eoas 3.0.5 → 3.1.0

package/dist/commands/server/validate.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const core_1 = require("@oclif/core");
+const chalk_1 = tslib_1.__importDefault(require("chalk"));
+const fs_extra_1 = tslib_1.__importDefault(require("fs-extra"));
+const path_1 = tslib_1.__importDefault(require("path"));
+const log_1 = tslib_1.__importDefault(require("../../lib/log"));
+const envCatalog_1 = require("../../lib/serverConfig/envCatalog");
+const helmValues_1 = require("../../lib/serverConfig/helmValues");
+/** A single document can carry either half of the pair, or both when merged. */
+function classifyInto(docs, doc) {
+    if (!docs.values && (0, helmValues_1.looksLikeChartValues)(doc)) {
+        docs.values = doc;
+    }
+    if (!docs.secretEnv) {
+        docs.secretEnv = (0, helmValues_1.extractSecretEnv)(doc);
+    }
+}
+/** Picks the Helm pair out of a directory, canonical file names first. */
+async function collectHelmDocs(dir, docs, skip) {
+    const names = (await fs_extra_1.default.readdir(dir))
+        .filter(name => /\.ya?ml$/i.test(name))
+        .sort((a, b) => {
+        const canonical = (name) => name === 'values.yaml' || name === 'secrets.yaml' ? 0 : 1;
+        return canonical(a) - canonical(b) || a.localeCompare(b);
+    });
+    for (const name of names) {
+        const filePath = path_1.default.join(dir, name);
+        if (filePath === skip || !(await fs_extra_1.default.stat(filePath)).isFile()) {
+            continue;
+        }
+        try {
+            classifyInto(docs, (0, helmValues_1.parseYamlFile)(await fs_extra_1.default.readFile(filePath, 'utf8')));
+        }
+        catch {
+            // Not a single YAML mapping (multi-doc, template output...): not ours.
+        }
+    }
+}
+class ServerValidate extends core_1.Command {
+    static args = {
+        file: core_1.Args.string({
+            description: 'Path to a server .env file, a Helm values or secrets YAML, or the directory holding the Helm pair',
+            required: true,
+        }),
+    };
+    static description = 'Check a server configuration (.env file or Helm values/secrets pair) for missing or inconsistent variables';
+    static examples = [
+        '<%= config.bin %> <%= command.id %> .env.xprem',
+        '<%= config.bin %> <%= command.id %> xprem-helm',
+        '<%= config.bin %> <%= command.id %> xprem-helm/values.yaml',
+    ];
+    static flags = {};
+    async run() {
+        const { args } = await this.parse(ServerValidate);
+        const target = path_1.default.resolve(process.cwd(), args.file);
+        if (!(await fs_extra_1.default.pathExists(target))) {
+            log_1.default.error(`File not found: ${target}`);
+            process.exit(1);
+        }
+        let issues;
+        if ((await fs_extra_1.default.stat(target)).isDirectory()) {
+            const docs = {};
+            await collectHelmDocs(target, docs);
+            if (!docs.values && !docs.secretEnv) {
+                log_1.default.error(`No Helm values or secrets YAML found in ${target}`);
+                process.exit(1);
+            }
+            issues = (0, helmValues_1.validateHelmPair)(docs.values, docs.secretEnv);
+        }
+        else if (/\.ya?ml$/i.test(target)) {
+            let doc;
+            try {
+                doc = (0, helmValues_1.parseYamlFile)(await fs_extra_1.default.readFile(target, 'utf8'));
+            }
+            catch (e) {
+                log_1.default.error(`Could not parse ${args.file} as YAML: ${e instanceof Error ? e.message : e}`);
+                process.exit(1);
+                return;
+            }
+            const docs = {};
+            classifyInto(docs, doc);
+            if (!docs.values && !docs.secretEnv) {
+                log_1.default.error(`${args.file} looks like neither a values file for the xprem Helm chart nor a secrets overlay (secretEnv map).`);
+                process.exit(1);
+            }
+            // The other half of the pair is picked up from the same directory.
+            await collectHelmDocs(path_1.default.dirname(target), docs, target);
+            issues = (0, helmValues_1.validateHelmPair)(docs.values, docs.secretEnv);
+        }
+        else {
+            issues = (0, envCatalog_1.validateEnvMap)((0, envCatalog_1.parseEnvFile)(await fs_extra_1.default.readFile(target, 'utf8')));
+        }
+        const errors = issues.filter(issue => issue.level === 'error');
+        const warnings = issues.filter(issue => issue.level === 'warning');
+        for (const issue of errors) {
+            log_1.default.log(`${chalk_1.default.red('✖')} ${issue.message}`);
+        }
+        for (const issue of warnings) {
+            log_1.default.log(`${chalk_1.default.yellow('⚠')} ${issue.message}`);
+        }
+        log_1.default.newLine();
+        if (errors.length > 0) {
+            log_1.default.fail(`${args.file}: ${errors.length} error(s), ${warnings.length} warning(s). The server would not boot with this configuration.`);
+            process.exit(1);
+        }
+        if (warnings.length > 0) {
+            log_1.default.succeed(`${args.file}: no errors, ${warnings.length} warning(s).`);
+            return;
+        }
+        log_1.default.succeed(`${args.file}: everything looks good.`);
+    }
+}
+exports.default = ServerValidate;

package/dist/lib/assets.d.ts

@@ -2,7 +2,7 @@ import Joi from 'joi';
 import { Credentials } from './auth';
 import { RequestedPlatform } from './expoConfig';
 export declare const MetadataJoi: Joi.ObjectSchema<any>;
-interface AssetToUpload {
+export interface AssetToUpload {
     path: string;
     name: string;
     ext: string;
@@ -14,8 +14,34 @@ export interface RequestUploadUrlItem {
     filePath: string;
     headers?: Record<string, string>;
 }
+export interface RequestUploadUrlsResponse {
+    uploadRequests: RequestUploadUrlItem[];
+    updateId: string;
+    rolloutPercentage?: number;
+    publishGroup?: string;
+}
+export declare const RequestUploadUrlsResponseJoi: Joi.ObjectSchema<any>;
+export interface ResolvedUploadRequest {
+    item: RequestUploadUrlItem;
+    absolutePath: string;
+    manifestEntry: AssetToUpload;
+}
+/**
+ * Maps every upload request of ONE server response onto a file the CLI itself
+ * exported, and throws on anything it cannot account for. This runs to
+ * completion before the first byte is read: a single bad entry aborts the whole
+ * publish rather than uploading the files that happened to be fine.
+ *
+ * Call it once per response: `eoas publish --platform all` requests upload URLs
+ * per runtime version, and every response legitimately names the same files.
+ */
+export declare function resolveUploadRequests({ uploadRequests, exportDir, manifest, }: {
+    uploadRequests: RequestUploadUrlItem[];
+    exportDir: string;
+    manifest: AssetToUpload[];
+}): Promise<ResolvedUploadRequest[]>;
 export declare function activeRolloutConflictMessage(branch: string): string;
-export declare function requestUploadUrls({ body, requestUploadUrl, auth, runtimeVersion, platform, commitHash, message, rolloutPercentage, branch, }: {
+export declare function requestUploadUrls({ body, requestUploadUrl, auth, runtimeVersion, platform, commitHash, message, rolloutPercentage, publishGroup, branch, }: {
     body: {
         fileNames: string[];
     };
@@ -26,10 +52,6 @@ export declare function requestUploadUrls({ body, requestUploadUrl, auth, runtim
     commitHash?: string;
     message?: string;
     rolloutPercentage?: number;
+    publishGroup?: string;
     branch: string;
-}): Promise<{
-    uploadRequests: RequestUploadUrlItem[];
-    updateId: string;
-    rolloutPercentage?: number;
-}>;
-export {};
+}): Promise<RequestUploadUrlsResponse>;

package/dist/lib/assets.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requestUploadUrls = exports.activeRolloutConflictMessage = exports.computeFilesRequests = exports.MetadataJoi = void 0;
+exports.requestUploadUrls = exports.activeRolloutConflictMessage = exports.resolveUploadRequests = exports.RequestUploadUrlsResponseJoi = exports.computeFilesRequests = exports.MetadataJoi = void 0;
 const tslib_1 = require("tslib");
 const fs_extra_1 = tslib_1.__importDefault(require("fs-extra"));
 const joi_1 = tslib_1.__importDefault(require("joi"));
@@ -73,11 +73,155 @@ function computeFilesRequests(projectDir, outputDir, requestedPlatform) {
     return assets;
 }
 exports.computeFilesRequests = computeFilesRequests;
+// The server dictates which local files the CLI opens and where their bytes are
+// sent, so its answer is untrusted input: a hostile or compromised server that
+// gets a forged filePath past us reads any file it wants off the developer or CI
+// machine. Every field is typed here, and the paths are checked against the
+// export manifest in resolveUploadRequests before anything is opened.
+const uploadRequestHeadersJoi = joi_1.default.object()
+    .pattern(
+// RFC 7230 header field-name, and a value that cannot smuggle a CRLF.
+/^[A-Za-z0-9!#$%&'*+\-.^_`|~]+$/, joi_1.default.string()
+    .allow('')
+    .pattern(/^[^\r\n]*$/))
+    .optional();
+const uploadRequestJoi = joi_1.default.object({
+    requestUploadUrl: joi_1.default.string()
+        .uri({ scheme: ['http', 'https'] })
+        .required(),
+    fileName: joi_1.default.string().required(),
+    filePath: joi_1.default.string().required(),
+    headers: uploadRequestHeadersJoi,
+    // Unknown keys are tolerated so a newer server can add fields without
+    // breaking older CLIs; nothing reads them.
+}).unknown(true);
+exports.RequestUploadUrlsResponseJoi = joi_1.default.object({
+    // The server marshals updateId from an int64, so it arrives as a JSON number;
+    // older or third-party servers may send it as a string. Normalized to a string
+    // below, which is what the markUpdateAsUploaded query parameter needs.
+    updateId: joi_1.default.alternatives().try(joi_1.default.string(), joi_1.default.number()).required(),
+    uploadRequests: joi_1.default.array().items(uploadRequestJoi).required(),
+    rolloutPercentage: joi_1.default.number().optional(),
+    publishGroup: joi_1.default.string().optional(),
+})
+    .required()
+    .unknown(true);
+function isLoopbackHost(hostname) {
+    const host = hostname.replace(/^\[/, '').replace(/\]$/, '').toLowerCase();
+    // Deliberately does not accept *.localhost: resolvers are free to answer it
+    // from DNS, which would let a remote host claim the plain-HTTP exemption.
+    return host === 'localhost' || host === '::1' || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+// Escape hatch for the deployments that legitimately serve upload URLs over
+// plain HTTP on a non-loopback host: a MinIO or S3-compatible endpoint set
+// through AWS_BASE_ENDPOINT, or a local bucket whose BASE_URL is an internal
+// hostname. It only lifts the transport requirement, never a path check.
+const INSECURE_UPLOAD_URLS_ENV = 'EOAS_ALLOW_INSECURE_UPLOAD_URLS';
+function insecureUploadUrlsAllowed() {
+    const value = process.env[INSECURE_UPLOAD_URLS_ENV];
+    return value === '1' || value?.toLowerCase() === 'true';
+}
+function assertSafeUploadUrl(requestUploadUrl) {
+    let url;
+    try {
+        url = new URL(requestUploadUrl);
+    }
+    catch {
+        throw new Error(`The server returned an unusable upload URL: ${requestUploadUrl}`);
+    }
+    if (url.protocol === 'https:') {
+        return;
+    }
+    if (url.protocol === 'http:' && isLoopbackHost(url.hostname)) {
+        return;
+    }
+    if (url.protocol === 'http:' && insecureUploadUrlsAllowed()) {
+        log_1.default.warn(`Uploading to ${url.origin} over plain HTTP because ${INSECURE_UPLOAD_URLS_ENV} is set. Your update artifacts travel unencrypted.`);
+        return;
+    }
+    throw new Error(`Refusing to upload to ${url.origin}: update artifacts may only be sent over HTTPS (plain HTTP is allowed for loopback addresses only). Set ${INSECURE_UPLOAD_URLS_ENV}=1 if your storage endpoint is intentionally served over HTTP.`);
+}
+function assertRelativePathShape(filePath) {
+    if (!filePath || filePath.includes('\0')) {
+        throw new Error('The server returned an empty or malformed file path.');
+    }
+    // win32.isAbsolute also covers the posix cases, drive letters and UNC paths.
+    if (path_1.default.isAbsolute(filePath) || path_1.default.win32.isAbsolute(filePath)) {
+        throw new Error(`Refusing to upload the absolute path "${filePath}" requested by the server.`);
+    }
+    if (filePath.split(/[/\\]/).some(segment => segment === '..')) {
+        throw new Error(`Refusing to upload "${filePath}": the server requested a path outside the export directory.`);
+    }
+}
+/**
+ * Maps every upload request of ONE server response onto a file the CLI itself
+ * exported, and throws on anything it cannot account for. This runs to
+ * completion before the first byte is read: a single bad entry aborts the whole
+ * publish rather than uploading the files that happened to be fine.
+ *
+ * Call it once per response: `eoas publish --platform all` requests upload URLs
+ * per runtime version, and every response legitimately names the same files.
+ */
+async function resolveUploadRequests({ uploadRequests, exportDir, manifest, }) {
+    const manifestByPath = new Map(manifest.map(entry => [entry.path, entry]));
+    // Canonical root, so a symlinked export directory (or /tmp on macOS) does not
+    // make every containment check fail below.
+    let exportRoot;
+    try {
+        exportRoot = await fs_extra_1.default.realpath(exportDir);
+    }
+    catch {
+        throw new Error(`Export directory ${exportDir} could not be resolved.`);
+    }
+    const seen = new Set();
+    const resolved = [];
+    for (const item of uploadRequests) {
+        assertSafeUploadUrl(item.requestUploadUrl);
+        assertRelativePathShape(item.filePath);
+        const manifestEntry = manifestByPath.get(item.filePath);
+        if (!manifestEntry) {
+            throw new Error(`Refusing to upload "${item.filePath}": the server asked for a file that is not part of this export.`);
+        }
+        if (item.fileName !== path_1.default.basename(item.filePath)) {
+            throw new Error(`Refusing to upload "${item.filePath}": the server returned the mismatched name "${item.fileName}".`);
+        }
+        if (seen.has(item.filePath)) {
+            throw new Error(`The server requested "${item.filePath}" more than once.`);
+        }
+        seen.add(item.filePath);
+        const absolutePath = path_1.default.resolve(exportRoot, item.filePath);
+        // Unreachable on POSIX: a path with no '..' segment and no leading separator
+        // cannot resolve out of the root. Kept for the Windows drive-relative case
+        // ("C:file" when the export root sits on another drive) and as a backstop if
+        // the checks above are ever relaxed.
+        if (absolutePath !== exportRoot && !absolutePath.startsWith(exportRoot + path_1.default.sep)) {
+            throw new Error(`Refusing to upload "${item.filePath}": it resolves outside the export directory.`);
+        }
+        let realPath;
+        try {
+            realPath = await fs_extra_1.default.realpath(absolutePath);
+        }
+        catch {
+            throw new Error(`File ${item.filePath} not found in the export directory.`);
+        }
+        // The root is already canonical, so any difference here means a symlink was
+        // traversed, either as the file itself or as one of its parent directories.
+        if (realPath !== absolutePath) {
+            throw new Error(`Refusing to upload "${item.filePath}": it is or goes through a symlink.`);
+        }
+        if (!(await fs_extra_1.default.lstat(absolutePath)).isFile()) {
+            throw new Error(`Refusing to upload "${item.filePath}": it is not a regular file.`);
+        }
+        resolved.push({ item, absolutePath, manifestEntry });
+    }
+    return resolved;
+}
+exports.resolveUploadRequests = resolveUploadRequests;
 function activeRolloutConflictMessage(branch) {
     return `A progressive rollout is already active for branch "${branch}" on this runtime version. End or revert it from the dashboard before publishing a new update.`;
 }
 exports.activeRolloutConflictMessage = activeRolloutConflictMessage;
-async function requestUploadUrls({ body, requestUploadUrl, auth, runtimeVersion, platform, commitHash, message, rolloutPercentage, branch, }) {
+async function requestUploadUrls({ body, requestUploadUrl, auth, runtimeVersion, platform, commitHash, message, rolloutPercentage, publishGroup, branch, }) {
     const uploadUrl = new URL(requestUploadUrl);
     uploadUrl.searchParams.set('runtimeVersion', runtimeVersion);
     uploadUrl.searchParams.set('platform', platform);
@@ -85,6 +229,9 @@ async function requestUploadUrls({ body, requestUploadUrl, auth, runtimeVersion,
     if (rolloutPercentage !== undefined) {
         uploadUrl.searchParams.set('rolloutPercentage', String(rolloutPercentage));
     }
+    if (publishGroup) {
+        uploadUrl.searchParams.set('publishGroup', publishGroup);
+    }
     const requestBody = { ...body };
     if (message) {
         requestBody.message = message;
@@ -105,12 +252,19 @@ async function requestUploadUrls({ body, requestUploadUrl, auth, runtimeVersion,
         throw new Error(`Failed to request upload URL: ${text}`);
     }
     const json = await response.json();
+    // Joi's sanitized value, not the raw payload: it is the object the schema
+    // actually vouched for, with inherited keys such as __proto__ dropped.
+    const { error, value } = exports.RequestUploadUrlsResponseJoi.validate(json);
+    if (error) {
+        throw new Error(`The server returned an invalid upload response: ${error.message}`);
+    }
+    const validated = { ...value, updateId: String(value.updateId) };
     // An old server silently ignores unknown query params, so a missing echo means
     // the rollout was not applied even though the flag was set. Abort before any
     // file is uploaded: continuing would finalize a full 100% publish.
-    if (rolloutPercentage !== undefined && json.rolloutPercentage === undefined) {
+    if (rolloutPercentage !== undefined && validated.rolloutPercentage === undefined) {
         throw new Error('The server ignored --rollout-percentage and would publish to 100% of devices. Update the server to a version that supports progressive rollouts, or publish without --rollout-percentage.');
     }
-    return json;
+    return validated;
 }
 exports.requestUploadUrls = requestUploadUrls;

package/dist/lib/auth.js

@@ -19,8 +19,9 @@ function retrieveCredentials() {
 }
 exports.retrieveCredentials = retrieveCredentials;
 function validateCredentials(credentials) {
-    if (!credentials)
+    if (!credentials) {
         return false;
+    }
     return !!(credentials.token || credentials.sessionSecret);
 }
 exports.validateCredentials = validateCredentials;

package/dist/lib/log.d.ts

@@ -12,10 +12,16 @@ export default class Log {
     static succeed(message: string): void;
     static withTick(...args: any[]): void;
     static withInfo(...args: any[]): void;
-    private static consoleLog;
+    /** Opens a clack session frame; every line after it hangs on the gutter. */
+    static intro(title: string): void;
+    /** Closes the clack session frame opened by intro. */
+    static outro(message: string): void;
+    static note(content: string, title?: string): void;
+    static cancel(message: string): void;
+    private static write;
     private static withTextColor;
     private static isLastLineNewLine;
-    private static updateIsLastLineNewLine;
+    private static track;
 }
 /**
  * Prints a link for given URL, using text if provided, otherwise text is just the URL.

package/dist/lib/log.js

@@ -2,19 +2,23 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.learnMore = exports.link = void 0;
 const tslib_1 = require("tslib");
-// This file is copied from eas-cli[https://github.com/expo/eas-cli] to ensure consistent user experience across the CLI.
+// Rendering for every command's output, drawn with the @clack/prompts
+// primitives so the whole CLI shares one visual identity (gutter, symbols,
+// notes). The static API is kept from the original eas-cli logger so call
+// sites did not have to change.
+const clack = tslib_1.__importStar(require("@clack/prompts"));
 const chalk_1 = tslib_1.__importDefault(require("chalk"));
-const figures_1 = tslib_1.__importDefault(require("figures"));
 const getenv_1 = require("getenv");
-const log_symbols_1 = tslib_1.__importDefault(require("log-symbols"));
 const terminal_link_1 = tslib_1.__importDefault(require("terminal-link"));
+const util_1 = require("util");
 class Log {
     static isDebug = (0, getenv_1.boolish)('DEBUG', false);
     static log(...args) {
-        Log.consoleLog(...args);
+        Log.write((0, util_1.format)(...args));
     }
     static newLine() {
-        Log.consoleLog();
+        Log.write('');
+        Log.isLastLineNewLine = true;
     }
     static addNewLineIfNone() {
         if (!Log.isLastLineNewLine) {
@@ -22,56 +26,68 @@ class Log {
         }
     }
     static error(...args) {
-        Log.consoleLog(...Log.withTextColor(args, chalk_1.default.red));
+        Log.track();
+        clack.log.error(Log.withTextColor(args, chalk_1.default.red).join(' '));
     }
     static warn(...args) {
-        Log.consoleLog(...Log.withTextColor(args, chalk_1.default.yellow));
+        Log.track();
+        clack.log.warn(Log.withTextColor(args, chalk_1.default.yellow).join(' '));
     }
     static debug(...args) {
         if (Log.isDebug) {
-            Log.consoleLog(...args);
+            Log.write((0, util_1.format)(...args));
         }
     }
     static gray(...args) {
-        Log.consoleLog(...Log.withTextColor(args, chalk_1.default.gray));
+        Log.write(Log.withTextColor(args, chalk_1.default.gray).join(' '));
     }
     static warnDeprecatedFlag(flag, message) {
         Log.warn(`› ${chalk_1.default.bold('--' + flag)} flag is deprecated. ${message}`);
     }
     static fail(message) {
-        Log.log(`${chalk_1.default.red(log_symbols_1.default.error)} ${message}`);
+        Log.track();
+        clack.log.error(message);
     }
     static succeed(message) {
-        Log.log(`${chalk_1.default.green(log_symbols_1.default.success)} ${message}`);
+        Log.track();
+        clack.log.success(message);
     }
     static withTick(...args) {
-        Log.consoleLog(chalk_1.default.green(figures_1.default.tick), ...args);
+        Log.track();
+        clack.log.success((0, util_1.format)(...args));
     }
     static withInfo(...args) {
-        Log.consoleLog(chalk_1.default.green(figures_1.default.info), ...args);
+        Log.track();
+        clack.log.info((0, util_1.format)(...args));
     }
-    static consoleLog(...args) {
-        Log.updateIsLastLineNewLine(args);
-        // eslint-disable-next-line no-console
-        console.log(...args);
+    /** Opens a clack session frame; every line after it hangs on the gutter. */
+    static intro(title) {
+        Log.track();
+        clack.intro(title);
+    }
+    /** Closes the clack session frame opened by intro. */
+    static outro(message) {
+        Log.track();
+        clack.outro(message);
+    }
+    static note(content, title) {
+        Log.track();
+        clack.note(content, title);
+    }
+    static cancel(message) {
+        Log.track();
+        clack.cancel(message);
+    }
+    static write(text) {
+        Log.track(text);
+        clack.log.message(text);
     }
     static withTextColor(args, chalkColor) {
-        return args.map(arg => chalkColor(arg));
+        return args.map(arg => chalkColor((0, util_1.format)(arg)));
     }
     static isLastLineNewLine = false;
-    static updateIsLastLineNewLine(args) {
-        if (args.length === 0) {
-            Log.isLastLineNewLine = true;
-        }
-        else {
-            const lastArg = args[args.length - 1];
-            if (typeof lastArg === 'string' && (lastArg === '' || lastArg.match(/[\r\n]$/))) {
-                Log.isLastLineNewLine = true;
-            }
-            else {
-                Log.isLastLineNewLine = false;
-            }
-        }
+    static track(text) {
+        Log.isLastLineNewLine = text !== undefined && text === '';
     }
 }
 exports.default = Log;

package/dist/lib/ora.d.ts

@@ -1,9 +1,10 @@
-import { Options, Ora } from 'ora';
-export { Ora, Options };
-/**
- * A custom ora spinner that sends the stream to stdout in CI, or non-TTY, instead of stderr (the default).
- *
- * @param options
- * @returns
- */
-export declare function ora(options?: Options | string): Ora;
+export type Spinner = {
+    start(text?: string): Spinner;
+    succeed(text?: string): Spinner;
+    fail(text?: string): Spinner;
+    warn(text?: string): Spinner;
+    stop(): Spinner;
+};
+export declare function ora(options?: string | {
+    text?: string;
+}): Spinner;