hammerkit 1.27.0-next.13 → 1.27.0-next.15

package/dist/server/service-runs.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mayOpenEndpoints = exports.getRunRepo = exports.toRunEndpoints = exports.refuseEndpoints = exports.getEndpointHosts = exports.getServiceRunName = void 0;
+const crypto_1 = require("crypto");
+const plan_1 = require("./plan");
+const policy_1 = require("./policy");
+const run_request_1 = require("./run-request");
+// The name of a service run when the request names none: the branch it runs from, as a DNS
+// label, so the runs of several branches stand side by side and each keeps its hosts.
+function getServiceRunName(branch) {
+    const name = (branch ?? '')
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/-+/g, '-')
+        .slice(0, 40)
+        .replace(/^-+|-+$/g, '');
+    return run_request_1.SERVICE_RUN_NAME_PATTERN.test(name) ? name : 'run';
+}
+exports.getServiceRunName = getServiceRunName;
+/**
+ * The host labels of a run's endpoints: its name, the port and twelve hex digits of its
+ * owner (at most 40 + 5 + 2 + 12 and three dashes: a DNS label), so two callers with a branch of the same name get hosts of their own, and a run
+ * that replaces another of the same name takes over its hosts. Two endpoints on the same
+ * port (of two services) are told apart by their place.
+ */
+function getEndpointHosts(name, owner, endpoints) {
+    const of = (0, crypto_1.createHash)('sha256').update(`${owner.iss}\0${owner.sub}`).digest('hex').slice(0, 12);
+    return endpoints.map((endpoint, index) => endpoints.findIndex((other) => other.port === endpoint.port) === index
+        ? `${name}-${endpoint.port}-${of}`
+        : `${name}-${endpoint.port}-${index}-${of}`);
+}
+exports.getEndpointHosts = getEndpointHosts;
+// The container port of each `host:container` port of a planned service.
+function containerPorts(plan) {
+    return plan.ports.map((port) => Number(port.split(':').pop()));
+}
+/**
+ * Why the endpoints of a service run can't be published, or null. Each is a port its
+ * service declares, of a service the run starts. Under a `runs.secretNetwork` below `open`
+ * a service behind an endpoint may not read a secret or a credential of the server: a page
+ * is a way out that no mask of the log covers.
+ */
+function refuseEndpoints(request, plan, secretNetworkOpen) {
+    for (const endpoint of request.endpoints) {
+        const item = plan[endpoint.service];
+        if (!item || item.kind !== 'service') {
+            return `the endpoint ${endpoint.service}:${endpoint.port} names no service the run starts`;
+        }
+        if (!containerPorts(item).includes(endpoint.port)) {
+            const ports = containerPorts(item);
+            return `${endpoint.service} has no port ${endpoint.port}${ports.length > 0 ? `, its ports are ${ports.join(', ')}` : ', it declares none'}`;
+        }
+        const reads = (0, plan_1.getCredentialReads)(item);
+        if (!secretNetworkOpen && reads.length > 0) {
+            return `${endpoint.service} reads ${reads.join(', ')}, it can not be behind an endpoint on this server (runs.secretNetwork): a page could show it`;
+        }
+    }
+    return null;
+}
+exports.refuseEndpoints = refuseEndpoints;
+function toRunEndpoints(endpoints, hosts, url) {
+    return endpoints.map((endpoint, index) => ({
+        service: endpoint.service,
+        port: endpoint.port,
+        host: hosts[index],
+        url: url(hosts[index]),
+    }));
+}
+exports.toRunEndpoints = toRunEndpoints;
+// The repository of a run's source, which the endpoints grants are written for.
+function getRunRepo(run) {
+    return run.source.type === 'upload' ? null : run.source.repo;
+}
+exports.getRunRepo = getRunRepo;
+// Who may open the endpoints of a service run, and extend it, besides its owner: those
+// with an `open` or `publish` level for its repository.
+function mayOpenEndpoints(grant, run) {
+    const repo = getRunRepo(run);
+    return repo !== null && (0, policy_1.endpointLevel)(grant, repo) !== null;
+}
+exports.mayOpenEndpoints = mayOpenEndpoints;
+//# sourceMappingURL=service-runs.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.13",
+  "version": "1.27.0-next.15",
   "keywords": [
     "build",
     "build-tool",