feat: add github-backed decision storage

2026-07-09 18:42:45 +02:00
parent 50a166a2ce
commit 6fc459e1fb
6 changed files with 629 additions and 12 deletions
@@ -76,6 +76,17 @@ function secretSourceSummary(sourcePath: string, key: string): Record<string, un
  };
 }

+function fileSourceSummary(sourcePath: string): Record<string, unknown> {
+  const absolute = sourcePath.startsWith("/") ? sourcePath : resolve(repoRoot, sourcePath);
+  if (!existsSync(absolute)) return { sourceRef: sourcePath, present: false, fingerprint: null };
+  const value = readFileSync(absolute, "utf8");
+  return {
+    sourceRef: sourcePath,
+    present: value.length > 0,
+    fingerprint: value.length > 0 ? `sha256:${sha256Short(value)}` : null,
+  };
+}
+
 function decisionDeploymentConfigSummary(configPath = hostK8sConfigPath): Record<string, unknown> {
  const parsed = readYamlConfig(configPath);
  const target = asRecord(parsed.target, `${configPath}.target`);
@@ -85,6 +96,13 @@ function decisionDeploymentConfigSummary(configPath = hostK8sConfigPath): Record
  const decision = asRecord(services.decisionCenter, `${configPath}.services.decisionCenter`);
  const database = asRecord(decision.database, `${configPath}.services.decisionCenter.database`);
  const sourceRef = asRecord(database.sourceRef, `${configPath}.services.decisionCenter.database.sourceRef`);
+  const storage = asRecord(decision.storage, `${configPath}.services.decisionCenter.storage`);
+  const github = asRecord(storage.github, `${configPath}.services.decisionCenter.storage.github`);
+  const ssh = asRecord(github.ssh, `${configPath}.services.decisionCenter.storage.github.ssh`);
+  const privateKey = asRecord(ssh.privateKey, `${configPath}.services.decisionCenter.storage.github.ssh.privateKey`);
+  const knownHosts = asRecord(ssh.knownHosts, `${configPath}.services.decisionCenter.storage.github.ssh.knownHosts`);
+  const privateKeySourceRef = asRecord(privateKey.sourceRef, `${configPath}.services.decisionCenter.storage.github.ssh.privateKey.sourceRef`);
+  const knownHostsSourceRef = asRecord(knownHosts.sourceRef, `${configPath}.services.decisionCenter.storage.github.ssh.knownHosts.sourceRef`);
  return {
    configPath,
    target: {
@@ -113,6 +131,19 @@ function decisionDeploymentConfigSummary(configPath = hostK8sConfigPath): Record
        stringField(sourceRef, "key", `${configPath}.services.decisionCenter.database.sourceRef`),
      ),
    },
+    storage: {
+      primary: stringField(storage, "primary", `${configPath}.services.decisionCenter.storage`),
+      github: {
+        repo: stringField(github, "repo", `${configPath}.services.decisionCenter.storage.github`),
+        sshUrl: stringField(github, "sshUrl", `${configPath}.services.decisionCenter.storage.github`),
+        branch: stringField(github, "branch", `${configPath}.services.decisionCenter.storage.github`),
+        basePath: stringField(github, "basePath", `${configPath}.services.decisionCenter.storage.github`),
+        worktreePath: stringField(github, "worktreePath", `${configPath}.services.decisionCenter.storage.github`),
+        sshSecret: stringField(ssh, "secretName", `${configPath}.services.decisionCenter.storage.github.ssh`),
+        privateKey: fileSourceSummary(stringField(privateKeySourceRef, "path", `${configPath}.services.decisionCenter.storage.github.ssh.privateKey.sourceRef`)),
+        knownHosts: fileSourceSummary(stringField(knownHostsSourceRef, "path", `${configPath}.services.decisionCenter.storage.github.ssh.knownHosts.sourceRef`)),
+      },
+    },
  };
 }

@@ -133,6 +164,23 @@ function manifestObjects(manifest: string): Array<Record<string, string>> {
    .filter((item) => item.kind.length > 0 && item.name.length > 0);
 }

+function redactSecretManifestValues(manifest: string): string {
+  return manifest.split(/^---$/mu).map((doc) => {
+    if (!/^kind:\s*Secret\s*$/mu.test(doc)) return doc;
+    const lines = doc.split("\n");
+    let inStringData = false;
+    return lines.map((line) => {
+      if (/^stringData:\s*$/u.test(line)) {
+        inStringData = true;
+        return line;
+      }
+      if (inStringData && /^\S/u.test(line)) inStringData = false;
+      if (inStringData && /^  [A-Za-z0-9_.-]+:\s*/u.test(line)) return line.replace(/:\s*.*$/u, ': "<redacted>"');
+      return line;
+    }).join("\n");
+  }).join("---");
+}
+
 function deploymentOptions(args: string[]): { configPath: string; confirm: boolean; dryRun: boolean; wait: boolean; full: boolean; raw: boolean } {
  return {
    configPath: optionValue(args, ["--config"]) ?? hostK8sConfigPath,
@@ -175,7 +223,7 @@ function deploymentPlan(args: string[]): Record<string, unknown> {
 function deploymentRender(args: string[]): Record<string, unknown> | string {
  const options = deploymentOptions(args);
  const manifest = renderDecisionDeploymentManifest(options.configPath);
-  if (options.raw || options.full) return manifest;
+  if (options.raw || options.full) return redactSecretManifestValues(manifest);
  return {
    ok: true,
    action: "decision-center-deployment-render",
@@ -315,6 +363,62 @@ async function runDeploymentCommand(config: UniDeskConfig, args: string[]): Prom
  throw new Error("decision deployment command must be one of: plan, render, apply, status");
 }

+function storageOptions(args: string[]): { configPath: string; confirm: boolean; dryRun: boolean } {
+  return {
+    configPath: optionValue(args, ["--config"]) ?? hostK8sConfigPath,
+    confirm: hasFlag(args, "--confirm"),
+    dryRun: hasFlag(args, "--dry-run"),
+  };
+}
+
+function storagePlan(args: string[]): Record<string, unknown> {
+  const options = storageOptions(args);
+  const summary = decisionDeploymentConfigSummary(options.configPath);
+  return {
+    ok: true,
+    action: "decision-center-storage-plan",
+    mutation: false,
+    config: {
+      configPath: options.configPath,
+      target: asRecord(summary.target, "summary.target"),
+      storage: asRecord(summary.storage, "summary.storage"),
+      database: asRecord(summary.database, "summary.database"),
+    },
+    next: {
+      servicePlan: "bun scripts/cli.ts decision storage status",
+      migrateDryRun: "bun scripts/cli.ts decision storage migrate --dry-run",
+      migrateConfirm: "bun scripts/cli.ts decision storage migrate --confirm",
+      verify: "bun scripts/cli.ts decision storage verify",
+    },
+  };
+}
+
+function storageProxy(path: string, init?: { method?: string; body?: unknown }): unknown {
+  return unwrapProxyResponse(decisionProxy(path, init));
+}
+
+async function storageProxyAsync(fetcher: (path: string, init?: { method?: string; body?: unknown }) => Promise<unknown>, path: string, init?: { method?: string; body?: unknown }): Promise<unknown> {
+  return unwrapProxyResponse(await decisionProxyAsync(fetcher, path, init));
+}
+
+async function runStorageCommand(args: string[], fetcher?: (path: string, init?: { method?: string; body?: unknown }) => Promise<unknown>): Promise<unknown> {
+  const [action = "plan"] = args;
+  if (action === "plan") return storagePlan(args.slice(1));
+  if (action === "status") {
+    return fetcher === undefined ? storageProxy("/api/storage/status") : storageProxyAsync(fetcher, "/api/storage/status");
+  }
+  if (action === "migrate") {
+    const options = storageOptions(args.slice(1));
+    if (!options.confirm && !options.dryRun) throw new Error("decision storage migrate requires --dry-run or --confirm");
+    const init = { method: "POST", body: { confirm: options.confirm } };
+    return fetcher === undefined ? storageProxy("/api/storage/migrate", init) : storageProxyAsync(fetcher, "/api/storage/migrate", init);
+  }
+  if (action === "verify") {
+    return fetcher === undefined ? storageProxy("/api/storage/verify") : storageProxyAsync(fetcher, "/api/storage/verify");
+  }
+  throw new Error("decision storage command must be one of: plan, status, migrate, verify");
+}
+
 function optionValues(args: string[], names: string[]): string[] {
  const values: string[] = [];
  for (let index = 0; index < args.length; index += 1) {
@@ -951,6 +1055,7 @@ export async function runDecisionCenterCommandAsync(
 ): Promise<unknown> {
  const [action = "list", id] = args;
  if (action === "deployment" || action === "deploy") return runDeploymentCommand(_config, args.slice(1));
+  if (action === "storage") return runStorageCommand(args.slice(1), fetcher);
  if (action === "diary") {
    const [diaryAction = "list", diaryId] = args.slice(1);
    if (diaryAction === "import") return importDiaryAsync(args.slice(2), fetcher);
@@ -978,5 +1083,5 @@ export async function runDecisionCenterCommandAsync(
  if (action === "list") return listRecordsAsync(args.slice(1), fetcher);
  if (action === "show") return showRecordAsync(id, fetcher);
  if (action === "health") return unwrapProxyResponse(await fetcher(`/api/microservices/${encodeURIComponent(serviceId)}/health`));
-  throw new Error("decision command must be one of: upload, list, show, health, requirement, diary, deployment");
+  throw new Error("decision command must be one of: upload, list, show, health, requirement, diary, deployment, storage");
 }
@@ -278,7 +278,7 @@ function microserviceHelp(): unknown {

 function decisionHelp(): unknown {
  return {
-    command: "decision upload|list|show|health|diary|requirement|deployment",
+    command: "decision upload|list|show|health|diary|requirement|deployment|storage",
    output: "json",
    usage: [
      "bun scripts/cli.ts decision upload <markdown-file> [--title text] [--type meeting|decision] [--doc-no DC-...]",
@@ -289,6 +289,8 @@ function decisionHelp(): unknown {
      "bun scripts/cli.ts decision requirement list|create|show|update|upsert ... [--doc-no DC-...] [--doc-type GOAL] [--doc-priority P0] [--signer text] [--issued-at ISO]",
      "bun scripts/cli.ts decision deployment plan|render|status [--config config/unidesk-host-k8s.yaml]",
      "bun scripts/cli.ts decision deployment apply --dry-run|--confirm [--config config/unidesk-host-k8s.yaml]",
+      "bun scripts/cli.ts decision storage plan|status|verify [--config config/unidesk-host-k8s.yaml]",
+      "bun scripts/cli.ts decision storage migrate --dry-run|--confirm [--config config/unidesk-host-k8s.yaml]",
    ],
    description: "Operate Decision Center through the registered user-service proxy and manage its NC01 YAML-first k8s deployment.",
  };