hammerkit 1.24.0 → 1.25.0

package/dist/server/server-config.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectPlatform = exports.readServerConfig = exports.serverConfigSchema = exports.entitlementSchema = exports.definitionName = exports.issuerSchema = exports.serverPlatformSchema = void 0;
+exports.detectPlatform = exports.getSecretCatalog = exports.readServerConfig = exports.getSourceAccounts = exports.serverConfigSchema = exports.sourceSchema = exports.entitlementSchema = exports.buildsLevelSchema = exports.accountLevelSchema = exports.accountSchema = exports.definitionName = exports.issuerSchema = exports.serverPlatformSchema = void 0;
 const zod_1 = require("zod");
 const yaml_1 = require("yaml");
 const log_1 = require("../log");
 const units_1 = require("../utils/units");
+const build_file_secret_provider_schema_1 = require("../schema/build-file-secret-provider-schema");
+const repo_1 = require("./repo");
 const LOOPBACK_HOSTS = ['127.0.0.1', 'localhost', '::1'];
 exports.serverPlatformSchema = zod_1.z
     .object({
@@ -62,50 +64,79 @@ function checkWho(who, ctx) {
         ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['claims', 'match'], message: 'match at least one claim' });
     }
 }
-exports.entitlementSchema = zod_1.z
+// The service accounts a server knows. A run never names one: the accounts it
+// uses are the ones its secrets are read as, and an entitlement says who may use
+// or only request each.
+const accountNameSchema = zod_1.z
+    .string()
+    .regex(/^[A-Za-z][A-Za-z0-9_-]*$/, 'a name starts with a letter and holds letters, digits, - and _');
+exports.accountSchema = zod_1.z
     .object({
-    ...whoShape,
-    // admin: runs on these accounts at once, and approves the runs others
-    // request on them
-    accounts: zod_1.z.array(zod_1.z.string().min(1)).default([]),
-    // may request runs on these accounts, which wait until an admin of the account
-    // (someone with it in `accounts`) approves them
-    request: zod_1.z.array(zod_1.z.string().min(1)).optional(),
-    // the build files (by name) the caller may publish, `*` for any; a separate
-    // permission from running them, so who defines work and who runs it can differ
-    publish: zod_1.z.array(zod_1.z.union([zod_1.z.literal('*'), exports.definitionName])).optional(),
-    // the build files the caller may propose a new version of: it can not run until
-    // someone who may `publish` that name approves it
-    propose: zod_1.z.array(zod_1.z.union([zod_1.z.literal('*'), exports.definitionName])).optional(),
-    // the account used when the caller names none; one of accounts or request
-    default: zod_1.z.string().min(1).optional(),
-    // where the code may come from: the caller's working tree or a git ref
+    description: zod_1.z.string().min(1).max(200).optional(),
+    // per secret provider, the environment that makes its command act as this
+    // account; the credentials are files and variables of the operator's machine
+    providers: build_file_secret_provider_schema_1.buildFileSecretAccountSchema.shape.providers.default({}),
+    // where the code of a run using this account may come from; both when left out
     source: zod_1.z
         .array(zod_1.z.enum(['upload', 'ref']))
         .min(1)
         .optional(),
+    // the refs (branches or tags, `release/*` for a level) a run using this account
+    // may be started from; a commit is not accepted then, it names no branch
+    refs: zod_1.z.array(zod_1.z.string().min(1).max(200)).min(1).optional(),
 })
     .strict()
-    .superRefine((entitlement, ctx) => {
-    checkWho(entitlement, ctx);
-    if (entitlement.accounts.length === 0 &&
-        (entitlement.request ?? []).length === 0 &&
-        (entitlement.propose ?? []).length === 0 &&
-        (entitlement.publish ?? []).length === 0) {
+    .superRefine((account, ctx) => {
+    if (account.refs && (account.source?.length !== 1 || account.source[0] !== 'ref')) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
-            message: 'name accounts to use or request, or build files to publish or propose',
+            path: ['refs'],
+            message: 'refs only restricts runs from a git ref, set source: [ref] too, an upload names no ref',
         });
     }
-    if (entitlement.default &&
-        ![...entitlement.accounts, ...(entitlement.request ?? [])].includes(entitlement.default)) {
+});
+exports.accountLevelSchema = zod_1.z.enum(['use', 'request']);
+// What a caller may do with the build files: run what is published, propose new
+// versions that someone else approves, or publish. Each level includes the lower.
+exports.buildsLevelSchema = zod_1.z.enum(['run', 'propose', 'publish']);
+const repoPatternSchema = zod_1.z.string().refine(repo_1.isRepoPattern, 'expected host/path, such as github.com/corp/*');
+exports.entitlementSchema = zod_1.z
+    .object({
+    ...whoShape,
+    // `use`: runs on the account at once and approves the runs others request on it;
+    // `request`: runs wait until somebody who may `use` the account approves them
+    accounts: zod_1.z.record(accountNameSchema, exports.accountLevelSchema).default({}),
+    // the repositories (`host/path` patterns) the caller may run from a git ref
+    repos: zod_1.z.array(repoPatternSchema).default([]),
+    builds: exports.buildsLevelSchema.optional(),
+})
+    .strict()
+    .superRefine((entitlement, ctx) => {
+    checkWho(entitlement, ctx);
+    if (Object.keys(entitlement.accounts).length === 0 && entitlement.builds === undefined) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
-            path: ['default'],
-            message: 'default has to be one of accounts or request',
+            message: 'name accounts to use or request, or a builds level',
         });
     }
 });
+// A repository the server can read: `github.com/corp/*` for an organisation,
+// `gitlab.corp.com/platform/**` for a group with its subgroups. The credential is a
+// secret of a provider, read as `account`, and handed to git for that fetch only.
+exports.sourceSchema = zod_1.z
+    .object({
+    match: repoPatternSchema,
+    secret: zod_1.z
+        .object({
+        from: zod_1.z.string().regex(/^[A-Za-z][A-Za-z0-9_-]*:.+$/, 'expected provider:reference'),
+        account: accountNameSchema,
+        // the user name of the basic authentication the token is sent with
+        username: zod_1.z.string().min(1).default('x-access-token'),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
 const duration = zod_1.z.string().refine((value) => {
     try {
         return (0, units_1.parseDuration)(value) > 0;
@@ -136,7 +167,11 @@ exports.serverConfigSchema = zod_1.z
     // the OAuth issuers whose tokens the server accepts, and the audience those
     // tokens have to carry
     issuers: zod_1.z.array(exports.issuerSchema).min(1, 'at least one issuer is needed, OAuth is the only way to call the server'),
-    // who may use which service account; default deny, so no entry means no account
+    // the service accounts, and the commands that read secrets as them; a build file
+    // can not declare either, only name an account on its secrets
+    accounts: zod_1.z.record(accountNameSchema, exports.accountSchema).default({}),
+    secretProviders: build_file_secret_provider_schema_1.buildFileSecretProvidersSchema.default({}),
+    // who may use which service account and which build files; default deny
     entitlements: zod_1.z.array(exports.entitlementSchema).default([]),
     approvals: zod_1.z
         .object({
@@ -144,21 +179,24 @@ exports.serverConfigSchema = zod_1.z
         timeout: duration.default('1h'),
         // runs waiting at the same time, more are refused
         maxWaiting: zod_1.z.number().int().min(1).default(100),
+        // after a version was rejected, who proposed it can not propose that build
+        // file again, and nobody that version, for this long
+        cooldown: duration.default('10m'),
     })
         .strict()
         .default({}),
-    // where a run gets its code from: the repository of each build file, by its name.
-    // The caller names a branch, tag or commit of it, never a repository.
-    sources: zod_1.z
-        .record(exports.definitionName, zod_1.z
-        .object({
-        git: zod_1.z
-            .string()
-            .min(1)
-            .refine((value) => !value.startsWith('-'), 'a repository can not look like an option'),
-    })
-        .strict())
-        .default({}),
+    // the repositories a run may get its code from, as patterns of `host/path`, and
+    // the secret that reads them: a token in a secret provider, read as a service
+    // account of the operator. The caller names a repository and a ref in the request,
+    // never a url.
+    sources: zod_1.z.array(exports.sourceSchema).default([]),
+    // what tasks may run on: containers, and the local runtime that runs commands on
+    // this machine as the user of the server. Local tasks read the whole file system of that
+    // user, so they have to be allowed by name.
+    runtimes: zod_1.z
+        .array(zod_1.z.enum(['docker', 'local']))
+        .min(1)
+        .default(['docker']),
     // where the server keeps what must survive a restart: the published build files
     storage: zod_1.z
         .object({ directory: zod_1.z.string().min(1).optional() })
@@ -171,6 +209,39 @@ exports.serverConfigSchema = zod_1.z
         maxConcurrent: zod_1.z.number().int().min(1).default(4),
         // finished runs that are kept for their state and logs
         keep: zod_1.z.number().int().min(1).default(200),
+        // what one caller (issuer and subject) may have at a time, so a single
+        // caller can not take the whole machine; over it a request gets 429
+        limits: zod_1.z
+            .object({
+            // runs that wait for an approval
+            waiting: zod_1.z.number().int().min(1).default(10),
+            // runs that wait in the queue for a free place
+            queued: zod_1.z.number().int().min(1).default(20),
+            // runs that execute at the same time, the others wait in the queue
+            running: zod_1.z.number().int().min(1).default(2),
+        })
+            .strict()
+            .default({}),
+        // a run that executes longer is stopped and fails
+        maxDuration: duration.default('1h'),
+        // log output kept per run; the rest is cut off
+        maxLogBytes: zod_1.z
+            .number()
+            .int()
+            .min(1024)
+            .default(1024 * 1024),
+        // the environment of a run: the variables of the server process that tasks
+        // (and the git fetch) can see. Nothing else of the server's environment
+        // is passed on, so there is no list built in; an operator names what the
+        // tools of the host need, such as PATH and DOCKER_HOST.
+        env: zod_1.z
+            .object({
+            allow: zod_1.z.array(zod_1.z.string().regex(/^[A-Za-z_][A-Za-z0-9_()]*$/)).default([]),
+            // fixed values that are set in addition
+            set: zod_1.z.record(zod_1.z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), zod_1.z.string()).default({}),
+        })
+            .strict()
+            .default({}),
     })
         .strict()
         .default({}),
@@ -196,6 +267,70 @@ exports.serverConfigSchema = zod_1.z
             });
         }
     });
+    for (const [name, account] of Object.entries(config.accounts)) {
+        for (const provider of Object.keys(account.providers)) {
+            if (!config.secretProviders[provider]) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['accounts', name, 'providers', provider],
+                    message: `secret provider ${provider} is not declared in secretProviders`,
+                });
+            }
+        }
+    }
+    config.entitlements.forEach((entitlement, index) => {
+        for (const account of Object.keys(entitlement.accounts)) {
+            if (!config.accounts[account]) {
+                const known = Object.keys(config.accounts);
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['entitlements', index, 'accounts', account],
+                    message: `unknown account ${account}, ${known.length > 0 ? `accounts: ${known.join(', ')}` : 'none is defined'}`,
+                });
+            }
+        }
+    });
+    config.sources.forEach((source, index) => {
+        if (!source.secret) {
+            return;
+        }
+        const { from, account } = source.secret;
+        const kind = from.substring(0, from.indexOf(':'));
+        const where = ['sources', index, 'secret'];
+        if (!config.accounts[account]) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: [...where, 'account'],
+                message: `unknown account ${account}`,
+            });
+        }
+        else if (!config.accounts[account].providers[kind]) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: [...where, 'from'],
+                message: `account ${account} has no credentials for the provider ${kind}`,
+            });
+        }
+        if (!config.secretProviders[kind]) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: [...where, 'from'],
+                message: `secret provider ${kind} is not declared in secretProviders`,
+            });
+        }
+    });
+    const readers = getSourceAccounts(config);
+    config.entitlements.forEach((entitlement, index) => {
+        for (const account of Object.keys(entitlement.accounts)) {
+            if (readers.includes(account)) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['entitlements', index, 'accounts', account],
+                    message: `the account ${account} reads the sources, no entitlement may name it`,
+                });
+            }
+        }
+    });
     if (!config.tls && !config.behindTlsProxy && !LOOPBACK_HOSTS.includes(config.listen.host)) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
@@ -204,6 +339,11 @@ exports.serverConfigSchema = zod_1.z
         });
     }
 });
+// The accounts that read repositories: no caller uses them and no build file names them.
+function getSourceAccounts(config) {
+    return [...new Set(config.sources.flatMap((source) => (source.secret ? [source.secret.account] : [])))];
+}
+exports.getSourceAccounts = getSourceAccounts;
 async function readServerConfig(environment, path) {
     if (!(await environment.file.exists(path))) {
         throw new Error(`unable to read ${path}: no such file`);
@@ -224,6 +364,27 @@ async function readServerConfig(environment, path) {
     return result.data;
 }
 exports.readServerConfig = readServerConfig;
+// The secret providers and accounts of the config as the engine reads them, so a
+// secret of a build file is read as an account of the operator.
+function getSecretCatalog(config) {
+    const providers = {};
+    for (const [name, provider] of Object.entries(config.secretProviders)) {
+        providers[name] = {
+            name,
+            type: 'command',
+            command: provider.command,
+            env: provider.env ?? {},
+            timeoutMs: (0, units_1.parseDuration)(provider.timeout ?? '30s'),
+            declaredIn: 'the server config',
+        };
+    }
+    const accounts = {};
+    for (const [name, account] of Object.entries(config.accounts)) {
+        accounts[name] = { name, default: false, providers: account.providers, declaredIn: 'the server config' };
+    }
+    return { providers, accounts, explicitAccounts: true };
+}
+exports.getSecretCatalog = getSecretCatalog;
 function detectPlatform() {
     const os = { darwin: 'macos', win32: 'windows' }[process.platform] ?? 'linux';
     const arch = process.arch === 'arm64' ? 'arm64' : 'amd64';