hammerkit 1.27.0-next.8 → 2.0.0-next.1

package/dist/server/dashboard.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleDashboard = exports.HEADERS = exports.DECIDE_WITHIN_MS = void 0;
+const crypto_1 = require("crypto");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const http_1 = require("./http");
+const policy_1 = require("./policy");
+const overview_1 = require("./overview");
+// Approving and publishing take a sign-in of the last minutes: the groups of a session are
+// those of its sign-in, and somebody taken out of a group must not decide for hours.
+exports.DECIDE_WITHIN_MS = 15 * 60000;
+const RUN = 'run_[A-Za-z0-9_-]{16}';
+// a hash of a build file version, checked by the API
+const HASH = '[A-Za-z0-9:_-]{1,200}';
+const path = (pattern) => new RegExp(`^/v1/${pattern}$`);
+// what the pages read
+const READS = [
+    'me',
+    'overview',
+    'capacity',
+    'tasks',
+    'runs',
+    `runs/${RUN}`,
+    `runs/${RUN}/logs`,
+    'approvals',
+    `approvals/${RUN}`,
+    'proposals',
+    `proposals/${HASH}`,
+    `proposals/${HASH}/files`,
+].map(path);
+// what the buttons do
+const ACTIONS = [`runs/${RUN}/(cancel|extend)`].map(path);
+// what needs a recent sign-in
+const DECISIONS = [`approvals/${RUN}/(approve|reject)`, `proposals/${HASH}/(approve|reject)`].map(path);
+exports.HEADERS = {
+    'cache-control': 'no-store',
+    'x-robots-tag': 'noindex',
+    // the app is a script and a style sheet of its own host, and talks to its host only
+    'content-security-policy': "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; " +
+        "font-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
+    'x-frame-options': 'DENY',
+    'referrer-policy': 'no-referrer',
+    'x-content-type-options': 'nosniff',
+};
+const TYPES = {
+    '.js': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.woff2': 'font/woff2',
+    '.png': 'image/png',
+};
+async function handleDashboard(context, principal, req, res, url) {
+    const now = context.now ?? Date.now;
+    const grant = (0, policy_1.getGrant)(context.config.entitlements, principal);
+    const viewer = { principal, grant, activity: context.config.runs.activity === 'everyone' };
+    const pathname = url.pathname;
+    for (const [name, value] of Object.entries(exports.HEADERS)) {
+        res.setHeader(name, value);
+    }
+    if (pathname === '/api' || pathname.startsWith('/api/')) {
+        if (grant.matched.length === 0) {
+            return (0, http_1.send)(res, 403, { error: 'you are not entitled to anything on this server' });
+        }
+        return api(context, principal, viewer, now(), req, res, url);
+    }
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+        return (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET, HEAD' });
+    }
+    return asset(context, req, res, pathname);
+}
+exports.handleDashboard = handleDashboard;
+async function api(context, principal, viewer, now, req, res, url) {
+    const { grant } = viewer;
+    const csrf = context.sign(`dashboard\0csrf\0${principal.iss}\0${principal.sub}\0${context.session ?? 'token'}`);
+    const method = req.method ?? 'GET';
+    if (url.pathname === '/api/session') {
+        if (method !== 'GET') {
+            return (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+        }
+        const session = {
+            iss: principal.iss,
+            sub: principal.sub,
+            observe: grant.observe,
+            seesOthers: grant.observe || (0, overview_1.seesActivity)(viewer),
+            publishes: (0, policy_1.mayPublish)(grant),
+            csrf,
+            ...(context.signedInAt !== undefined
+                ? { decideUntil: new Date(context.signedInAt + exports.DECIDE_WITHIN_MS).toISOString() }
+                : {}),
+            decideWithinMinutes: exports.DECIDE_WITHIN_MS / 60000,
+        };
+        return (0, http_1.send)(res, 200, session);
+    }
+    const download = new RegExp(`^/api/runs/(${RUN})/log\\.txt$`).exec(url.pathname);
+    if (download) {
+        if (method !== 'GET') {
+            return (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+        }
+        return logText(context, viewer, res, download[1], url.searchParams.get('task') ?? undefined);
+    }
+    const target = url.pathname.slice('/api'.length);
+    const read = READS.some((pattern) => pattern.test(target));
+    const action = ACTIONS.some((pattern) => pattern.test(target));
+    const decision = DECISIONS.some((pattern) => pattern.test(target));
+    if (!read && !action && !decision) {
+        return (0, http_1.send)(res, 404, { error: 'not found' });
+    }
+    if (method === 'GET' || method === 'HEAD') {
+        if (!read) {
+            return (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+        }
+    }
+    else if (method === 'POST' && (action || decision)) {
+        // a page of another site can not set the header, nor read the token
+        const given = Buffer.from(String(req.headers['x-hammerkit-csrf'] ?? ''));
+        const expected = Buffer.from(csrf);
+        if (given.length !== expected.length || !(0, crypto_1.timingSafeEqual)(given, expected)) {
+            return (0, http_1.send)(res, 403, { error: 'the page is out of date, open it again' });
+        }
+        // an API token is new; a sign-in in the browser has to be of the last minutes to decide
+        if (decision && context.signedInAt !== undefined && now - context.signedInAt > exports.DECIDE_WITHIN_MS) {
+            return (0, http_1.send)(res, 403, {
+                error: `approving and rejecting take a sign-in of the last ${exports.DECIDE_WITHIN_MS / 60000} minutes`,
+                signInAgain: true,
+            });
+        }
+        context.log(`dashboard ${method} ${target} iss=${principal.iss} sub=${principal.sub}`);
+    }
+    else {
+        return (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: read ? 'GET' : 'POST' });
+    }
+    const forwarded = new URL(`${target}${url.search}`, 'http://localhost');
+    return context.api(principal, req, res, forwarded);
+}
+// The log as a text file: what the tasks printed, as they printed it.
+function logText(context, viewer, res, id, task) {
+    const run = context.registry.peek(id);
+    // the log is for the owner of the run, who decides about it and observe
+    const logs = run && (0, overview_1.maySee)(viewer, run) && (0, overview_1.mayRead)(viewer, run) ? context.registry.logsOf(id) : undefined;
+    if (!run || !logs) {
+        return (0, http_1.send)(res, 404, { error: 'not found' });
+    }
+    const names = logs.index.names();
+    const chosen = task !== undefined && names.includes(task) ? task : undefined;
+    const lines = [];
+    const selected = chosen ? logs.index.lines(chosen) : undefined;
+    const total = selected ? selected.length : logs.index.size;
+    for (let position = 0; position < total; position++) {
+        const line = logs.index.text(logs.events, selected ? selected[position] : position);
+        lines.push(chosen ? line.text : `[${line.task}] ${line.text}`);
+    }
+    if (logs.truncated) {
+        lines.push('[hammerkit] the log was cut off at runs.maxLogBytes');
+    }
+    res.writeHead(200, {
+        'content-type': 'text/plain; charset=utf-8',
+        'content-disposition': `attachment; filename="${run.id}${chosen ? `-${chosen.replace(/[^A-Za-z0-9._-]/g, '_')}` : ''}.log"`,
+    });
+    res.end(lines.join('\n') + (lines.length > 0 ? '\n' : ''));
+}
+// The files of the app: its scripts and styles by their hashed names, and index.html for
+// every page, which the app draws.
+async function asset(context, req, res, pathname) {
+    const root = context.assets ?? (0, path_1.join)(__dirname, '..', 'dashboard');
+    const file = /^\/assets\/[A-Za-z0-9_-][A-Za-z0-9._-]{0,200}$/.test(pathname)
+        ? pathname.slice(1)
+        : pathname === '/favicon.svg'
+            ? 'favicon.svg'
+            : pathname.startsWith('/assets/') || pathname.startsWith('/.')
+                ? undefined
+                : 'index.html';
+    if (!file) {
+        return (0, http_1.send)(res, 404, { error: 'not found' });
+    }
+    let content;
+    try {
+        content = await (0, promises_1.readFile)((0, path_1.join)(root, file));
+    }
+    catch {
+        if (file === 'index.html') {
+            res.writeHead(503, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('The dashboard of this server was not built (npm run build:dashboard).\n');
+            return;
+        }
+        return (0, http_1.send)(res, 404, { error: 'not found' });
+    }
+    const extension = /\.[a-z0-9]+$/.exec(file)?.[0] ?? '';
+    res.writeHead(200, {
+        'content-type': file === 'index.html' ? 'text/html; charset=utf-8' : TYPES[extension] ?? 'application/octet-stream',
+        // the names of the scripts and styles change with what they hold
+        ...(file.startsWith('assets/') ? { 'cache-control': 'public, max-age=31536000, immutable' } : {}),
+    });
+    res.end(req.method === 'HEAD' ? undefined : content);
+}
+//# sourceMappingURL=dashboard.js.map

package/dist/server/definitions-api.js

@@ -5,6 +5,7 @@ const zod_1 = require("zod");
 const bundle_1 = require("../remote/bundle");
 const definitions_1 = require("./definitions");
 const http_1 = require("./http");
+const run_plan_1 = require("./run-plan");
 const oauth_1 = require("./oauth");
 const policy_1 = require("./policy");
 const proposals_1 = require("./proposals");
@@ -19,12 +20,25 @@ const MAX_PUBLISH_BYTES = bundle_1.MAX_BUNDLE_BYTES * 2;
  *                                        `annotations`, which are not part of the hash
  *   GET  /v1/definitions                 the versions, newest first; `?<key>=<value>`
  *                                        keeps the ones with those annotations
- *   GET  /v1/definitions/<hash>          one version
+ *   GET  /v1/definitions/<hash>          one version, with `arguments`: per task null when
+ *                                        a run of it may pass arguments, else why not
  *   GET  /v1/definitions/<hash>/files    its files
+ *   POST /v1/definitions/plan            what publishing a bundle would do: plans it with this
+ *                                        server's policy and stores nothing. For anybody with
+ *                                        a `builds` level, `run` too
  *   POST /v1/definitions/<hash>/yank     pull it back (body: optional {reason})
  *   POST /v1/definitions/<hash>/unyank   let it go on
  */
 async function handleDefinitions(config, store, proposals, log, principal, req, res, url) {
+    if (url.pathname === '/v1/definitions/plan') {
+        if (req.method !== 'POST') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+        }
+        else {
+            await plan(config, store, log, principal, req, res);
+        }
+        return true;
+    }
     const match = /^\/v1\/definitions(?:\/([^/]+)(\/files|\/yank|\/unyank)?)?$/.exec(url.pathname);
     if (!match) {
         return false;
@@ -72,7 +86,7 @@ async function handleDefinitions(config, store, proposals, log, principal, req,
         bundle ? (0, http_1.send)(res, 200, bundle) : (0, http_1.send)(res, 404, { error: 'not found' });
     }
     else {
-        (0, http_1.send)(res, 200, found);
+        (0, http_1.send)(res, 200, found.plan ? { ...found, arguments: (0, run_plan_1.describeArguments)(found.plan, config.runs) } : found);
     }
     return true;
 }
@@ -122,6 +136,55 @@ async function yank(config, store, log, principal, hash, undo, req, res) {
     log(`${undo ? 'unyank' : 'yank'} ${hash} iss=${principal.iss} sub=${principal.sub}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
     (0, http_1.send)(res, 200, changed);
 }
+// Answers what POST /v1/definitions would: the version with its plan, and whether the
+// caller would publish or propose it. A developer checks a build file against the policy
+// before the account that publishes does. Nothing is stored, nothing is logged but the call.
+async function plan(config, store, log, principal, req, res) {
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    if (grant.builds === null) {
+        (0, http_1.send)(res, 403, { error: 'you may not check build files, it needs builds: run, propose or publish' });
+        return;
+    }
+    const parsed = bundle_1.bundleSchema.safeParse(await (0, http_1.readJson)(req, MAX_PUBLISH_BYTES));
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return;
+    }
+    try {
+        // like a proposal: a caller who may not publish does not make the server fetch
+        const { version, existing } = await store.prepare(parsed.data, principal, {
+            noRemote: (0, policy_1.mayPublish)(grant) ? undefined : 'check',
+        });
+        const missing = (version.accounts ?? []).filter((account) => !(0, policy_1.canUse)(grant, account));
+        const outcome = existing
+            ? 'already published'
+            : (0, policy_1.mayPublish)(grant) && missing.length === 0
+                ? 'published'
+                : (0, policy_1.mayPublish)(grant) || (0, policy_1.mayPropose)(grant)
+                    ? 'proposed'
+                    : null;
+        log(`plan ${version.hash} iss=${principal.iss} sub=${principal.sub} tasks=${version.tasks.length}`);
+        (0, http_1.send)(res, 200, {
+            hash: version.hash,
+            tasks: version.tasks,
+            services: version.services,
+            plan: version.plan,
+            accounts: version.accounts,
+            outcome,
+            // a yanked version is not checked again: it is the one that was published
+            ...(existing?.yanked ? { yanked: true } : {}),
+            ...(missing.length > 0 ? { missing } : {}),
+        });
+    }
+    catch (e) {
+        if (e instanceof definitions_1.DefinitionError) {
+            (0, http_1.send)(res, 400, { error: `the build file does not load: ${e.message}` });
+            return;
+        }
+        throw e;
+    }
+}
 async function publish(config, store, proposals, log, principal, req, res) {
     const grant = (0, policy_1.getGrant)(config.entitlements, principal);
     if (!(0, policy_1.mayPublish)(grant) && !(0, policy_1.mayPropose)(grant)) {
@@ -149,7 +212,7 @@ async function publish(config, store, proposals, log, principal, req, res) {
         // a version can't run before it is approved, but it has to load, as it would
         // have when published, so the approver is not asked about a broken one
         const { version, existing } = await store.prepare(parsed.data, principal, {
-            noRemote: !(0, policy_1.mayPublish)(grant),
+            noRemote: (0, policy_1.mayPublish)(grant) ? undefined : 'proposal',
             annotations,
         });
         if (existing) {