freestyle 0.1.46 → 0.1.48

package/README.md

@@ -163,4 +163,55 @@ for (let i = 0; i < 10; i++) {
         `,
   });
 }
+
+// Restrict outbound requests and attach headers for matching domains.
+await freestyle.serverless.runs.create({
+  code: `export default async () => {
+    const res = await fetch("https://api.freestyle.sh/some-path");
+    return await res.text();
+  }`,
+  egress: {
+    allow: {
+      domains: {
+        "api.freestyle.sh": [
+          {
+            transform: [
+              {
+                headers: {
+                  "X-Freestyle-Admin-Key": "abc",
+                  "X-Freestyle-User-Id": "123",
+                },
+              },
+            ],
+          },
+        ],
+        "*": [],
+      },
+    },
+  },
+});
+
+// The same egress config shape is supported for deployments.
+await freestyle.serverless.deployments.create({
+  code: "export default () => new Response('ok')",
+  egress: {
+    allow: {
+      domains: {
+        "api.freestyle.sh": [
+          {
+            transform: [
+              {
+                headers: {
+                  "X-Freestyle-Admin-Key": "abc",
+                  "X-Freestyle-User-Id": "123",
+                },
+              },
+            ],
+          },
+        ],
+        "*": [],
+      },
+    },
+  },
+});
 ```

package/cli.mjs

@@ -6,7 +6,7 @@ import { Freestyle, VmSpec } from './index.mjs';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { spawn } from 'child_process';
+import { spawn, spawnSync } from 'child_process';
 
 const DEFAULT_STACK_API_URL = "https://api.stack-auth.com";
 const DEFAULT_STACK_APP_URL = "https://dash.freestyle.sh";
@@ -1105,6 +1105,27 @@ const runCommand = {
   }
 };
 
+function spawnGit(args) {
+  return new Promise((resolve, reject) => {
+    const sigintHandler = () => {
+    };
+    process.on("SIGINT", sigintHandler);
+    const child = spawn("git", args, { stdio: "inherit" });
+    child.on("error", (err) => {
+      process.off("SIGINT", sigintHandler);
+      reject(err);
+    });
+    child.on("close", (code, signal) => {
+      process.off("SIGINT", sigintHandler);
+      if (code === 0) {
+        resolve();
+      } else {
+        const detail = signal ? `signal ${signal}` : `exit code ${code}`;
+        reject(new Error(`git ${args[0]} failed with ${detail}`));
+      }
+    });
+  });
+}
 const gitCommand = {
   command: "git <action>",
   describe: "Manage Git repositories",
@@ -1224,6 +1245,99 @@ Total: ${repos.total}`);
           handleError(error);
         }
       }
+    ).command(
+      "clone <repoId> [directory]",
+      "Clone a repo and persist an access token in the checkout so git push/pull work",
+      (yargs2) => {
+        return yargs2.positional("repoId", {
+          type: "string",
+          description: "Repository ID to clone",
+          demandOption: true
+        }).positional("directory", {
+          type: "string",
+          description: "Destination directory (defaults to <repoId>)"
+        }).option("readonly", {
+          type: "boolean",
+          description: "Provision a read-only token instead of read/write",
+          default: false
+        });
+      },
+      async (argv) => {
+        loadEnv();
+        const args = argv;
+        const permission = args.readonly ? "read" : "write";
+        const destination = args.directory ?? args.repoId;
+        const freestyle = await getFreestyleClient();
+        let identityId;
+        let tokenId;
+        let cloneSucceeded = false;
+        try {
+          console.log(
+            `Provisioning ${permission} access token for ${args.repoId}...`
+          );
+          const { identity, identityId: newIdentityId } = await freestyle.identities.create();
+          identityId = newIdentityId;
+          await identity.permissions.git.grant({
+            repoId: args.repoId,
+            permission
+          });
+          const created = await identity.tokens.create();
+          tokenId = created.tokenId;
+          const url = new URL(`/${args.repoId}`, "https://git.freestyle.sh");
+          url.username = "x-access-token";
+          url.password = created.token;
+          console.log(`Cloning repository ${args.repoId} into ${destination}...`);
+          await spawnGit([
+            "clone",
+            url.toString(),
+            ...args.directory ? [args.directory] : []
+          ]);
+          spawnSync(
+            "git",
+            ["-C", destination, "config", "freestyle.identityId", identityId],
+            { stdio: "ignore" }
+          );
+          spawnSync(
+            "git",
+            ["-C", destination, "config", "freestyle.tokenId", tokenId],
+            { stdio: "ignore" }
+          );
+          spawnSync(
+            "git",
+            ["-C", destination, "config", "freestyle.permission", permission],
+            { stdio: "ignore" }
+          );
+          cloneSucceeded = true;
+          console.log(`
+\u2713 Clone complete (${permission} access)`);
+          console.log(
+            `  The access token is stored in ${destination}/.git/config;`
+          );
+          console.log(
+            `  git push and git pull will work from inside ${destination}.`
+          );
+        } catch (error) {
+          handleError(error);
+        } finally {
+          if (!cloneSucceeded) {
+            if (tokenId && identityId) {
+              try {
+                const identity = freestyle.identities.ref({ identityId });
+                await identity.tokens.revoke({ tokenId });
+              } catch (err) {
+                console.error("Warning: failed to revoke token:", err);
+              }
+            }
+            if (identityId) {
+              try {
+                await freestyle.identities.delete({ identityId });
+              } catch (err) {
+                console.error("Warning: failed to delete identity:", err);
+              }
+            }
+          }
+        }
+      }
     ).command(
       "delete <repoId>",
       "Delete a git repository",
@@ -1923,7 +2037,7 @@ const loginCommand = {
       if (teams.length > 1) {
         console.log(
           `
-\u2139\uFE0F  You have ${teams.length} teams. Use 'freestyle team switch' to change teams.`
+\u2139\uFE0F  You have ${teams.length} teams.`
         );
       }
     } catch (error) {