anbaric-cloud-hosting 1.25.0 → 1.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.25.0",
-    "anbaric-plugins": "^1.25.0",
-    "anbaric-tsapi": "^1.25.0",
-    "anbaric-web": "^1.25.0",
+    "anbaric-data-store": "^1.26.0",
+    "anbaric-plugins": "^1.26.0",
+    "anbaric-tsapi": "^1.26.0",
+    "anbaric-web": "^1.26.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.25.0",
-    "anbaric-state-machine": "^1.25.0",
+    "anbaric-impl-cloud": "^1.26.0",
+    "anbaric-state-machine": "^1.26.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/app-management/BaseBuildLayer.ts

@@ -155,9 +155,27 @@ abstract class BaseBuildLayer implements BuildLayer {
             await new Promise(resolve => setTimeout(resolve, LIVENESS_PROBE_INTERVAL_MS));
         }
 
+        // The admin port never answering almost always means the app process
+        // crashed on boot, so pull whatever it logged and put the real cause in
+        // the deploy result - not just the timeout, which says nothing.
+        const diagnostics = await this.diagnostics(deployment).catch(() => []);
+
         await this.stop(deployment);
         deployment.status = "failed";
         this.log(deployment, `app admin port ${deployment.adminPort} did not answer within ${this.livenessTimeoutMs / 1000}s`);
+        if (diagnostics.length > 0) {
+            this.log(deployment, "the app's last output before it stopped:");
+            for (const line of diagnostics) this.log(deployment, `  ${line}`);
+        } else {
+            this.log(deployment, "no output was captured - the app may have failed before logging, or is still starting");
+        }
+    }
+
+    // The app's recent output, for diagnosing a boot that never became live.
+    // Each build layer reads it from where its apps log (container logs,
+    // CloudWatch); the default has nothing to offer.
+    protected async diagnostics(_deployment : Deployment) : Promise<Array<string>> {
+        return [];
     }
 
     private async linkWorkspacePackages(appDir : string, manifest : { dependencies? : Record<string, string> }) : Promise<void> {

package/src/app-management/DockerBuildLayer.ts

@@ -53,6 +53,20 @@ class DockerBuildLayer extends BaseBuildLayer {
         super(appsDir, consumerPortBase, probe);
     }
 
+    protected async diagnostics(deployment : Deployment) : Promise<Array<string>> {
+        return new Promise((resolve) => {
+            const lines : Array<string> = [];
+            const take = (buffer : Buffer) => {
+                for (const line of buffer.toString().split("\n")) if (line.trim()) lines.push(line);
+            };
+            const logs = spawn("docker", ["logs", "--tail", "30", this.appHostFor(deployment.appName)]);
+            logs.stdout.on("data", take);
+            logs.stderr.on("data", take);
+            logs.on("close", () => resolve(lines.slice(-30)));
+            logs.on("error", () => resolve([]));
+        });
+    }
+
     protected appHostFor(appName : string) : string {
         return `anbaric-app-${appName}`;
     }
@@ -90,6 +104,7 @@ class DockerBuildLayer extends BaseBuildLayer {
             "--env", "ANBARIC_SECRET_STORE_TYPE=cloud",
             "--env", "ANBARIC_AUDITOR_TYPE=cloud",
             "--env", "ANBARIC_SESSION_RESOLVER_TYPE=cloud",
+            "--env", "ANBARIC_NOTIFIER_TYPE=cloud",
             "--env", `ANBARIC_CONSUMER_PORT=${deployment.consumerPort}`,
             "--env", `ANBARIC_CONSUMER_URL=http://${container}:${deployment.consumerPort}`,
             ...sqlEnv,

package/src/app-management/FargateBuildLayer.ts

@@ -7,7 +7,7 @@ import {ECSClient, CreateServiceCommand, DeleteServiceCommand, DescribeServicesC
 import {S3Client, PutObjectCommand} from "@aws-sdk/client-s3";
 import {ServiceDiscoveryClient, CreateServiceCommand as CreateDiscoveryServiceCommand,
     ListServicesCommand} from "@aws-sdk/client-servicediscovery";
-import {CloudWatchLogsClient, StartLiveTailCommand} from "@aws-sdk/client-cloudwatch-logs";
+import {CloudWatchLogsClient, FilterLogEventsCommand, StartLiveTailCommand} from "@aws-sdk/client-cloudwatch-logs";
 import {BaseBuildLayer, Deployment, Probe} from "./BaseBuildLayer";
 import {dockerfileFor} from "./DockerBuildLayer";
 
@@ -63,6 +63,19 @@ class FargateBuildLayer extends BaseBuildLayer {
         this.aws = aws ?? defaultClients(options.awsRegion);
     }
 
+    protected async diagnostics(deployment : Deployment) : Promise<Array<string>> {
+        const response = await this.aws.cloudWatchLogs.send(new FilterLogEventsCommand({
+            logGroupName: this.options.appsLogGroup,
+            logStreamNamePrefix: deployment.appName,
+            startTime: Date.now() - 10 * 60_000,
+            limit: 40,
+        }));
+        return (response.events ?? [])
+            .map((event : any) => (event.message ?? "").trimEnd())
+            .filter((line : string) => line.length > 0)
+            .slice(-30);
+    }
+
     protected appHostFor(appName : string) : string {
         return `${appName}.${this.options.namespaceName}`;
     }
@@ -179,6 +192,7 @@ class FargateBuildLayer extends BaseBuildLayer {
                     { name: "ANBARIC_SECRET_STORE_TYPE", value: "cloud" },
                     { name: "ANBARIC_AUDITOR_TYPE", value: "cloud" },
                     { name: "ANBARIC_SESSION_RESOLVER_TYPE", value: "cloud" },
+                    { name: "ANBARIC_NOTIFIER_TYPE", value: "cloud" },
                     { name: "ANBARIC_CONSUMER_PORT", value: String(deployment.consumerPort) },
                     { name: "ANBARIC_CONSUMER_URL", value: `http://${deployment.appHost}:${deployment.consumerPort}` },
                     ...(this.options.servicesUrl ? [{ name: "ANBARIC_SERVICES_URL", value: this.options.servicesUrl }] : []),

package/src/hosting/HostingServer.ts

@@ -1,4 +1,4 @@
-import {JobPersistence, JobRunSchedulePersistence, JsonStore, SecretStore} from "anbaric-tsapi";
+import {JobPersistence, JobRunSchedulePersistence, JsonStore, Notifier, SecretStore} from "anbaric-tsapi";
 import {BuildLayer} from "../app-management/BuildLayer";
 import {AuditRecordStore} from "../auditing/AuditRecordStore";
 import {Authenticator} from "../auth/Authenticator";
@@ -19,6 +19,7 @@ import {DocumentsHandler} from "./handlers/DocumentsHandler";
 import {JobsHandler} from "./handlers/JobsHandler";
 import {FaviconHandler} from "./handlers/FaviconHandler";
 import {JobRunSchedulesHandler} from "./handlers/JobRunSchedulesHandler";
+import {NotificationsHandler} from "./handlers/NotificationsHandler";
 import {LogoutHandler} from "./handlers/LogoutHandler";
 import {PagesHandler} from "./handlers/PagesHandler";
 import {PingHandler} from "./handlers/PingHandler";
@@ -56,7 +57,8 @@ class HostingServer {
                 tenant? : string,
                 auditRecords? : AuditRecordStore,
                 plugins : Array<LoadedPlugin> = [],
-                jobRunSchedules? : JobRunSchedulePersistence) {
+                jobRunSchedules? : JobRunSchedulePersistence,
+                notifier? : Notifier) {
         const pages = new PagesHandler();
         const ping = new PingHandler(tenant);
         const jobs = new JobsHandler(persistence);
@@ -84,6 +86,7 @@ class HostingServer {
         if (secrets) publicRouter.registerApi("secrets", secrets);
         if (audits) publicRouter.registerApi("audits", audits);
         if (jobRunSchedules) publicRouter.registerApi("job-run-schedules", new JobRunSchedulesHandler(jobRunSchedules));
+        if (notifier) publicRouter.registerApi("notifications", new NotificationsHandler(notifier));
         if (cliAuthorizer) {
             publicRouter.register("authorize-cli", new AuthorizeCliHandler(cliAuthorizer, pages, tenant));
             publicRouter.registerApi("keys", new KeysHandler(cliAuthorizer));
@@ -107,6 +110,7 @@ class HostingServer {
         if (secrets) internalRouter.registerApi("secrets", secrets);
         if (audits) internalRouter.registerApi("audits", audits);
         if (jobRunSchedules) internalRouter.registerApi("job-run-schedules", new JobRunSchedulesHandler(jobRunSchedules));
+        if (notifier) internalRouter.registerApi("notifications", new NotificationsHandler(notifier));
 
         // The favicon is requested by the browser before anyone has signed in,
         // and by deployed apps' pages, so gating it behind a session would send

package/src/hosting/handlers/NotificationsHandler.ts

@@ -0,0 +1,26 @@
+import {Notifier, deserializeJob, deserializeWaitForInput} from "anbaric-tsapi";
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+/* Receives a deployed app's notification request and hands it to the platform's
+   server-side notifier. Delivery is the notifier's business - the platform just
+   reconstructs the job and its wait from the wire and passes them on. */
+class NotificationsHandler implements RequestHandler {
+
+    constructor(private notifier : Notifier) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method !== "POST" || request.id) return request.notFound();
+
+        const { targets, job, waitingFor } = await request.body();
+        if (!Array.isArray(targets) || !job || !waitingFor) {
+            return request.reply(400, { error: "Expected { targets, job, waitingFor }" });
+        }
+
+        await this.notifier.notify(targets, deserializeJob(job), deserializeWaitForInput(waitingFor));
+        request.reply(204);
+    }
+
+}
+
+export { NotificationsHandler }

package/src/index.ts

@@ -9,6 +9,7 @@ export * from "./auth/CliKeyStore";
 export * from "./auth/HttpCliKeyStore";
 export * from "./auth/InMemoryCliKeyStore";
 export * from "./auth/AuthenticatorLoader";
+export * from "./notifications/NotifierLoader";
 export * from "./auth/KeyPair";
 export * from "./auth/Role";
 export * from "./auth/SessionSigner";
@@ -49,6 +50,7 @@ export * from "./plugins/PluginLoader";
 export * from "./plugins/PageDirectory";
 export * from "./hosting/handlers/QueueHandler";
 export * from "./hosting/handlers/JobRunSchedulesHandler";
+export * from "./hosting/handlers/NotificationsHandler";
 export * from "./hosting/handlers/SecretsHandler";
 export * from "./hosting/handlers/StateMachinesHandler";
 export * from "./hosting/handlers/auth/AuthorizeCliHandler";

package/src/main.ts

@@ -3,6 +3,7 @@ import {SecretStore} from "anbaric-tsapi";
 import {InMemorySecretStore} from "anbaric-data-store";
 import {Pool} from "pg";
 import {loadAuthenticator} from "./auth/AuthenticatorLoader";
+import {loadNotifier} from "./notifications/NotifierLoader";
 import {CliAuthorizer} from "./auth/CliAuthorizer";
 import {HttpCliKeyStore} from "./auth/HttpCliKeyStore";
 import {TokenAuthenticator} from "./auth/TokenAuthenticator";
@@ -84,7 +85,7 @@ const plugins = await new PluginLoader().load(process.env.ANBARIC_PLUGINS ?? "an
 const server = new HostingServer(new PostgresJobPersistence(pool), queue, registry, buildLayer,
     (appId, collection) => new PostgresJsonStore(pool, appId, collection), secretStoreFor, authenticator, cliAuthorizer,
     tokenAuthenticator, process.env.ANBARIC_TENANT, new PostgresAuditRecordStore(pool), plugins,
-    new PostgresJobRunSchedulePersistence(pool));
+    new PostgresJobRunSchedulePersistence(pool), await loadNotifier(process.env.ANBARIC_NOTIFIER_MODULE));
 const port = await server.listen(hostingPort);
 const internal = await server.listenInternal(internalPort);
 

package/src/notifications/NotifierLoader.ts

@@ -0,0 +1,18 @@
+import {Notifier} from "anbaric-tsapi";
+
+/* Loads the server-side notifier by module name, the same way the authenticator
+   is loaded (see AuthenticatorLoader). The platform is open source and cannot
+   name a proprietary delivery mechanism, so a host names its module through
+   ANBARIC_NOTIFIER_MODULE and that module exports a createNotifier factory.
+   With nothing named, the platform accepts notifications but delivers nothing. */
+const loadNotifier = async (moduleName? : string) : Promise<Notifier | undefined> => {
+    if (!moduleName) return undefined;
+
+    const module = await import(moduleName);
+    if (typeof module.createNotifier !== "function") {
+        throw new Error(`Notifier module "${moduleName}" does not export a createNotifier function`);
+    }
+    return module.createNotifier();
+};
+
+export { loadNotifier }