nolo-cli 0.1.26 → 0.1.29

package/server/handlers/appDeployStatusStore.ts

@@ -0,0 +1,178 @@
+import serverDb from "../../database/server/db";
+
+export const APP_DEPLOY_JOB_PREFIX = "app-deploy-job-";
+const APP_DEPLOY_LATEST_PREFIX = "app-deploy-latest-";
+const APP_DEPLOY_JOB_TTL_MS = 24 * 60 * 60 * 1000;
+
+export type AppDeployJobStatus =
+  | "pending"
+  | "running"
+  | "succeeded"
+  | "failed";
+
+export interface AppDeployJobStep {
+  id: "prepare" | "preflight" | "build" | "deploy" | "verify";
+  label: string;
+  status: "pending" | "running" | "succeeded" | "failed";
+  detail?: string;
+}
+
+export interface AppDeployJobRecord {
+  jobId: string;
+  userId: string;
+  name?: string;
+  status: AppDeployJobStatus;
+  summary: string;
+  steps: AppDeployJobStep[];
+  createdAt: string;
+  updatedAt: string;
+  expiresAt: string;
+  result?: any;
+  error?: {
+    message: string;
+    code?: string;
+    details?: unknown;
+  };
+}
+
+function buildJobKey(jobId: string) {
+  return `${APP_DEPLOY_JOB_PREFIX}${jobId}`;
+}
+
+function buildLatestKey(userId: string) {
+  return `${APP_DEPLOY_LATEST_PREFIX}${userId}`;
+}
+
+function isExpired(expiresAt: string | undefined): boolean {
+  if (!expiresAt) return false;
+  const ts = Date.parse(expiresAt);
+  return Number.isFinite(ts) && ts <= Date.now();
+}
+
+function parseTimestamp(value: string | undefined): number {
+  const ts = value ? Date.parse(value) : NaN;
+  return Number.isFinite(ts) ? ts : 0;
+}
+
+export function createInitialAppDeploySteps(): AppDeployJobStep[] {
+  return [
+    { id: "prepare", label: "整理部署参数", status: "running" },
+    { id: "preflight", label: "预检代码", status: "pending" },
+    { id: "build", label: "打包应用", status: "pending" },
+    { id: "deploy", label: "发布站点", status: "pending" },
+    { id: "verify", label: "验证访问", status: "pending" },
+  ];
+}
+
+export async function createAppDeployJob(args: {
+  jobId: string;
+  userId: string;
+  name?: string;
+  summary?: string;
+  steps?: AppDeployJobStep[];
+}): Promise<AppDeployJobRecord> {
+  const now = new Date().toISOString();
+  const record: AppDeployJobRecord = {
+    jobId: args.jobId,
+    userId: args.userId,
+    name: args.name,
+    status: "pending",
+    summary: args.summary ?? "部署请求已接收，准备开始…",
+    steps: args.steps ?? createInitialAppDeploySteps(),
+    createdAt: now,
+    updatedAt: now,
+    expiresAt: new Date(Date.now() + APP_DEPLOY_JOB_TTL_MS).toISOString(),
+  };
+  await serverDb.put(buildJobKey(args.jobId), record);
+  await serverDb.put(buildLatestKey(args.userId), {
+    jobId: args.jobId,
+    updatedAt: now,
+  });
+  return record;
+}
+
+export async function getAppDeployJob(jobId: string): Promise<AppDeployJobRecord | null> {
+  try {
+    const record = (await serverDb.get(buildJobKey(jobId))) as AppDeployJobRecord;
+    if (isExpired(record?.expiresAt)) {
+      await serverDb.del(buildJobKey(jobId));
+      return null;
+    }
+    return record;
+  } catch (error: any) {
+    if (error?.notFound) return null;
+    throw error;
+  }
+}
+
+// Per-job promise queue to serialize concurrent patch calls and prevent
+// read-modify-write races when multiple reportProgress calls overlap.
+const patchQueues = new Map<string, Promise<unknown>>();
+
+export async function patchAppDeployJob(
+  jobId: string,
+  patch: Partial<AppDeployJobRecord>
+): Promise<AppDeployJobRecord | null> {
+  const prev = patchQueues.get(jobId) ?? Promise.resolve();
+  const op = prev.catch(() => {}).then(async (): Promise<AppDeployJobRecord | null> => {
+    const current = await getAppDeployJob(jobId);
+    if (!current) return null;
+    const next: AppDeployJobRecord = {
+      ...current,
+      ...patch,
+      updatedAt: new Date().toISOString(),
+    };
+    await serverDb.put(buildJobKey(jobId), next);
+    await serverDb.put(buildLatestKey(next.userId), {
+      jobId,
+      updatedAt: next.updatedAt,
+    });
+    return next;
+  });
+  patchQueues.set(jobId, op);
+  op.finally(() => {
+    if (patchQueues.get(jobId) === op) {
+      patchQueues.delete(jobId);
+    }
+  });
+  return op;
+}
+
+export async function getLatestAppDeployJobId(userId: string): Promise<string | null> {
+  try {
+    const record = (await serverDb.get(buildLatestKey(userId))) as { jobId?: string };
+    return typeof record?.jobId === "string" ? record.jobId : null;
+  } catch (error: any) {
+    if (error?.notFound) return null;
+    throw error;
+  }
+}
+
+export async function resolveLatestAppDeployJobId(userId: string): Promise<{
+  jobId: string | null;
+  ambiguous: boolean;
+}> {
+  const jobs: AppDeployJobRecord[] = [];
+  for await (const [key, value] of serverDb.iterator()) {
+    if (typeof key !== "string" || !key.startsWith(APP_DEPLOY_JOB_PREFIX)) continue;
+    const record = value as AppDeployJobRecord;
+    if (!record || record.userId !== userId) continue;
+    if (isExpired(record.expiresAt)) {
+      await serverDb.del(key);
+      continue;
+    }
+    jobs.push(record);
+  }
+
+  jobs.sort(
+    (a, b) => parseTimestamp(b.updatedAt ?? b.createdAt) - parseTimestamp(a.updatedAt ?? a.createdAt)
+  );
+  const activeJobs = jobs.filter((job) => job.status === "pending" || job.status === "running");
+  if (activeJobs.length > 1) {
+    return { jobId: null, ambiguous: true };
+  }
+  if (activeJobs.length === 1) {
+    return { jobId: activeJobs[0].jobId, ambiguous: false };
+  }
+  return { jobId: jobs[0]?.jobId ?? null, ambiguous: false };
+}

package/server/handlers/appDomainHandler.ts

@@ -0,0 +1,476 @@
+import { resolve4 } from "node:dns/promises";
+import serverDb from "../../database/server/db";
+import { getAppRecord, setAppCustomUrl } from "./appSandboxHandler";
+import { hasSpaceRole } from "./appSpaceAccess";
+import {
+  checkAuthAndConfig,
+  jsonError,
+  jsonOk,
+} from "./appDeployShared";
+
+export const APP_DOMAIN_PREFIX = "app-domain-";
+export const DOMAIN_HOST_PREFIX = "domain-host-";
+export const APP_ROUTE_PREFIX = "app-route-";
+
+export type DomainBindMode = "platform_a";
+
+export interface DomainRecord {
+  hostname: string;
+  mode: DomainBindMode;
+  aRecords: string[];
+  pendingDns: boolean;
+  createdAt: string;
+  updatedAt: string;
+  verifiedAt?: string;
+}
+
+type LegacyDomainRecord = Partial<DomainRecord> & {
+  mode?: string;
+  cfDomainId?: string;
+  cfDnsRecordId?: string;
+  zoneId?: string;
+  cnameTarget?: string;
+  scriptName?: string;
+};
+
+const DOMAIN_HOST_LOCKS = new Map<string, Promise<void>>();
+
+const PLATFORM_HOSTS = new Set([
+  "nolo.chat",
+  "us.nolo.chat",
+  "localhost",
+  "127.0.0.1",
+  "::1",
+  ...(process.env.PLATFORM_SERVER_HOST ? [normalizeHost(process.env.PLATFORM_SERVER_HOST)] : []),
+]);
+
+function normalizeHost(value?: string | null): string {
+  const raw = String(value || "").trim().toLowerCase();
+  if (!raw) return "";
+  if (raw.startsWith("[") && raw.includes("]")) {
+    return raw.slice(1, raw.indexOf("]"));
+  }
+  return raw.split("/")[0].split(":")[0];
+}
+
+function hostnameToSafeKey(hostname: string): string {
+  return hostname.replace(/[^a-z0-9.-]/g, "_");
+}
+
+function buildAppDomainKey(appId: string, hostname: string): string {
+  return `${APP_DOMAIN_PREFIX}${appId}-${hostnameToSafeKey(hostname)}`;
+}
+
+function normalizeARecords(value: unknown): string[] {
+  if (!Array.isArray(value)) return [];
+  return [...new Set(value.map((item) => String(item || "").trim()).filter((item) => isLikelyIpv4(item)))];
+}
+
+function normalizeStoredDomainRecord(
+  rawRecord: LegacyDomainRecord | null | undefined,
+  req?: Request
+): { record: DomainRecord | null; needsWrite: boolean } {
+  const hostname = normalizeHost(rawRecord?.hostname);
+  if (!hostname) return { record: null, needsWrite: false };
+
+  const fallbackNow = new Date().toISOString();
+  const createdAt =
+    typeof rawRecord?.createdAt === "string" && rawRecord.createdAt.trim()
+      ? rawRecord.createdAt
+      : fallbackNow;
+  const updatedAt =
+    typeof rawRecord?.updatedAt === "string" && rawRecord.updatedAt.trim()
+      ? rawRecord.updatedAt
+      : createdAt;
+  const verifiedAt =
+    typeof rawRecord?.verifiedAt === "string" && rawRecord.verifiedAt.trim()
+      ? rawRecord.verifiedAt
+      : undefined;
+
+  const rawARecords = normalizeARecords(rawRecord?.aRecords);
+  const aRecords = rawARecords.length > 0 ? rawARecords : getPlatformDomainARecords(req);
+  const pendingDns =
+    typeof rawRecord?.pendingDns === "boolean" ? rawRecord.pendingDns : true;
+
+  return {
+    record: {
+      hostname,
+      mode: "platform_a",
+      aRecords,
+      pendingDns,
+      createdAt,
+      updatedAt,
+      ...(verifiedAt ? { verifiedAt } : {}),
+    },
+    needsWrite:
+      rawRecord?.hostname !== hostname ||
+      rawRecord?.mode !== "platform_a" ||
+      typeof rawRecord?.pendingDns !== "boolean" ||
+      typeof rawRecord?.updatedAt !== "string" ||
+      (typeof rawRecord?.scriptName === "string" && rawRecord.scriptName.trim().length > 0) ||
+      rawARecords.length !== aRecords.length ||
+      rawARecords.some((ip, index) => ip !== aRecords[index]),
+  };
+}
+
+function isLikelyIpv4(value: string): boolean {
+  return /^(\d{1,3}\.){3}\d{1,3}$/.test(value);
+}
+
+function getPlatformDomainARecords(req?: Request): string[] {
+  const raw =
+    process.env.APP_CUSTOM_DOMAIN_A_RECORDS ||
+    process.env.PLATFORM_CUSTOM_DOMAIN_A_RECORDS ||
+    process.env.PLATFORM_SERVER_IP ||
+    "";
+  if (raw.trim()) {
+    return [...new Set(
+      raw
+        .split(/[,\s]+/)
+        .map((item) => item.trim())
+        .filter((item) => isLikelyIpv4(item))
+    )];
+  }
+
+  try {
+    const host = normalizeHost(new URL(req?.url || "https://nolo.chat").hostname);
+    if (host === "us.nolo.chat") return ["144.202.110.59"];
+    if (host === "nolo.chat") return ["34.81.108.123"];
+    if (host === "localhost" || host === "127.0.0.1") return ["127.0.0.1"];
+  } catch {}
+  return [];
+}
+
+function isPlatformHost(hostname: string): boolean {
+  const normalized = normalizeHost(hostname);
+  if (!normalized) return false;
+  if (PLATFORM_HOSTS.has(normalized)) return true;
+  return normalized.endsWith(".nolo.chat");
+}
+
+function isValidHostname(hostname: string): boolean {
+  if (!hostname || hostname.length > 253) return false;
+  if (hostname.endsWith(".")) return false;
+  const labels = hostname.split(".");
+  if (labels.length < 2) return false;
+  return labels.every((label) =>
+    !!label &&
+    label.length <= 63 &&
+    /^[a-z0-9-]+$/.test(label) &&
+    !label.startsWith("-") &&
+    !label.endsWith("-")
+  );
+}
+
+export async function handleAppDomainAllow(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204 });
+  if (req.method !== "GET") {
+    return new Response("Method not allowed", { status: 405 });
+  }
+
+  const url = new URL(req.url);
+  const hostname = normalizeHost(
+    url.searchParams.get("domain") || url.searchParams.get("hostname")
+  );
+  if (!isValidHostname(hostname) || isPlatformHost(hostname)) {
+    return new Response("denied", { status: 404 });
+  }
+
+  const appId = await serverDb.get(`${DOMAIN_HOST_PREFIX}${hostname}`).catch(() => null);
+  if (typeof appId === "string" && appId.trim()) {
+    return new Response("ok", {
+      status: 200,
+      headers: { "Cache-Control": "no-store" },
+    });
+  }
+
+  return new Response("denied", { status: 404 });
+}
+
+async function resolveHostnameARecords(hostname: string): Promise<string[]> {
+  try {
+    return await resolve4(hostname);
+  } catch {
+    return [];
+  }
+}
+
+async function withHostnameLock<T>(hostname: string, fn: () => Promise<T>): Promise<T> {
+  const previous = DOMAIN_HOST_LOCKS.get(hostname) ?? Promise.resolve();
+  let release!: () => void;
+  const next = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  DOMAIN_HOST_LOCKS.set(hostname, next);
+  return previous
+    .then(fn)
+    .finally(() => {
+      release();
+      if (DOMAIN_HOST_LOCKS.get(hostname) === next) {
+        DOMAIN_HOST_LOCKS.delete(hostname);
+      }
+    });
+}
+
+async function canManageAppDomains(userId: string, appRecord: any): Promise<boolean> {
+  if (!appRecord) return false;
+  if (!appRecord.spaceId) return appRecord.userId === userId;
+  return hasSpaceRole(userId, appRecord.spaceId, "admin");
+}
+
+async function listDomainRecords(
+  appId: string,
+  options: {
+    db?: any;
+    req?: Request;
+    backfill?: boolean;
+  } = {}
+): Promise<DomainRecord[]> {
+  const { db = serverDb, req, backfill = true } = options;
+  const prefix = `${APP_DOMAIN_PREFIX}${appId}-`;
+  const records: DomainRecord[] = [];
+  for await (const [key, value] of db.iterator({
+    gte: prefix,
+    lte: `${prefix}\xff`,
+  })) {
+    const { record, needsWrite } = normalizeStoredDomainRecord(
+      value as LegacyDomainRecord,
+      req
+    );
+    if (!record) continue;
+    if (needsWrite && backfill) {
+      await db.put(String(key), record);
+    }
+    records.push(record);
+  }
+  return records.sort((a, b) => {
+    if (a.pendingDns !== b.pendingDns) return a.pendingDns ? 1 : -1;
+    return a.hostname.localeCompare(b.hostname);
+  });
+}
+
+async function refreshDomainDnsState(
+  appId: string,
+  record: DomainRecord,
+  options: {
+    db?: any;
+  } = {}
+): Promise<DomainRecord> {
+  const { db = serverDb } = options;
+  const resolvedARecords = await resolveHostnameARecords(record.hostname);
+  const pendingDns =
+    record.aRecords.length === 0 ||
+    !record.aRecords.every((ip) => resolvedARecords.includes(ip));
+  if (pendingDns === record.pendingDns) return record;
+  const next: DomainRecord = {
+    ...record,
+    pendingDns,
+    updatedAt: new Date().toISOString(),
+    ...(pendingDns ? {} : { verifiedAt: new Date().toISOString() }),
+  };
+  await db.put(buildAppDomainKey(appId, record.hostname), next);
+  return next;
+}
+
+async function syncPrimaryCustomUrl(
+  appId: string,
+  req?: Request,
+  db: any = serverDb
+): Promise<void> {
+  const records = await listDomainRecords(appId, { db, req });
+  const active = records.find((record) => !record.pendingDns);
+  await setAppCustomUrl(appId, active ? `https://${active.hostname}` : undefined);
+}
+
+async function parseDomainBody(req: Request): Promise<any> {
+  if (req.method === "GET") {
+    const url = new URL(req.url);
+    return {
+      appId: url.searchParams.get("appId") ?? undefined,
+      hostname: url.searchParams.get("hostname") ?? undefined,
+    };
+  }
+  try {
+    return await req.json();
+  } catch {
+    throw new Error("INVALID_JSON");
+  }
+}
+
+function toDomainResponse(record: DomainRecord) {
+  return {
+    hostname: record.hostname,
+    url: `https://${record.hostname}`,
+    mode: record.mode,
+    pendingDns: record.pendingDns,
+    dnsRecordType: "A" as const,
+    aRecords: record.aRecords,
+    verifiedAt: record.verifiedAt,
+  };
+}
+
+export async function handleAppDomainBind(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204 });
+
+  const auth = await checkAuthAndConfig(req);
+  if (auth instanceof Response) return auth;
+
+  let body: any;
+  try {
+    body = await parseDomainBody(req);
+  } catch {
+    return jsonError(400, "请求体必须是合法的 JSON", "INVALID_JSON");
+  }
+
+  const appId = String(body?.appId || "").trim();
+  const hostname = normalizeHost(body?.hostname);
+  if (!appId || !hostname) {
+    return jsonError(400, "缺少 appId 或 hostname", "MISSING_PARAMS");
+  }
+  if (!isValidHostname(hostname)) {
+    return jsonError(400, "域名格式无效", "INVALID_HOSTNAME");
+  }
+  if (isPlatformHost(hostname)) {
+    return jsonError(400, "不能绑定平台内置域名", "INVALID_HOSTNAME");
+  }
+
+  const targetARecords = getPlatformDomainARecords(req);
+  if (targetARecords.length === 0) {
+    return jsonError(500, "平台尚未配置自定义域名 A 记录目标", "DOMAIN_A_RECORDS_NOT_CONFIGURED");
+  }
+
+  const appRecord = await getAppRecord(appId);
+  if (!appRecord) return jsonError(404, "应用不存在", "NOT_FOUND");
+  if (!(await canManageAppDomains(auth.userId, appRecord))) {
+    return jsonError(403, "无权限管理该应用的域名", "FORBIDDEN");
+  }
+
+  return withHostnameLock(hostname, async () => {
+    const hostKey = `${DOMAIN_HOST_PREFIX}${hostname}`;
+    const domainKey = buildAppDomainKey(appId, hostname);
+    const currentOwner = await serverDb.get(hostKey).catch(() => null);
+    if (currentOwner && currentOwner !== appId) {
+      return jsonError(409, "该域名已被其他应用绑定", "HOSTNAME_ALREADY_BOUND");
+    }
+
+    const existing = await serverDb.get(domainKey).catch(() => null) as DomainRecord | null;
+    const resolvedARecords = await resolveHostnameARecords(hostname);
+    const pendingDns = !targetARecords.every((ip) => resolvedARecords.includes(ip));
+    const now = new Date().toISOString();
+    const record: DomainRecord = {
+      hostname,
+      mode: "platform_a",
+      aRecords: targetARecords,
+      pendingDns,
+      createdAt: existing?.createdAt ?? now,
+      updatedAt: now,
+      ...(pendingDns ? {} : { verifiedAt: now }),
+    };
+
+    await Promise.all([
+      serverDb.put(hostKey, appId),
+      serverDb.put(domainKey, record),
+    ]);
+    await syncPrimaryCustomUrl(appId, req);
+
+    return jsonOk({
+      success: true,
+      ...toDomainResponse(record),
+    });
+  });
+}
+
+export async function handleAppDomainUnbind(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204 });
+
+  const auth = await checkAuthAndConfig(req);
+  if (auth instanceof Response) return auth;
+
+  let body: any;
+  try {
+    body = await parseDomainBody(req);
+  } catch {
+    return jsonError(400, "请求体必须是合法的 JSON", "INVALID_JSON");
+  }
+
+  const appId = String(body?.appId || "").trim();
+  const hostname = normalizeHost(body?.hostname);
+  if (!appId || !hostname) {
+    return jsonError(400, "缺少 appId 或 hostname", "MISSING_PARAMS");
+  }
+
+  const appRecord = await getAppRecord(appId);
+  if (!appRecord) return jsonError(404, "应用不存在", "NOT_FOUND");
+  if (!(await canManageAppDomains(auth.userId, appRecord))) {
+    return jsonError(403, "无权限管理该应用的域名", "FORBIDDEN");
+  }
+
+  return withHostnameLock(hostname, async () => {
+    const hostKey = `${DOMAIN_HOST_PREFIX}${hostname}`;
+    const domainKey = buildAppDomainKey(appId, hostname);
+    const currentOwner = await serverDb.get(hostKey).catch(() => null);
+    if (currentOwner === appId) {
+      await serverDb.del(hostKey).catch(() => {});
+    }
+    await serverDb.del(domainKey).catch(() => {});
+    await syncPrimaryCustomUrl(appId, req);
+    return jsonOk({ success: true, appId, hostname, removed: true });
+  });
+}
+
+export async function handleAppDomainList(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204 });
+
+  const auth = await checkAuthAndConfig(req);
+  if (auth instanceof Response) return auth;
+
+  let body: any;
+  try {
+    body = await parseDomainBody(req);
+  } catch {
+    return jsonError(400, "请求体必须是合法的 JSON", "INVALID_JSON");
+  }
+
+  const appId = String(body?.appId || "").trim();
+  if (!appId) return jsonError(400, "缺少 appId", "MISSING_APP_ID");
+
+  const appRecord = await getAppRecord(appId);
+  if (!appRecord) return jsonError(404, "应用不存在", "NOT_FOUND");
+  if (!(await canManageAppDomains(auth.userId, appRecord))) {
+    return jsonError(403, "无权限管理该应用的域名", "FORBIDDEN");
+  }
+
+  const domains = await Promise.all(
+    (await listDomainRecords(appId, { req })).map((record) =>
+      refreshDomainDnsState(appId, record)
+    )
+  );
+  await syncPrimaryCustomUrl(appId, req);
+  return jsonOk({
+    success: true,
+    domains: domains.map(toDomainResponse),
+  });
+}
+
+export async function deleteAppDomains(
+  appId: string,
+  db: any = serverDb
+): Promise<void> {
+  const prefix = `${APP_DOMAIN_PREFIX}${appId}-`;
+  for await (const [domainKey, value] of db.iterator({
+    gte: prefix,
+    lte: `${prefix}\xff`,
+  })) {
+    const hostname = normalizeHost((value as DomainRecord | null)?.hostname);
+    if (hostname) {
+      const hostKey = `${DOMAIN_HOST_PREFIX}${hostname}`;
+      try {
+        const owner = await db.get(hostKey);
+        if (owner === appId) {
+          await db.del(hostKey).catch(() => {});
+        }
+      } catch {}
+    }
+    await db.del(String(domainKey)).catch(() => {});
+  }
+}

package/server/handlers/appLegacyInfraCleanup.ts

@@ -0,0 +1,7 @@
+import serverDb from "../../database/server/db";
+
+export const APP_ROUTE_PREFIX = "app-route-";
+
+export async function deleteLegacyAppInfraRecords(appId: string, db: any = serverDb): Promise<void> {
+  await db.del(`${APP_ROUTE_PREFIX}${appId}`).catch(() => {});
+}