@preventive/triage 1.0.0-alpha.17 → 1.0.0-alpha.19

package/server-e2e/config.ts

@@ -2,16 +2,16 @@
 // vars, the optional config.json) into one immutable `Config`, failing
 // loud on malformed values so a typo surfaces at startup rather than
 // deep in `node:net` / at the first token verification. Pure parsing —
-// no backends opened, no crypto keys derived, no side effects beyond
-// `--help` / fail-fast `process.exit`. index.ts destructures the
-// result and does the wiring (backend selection, password HMAC, …).
+// no backends opened or process termination. Invalid configuration throws so
+// embedding hosts can recover; app.ts handles backend selection and wiring.
 
 import { Buffer } from 'node:buffer'
 import { readFileSync } from 'node:fs'
-import { argv, env } from 'node:process'
+import { env } from 'node:process'
 import { fileURLToPath } from 'node:url'
 import { dirname, join } from 'node:path'
 import { configuredScanServer } from '../server-common/scan-config.ts'
+import { databaseUrls } from '../server-common/database-config.ts'
 
 export type Config = {
   port: number
@@ -30,7 +30,7 @@ export type Config = {
   deepviewScanServer: string | null
 }
 
-// Parse + range-validate an integer env var, exiting with a clear
+// Parse + range-validate an integer env var, throwing a clear
 // up-front message on a malformed value — a NaN from `Number("abc")`
 // otherwise surfaces as a confusing crash deep inside `node:net`
 // (`WebSocketServer({ port: NaN })`) or a 0-ms `setInterval` loop. An
@@ -41,13 +41,12 @@ function intEnv(name: string, def: number, min: number, max: number, hint = ''):
   const raw = env[name]
   const n = raw == null ? def : Number(raw)
   if (!Number.isSafeInteger(n) || n < min || n > max) {
-    console.error(`Invalid ${name}: ${raw} — must be an integer in [${min}, ${max}].${hint ? ` ${hint}` : ''}`)
-    process.exit(1)
+    throw new Error(`Invalid ${name}: ${raw} — must be an integer in [${min}, ${max}].${hint ? ` ${hint}` : ''}`)
   }
   return n
 }
 
-const HELP = `Usage: node server-e2e/index.ts
+export const HELP = `Usage: node server-e2e/index.ts
 Environment:
   PORT                       listen port (default 8765)
   HOST                       bind host (default 127.0.0.1)
@@ -55,9 +54,15 @@ Environment:
                              in /api/config and allowed by the UI CSP.
                              Unset by default (no external scan service).
   DB_PATH                    sqlite file (default: server-e2e/data/data.db);
-                             ignored when DATABASE_URL is set
-  DATABASE_URL               Neon Postgres connection string; if set,
-                             selects the Neon backend instead of
+                             ignored when an e2e database URL is set
+  DATABASE_URL               shared Neon Postgres URL for enabled modes.
+                             Cannot be combined with E2E_DATABASE_URL
+                             or MANAGED_DATABASE_URL.
+  E2E_DATABASE_URL           e2e-only Neon URL, used without DATABASE_URL.
+                             Combined mode also requires
+                             MANAGED_DATABASE_URL; mixing Neon and
+                             SQLite backends is rejected.
+                             Either e2e URL selects Neon instead of
                              SQLite. Requires the optional peer dep
                              @neondatabase/serverless. The Neon
                              pairing additionally requires
@@ -66,12 +71,12 @@ Environment:
                              local-FS bytes cannot back a multi-
                              replica DB plane.
   BLOB_READ_WRITE_TOKEN      Vercel Blob R/W token (private store).
-                             Required when DATABASE_URL is set;
+                             Required when an e2e database URL is set;
                              ignored otherwise. Requires the optional
                              peer dep @vercel/blob.
   OBJSTORE_TOKEN_SECRET      Base64 (32 bytes) HMAC secret for REST
-                             bearer tokens. REQUIRED when DATABASE_URL
-                             is set (multi-replica deployments: a
+                             bearer tokens. REQUIRED in Neon mode
+                             (multi-replica deployments: a
                              token minted on one replica's WS plane
                              must validate on another replica's REST
                              plane). Optional under SQLite (a fresh
@@ -81,16 +86,15 @@ Environment:
   OBJSTORE_DIR               object store root (default: ./objstore
                              next to DB_PATH). Used by the local-FS
                              byte plane only; ignored when
-                             DATABASE_URL + BLOB_READ_WRITE_TOKEN
-                             are set (bytes live in Vercel Blob).
+                             an e2e database URL selects Neon
+                             (bytes live in Vercel Blob).
   OBJSTORE_REAP_INTERVAL_MS  orphan reaper period (default 600000)
-  OBJSTORE_REAP_DISABLED     set '1' / 'true' to disable the orphan
-                             reaper ENTIRELY — no boot sweep, no
-                             periodic GC. Orphaned/superseded blobs and
-                             stale staging rows then accumulate
-                             unbounded; only set this if an external job
-                             handles GC (e.g. a cron calling reapOrphans).
-                             Default OFF (reaper runs).
+  OBJSTORE_REAP_DISABLED     set '1' / 'true' to disable automatic orphan
+                             sweeps (boot and periodic). Explicit /api/reap
+                             remains available. Schedule cleanup externally
+                             to avoid accumulating orphaned bytes.
+  CRON_SECRET               bearer secret for GET /api/reap (fails closed
+                             when unset). Runs cleanup for enabled modes.
   TRUST_PROXY                set '1' / 'true' to honour X-Forwarded-
                              Host / X-Forwarded-Proto when computing
                              the same-origin gate's expected origin.
@@ -126,11 +130,11 @@ function readServerConfigFile(path: string): ServerConfigFile {
   let raw: string
   try { raw = readFileSync(path, 'utf8') } catch (err) {
     if ((err as NodeJS.ErrnoException)?.code === 'ENOENT') return {}
-    console.error(`Failed to read ${path}:`, (err as Error)?.message ?? err); process.exit(1)
+    throw new Error(`Failed to read ${path}: ${(err as Error)?.message ?? err}`, { cause: err })
   }
   try { return JSON.parse(raw) as ServerConfigFile }
   catch (err) {
-    console.error(`Failed to parse ${path} as JSON:`, (err as Error)?.message ?? err); process.exit(1)
+    throw new Error(`Failed to parse ${path} as JSON: ${(err as Error)?.message ?? err}`, { cause: err })
   }
 }
 
@@ -145,20 +149,17 @@ function decodeTokenSecret(raw: string): Uint8Array<ArrayBuffer> {
   // typo-detector below would fail with a misleading message.
   const trimmed = raw.trim()
   if (trimmed.length === 0) {
-    console.error('OBJSTORE_TOKEN_SECRET is empty after trimming whitespace')
-    process.exit(1)
+    throw new Error('OBJSTORE_TOKEN_SECRET is empty after trimming whitespace')
   }
   const decoded = Buffer.from(trimmed, 'base64')
   const reencoded = decoded.toString('base64')
   const norm = (s: string): string => s.replace(/=+$/u, '')
   if (norm(reencoded) !== norm(trimmed)) {
-    console.error('OBJSTORE_TOKEN_SECRET contains non-base64 characters (likely a typo, e.g. base64url chars in a base64 secret).')
-    console.error('Regenerate with: node -e \'console.log(require("crypto").randomBytes(32).toString("base64"))\'')
-    process.exit(1)
+    throw new Error('OBJSTORE_TOKEN_SECRET contains non-base64 characters (likely a typo, e.g. base64url chars in a base64 secret).\n' +
+      'Regenerate with: node -e \'console.log(require("crypto").randomBytes(32).toString("base64"))\'')
   }
   if (decoded.byteLength !== 32) {
-    console.error(`OBJSTORE_TOKEN_SECRET must decode to 32 bytes (got ${decoded.byteLength})`)
-    process.exit(1)
+    throw new Error(`OBJSTORE_TOKEN_SECRET must decode to 32 bytes (got ${decoded.byteLength})`)
   }
   // Copy into a fresh ArrayBuffer so the type matches
   // `Uint8Array<ArrayBuffer>` (Buffer may be SharedArrayBuffer-backed).
@@ -176,7 +177,7 @@ export function loadConfig(): Config {
   const objstoreDir = env['OBJSTORE_DIR'] ?? join(dirname(dbPath), 'objstore')
   // No practical upper bound beyond the safe-integer range.
   const reapIntervalMs = intEnv('OBJSTORE_REAP_INTERVAL_MS', 10 * 60 * 1000, 1, Number.MAX_SAFE_INTEGER)
-  // Hard off-switch for the orphan reaper (both the boot sweep AND the
+  // Off-switch for automatic orphan reaping (both the boot sweep AND the
   // periodic timer). '1' / 'true' (case-insensitive) → disabled; anything
   // else, including unset, leaves it ON. Same boolean shape as TRUST_PROXY.
   const reapDisabledEnv = env['OBJSTORE_REAP_DISABLED']
@@ -187,7 +188,7 @@ export function loadConfig(): Config {
   const serverConfig = readServerConfigFile(configPath)
   const rawPassword = serverConfig.password
   if (rawPassword != null && typeof rawPassword !== 'string') {
-    console.error(`Invalid ${configPath}: "password" must be a string or null`); process.exit(1)
+    throw new Error(`Invalid ${configPath}: "password" must be a string or null`)
   }
   const password = rawPassword ?? null
   // Upper bound 65_536 — bounds memory under hostile load; a deployer
@@ -196,12 +197,7 @@ export function loadConfig(): Config {
   // error-precedence order.
   const maxInflightPerSocket = intEnv('MAX_INFLIGHT_PER_SOCKET', 64, 1, 65_536)
 
-  if (argv.includes('--help') || argv.includes('-h')) {
-    console.log(HELP)
-    process.exit(0)
-  }
-
-  const neonUrl = env['DATABASE_URL'] ?? null
+  const neonUrl = databaseUrls().e2e
   const blobToken = env['BLOB_READ_WRITE_TOKEN'] ?? null
   const tokenSecretB64 = env['OBJSTORE_TOKEN_SECRET'] ?? null
   const tokenSecret = tokenSecretB64 ? decodeTokenSecret(tokenSecretB64) : null

package/server-e2e/db-neon.ts

@@ -4,7 +4,7 @@
 // dialect on the wire.
 //
 // `@neondatabase/serverless` is an OPTIONAL peer dep — selected by
-// the `DATABASE_URL` branch in `server-e2e/index.ts`. The peer dep
+// the configured database URL branch in `server-e2e/index.ts`. The peer dep
 // itself is loaded lazily via the dynamic `import()` inside
 // `openNeonDb` below, so a SQLite-only deployment never installs it
 // (`autoInstallPeers: false` in `pnpm-workspace.yaml`) and never

package/server-e2e/db.ts

@@ -125,7 +125,7 @@ export type CommitResult =
 // (`./db-neon.ts`) constructs a Handle with `db` unset. Callers that
 // reach into `db` directly (e.g. `openObjstore`, test-only fixture
 // SQL) are SQLite-coupled by construction; passing them a Neon-backed
-// Handle is the operator's mistake to catch at the `if (DATABASE_URL)`
+// Handle is the operator's mistake to catch at the database URL
 // switch in `server-e2e/index.ts`.
 //
 // `tryCommit` is the backend-specific atomic-commit primitive

package/server-e2e/http.ts

@@ -230,7 +230,19 @@ export function createHttpServer(deps: HttpServerDeps): Server {
     res.end(NOT_FOUND_BODY)
   })
 
+  installUpgradeHandler(httpServer, wss, isOriginAllowed)
+
+  return httpServer
+}
+
+function installUpgradeHandler(httpServer: Server, wss: WebSocketServer, isOriginAllowed: HttpServerDeps['isOriginAllowed']): void {
   httpServer.on('upgrade', (req, socket, head) => {
+    // Combined deployments must not let a managed share capability enter the
+    // unscoped sync transport, which bypasses the normal HTTP router.
+    if (req.headers['x-deepview-share'] !== undefined) {
+      socket.end('HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\nConnection: close\r\n\r\n')
+      return
+    }
     // RFC 6455: the WS upgrade IS an HTTP request; reject with a normal
     // HTTP response so a misconfigured client sees the JSON body instead
     // of ECONNRESET. `socket.end(body)` flushes before sending FIN.
@@ -261,6 +273,4 @@ export function createHttpServer(deps: HttpServerDeps): Server {
     }
     wss.handleUpgrade(req, socket, head, (ws) => { wss.emit('connection', ws, req) })
   })
-
-  return httpServer
 }