@ticatec/omniflow-nexus 1.0.0

package/src/client/NexusClient.ts

@@ -0,0 +1,143 @@
+import {
+  maskSecrets,
+  safeFetch,
+  extractErrorMessage,
+  type SafeFetchOptions
+} from '@ticatec/omniflow-artifact'
+
+export interface NexusClientConfig {
+  baseUrl: string
+  username?: string
+  password?: string
+  token?: string
+  timeoutMs?: number
+}
+
+export class NexusClient {
+  readonly baseUrl: string
+  readonly username?: string
+  readonly password?: string
+  readonly token?: string
+  readonly timeoutMs: number
+
+  constructor(config: NexusClientConfig) {
+    let base = config.baseUrl.trim().replace(/\/+$/, '')
+    if (!/^https?:\/\//i.test(base)) {
+      base = `https://${base}`
+    }
+    this.baseUrl = base
+    this.username = config.username
+    this.password = config.password
+    this.token = config.token
+    this.timeoutMs = config.timeoutMs ?? 30000
+  }
+
+  get host(): string {
+    const parsed = new URL(this.baseUrl)
+    return parsed.host
+  }
+
+  get hostname(): string {
+    const parsed = new URL(this.baseUrl)
+    return parsed.hostname
+  }
+
+  /**
+   * Return sensitive credential strings of length >= 3 for scrubbing.
+   * Username is intentionally excluded to preserve debugging visibility.
+   */
+  getSecrets(): string[] {
+    const secrets = [this.token, this.password].filter(
+      (s): s is string => typeof s === 'string' && s.length >= 3
+    )
+    if (this.username && this.password) {
+      const basic = Buffer.from(`${this.username}:${this.password}`).toString('base64')
+      if (basic.length >= 3) {
+        secrets.push(basic)
+      }
+    }
+    return secrets
+  }
+
+  maskSecrets(input: string): string {
+    return maskSecrets(input, this.getSecrets())
+  }
+
+  async extractErrorMessage(response: Response): Promise<string> {
+    return extractErrorMessage(response, this.getSecrets())
+  }
+
+  getAuthHeaders(): Record<string, string> {
+    const headers: Record<string, string> = {}
+    if (this.token) {
+      headers['Authorization'] = `Bearer ${this.token}`
+    } else if (this.username && this.password) {
+      const basic = Buffer.from(`${this.username}:${this.password}`).toString('base64')
+      headers['Authorization'] = `Basic ${basic}`
+    }
+    return headers
+  }
+
+  /**
+   * Resolve root repository URL for a given repository name.
+   * Handles cases where baseUrl might already contain "/repository/<name>".
+   */
+  getRepositoryBaseUrl(repoName = ''): string {
+    let cleanBase = this.baseUrl.replace(/\/+$/, '')
+
+    if (cleanBase.includes('/repository/')) {
+      const idx = cleanBase.indexOf('/repository/')
+      const root = cleanBase.substring(0, idx)
+      const existingRepo = cleanBase.substring(idx + '/repository/'.length).split('/')[0]
+      const targetRepo = repoName || existingRepo
+      return `${root}/repository/${targetRepo}`
+    }
+
+    if (!repoName) {
+      return `${cleanBase}/repository`
+    }
+
+    return `${cleanBase}/repository/${repoName.replace(/^\/+/, '').replace(/\/+$/, '')}`
+  }
+
+  /**
+   * Build URL for Maven artifact.
+   */
+  getMavenArtifactUrl(
+    repoName: string,
+    groupId: string,
+    artifactId: string,
+    version: string,
+    filename: string
+  ): string {
+    const base = this.getRepositoryBaseUrl(repoName)
+    const groupPath = groupId.replace(/\./g, '/')
+    return `${base}/${groupPath}/${artifactId}/${version}/${filename}`
+  }
+
+  /**
+   * Build URL for Raw (Generic) artifact.
+   */
+  getRawArtifactUrl(repoName: string, subpath: string, filename: string): string {
+    const base = this.getRepositoryBaseUrl(repoName)
+    const cleanSubpath = subpath ? subpath.replace(/^\/+/, '').replace(/\/+$/, '') : ''
+    return cleanSubpath ? `${base}/${cleanSubpath}/${filename}` : `${base}/${filename}`
+  }
+
+  async request(url: string, init: RequestInit = {}): Promise<Response> {
+    const headers = {
+      ...this.getAuthHeaders(),
+      ...(init.headers as Record<string, string> || {})
+    }
+
+    return safeFetch(url, {
+      ...init,
+      headers,
+      timeoutMs: this.timeoutMs,
+      secrets: this.getSecrets()
+    })
+  }
+}
+
+export { maskSecrets, safeFetch, extractErrorMessage, type SafeFetchOptions }
+

package/src/docker/NexusDockerPublisher.ts

@@ -0,0 +1,66 @@
+import { BaseDockerPublisher } from '@ticatec/omniflow-artifact'
+import type { RegistryConfig } from '@ticatec/omniflow-artifact'
+
+/**
+ * Sonatype Nexus 3 Docker Registry Publisher.
+ *
+ * Supports Nexus Docker hosted repositories via:
+ * 1. Dedicated HTTP connector port (e.g. nexus.example.com:8082/my-app:tag)
+ * 2. Repository path routing (e.g. nexus.example.com/repository/docker-hosted/my-app:tag)
+ */
+export class NexusDockerPublisher extends BaseDockerPublisher {
+  readonly id = 'nexus-docker'
+  readonly name = 'Nexus 3 Docker Registry'
+  readonly platform = 'nexus'
+  override readonly priority = 20
+
+  override detect(registry: RegistryConfig): boolean {
+    if (registry.type !== 'docker' && registry.type !== 'container') {
+      return false
+    }
+
+    const regName = (registry.name || '').toLowerCase()
+    if (regName === 'nexus' || regName.startsWith('nexus-') || regName === 'nexus-docker') {
+      return true
+    }
+
+    const server = (registry.server || '').toLowerCase()
+    try {
+      const parsed = new URL(server.includes('://') ? server : `https://${server}`)
+      const host = parsed.hostname.toLowerCase()
+
+      // Exclude other known platforms
+      if (
+        host === 'aliyun.com' ||
+        host.endsWith('.aliyun.com') ||
+        host.endsWith('.aliyuncs.com') ||
+        host === 'gitlab.com' ||
+        host.endsWith('.gitlab.com') ||
+        host === 'github.com' ||
+        host.endsWith('.github.com')
+      ) {
+        return false
+      }
+
+      return host.includes('nexus') || parsed.pathname.includes('/repository/docker')
+    } catch {
+      return false
+    }
+  }
+
+  override buildRepositoryUrl(registry: RegistryConfig, imageName: string): string {
+    let host = this.normalizeServerHost(registry.server)
+    const cleanImage = imageName.replace(/^\/+/, '')
+
+    // Check if server or namespace includes repository path
+    const ns = (registry.namespace || '').replace(/\/+$/, '')
+    if (ns) {
+      if (cleanImage.startsWith(`${ns}/`)) {
+        return `${host}/${cleanImage}`
+      }
+      return `${host}/${ns}/${cleanImage}`
+    }
+
+    return `${host}/${cleanImage}`
+  }
+}

package/src/index.ts

@@ -0,0 +1,54 @@
+import type { PluginContext } from '@ticatec/omniflow-core'
+import type { ArtifactPublisherRegistry } from '@ticatec/omniflow-artifact'
+import { NexusMavenPublisher } from './maven/NexusMavenPublisher.js'
+import { NexusNpmPublisher } from './npm/NexusNpmPublisher.js'
+import { NexusDockerPublisher } from './docker/NexusDockerPublisher.js'
+import { NexusRawPublisher } from './raw/NexusRawPublisher.js'
+
+export * from './client/NexusClient.js'
+export * from './maven/NexusMavenPublisher.js'
+export * from './npm/NexusNpmPublisher.js'
+export * from './docker/NexusDockerPublisher.js'
+export * from './raw/NexusRawPublisher.js'
+
+export interface RegisterNexusOptions {
+  artifactRegistry?: ArtifactPublisherRegistry
+}
+
+/**
+ * Standard OmniFlow Plugin SPI entry point.
+ */
+export function register(ctx: PluginContext, options: Record<string, unknown> = {}): void {
+  registerNexus({ artifactRegistry: ctx.artifactRegistry })
+}
+
+export default register
+
+/**
+ * Register all Sonatype Nexus 3 artifact publishers into the target registry.
+ */
+export function registerNexus(options: RegisterNexusOptions = {}): {
+  mavenPublisher: NexusMavenPublisher
+  npmPublisher: NexusNpmPublisher
+  dockerPublisher: NexusDockerPublisher
+  rawPublisher: NexusRawPublisher
+} {
+  const mavenPublisher = new NexusMavenPublisher()
+  const npmPublisher = new NexusNpmPublisher()
+  const dockerPublisher = new NexusDockerPublisher()
+  const rawPublisher = new NexusRawPublisher()
+
+  if (options.artifactRegistry) {
+    options.artifactRegistry.register(mavenPublisher)
+    options.artifactRegistry.register(npmPublisher)
+    options.artifactRegistry.register(dockerPublisher)
+    options.artifactRegistry.register(rawPublisher)
+  }
+
+  return {
+    mavenPublisher,
+    npmPublisher,
+    dockerPublisher,
+    rawPublisher
+  }
+}

package/src/maven/NexusMavenPublisher.ts

@@ -0,0 +1,247 @@
+import { promises as fs } from 'fs'
+import path from 'path'
+import crypto from 'crypto'
+import { BasePublisher, resolveMavenArtifactFilenames, mavenPomPathFor, isMavenArtifactFile } from '@ticatec/omniflow-artifact'
+import type { ArtifactPayload, PublishOptions, RegistryConfig } from '@ticatec/omniflow-artifact'
+import { NexusClient } from '../client/NexusClient.js'
+
+/**
+ * Sonatype Nexus 3 Maven Repository Publisher.
+ *
+ * Endpoint format: PUT {server}/repository/{repoName}/{groupId-as-path}/{artifactId}/{version}/{filename}
+ * Typically used with repositories like "maven-releases" or "maven-snapshots".
+ */
+export class NexusMavenPublisher extends BasePublisher {
+  readonly id = 'nexus-maven'
+  readonly name = 'Nexus 3 Maven Repository'
+  readonly platform = 'nexus'
+  readonly artifactType = 'maven'
+  override readonly priority = 20
+
+  override detect(registry: RegistryConfig): boolean {
+    if (registry.type !== 'maven' && registry.type !== 'jar') {
+      return false
+    }
+
+    const regName = (registry.name || '').toLowerCase()
+    if (regName === 'nexus' || regName.startsWith('nexus-')) {
+      return true
+    }
+
+    const server = (registry.server || '').toLowerCase()
+    try {
+      const parsed = new URL(server.includes('://') ? server : `https://${server}`)
+      const host = parsed.hostname.toLowerCase()
+
+      // Exclude other known platforms
+      if (
+        host === 'aliyun.com' ||
+        host.endsWith('.aliyun.com') ||
+        host.endsWith('.aliyuncs.com') ||
+        host === 'gitlab.com' ||
+        host.endsWith('.gitlab.com') ||
+        host === 'github.com' ||
+        host.endsWith('.github.com')
+      ) {
+        return false
+      }
+
+      return host.includes('nexus') || parsed.pathname.includes('/repository/')
+    } catch {
+      return false
+    }
+  }
+
+  async login(registry: RegistryConfig, _options?: PublishOptions): Promise<void> {
+    const creds = this.resolveCredentials(registry)
+    if (!creds.token && (!creds.username || !creds.password)) {
+      this.log(`  ℹ No auth credentials configured for Nexus Maven repository ${registry.server}`)
+    }
+  }
+
+  override buildTargetRef(artifact: ArtifactPayload, _registry: RegistryConfig): string {
+    try {
+      const { groupId, artifactId, version } = resolveMavenArtifactFilenames(artifact, undefined, undefined, 'Nexus')
+      return `${groupId}:${artifactId}:${version}`
+    } catch {
+      const version = artifact.tags && artifact.tags.length > 0 ? artifact.tags[0] : '1.0.0'
+      return `${artifact.name}:${version}`
+    }
+  }
+
+  override async exists(
+    artifact: ArtifactPayload,
+    registry: RegistryConfig,
+    options?: PublishOptions
+  ): Promise<boolean> {
+    const creds = this.resolveCredentials(registry)
+    const client = new NexusClient({
+      baseUrl: registry.server,
+      username: creds.username,
+      password: creds.password,
+      token: creds.token,
+      timeoutMs: options?.timeoutMs
+    })
+
+    let jarPath = artifact.source
+    if (jarPath) {
+      const stat = await fs.stat(jarPath).catch(() => null)
+      if (stat?.isDirectory()) {
+        const files = await fs.readdir(jarPath).catch(() => [] as string[])
+        const jarFile = files.find(
+          f => isMavenArtifactFile(f)
+        )
+        if (jarFile) {
+          jarPath = path.join(jarPath, jarFile)
+        }
+      }
+    }
+
+    const { groupId, artifactId, version, jarFilename } = resolveMavenArtifactFilenames(
+      artifact,
+      jarPath,
+      undefined,
+      'Nexus'
+    )
+
+    const defaultRepo = version.toUpperCase().endsWith('-SNAPSHOT') ? 'maven-snapshots' : 'maven-releases'
+    const repoName =
+      registry.namespace?.trim() ||
+      (registry.options?.repository as string | undefined)?.trim() ||
+      ((registry as any).metadata?.repository as string | undefined)?.trim() ||
+      defaultRepo
+
+    const targetUrl = client.getMavenArtifactUrl(repoName, groupId, artifactId, version, jarFilename)
+
+    try {
+      const res = await client.request(targetUrl, { method: 'HEAD' })
+      if (res.ok || res.status === 200 || res.status === 204) {
+        return true
+      }
+      if (res.status === 404) {
+        return false
+      }
+      const err = await client.extractErrorMessage(res)
+      throw new Error(`Failed to check Maven artifact existence (${res.status}): ${err}`)
+    } catch (err: any) {
+      if (err?.message?.includes('Failed to check Maven artifact existence')) {
+        throw err
+      }
+      throw new Error(`Failed to check Maven artifact existence: ${client.maskSecrets(err?.message || String(err))}`)
+    }
+  }
+
+  protected async doPublish(
+    artifact: ArtifactPayload,
+    registry: RegistryConfig,
+    options?: PublishOptions
+  ): Promise<{
+    ref: string
+    digest?: string
+    metadata?: Record<string, unknown>
+  }> {
+    const creds = this.resolveCredentials(registry)
+    const client = new NexusClient({
+      baseUrl: registry.server,
+      username: creds.username,
+      password: creds.password,
+      token: creds.token,
+      timeoutMs: options?.timeoutMs
+    })
+
+    // Locate jar file
+    let jarPath = artifact.source
+    const stat = await fs.stat(jarPath).catch(() => null)
+    if (stat?.isDirectory()) {
+      const files = await fs.readdir(jarPath)
+      const jarFile = files.find(f => isMavenArtifactFile(f))
+      if (!jarFile) {
+        throw new Error(`No jar/war artifact found in directory: ${jarPath}`)
+      }
+      jarPath = path.join(jarPath, jarFile)
+    }
+
+    const { groupId, artifactId, version, jarFilename, pomFilename } = resolveMavenArtifactFilenames(
+      artifact,
+      jarPath,
+      undefined,
+      'Nexus'
+    )
+
+    const defaultRepo = version.toUpperCase().endsWith('-SNAPSHOT') ? 'maven-snapshots' : 'maven-releases'
+    const repoName =
+      registry.namespace?.trim() ||
+      (registry.options?.repository as string | undefined)?.trim() ||
+      ((registry as any).metadata?.repository as string | undefined)?.trim() ||
+      defaultRepo
+
+    const jarBuffer = await fs.readFile(jarPath)
+    const digest = `sha256:${crypto.createHash('sha256').update(jarBuffer).digest('hex')}`
+
+    const targetUrl = client.getMavenArtifactUrl(repoName, groupId, artifactId, version, jarFilename)
+    this.log(`  📤 Uploading Maven JAR to Nexus: ${client.maskSecrets(targetUrl)}`)
+
+    if (options?.dryRun) {
+      this.log(`  [dryRun] Would PUT ${jarFilename} (${jarBuffer.length} bytes) to ${client.maskSecrets(targetUrl)}`)
+      return {
+        ref: `${groupId}:${artifactId}:${version}`,
+        digest,
+        metadata: { repoName, targetUrl, size: jarBuffer.length }
+      }
+    }
+
+    // The POM goes up first, deliberately.
+    //
+    // The existence probe checks for the jar/war, so uploading that last is what
+    // makes the probe mean "this artifact is complete". With the artifact first, a
+    // run that uploaded it and then failed on the POM would leave a coordinate that
+    // probes as present: the retry skips it as already published, and the POM never
+    // arrives — a jar in the repository forever, with no dependency information.
+    // Upload pom if exists
+    const pomPath = mavenPomPathFor(jarPath)
+    const pomStat = await fs.stat(pomPath).catch(() => null)
+    if (pomStat?.isFile()) {
+      const pomBuffer = await fs.readFile(pomPath)
+      const pomTargetUrl = client.getMavenArtifactUrl(repoName, groupId, artifactId, version, pomFilename)
+      this.log(`  📤 Uploading Maven POM to Nexus: ${client.maskSecrets(pomTargetUrl)}`)
+
+      const pomRes = await client.request(pomTargetUrl, {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/xml' },
+        body: pomBuffer as unknown as BodyInit
+      })
+
+      if (!pomRes.ok && pomRes.status !== 201 && pomRes.status !== 200) {
+        const pomErr = await client.extractErrorMessage(pomRes)
+        throw new Error(`Failed to upload Maven POM to Nexus (${pomRes.status}): ${pomErr}`)
+      }
+    }
+
+    const res = await client.request(targetUrl, {
+      method: 'PUT',
+      headers: {
+        'Content-Type': 'application/java-archive'
+      },
+      body: jarBuffer as unknown as BodyInit
+    })
+
+    if (!res.ok && res.status !== 201 && res.status !== 200) {
+      const errText = await client.extractErrorMessage(res)
+      throw new Error(`Failed to upload Maven JAR to Nexus (${res.status}): ${errText}`)
+    }
+
+    return {
+      ref: `${groupId}:${artifactId}:${version}`,
+      digest,
+      metadata: {
+        groupId,
+        artifactId,
+        version,
+        repoName,
+        targetUrl,
+        size: jarBuffer.length
+      }
+    }
+  }
+}
+

package/src/npm/NexusNpmPublisher.ts

@@ -0,0 +1,81 @@
+import { BaseNpmPublisher } from '@ticatec/omniflow-artifact'
+import type { RegistryConfig } from '@ticatec/omniflow-artifact'
+
+/**
+ * Sonatype Nexus 3 NPM Package Registry Publisher.
+ *
+ * Endpoint format: {server}/repository/{repoName}/
+ * Typically used with repositories like "npm-hosted".
+ */
+export class NexusNpmPublisher extends BaseNpmPublisher {
+  readonly id = 'nexus-npm'
+  readonly name = 'Nexus 3 NPM Repository'
+  readonly platform = 'nexus'
+  override readonly priority = 20
+
+  override detect(registry: RegistryConfig): boolean {
+    if (registry.type !== 'npm') {
+      return false
+    }
+
+    const regName = (registry.name || '').toLowerCase()
+    if (regName === 'nexus' || regName.startsWith('nexus-')) {
+      return true
+    }
+
+    const server = (registry.server || '').toLowerCase()
+    try {
+      const parsed = new URL(server.includes('://') ? server : `https://${server}`)
+      const host = parsed.hostname.toLowerCase()
+
+      // Exclude other known platforms
+      if (
+        host === 'aliyun.com' ||
+        host.endsWith('.aliyun.com') ||
+        host.endsWith('.aliyuncs.com') ||
+        host === 'gitlab.com' ||
+        host.endsWith('.gitlab.com') ||
+        host === 'github.com' ||
+        host.endsWith('.github.com')
+      ) {
+        return false
+      }
+
+      return host.includes('nexus') || parsed.pathname.includes('/repository/')
+    } catch {
+      return false
+    }
+  }
+
+  override normalizeRegistryUrl(
+    server: string,
+    _registryOrNamespace?: RegistryConfig | string
+  ): string {
+    let url = server.trim()
+    if (!/^https?:\/\//i.test(url)) {
+      url = `https://${url}`
+    }
+
+    if (url.includes('/repository/')) {
+      return url.endsWith('/') ? url : `${url}/`
+    }
+
+    let repoName: string | undefined
+    if (typeof _registryOrNamespace === 'string') {
+      repoName = _registryOrNamespace.trim()
+    } else if (_registryOrNamespace && typeof _registryOrNamespace === 'object') {
+      const reg = _registryOrNamespace as RegistryConfig & { metadata?: Record<string, unknown> }
+      repoName =
+        reg.namespace?.trim() ||
+        (reg.options?.repository as string | undefined)?.trim() ||
+        (reg.options?.repoName as string | undefined)?.trim() ||
+        (reg.metadata?.repository as string | undefined)?.trim() ||
+        (reg.metadata?.repoName as string | undefined)?.trim()
+    }
+
+    const cleanBase = url.replace(/\/+$/, '')
+    const targetRepo = repoName ? repoName.replace(/^\/+/, '').replace(/\/+$/, '') : 'npm-hosted'
+    return `${cleanBase}/repository/${targetRepo}/`
+  }
+}
+