forked from EduCraft/curriculum-project-hub
487 lines
17 KiB
JavaScript
487 lines
17 KiB
JavaScript
#!/usr/bin/env node
|
|
import { execFile } from "node:child_process";
|
|
import { constants } from "node:fs";
|
|
import { access, readFile, realpath, stat } from "node:fs/promises";
|
|
import { basename, dirname, join, resolve } from "node:path";
|
|
import { promisify } from "node:util";
|
|
import { PrismaClient } from "@prisma/client";
|
|
import { parse } from "dotenv";
|
|
import {
|
|
DeploymentPreflightError,
|
|
validateDeploymentPreflight,
|
|
type DeploymentEnv,
|
|
type DeploymentPreflightInput,
|
|
type DeploymentPreflightResult,
|
|
} from "./preflight.js";
|
|
|
|
const execFileAsync = promisify(execFile);
|
|
|
|
interface Options {
|
|
readonly envFile: string;
|
|
readonly nodeBin: string;
|
|
readonly runuserBin: string;
|
|
readonly setprivBin: string;
|
|
readonly serviceUser: string;
|
|
readonly baseDir: string;
|
|
readonly hubDir: string;
|
|
readonly serviceHome: string;
|
|
readonly stateDir: string;
|
|
readonly cacheDir: string;
|
|
readonly workspaceRoot: string;
|
|
readonly bwrapBin: string;
|
|
readonly socatBin: string;
|
|
readonly pgIsReadyBin: string;
|
|
readonly serviceUid?: number;
|
|
readonly serviceGid?: number;
|
|
}
|
|
|
|
async function main(): Promise<void> {
|
|
const options = parseArgs(process.argv.slice(2));
|
|
const envFileContents = await readFile(options.envFile);
|
|
const env = parse(envFileContents) satisfies DeploymentEnv;
|
|
const rawInput = deploymentInput(options, env);
|
|
|
|
// Validate lexical paths and values before touching any external dependency.
|
|
validateDeploymentPreflight(rawInput);
|
|
|
|
const canonicalInput = await canonicalizeInput(rawInput);
|
|
const result = validateDeploymentPreflight(canonicalInput);
|
|
await validateSecretFile(options.envFile);
|
|
await validateNodeVersion(options.nodeBin);
|
|
await validateExecutable(options.runuserBin, "runuser");
|
|
await validateExecutable(options.setprivBin, "setpriv");
|
|
await validateExecutable(options.bwrapBin, "bubblewrap");
|
|
await validateExecutable(options.socatBin, "socat");
|
|
await validateExecutable(result.cphBin, "cph");
|
|
await validateExecutable(options.pgIsReadyBin, "pg_isready");
|
|
await validateCph(result.cphBin);
|
|
await validatePostgres(options.pgIsReadyBin, result);
|
|
await validatePostgresQuery(result.databaseUrl);
|
|
|
|
if (options.serviceUid !== undefined && options.serviceGid !== undefined) {
|
|
await validateProvisionedDirectories(canonicalInput, options.serviceUid, options.serviceGid);
|
|
await validateServiceRuntime(options, rawInput, canonicalInput, result);
|
|
}
|
|
|
|
console.log("[preflight] configuration and prerequisites valid");
|
|
}
|
|
|
|
function deploymentInput(options: Options, env: DeploymentEnv): DeploymentPreflightInput {
|
|
return {
|
|
baseDir: options.baseDir,
|
|
hubDir: options.hubDir,
|
|
serviceHome: options.serviceHome,
|
|
stateDir: options.stateDir,
|
|
cacheDir: options.cacheDir,
|
|
workspaceRoot: options.workspaceRoot,
|
|
env,
|
|
};
|
|
}
|
|
|
|
async function canonicalizeInput(input: DeploymentPreflightInput): Promise<DeploymentPreflightInput> {
|
|
const baseDir = await canonicalizeProspectivePath(input.baseDir);
|
|
const hubDir = await canonicalizeProspectivePath(input.hubDir);
|
|
const serviceHome = await canonicalizeProspectivePath(input.serviceHome);
|
|
const stateDir = await canonicalizeProspectivePath(input.stateDir);
|
|
const cacheDir = await canonicalizeProspectivePath(input.cacheDir);
|
|
const workspaceRoot = await canonicalizeProspectivePath(input.workspaceRoot);
|
|
return {
|
|
baseDir,
|
|
hubDir,
|
|
serviceHome,
|
|
stateDir,
|
|
cacheDir,
|
|
workspaceRoot,
|
|
env: { ...input.env, HUB_PROJECT_WORKSPACE_ROOT: workspaceRoot },
|
|
};
|
|
}
|
|
|
|
async function canonicalizeProspectivePath(value: string): Promise<string> {
|
|
const absolute = resolve(value);
|
|
const missingComponents: string[] = [];
|
|
let candidate = absolute;
|
|
|
|
while (true) {
|
|
try {
|
|
const existing = await realpath(candidate);
|
|
return resolve(existing, ...missingComponents.reverse());
|
|
} catch (error) {
|
|
if (!isNodeError(error) || error.code !== "ENOENT") throw error;
|
|
const parent = dirname(candidate);
|
|
if (parent === candidate) throw error;
|
|
missingComponents.push(basename(candidate));
|
|
candidate = parent;
|
|
}
|
|
}
|
|
}
|
|
|
|
async function validateSecretFile(path: string): Promise<void> {
|
|
const metadata = await stat(path);
|
|
if (!metadata.isFile()) {
|
|
throw new Error(`environment file is not a regular file: ${path}`);
|
|
}
|
|
if ((metadata.mode & 0o077) !== 0) {
|
|
throw new Error(`environment file must not be accessible by group or others: ${path}`);
|
|
}
|
|
}
|
|
|
|
async function validateNodeVersion(nodeBin: string): Promise<void> {
|
|
let stdout: string;
|
|
try {
|
|
({ stdout } = await execFileAsync(nodeBin, ["--version"], { timeout: 10_000 }));
|
|
} catch (error) {
|
|
throw new Error(`Node.js version check failed: ${nodeBin} (${formatFailure(error)})`, { cause: error });
|
|
}
|
|
const version = stdout.trim().replace(/^v/, "");
|
|
const major = Number(version.split(".")[0]);
|
|
if (!Number.isInteger(major) || major < 20) {
|
|
throw new Error(`Node.js 20 or newer is required; found ${version || "unknown"}`);
|
|
}
|
|
console.log(`[preflight] Node.js: ${version}`);
|
|
}
|
|
|
|
async function validateExecutable(path: string, label: string): Promise<void> {
|
|
try {
|
|
await access(path, constants.X_OK);
|
|
} catch (error) {
|
|
throw new Error(
|
|
`${label} executable is missing or not executable: ${path} (${formatFailure(error)})`,
|
|
{ cause: error },
|
|
);
|
|
}
|
|
}
|
|
|
|
async function validateCph(cphBin: string): Promise<void> {
|
|
let stdout: string;
|
|
try {
|
|
({ stdout } = await execFileAsync(cphBin, ["--version"], { timeout: 10_000 }));
|
|
} catch (error) {
|
|
throw new Error(`cph --version failed: ${cphBin} (${formatFailure(error)})`, { cause: error });
|
|
}
|
|
if (!/^cph \d+\.\d+\.\d+(?:\s|$)/m.test(stdout)) {
|
|
throw new Error(`cph --version returned an unexpected value: ${cphBin}`);
|
|
}
|
|
console.log(`[preflight] cph: ${stdout.trim()}`);
|
|
}
|
|
|
|
async function validatePostgres(pgIsReadyBin: string, result: DeploymentPreflightResult): Promise<void> {
|
|
const url = new URL(result.databaseUrl);
|
|
const postgresEnv: NodeJS.ProcessEnv = {
|
|
...process.env,
|
|
PGCONNECT_TIMEOUT: "5",
|
|
PGHOST: url.hostname,
|
|
PGPORT: url.port || "5432",
|
|
PGUSER: decodeURIComponent(url.username),
|
|
PGPASSWORD: decodeURIComponent(url.password),
|
|
PGDATABASE: decodeURIComponent(url.pathname.replace(/^\//, "")),
|
|
};
|
|
const sslMode = url.searchParams.get("sslmode");
|
|
if (sslMode !== null) postgresEnv["PGSSLMODE"] = sslMode;
|
|
|
|
try {
|
|
await execFileAsync(pgIsReadyBin, ["--quiet"], { env: postgresEnv, timeout: 10_000 });
|
|
} catch (error) {
|
|
throw new Error(
|
|
`PostgreSQL is not accepting connections for DATABASE_URL (${formatFailure(error)})`,
|
|
{ cause: error },
|
|
);
|
|
}
|
|
console.log("[preflight] PostgreSQL is accepting connections");
|
|
}
|
|
|
|
async function validatePostgresQuery(databaseUrl: string): Promise<void> {
|
|
const client = new PrismaClient({
|
|
datasources: { db: { url: databaseUrl } },
|
|
log: [],
|
|
});
|
|
let queryFailure: unknown;
|
|
try {
|
|
await client.$queryRawUnsafe("SELECT 1");
|
|
} catch (error) {
|
|
queryFailure = error;
|
|
}
|
|
|
|
let disconnectFailure: unknown;
|
|
try {
|
|
await client.$disconnect();
|
|
} catch (error) {
|
|
disconnectFailure = error;
|
|
}
|
|
|
|
if (queryFailure !== undefined) {
|
|
const disconnectDetail =
|
|
disconnectFailure === undefined ? "" : `; disconnect also failed (${formatFailure(disconnectFailure)})`;
|
|
throw new Error(
|
|
`PostgreSQL authenticated query failed for DATABASE_URL (${formatFailure(queryFailure)})${disconnectDetail}`,
|
|
{ cause: queryFailure },
|
|
);
|
|
}
|
|
if (disconnectFailure !== undefined) {
|
|
throw new Error(
|
|
`PostgreSQL preflight disconnect failed (${formatFailure(disconnectFailure)})`,
|
|
{ cause: disconnectFailure },
|
|
);
|
|
}
|
|
console.log("[preflight] PostgreSQL authenticated query succeeded");
|
|
}
|
|
|
|
async function validateProvisionedDirectories(
|
|
input: DeploymentPreflightInput,
|
|
serviceUid: number,
|
|
serviceGid: number,
|
|
): Promise<void> {
|
|
const directories = [input.serviceHome, input.stateDir, input.cacheDir, input.workspaceRoot];
|
|
for (const directory of directories) {
|
|
const metadata = await stat(directory);
|
|
if (!metadata.isDirectory()) {
|
|
throw new Error(`provisioned path is not a directory: ${directory}`);
|
|
}
|
|
if (metadata.uid !== serviceUid || metadata.gid !== serviceGid) {
|
|
throw new Error(`provisioned directory has unexpected ownership: ${directory}`);
|
|
}
|
|
if ((metadata.mode & 0o777) !== 0o750) {
|
|
throw new Error(`provisioned directory must have mode 0750: ${directory}`);
|
|
}
|
|
}
|
|
console.log(`[preflight] service directories owned by ${serviceUid}:${serviceGid} with mode 0750`);
|
|
}
|
|
|
|
async function validateServiceRuntime(
|
|
options: Options,
|
|
configuredInput: DeploymentPreflightInput,
|
|
canonicalInput: DeploymentPreflightInput,
|
|
result: DeploymentPreflightResult,
|
|
): Promise<void> {
|
|
const serviceEnv: NodeJS.ProcessEnv = {
|
|
...configuredInput.env,
|
|
NODE_ENV: "production",
|
|
DATABASE_URL: result.databaseUrl,
|
|
HOME: configuredInput.serviceHome,
|
|
XDG_STATE_HOME: configuredInput.stateDir,
|
|
XDG_CACHE_HOME: configuredInput.cacheDir,
|
|
PATH: [dirname(options.nodeBin), dirname(options.bwrapBin), dirname(options.socatBin), dirname(result.cphBin), "/usr/bin", "/bin"].join(":"),
|
|
};
|
|
const pathAccessRequirements = (input: DeploymentPreflightInput) => [
|
|
[input.hubDir, constants.R_OK | constants.X_OK],
|
|
[join(input.hubDir, "dist"), constants.R_OK | constants.X_OK],
|
|
[join(input.hubDir, "node_modules"), constants.R_OK | constants.X_OK],
|
|
[join(input.hubDir, "prisma"), constants.R_OK | constants.X_OK],
|
|
[input.serviceHome, constants.R_OK | constants.W_OK | constants.X_OK],
|
|
[input.stateDir, constants.R_OK | constants.W_OK | constants.X_OK],
|
|
[input.cacheDir, constants.R_OK | constants.W_OK | constants.X_OK],
|
|
[input.workspaceRoot, constants.R_OK | constants.W_OK | constants.X_OK],
|
|
[join(input.hubDir, "dist", "server.js"), constants.R_OK],
|
|
[join(input.hubDir, "dist", "deployment", "service-runtime-probe.js"), constants.R_OK],
|
|
[join(input.hubDir, "node_modules", "prisma", "build", "index.js"), constants.R_OK],
|
|
[join(input.hubDir, "prisma", "schema.prisma"), constants.R_OK],
|
|
] as const;
|
|
const accessRequirements = [
|
|
...pathAccessRequirements(configuredInput),
|
|
...pathAccessRequirements(canonicalInput),
|
|
[options.nodeBin, constants.X_OK],
|
|
[options.bwrapBin, constants.X_OK],
|
|
[options.socatBin, constants.X_OK],
|
|
[options.setprivBin, constants.X_OK],
|
|
[result.cphBin, constants.X_OK],
|
|
] as const;
|
|
const accessProbe = [
|
|
'const { accessSync } = require("node:fs");',
|
|
"for (const [path, mode] of JSON.parse(process.argv[1])) accessSync(path, mode);",
|
|
].join("\n");
|
|
|
|
await runAsService(
|
|
options,
|
|
serviceEnv,
|
|
options.nodeBin,
|
|
["-e", accessProbe, JSON.stringify(accessRequirements)],
|
|
"release and persistent path access probe",
|
|
);
|
|
await runAsService(
|
|
options,
|
|
serviceEnv,
|
|
options.nodeBin,
|
|
["--check", join(configuredInput.hubDir, "dist", "server.js")],
|
|
"built Hub syntax probe",
|
|
);
|
|
await runAsService(
|
|
options,
|
|
serviceEnv,
|
|
options.nodeBin,
|
|
[join(configuredInput.hubDir, "node_modules", "prisma", "build", "index.js"), "--version"],
|
|
"Prisma runtime probe",
|
|
);
|
|
await runAsService(
|
|
options,
|
|
serviceEnv,
|
|
options.nodeBin,
|
|
[join(configuredInput.hubDir, "dist", "deployment", "service-runtime-probe.js")],
|
|
"Hub dependency and authenticated database probe",
|
|
);
|
|
await runAsService(options, serviceEnv, result.cphBin, ["--version"], "cph runtime probe");
|
|
await runAsService(options, serviceEnv, options.socatBin, ["-V"], "socat runtime probe");
|
|
await runAsService(
|
|
options,
|
|
serviceEnv,
|
|
options.bwrapBin,
|
|
[
|
|
"--unshare-all",
|
|
"--die-with-parent",
|
|
"--new-session",
|
|
"--ro-bind",
|
|
"/",
|
|
"/",
|
|
"--proc",
|
|
"/proc",
|
|
"--dev",
|
|
"/dev",
|
|
"/bin/true",
|
|
],
|
|
"bubblewrap user-namespace probe",
|
|
);
|
|
console.log(`[preflight] runtime prerequisites execute as service user ${options.serviceUser}`);
|
|
}
|
|
|
|
async function runAsService(
|
|
options: Options,
|
|
env: NodeJS.ProcessEnv,
|
|
command: string,
|
|
args: readonly string[],
|
|
label: string,
|
|
): Promise<void> {
|
|
try {
|
|
await execFileAsync(
|
|
options.runuserBin,
|
|
[
|
|
"-u",
|
|
options.serviceUser,
|
|
"--",
|
|
options.setprivBin,
|
|
"--no-new-privs",
|
|
command,
|
|
...args,
|
|
],
|
|
{ cwd: options.hubDir, env, timeout: 15_000, maxBuffer: 2 * 1024 * 1024 },
|
|
);
|
|
} catch (error) {
|
|
throw new Error(`${label} failed for service user ${options.serviceUser} (${formatFailure(error)})`, {
|
|
cause: error,
|
|
});
|
|
}
|
|
}
|
|
|
|
function parseArgs(argv: readonly string[]): Options {
|
|
const values = new Map<string, string>();
|
|
for (let index = 0; index < argv.length; index += 2) {
|
|
const key = argv[index];
|
|
const value = argv[index + 1];
|
|
if (key === undefined || value === undefined || !key.startsWith("--")) {
|
|
throw new Error("preflight arguments must be --name value pairs");
|
|
}
|
|
if (values.has(key)) throw new Error(`duplicate preflight argument: ${key}`);
|
|
values.set(key, value);
|
|
}
|
|
|
|
const allowed = new Set([
|
|
"--env-file",
|
|
"--node-bin",
|
|
"--runuser-bin",
|
|
"--setpriv-bin",
|
|
"--service-user",
|
|
"--base-dir",
|
|
"--hub-dir",
|
|
"--service-home",
|
|
"--state-dir",
|
|
"--cache-dir",
|
|
"--workspace-root",
|
|
"--bwrap-bin",
|
|
"--socat-bin",
|
|
"--pg-isready-bin",
|
|
"--service-uid",
|
|
"--service-gid",
|
|
]);
|
|
for (const key of values.keys()) {
|
|
if (!allowed.has(key)) throw new Error(`unknown preflight argument: ${key}`);
|
|
}
|
|
|
|
const serviceUid = optionalId(values, "--service-uid");
|
|
const serviceGid = optionalId(values, "--service-gid");
|
|
if ((serviceUid === undefined) !== (serviceGid === undefined)) {
|
|
throw new Error("--service-uid and --service-gid must be supplied together");
|
|
}
|
|
|
|
return {
|
|
envFile: required(values, "--env-file"),
|
|
nodeBin: required(values, "--node-bin"),
|
|
runuserBin: required(values, "--runuser-bin"),
|
|
setprivBin: required(values, "--setpriv-bin"),
|
|
serviceUser: required(values, "--service-user"),
|
|
baseDir: required(values, "--base-dir"),
|
|
hubDir: required(values, "--hub-dir"),
|
|
serviceHome: required(values, "--service-home"),
|
|
stateDir: required(values, "--state-dir"),
|
|
cacheDir: required(values, "--cache-dir"),
|
|
workspaceRoot: required(values, "--workspace-root"),
|
|
bwrapBin: required(values, "--bwrap-bin"),
|
|
socatBin: required(values, "--socat-bin"),
|
|
pgIsReadyBin: required(values, "--pg-isready-bin"),
|
|
...(serviceUid === undefined ? {} : { serviceUid, serviceGid: serviceGid! }),
|
|
};
|
|
}
|
|
|
|
function required(values: ReadonlyMap<string, string>, key: string): string {
|
|
const value = values.get(key);
|
|
if (value === undefined || value === "") throw new Error(`missing required preflight argument: ${key}`);
|
|
return value;
|
|
}
|
|
|
|
function optionalId(values: ReadonlyMap<string, string>, key: string): number | undefined {
|
|
const raw = values.get(key);
|
|
if (raw === undefined) return undefined;
|
|
const value = Number(raw);
|
|
if (!Number.isInteger(value) || value < 0) throw new Error(`${key} must be a non-negative integer`);
|
|
return value;
|
|
}
|
|
|
|
function isNodeError(error: unknown): error is NodeJS.ErrnoException {
|
|
return error instanceof Error && "code" in error;
|
|
}
|
|
|
|
function formatFailure(error: unknown): string {
|
|
if (!(error instanceof Error)) return String(error);
|
|
|
|
const details: string[] = [];
|
|
const processError = error as NodeJS.ErrnoException & {
|
|
readonly signal?: NodeJS.Signals | null;
|
|
readonly stderr?: string | Buffer;
|
|
};
|
|
if (processError.code !== undefined) details.push(`exit=${String(processError.code)}`);
|
|
if (processError.signal !== undefined && processError.signal !== null) {
|
|
details.push(`signal=${processError.signal}`);
|
|
}
|
|
const stderr = processError.stderr?.toString().trim();
|
|
if (stderr !== undefined && stderr !== "") details.push(`stderr=${boundedDiagnostic(redactDiagnostic(stderr))}`);
|
|
if (details.length === 0) details.push(boundedDiagnostic(redactDiagnostic(error.message)));
|
|
return details.join(", ");
|
|
}
|
|
|
|
function boundedDiagnostic(value: string): string {
|
|
const limit = 2_000;
|
|
if (value.length <= limit) return value;
|
|
return `${value.slice(0, limit)}…[truncated ${value.length - limit} chars]`;
|
|
}
|
|
|
|
function redactDiagnostic(value: string): string {
|
|
return value
|
|
.replace(/\b(postgres(?:ql)?):\/\/([^:\s/@]+):([^@\s]+)@/gi, "$1://$2:[REDACTED]@")
|
|
.replace(/\b(password\s*[:=]\s*)\S+/gi, "$1[REDACTED]");
|
|
}
|
|
|
|
main().catch((error: unknown) => {
|
|
if (error instanceof DeploymentPreflightError) {
|
|
console.error(`[preflight] ${error.message}`);
|
|
} else {
|
|
console.error(`[preflight] failed: ${error instanceof Error ? error.message : String(error)}`);
|
|
}
|
|
process.exitCode = 1;
|
|
});
|