anbaric-cloud-hosting 1.65.3 → 1.66.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.65.3",
+  "version": "1.66.1",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.65.3",
-    "anbaric-plugins": "^1.65.3",
-    "anbaric-tsapi": "^1.65.3",
-    "anbaric-web": "^1.65.3",
+    "anbaric-data-store": "^1.66.1",
+    "anbaric-plugins": "^1.66.1",
+    "anbaric-tsapi": "^1.66.1",
+    "anbaric-web": "^1.66.1",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.65.3",
-    "anbaric-state-machine": "^1.65.3",
+    "anbaric-impl-cloud": "^1.66.1",
+    "anbaric-state-machine": "^1.66.1",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/app-management/BaseBuildLayer.ts

@@ -3,13 +3,14 @@ import {mkdir, readFile, rm, symlink, writeFile} from "node:fs/promises";
 import {join} from "node:path";
 import {adminPing} from "../app-admin/adminPing";
 import {DocGenerator} from "../docs/DocGenerator";
-import {BuildLayer, DeploymentStatus, DeploymentSummary} from "./BuildLayer";
+import {AppSize, BuildLayer, DeploymentStatus, DeploymentSummary} from "./BuildLayer";
 
 type Deployment = {
     appName : string,
     status : DeploymentStatus,
     appPort : number,
     appHost : string,
+    size : AppSize,
     adminPort : number,
     consumerPort : number,
     log : Array<string>,
@@ -70,6 +71,8 @@ abstract class BaseBuildLayer implements BuildLayer {
             status: "building",
             appPort,
             appHost: this.appHostFor(appName),
+            // A redeploy keeps the size the app was given; only the console changes it.
+            size: existing?.size ?? "small",
             adminPort: APP_ADMIN_PORT,
             consumerPort: existing?.consumerPort ?? this.consumerPortBase + this.nextAppIndex++,
             log: [],
@@ -106,6 +109,23 @@ abstract class BaseBuildLayer implements BuildLayer {
         yield* this.streamLogs(deployment, signal);
     }
 
+    async resize(appName : string, size : AppSize) : Promise<DeploymentSummary | undefined> {
+        const deployment = this.deployments.get(appName);
+        if (!deployment) return undefined;
+        if (deployment.size === size) return this.summarize(deployment);
+
+        const before = deployment.size;
+        deployment.size = size;
+        this.log(deployment, `resizing to ${size}`);
+        try {
+            await this.applySize(deployment);
+        } catch (error) {
+            deployment.size = before;
+            throw error;
+        }
+        return this.summarize(deployment);
+    }
+
     async teardown(appName : string) : Promise<DeploymentSummary | undefined> {
         const deployment = this.deployments.get(appName);
         if (!deployment) return undefined;
@@ -200,6 +220,8 @@ abstract class BaseBuildLayer implements BuildLayer {
     protected abstract appHostFor(appName : string) : string;
     protected abstract start(deployment : Deployment, appDir : string, entryPoint : string) : Promise<void>;
     protected abstract stop(deployment : Deployment) : Promise<void>;
+    // Puts the running app onto the instance its (already changed) size names.
+    protected abstract applySize(deployment : Deployment) : Promise<void>;
     protected abstract streamLogs(deployment : Deployment, signal : AbortSignal) : AsyncIterable<string>;
     // Materialises the app's source into a directory for regeneration; the
     // returned cleanup removes anything temporary the implementation created.
@@ -319,6 +341,7 @@ abstract class BaseBuildLayer implements BuildLayer {
             status: deployment.status,
             appPort: deployment.appPort,
             appHost: deployment.appHost,
+            size: deployment.size,
             ...(deployment.draining
                 ? { draining: { inFlight: deployment.draining.inFlight, since: new Date(deployment.draining.since).toISOString() } }
                 : {}),

package/src/app-management/BuildLayer.ts

@@ -8,16 +8,32 @@ type Draining = {
     since : string,
 };
 
+/* How big an app's instance is. Small is what every app starts as; large is
+   faster compute and four times the memory, and costs more. The sizes are
+   named rather than numbered so the platform can change what they mean. */
+type AppSize = "small" | "large";
+
+const APP_SIZES : Array<AppSize> = ["small", "large"];
+
+const isAppSize = (value : unknown) : value is AppSize =>
+    typeof value === "string" && APP_SIZES.includes(value as AppSize);
+
 type DeploymentSummary = {
     appName : string,
     status : DeploymentStatus,
     appPort : number,
     appHost : string,
+    size : AppSize,
     draining? : Draining,
 };
 
 interface BuildLayer {
 
+    /* Moves a running app onto a different size of instance. The app is rolled
+       as a deploy would roll it, so nothing in hand is lost. Returns undefined
+       for an unknown app. */
+    resize(appName : string, size : AppSize) : Promise<DeploymentSummary | undefined>;
+
     ensureHydrated() : Promise<void>;
     deploy(appName : string, appPort : number, tarball : Buffer) : DeploymentSummary;
     status(appName : string) : (DeploymentSummary & { log : Array<string> }) | undefined;
@@ -45,4 +61,5 @@ interface BuildLayer {
 
 }
 
-export type { BuildLayer, DeploymentStatus, DeploymentSummary, Draining };
+export type { BuildLayer, DeploymentStatus, DeploymentSummary, Draining, AppSize };
+export { APP_SIZES, isAppSize };

package/src/app-management/DockerBuildLayer.ts

@@ -123,6 +123,10 @@ class DockerBuildLayer extends BaseBuildLayer {
         await this.removeContainer(deployment, this.appHostFor(deployment.appName));
     }
 
+    // A local container has whatever the machine has; the size is remembered
+    // so a later deploy to the cloud starts at it, and otherwise means nothing.
+    protected async applySize(_deployment : Deployment) : Promise<void> {}
+
     // Locally the extracted source from the last deploy is still on disk, so
     // regeneration reads it in place with nothing to clean up.
     protected async sourceDir(appName : string) : Promise<{ dir : string, cleanup : () => Promise<void> }> {

package/src/app-management/FargateBuildLayer.ts

@@ -11,6 +11,7 @@ import {ServiceDiscoveryClient, CreateServiceCommand as CreateDiscoveryServiceCo
     ListServicesCommand} from "@aws-sdk/client-servicediscovery";
 import {CloudWatchLogsClient, FilterLogEventsCommand, StartLiveTailCommand} from "@aws-sdk/client-cloudwatch-logs";
 import {BaseBuildLayer, Deployment, Probe} from "./BaseBuildLayer";
+import {AppSize} from "./BuildLayer";
 import {DocGenerator} from "../docs/DocGenerator";
 import {dockerfileFor} from "./DockerBuildLayer";
 
@@ -55,6 +56,15 @@ const defaultClients = (region : string) : AwsClients => ({
 const BUILD_TIMEOUT_MS = 900_000;
 const FARGATE_LIVENESS_TIMEOUT_MS = 420_000;
 
+/* What each size is on Fargate, in the units ECS wants. The memory is what
+   the console describes as "4× the RAM"; the CPU is not advertised, only felt. */
+const TASK_SIZES : Record<AppSize, { cpu : string, memory : string }> = {
+    small: { cpu: "256", memory: "512" },
+    large: { cpu: "512", memory: "2048" },
+};
+
+const sizeOfTask = (memory? : string) : AppSize => memory === TASK_SIZES.large.memory ? "large" : "small";
+
 class FargateBuildLayer extends BaseBuildLayer {
 
     private aws : AwsClients;
@@ -115,6 +125,16 @@ class FargateBuildLayer extends BaseBuildLayer {
         await this.upsertService(deployment, taskDefinition, registryArn);
     }
 
+    /* The image is the one already baked for this app; only the task's shape
+       changes. Registering a definition at the new size and rolling the
+       service onto it is exactly the tail of a deploy. */
+    protected async applySize(deployment : Deployment) : Promise<void> {
+        const imageUri = `${this.options.appsRepositoryUrl}:${deployment.appName}`;
+        const taskDefinition = await this.registerTaskDefinition(deployment, imageUri);
+        const registryArn = await this.discoveryServiceFor(deployment.appName);
+        await this.upsertService(deployment, taskDefinition, registryArn);
+    }
+
     protected async stop(deployment : Deployment) : Promise<void> {
         if (this.deployments.get(deployment.appName) !== deployment) return;
 
@@ -173,8 +193,7 @@ class FargateBuildLayer extends BaseBuildLayer {
             family: this.serviceNameFor(deployment.appName),
             requiresCompatibilities: ["FARGATE"],
             networkMode: "awsvpc",
-            cpu: "256",
-            memory: "512",
+            ...TASK_SIZES[deployment.size],
             executionRoleArn: this.options.appExecutionRoleArn,
             runtimePlatform: { operatingSystemFamily: "LINUX", cpuArchitecture: "X86_64" },
             containerDefinitions: [{
@@ -338,6 +357,7 @@ class FargateBuildLayer extends BaseBuildLayer {
             status: (service.runningCount ?? 0) > 0 ? "running" : "stopped",
             appPort,
             appHost: this.appHostFor(appName),
+            size: sizeOfTask(taskDefinition.memory),
             adminPort: port("ANBARIC_ADMIN_PORT", 8791),
             consumerPort: port("ANBARIC_CONSUMER_PORT", 0),
             log: [],

package/src/app-management/redactEmails.ts

@@ -0,0 +1,11 @@
+const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}/g;
+
+/* An app's logs are read by its builders, who are not owed the addresses of
+   the people using it. Each address keeps the first two letters of its local
+   part, enough to tell one person's line from another's, and loses the rest
+   to a fixed shape: the same number of asterisks whatever the address, so the
+   redaction gives away neither its length nor its domain. */
+const redactEmails = (line : string) : string =>
+    line.replace(EMAIL, address => `${address.split("@")[0].slice(0, 2).toLowerCase()}****@****.**`);
+
+export { redactEmails };

package/src/billing/CentralBilling.ts

@@ -19,8 +19,15 @@ class CentralBilling {
         return String((await response.json() as { url : string }).url);
     }
 
-    private async call(method : string, path : string, body? : unknown) : Promise<Response> {
-        const headers : Record<string, string> = { "x-anbaric-central-key": this.secret };
+    /* Ends the tenant, on the say-so of the person named, whom central checks
+       is its owner. Nothing here is undone afterwards; this platform is among
+       the things going. */
+    async terminate(userId : string) : Promise<void> {
+        await this.call("DELETE", `/tenants/${encodeURIComponent(this.tenantSlug)}`, undefined, { "x-anbaric-user": userId });
+    }
+
+    private async call(method : string, path : string, body? : unknown, extra : Record<string, string> = {}) : Promise<Response> {
+        const headers : Record<string, string> = { "x-anbaric-central-key": this.secret, ...extra };
         if (body !== undefined) headers["content-type"] = "application/json";
 
         const response = await this.fetchFn(`${this.centralUrl.replace(/\/$/, "")}${path}`,

package/src/hosting/handlers/AppsHandler.ts

@@ -1,8 +1,9 @@
-import {BuildLayer} from "../../app-management/BuildLayer";
+import {BuildLayer, isAppSize} from "../../app-management/BuildLayer";
 import {deniesBuild} from "../../auth/TenantRole";
 import {Request} from "../Request";
 import {hostnameObjection} from "../../app-management/appHostname";
 import {appAddress} from "../../app-management/appAddress";
+import {redactEmails} from "../../app-management/redactEmails";
 import {RequestHandler} from "../RequestHandler";
 import {Subdomains} from "../../subdomains/Subdomains";
 
@@ -31,6 +32,9 @@ class AppsHandler implements RequestHandler {
             case "subdomain":
                 if (request.id) return this.handleSubdomain(request, request.id);
                 break;
+            case "size":
+                if (request.id) return this.handleSize(request, request.id);
+                break;
             case undefined:
                 if (request.id) return this.handleApp(request, request.id);
                 return this.handleCollection(request);
@@ -40,10 +44,24 @@ class AppsHandler implements RequestHandler {
 
     private changesApps(request : Request) : boolean {
         if (request.subresource === "deploy" || request.subresource === "docs") return true;
-        if (request.subresource === "subdomain") return request.method === "PUT";
+        if (request.subresource === "subdomain" || request.subresource === "size") return request.method === "PUT";
         return request.subresource === undefined && request.method === "DELETE";
     }
 
+    /* How big the app's instance is, which is a builder's to change and costs
+       what the console told them it would. The app is rolled onto the new
+       size; what it is doing is drained first, as any deploy does. */
+    private async handleSize(request : Request, appName : string) : Promise<void> {
+        if (request.method !== "PUT") return request.notFound();
+
+        const body = await request.body() as { size? : string } | undefined;
+        if (! isAppSize(body?.size)) return request.reply(400, { error: 'Expected a body of { size : "small" | "large" }' });
+
+        const summary = await this.buildLayer.resize(appName, body.size);
+        if (! summary) return request.reply(404, { error: `No app named "${appName}"` });
+        return request.reply(200, summary);
+    }
+
     /* Where an app answers, which is a builder's to change. The address itself
        is the control plane's to agree, so a name already taken comes back from
        there as a refusal and is passed on as one. */
@@ -155,7 +173,7 @@ class AppsHandler implements RequestHandler {
         try {
             for await (const line of this.buildLayer.logs(appName, controller.signal)) {
                 clearTimeout(heartbeat);
-                if (!response.write(`${line}\n`)) {
+                if (!response.write(`${redactEmails(line)}\n`)) {
                     await new Promise<void>(resolve => response.once("drain", resolve));
                 }
                 heartbeat = beat();

package/src/hosting/handlers/BillingHandler.ts

@@ -12,9 +12,29 @@ class BillingHandler implements RequestHandler {
     async handle(request : Request) : Promise<void> {
         if (request.method === "GET" && request.id === "summary") return this.summary(request);
         if (request.method === "POST" && request.id === "portal") return this.portal(request);
+        if (request.method === "DELETE" && request.id === "account") return this.terminate(request);
         request.notFound();
     }
 
+    /* The end of the tenant, which only its owner may ask for, and only by
+       typing the word: the page asks for it, and this refuses without it, so
+       nothing in a script or a stray click can do it by accident. */
+    private async terminate(request : Request) : Promise<void> {
+        if (request.user?.tenantRole !== "OWNER") {
+            return request.reply(403, { error: "Only the owner of this tenant can terminate it" });
+        }
+
+        const body = await request.body() as { confirm? : string } | undefined;
+        if (body?.confirm !== "DELETE") return request.reply(400, { error: 'Terminating a tenant needs { confirm : "DELETE" }' });
+
+        try {
+            await this.billing.terminate(request.user.id);
+            request.reply(202, { terminated: true });
+        } catch (error) {
+            request.reply(409, { error: error instanceof Error ? error.message : "Could not terminate this tenant" });
+        }
+    }
+
     private async summary(request : Request) : Promise<void> {
         if (deniesBuild(request.user?.tenantRole)) {
             return request.reply(403, { error: "Your role in this tenant cannot see its costs" });