spinuptui 0.28.0 → 1.1.0

package/src/lib/cliIncidents.ts

@@ -35,6 +35,13 @@ const KIND_FIELDS: Array<[keyof KumaMonitorRef, IncidentKind]> = [
   ["bypassId", "bypass"],
 ]
 
+// Does this ref name at least one monitor `resolveIncidents` would query? A ref
+// can outlive its monitors (removing one deletes its id, not the entry), so an
+// entry's mere presence isn't the answer.
+export function hasIncidentMonitors(ref: KumaMonitorRef | undefined): boolean {
+  return !!ref && KIND_FIELDS.some(([field]) => typeof ref[field] === "number")
+}
+
 interface Target {
   domain: string
   kind: IncidentKind

package/src/lib/cliSiblings.ts

@@ -0,0 +1,181 @@
+// `spinuptui siblings <domain>` — every site sharing a server with this one,
+// for external tooling (e.g. an incident-diagnostics agent handed one domain).
+//
+// The motivating case: a server's vanity host pages on `?healthz`, but the
+// vanity site is an empty placeholder — the load is always a co-tenant, and
+// site isolation means the vanity user can't read the neighbour's logs. The
+// agent needs to know who else lives on the box, and which of them it can
+// actually SSH into, before it can find the request-level cause. Answering that
+// from the API takes two calls; discovering it by hand took weeks.
+
+import type { AppConfig } from "../config.ts"
+import type { Server, Site } from "../api/types.ts"
+import type { SpinupWPClientLike } from "../api/client.ts"
+import { ApiError } from "../api/client.ts"
+import {
+  resolveSiteByDomain,
+  probeSshTarget,
+  type SshAccessReason,
+  type SshAccessCandidate,
+  type SshProbeStatus,
+} from "./cliSsh.ts"
+import { hasIncidentMonitors } from "./cliIncidents.ts"
+import { resolveSiteSshTarget } from "./probe.ts"
+import { isVanityPair } from "./vanitySite.ts"
+
+// Why a co-tenant's logs may be out of reach. `ok` means this device's key is
+// accepted for that site user; `permission_denied` is the one worth acting on
+// (grant the key with K in the Browser view) and the usual reason a neighbour's
+// access log can't be read.
+export type SiblingSshStatus = SshProbeStatus
+
+export interface SiblingSite {
+  domain: string
+  siteUser: string | null
+  sshTarget: string
+  isWordPress: boolean
+  phpVersion: string | null
+  pageCache: boolean | null
+  // The site living at the server's own hostname — a placeholder whose monitors
+  // report on the whole box, so its pages are rarely about itself.
+  isVanity: boolean
+  // Has Uptime Kuma monitors registered through SpinupTUI, so `spinuptui
+  // incidents <domain>` will return something for it.
+  monitored: boolean
+  // The domain that was asked about, so a caller can tell itself apart from the
+  // neighbours without re-matching on additional domains.
+  isQuery: boolean
+  // Only present with --probe.
+  ssh?: SiblingSshStatus
+  sshMessage?: string
+}
+
+export interface SiblingsServer {
+  id: number
+  name: string
+  ip: string | null
+  // Needed alongside each site's sshTarget; null means the default, 22.
+  sshPort: number | null
+  provider: string | null
+  size: string | null
+  ubuntuVersion: string | null
+}
+
+export type SiblingsResult =
+  | {
+      ok: true
+      domain: string
+      primaryDomain: string
+      server: SiblingsServer
+      siteCount: number
+      sites: SiblingSite[]
+    }
+  | {
+      ok: false
+      domain: string
+      reason: SshAccessReason
+      message: string
+      remedy?: string
+      candidates?: SshAccessCandidate[]
+    }
+
+// Every probe hits the same sshd, so they're capped rather than all fired at
+// once: OpenSSH's default MaxStartups (10:30:100) starts dropping connections
+// that are still authenticating past 10, which would turn a big server's
+// result into random connection failures. A small burst of refused logins is
+// also gentler on any fail2ban-style guard watching that sshd.
+const PROBE_CONCURRENCY = 4
+
+async function mapLimit<T, R>(items: T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]> {
+  const out = new Array<R>(items.length)
+  let next = 0
+  const worker = async () => {
+    while (next < items.length) {
+      const i = next++
+      out[i] = await fn(items[i]!)
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker))
+  return out
+}
+
+function describe(site: Site, server: Server, cfg: AppConfig, queryId: number): SiblingSite {
+  return {
+    domain: site.domain,
+    siteUser: site.site_user,
+    sshTarget: resolveSiteSshTarget(site, server, cfg.sshUser),
+    isWordPress: site.is_wordpress,
+    phpVersion: site.php_version,
+    pageCache: site.page_cache ? site.page_cache.enabled : null,
+    isVanity: isVanityPair(site.domain, server.name),
+    monitored: hasIncidentMonitors(cfg.kumaMonitors[site.domain]),
+    isQuery: site.id === queryId,
+  }
+}
+
+export async function resolveSiblings(
+  domain: string,
+  client: SpinupWPClientLike,
+  cfg: AppConfig,
+  opts?: { server?: string | null; probe?: boolean },
+): Promise<SiblingsResult> {
+  const resolved = await resolveSiteByDomain(domain, client, cfg, { server: opts?.server ?? null })
+  if (!resolved.ok) return resolved.result
+
+  const { site, server } = resolved
+
+  let siteList: Site[]
+  try {
+    siteList = await client.listSites(server.id)
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      return {
+        ok: false,
+        domain,
+        reason: "token_rejected",
+        message: "Saved API token was rejected (401) — it may be expired or revoked.",
+        remedy: "Run `spinuptui login` to save a fresh token.",
+      }
+    }
+    const message = err instanceof ApiError ? err.message : `Unexpected error: ${(err as Error).message}`
+    return { ok: false, domain, reason: "api_error", message }
+  }
+
+  // The vanity host first, then the queried site, then alphabetically: a reader
+  // scanning the list sees what the box calls itself before its tenants.
+  const sorted = [...siteList].sort((a, b) => {
+    const rank = (s: Site) =>
+      isVanityPair(s.domain, server.name) ? 0 : s.id === site.id ? 1 : 2
+    return rank(a) - rank(b) || a.domain.localeCompare(b.domain)
+  })
+
+  const sites = sorted.map((s) => describe(s, server, cfg, site.id))
+  const port = server.ssh_port && server.ssh_port !== 22 ? server.ssh_port : null
+
+  // resolveSiteByDomain has already refused a server with no IP, so every
+  // sshTarget here is a real user@ip.
+  if (opts?.probe) {
+    const probes = await mapLimit(sites, PROBE_CONCURRENCY, (s) => probeSshTarget(s.sshTarget, port))
+    probes.forEach((p, i) => {
+      sites[i]!.ssh = p.status
+      if (p.message) sites[i]!.sshMessage = p.message
+    })
+  }
+
+  return {
+    ok: true,
+    domain,
+    primaryDomain: site.domain,
+    server: {
+      id: server.id,
+      name: server.name,
+      ip: server.ip_address,
+      sshPort: port,
+      provider: server.provider_name,
+      size: server.size,
+      ubuntuVersion: server.ubuntu_version,
+    },
+    siteCount: sites.length,
+    sites,
+  }
+}

package/src/lib/cliSsh.ts

@@ -169,15 +169,17 @@ export async function resolveSshTargetInfo(
   }
 }
 
-export async function resolveSshAccess(
-  domain: string,
-  client: SpinupWPClientLike,
-  cfg: AppConfig,
-  opts?: { server?: string | null },
-): Promise<SshAccessResult> {
-  const resolution = await resolveSshTargetInfo(domain, client, cfg, opts)
-  if (!resolution.ok) return resolution.result
-  const { primaryDomain, sshTarget: target, port, server: serverName } = resolution.info
+// One BatchMode `ssh … true` against an already-resolved target, classified.
+// Shared by `ssh` (one domain) and `siblings --probe` (every site on a server)
+// so both read a refused key, an unreachable box and anything else the same way.
+export type SshProbeStatus = "ok" | "permission_denied" | "connection_failed" | "ssh_error"
+
+const PROBE_TIMEOUT_MS = 15_000
+
+export async function probeSshTarget(
+  target: string,
+  port: number | null,
+): Promise<{ status: SshProbeStatus; message?: string }> {
   const portOpt = port ? ["-p", String(port)] : []
 
   let proc: ReturnType<typeof Bun.spawn>
@@ -188,46 +190,58 @@ export async function resolveSshAccess(
       stdin: "ignore",
     })
   } catch (err) {
-    return { ok: false, domain, reason: "ssh_error", message: `Failed to launch ssh: ${(err as Error).message}` }
+    return { status: "ssh_error", message: `Failed to launch ssh: ${(err as Error).message}` }
   }
 
+  let timedOut = false
   const timeout = setTimeout(() => {
+    timedOut = true
     try {
       proc.kill()
     } catch {
       /* already gone */
     }
-  }, 15000)
+  }, PROBE_TIMEOUT_MS)
 
   const exitCode = await proc.exited
   clearTimeout(timeout)
-  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
+  if (exitCode === 0) return { status: "ok" }
 
-  if (exitCode === 0) {
-    return { ok: true, domain, primaryDomain, sshTarget: target, port, server: serverName }
+  // Killed by our own timer: ssh never got to say why, so say it here rather
+  // than reporting the kill signal's exit code as an unexplained ssh error.
+  if (timedOut) {
+    return { status: "connection_failed", message: `ssh did not finish within ${PROBE_TIMEOUT_MS / 1000}s.` }
   }
 
-  if (/permission denied/i.test(stderr)) {
-    return {
-      ok: false,
-      domain,
-      reason: "permission_denied",
-      message: stderr.trim().split("\n").slice(-2).join(" ") || "Permission denied.",
-      remedy: GRANT_KEY_REMEDY,
-    }
-  }
+  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
+  const tail = stderr.trim().split("\n").slice(-2).join(" ")
+
+  if (/permission denied/i.test(stderr)) return { status: "permission_denied", message: tail || "Permission denied." }
   if (/(connection timed out|operation timed out|connection refused|could not resolve)/i.test(stderr)) {
-    return {
-      ok: false,
-      domain,
-      reason: "connection_failed",
-      message: stderr.trim().split("\n").slice(-2).join(" ") || `ssh exited with code ${exitCode}`,
-    }
+    return { status: "connection_failed", message: tail || `ssh exited with code ${exitCode}` }
+  }
+  return { status: "ssh_error", message: tail || `ssh exited with code ${exitCode}` }
+}
+
+export async function resolveSshAccess(
+  domain: string,
+  client: SpinupWPClientLike,
+  cfg: AppConfig,
+  opts?: { server?: string | null },
+): Promise<SshAccessResult> {
+  const resolution = await resolveSshTargetInfo(domain, client, cfg, opts)
+  if (!resolution.ok) return resolution.result
+  const { primaryDomain, sshTarget: target, port, server: serverName } = resolution.info
+
+  const probe = await probeSshTarget(target, port)
+  if (probe.status === "ok") {
+    return { ok: true, domain, primaryDomain, sshTarget: target, port, server: serverName }
   }
   return {
     ok: false,
     domain,
-    reason: "ssh_error",
-    message: stderr.trim().split("\n").slice(-2).join(" ") || `ssh exited with code ${exitCode}`,
+    reason: probe.status,
+    message: probe.message ?? "ssh failed.",
+    ...(probe.status === "permission_denied" ? { remedy: GRANT_KEY_REMEDY } : {}),
   }
 }

package/src/lib/cloneSettings.ts

@@ -0,0 +1,180 @@
+// Carry a site's SpinupWP settings onto its clone: page cache (on/off, duration,
+// exclusions), the nginx security toggles, path redirects, and the server-level WP
+// cron interval. The create payload can only say "page cache on", so without this
+// a clone comes out with SpinupWP's defaults for everything else. Each setting is
+// compared first and only a difference is written, so a retry re-runs it safely.
+//
+// Not carried here: basic auth (the password can't be read from the API — the
+// result flags it instead) and backups (stored per DOMAIN in the bucket, so a clone
+// backing up before DNS cutover would write over production's files; they're
+// applied at cutover).
+
+import type { SpinupWPClientLike } from "../api/client.ts"
+import { WP_CRON_INTERVALS, type NginxSettings, type PageCachePayload, type PageCacheSettings, type PathRedirect, type Site } from "../api/types.ts"
+import { pollEvent } from "./cloneDomains.ts"
+
+export interface SettingsCarryResult {
+  carried: string[] // short labels for what was written ("page cache", "3 redirects", …)
+  failed: { what: string; error: string }[]
+  basicAuthMissing: boolean // the source is password-protected, the clone isn't
+}
+
+type Log = (entry: Record<string, unknown>) => void
+
+// Page-cache exclusion lists read back as one pipe-joined regex but are written one
+// entry per line. Split on top-level pipes only, so an alternation inside a group
+// or class — "(a|b)", "[|]" — stays one entry. Exported for the test harness.
+export function splitCacheList(joined: string): string[] {
+  const out: string[] = []
+  let depth = 0
+  let cur = ""
+  for (let i = 0; i < joined.length; i++) {
+    const ch = joined[i]!
+    if (ch === "\\") {
+      cur += ch + (joined[i + 1] ?? "")
+      i++
+      continue
+    }
+    if (ch === "(" || ch === "[" || ch === "{") depth++
+    else if ((ch === ")" || ch === "]" || ch === "}") && depth > 0) depth--
+    if (ch === "|" && depth === 0) {
+      out.push(cur)
+      cur = ""
+      continue
+    }
+    cur += ch
+  }
+  out.push(cur)
+  return out.filter((e) => e !== "")
+}
+
+const CACHE_LISTS = ["path_exclusions", "cookie_exclusions", "ignored_query_params"] as const
+
+// What to send so the dest's page cache matches the source's: only the fields that
+// differ, and never a list the source leaves unset (null reads as "SpinupWP's
+// default", which the dest already has).
+function pageCacheDiff(src: PageCacheSettings, dst: PageCacheSettings | undefined): PageCachePayload {
+  const out: PageCachePayload = {}
+  if (src.duration != null && src.duration_unit != null && (src.duration !== dst?.duration || src.duration_unit !== dst?.duration_unit)) {
+    out.duration = src.duration
+    out.duration_unit = src.duration_unit
+  }
+  for (const k of CACHE_LISTS) {
+    const v = src[k]
+    if (v != null && v !== dst?.[k]) out[k] = splitCacheList(v).join("\n")
+  }
+  return out
+}
+
+// Wait for each event and turn the outcome into an error string (undefined = done).
+async function settle(client: SpinupWPClientLike, eventIds: number[]): Promise<string | undefined> {
+  for (const id of eventIds) {
+    const r = await pollEvent(client, id)
+    if (r.outcome === "failed") return `event ${id} failed on SpinupWP`
+    if (r.outcome === "timeout") return `gave up waiting for event ${id}${r.lastStatus ? ` (still "${r.lastStatus}")` : ""} — retry the site to re-check`
+  }
+  return undefined
+}
+
+const redirectKey = (r: Pick<PathRedirect, "from" | "to">) => `${r.from}\u0000${r.to}`
+
+export async function carrySiteSettings(
+  client: SpinupWPClientLike,
+  sourceSiteId: number,
+  destSiteId: number,
+  wpCron: { source?: number | null; dest?: number | null },
+  log?: Log,
+): Promise<SettingsCarryResult> {
+  const result: SettingsCarryResult = { carried: [], failed: [], basicAuthMissing: false }
+  let src: Site
+  let dst: Site
+  try {
+    ;[src, dst] = await Promise.all([client.getSite(sourceSiteId), client.getSite(destSiteId)])
+  } catch (err) {
+    result.failed.push({ what: "settings", error: `couldn't read the sites: ${(err as Error).message}` })
+    return result
+  }
+
+  // Each step records its own outcome; one failing never stops the rest.
+  const step = async (what: string, run: () => Promise<number[] | null>) => {
+    try {
+      const events = await run()
+      if (events == null) return // nothing to change
+      const error = await settle(client, events)
+      if (error) {
+        result.failed.push({ what, error })
+        log?.({ event: "settings-carry", what, ok: false, error })
+      } else {
+        result.carried.push(what)
+        log?.({ event: "settings-carry", what, ok: true })
+      }
+    } catch (err) {
+      const error = (err as Error).message
+      result.failed.push({ what, error })
+      log?.({ event: "settings-carry", what, ok: false, error })
+    }
+  }
+
+  // Page cache
+  const sc = src.page_cache
+  if (sc) {
+    await step("page cache", async () => {
+      if (!sc.enabled) return dst.page_cache?.enabled ? [(await client.disablePageCache(destSiteId)).event_id] : null
+      const diff = pageCacheDiff(sc, dst.page_cache)
+      if (!dst.page_cache?.enabled) return [(await client.enablePageCache(destSiteId, diff)).event_id]
+      return Object.keys(diff).length > 0 ? [(await client.updatePageCache(destSiteId, diff)).event_id] : null
+    })
+  }
+
+  // Nginx security toggles (public_folder is set at create and handled by the pull)
+  const sn = src.nginx ?? {}
+  const nginx: NginxSettings = {}
+  for (const k of ["uploads_directory_protected", "xmlrpc_protected", "subdirectory_rewrite_in_place"] as const) {
+    if (sn[k] != null && sn[k] !== dst.nginx?.[k]) nginx[k] = sn[k]
+  }
+  if (Object.keys(nginx).length > 0) {
+    await step("security settings", async () => (await client.updateNginx(destSiteId, nginx)).event_ids)
+  }
+
+  // Path redirects: add the source's that the dest lacks. The dest's own extras
+  // are left alone (a clone shouldn't delete anything).
+  let srcRedirects: PathRedirect[] = []
+  try {
+    srcRedirects = await client.listPathRedirects(sourceSiteId)
+  } catch (err) {
+    result.failed.push({ what: "redirects", error: `couldn't list the source's redirects: ${(err as Error).message}` })
+  }
+  if (srcRedirects.length > 0) {
+    let have = new Set<string>()
+    try {
+      have = new Set((await client.listPathRedirects(destSiteId)).map(redirectKey))
+    } catch {
+      /* add them all; a duplicate is rejected per redirect and reported */
+    }
+    const missing = srcRedirects.filter((r) => !have.has(redirectKey(r)))
+    if (missing.length > 0) {
+      await step(`${missing.length} redirect${missing.length === 1 ? "" : "s"}`, async () => {
+        const events: number[] = []
+        for (const r of missing) events.push((await client.addPathRedirect(destSiteId, { from: r.from, to: r.to, type: r.type })).event_id)
+        return events
+      })
+    }
+  }
+
+  // WP cron: both ends' intervals come from their crontabs (undefined = unread,
+  // null = no managed job recognized). Only an interval is ever carried: a source
+  // with no recognizable job might have WP cron off, or a line shape we don't
+  // parse, and switching the clone's off on a guess is worse than leaving it.
+  const want = wpCron.source
+  const have = wpCron.dest
+  if (want != null && have !== undefined && want !== have) {
+    if (!(WP_CRON_INTERVALS as readonly number[]).includes(want)) {
+      result.failed.push({ what: "WP cron", error: `the source runs WP cron every ${want} min, which SpinupWP's API doesn't offer` })
+    } else {
+      await step(`WP cron every ${want} min`, async () => [(have == null ? await client.enableWpCron(destSiteId, want) : await client.updateWpCron(destSiteId, want)).event_id])
+    }
+  }
+
+  result.basicAuthMissing = !!src.basic_auth?.enabled && !dst.basic_auth?.enabled
+  return result
+}