From 960886b9cd74ff9e75894eb37dc3478a6140b610 Mon Sep 17 00:00:00 2001 From: Codex Date: Tue, 2 Jun 2026 10:27:30 +0000 Subject: [PATCH] fix: preserve scoped ssh env for frontend rebuild --- scripts/src/docker.ts | 2 ++ scripts/ssh-argv-guidance-contract-test.ts | 3 +++ 2 files changed, 5 insertions(+) diff --git a/scripts/src/docker.ts b/scripts/src/docker.ts index 59a7a8d7..6870b954 100644 --- a/scripts/src/docker.ts +++ b/scripts/src/docker.ts @@ -160,6 +160,8 @@ export function writeComposeEnv(config: UniDeskConfig, freshLogPrefix: boolean): UNIDESK_DATABASE_VOLUME: config.database.volume, UNIDESK_DATABASE_VOLUME_SIZE: config.database.volumeSize, UNIDESK_PROVIDER_TOKEN: config.providerGateway.token, + UNIDESK_SSH_CLIENT_TOKEN: runtimeSecret("UNIDESK_SSH_CLIENT_TOKEN"), + UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST: runtimeSecret("UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST") || "G14,G14:*,D601,D601:*", UNIDESK_PROVIDER_ID: config.providerGateway.id, UNIDESK_PROVIDER_NAME: config.providerGateway.name, UNIDESK_PROVIDER_LABELS_JSON: labels, diff --git a/scripts/ssh-argv-guidance-contract-test.ts b/scripts/ssh-argv-guidance-contract-test.ts index 65c7f206..677126ff 100644 --- a/scripts/ssh-argv-guidance-contract-test.ts +++ b/scripts/ssh-argv-guidance-contract-test.ts @@ -1250,6 +1250,9 @@ export async function runSshArgvGuidanceContract(): Promise { const composeSource = readFileSync(new URL("../docker-compose.yml", import.meta.url), "utf8"); assertCondition(composeSource.includes('PROVIDER_TOKEN: "${UNIDESK_PROVIDER_TOKEN}"'), "frontend compose service must receive provider token for the ssh proxy", composeSource); + assertCondition(composeSource.includes('UNIDESK_SSH_CLIENT_TOKEN: "${UNIDESK_SSH_CLIENT_TOKEN:-}"') && composeSource.includes("UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST"), "frontend compose service must receive scoped ssh client token and route allowlist", composeSource); + const dockerCliSource = readFileSync(new URL("./src/docker.ts", import.meta.url), "utf8"); + assertCondition(dockerCliSource.includes('UNIDESK_SSH_CLIENT_TOKEN: runtimeSecret("UNIDESK_SSH_CLIENT_TOKEN")') && dockerCliSource.includes('UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST: runtimeSecret("UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST")'), "server rebuild must preserve scoped ssh client runtime env instead of dropping it from docker-compose.env", dockerCliSource); const devCoreManifest = readFileSync(new URL("../src/components/microservices/k3sctl-adapter/k3s/dev/unidesk-dev-core.k8s.yaml", import.meta.url), "utf8"); assertCondition(devCoreManifest.includes("name: frontend-dev") && devCoreManifest.includes("name: PROVIDER_TOKEN"), "dev frontend manifest must receive provider token for the ssh proxy", devCoreManifest);