hammerkit 1.26.0 → 1.27.0-next.10

package/dist/schema/build-file-container-service-schema.js

@@ -8,6 +8,8 @@ const labels_schema_1 = require("./labels-schema");
 const build_file_service_container_healthcheck_1 = require("./build-file-service-container-healthcheck");
 const build_file_secret_schema_1 = require("./build-file-secret-schema");
 const resources_schema_1 = require("./resources-schema");
+const size_schema_1 = require("./size-schema");
+const network_schema_1 = require("./network-schema");
 exports.buildFileContainerServiceSchema = (0, zod_1.object)({
     image: (0, zod_1.string)(),
     description: (0, zod_1.string)().optional(),
@@ -39,6 +41,12 @@ exports.buildFileContainerServiceSchema = (0, zod_1.object)({
     // the service account its provider secrets are read as, unless a secret names one
     account: (0, zod_1.string)().optional(),
     resources: resources_schema_1.resourcesSchema.optional(),
+    // on Kubernetes, the size of the claim that holds its sources, mounts and volumes
+    volumeSize: size_schema_1.sizeSchema.describe('size of its claim on Kubernetes, e.g. 10Gi').optional(),
+    // what the service reaches besides its needs; tasks needing it always reach it
+    network: network_schema_1.networkSchema.optional(),
+    // whether its `cmd` takes the arguments after `--` of `up`: false refuses them
+    args: (0, zod_1.boolean)().optional(),
 })
     .strict()
     .describe('container service');

package/dist/schema/build-file-container-task-schema.js

@@ -3,10 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildFileContainerTaskSchema = void 0;
 const build_file_base_task_schema_1 = require("./build-file-base-task-schema");
 const zod_1 = require("zod");
+const size_schema_1 = require("./size-schema");
 exports.buildFileContainerTaskSchema = build_file_base_task_schema_1.buildFileBaseTaskSchema
     .extend({
     image: (0, zod_1.string)(),
     mounts: (0, zod_1.array)((0, zod_1.string)()).optional(),
+    // on Kubernetes, the size of the claim that holds its sources, mounts and outputs
+    volumeSize: size_schema_1.sizeSchema.describe('size of its claim on Kubernetes, e.g. 10Gi').optional(),
 })
     .strict()
     .describe('container task');

package/dist/schema/build-file-environment-schema.js

@@ -3,11 +3,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildFileEnvironmentSchema = exports.buildFileDockerEnvironmentSchema = exports.buildFileKubernetesEnvironmentSchema = void 0;
 const zod_1 = require("zod");
 const build_file_environment_schema_http_route_1 = require("./build-file-environment-schema-http-route");
+const size_schema_1 = require("./size-schema");
 exports.buildFileKubernetesEnvironmentSchema = (0, zod_1.object)({
     namespace: (0, zod_1.string)().optional(),
     context: (0, zod_1.string)(),
     kubeconfig: (0, zod_1.string)().optional(),
     httpRoutes: (0, zod_1.array)(build_file_environment_schema_http_route_1.buildFileEnvironmentSchemaHttpRoute).optional(),
+    // Hammerkit can't tell from the API whether the cluster's network plugin
+    // enforces NetworkPolicy, so the build file states it before any task or
+    // service there may have a limited network.
+    networkPolicy: (0, zod_1.literal)('enforced')
+        .describe('the cluster enforces NetworkPolicy, which limited networks need')
+        .optional(),
+    // the size of the claim of a task or service that states none (1Gi when left out)
+    volumeSize: size_schema_1.sizeSchema.describe('size of the claim of each task and service, 1Gi by default').optional(),
     // Ingress support was removed in 1.8.0. Fail instead of dropping the routes.
     ingresses: (0, zod_1.never)({
         errorMap: () => ({

package/dist/schema/network-schema.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.networkSchema = exports.allowEntrySchema = exports.getAllowListError = exports.isAllowEntry = exports.parseAllowEntry = exports.isNeedName = exports.isAllowHost = exports.PROXY_PORT = void 0;
+const zod_1 = require("zod");
+// A host name, or `*.` and a domain for every name under it. No IP
+// addresses: the proxy allows a name, whatever it resolves to.
+const HOST_PATTERN = /^(\*\.)?([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)*[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i;
+// The port the egress proxy serves HTTP on, so no TCP forward can take it.
+exports.PROXY_PORT = 3128;
+// Resolvers read a name like `0x7f000001`, `0x7f.1` or `127.1` as an address:
+// a hex label, or a numeric last label (no top-level domain is numeric).
+function looksLikeAddress(value) {
+    const labels = value.replace(/^\*\./, '').split('.');
+    return /^[0-9]+$/.test(labels[labels.length - 1]) || labels.some((label) => /^0x[0-9a-f]*$/i.test(label));
+}
+function isAllowHost(value) {
+    return HOST_PATTERN.test(value) && !looksLikeAddress(value);
+}
+exports.isAllowHost = isAllowHost;
+// The name a limited item reaches a needed service under: a plain host name,
+// which the egress proxy takes as exactly that name.
+function isNeedName(value) {
+    return !value.startsWith('*.') && isAllowHost(value);
+}
+exports.isNeedName = isNeedName;
+function parseAllowEntry(value) {
+    const match = /^([^:]+):([0-9]{1,5})$/.exec(value);
+    if (!match) {
+        return isAllowHost(value) ? { host: value, port: null } : null;
+    }
+    const port = parseInt(match[2], 10);
+    return isNeedName(match[1]) && port >= 1 && port <= 65535 && port !== exports.PROXY_PORT ? { host: match[1], port } : null;
+}
+exports.parseAllowEntry = parseAllowEntry;
+function isAllowEntry(value) {
+    return parseAllowEntry(value) !== null;
+}
+exports.isAllowEntry = isAllowEntry;
+// What is wrong with a whole allow list, null when nothing: the proxy listens
+// on each forward's port under the item's name for it, so two hosts can't
+// share a port.
+function getAllowListError(entries) {
+    const hosts = new Map();
+    for (const entry of entries.map(parseAllowEntry)) {
+        if (!entry || entry.port === null) {
+            continue;
+        }
+        const host = hosts.get(entry.port);
+        if (host && host.toLowerCase() !== entry.host.toLowerCase()) {
+            return `${host}:${entry.port} and ${entry.host}:${entry.port} share a port, each TCP forward needs its own`;
+        }
+        hosts.set(entry.port, entry.host);
+    }
+    return null;
+}
+exports.getAllowListError = getAllowListError;
+exports.allowEntrySchema = (0, zod_1.string)().refine(isAllowEntry, (value) => ({
+    message: `invalid host "${value}", expected a name such as registry.npmjs.org or *.githubusercontent.com, ` +
+        `or a name and port such as db.example.com:5432 (any port but ${exports.PROXY_PORT})`,
+}));
+// What a container task or service reaches besides the services in its
+// `needs`, which it reaches at every level: everything the host reaches
+// (`open`, the default), nothing (`none`), or the listed hosts through an
+// egress proxy: HTTP(S) to a host, raw TCP to a host and port. Not part of
+// the cache key.
+exports.networkSchema = (0, zod_1.union)([
+    (0, zod_1.literal)('open'),
+    (0, zod_1.literal)('none'),
+    (0, zod_1.object)({
+        allow: (0, zod_1.array)(exports.allowEntrySchema).superRefine((entries, ctx) => {
+            const error = getAllowListError(entries);
+            if (error) {
+                ctx.addIssue({ code: 'custom', message: error });
+            }
+        }),
+    }).strict(),
+]).describe('network the task or service reaches besides its needs: open (default), none or { allow: [hosts or host:port] }');
+//# sourceMappingURL=network-schema.js.map

package/dist/schema/reference-parser.js

@@ -128,6 +128,8 @@ function applySchemaExtension(reference, task) {
     task.schema.cache = task.schema.cache ?? extend.schema.cache;
     task.schema.timeout = task.schema.timeout ?? extend.schema.timeout;
     task.schema.runner = task.schema.runner ?? extend.schema.runner;
+    task.schema.network = task.schema.network ?? extend.schema.network;
+    task.schema.args = task.schema.args ?? extend.schema.args;
     if (!reset.has('cmds'))
         task.schema.cmds = extendArray(task.schema.cmds, extend.schema.cmds);
     if (!reset.has('src'))

package/dist/schema/schema-parser.js

@@ -12,8 +12,9 @@ async function createParseContext(fileName, environment, options) {
     const ctx = {
         files: {},
         refreshed: options?.refresh ? new Map() : undefined,
+        directory: options?.directory,
     };
-    const scope = await appendBuildFile((0, path_1.dirname)(fileName), ctx, environment, fileName, []);
+    const scope = await appendBuildFile(workDirectory(ctx, (0, path_1.dirname)(fileName)), ctx, environment, fileName, []);
     return { ctx, scope };
 }
 exports.createParseContext = createParseContext;
@@ -41,8 +42,8 @@ async function appendBuildFile(cwd, ctx, environment, fileName, namePrefix, remo
             for (const referenceName of Object.keys(scope.schema.references)) {
                 const target = await locateInclude(ctx, scope, scope.schema.references[referenceName], 
                 // a remote file's paths resolve within its repository
-                remote ? (0, path_1.dirname)(scope.fileName) : scope.cwd, environment);
-                const referenceScope = await appendBuildFile((0, path_1.dirname)(target.fileName), ctx, environment, target.fileName, [...namePrefix, referenceName], target.remote, target.inputs);
+                remote ? (0, path_1.dirname)(scope.fileName) : readDirectory(ctx, scope.cwd), environment);
+                const referenceScope = await appendBuildFile(workDirectory(ctx, (0, path_1.dirname)(target.fileName)), ctx, environment, target.fileName, [...namePrefix, referenceName], target.remote, target.inputs);
                 if (scope.references[referenceName]) {
                     throw new Error(referenceName + ' already exists');
                 }
@@ -66,6 +67,18 @@ async function appendBuildFile(cwd, ctx, environment, fileName, namePrefix, remo
     }
 }
 exports.appendBuildFile = appendBuildFile;
+// The directory a build file works in, for the directory it was read from: the same
+// one, unless the files were read from elsewhere (see BuildFileDirectory).
+function workDirectory(ctx, directory) {
+    return ctx.directory ? moveDirectory(directory, ctx.directory.read, ctx.directory.work) : directory;
+}
+// Where the build file of a directory it works in is read from.
+function readDirectory(ctx, directory) {
+    return ctx.directory ? moveDirectory(directory, ctx.directory.work, ctx.directory.read) : directory;
+}
+function moveDirectory(directory, from, to) {
+    return (0, resolve_git_source_1.isWithin)(from, directory) ? (0, path_1.join)(to, (0, path_1.relative)(from, directory)) : directory;
+}
 // A string is a local path below `base`; an object is a git source, fetched once
 // into the include cache. Inside a cached checkout a local path may not leave it:
 // a remote file contributes definitions from its own repository only.

package/dist/schema/work-scope-parser.js

@@ -38,6 +38,11 @@ function getWorkContext(context, scope, environment) {
             workTree.environment = filteredWorkTree.environment;
         }
     }
+    // on a server the operator says where things run (a build file there has no environments)
+    if (environment.hosted?.kubernetes) {
+        workTree.environment = environment.hosted.kubernetes;
+        filteredWorkTree.environment = environment.hosted.kubernetes;
+    }
     // everything is planned before the run is narrowed: planning a service adds
     // its init task's need on it, which narrowing follows
     const tasks = Object.values(context.tasks).map((task) => (0, append_work_task_1.appendWorkTask)(workTree, task.cwd, task, environment, context));

package/dist/secrets/command-secret-provider.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCommandSecretProvider = void 0;
+exports.ownInvocation = exports.getProviderInvocation = exports.createCommandSecretProvider = void 0;
 const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
 const abort_1 = require("../executer/abort");
 const STDERR_LIMIT = 500;
 // Runs the provider's command and takes its stdout, verbatim, as the value: a
@@ -11,20 +13,32 @@ const STDERR_LIMIT = 500;
 // auth login`, the 1Password app) is never picked up, and a missing credential
 // fails instead of falling back to one.
 function createCommandSecretProvider(binding) {
-    const { definition, account } = binding;
     return {
         async resolve(ref, environment) {
-            const [command, ...args] = definition.command.map((part) => expand(part, environment, `provider ${definition.name}`).replace(/\{\{ref\}\}/g, () => ref));
-            const env = {
-                ...minimalEnvironment(environment),
-                ...expandAll(definition.env, environment, `provider ${definition.name}`),
-                ...expandAll(account.env, environment, `account ${account.name}, provider ${definition.name}`),
-            };
-            return run(command, args, env, definition.timeoutMs, environment);
+            const { command, args, env } = getProviderInvocation(binding, ref, environment);
+            return run(command, args, { ...minimalEnvironment(environment), ...env }, binding.definition.timeoutMs, environment);
         },
     };
 }
 exports.createCommandSecretProvider = createCommandSecretProvider;
+/**
+ * The command that reads `ref` as the account of the binding, and the variables of
+ * the provider and the account it runs with: `${NAME}` filled from the environment,
+ * `{{ref}}` as part of one argument. Without PATH, which is the machine's that runs it.
+ */
+function getProviderInvocation(binding, ref, environment) {
+    const { definition, account } = binding;
+    const [command, ...args] = definition.command.map((part) => expand(part, environment, `provider ${definition.name}`).replace(/\{\{ref\}\}/g, () => ref));
+    return {
+        command,
+        args,
+        env: {
+            ...expandAll(definition.env, environment, `provider ${definition.name}`),
+            ...expandAll(account.env, environment, `account ${account.name}, provider ${definition.name}`),
+        },
+    };
+}
+exports.getProviderInvocation = getProviderInvocation;
 function minimalEnvironment(environment) {
     const names = process.platform === 'win32' ? ['PATH', 'Path', 'PATHEXT', 'SystemRoot'] : ['PATH'];
     const result = {};
@@ -57,7 +71,13 @@ function run(command, args, env, timeoutMs, environment) {
             reject(new abort_1.AbortError());
             return;
         }
-        const child = (0, child_process_1.spawn)(command, args, { env, shell: false, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
+        const own = ownInvocation(command, args, env.PATH ?? env.Path);
+        const child = (0, child_process_1.spawn)(own.command, own.args, {
+            env,
+            shell: false,
+            windowsHide: true,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
         const stdout = [];
         const stderr = [];
         let failure = null;
@@ -96,6 +116,49 @@ function run(command, args, env, timeoutMs, environment) {
         });
     });
 }
+const ownBinary = {
+    execPath: process.pkg ? process.execPath : null,
+    entry: (0, path_1.resolve)(__dirname, '..', 'index.js'),
+};
+/**
+ * A release binary (a build of pkg) gives every child PKG_EXECPATH, its own path,
+ * and a child that is the same binary then starts as plain node, loading its first
+ * argument as a script: `hammerkit github-app-token` as a provider fails with
+ * "Cannot find module". So when the command is this binary, by any name on PATH, it
+ * is started the way the server starts its workers: the entry script in front.
+ */
+function ownInvocation(command, args, path, self = ownBinary) {
+    if (self.execPath === null) {
+        return { command, args };
+    }
+    const own = statOf(self.execPath);
+    const found = candidates(command, path).find((candidate) => {
+        const stat = statOf(candidate);
+        return stat && own && stat.dev === own.dev && stat.ino === own.ino;
+    });
+    return found ? { command: self.execPath, args: [self.entry, ...args] } : { command, args };
+}
+exports.ownInvocation = ownInvocation;
+// where spawn looks for the command: a path as it is, a name in each directory of PATH
+function candidates(command, path) {
+    const extensions = process.platform === 'win32' ? ['', ...(process.env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM').split(';')] : [''];
+    const bases = (0, path_1.isAbsolute)(command) || /[\\/]/.test(command)
+        ? [(0, path_1.resolve)(command)]
+        : (path ?? '')
+            .split(path_1.delimiter)
+            .filter((dir) => dir.length > 0)
+            .map((dir) => (0, path_1.resolve)(dir, command));
+    return bases.flatMap((base) => extensions.map((extension) => base + extension));
+}
+function statOf(path) {
+    try {
+        const stat = (0, fs_1.statSync)(path);
+        return stat.isFile() ? stat : null;
+    }
+    catch {
+        return null;
+    }
+}
 // What the CLI said, as the first lines of a failure; its own output may hold a
 // value it was asked for, so it is masked like all output.
 function describeStderr(chunks, environment) {

package/dist/secrets/github-app-token-command.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerGithubAppTokenCommand = void 0;
+const log_1 = require("../log");
+const github_app_token_1 = require("./github-app-token");
+// `hammerkit github-app-token <owner/repo>`: a secret provider command for the token a
+// server reads and pushes a repository with, so the released binary mints it without a
+// script or a runtime of its own. It prints the token and nothing else, without a newline.
+// A failure goes to stderr, which the server puts in its error: the CLI's console writes to
+// stdout, and the server drops what a failed provider printed there.
+function registerGithubAppTokenCommand(program, environment) {
+    program
+        .command('github-app-token <repo>')
+        .description('print an installation token of a GitHub App for one repository (a secret provider command)')
+        .action(async (repo) => {
+        try {
+            environment.stdout.write(await (0, github_app_token_1.githubAppToken)(repo, environment.processEnvs));
+        }
+        catch (e) {
+            environment.stderr.write(`github-app-token: ${(0, log_1.getErrorMessage)(e)}\n`);
+            throw e;
+        }
+    });
+}
+exports.registerGithubAppTokenCommand = registerGithubAppTokenCommand;
+//# sourceMappingURL=github-app-token-command.js.map

package/dist/secrets/github-app-token.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.githubAppToken = void 0;
+const crypto_1 = require("crypto");
+const promises_1 = require("fs/promises");
+const defaultDeps = {
+    fetch: (input, init) => fetch(input, init),
+    readFile: (path) => (0, promises_1.readFile)(path),
+    now: () => Date.now(),
+};
+const CLOUD_PLATFORM = 'https://www.googleapis.com/auth/cloud-platform';
+const METADATA_TOKEN = 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token';
+const REQUEST_TIMEOUT_MS = 20 * 1000;
+/**
+ * An installation token of a GitHub App for one repository (`owner/repo`), as a secret
+ * provider command prints it: the App's key signs a JWT, the JWT asks for a token of the
+ * installation on that repository, limited to it. For an owner alone (`owner`) the token
+ * covers every repository the installation of that owner may reach. The key is read from Google Secret
+ * Manager (`GITHUB_APP_KEY_SECRET`) as the workload's own Google identity, or from a file
+ * (`GITHUB_APP_KEY_FILE`). Errors say which step failed and never hold the key or a token.
+ */
+async function githubAppToken(repo, env, deps = defaultDeps) {
+    const match = /^([A-Za-z0-9-]+)(?:\/([A-Za-z0-9._-]+))?$/.exec(repo);
+    if (!match) {
+        throw new Error(`${repo} is not a repository: name it as owner/repo, or owner for all of an installation`);
+    }
+    const [, owner, name] = match;
+    const appId = env.GITHUB_APP_ID;
+    if (!appId) {
+        throw new Error('GITHUB_APP_ID is not set');
+    }
+    const api = (env.GITHUB_API_URL || 'https://api.github.com').replace(/\/+$/, '');
+    const key = await appKey(env, deps);
+    const now = Math.floor(deps.now() / 1000);
+    // a minute back for the clock of GitHub, and under its limit of ten minutes
+    const unsigned = `${base64url({ alg: 'RS256', typ: 'JWT' })}.${base64url({
+        iat: now - 60,
+        exp: now + 540,
+        iss: appId,
+    })}`;
+    let signature;
+    try {
+        signature = (0, crypto_1.createSign)('RSA-SHA256').update(unsigned).sign(key, 'base64url');
+    }
+    catch {
+        throw new Error('the key of the GitHub App is not an RSA private key in PEM');
+    }
+    const headers = {
+        authorization: `Bearer ${unsigned}.${signature}`,
+        accept: 'application/vnd.github+json',
+        'x-github-api-version': '2022-11-28',
+    };
+    const notInstalled = `the GitHub App ${appId} is not installed on ${repo}`;
+    const installation = name
+        ? await request(deps, `${api}/repos/${repo}/installation`, { headers }, (status) => status === 404 ? notInstalled : `GitHub did not find the App on ${repo}`)
+        : // an organisation, else a user
+            (await request(deps, `${api}/orgs/${owner}/installation`, { headers }, () => `GitHub did not find the App on ${owner}`, true)) ??
+                (await request(deps, `${api}/users/${owner}/installation`, { headers }, (status) => status === 404 ? notInstalled : `GitHub did not find the App on ${owner}`));
+    const created = await request(deps, `${api}/app/installations/${installation.id}/access_tokens`, { method: 'POST', headers, ...(name ? { body: JSON.stringify({ repositories: [name] }) } : {}) }, () => `GitHub did not give the App a token for ${repo}`);
+    if (!created.token) {
+        throw new Error(`GitHub did not give the App a token for ${repo}: the answer has no token`);
+    }
+    return created.token;
+}
+exports.githubAppToken = githubAppToken;
+async function appKey(env, deps) {
+    const secret = env.GITHUB_APP_KEY_SECRET;
+    const file = env.GITHUB_APP_KEY_FILE;
+    if (!!secret === !!file) {
+        throw new Error('set one of GITHUB_APP_KEY_SECRET (a Secret Manager version) and GITHUB_APP_KEY_FILE');
+    }
+    if (file) {
+        try {
+            return await deps.readFile(file);
+        }
+        catch (e) {
+            throw new Error(`could not read GITHUB_APP_KEY_FILE ${file}: ${e.code ?? 'unreadable'}`);
+        }
+    }
+    if (!/^projects\/[^/]+\/secrets\/[^/]+\/versions\/[^/]+$/.test(secret)) {
+        throw new Error('GITHUB_APP_KEY_SECRET is not a version: projects/<project>/secrets/<secret>/versions/<version>');
+    }
+    const accessToken = await googleAccessToken(env, deps);
+    const version = await request(deps, `https://secretmanager.googleapis.com/v1/${secret}:access`, { headers: { authorization: `Bearer ${accessToken}` } }, () => `Secret Manager did not give ${secret}`);
+    if (!version.payload?.data) {
+        throw new Error(`Secret Manager did not give ${secret}: the version has no data`);
+    }
+    return Buffer.from(version.payload.data, 'base64');
+}
+// The workload's own Google identity, without a key of Google's: a federated identity from
+// GOOGLE_APPLICATION_CREDENTIALS (a token file, such as a projected Kubernetes service
+// account token, exchanged at Google's STS), else the metadata server (GCE, Cloud Run, GKE).
+async function googleAccessToken(env, deps) {
+    const path = env.GOOGLE_APPLICATION_CREDENTIALS;
+    if (!path) {
+        const token = await request(deps, METADATA_TOKEN, { headers: { 'metadata-flavor': 'Google' } }, () => 'the metadata server gave no Google token (and GOOGLE_APPLICATION_CREDENTIALS is not set)');
+        return required(token.access_token, 'the metadata server gave no Google token');
+    }
+    let account;
+    try {
+        account = JSON.parse((await deps.readFile(path)).toString('utf8'));
+    }
+    catch {
+        throw new Error(`GOOGLE_APPLICATION_CREDENTIALS ${path} is not a readable JSON file`);
+    }
+    const source = account.credential_source?.file;
+    if (account.type !== 'external_account' || !source || !account.audience) {
+        throw new Error(`GOOGLE_APPLICATION_CREDENTIALS ${path} is not an external_account with a credential_source file; a key of a service account is not taken`);
+    }
+    let subject;
+    try {
+        const content = (await deps.readFile(source)).toString('utf8');
+        const format = account.credential_source?.format;
+        subject = format?.type === 'json' ? JSON.parse(content)[format.subject_token_field_name ?? ''] : content.trim();
+    }
+    catch {
+        throw new Error(`could not read the subject token file ${source} of GOOGLE_APPLICATION_CREDENTIALS`);
+    }
+    if (!subject) {
+        throw new Error(`the subject token file ${source} of GOOGLE_APPLICATION_CREDENTIALS is empty`);
+    }
+    const exchanged = await request(deps, account.token_url ?? 'https://sts.googleapis.com/v1/token', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            grantType: 'urn:ietf:params:oauth:grant-type:token-exchange',
+            audience: account.audience,
+            scope: CLOUD_PLATFORM,
+            requestedTokenType: 'urn:ietf:params:oauth:token-type:access_token',
+            subjectToken: subject,
+            subjectTokenType: account.subject_token_type ?? 'urn:ietf:params:oauth:token-type:jwt',
+        }),
+    }, () => `Google STS did not exchange the token of ${source} for ${account.audience}`);
+    const federated = required(exchanged.access_token, 'Google STS gave no token');
+    if (!account.service_account_impersonation_url) {
+        return federated;
+    }
+    // the pool's identity acts as a service account of Google
+    const impersonated = await request(deps, account.service_account_impersonation_url, {
+        method: 'POST',
+        headers: { authorization: `Bearer ${federated}`, 'content-type': 'application/json' },
+        body: JSON.stringify({ scope: [CLOUD_PLATFORM] }),
+    }, () => 'Google did not let the federated identity act as the service account');
+    return required(impersonated.accessToken, 'Google gave no token of the service account');
+}
+async function request(deps, url, init, failed, missing) {
+    let response;
+    try {
+        response = await deps.fetch(url, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+    }
+    catch (e) {
+        const cause = e.cause?.code ?? (e instanceof Error ? e.message : String(e));
+        throw new Error(`${failed(0)}: ${new URL(url).host} could not be reached (${cause})`);
+    }
+    const text = await response.text();
+    if (missing && response.status === 404) {
+        return undefined;
+    }
+    if (!response.ok) {
+        throw new Error(`${failed(response.status)}: ${response.status} ${said(text)}`.trim());
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${failed(response.status)}: the answer is not JSON`);
+    }
+}
+function said(text) {
+    try {
+        const body = JSON.parse(text);
+        const message = body.message ?? body.error_description ?? body.error?.message ?? body.error;
+        if (typeof message === 'string') {
+            return message.slice(0, 300);
+        }
+    }
+    catch {
+        // not JSON: only the status is said
+    }
+    return '';
+}
+function required(value, message) {
+    if (!value) {
+        throw new Error(message);
+    }
+    return value;
+}
+function base64url(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+//# sourceMappingURL=github-app-token.js.map

package/dist/server/accounts-api.js

@@ -6,7 +6,7 @@ const policy_1 = require("./policy");
 /**
  * Who the caller is and what they may do:
  *
- *   GET /v1/me         identity, accounts with their level, repositories and the builds level
+ *   GET /v1/me         identity, accounts with their level, repositories, the builds level and the sandbox grants
  *   GET /v1/accounts   the accounts the caller has a level on, with what the operator says about them
  */
 async function handleAccounts(config, log, principal, req, res, url) {
@@ -25,7 +25,14 @@ async function handleAccounts(config, log, principal, req, res, url) {
         log(`grant iss=${principal.iss} sub=${principal.sub} accounts=[${accounts
             .map((account) => `${account.name}:${account.level}`)
             .join(',')}] entitlements=[${grant.matched.join(',')}]`);
-        (0, http_1.send)(res, 200, { iss: principal.iss, sub: principal.sub, accounts, repos: grant.repos, builds: grant.builds });
+        (0, http_1.send)(res, 200, {
+            iss: principal.iss,
+            sub: principal.sub,
+            accounts,
+            repos: grant.repos,
+            builds: grant.builds,
+            sandboxes: grant.sandboxes,
+        });
         return true;
     }
     (0, http_1.send)(res, 200, {