openship 0.6.1 → 0.6.5

package/dist/{chunk-EMXI4UCU.js → chunk-LFCSC4IU.js}

@@ -7,14 +7,14 @@ import {
   localGitSshWriter,
   materializeGitSsh,
   sq
-} from "./chunk-VDDMADOF.js";
+} from "./chunk-TM2IQPYU.js";
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-6ODUBKUB.js";
+} from "./chunk-5OUWIPOB.js";
 import {
   packageManagerEnsureCommand
-} from "./chunk-OTLSJYAC.js";
+} from "./chunk-LEYSL46B.js";
 import {
   __commonJS,
   __toESM
@@ -480,16 +480,34 @@ var require_ignore = __commonJS({
 
 // ../../packages/adapters/src/runtime/docker-paths.ts
 import { access, readdir } from "fs/promises";
-import { isAbsolute, join, relative, sep } from "path";
+import { isAbsolute, join, relative, resolve, sep } from "path";
 function toPosixPath(value) {
   return value.split(sep).filter(Boolean).join("/");
 }
+function toSafeSegments(value, label) {
+  const segments = value.split(/[\\/]/).filter((segment) => segment && segment !== ".");
+  if (segments.includes("..")) {
+    throw new Error(
+      `Invalid ${label} ${JSON.stringify(value)}: path segments must not contain "..".`
+    );
+  }
+  return segments;
+}
 function normalizeDockerRelativePath(value) {
   const normalized = value?.trim().replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
   if (!normalized || normalized === ".") {
     return "";
   }
-  return normalized.split(/[\\/]/).filter(Boolean).join("/");
+  return toSafeSegments(normalized, "path").join("/");
+}
+function resolveWithinDirectory(baseDir, relativePath) {
+  const base = resolve(baseDir);
+  const target = resolve(base, ...toSafeSegments(relativePath?.trim() ?? "", "path"));
+  const escape = relative(base, target);
+  if (escape === ".." || escape.startsWith(`..${sep}`) || isAbsolute(escape)) {
+    throw new Error(`Resolved path ${JSON.stringify(target)} escapes ${JSON.stringify(base)}.`);
+  }
+  return target;
 }
 function normalizeDockerRootDirectory(rootDirectory, localPath) {
   let normalized = rootDirectory?.trim() ?? "";
@@ -509,7 +527,7 @@ function normalizeDockerRootDirectory(rootDirectory, localPath) {
   if (!normalized || normalized === ".") {
     return "";
   }
-  return toPosixPath(normalized);
+  return toSafeSegments(normalized, "rootDirectory").join("/");
 }
 function resolveExplicitDockerfileCandidate(rootDirectory, dockerfilePath) {
   const normalizedRootDirectory = normalizeDockerRelativePath(rootDirectory);
@@ -904,7 +922,7 @@ import { join as join2, relative as relative2, sep as sep2 } from "path";
 var GIT_CLONE_IDLE_TIMEOUT_MS = 5 * 6e4;
 var GIT_CHECKOUT_IDLE_TIMEOUT_MS = 6e4;
 function spawnGit(args, opts) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const child = spawn("git", args, {
       stdio: ["ignore", "pipe", "pipe"],
       env: {
@@ -954,7 +972,7 @@ function spawnGit(args, opts) {
     });
     child.on("close", (code) => {
       clearTimeout(idleTimer);
-      if (code === 0) resolve();
+      if (code === 0) resolve2();
       else reject(new Error(`git exited with code ${code}: ${stderr.trim().slice(-500) || "no stderr"}`));
     });
   });
@@ -1014,7 +1032,7 @@ async function applyDockerignore(contextDir, config) {
 async function materializeLocalSource(sourcePath, targetPath) {
   const { args, cleanup } = await prepareSourceTarArgs(sourcePath);
   try {
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve2, reject) => {
       const create = spawn("tar", args, { env: getTarCreateEnv() });
       const extract = spawn("tar", ["-xzf", "-", "-C", targetPath]);
       let err = "";
@@ -1027,7 +1045,7 @@ async function materializeLocalSource(sourcePath, targetPath) {
       create.on("close", (code) => createCode = code);
       create.stdout.pipe(extract.stdin);
       extract.on("close", (code) => {
-        if (code === 0 && (createCode ?? 0) === 0) return resolve();
+        if (code === 0 && (createCode ?? 0) === 0) return resolve2();
         const parts = [
           createCode ? `pack exited ${createCode}: ${createErr.trim().slice(-500)}` : "",
           code ? `extract exited ${code}: ${err.trim().slice(-500)}` : ""
@@ -1173,6 +1191,7 @@ async function createDockerBuildContext(config, opts) {
 
 export {
   normalizeDockerRelativePath,
+  resolveWithinDirectory,
   resolveDockerfileCandidates,
   staticBuilderOutputPath,
   generateDockerfile,

package/dist/{chunk-JIMUYEKN.js → chunk-MSZUCNPV.js}

@@ -6,7 +6,7 @@ import {
   detectBuildKillHint,
   runBuildPipeline,
   transferLocalDirectory
-} from "./chunk-VDDMADOF.js";
+} from "./chunk-TM2IQPYU.js";
 import {
   LocalExecutor
 } from "./chunk-6FH4AXVY.js";

package/dist/{chunk-YIPMDGG6.js → chunk-PZRRL5PC.js}

@@ -2,12 +2,22 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
+import {
+  envOps,
+  opScript
+} from "./chunk-EZPPTWJQ.js";
+import {
+  resolveEnvironment
+} from "./chunk-WFRXYWK2.js";
 import {
   sq
 } from "./chunk-ZFJXPCQP.js";
 import {
+  SYSTEM,
+  answered,
+  refused,
   safeErrorMessage
-} from "./chunk-OTLSJYAC.js";
+} from "./chunk-LEYSL46B.js";
 
 // ../../packages/adapters/src/infra/openresty-lua.ts
 import { createHash, randomBytes } from "crypto";
@@ -126,6 +136,40 @@ function edgeRealIpConf() {
   }
   return lines.join("\n") + "\n";
 }
+var CLOUD_EDGE_REAL_IP_HEADER = "X-Real-IP";
+function isCloudFrontedHost(hostname) {
+  const host = hostname.trim().toLowerCase().replace(/\.+$/, "");
+  const suffix = `.${SYSTEM.DOMAINS.CLOUD_DOMAIN.toLowerCase()}`;
+  return host.length > suffix.length && host.endsWith(suffix);
+}
+function cloudEdgeRealIpConf(indent = "    ") {
+  const lines = [
+    "# Openship Cloud's edge fronts this free host, so the peer is the edge and the",
+    "# visitor is named in X-Real-IP (which that front OVERWRITES). The http-scope block",
+    "# reads CF-Connecting-IP for Cloudflare-fronted custom domains, and there is one",
+    "# real_ip_header per scope \u2014 hence this override.",
+    "#",
+    "# Trust is scoped to this VHOST instead of to a peer list, deliberately. The Cloud",
+    "# edge reaches origins from its own address, which this box has no way to know and",
+    "# which Cloudflare's ranges (the visitor\u2192edge leg) do not contain \u2014 so a peer list",
+    "# here silently ignores the header and every free-domain visitor stays the edge.",
+    "#",
+    "# What bounds it is the server_name: this block exists only inside a <slug>.opsh.io",
+    "# vhost, a hostname whose only legitimate path is that edge. Someone who reaches this",
+    "# box directly on :80 with a forged Host AND a forged X-Real-IP can choose their own",
+    "# apparent address for THIS vhost \u2014 accepted, because the alternative is the address",
+    "# being wrong for every visitor all the time. Custom domains keep the peer-anchored",
+    "# http-scope block; do not widen this to them.",
+    `real_ip_header ${CLOUD_EDGE_REAL_IP_HEADER};`,
+    // OFF, unlike the http-scope block: the Cloud edge OVERWRITES X-Real-IP with a single
+    // address, so there is no list to walk, and "skip trusted addresses from the right"
+    // has no meaning once every address is trusted.
+    "real_ip_recursive off;",
+    "set_real_ip_from 0.0.0.0/0;",
+    "set_real_ip_from ::/0;"
+  ];
+  return lines.map((l) => `${indent}${l}`).join("\n") + "\n";
+}
 
 // ../../packages/adapters/src/infra/edge-not-found.ts
 var EDGE_UNROUTED_SENTINEL = "openship-edge-unrouted";
@@ -266,6 +310,9 @@ var EDGE_CONTAINER_MOUNTS = [
   { host: `${EDGE_HOST_STATE_DIR}/acme`, container: "/var/www/acme" },
   { host: "/opt/openship/static", container: "/opt/openship/static" }
 ];
+var EDGE_SAME_PATH_MOUNTS = EDGE_CONTAINER_MOUNTS.filter(
+  (m) => m.host === m.container
+).map((m) => m.host.replace(/\/+$/, ""));
 var EDGE_HOST_PATHS = {
   bin: OPENRESTY_DEFAULT_PATHS.bin,
   confPath: OPENRESTY_DEFAULT_PATHS.confPath,
@@ -455,7 +502,7 @@ var MANAGEMENT_BLOCK = `# Openship internal management - analytics & live-log st
 ${EDGE_MGMT_SERVER_BLOCK}
 `;
 var ACME_HTTP01_PORT = 49180;
-var ACME_CHALLENGE_LOCATION = `    location /.well-known/acme-challenge/ {
+var ACME_CHALLENGE_LOCATION = `    location ^~ /.well-known/acme-challenge/ {
         proxy_pass http://127.0.0.1:${ACME_HTTP01_PORT};
         proxy_set_header Host $host;
     }`;
@@ -466,7 +513,7 @@ var EDGE_CHALLENGE_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme/oblien${EDGE_CHALLENG
   /\/$/,
   ""
 );
-var EDGE_CHALLENGE_LOCATION = `    location ${EDGE_CHALLENGE_URL_PREFIX} {
+var EDGE_CHALLENGE_LOCATION = `    location ^~ ${EDGE_CHALLENGE_URL_PREFIX} {
         root ${EDGE_CHALLENGE_ROOT};
         default_type text/plain;
         try_files $uri =404;
@@ -600,27 +647,22 @@ async function ensureLuaScripts(executor, paths) {
   }
 }
 async function installGeoDeps(executor) {
-  try {
-    const hasPkg = async (cmd) => {
-      try {
-        await executor.exec(`command -v ${cmd}`);
-        return true;
-      } catch {
-        return false;
-      }
-    };
-    if (await hasPkg("apt-get")) {
-      await executor.exec(
-        "apt-get update -qq && apt-get install -y -qq libmaxminddb0 libmaxminddb-dev"
+  const profile = await resolveEnvironment(executor).catch((err) => safeErrorMessage(err));
+  const install = typeof profile === "string" ? refused(`the host profile could not be read: ${profile}`) : envOps(profile).pkgInstallVariants({
+    apt: answered(["libmaxminddb0", "libmaxminddb-dev"]),
+    dnf: answered(["libmaxminddb", "libmaxminddb-devel"]),
+    yum: answered(["libmaxminddb", "libmaxminddb-devel"]),
+    apk: answered(["libmaxminddb"]),
+    brew: refused("the bare edge is Linux-only, so Openship has no macOS package for it.")
+  });
+  if (install.supported) {
+    await executor.exec(opScript(install.value)).catch((err) => {
+      console.warn(
+        `[openresty] libmaxminddb install failed \u2014 geo lookups return nil: ${safeErrorMessage(err)}`
       );
-    } else if (await hasPkg("dnf")) {
-      await executor.exec("dnf install -y libmaxminddb libmaxminddb-devel");
-    } else if (await hasPkg("yum")) {
-      await executor.exec("yum install -y libmaxminddb libmaxminddb-devel");
-    } else if (await hasPkg("apk")) {
-      await executor.exec("apk add --no-cache libmaxminddb");
-    }
-  } catch {
+    });
+  } else {
+    console.warn(`[openresty] libmaxminddb not installed \u2014 geo lookups return nil: ${install.reason}`);
   }
   try {
     const exists = await executor.exists(GEOIP_DB_PATH);
@@ -665,6 +707,8 @@ async function deployLuaScripts(executor, paths) {
 }
 
 export {
+  isCloudFrontedHost,
+  cloudEdgeRealIpConf,
   OPENRESTY_LUA_DIR,
   LUA_LOGGER_PATH,
   RULES_GUARD_PATH,
@@ -679,6 +723,7 @@ export {
   EDGE_DEFAULT_CERT_CN,
   EDGE_HOST_STATE_DIR,
   EDGE_CONTAINER_MOUNTS,
+  EDGE_SAME_PATH_MOUNTS,
   EDGE_HOST_PATHS,
   detectOpenRestyPaths,
   buildReloadCommand,