@serve.zone/interfaces 10.1.0 → 11.1.0

package/dist_ts/requests/backup.d.ts

@@ -1,7 +1,7 @@
 import * as plugins from '../plugins.js';
 import type { IArchivePruneResult, IArchiveRetentionPolicy, IBackupArchiveManifest, IBackupArchiveObject, IBackupRecord, IBackupReplicationResult, IIsolatedRestoreNodeState, IIsolatedRestoreRecord, TBackupSnapshot, TIsolatedRestoreResourceMapping } from '../data/backup.js';
 import type { IService } from '../data/service.js';
-import type { IIdentity } from '../data/user.js';
+import type { IIdentity, IIdentityCredential } from '../data/user.js';
 export interface IReq_Any_Cloudly_CreateServiceBackup extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_CreateServiceBackup> {
     method: 'createServiceBackup';
     request: {
@@ -154,7 +154,8 @@ export interface IReq_Cloudly_Coreflow_PruneNodeArchive extends plugins.typedreq
 export interface IReq_Any_Cloudly_CreateIsolatedRestore extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_CreateIsolatedRestore> {
     method: 'createIsolatedRestore';
     request: {
-        identity: IIdentity;
+        /** Cloudly verifies this credential and derives all actor claims server-side. */
+        identity: IIdentityCredential;
         sourceBackupId: string;
         targetNodeName: string;
         purpose: string;
@@ -186,7 +187,8 @@ export interface IReq_Any_Cloudly_CreateIsolatedRestore extends plugins.typedreq
 export interface IReq_Any_Cloudly_GetIsolatedRestores extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetIsolatedRestores> {
     method: 'getIsolatedRestores';
     request: {
-        identity: IIdentity;
+        /** Cloudly verifies this credential and derives all actor claims server-side. */
+        identity: IIdentityCredential;
         sourceBackupId?: string;
         sourceServiceId?: string;
         clusterId?: string;
@@ -208,7 +210,8 @@ export interface IReq_Any_Cloudly_GetIsolatedRestores extends plugins.typedreque
 export interface IReq_Any_Cloudly_GetIsolatedRestoreById extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetIsolatedRestoreById> {
     method: 'getIsolatedRestoreById';
     request: {
-        identity: IIdentity;
+        /** Cloudly verifies this credential and derives all actor claims server-side. */
+        identity: IIdentityCredential;
         restoreId: string;
     };
     response: {
@@ -285,7 +288,8 @@ export interface IReq_Cloudly_Coreflow_CleanupIsolatedRestore extends plugins.ty
 export interface IReq_Any_Cloudly_CleanupIsolatedRestore extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_CleanupIsolatedRestore> {
     method: 'cleanupIsolatedRestore';
     request: {
-        identity: IIdentity;
+        /** Cloudly verifies this credential and derives all actor claims server-side. */
+        identity: IIdentityCredential;
         restoreId: string;
         reason: string;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "10.1.0",
+  "version": "11.1.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '10.1.0',
+  version: '11.1.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -11,6 +11,8 @@ export * from './externalregistry.js';
 export * from './gateway.js';
 export * from './hostedapp.js';
 export * from './image.js';
+export * from './isolatedrestore.js';
+export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './registry.js';
 export * from './secretbundle.js';

package/ts/data/isolatedrestore.golden.ts

@@ -0,0 +1,157 @@
+import type {
+  IBackupArchiveManifest,
+  TIsolatedRestoreResourceMapping,
+} from './backup.js';
+import type { IIsolatedRestoreGrantClaims } from './isolatedrestore.js';
+
+export interface IIsolatedRestoreCanonicalDigestGoldenVector<TInput> {
+  input: TInput;
+  canonicalJson: string;
+  sha256: string;
+}
+
+const deepFreezeVector = <T>(valueArg: T): T => {
+  if (!valueArg || typeof valueArg !== 'object' || Object.isFrozen(valueArg)) {
+    return valueArg;
+  }
+  for (const key of Reflect.ownKeys(valueArg as object)) {
+    const descriptor = Object.getOwnPropertyDescriptor(valueArg as object, key);
+    if (descriptor && Object.hasOwn(descriptor, 'value')) {
+      deepFreezeVector(descriptor.value);
+    }
+  }
+  return Object.freeze(valueArg);
+};
+
+/**
+ * Portable fixed values for signer, relay, and verifier suites. The inputs
+ * deliberately cover an astral scalar, composed and decomposed accents, a
+ * quote, and a backslash. Consumers compare both JSON and SHA-256 verbatim.
+ */
+export const isolatedRestoreCanonicalDigestGoldenVectors: {
+  version: 1;
+  resourceMappings: IIsolatedRestoreCanonicalDigestGoldenVector<
+    TIsolatedRestoreResourceMapping[]
+  >;
+  archiveManifest: IIsolatedRestoreCanonicalDigestGoldenVector<
+    IBackupArchiveManifest
+  >;
+  grantClaims: IIsolatedRestoreCanonicalDigestGoldenVector<
+    IIsolatedRestoreGrantClaims
+  >;
+} = deepFreezeVector({
+  version: 1,
+  resourceMappings: {
+    input: [
+      {
+        id: 'mapping-volume',
+        type: 'volume',
+        source: {
+          snapshotId: 'snapshot-volume',
+          volumeName: 'source-volume',
+          mountPath: '/srv/😀/é/"quoted"',
+        },
+        target: {
+          volumeName: 'scratch-volume',
+          mountPath: '/srv/😀/é/"quoted"',
+        },
+      },
+      {
+        id: 'mapping-database',
+        type: 'database',
+        source: {
+          snapshotId: 'snapshot-database',
+          resourceName: 'source-database-resource',
+          databaseName: 'source_database',
+        },
+        target: {
+          resourceName: 'scratch-database-resource',
+          databaseName: 'scratch_database',
+        },
+      },
+      {
+        id: 'mapping-objectstorage',
+        type: 'objectstorage',
+        source: {
+          snapshotId: 'snapshot-objectstorage',
+          resourceName: 'source-objectstorage-resource',
+          bucketName: 'source-bucket',
+        },
+        target: {
+          resourceName: 'scratch-objectstorage-resource',
+          bucketName: 'scratch-bucket',
+        },
+      },
+    ] as TIsolatedRestoreResourceMapping[],
+    canonicalJson:
+      '[{"id":"mapping-volume","source":{"mountPath":"/srv/😀/é/\\"quoted\\"","snapshotId":"snapshot-volume","volumeName":"source-volume"},"target":{"mountPath":"/srv/😀/é/\\"quoted\\"","volumeName":"scratch-volume"},"type":"volume"},' +
+      '{"id":"mapping-database","source":{"databaseName":"source_database","resourceName":"source-database-resource","snapshotId":"snapshot-database"},"target":{"databaseName":"scratch_database","resourceName":"scratch-database-resource"},"type":"database"},' +
+      '{"id":"mapping-objectstorage","source":{"bucketName":"source-bucket","resourceName":"source-objectstorage-resource","snapshotId":"snapshot-objectstorage"},"target":{"bucketName":"scratch-bucket","resourceName":"scratch-objectstorage-resource"},"type":"objectstorage"}]',
+    sha256: '3c084580fc258dcb5dc25b80d7331eb1d9072a124f640df3ce26eba4917afe70',
+  },
+  archiveManifest: {
+    input: {
+      version: 1,
+      backupId: 'backup-0001',
+      createdAt: 1700000000123,
+      objects: [
+        {
+          path: 'config.json',
+          size: 2,
+          sha256: '0000000000000000000000000000000000000000000000000000000000000000',
+        },
+        {
+          path: 'snapshots/snapshot-volume.json',
+          size: 3,
+          sha256: 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff',
+        },
+        {
+          path: 'snapshots/snapshot-database.json',
+          size: 5,
+          sha256: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+        },
+        {
+          path: 'snapshots/snapshot-objectstorage.json',
+          size: 7,
+          sha256: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+        },
+      ],
+      totalSize: 17,
+    },
+    canonicalJson:
+      '{"backupId":"backup-0001","createdAt":1700000000123,"objects":[{"path":"config.json","sha256":"0000000000000000000000000000000000000000000000000000000000000000","size":2},' +
+      '{"path":"snapshots/snapshot-volume.json","sha256":"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","size":3},' +
+      '{"path":"snapshots/snapshot-database.json","sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","size":5},' +
+      '{"path":"snapshots/snapshot-objectstorage.json","sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":7}],"totalSize":17,"version":1}',
+    sha256: 'cd688de1a4b7e0f0b185c660a2c0c199ea4009832c5614a49e8a4dec411f3bd4',
+  },
+  grantClaims: {
+    input: {
+      grantVersion: 1,
+      iss: 'urn:foss:restore:😀:é:é:"quoted":\\backslash',
+      aud: 'corestore.restore',
+      sub: 'cloudly-control',
+      jti: 'grant-0001',
+      authorizationId: 'authorization-0001',
+      tenantId: 'tenant-0001',
+      clusterId: 'cluster-eu-1',
+      targetNodeName: 'node-1',
+      restoreId: 'restore-0001',
+      sourceBackupId: 'backup-0001',
+      sourceServiceId: 'service-source',
+      scratchNamespaceId: 'scratch-0001',
+      stagingArchiveId: 'archive-0001',
+      operation: 'prepare',
+      resourceMappingsSha256: '3c084580fc258dcb5dc25b80d7331eb1d9072a124f640df3ce26eba4917afe70',
+      archiveManifestSha256: 'cd688de1a4b7e0f0b185c660a2c0c199ea4009832c5614a49e8a4dec411f3bd4',
+      iat: 2_000_000_000,
+      nbf: 2_000_000_000,
+      exp: 2_000_000_120,
+    },
+    canonicalJson:
+      '{"archiveManifestSha256":"cd688de1a4b7e0f0b185c660a2c0c199ea4009832c5614a49e8a4dec411f3bd4","aud":"corestore.restore","authorizationId":"authorization-0001","clusterId":"cluster-eu-1","exp":2000000120,"grantVersion":1,"iat":2000000000,' +
+      '"iss":"urn:foss:restore:😀:é:é:\\"quoted\\":\\\\backslash","jti":"grant-0001","nbf":2000000000,"operation":"prepare","resourceMappingsSha256":"3c084580fc258dcb5dc25b80d7331eb1d9072a124f640df3ce26eba4917afe70",' +
+      '"restoreId":"restore-0001","scratchNamespaceId":"scratch-0001","sourceBackupId":"backup-0001","sourceServiceId":"service-source","stagingArchiveId":"archive-0001","sub":"cloudly-control","targetNodeName":"node-1","tenantId":"tenant-0001"}',
+    sha256: '6fcc94b4c6498b9fa45ec41de197999bbb38b9f8437a9c41f9c9478bdf3af8bf',
+  },
+});