cyberia 3.1.3 → 3.2.9

package/src/server/auth.js

@@ -9,7 +9,12 @@ import { loggerFactory } from './logger.js';
 import crypto from 'crypto';
 import { promisify } from 'util';
 import { UserDto } from '../api/user/user.model.js';
-import { commonAdminGuard, commonModeratorGuard, validatePassword } from '../client/components/core/CommonJs.js';
+import {
+  commonAdminGuard,
+  commonModeratorGuard,
+  commonUserGuard,
+  validatePassword,
+} from '../client/components/core/CommonJs.js';
 import helmet from 'helmet';
 import rateLimit from 'express-rate-limit';
 import slowDown from 'express-slow-down';
@@ -303,6 +308,23 @@ const moderatorGuard = (req, res, next) => {
     return res.status(400).json({ status: 'error', message: 'bad request' });
   }
 };
+/**
+ * Express middleware to guard routes for authenticated users (any non-guest role).
+ * @param {import('express').Request} req The Express request object.
+ * @param {import('express').Response} res The Express response object.
+ * @param {import('express').NextFunction} next The next middleware function.
+ * @memberof Auth
+ */
+const userGuard = (req, res, next) => {
+  try {
+    if (!req.auth || !commonUserGuard(req.auth.user.role))
+      return res.status(403).json({ status: 'error', message: 'Insufficient permission' });
+    return next();
+  } catch (err) {
+    logger.error(err);
+    return res.status(400).json({ status: 'error', message: 'bad request' });
+  }
+};
 
 // ---------- Password validation middleware (server-side) ----------
 /**
@@ -678,6 +700,7 @@ export {
   jwtVerify as verifyJWT,
   adminGuard,
   moderatorGuard,
+  userGuard,
   validatePasswordMiddleware,
   getBearerToken,
   createSessionAndUserToken,

package/src/server/backup.js

@@ -6,7 +6,6 @@
 
 import fs from 'fs-extra';
 import { loggerFactory } from './logger.js';
-import { shellExec } from './process.js';
 import Underpost from '../index.js';
 import { loadCronDeployEnv } from './conf.js';
 
@@ -21,16 +20,24 @@ class BackUp {
   /**
    * @method callback
    * @description Initiates a backup operation for the specified deployment list.
-   * @param {string} deployList - The list of deployments to backup.
+   * Orchestrates two backup phases per deployment:
+   *   1. Database export (MariaDB / MongoDB dump via `node bin db --export`).
+   *   2. Repository backup (git commit+push inside the deployment pod via `node bin db --repo-backup`).
+   *
+   * Commands are always forwarded to the host node via SSH because the CronJob
+   * container itself has no kubectl access. GITHUB_TOKEN and GITHUB_USERNAME
+   * are passed as ephemeral inline env vars so they never touch the host filesystem.
+   *
+   * @param {string} deployList - Comma-separated list of deployment IDs.
    * @param {Object} options - The options for the backup operation.
    * @param {boolean} options.git - Whether to backup data using Git.
    * @param {boolean} [options.k3s] - Use k3s cluster context.
    * @param {boolean} [options.kind] - Use kind cluster context.
    * @param {boolean} [options.kubeadm] - Use kubeadm cluster context.
-   * @param {boolean} [options.ssh] - Execute backup commands via SSH on the remote node.
    * @memberof UnderpostBakcUp
    */
   static callback = async function (deployList, options = { git: false }) {
+    const firstDeployId = deployList && deployList !== 'dd' ? deployList.split(',')[0].trim() : '';
     loadCronDeployEnv();
     if ((!deployList || deployList === 'dd') && fs.existsSync(`./engine-private/deploy/dd.router`))
       deployList = fs.readFileSync(`./engine-private/deploy/dd.router`, 'utf8').trim();
@@ -43,19 +50,40 @@ class BackUp {
     for (const _deployId of deployList.split(',')) {
       const deployId = _deployId.trim();
       if (!deployId) continue;
+      const dbCommand = `node bin db ${options.git ? '--git --force-clone ' : ''}--export --primary-pod --preserveUUID${clusterFlag} ${deployId}`;
+      const repoCommand = `node bin db --repo-backup${clusterFlag} ${deployId}`;
 
-      const command = `node bin db ${options.git ? '--git --force-clone ' : ''}--export --primary-pod${clusterFlag} ${deployId}`;
+      // Pass GITHUB_TOKEN and GITHUB_USERNAME ephemerally through the SSH command
+      // so git operations can push backups without relying on host env files.
+      const envPrefix = [
+        process.env.GITHUB_TOKEN ? `GITHUB_TOKEN=${process.env.GITHUB_TOKEN}` : '',
+        process.env.GITHUB_USERNAME ? `GITHUB_USERNAME=${process.env.GITHUB_USERNAME}` : '',
+      ]
+        .filter(Boolean)
+        .join(' ');
+      const prefixCmd = (cmd) => (envPrefix ? `${envPrefix} ${cmd}` : cmd);
 
-      if (options.ssh) {
+      try {
         logger.info('Executing database export via SSH for', deployId);
-        await Underpost.ssh.sshRemoteRunner(command, {
+        await Underpost.ssh.sshRemoteRunner(prefixCmd(dbCommand), {
           remote: true,
           useSudo: true,
           cd: '/home/dd/engine',
         });
-      } else {
-        logger.info('Executing database export for', deployId);
-        shellExec(command);
+      } catch (err) {
+        logger.error(`Error during database export for ${deployId}:`, err);
+      }
+
+      // Repository backup: Cron container → SSH to host → host finds pod → kubectl exec git backup
+      try {
+        logger.info('Executing repository backup via SSH for', deployId);
+        await Underpost.ssh.sshRemoteRunner(prefixCmd(repoCommand), {
+          remote: true,
+          useSudo: true,
+          cd: '/home/dd/engine',
+        });
+      } catch (err) {
+        logger.error(`Error during repository backup for ${deployId}:`, err);
       }
     }
   };

package/src/server/client-build-docs.js

@@ -324,59 +324,56 @@ const buildApiDocs = async ({
 };
 
 /**
- * Builds JSDoc documentation
+ * Builds API documentation using TypeDoc (generates a modern static site from JSDoc-annotated JS).
+ * Config is read from the base typedoc JSON, merged with runtime values, written to a temporary
+ * file, and deleted after the build — the base config file is never mutated on disk.
  * @function buildJsDocs
  * @memberof clientBuildDocs
- * @param {Object} options - JSDoc build options
+ * @param {Object} options - TypeDoc build options
  * @param {string} options.host - The hostname for the documentation
  * @param {string} options.path - The base path for the documentation
  * @param {Object} options.metadata - Metadata for the documentation
- * @param {string} options.publicClientId - Client ID used to resolve the tutorials/references directory
+ * @param {string} options.publicClientId - Client ID used to resolve the references directory
  * @param {Object} options.docs - Documentation config from server conf
- * @param {string} options.docs.jsJsonPath - Path to the JSDoc JSON config file
+ * @param {string} options.docs.jsJsonPath - Path to the base typedoc JSON config file
+ * @param {string} options.docsDestination - Resolved output path for the generated docs
  */
-const buildJsDocs = async ({ host, path, metadata = {}, publicClientId, docs }) => {
+const buildJsDocs = async ({ host, path, metadata = {}, publicClientId, docs, docsDestination }) => {
   const logger = loggerFactory(import.meta);
 
-  const jsDocSourcePath = docs.jsJsonPath;
-  if (!fs.existsSync(jsDocSourcePath)) {
-    logger.warn('jsdoc config not found, skipping', jsDocSourcePath);
+  const typedocConfigPath = docs.jsJsonPath;
+  if (!fs.existsSync(typedocConfigPath)) {
+    logger.warn('typedoc config not found, skipping', typedocConfigPath);
     return;
   }
-  const jsDocsConfig = JSON.parse(fs.readFileSync(jsDocSourcePath, 'utf8'));
-  logger.info('using jsdoc config', jsDocSourcePath);
+  const baseConfig = JSON.parse(fs.readFileSync(typedocConfigPath, 'utf8'));
+  logger.info('using typedoc config', typedocConfigPath);
 
-  jsDocsConfig.opts.destination = `./public/${host}${path === '/' ? path : `${path}/`}docs/`;
-  jsDocsConfig.opts.theme_opts.title = metadata?.title ? metadata.title : undefined;
-  jsDocsConfig.opts.theme_opts.favicon = `./public/${host}${path === '/' ? '/' : `${path}/`}favicon.ico`;
-
-  const tutorialsPath = `./src/client/public/${publicClientId}/docs/references`;
+  // Build runtime config in memory — never mutate the base config file
+  // tsconfig must be absolute so TypeDoc resolves it regardless of where the
+  // tmp config file is located on disk.
+  const runtimeConfig = {
+    ...baseConfig,
+    tsconfig: fs.realpathSync(baseConfig.tsconfig || './tsconfig.docs.json'),
+    out: docsDestination,
+    name: metadata?.title || baseConfig.name,
+    favicon: `./public/${host}${path === '/' ? '/' : `${path}/`}favicon.ico`,
+  };
 
+  // Include extra reference documents as TypeDoc document pages
+  // TypeDoc 0.28+: option is `projectDocuments`, not `documents`
   if (Array.isArray(docs.references) && docs.references.length > 0) {
-    fs.mkdirSync(tutorialsPath, { recursive: true });
-    for (const refPath of docs.references) {
-      if (fs.existsSync(refPath)) {
-        const fileName = refPath.split('/').pop();
-        fs.copySync(refPath, `${tutorialsPath}/${fileName}`);
-        logger.info('copied reference to tutorials', refPath);
-      }
-    }
+    runtimeConfig.projectDocuments = docs.references.filter((p) => fs.existsSync(p));
+    if (runtimeConfig.projectDocuments.length > 0) logger.info('typedoc documents', runtimeConfig.projectDocuments);
   }
 
-  if (fs.existsSync(tutorialsPath) && fs.readdirSync(tutorialsPath).length > 0) {
-    jsDocsConfig.opts.tutorials = tutorialsPath;
-    if (jsDocsConfig.opts.theme_opts.sections && !jsDocsConfig.opts.theme_opts.sections.includes('Tutorials')) {
-      jsDocsConfig.opts.theme_opts.sections.push('Tutorials');
-    }
-    logger.info('build jsdoc tutorials', tutorialsPath);
-  } else {
-    delete jsDocsConfig.opts.tutorials;
-  }
+  const tmpConfigPath = `.typedoc.tmp.json`;
+  fs.writeFileSync(tmpConfigPath, JSON.stringify(runtimeConfig, null, 2), 'utf8');
+  logger.warn('build typedoc view', docsDestination);
 
-  fs.writeFileSync(jsDocSourcePath, JSON.stringify(jsDocsConfig, null, 4), 'utf8');
-  logger.warn('build jsdoc view', jsDocsConfig.opts.destination);
+  shellExec(`node_modules/.bin/typedoc --options ${tmpConfigPath}`, { silent: true });
 
-  shellExec(`npx jsdoc -c ${jsDocSourcePath}`, { silent: true });
+  fs.removeSync(tmpConfigPath);
 };
 
 /**
@@ -384,16 +381,13 @@ const buildJsDocs = async ({ host, path, metadata = {}, publicClientId, docs })
  * @function buildCoverage
  * @memberof clientBuildDocs
  * @param {Object} options - Coverage build options
- * @param {string} options.host - The hostname for the coverage
- * @param {string} options.path - The base path for the coverage
  * @param {Object} options.docs - Documentation config from server conf
- * @param {string} options.docs.coveragePath - Directory where to run npm run coverage
+ * @param {string} options.docs.coveragePath - Directory where coverage reports are generated
+ * @param {string} options.docsDestination - Resolved output path where docs were built
  */
-const buildCoverage = async ({ host, path, docs }) => {
+const buildCoverage = async ({ docs, docsDestination }) => {
   const logger = loggerFactory(import.meta);
-  const jsDocSourcePath = docs.jsJsonPath;
-  const jsDocsConfig = JSON.parse(fs.readFileSync(jsDocSourcePath, 'utf8'));
-  const coveragePath = docs.coveragePath;
+  const { coveragePath, coverageOutputDir = 'coverage' } = docs;
 
   const coverageOutputPath = `${coveragePath}/coverage`;
   if (!fs.existsSync(coverageOutputPath)) {
@@ -411,9 +405,15 @@ const buildCoverage = async ({ host, path, docs }) => {
   }
 
   if (fs.existsSync(coverageOutputPath) && fs.readdirSync(coverageOutputPath).length > 0) {
-    const coverageBuildPath = `${jsDocsConfig.opts.destination}coverage`;
+    const coverageBuildPath = `${docsDestination}${coverageOutputDir}`;
     fs.mkdirSync(coverageBuildPath, { recursive: true });
-    fs.copySync(coverageOutputPath, coverageBuildPath);
+    // Hardhat 3 outputs HTML to coverage/html/; Hardhat 2 / c8 output directly to coverage/
+    const coverageHtmlSubdir = `${coverageOutputPath}/html`;
+    if (fs.existsSync(coverageHtmlSubdir) && fs.existsSync(`${coverageHtmlSubdir}/index.html`)) {
+      fs.copySync(coverageHtmlSubdir, coverageBuildPath);
+    } else {
+      fs.copySync(coverageOutputPath, coverageBuildPath);
+    }
     logger.warn('build coverage', coverageBuildPath);
   } else {
     logger.warn('no coverage output found, skipping', coverageOutputPath);
@@ -446,8 +446,14 @@ const buildDocs = async ({
   packageData,
   docs,
 }) => {
-  await buildJsDocs({ host, path, metadata, publicClientId, docs });
-  await buildCoverage({ host, path, docs });
+  const pathPrefix = path === '/' ? '/' : `${path}/`;
+  // TypeDoc output is versioned: served at /docs/engine/{version}/
+  const version = (packageData?.version || '').replace(/^v/, '');
+  const jsDocsDestination = `./public/${host}${pathPrefix}docs/engine/${version}/`;
+  // Coverage output at /docs/coverage/ (or /docs/{coverageOutputDir}/)
+  const coverageBaseDestination = `./public/${host}${pathPrefix}docs/`;
+  await buildJsDocs({ host, path, metadata, publicClientId, docs, docsDestination: jsDocsDestination });
+  await buildCoverage({ docs, docsDestination: coverageBaseDestination });
   await buildApiDocs({
     host,
     path,