@substrat-run/adapter-cloudflare 0.162.0 → 0.163.0

package/dist/control-plane-do.js

@@ -4,7 +4,7 @@ import { replyOf } from './do-reply.js';
 import { switchSqlOver } from './scope-do.js';
 import { blankSqlComments, boundShapesColumn, executableSqlStatements, installsReconciledOf, PROVISIONED_VERSIONS_SQL, provisionedVersionsParams, } from '@substrat-run/kernel';
 import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, COPY_MOVE_RENEW_SQL, copyMoveRenewParams, PENDING_COPY_KEEP_ALIVE_SQL, pendingCopyKeepAliveParams, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, } from '@substrat-run/kernel';
-import { opsFailureReferenceWhere } from '@substrat-run/kernel';
+import { autoAdmittedProdRefusal, listedPromoteRefusal, opsFailureReferenceWhere } from '@substrat-run/kernel';
 import { doBuiltColumnsOf, doRedactionSql } from './sql.js';
 import { assertReplayableDump, AUTO_ADMISSION_NOTE, instant, opsFailureFingerprint, ROUTE_SCOPE_HOSTNAMES_MAX, SCOPE_GATE_REASONS, substratError } from '@substrat-run/contracts';
 /**
@@ -818,6 +818,9 @@ export const REPLIED_METHODS = [
     'admitVersion',
     'rejectVersion',
     'setVerticalServing',
+    // #2565: refuses a listed vertical's prod with forbidden (`unlistedOnly`) or conflict (an
+    // auto-admitted version). A DO from before lists it not, so the current coordinator fails closed.
+    'promoteChannel',
     // #2526: the role, grant and org writes at a tenant node, each with its admin row in its unit. A
     // DO from before lists none of them, so the current coordinator fails closed against it. That is
     // why the org write is `insertOrg` and not `createOrg` with a trailing row: an older DO lists
@@ -829,6 +832,16 @@ export const REPLIED_METHODS = [
     'writeTenantSystemGrant',
     'grantConnectionInDirectory',
     'insertOrg',
+    // #2526: the hostname and entitlement writes, each reading its row and judging its no-op in the
+    // unit that writes it and its admin row. A DO from before lists none of them, so the current
+    // coordinator fails closed against it; a coordinator from before calls them directly, without
+    // the trailing row, and gets the bare write it always did.
+    'bindHostnameInDirectory',
+    'setHostnameStatus',
+    'setHostnameIssuance',
+    'deleteHostname',
+    'grantEntitlement',
+    'revokeEntitlement',
 ];
 export class ControlPlaneDO extends DurableObject {
     sql;
@@ -1382,6 +1395,8 @@ export class ControlPlaneDO extends DurableObject {
         if (status === 'reaped') {
             throw substratError('validation_failed', `tenant ${tenantId} cannot be set to 'reaped' via setTenantStatus — reap goes through reapTenant (control-plane.md §4.8)`);
         }
+        if (before.status === 'reaped')
+            throw substratError('conflict', `tenant ${tenantId} is reaped and cannot change status`);
         // Stamp/clear deleting_at so the grace-window sweep can age tenants (§4.8):
         // entering `deleting` stamps, leaving it (an un-delete) clears — the same shape
         // transitionScope uses for archived_at.
@@ -2205,7 +2220,11 @@ export class ControlPlaneDO extends DurableObject {
             scope_hostnames: JSON.parse(scope_hostnames_json),
         };
     }
-    /** Demote any current canonical for this surface — exactly one may hold it. */
+    /**
+     * Demote any current canonical for this surface — exactly one may hold it. This and
+     * `upsertHostname` are `bindHostnameInDirectory`'s steps; a coordinator from before #2526 still
+     * calls them directly.
+     */
     demoteCanonical(scopeId, surface) {
         this.sql.exec('UPDATE hostnames SET canonical = 0 WHERE scope_id = ? AND surface = ?', scopeId, surface);
     }
@@ -2218,8 +2237,62 @@ export class ControlPlaneDO extends DurableObject {
           status, status_note, canonical, created_at, custom_hostname_id, validation_records)
        VALUES (?, ?, ?, ?, ?, ?, 'pending', NULL, ?, ?, NULL, NULL)`, h.hostname, h.tenantId, h.scopeId, h.verticalSlug, h.surface, h.region, h.canonical ? 1 : 0, h.createdAt);
     }
-    setHostnameStatus(hostname, status, note) {
-        this.sql.exec('UPDATE hostnames SET status = ?, status_note = ? WHERE hostname = ?', status, note, hostname);
+    /**
+     * #2526: `bindHostname` as one unit — the scope (in the tenant), the name's current holder and
+     * whether it released the name (archived or reaped), the demotion of the surface's canonical,
+     * the bind and its admin row, whose vertical is the scope's as read here. A name another live
+     * scope holds is refused `conflict`, writing nothing; so is the demotion when the bind fails.
+     */
+    bindHostnameInDirectory(h, audit) {
+        this.ctx.storage.transactionSync(() => {
+            const scope = this.getScopeRecord(h.tenantId, h.scopeId);
+            if (!scope)
+                throw substratError('not_found', `unknown scope ${h.scopeId} in tenant ${h.tenantId}`);
+            const existing = this.readHostname(h.hostname);
+            if (existing && existing.scope_id !== h.scopeId) {
+                // A hostname routes to exactly one place; silently rebinding would move another
+                // tenant's traffic. Exception: the holder is ARCHIVED or REAPED (a deleted app, storage
+                // since wiped) — it has released the name, so the rebind reclaims it.
+                const holder = this.getScopeRecord(existing.tenant_id, existing.scope_id);
+                if (holder?.status !== 'archived' && holder?.status !== 'reaped') {
+                    throw substratError('conflict', `hostname '${h.hostname}' is already bound to another scope`);
+                }
+            }
+            if (h.canonical)
+                this.demoteCanonical(h.scopeId, h.surface);
+            this.upsertHostname({ ...h, verticalSlug: scope.vertical });
+            this.recordAdmin({ ...audit, vertical: scope.vertical });
+        });
+    }
+    /**
+     * With `audit` (#2526, through `reply`): the row is read here — refused `not_found` when the
+     * name is not bound — and a status it already holds writes nothing and records nothing;
+     * otherwise the update and its admin row, its target and `before` from that read, commit as
+     * one unit. Answers whether it wrote. Without, as a coordinator from before #2526 calls it, the
+     * bare update.
+     */
+    setHostnameStatus(hostname, status, note, audit) {
+        return this.auditedHostnameUpdate(hostname, (row) => row.status === status, () => this.sql.exec('UPDATE hostnames SET status = ?, status_note = ? WHERE hostname = ?', status, note, hostname).rowsWritten > 0, audit);
+    }
+    /**
+     * #2526: a hostname update with its admin row. Without `audit`, the bare `write`. With it, one
+     * unit: the row read (refused `not_found` when the name is not bound), nothing written and
+     * nothing recorded when `unchanged` judges it so, else the write and the row, whose target and
+     * `before` status are the row as read.
+     */
+    auditedHostnameUpdate(hostname, unchanged, write, audit) {
+        if (!audit)
+            return write();
+        return this.ctx.storage.transactionSync(() => {
+            const row = this.readHostname(hostname);
+            if (!row)
+                throw substratError('not_found', `unknown hostname '${hostname}'`);
+            if (unchanged(row))
+                return false; // idempotent, and a no-op is not audited
+            write();
+            this.recordAdmin({ ...audit, tenantId: row.tenant_id, scopeId: row.scope_id, before: { status: row.status } });
+            return true;
+        });
     }
     /**
      * Record the result of a Cloudflare-for-SaaS issuance step (§4.7) — the status the
@@ -2228,25 +2301,42 @@ export class ControlPlaneDO extends DurableObject {
      * `undefined`); the DNS records and status are refreshed each pass. This is the only
      * writer that moves a hostname off `pending` into `verifying`/`active`/`failed` for a
      * custom domain.
+     *
+     * With `audit` (#2526, through `reply`): the row is read here — refused `not_found` when the
+     * name is not bound — and a poll that finds nothing changed (the same status, the same records,
+     * the id already set) writes nothing and records nothing; otherwise the update and its admin
+     * row, its target and `before` from that read, commit as one unit. Answers whether it wrote.
+     * Without, as a coordinator from before #2526 calls it, the bare update.
      */
-    setHostnameIssuance(hostname, fields) {
-        if (fields.customHostnameId !== undefined) {
-            this.sql.exec(`UPDATE hostnames
+    setHostnameIssuance(hostname, fields, audit) {
+        // A poll that changes nothing is not an event, so the reconcile sweep does not flood the
+        // admin log with no-op rows every interval. No records are stored as NULL.
+        const unchanged = (row) => row.status === fields.status &&
+            (row.validation_records ?? null) === fields.validationRecords &&
+            (fields.customHostnameId === undefined || fields.customHostnameId === row.custom_hostname_id);
+        return this.auditedHostnameUpdate(hostname, unchanged, () => (fields.customHostnameId !== undefined
+            ? this.sql.exec(`UPDATE hostnames
             SET status = ?, status_note = ?, custom_hostname_id = ?, validation_records = ?
-          WHERE hostname = ?`, fields.status, fields.note, fields.customHostnameId, fields.validationRecords, hostname);
-        }
-        else {
-            this.sql.exec(`UPDATE hostnames SET status = ?, status_note = ?, validation_records = ? WHERE hostname = ?`, fields.status, fields.note, fields.validationRecords, hostname);
-        }
+          WHERE hostname = ?`, fields.status, fields.note, fields.customHostnameId, fields.validationRecords, hostname)
+            : this.sql.exec(`UPDATE hostnames SET status = ?, status_note = ?, validation_records = ? WHERE hostname = ?`, fields.status, fields.note, fields.validationRecords, hostname)).rowsWritten > 0, audit);
     }
     /**
      * Delete a binding and answer the row it removed, or null. With `owner`, only while the row
      * still names that tenant and scope (#2285): the delete decides it, not an earlier read.
+     * With `audit` (#2526, through `reply`), the admin row, its target and `before` from the row
+     * removed, commits with the delete; a delete that removed nothing records nothing.
      */
-    deleteHostname(hostname, owner) {
-        const rows = this.sql.exec(`DELETE FROM hostnames WHERE hostname = ?${owner ? ' AND tenant_id = ? AND scope_id = ?' : ''}
-       RETURNING tenant_id, scope_id, status`, hostname, ...(owner ? [owner.tenantId, owner.scopeId] : [])).toArray();
-        return rows[0] ?? null;
+    deleteHostname(hostname, owner, audit) {
+        let removed = null;
+        this.writeAndAudit(() => {
+            const rows = this.sql.exec(`DELETE FROM hostnames WHERE hostname = ?${owner ? ' AND tenant_id = ? AND scope_id = ?' : ''}
+         RETURNING tenant_id, scope_id, status`, hostname, ...(owner ? [owner.tenantId, owner.scopeId] : [])).toArray();
+            removed = rows[0] ?? null;
+            return removed !== null;
+        }, audit && (() => ({
+            ...audit, tenantId: removed.tenant_id, scopeId: removed.scope_id, before: { hostname, status: removed.status },
+        })));
+        return removed;
     }
     listHostnames(filter) {
         const where = [];
@@ -2310,10 +2400,8 @@ export class ControlPlaneDO extends DurableObject {
                     .exec(`SELECT v.id, v.admission_note FROM vertical_channels c JOIN vertical_versions v ON v.id = c.version_id
               WHERE c.vertical_slug = ? AND c.channel = 'prod'`, slug)
                     .toArray()[0];
-                if (prod?.admission_note === AUTO_ADMISSION_NOTE) {
-                    throw substratError('conflict', `vertical '${slug}' prod version ${prod.id} is auto-admitted (private self-serve) — ` +
-                        `a staff admit must vouch for it before listing`);
-                }
+                if (prod?.admission_note === AUTO_ADMISSION_NOTE)
+                    throw autoAdmittedProdRefusal(slug, prod.id);
             }
             return { listed: !!r.listed };
         }, audit);
@@ -2781,15 +2869,23 @@ export class ControlPlaneDO extends DurableObject {
      * Remove a reaped fork's directory presence: hostname bindings + the scope row
      * (preview-and-snapshots.md §9). The coordinator's deleteSnapshot calls this AFTER
      * wiping the scope DO's storage — the fork-only refusal lives there, not here.
+     * #2555: with `onlyWhile`, only a scope still in that status is removed, judged in the same unit,
+     * so a scope another call activated in between keeps its row; answers whether it was removed.
      */
-    deleteScopeDirectory(scopeId) {
-        this.ctx.storage.transactionSync(() => {
+    deleteScopeDirectory(scopeId, onlyWhile) {
+        return this.ctx.storage.transactionSync(() => {
+            if (onlyWhile) {
+                const row = this.sql.exec('SELECT status FROM scopes WHERE scope_id = ?', scopeId).toArray()[0];
+                if (row?.status !== onlyWhile)
+                    return false;
+            }
             this.sql.exec('UPDATE peer_bindings SET invalidated = 1 WHERE target_scope_id = ?', scopeId);
             this.sql.exec('DELETE FROM hostnames WHERE scope_id = ?', scopeId);
             forgetSwitchesOf(this.kernelSql, scopeId);
             this.forgetLifecycleDeliveries('scope_id = ?', scopeId);
             forgetScopeStorage(doRedactionSql(this.sql), scopeId);
             this.sql.exec('DELETE FROM scopes WHERE scope_id = ?', scopeId);
+            return true;
         });
     }
     /**
@@ -2814,12 +2910,28 @@ export class ControlPlaneDO extends DurableObject {
      * channel has none yet). A compare-and-set in one synchronous transaction, so no other promote
      * runs between the read and the write: a promote judged its gates against `from` across awaits,
      * and the one that lost the race is told so (`false`) and writes nothing, `audit` included.
+     *
+     * #2565: the vertical's `listed` is read in the same unit — refusing a listed vertical when
+     * `unlistedOnly`, and an auto-admitted version as a listed vertical's new prod. It replaces
+     * `moveChannel`, which judged neither: a new name, so a DO from before refuses the call and a
+     * coordinator from before finds no `moveChannel` to call. Both fail closed.
      */
-    moveChannel(from, history, audit) {
+    promoteChannel(from, history, unlistedOnly, audit) {
         return this.writeAndAudit(() => {
             const now = this.readChannel(history.vertical_slug, history.channel);
             if ((now?.version_id ?? null) !== from)
                 return false;
+            const vertical = this.readVertical(history.vertical_slug);
+            const listed = vertical?.listed;
+            if (listed && unlistedOnly)
+                throw listedPromoteRefusal();
+            // A re-promote of what prod already names, and what serves (if anything does), moves
+            // nothing, so it is not judged again. One whose serve would change what runs is.
+            const serving = vertical?.serving_ref && vertical.serving_version_id ? vertical.serving_version_id : history.version_id;
+            if (listed && history.channel === 'prod' && (from !== history.version_id || serving !== history.version_id) &&
+                this.versionAdmission(history.version_id).admission_note === AUTO_ADMISSION_NOTE) {
+                throw autoAdmittedProdRefusal(history.vertical_slug, history.version_id);
+            }
             this.sql.exec(`INSERT INTO vertical_channels (vertical_slug, channel, version_id, updated_at)
          VALUES (?, ?, ?, ?)
          ON CONFLICT (vertical_slug, channel) DO UPDATE SET version_id = ?, updated_at = ?`, history.vertical_slug, history.channel, history.version_id, history.at, history.version_id, history.at);
@@ -3031,8 +3143,24 @@ export class ControlPlaneDO extends DurableObject {
     /**
      * Upsert; returns before/after for the host's audit row, `changed: false` when
      * the merged result equals what the row already carried (not audited upstream).
+     * With `audit` (#2526, through `reply`), an effective change commits with its admin row,
+     * `before` and `after` the grant as read and written here; an unchanged grant records none.
      */
-    grantEntitlement(tenantId, key, input, actor) {
+    grantEntitlement(tenantId, key, input, actor, audit) {
+        let result;
+        this.writeAndAudit(() => {
+            result = this.grantEntitlementIn(tenantId, key, input, actor);
+            return result.changed;
+        }, audit && (() => ({
+            ...audit,
+            before: result.before
+                ? { entitlementKey: key, expiresAt: result.before.expires_at, quota: result.before.quota, plan: result.before.plan }
+                : null,
+            after: { entitlementKey: key, expiresAt: result.after.expires_at, quota: result.after.quota, plan: result.after.plan },
+        })));
+        return result;
+    }
+    grantEntitlementIn(tenantId, key, input, actor) {
         const existing = this.readEntitlement(tenantId, key);
         const next = {
             expiresAt: input.expiresAt !== undefined ? input.expiresAt : (existing?.expires_at ?? null),
@@ -3070,12 +3198,23 @@ export class ControlPlaneDO extends DurableObject {
             },
         };
     }
-    /** DELETE; returns the removed row (the host's audit `before`), null if none. */
-    revokeEntitlement(tenantId, key) {
-        const existing = this.readEntitlement(tenantId, key);
-        if (!existing)
-            return null;
-        this.sql.exec('DELETE FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?', tenantId, key);
+    /**
+     * DELETE; returns the removed row (the host's audit `before`), null if none. With `audit`
+     * (#2526, through `reply`), the admin row, `before` the row removed, commits with the delete;
+     * a revoke of nothing held records nothing.
+     */
+    revokeEntitlement(tenantId, key, audit) {
+        let existing = null;
+        this.writeAndAudit(() => {
+            existing = this.readEntitlement(tenantId, key);
+            if (!existing)
+                return false;
+            this.sql.exec('DELETE FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?', tenantId, key);
+            return true;
+        }, audit && (() => ({
+            ...audit,
+            before: { entitlementKey: key, expiresAt: existing.expires_at, quota: existing.quota, plan: existing.plan },
+        })));
         return existing;
     }
     tenantHoldsEntitlement(tenantId, key) {