@wtfalch/foundry 0.16.9 → 0.16.11

package/dist/plan/platform-providers.d.ts

@@ -260,7 +260,9 @@ export interface PlatformMailAdminPort {
      * Sets the instance's default hostname and its OIDC directory
      * (`x:SystemSettings`/`x:Directory`/`x:Domain`/`x:Authentication`) --
      * idempotent, safe to call on every apply once the instance is up. A fresh
-     * instance is first taken out of bootstrap mode.
+     * instance is first given its `Bootstrap` config; Stalwart 0.16 loads that
+     * only on its next start, so the call then returns `'restart'` having
+     * written nothing else. The caller restarts the app and calls again.
      */
     applySettings(input: {
         mailHost: string;
@@ -270,8 +272,12 @@ export interface PlatformMailAdminPort {
             issuerUrl: string;
             audience: string;
         };
-    }): Promise<void>;
-    /** `StalwartClient.createApiKey`'s own signature. */
+    }): Promise<'restart' | undefined>;
+    /**
+     * `StalwartClient.createApiKey`'s own signature. The key belongs to a real
+     * admin account, not to the recovery admin (see
+     * {@link defaultStalwartForInstance}).
+     */
     createApiKey(description: string, permissions: readonly string[] | 'inherit'): Promise<string>;
 }
 /**
@@ -293,6 +299,8 @@ export declare function defaultStalwartForInstance(input: {
     url: string;
     user: string;
     password: string;
+    /** The platform's apex: the domain of the admin account the API key is minted as. */
+    apex: string;
 }): PlatformMailAdminPort;
 /**
  * #169: everything {@link provisionPlatformMail} needs beyond
@@ -322,6 +330,7 @@ export interface PlatformMailDeps {
         url: string;
         user: string;
         password: string;
+        apex: string;
     }): PlatformMailAdminPort;
     deliverSecret: FoundryStepExecutorPorts['deliverSecret'];
     /** Clock, sleep and fetch for the readiness wait and delivery retries; real ones by default. */

package/dist/plan/platform-providers.js

@@ -1488,10 +1488,11 @@ export function defaultStalwartForInstance(input) {
     return {
         async applySettings({ mailHost, apex, oidc }) {
             // A fresh Stalwart (0.16) is in bootstrap mode and refuses every write
-            // but the `Bootstrap` object, so complete that first. A server already
-            // past it skips this. `update` drops the response, which carries the
-            // generated `admin@<apex>` secret: this step signs in with the
-            // recovery admin and never needs it.
+            // but the `Bootstrap` object, and loads that object only on its next
+            // start, so write it and hand the restart to the caller. A server
+            // already past it skips this. `update` drops the response, which
+            // carries the generated `admin@<apex>` secret: this step signs in with
+            // the recovery admin and never needs it.
             if ((await instance.client.probe()) === 'bootstrap') {
                 await instance.client.update('Bootstrap', 'singleton', {
                     serverHostname: mailHost,
@@ -1499,13 +1500,45 @@ export function defaultStalwartForInstance(input) {
                     // The server sits behind a tunnel; no ACME challenge can reach it.
                     requestTlsCertificate: false,
                 });
-                await instance.client.waitFor('ready');
+                return 'restart';
             }
             await applyObjects(instance.client, platformMailSettingsObjects({ apex, mailHost, oidc }), () => { });
         },
-        createApiKey: (description, permissions) => instance.client.createApiKey(description, permissions),
+        async createApiKey(description, permissions) {
+            // The recovery admin is not a directory account (Stalwart's
+            // `account_set` in `jmap/src/registry/mapping/account.rs` finds no
+            // Account for its id and answers notFound), so it cannot own a key. Give an internal admin account (no credential, so
+            // nothing to sign in with, and the OIDC directory is never asked) and
+            // act as it: the recovery admin may impersonate any account as
+            // `<account>%<recovery user>`.
+            const domains = await instance.client.list('Domain');
+            const domain = domains.find((d) => d.name === input.apex);
+            if (!domain) {
+                throw new Error(`platform:mail: Stalwart has no domain ${input.apex} to hold the admin account`);
+            }
+            await instance.client.upsert('Account', (a) => a.name === PLATFORM_MAIL_ADMIN_ACCOUNT && a.domainId === domain.id, {
+                '@type': 'User',
+                name: PLATFORM_MAIL_ADMIN_ACCOUNT,
+                domainId: domain.id,
+                description: 'foundry platform admin (API key owner)',
+                roles: { '@type': 'Admin' },
+                permissions: { '@type': 'Inherit' },
+                encryptionAtRest: { '@type': 'Disabled' },
+                quotas: {},
+                aliases: {},
+                memberGroupIds: {},
+            }, {});
+            const asAdmin = openInstance({
+                url: input.url,
+                secret: input.password,
+                user: `${PLATFORM_MAIL_ADMIN_ACCOUNT}@${input.apex}%${input.user}`,
+            });
+            return asAdmin.client.createApiKey(description, permissions);
+        },
     };
 }
+/** The internal account the admin API key belongs to, in the platform's apex domain. */
+const PLATFORM_MAIL_ADMIN_ACCOUNT = 'foundry-admin';
 /** The ZITADEL project and resource api Stalwart's own OIDC directory checks access tokens' `aud` claim against (#346). */
 const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
 /**
@@ -1783,11 +1816,19 @@ async function provisionPlatformMail(context, deps) {
                 url: `https://${hostname}`,
                 user: STALWART_RECOVERY_USER,
                 password,
-            });
-            await admin.applySettings({
-                mailHost,
                 apex: platform.apex,
-                oidc: { issuerUrl: issuer, audience: project.id },
+            });
+            await applyMailSettings(admin, {
+                coolify: deps.coolify,
+                appId,
+                runtime,
+                sleep,
+                hostname,
+                settings: {
+                    mailHost,
+                    apex: platform.apex,
+                    oidc: { issuerUrl: issuer, audience: project.id },
+                },
             });
             await record(PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, project.id);
         }
@@ -1815,11 +1856,19 @@ async function provisionPlatformMail(context, deps) {
                 url: `https://${hostname}`,
                 user: STALWART_RECOVERY_USER,
                 password,
-            });
-            await admin.applySettings({
-                mailHost,
                 apex: platform.apex,
-                oidc: { issuerUrl: issuer, audience: project.id },
+            });
+            await applyMailSettings(admin, {
+                coolify: deps.coolify,
+                appId,
+                runtime,
+                sleep,
+                hostname,
+                settings: {
+                    mailHost,
+                    apex: platform.apex,
+                    oidc: { issuerUrl: issuer, audience: project.id },
+                },
             });
             // Recorded and persisted before the secret leaves this function: if
             // delivery fails for good, the next plan reports the lost key rather
@@ -2017,6 +2066,37 @@ async function waitForMailInstance(url, runtime, sleep) {
         await sleep(interval);
     }
 }
+/**
+ * Applies the settings; when the instance was fresh, restarts the app (the
+ * `Bootstrap` config loads only on Stalwart's next start) and applies again
+ * once it answers ready. Rejects if it is still in bootstrap after the wait.
+ */
+async function applyMailSettings(admin, input) {
+    const { runtime, sleep } = input;
+    if ((await admin.applySettings(input.settings)) !== 'restart')
+        return;
+    await input.coolify.raw('POST', `/applications/${input.appId}/restart`);
+    const now = runtime.now ?? Date.now;
+    const deadline = now() + (runtime.readyTimeoutMs ?? 300_000);
+    for (;;) {
+        await sleep(runtime.readyIntervalMs ?? 5_000);
+        await waitForMailInstance(`https://${input.hostname}${STALWART_READY_PATH}`, runtime, sleep);
+        // The old container may still answer, or drop the connection, for a
+        // moment after the restart call.
+        try {
+            if ((await admin.applySettings(input.settings)) !== 'restart')
+                return;
+        }
+        catch (error) {
+            if (now() >= deadline)
+                throw error;
+            continue;
+        }
+        if (now() >= deadline) {
+            throw new Error(`platform:mail: Stalwart at https://${input.hostname} is still in bootstrap mode after a restart; apply again`);
+        }
+    }
+}
 function redactedMailError(error, secrets) {
     const original = error instanceof Error ? error : new Error(String(error));
     const message = redactSecrets(original.message, secrets);
@@ -2964,6 +3044,9 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
             envs.push({ key: 'INTEGRATIONS_URL', value: url }, {
                 key: 'INTEGRATIONS_MANAGEMENT_PRIVATE_KEY',
                 value: held(INTEGRATIONS_MANAGEMENT_KEY_REF),
+                // A PEM spans lines; unflagged, Coolify writes it into `.env`
+                // unquoted and the container never starts.
+                multiline: true,
             }, {
                 key: 'INTEGRATIONS_MANAGEMENT_ISSUER',
                 value: INTEGRATIONS_MANAGEMENT_ISSUER,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.16.9",
+  "version": "0.16.11",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",