querysub 0.654.0 → 0.656.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "querysub",
-  "version": "0.654.0",
+  "version": "0.656.0",
   "main": "index.js",
   "license": "MIT",
   "note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",
@@ -79,7 +79,7 @@
     "node-forge": "https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6",
     "pako": "^2.1.0",
     "peggy": "^5.0.6",
-    "sliftutils": "^1.7.127",
+    "sliftutils": "^1.7.128",
     "socket-function": "^1.2.34",
     "terser": "^5.31.0",
     "typenode": "^6.6.1",

package/src/-g-core-values/NodeCapabilities.ts

@@ -14,7 +14,7 @@ import { formatTime } from "socket-function/src/formatting/format";
 import type { DebugFunctionShardInfo } from "../3-path-functions/PathFunctionRunner";
 import type { AuthoritySpec } from "../0-path-value-core/PathRouter";
 import { requiresNetworkTrustHook } from "../-d-trust/NetworkTrust2";
-import { isNoNetwork } from "../config";
+import { isNoNetwork, isPublic } from "../config";
 import { getDomain } from "../config";
 import { getDebuggerUrl } from "../diagnostics/listenOnDebugger";
 import { hackDevtoolsWebsocketForward } from "./oneTimeForward";
@@ -176,10 +176,12 @@ class NodeCapabilitiesControllerBase {
     }
 
     public async getInspectURL() {
+        assertAssistedDebugConnectionAllowed();
         return await getDebuggerUrl();
     }
 
     public async exposeExternalDebugPortOnce(forExternalIP: string) {
+        assertAssistedDebugConnectionAllowed();
         // https://notdevtools.com/devtools/inspector.html?experiments=true&v8only=true&ws=127.0.0.1:62448/22895aed-f8da-4dfb-8d50-e432a9c2d827
         let debugURL = await this.getInspectURL();
 
@@ -203,6 +205,13 @@ class NodeCapabilitiesControllerBase {
 }
 let lastExposed: (() => void) | undefined;
 
+/** The assisted debug connection (opening the inspector, forwarding the port externally, TLS proxying) only exists because public servers can't be reached directly - on a non-public server the debugger can be attached directly, and the forwarding machinery would only add attack surface. */
+export function assertAssistedDebugConnectionAllowed() {
+    if (!isPublic()) {
+        throw new Error(`Non-public server, connect directly. Don't use this assisted connection code.`);
+    }
+}
+
 
 let getFunctionRunnerShards = () => [] as DebugFunctionShardInfo[];
 export function set_debug_getFunctionRunnerShards(fnc: () => DebugFunctionShardInfo[]) {

package/src/deployManager/components/MachineDetailPage.tsx

@@ -1,6 +1,6 @@
 import { SocketFunction } from "socket-function/SocketFunction";
 import { qreact } from "../../4-dom/qreact";
-import { MACHINE_RESYNC_INTERVAL, MachineServiceController, ServiceConfig, getMachineIdList } from "../machineSchema";
+import { MACHINE_RESYNC_INTERVAL, MachineServiceController, ServiceConfig, getMachineIdList, getMachineInfoLive } from "../machineSchema";
 import { css } from "typesafecss";
 import { currentViewParam, selectedMachineIdParam, selectedServiceIdParam } from "../urlParams";
 import { formatNumber, formatVeryNiceDateTime } from "socket-function/src/formatting/format";
@@ -19,7 +19,7 @@ export class MachineDetailPage extends qreact.Component {
         if (!selectedMachineId) return <div>No machine selected</div>;
 
         let controller = MachineServiceController(SocketFunction.browserNodeId());
-        let machineInfo = controller.getMachineInfo(selectedMachineId);
+        let machineInfo = getMachineInfoLive(selectedMachineId);
         let serviceList = controller.getServiceList();
         let machineConfig = controller.getMachineConfig(selectedMachineId);
 

package/src/deployManager/components/MachinePicker.tsx

@@ -6,7 +6,7 @@ import { isDefined } from "../../misc";
 import { formatTime } from "socket-function/src/formatting/format";
 import { css } from "typesafecss";
 import { Querysub } from "../../4-querysub/Querysub";
-import { MachineServiceController, getLiveServiceParameters, getMachineTargets, applyCommandTemplate } from "../machineSchema";
+import { MachineServiceController, getLiveServiceParameters, getMachineTargets, applyCommandTemplate, getMachineInfoLive } from "../machineSchema";
 import { FUNCTION_RUNNER_COMMAND_PREFIX } from "../serviceCategories";
 
 module.hotreload = true;
@@ -53,7 +53,7 @@ export class MachinePicker extends qreact.Component<{
 }> {
     render() {
         let controller = MachineServiceController(SocketFunction.browserNodeId());
-        let machines = (controller.getMachineList() || []).map(x => controller.getMachineInfo(x)).filter(isDefined);
+        let machines = (controller.getMachineList() || []).map(x => getMachineInfoLive(x)).filter(isDefined);
         sort(machines, x => -x.heartbeat);
 
         let networksPerMachine = getMachineNetworks(controller);

package/src/deployManager/components/MachinesListPage.tsx

@@ -1,6 +1,6 @@
 import { SocketFunction } from "socket-function/SocketFunction";
 import { qreact } from "../../4-dom/qreact";
-import { MACHINE_RESYNC_INTERVAL, MachineServiceController } from "../machineSchema";
+import { MACHINE_RESYNC_INTERVAL, MachineServiceController, getMachineInfoLive } from "../machineSchema";
 import { css } from "typesafecss";
 import { t } from "../../2-proxy/schema2";
 import { Querysub } from "../../4-querysub/Querysub";
@@ -26,7 +26,7 @@ export class MachinesListPage extends qreact.Component {
 
         if (!machineList) return <div>Loading machines...</div>;
 
-        let machines = machineList.map(machineId => [machineId, controller.getMachineInfo(machineId)] as const).filter(x => x[1]);
+        let machines = machineList.map(machineId => [machineId, getMachineInfoLive(machineId)] as const).filter(x => x[1]);
         sort(machines, x => -(x[1]?.heartbeat || 0));
 
         let machineConfigs = controller.getMachineConfigList();

package/src/deployManager/components/ServiceDetailPage.tsx

@@ -1,6 +1,6 @@
 import { SocketFunction } from "socket-function/SocketFunction";
 import { qreact } from "../../4-dom/qreact";
-import { DEFAULT_OVERLAP_TIME, MACHINE_RESYNC_INTERVAL, MachineServiceController, ServiceConfig, ServiceParameters, applyCommandTemplate, getCommandTemplateVariables, getLiveServiceParameters, getMachineTargets, setMachineTargets, stripReleaseState } from "../machineSchema";
+import { DEFAULT_OVERLAP_TIME, MACHINE_RESYNC_INTERVAL, MachineServiceController, ServiceConfig, ServiceParameters, applyCommandTemplate, getCommandTemplateVariables, getLiveServiceParameters, getMachineInfoLive, getMachineTargets, setMachineTargets, stripReleaseState } from "../machineSchema";
 import { css } from "typesafecss";
 import { t } from "../../2-proxy/schema2";
 import { Querysub } from "../../4-querysub/Querysub";
@@ -121,7 +121,7 @@ export class ServiceDetailPage extends qreact.Component {
 
         return <div className={css.vbox(8).fillWidth}>
             {[...machineGroups.entries()].map(([machineId, group]) => {
-                let ip = controller.getMachineInfo(machineId)?.info["getExternalIP"];
+                let ip = getMachineInfoLive(machineId)?.info["getExternalIP"];
                 if (typeof ip !== "string") {
                     ip = "";
                 }
@@ -226,7 +226,7 @@ export class ServiceDetailPage extends qreact.Component {
         let machineStatuses = machineTargets.map(({ machineId, variables }) => {
             let index = nextIndexes.get(machineId) || 0;
             nextIndexes.set(machineId, index + 1);
-            let machineInfo = controller.getMachineInfo(machineId);
+            let machineInfo = getMachineInfoLive(machineId);
             let machineConfig = controller.getMachineConfig(machineId);
             const serviceInfo = machineInfo?.services[selectedServiceId || ""];
             const isMachineDead = machineInfo ? Date.now() - machineInfo.heartbeat > (MACHINE_RESYNC_INTERVAL * 4) : true;
@@ -248,7 +248,7 @@ export class ServiceDetailPage extends qreact.Component {
         sort(machineStatuses, x => (x.isDisabled ? 3 : x.hasError ? 0 : x.isMachineDead ? 1 : 2) * 1000000 + x.heartbeat);
         let now = Querysub.nowDelayed(timeInSecond);
 
-        let machines = (controller.getMachineList() || []).map(x => controller.getMachineInfo(x)).filter(isDefined);
+        let machines = (controller.getMachineList() || []).map(x => getMachineInfoLive(x)).filter(isDefined);
         sort(machines, x => -x.heartbeat);
 
         return <div className={css.vbox(16).fillWidth}>

package/src/deployManager/components/ServicesListPage.tsx

@@ -1,6 +1,6 @@
 import { SocketFunction } from "socket-function/SocketFunction";
 import { qreact } from "../../4-dom/qreact";
-import { DEFAULT_OVERLAP_TIME, MachineServiceController, ServiceConfig, getLiveServiceParameters, getMachineIdList } from "../machineSchema";
+import { DEFAULT_OVERLAP_TIME, MachineServiceController, ServiceConfig, getLiveServiceParameters, getMachineIdList, getMachineInfoLive } from "../machineSchema";
 import { css } from "typesafecss";
 import { t } from "../../2-proxy/schema2";
 import { Querysub } from "../../4-querysub/Querysub";
@@ -62,7 +62,7 @@ export class ServicesListPage extends qreact.Component {
         let services = serviceList.map(serviceId => [serviceId, controller.getServiceConfig(serviceId)] as const);
         sort(services, x => -(x[1]?.info.lastUpdatedTime || Date.now()) - (x[1]?.parameters.deploy && (Number.MAX_SAFE_INTEGER / 2) || 0));
 
-        let getMachineInfo = cache((machineId: string) => controller.getMachineInfo(machineId));
+        let getMachineInfo = cache((machineId: string) => getMachineInfoLive(machineId));
         let getMachineConfig = cache((machineId: string) => controller.getMachineConfig(machineId));
 
         let keyCounts = new Map<string, number>();

package/src/deployManager/machineSchema.ts

@@ -9,7 +9,7 @@ import { getSyncedController } from "../library-components/SyncedController";
 import { requiresNetworkTrustHook } from "../-d-trust/NetworkTrust2";
 import { extractType } from "../misc/extractType";
 import { getOwnMachineId } from "sliftutils/misc/https/certs";
-import { delay, runInSerial, runInfinitePollCallAtStart } from "socket-function/src/batching";
+import { delay, runInSerial, runInfinitePoll, runInfinitePollCallAtStart } from "socket-function/src/batching";
 import { lazy } from "socket-function/src/caching";
 import { errorToUndefinedSilent } from "../errors";
 import { commitAndPush, getGitDiff, getGitRefInfo, getGitRefLive, getGitURLLive, getGitUncommitted, getLatestRefOnUpstreamBranch, setGitRef } from "../4-deploy/git";
@@ -704,3 +704,20 @@ export const MachineServiceController = getSyncedController(
         }
     }
 );
+
+const MACHINE_INFO_REFRESH_INTERVAL = timeInMinute * 5;
+let accessedMachineInfoIds = new Set<string>();
+const startMachineInfoRefreshLoop = lazy(() => {
+    runInfinitePoll(MACHINE_INFO_REFRESH_INTERVAL, () => {
+        let controller = MachineServiceController(SocketFunction.browserNodeId());
+        for (let id of accessedMachineInfoIds) {
+            controller.getMachineInfo.refresh(id);
+        }
+    });
+});
+/** Machine infos only change via heartbeats, which nothing on the client invalidates, so a page left open shows an ever-older heartbeat and eventually flags a healthy machine as likely dead. All UI reads go through here: the first access starts a loop that keeps refreshing every machine that has ever been accessed (refreshes are cheap, and this way nothing polls unless the data was actually used). */
+export function getMachineInfoLive(machineId: string): MachineInfo | undefined {
+    accessedMachineInfoIds.add(machineId);
+    startMachineInfoRefreshLoop();
+    return MachineServiceController(SocketFunction.browserNodeId()).getMachineInfo(machineId);
+}

package/src/deployManager/setupMachineMain.ts

@@ -4,6 +4,7 @@ import { Querysub } from "../4-querysub/Querysub";
 import { runPromise } from "../functional/runCommand";
 import fs from "fs";
 import os from "os";
+import path from "path";
 import readline from "readline";
 import open from "open";
 import { fsExistsAsync } from "../fs";
@@ -575,8 +576,37 @@ sudo systemctl start ${SERVICE_UNIT_NAME}
     console.log(`   Screen:  ssh ${sshRemote} -t "tmux attach -t ${SERVICE_NAME}"`);
     console.log(`   Status:  ssh ${sshRemote} "systemctl status ${SERVICE_UNIT_NAME}"`);
 
+    await runMachineDeployHook(sshRemote);
+
     console.log("\n🎉 Machine setup complete!");
 }
 
+async function runMachineDeployHook(sshRemote: string) {
+    let hookPathBase = path.resolve("./machineDeploy");
+    let hookExists = false;
+    for (let extension of [".ts", ".tsx", ".js"]) {
+        if (await fsExistsAsync(hookPathBase + extension)) {
+            hookExists = true;
+            break;
+        }
+    }
+    if (!hookExists) {
+        console.log(`No machineDeploy file at ${hookPathBase}, skipping the application deploy hook`);
+        return;
+    }
+    console.log(`Running the machineDeploy hook at ${hookPathBase}`);
+    try {
+        let hookModule = await import(hookPathBase) as { machineDeploy?: (config: { sshRemote: string }) => Promise<void> };
+        if (!hookModule.machineDeploy) {
+            throw new Error(`Expected ${hookPathBase} to export machineDeploy, exports are: ${Object.keys(hookModule).join(", ") || "(none)"}`);
+        }
+        await hookModule.machineDeploy({ sshRemote });
+        console.log("✅ machineDeploy hook finished");
+    } catch (e) {
+        console.error((e as Error).stack || String(e));
+        console.error(`⚠️  The machineDeploy hook failed (see the error above). This is fine if the synchronization database hasn't been set up yet, or isn't running.`);
+    }
+}
+
 
 main().catch(console.error).finally(() => process.exit(0));

package/src/diagnostics/MachineThreadInfo.tsx

@@ -10,7 +10,7 @@ import { assertIsNetworkTrusted } from "../-d-trust/NetworkTrust2";
 import { runPromise } from "../functional/runCommand";
 import { errorToUndefinedSilent } from "../errors";
 import { decodeNodeId } from "sliftutils/misc/https/certs";
-import { getDomain } from "../config";
+import { getDomain, isPublic } from "../config";
 import { keyBy, keyByArray, timeInSecond, timeoutToUndefined, timeoutToUndefinedSilent } from "socket-function/src/misc";
 import dns from "dns";
 import { isDefined } from "../misc";
@@ -239,7 +239,8 @@ class MachineThreadInfoBase {
             hostname: hostname?.trim() || "",
             entrypoint: process.argv[1] || "",
             aliveTime: aliveTime,
-            inspectURL: await getDebuggerUrl(),
+            // Only public servers hand out an inspect URL - getDebuggerUrl opens the inspector port as a side effect, and on a non-public server the debugger should be attached directly instead
+            inspectURL: isPublic() && await getDebuggerUrl() || "",
         };
     }
 

package/src/diagnostics/NodeViewer.tsx

@@ -5,7 +5,7 @@ import { getAllNodeIds, getBrowserUrlNode, syncNodesNow } from "../../src/-f-nod
 import { errorToUndefined, errorToUndefinedSilent, logErrors, timeoutToError } from "../../src/errors";
 import { QuerysubController } from "../../src/4-querysub/QuerysubController";
 import { Querysub } from "../../src/4-querysub/Querysub";
-import { NodeCapabilitiesController, getControllerNodeIdList } from "../../src/-g-core-values/NodeCapabilities";
+import { NodeCapabilitiesController, assertAssistedDebugConnectionAllowed, getControllerNodeIdList } from "../../src/-g-core-values/NodeCapabilities";
 import { lazy } from "socket-function/src/caching";
 import { atomicObjectWrite } from "../../src/2-proxy/PathValueProxyWatcher";
 import { Button } from "../../src/library-components/Button";
@@ -355,6 +355,7 @@ class NodeViewerControllerBase {
     }
 
     public async getExternalInspectURL(nodeId: string) {
+        assertAssistedDebugConnectionAllowed();
         // TODO: Replace this with a an HTTPS => HTTP proxy, adding a secret time based key
         //  - Needs to run in another process
         //  - Key will use machine hash(secret key + time mod interval). Will last for 2X interval, so at
@@ -482,6 +483,7 @@ class NodeViewerControllerBase {
     }
 
     public async getInspectURL(nodeId: string) {
+        assertAssistedDebugConnectionAllowed();
         return await NodeCapabilitiesController.nodes[nodeId].getInspectURL();
     }