cyberia 3.1.3 → 3.2.9

package/src/api/user/user.model.js

@@ -3,7 +3,6 @@ import validator from 'validator';
 import { userRoleEnum } from '../../client/components/core/CommonJs.js';
 import crypto from 'crypto';
 // https://mongoosejs.com/docs/2.7.x/docs/schematypes.html
-
 const UserSchema = new Schema(
   {
     email: {
@@ -88,13 +87,10 @@ const UserSchema = new Schema(
     timestamps: true,
   },
 );
-
 const UserModel = model('User', UserSchema);
-
 const ProviderSchema = UserSchema;
-
-const UserDto = {
-  select: {
+class UserDto {
+  static select = {
     get: () => {
       return {
         _id: 1,
@@ -112,8 +108,8 @@ const UserDto = {
     getAll: () => {
       return { _id: 1 };
     },
-  },
-  public: {
+  };
+  static public = {
     get: () => {
       return {
         _id: 1,
@@ -125,8 +121,8 @@ const UserDto = {
         updatedAt: 1,
       };
     },
-  },
-  auth: {
+  };
+  static auth = {
     payload: (user, jwtid, ip, userAgent, host, path) => {
       const tokenPayload = {
         _id: user._id.toString(),
@@ -141,7 +137,6 @@ const UserDto = {
       };
       return tokenPayload;
     },
-  },
-};
-
+  };
+}
 export { UserSchema, UserModel, userRoleEnum, ProviderSchema, UserDto };

package/src/api/user/user.service.js

@@ -9,19 +9,17 @@ import {
   refreshSessionAndToken,
   logoutSession,
   jwtSign,
-  getBearerToken,
   validatePasswordMiddleware,
 } from '../../server/auth.js';
 import { MailerProvider } from '../../mailer/MailerProvider.js';
-import { CoreWsMailerManagement } from '../../ws/core/management/core.ws.mailer.js';
-import { CoreWsEmit } from '../../ws/core/core.ws.emit.js';
+import { CoreWsEmitter } from '../../ws/core/core.ws.emit.js';
 import { CoreWsMailerChannel } from '../../ws/core/channels/core.ws.mailer.js';
 import validator from 'validator';
 import { DataBaseProvider } from '../../db/DataBaseProvider.js';
 import { FileFactory, FileCleanup } from '../file/file.service.js';
 import { UserDto } from './user.model.js';
-import { selectDtoFactory, ValkeyAPI } from '../../server/valkey.js';
 import { timer } from '../../client/components/core/CommonJs.js';
+import { GuestService } from './guest.service.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -227,15 +225,7 @@ const UserService = {
         } else throw new Error('Invalid credentials');
 
       case 'guest': {
-        const user = await ValkeyAPI.valkeyObjectFactory(options, 'user');
-        await ValkeyAPI.setValkeyObject(options, user.email, user);
-        return {
-          token: jwtSign(
-            UserDto.auth.payload(user, null, req.ip, req.headers['user-agent'], options.host, options.path),
-            options,
-          ),
-          user: selectDtoFactory(user, UserDto.select.get()),
-        };
+        return await GuestService.create(req, options);
       }
 
       default:
@@ -319,11 +309,13 @@ const UserService = {
         {
           const user = await User.findByIdAndUpdate(_id, { emailConfirmed: true }, { runValidators: true });
         }
-        const userWsId = CoreWsMailerManagement.getUserWsId(`${options.host}${options.path}`, user._id.toString());
-        CoreWsEmit(CoreWsMailerChannel.channel, CoreWsMailerChannel.client[userWsId], {
-          status: 'email-confirmed',
-          id: userWsId,
-        });
+        const userWsId = CoreWsMailerChannel.getUserWsId(`${options.host}${options.path}`, user._id.toString());
+        if (userWsId && CoreWsMailerChannel.client[userWsId]) {
+          CoreWsEmitter.emit(CoreWsMailerChannel.channel, CoreWsMailerChannel.client[userWsId], {
+            status: 'email-confirmed',
+            id: userWsId,
+          });
+        }
         options.png.header(res, req);
         return options.png.buffer['check'];
       } else {
@@ -359,8 +351,7 @@ const UserService = {
       case 'auth': {
         let user;
         if (req.auth.user._id.match('guest')) {
-          user = await ValkeyAPI.getValkeyObject(options, req.auth.user.email);
-          if (!user) throw new Error('guest user expired');
+          return await GuestService.auth(req, options);
         } else
           user = await User.findOne({
             _id: req.auth.user._id,
@@ -368,13 +359,6 @@ const UserService = {
 
         if (!user) throw new Error('user not found');
 
-        const guestUser = await ValkeyAPI.getValkeyObject(options, req.auth.user.email);
-        if (guestUser)
-          return {
-            user: selectDtoFactory(guestUser, UserDto.select.get()),
-            token: getBearerToken(req),
-          };
-
         return {
           token: await refreshSessionAndToken(req, res, User, options),
           user: await User.findOne({

package/src/cli/cluster.js

@@ -111,7 +111,7 @@ class UnderpostCluster {
       const npmRoot = getNpmRootPath();
       const underpostRoot = options.dev ? '.' : `${npmRoot}/underpost`;
 
-      if (options.listPods) return console.table(Underpost.deploy.get(podName ?? undefined));
+      if (options.listPods) return console.table(Underpost.kubectl.get(podName ?? undefined));
       // Set default namespace if not specified
       if (!options.namespace) options.namespace = 'default';
 
@@ -146,10 +146,10 @@ class UnderpostCluster {
       }
 
       // Check if a cluster (Kind, Kubeadm, or K3s) is already initialized
-      const alreadyKubeadmCluster = Underpost.deploy.get('calico-kube-controllers')[0];
-      const alreadyKindCluster = Underpost.deploy.get('kube-apiserver-kind-control-plane')[0];
+      const alreadyKubeadmCluster = Underpost.kubectl.get('calico-kube-controllers')[0];
+      const alreadyKindCluster = Underpost.kubectl.get('kube-apiserver-kind-control-plane')[0];
       // K3s pods often contain 'svclb-traefik' in the kube-system namespace
-      const alreadyK3sCluster = Underpost.deploy.get('svclb-traefik')[0];
+      const alreadyK3sCluster = Underpost.kubectl.get('svclb-traefik')[0];
 
       // --- Kubeadm/Kind/K3s Cluster Initialization ---
       if (!alreadyKubeadmCluster && !alreadyKindCluster && !alreadyK3sCluster) {
@@ -172,9 +172,19 @@ class UnderpostCluster {
           const podNetworkCidr = options.podNetworkCidr || '192.168.0.0/16';
           const controlPlaneEndpoint = options.controlPlaneEndpoint || `${os.hostname()}:6443`;
 
-          // Initialize kubeadm control plane
+          // Initialize kubeadm control plane.
+          // Use CRI-O socket when available, otherwise fall back to containerd.
+          const crioSocket = 'unix:///var/run/crio/crio.sock';
+          const containerdSocket = 'unix:///run/containerd/containerd.sock';
+          const criSocket =
+            shellExec(`test -S /var/run/crio/crio.sock && echo crio || echo containerd`, {
+              stdout: true,
+              silent: true,
+            }).trim() === 'crio'
+              ? crioSocket
+              : containerdSocket;
           shellExec(
-            `sudo kubeadm init --pod-network-cidr=${podNetworkCidr} --control-plane-endpoint="${controlPlaneEndpoint}"`,
+            `sudo kubeadm init --pod-network-cidr=${podNetworkCidr} --control-plane-endpoint="${controlPlaneEndpoint}" --cri-socket=${criSocket}`,
           );
           // Configure kubectl for the current user
           Underpost.cluster.chown('kubeadm'); // Pass 'kubeadm' to chown
@@ -299,7 +309,7 @@ EOF
             members: [{ _id: 0, host: `${options.mongoDbHost}:27017` }],
           };
 
-          const [pod] = Underpost.deploy.get(deploymentName);
+          const [pod] = Underpost.kubectl.get(deploymentName);
 
           shellExec(
             `sudo kubectl exec -i ${pod.NAME} -- mongo --quiet \
@@ -351,7 +361,7 @@ EOF
       }
 
       if (options.certManager) {
-        if (!Underpost.deploy.get('cert-manager').find((p) => p.STATUS === 'Running')) {
+        if (!Underpost.kubectl.get('cert-manager').find((p) => p.STATUS === 'Running')) {
           shellExec(`helm repo add jetstack https://charts.jetstack.io --force-update`);
           shellExec(
             `helm install cert-manager jetstack/cert-manager \
@@ -389,8 +399,17 @@ EOF
         );
         shellExec(`rm -f ${tarPath}`);
       } else if (options.kubeadm || options.k3s) {
-        // Kubeadm / K3s: use crictl to pull directly into containerd
-        shellExec(`sudo crictl pull ${image}`);
+        // Kubeadm / K3s: use crictl to pull directly into the active CRI runtime.
+        // crictl is not in sudo's secure_path; pass full PATH through env.
+        // Point crictl at CRI-O when the socket exists, otherwise fall back to containerd.
+        const criSock =
+          shellExec(`test -S /var/run/crio/crio.sock && echo crio || echo containerd`, {
+            stdout: true,
+            silent: true,
+          }).trim() === 'crio'
+            ? 'unix:///var/run/crio/crio.sock'
+            : 'unix:///run/containerd/containerd.sock';
+        shellExec(`sudo env PATH="$PATH:/usr/local/bin:/usr/bin" crictl --runtime-endpoint ${criSock} pull ${image}`);
       }
     },
 
@@ -453,12 +472,11 @@ net.ipv4.ip_forward = 1' | sudo tee ${iptableConfPath}`,
       shellExec(`sudo sysctl -w fs.inotify.max_queued_events=2099999999`);
 
       // shellExec(`sudo sysctl --system`); // Apply sysctl changes immediately
-      // Apply NAT iptables rules.
+      // Apply NAT iptables rules and configure firewalld for Kubernetes.
+      // nat-iptables.sh enables firewalld and opens all required ports; do NOT stop it
+      // afterwards — keeping firewalld running with these rules is required for
+      // multi-machine kubeadm inter-node communication.
       shellExec(`${underpostRoot}/scripts/nat-iptables.sh`, { silent: true });
-
-      // Disable firewalld (common cause of network issues in Kubernetes)
-      shellExec(`sudo systemctl stop firewalld`); // Stop if running
-      shellExec(`sudo systemctl disable firewalld`); // Disable from starting on boot
     },
 
     /**
@@ -575,8 +593,10 @@ net.ipv4.ip_forward = 1' | sudo tee ${iptableConfPath}`,
         shellExec('sudo systemctl stop kubelet');
         shellExec('sudo systemctl stop docker');
         shellExec('sudo systemctl stop podman');
-        // Safely unmount pod filesystems to avoid errors.
-        shellExec('sudo umount -f /var/lib/kubelet/pods/*/*');
+        // Lazy-unmount all kubelet pod mounts to avoid 'Device or resource busy' on rm.
+        shellExec(
+          `sudo sh -c 'findmnt --raw --noheadings -o TARGET | grep /var/lib/kubelet | sort -r | xargs -r umount -l' 2>/dev/null || true`,
+        );
 
         // Phase 3: Execute official uninstallation commands (type-specific)
         const clusterType = options.clusterType || 'kind';
@@ -584,6 +604,14 @@ net.ipv4.ip_forward = 1' | sudo tee ${iptableConfPath}`,
           `Phase 3/7: Executing official reset/uninstallation commands for cluster type: '${clusterType}'...`,
         );
         if (clusterType === 'kubeadm') {
+          // Kill control plane processes that hold ports (6443, 10257, 10259, 2379, 2380)
+          // so the next `kubeadm init` does not fail with [ERROR Port-xxxx].
+          logger.info('  -> Stopping and killing control plane containers and processes...');
+          shellExec('sudo crictl rm -a -f 2>/dev/null || true');
+          shellExec('sudo crictl rmp -a -f 2>/dev/null || true');
+          shellExec('sudo systemctl stop etcd 2>/dev/null || true');
+          for (const port of [6443, 10259, 10257, 2379, 2380])
+            shellExec(`sudo fuser -k ${port}/tcp 2>/dev/null || true`);
           logger.info('  -> Executing kubeadm reset...');
           shellExec('sudo kubeadm reset --force');
         } else if (clusterType === 'k3s') {
@@ -600,7 +628,12 @@ net.ipv4.ip_forward = 1' | sudo tee ${iptableConfPath}`,
         // Remove any leftover configurations and data.
         shellExec('sudo rm -rf /etc/kubernetes/*');
         shellExec('sudo rm -rf /etc/cni/net.d/*');
+        // Second-pass lazy umount before rm to clear any remaining busy mounts.
+        shellExec(
+          `sudo sh -c 'findmnt --raw --noheadings -o TARGET | grep /var/lib/kubelet | sort -r | xargs -r umount -l' 2>/dev/null || true`,
+        );
         shellExec('sudo rm -rf /var/lib/kubelet/*');
+        shellExec('sudo rm -rf /var/lib/etcd');
         shellExec('sudo rm -rf /var/lib/cni/*');
         shellExec('sudo rm -rf /var/lib/docker/*');
         shellExec('sudo rm -rf /var/lib/containerd/*');
@@ -613,11 +646,14 @@ net.ipv4.ip_forward = 1' | sudo tee ${iptableConfPath}`,
         // Remove iptables rules and CNI network interfaces.
         shellExec('sudo iptables -F');
         shellExec('sudo iptables -t nat -F');
-        shellExec('sudo ip link del cni0');
-        shellExec('sudo ip link del flannel.1');
+        shellExec('sudo ip link del cni0 2>/dev/null || true');
+        shellExec('sudo ip link del flannel.1 2>/dev/null || true');
+        shellExec('sudo ip link del vxlan.calico 2>/dev/null || true');
+        shellExec('sudo ip link del tunl0 2>/dev/null || true');
 
         logger.info('Phase 6/7: Clean up images');
-        shellExec(`podman rmi $(podman images -qa) --force`);
+        shellExec('sudo podman rmi --all --force 2>/dev/null || true');
+        shellExec('sudo crictl rmi --prune 2>/dev/null || true');
 
         // Phase 6: Reload daemon and finalize
         logger.info('Phase 7/7: Reloading the system daemon and finalizing...');
@@ -641,7 +677,7 @@ net.ipv4.ip_forward = 1' | sudo tee ${iptableConfPath}`,
       const resources = {};
       const nodeName = node
         ? node
-        : Underpost.deploy.get('kind-control-plane', 'node').length > 0
+        : Underpost.kubectl.get('kind-control-plane', 'node').length > 0
           ? 'kind-control-plane'
           : os.hostname();
       const info = shellExec(`kubectl describe node ${nodeName} | grep -E '(Allocatable:|Capacity:)' -A 6`, {
@@ -687,6 +723,9 @@ net.ipv4.ip_forward = 1' | sudo tee ${iptableConfPath}`,
       // Install Podman
       shellExec(`sudo dnf -y install podman`);
 
+      // Install CRI-O (required for kubeadm with CRI-O socket)
+      shellExec(`node bin run install-crio`);
+
       // Install Kind (Kubernetes in Docker)
       shellExec(`[ $(uname -m) = ${archData.name} ] && curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.29.0/kind-linux-${archData.alias}
 chmod +x ./kind
@@ -744,6 +783,14 @@ EOF`);
       console.log('Removing Podman...');
       shellExec(`sudo dnf -y remove podman`);
 
+      // Remove CRI-O
+      console.log('Removing CRI-O...');
+      shellExec(`sudo systemctl stop crio 2>/dev/null || true`);
+      shellExec(`sudo systemctl disable crio 2>/dev/null || true`);
+      shellExec(`sudo dnf -y remove cri-o`);
+      shellExec(`sudo rm -f /etc/yum.repos.d/cri-o.repo`);
+      shellExec(`sudo rm -f /etc/crictl.yaml`);
+
       // Remove Kubeadm, Kubelet, and Kubectl
       console.log('Removing Kubernetes tools...');
       shellExec(`sudo yum remove -y kubelet kubeadm kubectl`);