/engine.recorder.snapshots.storage'), { readOnly: true }).initialize();
   const feedConfig = config.get('@opentermsarchive/engine.collection-api.feed');
   const datasetStorage = new DatasetStorage(config.get('@opentermsarchive/engine.dataset.storagePath'));