openship 0.6.6 → 0.6.8

package/dist/{chunk-QVW76WDL.js → chunk-IAMOUDHY.js}

@@ -17,26 +17,30 @@ import {
   detectOpenRestyPaths,
   edgeChallengeVhostConf,
   isCloudFrontedHost,
-  luaSourceAvailable
-} from "./chunk-RSR7PFIQ.js";
+  luaSourceAvailable,
+  reloadBareOpenResty
+} from "./chunk-7PEXM2UI.js";
 import {
   edgeDownExplanation,
   explainEdgeDown,
   isEdgeDownFailure
 } from "./chunk-I3DPMTSF.js";
+import {
+  probeHostedHttp
+} from "./chunk-R4VDPFLS.js";
 import {
   EXECUTOR_DELEGATE
-} from "./chunk-UVNMQM7W.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   logEntry,
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-P7RCYELG.js";
 import {
   edgeFailureReason
-} from "./chunk-2YM3NI2E.js";
+} from "./chunk-X53JXRS4.js";
 import {
   probeListeningPort
-} from "./chunk-SM26HDS2.js";
+} from "./chunk-BO6CY4V2.js";
 import {
   PROXY_DIRECTIVES,
   parseProxyValue,
@@ -44,7 +48,7 @@ import {
   resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {
@@ -294,21 +298,49 @@ async function readDeclaredPair(exec, certPath, keyPath, container) {
 }
 
 // ../../packages/adapters/src/system/output-exists.ts
-function buildCommand(servedPath) {
+var SAFE_HOST = /^[A-Za-z0-9][A-Za-z0-9.-]{0,252}$/;
+var SAFE_PATH = /^\/[A-Za-z0-9._~/-]*$/;
+function safeRequestPath(path) {
+  return SAFE_PATH.test(path) && !path.split("/").includes("..");
+}
+function buildCommand(servedPath, opts) {
   const p = servedPath.replace(/'/g, "'\\''");
-  return [
+  const parts = [
     `if [ -e '${p}' ]; then echo FOUND; fi`,
-    `if [ -f '${p}' ] || [ -f '${p}/index.html' ]; then echo INDEX; fi`,
-    "true"
-  ].join("; ");
+    `if [ -f '${p}' ] || [ -f '${p}/index.html' ]; then echo INDEX; fi`
+  ];
+  const host = opts?.hostname;
+  const path = opts?.requestPath ?? "/";
+  if (host && SAFE_HOST.test(host) && safeRequestPath(path)) {
+    const port = opts?.edgePort ?? 80;
+    const maxTime = opts?.timeoutSeconds ?? 3;
+    parts.push(
+      `if command -v curl >/dev/null 2>&1; then echo "HTTP $(curl -sS -o /dev/null -w '%{http_code} %{num_connects}' --max-time ${maxTime} -H 'Host: ${host}' -H 'X-Forwarded-Proto: https' 'http://127.0.0.1:${port}${path}' 2>/dev/null)"; fi`
+    );
+  }
+  parts.push("true");
+  return parts.join("; ");
+}
+function statusIsServed(status) {
+  if (status >= 200 && status < 400) return true;
+  return status === 401 || status === 403;
 }
-async function probeStaticOutput(executor, servedPath) {
+function parseHttp(out) {
+  const match = /(^|\n)HTTP (\d+) (\d+)(\r?\n|$)/.exec(out);
+  if (!match) return {};
+  const status = Number(match[2]);
+  const connects = Number(match[3]);
+  if (!Number.isFinite(status) || status === 0 || connects === 0) return {};
+  return { status, served: statusIsServed(status) };
+}
+async function probeStaticOutput(executor, servedPath, opts) {
   try {
-    const out = await executor.exec(buildCommand(servedPath), { timeout: 5e3 });
+    const out = await executor.exec(buildCommand(servedPath, opts), { timeout: 8e3 });
     return {
       found: /(^|\n)FOUND(\r?\n|$)/.test(out),
       hasIndex: /(^|\n)INDEX(\r?\n|$)/.test(out),
-      checked: true
+      checked: true,
+      ...parseHttp(out)
     };
   } catch {
     return { found: false, hasIndex: false, checked: false };
@@ -562,7 +594,7 @@ function acmeKeyArgs(keyType) {
       return [];
   }
 }
-var DOMAIN_RE = /^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/;
+var DOMAIN_RE = /^(\*\.)?[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/;
 function assertValidDomain(domain) {
   if (!DOMAIN_RE.test(domain) || domain.length > 253) {
     throw new Error(`Invalid domain: ${domain}`);
@@ -570,7 +602,9 @@ function assertValidDomain(domain) {
 }
 function assertNoNginxInjection(value, what) {
   if (/[\s;{}#\\'"]/.test(value)) {
-    throw new Error(`Invalid ${what} (contains characters that could inject nginx config): ${value}`);
+    throw new Error(
+      `Invalid ${what} (contains characters that could inject nginx config): ${value}`
+    );
   }
 }
 function assertNoRuntimeVariable(value, what, allowCaptures = false) {
@@ -667,7 +701,9 @@ function certbotDiagnosis(output, domain) {
     diagnosis = `Couldn't start the certificate challenge listener for ${domain} on port ${ACME_HTTP01_PORT}: something on this server is already holding it. That port is used only while a certificate is being issued, so this is almost always a certificate run from an earlier attempt that hasn't exited \u2014 retry, and if it persists find the holder with \`ss -ltnp | grep ${ACME_HTTP01_PORT}\` and stop it. Nothing was requested from Let's Encrypt, so this is not a DNS or routing problem.`;
   } else if (/timeout during connect|connection refused|failed to connect|Timeout/i.test(text)) {
     diagnosis = `Port 80 for ${domain} isn't reachable from the internet \u2014 a firewall / cloud security group is blocking it, the domain doesn't point at this server, or another proxy is still bound to :80.`;
-  } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(text)) {
+  } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(
+    text
+  )) {
     diagnosis = `${domain} doesn't resolve to this server yet \u2014 the DNS A record is missing or hasn't propagated. Wait for propagation, then retry from the Domains tab.`;
   } else if (/\b52[56]\b|ssl handshake failed/i.test(text)) {
     diagnosis = `Cloudflare's proxy is answering the certificate challenge for ${domain} instead of forwarding it to this server: it redirects the request to HTTPS, then rejects the origin's TLS. Fix it one of three ways \u2014 set SSL/TLS \u2192 Overview to "Full" (not "Full (strict)") until the first certificate is issued, or turn the orange cloud off for this record until it is, or upload a Cloudflare Origin CA certificate from the Domains tab and skip Let's Encrypt entirely.`;
@@ -690,6 +726,7 @@ var NginxProvider = class {
   acmeTosAgreed;
   certDir;
   executor;
+  paths;
   reloadCommand;
   pinPaths;
   containerEdge;
@@ -713,8 +750,9 @@ var NginxProvider = class {
     this.acmeTosAgreed = opts.acmeTosAgreed ?? true;
     this.certDir = opts.certDir ?? DEFAULT_CERT_DIR;
     this.executor = opts.executor ?? null;
+    this.paths = opts.paths;
     this.containerEdge = opts.containerEdge ?? false;
-    this.reloadCommand = buildReloadCommand(opts.paths, { containerEdge: this.containerEdge });
+    this.reloadCommand = buildReloadCommand(opts.paths);
     this.pinPaths = opts.pinPaths ?? false;
     this.challengeDir = opts.challengeDir ?? EDGE_CHALLENGE_DIR;
   }
@@ -979,8 +1017,19 @@ var NginxProvider = class {
    *
    * Advisory: never throws.
    */
-  async probeStaticRoot(servedPath) {
-    if (this.executor) return probeStaticOutput(this.executor, servedPath);
+  async probeStaticRoot(servedPath, opts) {
+    if (this.executor) return probeStaticOutput(this.executor, servedPath, opts);
+    const fs = await this.probeStaticRootViaFs(servedPath);
+    if (!opts?.hostname) return fs;
+    const http = await probeHostedHttp({
+      hostname: opts.hostname,
+      path: opts.requestPath ?? "/",
+      port: opts.edgePort ?? 80,
+      timeoutMs: (opts.timeoutSeconds ?? 3) * 1e3
+    });
+    return http ? { ...fs, status: http.status, served: http.served } : fs;
+  }
+  async probeStaticRootViaFs(servedPath) {
     const found = await this._exists(servedPath);
     if (!found) return { found: false, hasIndex: false, checked: true };
     const isFile = await fsStat(servedPath).then((s) => s.isFile()).catch(() => false);
@@ -1052,6 +1101,31 @@ eab-hmac-key = ${this.acmeEabHmacKey}
     }
     return path;
   }
+  /** Materialize generated DNS hooks on the same target where Certbot runs. */
+  async createEphemeralDnsHooks(opts) {
+    if (!opts?.dnsAuthHookScript) return null;
+    const dir = join(dirname(this.certDir), `.openship-dns-${randomBytes(12).toString("hex")}`);
+    const authPath = join(dir, "auth.sh");
+    const cleanupPath = join(dir, "cleanup.sh");
+    const recordPath = join(dir, "record-id.txt");
+    await this._mkdir(dir);
+    try {
+      await this._chmod(dir, 448);
+      await this._writeFile(authPath, opts.dnsAuthHookScript, 448);
+      if (opts.dnsCleanupHookScript) {
+        await this._writeFile(cleanupPath, opts.dnsCleanupHookScript, 448);
+      }
+    } catch (err) {
+      await this._rm(dir).catch(() => void 0);
+      throw err;
+    }
+    const recordEnv = `OPENSHIP_DNS_RECORD_FILE=${sq(recordPath)}`;
+    return {
+      dir,
+      authCommand: `${recordEnv} ${sq(authPath)}`,
+      cleanupCommand: opts.dnsCleanupHookScript ? `${recordEnv} ${sq(cleanupPath)}` : void 0
+    };
+  }
   async _captureFile(path) {
     if (!await this._exists(path)) {
       return { exists: false };
@@ -1305,7 +1379,9 @@ ${serveLocation}
    */
   async _lsSites() {
     if (!this.executor) return fsReaddir(this.sitesDir);
-    const out = await this.executor.exec(`ls -1 ${sq(this._commandSitesDir())} 2>/dev/null || true`);
+    const out = await this.executor.exec(
+      `ls -1 ${sq(this._commandSitesDir())} 2>/dev/null || true`
+    );
     return out.split("\n").map((l) => l.trim()).filter(Boolean);
   }
   /**
@@ -1368,8 +1444,11 @@ ${serveLocation}
    * from the old in-memory config (an inconsistent half-state that would silently
    * vanish on the next unrelated reload). The error is re-thrown for retry.
    */
-  async removeRoute(domain) {
+  async removeRoute(domain, opts) {
     assertValidDomain(domain);
+    if (opts?.signal?.aborted) {
+      throw new Error(`Route removal aborted before it started: ${domain}`);
+    }
     const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
     const statePath = this.routeStatePath(slug);
@@ -1378,11 +1457,20 @@ ${serveLocation}
     await this._rm(configPath);
     await this._rm(statePath).catch(() => void 0);
     try {
-      await this.reload();
+      await this.reload({ allowStopped: true });
     } catch (err) {
-      await this._restoreFile(configPath, confSnapshot);
-      await this._restoreFile(statePath, stateSnapshot);
-      await this.reload().catch(() => void 0);
+      try {
+        if (!opts?.signal?.aborted) await this._restoreFile(configPath, confSnapshot);
+        if (!opts?.signal?.aborted) await this._restoreFile(statePath, stateSnapshot);
+        if (!opts?.signal?.aborted) {
+          await this.reload({ allowStopped: true }).catch(() => void 0);
+        }
+      } finally {
+        if (opts?.signal?.aborted) {
+          await this._rm(configPath).catch(() => void 0);
+          await this._rm(statePath).catch(() => void 0);
+        }
+      }
       throw err;
     }
     await this._rm(this.bootstrapCertDir(domain)).catch(() => void 0);
@@ -1489,31 +1577,47 @@ ${serveLocation}
     const emailArgs = validEmail ? ["--email", this.acmeEmail] : ["--register-unsafely-without-email"];
     let certonlyOut = "";
     const eabConfig = await this.createEphemeralEabConfig();
+    let generatedDnsHooks = null;
     try {
-      certonlyOut = await this._execCertbot([
-        ...eabConfig ? ["--config", eabConfig] : [],
+      generatedDnsHooks = await this.createEphemeralDnsHooks(opts);
+      const isDnsChallenge = opts?.challenge === "dns-01" || domain.startsWith("*.");
+      const challengeArgs = isDnsChallenge ? [
         "certonly",
-        "--standalone",
-        "--http-01-port",
-        String(ACME_HTTP01_PORT),
-        "--cert-name",
-        domain,
-        "-d",
-        domain,
-        ...this.acmeDirectoryUrl ? ["--server", this.acmeDirectoryUrl] : [],
-        ...acmeKeyArgs(this.acmeKeyType),
-        ...emailArgs,
-        ...this.acmeTosAgreed ? ["--agree-tos"] : [],
-        "--non-interactive",
-        // Forced reissue: certbot would otherwise print "not due for renewal"
-        // (exit 0) when a lineage exists, leaving the stale cert in place.
-        ...opts?.force ? ["--force-renewal"] : []
-      ], opts?.onLog);
+        "--manual",
+        "--preferred-challenges",
+        "dns",
+        ...generatedDnsHooks?.authCommand || opts?.dnsAuthHook ? ["--manual-auth-hook", generatedDnsHooks?.authCommand ?? opts.dnsAuthHook] : [],
+        ...generatedDnsHooks?.cleanupCommand || opts?.dnsCleanupHook ? [
+          "--manual-cleanup-hook",
+          generatedDnsHooks?.cleanupCommand ?? opts.dnsCleanupHook
+        ] : []
+      ] : ["certonly", "--standalone", "--http-01-port", String(ACME_HTTP01_PORT)];
+      certonlyOut = await this._execCertbot(
+        [
+          ...eabConfig ? ["--config", eabConfig] : [],
+          ...challengeArgs,
+          "--cert-name",
+          domain,
+          "-d",
+          domain,
+          ...this.acmeDirectoryUrl ? ["--server", this.acmeDirectoryUrl] : [],
+          ...acmeKeyArgs(this.acmeKeyType),
+          ...emailArgs,
+          ...this.acmeTosAgreed ? ["--agree-tos"] : [],
+          "--non-interactive",
+          // Forced reissue: certbot would otherwise print "not due for renewal"
+          // (exit 0) when a lineage exists, leaving the stale cert in place.
+          ...opts?.force ? ["--force-renewal"] : []
+        ],
+        opts?.onLog
+      );
     } catch (err) {
       const raw = this.redactAcmeSecrets(safeErrorMessage(err));
       let summary = summarizeCertbotFailure(raw, domain);
       if (isAcmePortBindFailure(raw) && this.executor) {
-        const occupant = await probeListeningPort(this.executor, ACME_HTTP01_PORT).catch(() => null);
+        const occupant = await probeListeningPort(this.executor, ACME_HTTP01_PORT).catch(
+          () => null
+        );
         if (occupant) {
           summary += ` Currently held by ${occupant.command}` + (occupant.pid !== null ? ` (pid ${occupant.pid})` : "") + (occupant.systemdUnit ? ` via ${occupant.systemdUnit}` : "") + `.`;
         }
@@ -1521,6 +1625,7 @@ ${serveLocation}
       throw new Error(summary);
     } finally {
       if (eabConfig) await this._rm(dirname(eabConfig)).catch(() => void 0);
+      if (generatedDnsHooks) await this._rm(generatedDnsHooks.dir).catch(() => void 0);
     }
     const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
@@ -1588,24 +1693,24 @@ ${tail}` : "")
   /**
    * Renew a TLS certificate using certbot.
    */
-  async renewCert(domain) {
+  async renewCert(domain, opts) {
     assertValidDomain(domain);
+    if (opts?.challenge === "dns-01" || domain.startsWith("*.")) {
+      return this.provisionCert(domain, { ...opts, challenge: "dns-01", force: true });
+    }
     if (!await this.certsExist(domain)) {
-      return this.provisionCert(domain);
+      return this.provisionCert(domain, opts);
     }
     if (!await this.hasCertbotLineage(domain)) {
-      return this.provisionCert(domain, { force: true });
+      return this.provisionCert(domain, { ...opts, force: true });
     }
     if (!await this.lineageServerMatches(domain)) {
-      return this.provisionCert(domain, { force: true });
+      return this.provisionCert(domain, { ...opts, force: true });
     }
-    await this._execCertbot([
-      "renew",
-      "--cert-name",
-      domain,
-      ...acmeKeyArgs(this.acmeKeyType),
-      "--non-interactive"
-    ]);
+    await this._execCertbot(
+      ["renew", "--cert-name", domain, ...acmeKeyArgs(this.acmeKeyType), "--non-interactive"],
+      opts?.onLog
+    );
     await this.reload();
     return this.readCertInfo(domain);
   }
@@ -1763,23 +1868,42 @@ ${tail}` : "")
    * config may move). Re-detecting on every reload keeps the provider
    * in sync without requiring an API restart.
    */
-  async reload() {
+  async reload(opts = {}) {
     if (this.executor) {
       if (!this.pinPaths) {
         try {
           const freshPaths = await detectOpenRestyPaths(this.executor);
+          this.paths = freshPaths;
           this.sitesDir = freshPaths.sitesDir;
           this.nginxVersion = freshPaths.nginxVersion ?? this.nginxVersion;
-          this.reloadCommand = buildReloadCommand(freshPaths, {
-            containerEdge: this.containerEdge
-          });
+          this.reloadCommand = buildReloadCommand(freshPaths);
         } catch {
         }
       }
-      await this.executor.exec(this.reloadCommand);
+      if (this.containerEdge) {
+        await this.executor.exec(this.reloadCommand, { timeout: 15e3 });
+      } else {
+        await reloadBareOpenResty(this.executor, this.paths, {
+          allowStopped: opts.allowStopped ?? false
+        });
+      }
+      return;
+    }
+    if (this.containerEdge) {
+      await execFileAsync("sh", ["-lc", this.reloadCommand], { timeout: 15e3 });
       return;
     }
-    await execFileAsync("sh", ["-lc", this.reloadCommand]);
+    const localExecutor = {
+      exec: async (command, execOpts) => {
+        const { stdout } = await execFileAsync("sh", ["-lc", command], {
+          timeout: execOpts?.timeout
+        });
+        return String(stdout);
+      }
+    };
+    await reloadBareOpenResty(localExecutor, this.paths, {
+      allowStopped: opts.allowStopped ?? false
+    });
   }
   async certsExist(domain) {
     const certPath = join(this.certDir, domain, "fullchain.pem");
@@ -1961,7 +2085,9 @@ ${geoEntries.join("\n")}
     if (!foundDesiredInclude) {
       const httpIndex = nextLines.findIndex((line) => /^\s*http\s*\{\s*$/.test(line));
       if (httpIndex === -1) {
-        throw new Error(`Failed to ensure rate-limit include: ${confPath} is missing an http block`);
+        throw new Error(
+          `Failed to ensure rate-limit include: ${confPath} is missing an http block`
+        );
       }
       const indent = nextLines[httpIndex].match(/^\s*/)?.[0] ?? "";
       nextLines.splice(httpIndex + 1, 0, `${indent}    ${desiredIncludeLine}`);