@pulse-compute/provider-fastly 0.0.0 → 1.0.0-beta.2

package/src/compiler/fastly-config-secret-serve.js

@@ -0,0 +1,323 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const { getDefaultArtifactsDir } = require('@pulse-compute/wasm-build-support/artifacts-dir');
+const { createPulseRuntimeConfigProvider, buildConfigProviderResolution } = require('./config-provider-resolution.js');
+const { PACKAGE_VERSION, normalizeArtifact, normalizeDiagnostic } = loadContractsDiagnostics();
+
+
+function loadContractsDiagnostics() {
+  try {
+    return require('@pulse-compute/wasm-contracts/diagnostics');
+  } catch (error) {
+    if (error && error.code === 'MODULE_NOT_FOUND' && String(error.message).includes('@pulse-compute/wasm-contracts')) {
+      return require('../../../../wasm/packages/contracts/src/diagnostics.js');
+    }
+    throw error;
+  }
+}
+
+const PHASE = '13E';
+const CONTRACT_VERSION = 'pulsewasm.fastly-config-secret-serve.v1';
+const RUNTIME_VERSION = 'pulsewasm.fastly-config-secret-runtime.v1';
+const READINESS_VERSION = 'pulsewasm.fastly-config-secret-readiness.v1';
+const SMOKE_VERSION = 'pulsewasm.fastly-config-secret-smoke.v1';
+
+function sha256Text(text) { return crypto.createHash('sha256').update(String(text || ''), 'utf8').digest('hex'); }
+function sha256Buffer(buffer) { return crypto.createHash('sha256').update(buffer).digest('hex'); }
+function makeFile(file, text) { return { file, text, bytes: Buffer.byteLength(text, 'utf8'), sha256: sha256Text(text) }; }
+function diag(code, message, hint, details) {
+  return normalizeDiagnostic({
+    phase: 'fastly-config-secret-serve',
+    severity: 'error',
+    code,
+    message,
+    hint,
+    details,
+    loc: { file: '<fastly-config-secret-serve>' }
+  });
+}
+function stripSecretFields(value) {
+  if (Array.isArray(value)) return value.map(stripSecretFields);
+  if (!value || typeof value !== 'object') return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (key === 'Authorization' && typeof child === 'string') {
+      out[key] = '<redacted>';
+    } else {
+      out[key] = stripSecretFields(child);
+    }
+  }
+  return out;
+}
+function buildGeneratedModuleSource() {
+  return `/* Generated by PulseWasm.
+ * Fastly config/secret serve proof wrapper.
+ * Resolves symbolic config/secret refs before constructing the compiled-Wasm runtime.
+ */
+'use strict';
+
+const path = require('node:path');
+const { createPulseRuntimeConfigProvider } = require('../host/config-provider.cjs');
+const { createPulseWasmCompiledHostRuntime } = require('../host/compiled-wasm-host-runtime.cjs');
+const { createFastlyStreamHeaderAdapter } = require('../fastly/fastly-adapter.cjs');
+
+function createFastlyConfigSecretServe(options = {}) {
+  const provider = createPulseRuntimeConfigProvider({
+    resolvedConfig: options.resolvedConfig,
+    configValues: options.configValues || {},
+    secretValues: options.secretValues || {}
+  });
+  const resolvedRuntime = provider.resolveRuntime();
+  const runtime = createPulseWasmCompiledHostRuntime({
+    wasmPath: options.wasmPath,
+    deploymentPosture: options.deploymentPosture || { engine: 'wasm' },
+    hostResponses: options.hostResponses || {}
+  });
+  const adapter = createFastlyStreamHeaderAdapter({ runtime });
+  return {
+    profile: provider.profile,
+    provider,
+    resolvedRuntime,
+    runtime,
+    adapter,
+    executeRequest(request) {
+      return adapter.executeRequest(request);
+    },
+    previewRuntime() {
+      return provider.previewRuntime();
+    }
+  };
+}
+
+module.exports = { createFastlyConfigSecretServe };
+`;
+}
+function buildMarkdown(contract, runtimeArtifact, readiness, smoke) {
+  return [
+    '# PulseWasm Fastly Config / Secret Serve Proof',
+    '',
+    `Generated by: \`${contract.generatedBy}\``,
+    '',
+    '## What this proves',
+    '',
+    '- `$config` / `$secret` refs are resolved before request execution.',
+    '- Resolved runtime config stays outside the Wasm binary.',
+    '- The compiled-Wasm runtime still serves requests through the Fastly-shaped adapter.',
+    '- Missing config and missing secret values fail before serve.',
+    '',
+    '## Current status',
+    '',
+    `- profile: \`${contract.profile || '<none>'}\``,
+    `- config refs: ${contract.summary.configRefs}`,
+    `- secret refs: ${contract.summary.secretRefs}`,
+    `- serve-like smoke executed: ${smoke.executed}`,
+    `- failed checks: ${smoke.failedChecks}`,
+    `- manual Fastly serve still external: ${!readiness.realFastlyServeExecuted}`,
+    ''
+  ].join('\n');
+}
+
+function buildFastlyConfigSecretServe(options = {}) {
+  const generatedBy = options.generatedBy || PACKAGE_VERSION;
+  const cwd = options.cwd || process.cwd();
+  const outDir = options.outDir ? path.resolve(cwd, options.outDir) : getDefaultArtifactsDir(cwd);
+  const resolvedConfig = options.resolvedConfig;
+  const configValues = options.configValues || {};
+  const secretValues = options.secretValues || {};
+  const diagnostics = [];
+  const providerBuild = buildConfigProviderResolution({
+    resolvedConfig,
+    cwd,
+    generatedBy,
+    configValues,
+    secretValues
+  });
+
+  const generatedModuleFile = buildGeneratedModuleSource();
+  const generatedModulePath = path.join(outDir, 'generated', 'fastly', 'fastly-config-secret-serve.cjs');
+  fs.mkdirSync(path.dirname(generatedModulePath), { recursive: true });
+  fs.writeFileSync(generatedModulePath, generatedModuleFile);
+
+  const wasmPath = path.join(outDir, 'generated', 'compiled-wasm-runtime', 'pulsewasm-compiled-runtime.wasm');
+  if (!fs.existsSync(wasmPath)) {
+    diagnostics.push(diag(
+      'PULSEWASM_FASTLY_CONFIG_SECRET_WASM_MISSING',
+      'Compiled Wasm runtime candidate is missing for the Fastly config/secret proof.',
+      'Generate the compiled runtime before running the Fastly config/secret serve proof.',
+      { wasmPath: path.relative(cwd, wasmPath), artifactDir: path.relative(cwd, outDir) }
+    ));
+  }
+
+  const hostRuntimeModulePath = path.join(outDir, 'generated', 'host', 'compiled-wasm-host-runtime.cjs');
+  const fastlyAdapterModulePath = path.join(outDir, 'generated', 'fastly', 'fastly-adapter.cjs');
+  const configProviderModulePath = path.join(outDir, 'generated', 'host', 'config-provider.cjs');
+  for (const [filePath, code] of [
+    [path.join(outDir, 'generated', 'host', 'config-provider.cjs'), providerBuild.files.find((f) => f.file.endsWith('config-provider.cjs')).text]
+  ]) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, code);
+  }
+
+  const contract = {
+    version: CONTRACT_VERSION,
+    generatedBy,
+    phase: PHASE,
+    status: diagnostics.length ? 'error' : 'ok',
+    profile: resolvedConfig.profile || null,
+    scope: [
+      'resolve $config / $secret before request execution',
+      'keep resolved values outside the Wasm binary',
+      'drive the compiled-Wasm runtime through the Fastly-shaped adapter after provider resolution'
+    ],
+    summary: {
+      configRefs: providerBuild.artifact.summary.configRefs,
+      secretRefs: providerBuild.artifact.summary.secretRefs,
+      diagnostics: diagnostics.length
+    },
+    readiness: {
+      providerResolutionRequiredBeforeServe: true,
+      runtimeValuesEmbeddedIntoWasm: false,
+      manualFastlyServeExternal: true
+    }
+  };
+
+  const runtimeArtifact = {
+    version: RUNTIME_VERSION,
+    generatedBy,
+    phase: PHASE,
+    status: diagnostics.length ? 'error' : 'ok',
+    profile: resolvedConfig.profile || null,
+    resolvedRuntimePreview: stripSecretFields(providerBuild.resolution.previewRuntime),
+    providerMap: providerBuild.providerMap.fastly,
+    generatedModule: {
+      file: 'generated/fastly/fastly-config-secret-serve.cjs',
+      bytes: Buffer.byteLength(generatedModuleFile, 'utf8'),
+      sha256: sha256Text(generatedModuleFile)
+    }
+  };
+
+  const smoke = {
+    version: SMOKE_VERSION,
+    generatedBy,
+    phase: PHASE,
+    executed: false,
+    failedChecks: 0,
+    checks: [],
+    wasmContainsSecretBytes: false,
+    realFastlyServeExecuted: false
+  };
+
+  let smokeFailures = 0;
+  try {
+    const { createPulseRuntimeConfigProvider } = require(configProviderModulePath);
+    const { createPulseWasmCompiledHostRuntime } = require(hostRuntimeModulePath);
+    const { createFastlyStreamHeaderAdapter } = require(fastlyAdapterModulePath);
+    const provider = createPulseRuntimeConfigProvider({ resolvedConfig, configValues, secretValues });
+    const resolvedRuntime = provider.resolveRuntime();
+    smoke.executed = true;
+
+    const runtime = createPulseWasmCompiledHostRuntime({
+      wasmPath,
+      deploymentPosture: { engine: 'wasm' }
+    });
+    const adapter = createFastlyStreamHeaderAdapter({ runtime });
+
+    const extensionResult = adapter.executeRequest({
+      method: 'GET',
+      path: '/extension',
+      rawHeaders: ['X-Test', '1', 'X-Test', '2']
+    });
+    smoke.checks.push({ name: 'extension_status', expected: 220, actual: extensionResult.status });
+    if (extensionResult.status !== 220) smokeFailures += 1;
+
+    const streamResult = adapter.executeRequest({
+      method: 'GET',
+      path: '/stream',
+      rawHeaders: ['X-Test', '1']
+    });
+    smoke.checks.push({ name: 'stream_status', expected: 206, actual: streamResult.status });
+    if (streamResult.status !== 206) smokeFailures += 1;
+    smoke.checks.push({ name: 'stream_body', expected: 'asset:42', actual: streamResult.body });
+    if (streamResult.body !== 'asset:42') smokeFailures += 1;
+
+    smoke.checks.push({ name: 'config_resolved', expected: 'https://users.example.test', actual: resolvedRuntime.capabilities.backends.usersApi.baseUrl });
+    if (resolvedRuntime.capabilities.backends.usersApi.baseUrl !== 'https://users.example.test') smokeFailures += 1;
+    smoke.checks.push({ name: 'secret_resolved', expected: 'shh-token', actual: resolvedRuntime.capabilities.backends.usersApi.headers.Authorization });
+    if (resolvedRuntime.capabilities.backends.usersApi.headers.Authorization !== 'shh-token') smokeFailures += 1;
+
+    const wasmBytes = fs.readFileSync(wasmPath);
+    const secretNeedles = Object.values(secretValues).map((v) => Buffer.from(String(v), 'utf8'));
+    smoke.wasmContainsSecretBytes = secretNeedles.some((needle) => needle.length > 0 && wasmBytes.includes(needle));
+    smoke.checks.push({ name: 'secret_not_embedded_in_wasm', expected: false, actual: smoke.wasmContainsSecretBytes });
+    if (smoke.wasmContainsSecretBytes) smokeFailures += 1;
+
+    try {
+      createPulseRuntimeConfigProvider({ resolvedConfig, configValues: {}, secretValues }).resolveRuntime();
+      smoke.checks.push({ name: 'missing_config_caught', expected: true, actual: false });
+      smokeFailures += 1;
+    } catch (error) {
+      const ok = error.code === 'PULSEWASM_CONFIG_PROVIDER_MISSING_CONFIG';
+      smoke.checks.push({ name: 'missing_config_caught', expected: true, actual: ok });
+      if (!ok) smokeFailures += 1;
+    }
+
+    try {
+      createPulseRuntimeConfigProvider({ resolvedConfig, configValues, secretValues: {} }).resolveRuntime();
+      smoke.checks.push({ name: 'missing_secret_caught', expected: true, actual: false });
+      smokeFailures += 1;
+    } catch (error) {
+      const ok = error.code === 'PULSEWASM_CONFIG_PROVIDER_MISSING_SECRET';
+      smoke.checks.push({ name: 'missing_secret_caught', expected: true, actual: ok });
+      if (!ok) smokeFailures += 1;
+    }
+  } catch (error) {
+    diagnostics.push(diag(
+      error.code || 'PULSEWASM_FASTLY_CONFIG_SECRET_SMOKE_ERROR',
+      error.message,
+      'Inspect the generated Fastly config/secret wrapper and provider mapping.',
+      { stack: String(error.stack || error) }
+    ));
+    smoke.failedChecks += 1;
+  }
+  smoke.failedChecks += smokeFailures;
+
+  const readiness = {
+    version: READINESS_VERSION,
+    generatedBy,
+    phase: PHASE,
+    readyForManualFastlyServeWithStores: !diagnostics.length && smoke.failedChecks === 0,
+    realFastlyServeExecuted: false,
+    providerResolutionRequiredBeforeServe: true,
+    runtimeValuesEmbeddedIntoWasm: smoke.wasmContainsSecretBytes ? true : false,
+    summary: {
+      providerResolved: !diagnostics.length,
+      smokeExecuted: smoke.executed,
+      failedChecks: smoke.failedChecks
+    }
+  };
+
+  const files = [
+    makeFile('generated/fastly/fastly-config-secret-serve.cjs', generatedModuleFile),
+    makeFile('generated/host/fastly-config-secret-serve.md', buildMarkdown(contract, runtimeArtifact, readiness, smoke))
+  ];
+
+  return {
+    contract: normalizeArtifact(contract, cwd),
+    runtimeArtifact: normalizeArtifact(runtimeArtifact, cwd),
+    readiness: normalizeArtifact(readiness, cwd),
+    smoke: normalizeArtifact(smoke, cwd),
+    diagnostics,
+    files
+  };
+}
+
+module.exports = {
+  CONTRACT_VERSION,
+  RUNTIME_VERSION,
+  READINESS_VERSION,
+  SMOKE_VERSION,
+  buildFastlyConfigSecretServe
+};