@qawolf/ci-sdk 2.0.0 → 2.2.0

package/README.md

@@ -454,8 +454,10 @@ const sdk = makeQaWolfSdk(
 This package follows the [SemVer](https://semver.org/) versioning scheme. Additional notes:
 
 - We recommend depending on the `^` range operator for this package, as it will not introduce breaking changes and guarantee an up-to-date API usage version.
+
 <!-- There is a limitation in NPM preventing us from using relative links and hosting other MD files when the repository hosting code is not
   public, hence we inline the changelog in the README. See https://github.com/npm/feedback/discussions/666 -->
+
 - We will provide a changelog for each release, which will be available in the Changelog section below.
 - This package major version will be bumped when an API breaking change is introduced. This won't
   happen too often, and we will reach out to you and give advance notice when it does.
@@ -467,6 +469,10 @@ This package follows the [SemVer](https://semver.org/) versioning scheme. Additi
 
 # Changelog
 
+## v2.1.0
+
+- `attemptNotifyDeploy`: the `deploy_success` response is now validated at runtime instead of being trusted. A response with a non-JSON body, or a body that does not match the expected shape, returns `outcome: "aborted"` with the new `abortReason: "invalid-response-body"`. This is distinct from `"network-error"`, which now covers only transport and body-stream failures rather than also masking unparseable responses. A result the SDK does not recognize (for example a new result kind sent by a newer backend) returns `outcome: "failed"` with the new `failReason: "unknown-result"` instead of being reported as a success. Recognized results are unchanged, and older backends that omit newer fields remain fully supported.
+
 ## v2.0.0
 
 - `attemptNotifyDeploy`: the `DeployStatus` response now carries `skippedTriggers` (triggers that matched the deployment but produced no run, each with a `reason` code and human-readable `message`) and `skippedDeployment` (set when no trigger matched at all). The result now distinguishes these cases. A trigger that matched but could not run (e.g. the environment was still syncing) returns `outcome: "failed"` with `failReason: "trigger-skipped"` and a `skippedTriggers` array, since a precondition was not met and retrying may succeed. A deployment that matched no trigger returns `outcome: "skipped"` with `skippedDeployment` (the server's reason, when it provides one). That result is deterministic given the current configuration, so it is reported as a skip rather than a failure and is logged as a warning, not an error. Preview deployments keep `outcome: "success"` but now log the skip reason. `outcome: "success"` results are unchanged.

package/dist/index.cjs

@@ -41,7 +41,7 @@ var defaultServiceBase = "https://app.qawolf.com/";
 
 // package.json
 var package_default = {
-  version: "2.0.0"};
+  version: "2.2.0"};
 
 // src/lib/sdk/defaults/userAgent.ts
 var defaultUserAgent = `ci-sdk/${package_default.version}`;
@@ -123,6 +123,14 @@ async function handleSuccessResponse(data, log) {
       outcome: "failed"
     };
   }
+  const unrecognizedResult = results.find((result) => "unrecognized" in result);
+  if (unrecognizedResult) {
+    log.error(`\u{1F6AB} The deployment response contained an unrecognized result. Please upgrade @qawolf/ci-sdk.`);
+    return {
+      failReason: "unknown-result",
+      outcome: "failed"
+    };
+  }
   const failedTrigger = results.find((result) => "failureReason" in result);
   if (failedTrigger) {
     log.error(`\u{1F6AB} Run could not be created. Reason: "${failedTrigger.failureReason}". Please contact support.`);
@@ -171,10 +179,16 @@ function mapSuiteResult(result) {
       triggerId: result.trigger_id
     };
   }
+  if ("duplicate_suite_id" in result) {
+    return {
+      duplicateSuiteId: result.duplicate_suite_id,
+      skipReason: result.skip_reason,
+      triggerId: result.trigger_id
+    };
+  }
   return {
-    duplicateSuiteId: result.duplicate_suite_id,
-    skipReason: result.skip_reason,
-    triggerId: result.trigger_id
+    triggerId: result.trigger_id,
+    unrecognized: true
   };
 }
 __name(mapSuiteResult, "mapSuiteResult");
@@ -196,11 +210,61 @@ function mapDeploySuccessResponse(wire) {
 }
 __name(mapDeploySuccessResponse, "mapDeploySuccessResponse");
 
+// src/lib/sdk/domain/attemptDeploy/parseDeploySuccessWireResponse.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord, "isRecord");
+function isWireSuiteResult(value) {
+  if (!isRecord(value)) return false;
+  if (typeof value.trigger_id !== "string") return false;
+  if ("created_suite_id" in value) return typeof value.created_suite_id === "string";
+  if ("failure_reason" in value) return typeof value.failure_reason === "string";
+  if ("duplicate_suite_id" in value) {
+    return typeof value.duplicate_suite_id === "string" && typeof value.skip_reason === "string";
+  }
+  return true;
+}
+__name(isWireSuiteResult, "isWireSuiteResult");
+function isEnvironment(value) {
+  if (!isRecord(value)) return false;
+  if (typeof value.id !== "string") return false;
+  if (typeof value.isStatic !== "boolean") return false;
+  if (value.alias !== void 0 && typeof value.alias !== "string") return false;
+  return true;
+}
+__name(isEnvironment, "isEnvironment");
+function isSkippedDeployment(value) {
+  if (!isRecord(value)) return false;
+  return typeof value.message === "string" && typeof value.reason === "string";
+}
+__name(isSkippedDeployment, "isSkippedDeployment");
+function isSkippedTrigger(value) {
+  if (!isRecord(value)) return false;
+  return typeof value.environment_id === "string" && typeof value.message === "string" && typeof value.reason === "string" && typeof value.trigger_id === "string";
+}
+__name(isSkippedTrigger, "isSkippedTrigger");
+function isDeploySuccessWireResponse(value) {
+  if (!isRecord(value)) return false;
+  if (value.environment !== void 0 && !isEnvironment(value.environment)) return false;
+  if (!Array.isArray(value.results) || !value.results.every(isWireSuiteResult)) return false;
+  if (value.skipped_deployment !== void 0 && !isSkippedDeployment(value.skipped_deployment)) return false;
+  if (value.skipped_triggers !== void 0 && (!Array.isArray(value.skipped_triggers) || !value.skipped_triggers.every(isSkippedTrigger))) return false;
+  return true;
+}
+__name(isDeploySuccessWireResponse, "isDeploySuccessWireResponse");
+function parseDeploySuccessWireResponse(value) {
+  return isDeploySuccessWireResponse(value) ? value : "invalid";
+}
+__name(parseDeploySuccessWireResponse, "parseDeploySuccessWireResponse");
+
 // src/lib/sdk/domain/attemptDeploy/index.ts
 async function attemptNotifyDeploy(deps, apiConfig, config) {
   const { fetch: localFetch, log } = deps;
+  let response;
+  let bodyText;
   try {
-    const response = await localFetch(new URL("/api/webhooks/deploy_success", apiConfig.serviceBase), {
+    response = await localFetch(new URL("/api/webhooks/deploy_success", apiConfig.serviceBase), {
       body: JSON.stringify({
         branch: config.branch,
         commit_url: config.commitUrl,
@@ -216,7 +280,8 @@ async function attemptNotifyDeploy(deps, apiConfig, config) {
           repository: config.repository
         },
         sha: config.sha,
-        variables: config.variables
+        variables: config.variables,
+        workspaceId: config.workspaceId
       }),
       headers: {
         Authorization: `Bearer ${apiConfig.apiKey}`,
@@ -229,9 +294,7 @@ async function attemptNotifyDeploy(deps, apiConfig, config) {
       signal: AbortSignal.timeout(5 * 60 * 1e3)
     });
     if (!response.ok) return handleErrorResponse(response, log);
-    const wire = await response.json();
-    const data = mapDeploySuccessResponse(wire);
-    return handleSuccessResponse(data, log);
+    bodyText = await response.text();
   } catch {
     log.error(`\u{1F6AB} Network error from deploy_success, aborting.`);
     return {
@@ -240,8 +303,29 @@ async function attemptNotifyDeploy(deps, apiConfig, config) {
       outcome: "aborted"
     };
   }
+  let rawBody;
+  try {
+    rawBody = JSON.parse(bodyText);
+  } catch {
+    return abortInvalidResponseBody(log, "the response body was not JSON");
+  }
+  const wire = parseDeploySuccessWireResponse(rawBody);
+  if (wire === "invalid") {
+    return abortInvalidResponseBody(log, "the response body did not match the expected shape");
+  }
+  const data = mapDeploySuccessResponse(wire);
+  return handleSuccessResponse(data, log);
 }
 __name(attemptNotifyDeploy, "attemptNotifyDeploy");
+function abortInvalidResponseBody(log, detail) {
+  log.error(`\u{1F6AB} Invalid response from deploy_success (${detail}), aborting.`);
+  return {
+    abortReason: "invalid-response-body",
+    httpStatus: void 0,
+    outcome: "aborted"
+  };
+}
+__name(abortInvalidResponseBody, "abortInvalidResponseBody");
 async function handleErrorResponse(response, log) {
   const status = response.status;
   let abortReason;
@@ -263,10 +347,28 @@ async function handleErrorResponse(response, log) {
 }
 __name(handleErrorResponse, "handleErrorResponse");
 
+// src/lib/api/signed-url.ts
+var signedUrlPaths = {
+  runInputsExecutables: "/api/v0/run-inputs-executables-signed-urls",
+  teamStorage: "/api/v0/team-storage-signed-url"
+};
+function buildSignedUrl({ destinationFilePath, endpoint, serviceBase, workspaceId }) {
+  const url = new URL(signedUrlPaths[endpoint], serviceBase);
+  if (destinationFilePath !== void 0) url.searchParams.set("file", destinationFilePath);
+  if (workspaceId !== void 0) url.searchParams.set("workspaceId", workspaceId);
+  return url;
+}
+__name(buildSignedUrl, "buildSignedUrl");
+
 // src/lib/api/generate-signed-url-for-run-inputs-executables.ts
-async function callGenerateSignedUrlForRunInputsExecutablesStorage({ apiKey, serviceBase, userAgent }, { destinationFilePath }, { fetch: localFetch, log }) {
+async function callGenerateSignedUrlForRunInputsExecutablesStorage({ apiKey, serviceBase, userAgent }, { destinationFilePath, workspaceId }, { fetch: localFetch, log }) {
   try {
-    const response = await localFetch(new URL(`${serviceBase}/api/v0/run-inputs-executables-signed-urls?file=${encodeURIComponent(destinationFilePath)}`), {
+    const response = await localFetch(buildSignedUrl({
+      destinationFilePath,
+      endpoint: "runInputsExecutables",
+      serviceBase,
+      workspaceId
+    }), {
       headers: {
         Authorization: `Bearer ${apiKey}`,
         "Content-Type": "application/json",
@@ -344,9 +446,14 @@ async function generateSignedUrlForRunInputsExecutablesStorage(deps, apiConfig,
 __name(generateSignedUrlForRunInputsExecutablesStorage, "generateSignedUrlForRunInputsExecutablesStorage");
 
 // src/lib/api/generate-signed-url-for-team-storage.ts
-async function callGenerateSignedUrlForTempTeamStorage({ apiKey, serviceBase, userAgent }, { destinationFilePath }, { fetch: localFetch, log }) {
+async function callGenerateSignedUrlForTempTeamStorage({ apiKey, serviceBase, userAgent }, { destinationFilePath, workspaceId }, { fetch: localFetch, log }) {
   try {
-    const response = await localFetch(new URL(`${serviceBase}/api/v0/team-storage-signed-url?file=${destinationFilePath}`), {
+    const response = await localFetch(buildSignedUrl({
+      destinationFilePath,
+      endpoint: "teamStorage",
+      serviceBase,
+      workspaceId
+    }), {
       headers: {
         Authorization: `Bearer ${apiKey}`,
         "Content-Type": "application/json",