@rubytech/create-maxy-code 0.1.109 → 0.1.111

package/payload/platform/plugins/cloudflare/scripts/tunnel-ingress.ts

@@ -1,291 +0,0 @@
-// Pure tunnel-ingress rendering + state I/O.
-//
-// Mirror of `samba-provision.ts`: pure decision functions in this file with
-// no side effects; `setup-tunnel.sh` orchestrates I/O around them. Invoked
-// from bash via `node --experimental-strip-types`. The CLI shim at the
-// bottom of this file takes a JSON spec on argv and prints rendered YAML
-// (or the requested state snippet) on stdout so the shell can `>` it into
-// the brand's config.yml or tunnel.state.
-//
-// Why a pure module:
-//  - The existing setup-tunnel.sh rebuilds config.yml from scratch every
-//    run. Adding SSH and SMB conditionally inline doubles the rewrite
-//    logic and makes it untestable. Extracting to a pure function with a
-//    test grid locks the YAML shape against future drift.
-//  - tunnel.state needs additive sshHostname / smbHostname fields so a
-//    re-run with no env vars rehydrates the ingress instead of silently
-//    dropping it. The persistence shape lives here so the test grid
-//    covers round-trip parity.
-//
-// Out of scope:
-//  - Cloudflare API calls (banned per `feedback_cf_api_total_eradication`).
-//  - Access policy creation (operator authors it in the dashboard).
-//  - DNS routing (the bash wrapper invokes `cloudflared tunnel route dns`).
-
-import { readFileSync, existsSync, appendFileSync } from "node:fs";
-
-// STREAM_LOG_PATH writer (contract). The four CLI
-// subcommands invoked from setup-tunnel.sh (probe-samba, render-config,
-// render-state, action-req) emit a `phase=<cmd>-start` line on entry and
-// `phase=<cmd>-ok` / `phase=<cmd>-fail` on exit. Pattern ported verbatim
-// from list-cf-domains.ts:94-133: sticky-flag on first write failure to
-// avoid stderr spam if STREAM_LOG_PATH is unwritable; observability
-// failure must not mask the subcommand's real signal.
-let streamLogWriteFailed = false;
-
-function logPhase(line: string): void {
-  const streamLogPath = process.env.STREAM_LOG_PATH;
-  if (!streamLogPath || streamLogWriteFailed) return;
-  try {
-    appendFileSync(
-      streamLogPath,
-      `[${new Date().toISOString()}] [script:tunnel-ingress] ${line}\n`,
-    );
-  } catch (err) {
-    streamLogWriteFailed = true;
-    const detail = (err instanceof Error ? err.message : String(err))
-      .slice(0, 200)
-      .replace(/"/g, "'");
-    process.stderr.write(
-      `[tunnel-ingress] phase=stream-log-write-failed detail="${detail}"\n`,
-    );
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Types
-// ---------------------------------------------------------------------------
-
-export interface IngressSpec {
-  tunnelId: string;
-  credentialsPath: string;
-  httpPort: number;
-  httpHostnames: string[];
-  sshHostname?: string | null;
-  smbHostname?: string | null;
-}
-
-export interface TunnelState {
-  tunnelId: string;
-  tunnelName: string;
-  domain: string;
-  configPath: string;
-  credentialsPath: string;
-  sshHostname?: string | null;
-  smbHostname?: string | null;
-}
-
-// ---------------------------------------------------------------------------
-// Pure renderer
-// ---------------------------------------------------------------------------
-
-/**
- * Render config.yml from a fully-resolved IngressSpec. Order matters:
- * cloudflared matches ingress rules top-to-bottom, so the catch-all
- * `http_status:404` MUST be last. SSH and SMB are inserted between the
- * HTTPS hostnames and the catch-all — they carry non-HTTP services, so
- * placing them after HTTPS keeps the existing HTTP routing behaviour
- * unchanged when no SSH/SMB hostname is configured.
- */
-export function renderConfigYml(spec: IngressSpec): string {
-  const lines: string[] = [];
-  lines.push(`tunnel: ${spec.tunnelId}`);
-  lines.push(`credentials-file: ${spec.credentialsPath}`);
-  lines.push(`ingress:`);
-  for (const h of spec.httpHostnames) {
-    lines.push(`  - hostname: ${h}`);
-    lines.push(`    service: http://localhost:${spec.httpPort}`);
-  }
-  if (spec.sshHostname) {
-    lines.push(`  - hostname: ${spec.sshHostname}`);
-    lines.push(`    service: ssh://localhost:22`);
-  }
-  if (spec.smbHostname) {
-    lines.push(`  - hostname: ${spec.smbHostname}`);
-    lines.push(`    service: tcp://localhost:445`);
-  }
-  lines.push(`  - service: http_status:404`);
-  lines.push(``);
-  return lines.join("\n");
-}
-
-/**
- * Render the tunnel.state JSON, preserving SSH/SMB hostnames as additive
- * fields so re-runs can rehydrate them. The base shape (tunnelId,
- * tunnelName, domain, configPath, credentialsPath) is a superset that
- * consumers without ssh/smb knowledge continue to read correctly.
- */
-export function renderTunnelState(state: TunnelState): string {
-  const out: Record<string, string> = {
-    tunnelId: state.tunnelId,
-    tunnelName: state.tunnelName,
-    domain: state.domain,
-    configPath: state.configPath,
-    credentialsPath: state.credentialsPath,
-  };
-  if (state.sshHostname) out.sshHostname = state.sshHostname;
-  if (state.smbHostname) out.smbHostname = state.smbHostname;
-  return JSON.stringify(out, null, 2) + "\n";
-}
-
-/**
- * Read an existing tunnel.state from disk, returning the persisted
- * sshHostname / smbHostname if present. Used to rehydrate on re-runs
- * where the operator did not pass the env vars again. Missing file or
- * malformed JSON returns nulls — the caller decides whether to fail.
- */
-export function readPersistedHostnames(statePath: string): {
-  sshHostname: string | null;
-  smbHostname: string | null;
-} {
-  if (!existsSync(statePath)) return { sshHostname: null, smbHostname: null };
-  try {
-    const raw = readFileSync(statePath, "utf8");
-    const parsed = JSON.parse(raw) as Partial<TunnelState>;
-    return {
-      sshHostname: typeof parsed.sshHostname === "string" ? parsed.sshHostname : null,
-      smbHostname: typeof parsed.smbHostname === "string" ? parsed.smbHostname : null,
-    };
-  } catch {
-    return { sshHostname: null, smbHostname: null };
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Samba presence probe
-// ---------------------------------------------------------------------------
-
-/**
- * Probe whether the per-brand Samba stanza exists in /etc/samba/smb.conf.
- * The brand stanza header is `[<brand>]` at the start of a line (the
- * `renderBrandStanza` output). Source of truth is the Pi filesystem, not
- * brand.json — Samba is provisioned by the installer's post-install step,
- * not declared up-front.
- */
-export function probeSambaStanza(brand: string, smbConfPath = "/etc/samba/smb.conf"): boolean {
-  if (!existsSync(smbConfPath)) return false;
-  try {
-    const raw = readFileSync(smbConfPath, "utf8");
-    const re = new RegExp(`^\\[${escapeRegex(brand)}\\]\\s*$`, "m");
-    return re.test(raw);
-  } catch {
-    return false;
-  }
-}
-
-function escapeRegex(s: string): string {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-// ---------------------------------------------------------------------------
-// ACTION REQUIRED block
-// ---------------------------------------------------------------------------
-
-/**
- * Render the dashboard click-path the operator follows to author the Access
- * policy. Same shape as the existing apex-CNAME ACTION REQUIRED block in
- * setup-tunnel.sh. The script does NOT create the policy — Cloudflare API
- * is banned (`feedback_cf_api_total_eradication`) and `cloudflared` CLI
- * has no Access-application create subcommand. The operator clicks through
- * Zero Trust → Access → Applications → Add → Self-hosted.
- */
-export function renderAccessPolicyActionRequired(input: {
-  sshHostname?: string | null;
-  smbHostname?: string | null;
-  operatorEmail: string;
-}): string {
-  const hosts: Array<{ kind: "SSH" | "SMB"; hostname: string }> = [];
-  if (input.sshHostname) hosts.push({ kind: "SSH", hostname: input.sshHostname });
-  if (input.smbHostname) hosts.push({ kind: "SMB", hostname: input.smbHostname });
-  if (hosts.length === 0) return "";
-
-  const lines: string[] = [];
-  lines.push("");
-  lines.push("============================================================");
-  lines.push("ACTION REQUIRED — Cloudflare Zero Trust Access policy");
-  lines.push("============================================================");
-  for (const { kind, hostname } of hosts) {
-    lines.push(`  ${kind}: ${hostname}`);
-    lines.push(`    Cloudflare dashboard → Zero Trust → Access → Applications`);
-    lines.push(`    Add → Self-hosted`);
-    lines.push(`      Application name: ${hostname}`);
-    lines.push(`      Application domain: ${hostname}`);
-    lines.push(`      Policy → Action: Allow`);
-    lines.push(`      Include → Emails: ${input.operatorEmail}`);
-    lines.push("");
-  }
-  lines.push("Until each Access application is created, off-LAN clients see");
-  lines.push("Cloudflare's identity-rejection page and bytes never reach the Pi.");
-  lines.push("============================================================");
-  return lines.join("\n");
-}
-
-// ---------------------------------------------------------------------------
-// CLI shim
-// ---------------------------------------------------------------------------
-
-// Bash invokes this file with one of three subcommands:
-//   render-config <spec.json>          → stdout YAML
-//   render-state  <state.json>         → stdout JSON
-//   read-state    <state-path>         → stdout JSON {sshHostname,smbHostname}
-//   probe-samba   <brand> [smb.conf]   → exit 0 if present, 1 if absent
-//   action-req    <input.json>         → stdout ACTION REQUIRED block
-
-function readJsonArg(path: string): unknown {
-  const raw = readFileSync(path, "utf8");
-  return JSON.parse(raw);
-}
-
-const isCli =
-  typeof process !== "undefined" &&
-  Array.isArray(process.argv) &&
-  process.argv[1] !== undefined &&
-  /tunnel-ingress\.(ts|js|mjs|mts)$/.test(process.argv[1]);
-
-if (isCli) {
-  const [, , cmd, ...rest] = process.argv;
-  // Track which subcommands carry the stream-log contract — for these
-  // we emit start/ok/fail phase pairs. Unknown subcommands and read-state are
-  // out of scope per the task (read-state has no setup-tunnel.sh caller line).
-  const instrumented = new Set(["probe-samba", "render-config", "render-state", "action-req"]);
-  if (instrumented.has(cmd)) logPhase(`phase=${cmd}-start`);
-  try {
-    if (cmd === "render-config") {
-      const spec = readJsonArg(rest[0]) as IngressSpec;
-      process.stdout.write(renderConfigYml(spec));
-      logPhase(`phase=${cmd}-ok`);
-    } else if (cmd === "render-state") {
-      const state = readJsonArg(rest[0]) as TunnelState;
-      process.stdout.write(renderTunnelState(state));
-      logPhase(`phase=${cmd}-ok`);
-    } else if (cmd === "read-state") {
-      const persisted = readPersistedHostnames(rest[0]);
-      process.stdout.write(JSON.stringify(persisted));
-    } else if (cmd === "probe-samba") {
-      const brand = rest[0];
-      const smbConf = rest[1] ?? "/etc/samba/smb.conf";
-      const present = probeSambaStanza(brand, smbConf);
-      logPhase(`phase=${cmd}-ok brand=${brand} present=${present}`);
-      process.exit(present ? 0 : 1);
-    } else if (cmd === "action-req") {
-      const input = readJsonArg(rest[0]) as {
-        sshHostname?: string | null;
-        smbHostname?: string | null;
-        operatorEmail: string;
-      };
-      process.stdout.write(renderAccessPolicyActionRequired(input));
-      logPhase(`phase=${cmd}-ok`);
-    } else {
-      process.stderr.write(`tunnel-ingress: unknown subcommand: ${cmd}\n`);
-      process.exit(2);
-    }
-  } catch (err) {
-    const msg = (err as Error).message;
-    if (instrumented.has(cmd)) {
-      const detail = msg.slice(0, 200).replace(/"/g, "'");
-      logPhase(`phase=${cmd}-fail error="${detail}"`);
-    }
-    process.stderr.write(`tunnel-ingress: ${msg}\n`);
-    process.exit(1);
-  }
-}