ysk-server-core 1.0.0 → 1.1.0

package/dist/hosting/project-ops.js

@@ -11,6 +11,9 @@ import { buildServerNameList, renderNginxPhpFpm, renderNginxProxy, renderNginxSt
 import { syncNginxConfigs, writeManagedNginxConf } from './nginx-sync.js';
 import { apacheBackendUpstream, defaultProcessCommands, defaultRuntimeVersion, detectBunEntry, detectJavaEntry, isProcessRuntime, renderProcessUnit, selectNodeRuntime, selectPhpRuntime, } from './runtime.js';
 import { gitSync } from './git-deploy.js';
+import { gitCheckoutRef, gitFetch, gitLog, gitDiff, gitResetHard, listGitRemoteRefs, probeGitStatus, restoreEnvFile, } from './git-control.js';
+import { clearGitDeployKeyFile, clearGitHostPin, clearGitHttpsToken, createProjectGitDeployKey, hasGitHttpsToken, describeGitAuth, parseGitRemoteHost, pinGitHostKeys, resolveGitAuthRuntime, saveGitHttpsToken, scanGitHostKeys, } from './git-auth.js';
+import { describeGitHook, generateGitHookSecret, hasGitHookSecret, saveGitHookSecret, } from './git-hook.js';
 import { backupProject } from './backup-cron.js';
 import { applyPhpHosting } from './system-apply.js';
 import { resolveBestCertPaths } from './ssl-certs.js';
@@ -119,6 +122,12 @@ export class ProjectOpsService {
         this.dataDir = dataDir;
         this.audit = audit;
     }
+    liveLinuxUsers() {
+        return this.projects
+            .list()
+            .map((p) => String(p.linux_user ?? '').trim())
+            .filter(Boolean);
+    }
     /**
      * Full Node deploy path:
      * 1) write app artifacts (.env, entry stub, unit)
@@ -167,6 +176,7 @@ export class ProjectOpsService {
         const nodeBinary = nodeResolved.path;
         notes.push(tl('notes.auto.t0172', { v0: (nodeBinary) }));
         notes.push(...nodeResolved.notes);
+        this.projects.updateRuntimeState(projectId, { runtime_bin: nodeBinary });
         const isolatedDeploy = this.host.executeEnabled() && this.host.isRoot() && Boolean(row.os_provisioned);
         if (isolatedDeploy && !nodeBinaryExists(nodeBinary, this.host)) {
             notes.push(tl('notes.deploy.nodeMissingIsolated', { path: nodeBinary, version: nodeVer }));
@@ -639,7 +649,8 @@ export class ProjectOpsService {
                 dataDir: this.dataDir,
                 systemConfDir: '/etc/nginx/conf.d',
                 host: this.host,
-                dryRun: false
+                dryRun: false,
+                keepLinuxUsers: this.liveLinuxUsers()
             });
             written.push(...sync.copied);
             notes.push(...sync.notes);
@@ -1009,6 +1020,7 @@ export class ProjectOpsService {
             dataDir: this.dataDir,
             systemConfDir: systemDir,
             host: this.host,
+            keepLinuxUsers: this.liveLinuxUsers(),
         });
         notes.push(...sync.notes);
         written.push(...sync.copied);
@@ -1203,7 +1215,8 @@ export class ProjectOpsService {
         const sync = await syncNginxConfigs({
             dataDir: this.dataDir,
             systemConfDir: systemDir,
-            host: this.host
+            host: this.host,
+            keepLinuxUsers: this.liveLinuxUsers()
         });
         const notes = [tl('notes.auto.t0191', { v0: (nginxPath) }), ...sync.notes];
         let nginxReloaded = false;
@@ -1292,20 +1305,51 @@ export class ProjectOpsService {
             });
         }
         const appDir = join(row.home_dir, 'app');
+        const auth = this.gitAuthRuntime(row, gitUrl);
+        if (auth.blocked) {
+            this.projects.updateRuntimeState(projectId, {
+                git_url: gitUrl,
+                git_last_error: {
+                    code: auth.blocked.code,
+                    message: auth.blocked.message,
+                    at: new Date().toISOString(),
+                },
+            });
+            return {
+                ok: false,
+                projectId,
+                processStatus: row.process_status || 'stopped',
+                listening: false,
+                notes: [auth.blocked.message],
+                written: [],
+            };
+        }
         const git = await gitSync({
             host: this.host,
             gitUrl,
             targetDir: appDir,
             branch: opts.branch ?? row.git_branch,
-            depth: opts.depth ?? 1
+            depth: opts.depth ?? 1,
+            env: auth.env,
         });
         this.projects.updateRuntimeState(projectId, {
             git_url: gitUrl,
             git_branch: git.branch ?? opts.branch,
-            git_commit: git.commit
+            git_commit: git.commit,
+            git_shallow: existsSync(join(appDir, '.git', 'shallow')),
+            git_last_error: git.ok
+                ? undefined
+                : {
+                    code: git.errorCode || 'unknown',
+                    message: git.notes[git.notes.length - 1] || '',
+                    at: new Date().toISOString(),
+                },
         });
         const notes = [...git.notes];
         if (git.ok) {
+            const envPath = restoreEnvFile(appDir, row.env_vars);
+            if (envPath)
+                notes.push(tl('notes.git.envRestored'));
             await chownProjectHome(this.host, row, notes);
         }
         const savedEntry = opts.entry?.trim() || row.deploy_entry?.trim() || undefined;
@@ -1360,6 +1404,289 @@ export class ProjectOpsService {
             degraded: redeployResult?.degraded ?? true
         };
     }
+    gitAuthRuntime(row, gitUrl) {
+        return resolveGitAuthRuntime({
+            dataDir: this.dataDir,
+            projectId: row.id,
+            gitUrl: gitUrl ?? row.git_url ?? '',
+            authKind: row.git_auth_kind,
+            identityId: row.git_identity_id,
+        });
+    }
+    async gitStatus(projectId) {
+        const row = this.require(projectId);
+        const st = await probeGitStatus({
+            host: this.host,
+            appDir: join(row.home_dir, 'app'),
+            storedUrl: row.git_url,
+        });
+        const auth = describeGitAuth({
+            dataDir: this.dataDir,
+            projectId: row.id,
+            gitUrl: row.git_url,
+            authKind: row.git_auth_kind,
+            identityId: row.git_identity_id,
+        });
+        if (auth.scheme === 'ssh' && auth.host && !auth.hostPinned) {
+            auth.hostKeys = await scanGitHostKeys(this.host, auth.host);
+        }
+        return {
+            ...st,
+            auth,
+            hook: describeGitHook(this.dataDir, projectId, row.git_hook_enabled),
+        };
+    }
+    async gitLog(projectId, limit) {
+        const row = this.require(projectId);
+        return gitLog({ host: this.host, appDir: join(row.home_dir, 'app'), limit });
+    }
+    async gitDiff(projectId) {
+        const row = this.require(projectId);
+        return gitDiff({ host: this.host, appDir: join(row.home_dir, 'app') });
+    }
+    async gitRefs(projectId, opts) {
+        const row = this.require(projectId);
+        const gitUrl = (opts?.gitUrl ?? row.git_url ?? '').trim();
+        if (!gitUrl) {
+            return {
+                ok: false,
+                branches: [],
+                tags: [],
+                notes: [tl('notes.git.refsNeedUrl')],
+            };
+        }
+        const auth = this.gitAuthRuntime(row, gitUrl);
+        if (auth.blocked) {
+            return {
+                ok: false,
+                branches: [],
+                tags: [],
+                notes: [auth.blocked.message],
+                code: auth.blocked.code,
+            };
+        }
+        return listGitRemoteRefs({ host: this.host, gitUrl, env: auth.env });
+    }
+    async gitFetch(projectId, opts) {
+        const row = this.require(projectId);
+        const auth = this.gitAuthRuntime(row);
+        if (auth.blocked) {
+            return {
+                ok: false,
+                action: 'fetch',
+                notes: [auth.blocked.message],
+                code: auth.blocked.code,
+            };
+        }
+        const r = await gitFetch({
+            host: this.host,
+            appDir: join(row.home_dir, 'app'),
+            unshallow: opts?.unshallow,
+            env: auth.env,
+        });
+        this.audit?.append({
+            actor: opts?.actor ?? 'system',
+            action: 'project.git_fetch',
+            resource: projectId,
+            detail: r,
+            ok: r.ok,
+        });
+        return r;
+    }
+    async gitCheckout(projectId, opts) {
+        const row = this.require(projectId);
+        const appDir = join(row.home_dir, 'app');
+        const auth = this.gitAuthRuntime(row);
+        if (auth.blocked) {
+            return {
+                ok: false,
+                action: 'checkout',
+                notes: [auth.blocked.message],
+                code: auth.blocked.code,
+            };
+        }
+        const r = await gitCheckoutRef({ host: this.host, appDir, ref: opts.ref, env: auth.env });
+        if (r.ok) {
+            restoreEnvFile(appDir, row.env_vars);
+            this.projects.updateRuntimeState(projectId, {
+                git_branch: r.branch,
+                git_commit: r.commit,
+                git_last_error: undefined,
+            });
+        }
+        else {
+            this.projects.updateRuntimeState(projectId, {
+                git_last_error: {
+                    code: r.code || 'unknown',
+                    message: r.notes[0] || '',
+                    at: new Date().toISOString(),
+                },
+            });
+        }
+        this.audit?.append({
+            actor: opts.actor,
+            action: 'project.git_checkout',
+            resource: projectId,
+            detail: r,
+            ok: r.ok,
+        });
+        return r;
+    }
+    async gitReset(projectId, opts) {
+        const row = this.require(projectId);
+        const appDir = join(row.home_dir, 'app');
+        const auth = this.gitAuthRuntime(row);
+        if (auth.blocked) {
+            return {
+                ok: false,
+                action: 'reset',
+                notes: [auth.blocked.message],
+                code: auth.blocked.code,
+            };
+        }
+        const r = await gitResetHard({ host: this.host, appDir, ref: opts.ref, env: auth.env });
+        if (r.ok) {
+            restoreEnvFile(appDir, row.env_vars);
+            this.projects.updateRuntimeState(projectId, {
+                git_branch: r.branch,
+                git_commit: r.commit,
+                git_last_error: undefined,
+            });
+        }
+        else {
+            this.projects.updateRuntimeState(projectId, {
+                git_last_error: {
+                    code: r.code || 'unknown',
+                    message: r.notes[0] || '',
+                    at: new Date().toISOString(),
+                },
+            });
+        }
+        this.audit?.append({
+            actor: opts.actor,
+            action: 'project.git_reset',
+            resource: projectId,
+            detail: r,
+            ok: r.ok,
+        });
+        return r;
+    }
+    async gitAuth(projectId, opts) {
+        const row = this.require(projectId);
+        const notes = [];
+        if (opts.gitUrl?.trim()) {
+            this.projects.updateRuntimeState(projectId, { git_url: opts.gitUrl.trim() });
+        }
+        const url = (opts.gitUrl ?? row.git_url ?? '').trim();
+        try {
+            if (opts.action === 'set-token') {
+                const token = (opts.token ?? '').trim();
+                if (token.length < 8) {
+                    return { ok: false, notes: [tl('notes.git.tokenInvalid')] };
+                }
+                saveGitHttpsToken(this.dataDir, projectId, token);
+                this.projects.updateRuntimeState(projectId, { git_auth_kind: 'https-token' });
+                notes.push(tl('notes.git.tokenSaved'));
+            }
+            else if (opts.action === 'clear-token') {
+                clearGitHttpsToken(this.dataDir, projectId);
+                this.projects.updateRuntimeState(projectId, {
+                    git_auth_kind: row.git_identity_id ? 'ssh' : 'none',
+                });
+                notes.push(tl('notes.git.tokenCleared'));
+            }
+            else if (opts.action === 'make-deploy-key') {
+                const made = createProjectGitDeployKey({
+                    dataDir: this.dataDir,
+                    projectId,
+                    projectName: row.name,
+                    actor: opts.actor,
+                });
+                if (!made.ok || !made.identityId) {
+                    return { ok: false, notes: made.notes };
+                }
+                this.projects.updateRuntimeState(projectId, {
+                    git_auth_kind: 'ssh',
+                    git_identity_id: made.identityId,
+                });
+                notes.push(...made.notes);
+            }
+            else if (opts.action === 'clear-deploy-key') {
+                clearGitDeployKeyFile(this.dataDir, projectId);
+                this.projects.updateRuntimeState(projectId, {
+                    git_identity_id: undefined,
+                    git_auth_kind: hasGitHttpsToken(this.dataDir, projectId) ? 'https-token' : 'none',
+                });
+                notes.push(tl('notes.git.deployKeyCleared'));
+            }
+            else if (opts.action === 'pin-host') {
+                const host = parseGitRemoteHost(url).host;
+                if (!host)
+                    return { ok: false, notes: [tl('notes.git.hostkey')] };
+                const keys = await scanGitHostKeys(this.host, host);
+                if (!keys.length)
+                    return { ok: false, notes: [tl('notes.git.hostScanFailed')] };
+                pinGitHostKeys(this.dataDir, projectId, host, keys);
+                notes.push(tl('notes.git.hostPinned', { host }));
+            }
+            else if (opts.action === 'clear-host') {
+                clearGitHostPin(this.dataDir, projectId);
+                notes.push(tl('notes.git.hostUnpinned'));
+            }
+        }
+        catch (e) {
+            return { ok: false, notes: [e instanceof Error ? e.message : tl('notes.git.unknown')] };
+        }
+        const fresh = this.require(projectId);
+        this.audit?.append({
+            actor: opts.actor,
+            action: `project.git_auth.${opts.action}`,
+            resource: projectId,
+            detail: { action: opts.action },
+            ok: true,
+        });
+        return {
+            ok: true,
+            notes,
+            auth: describeGitAuth({
+                dataDir: this.dataDir,
+                projectId,
+                gitUrl: fresh.git_url,
+                authKind: fresh.git_auth_kind,
+                identityId: fresh.git_identity_id,
+            }),
+        };
+    }
+    gitHookManage(projectId, opts) {
+        this.require(projectId);
+        const notes = [];
+        let hookSecret;
+        if (opts.action === 'disable') {
+            this.projects.updateRuntimeState(projectId, { git_hook_enabled: false });
+            notes.push(tl('notes.git.hookDisabled'));
+        }
+        else {
+            const existing = hasGitHookSecret(this.dataDir, projectId);
+            if (opts.action === 'rotate' || !existing) {
+                hookSecret = generateGitHookSecret();
+                saveGitHookSecret(this.dataDir, projectId, hookSecret);
+                notes.push(tl('notes.git.hookSecretOnce'));
+            }
+            else {
+                notes.push(tl('notes.git.hookEnabled'));
+            }
+            this.projects.updateRuntimeState(projectId, { git_hook_enabled: true });
+        }
+        const hook = describeGitHook(this.dataDir, projectId, this.require(projectId).git_hook_enabled);
+        this.audit?.append({
+            actor: opts.actor,
+            action: `project.git_hook.${opts.action}`,
+            resource: projectId,
+            detail: { action: opts.action },
+            ok: true,
+        });
+        return { ok: true, notes, hook, hookSecret };
+    }
     /**
      * Write env vars to app/.env and store on project.
      */
@@ -1424,7 +1751,8 @@ export class ProjectOpsService {
             listening: false,
             notes: r.notes,
             written: r.archivePath ? [r.archivePath] : [],
-            archivePath: r.archivePath
+            archivePath: r.archivePath,
+            includesDatabase: Boolean(r.includesDatabase)
         };
     }
     /**
@@ -2033,6 +2361,18 @@ export class ProjectOpsService {
         const appDir = join(row.home_dir, 'app');
         mkdirSync(appDir, { recursive: true });
         mkdirSync(join(row.home_dir, 'logs'), { recursive: true });
+        if (row.runtime === 'python' && this.host.executeEnabled() && this.host.isRoot()) {
+            const ver = String(row.runtime_version ?? '').replace(/^python/, '');
+            const pkg = /^\d+\.\d+$/.test(ver) ? `python${ver}-venv` : 'python3-venv';
+            const venv = await this.host.runCommand([
+                'bash',
+                '-c',
+                `dpkg -s ${JSON.stringify(pkg)} >/dev/null 2>&1 || apt-get install -y -o APT::Get::AllowUnauthenticated=false ${JSON.stringify(pkg)} python3-venv`,
+            ], { timeoutMs: 180_000 });
+            notes.push(venv.exitCode === 0
+                ? `python venv package ready (${pkg})`
+                : `python venv package missing (${pkg}): ${(venv.stderr || venv.stdout).slice(0, 200)}`);
+        }
         const port = await resolveProcessPort({
             requested: opts.port,
             preferred: row.preferred_port,
@@ -2046,8 +2386,14 @@ export class ProjectOpsService {
         if (!entry && row.runtime === 'python') {
             entry = detectPythonEntry(appDir) ?? undefined;
         }
-        if (!entry && row.runtime === 'rust' && cargoName) {
-            entry = `./target/release/${cargoName}`;
+        if (row.runtime === 'rust') {
+            const looksLikeGoApp = !entry || entry === './app' || entry === 'app';
+            if (looksLikeGoApp && cargoName) {
+                entry = `./target/release/${cargoName}`;
+            }
+            else if (!entry && cargoName) {
+                entry = `./target/release/${cargoName}`;
+            }
         }
         if (!entry && (row.runtime === 'java' || row.runtime === 'kotlin')) {
             entry = detectJavaEntry(appDir) ?? undefined;
@@ -2096,6 +2442,30 @@ export class ProjectOpsService {
             notes.push(tl('notes.auto.n0821'));
             await chownProjectHome(this.host, row, notes);
         }
+        if (row.runtime === 'rust') {
+            const rustBin = join(appDir, String(cmds.entry ?? '').replace(/^\.\//, ''));
+            if (!existsSync(rustBin)) {
+                notes.push(`Rust binary not found at ${cmds.entry}. Build output is usually ./target/release/${cargoName ?? '<crate>'}. Refusing to write ExecStart.`);
+                this.projects.updateRuntimeState(projectId, {
+                    process_status: 'failed',
+                    status: 'failed',
+                    port,
+                    last_deploy_notes: clipDeployNotes(notes),
+                });
+                return {
+                    ok: false,
+                    projectId,
+                    port,
+                    processStatus: 'failed',
+                    listening: false,
+                    notes,
+                    written,
+                    degraded: true,
+                    requiresRoot: !this.host.isRoot(),
+                    requiresExecute: !this.host.executeEnabled(),
+                };
+            }
+        }
         const rtKind = row.runtime;
         const tuningEnv = tuningToEnv(loadRuntimeTuning(this.dataDir, rtKind, row.runtime_version ?? 'default'));
         if (Object.keys(tuningEnv).length) {