feat: move code queue to d601

scripts/src/config.ts

@@ -12,6 +12,7 @@ export interface UniDeskConfig {
     frontend: { port: number; containerPort: number };
     database: { port: number; containerPort: number };
     providerIngress: { port: number; containerPort: number };
+    restrictedHostAccess?: { bindHost: string; allowedSourceCidrs: string[] };
   };
   auth: { username: string; password: string; sessionSecret: string; sessionTtlSeconds: number };
   database: { user: string; password: string; name: string; volume: string; volumeSize: string };
@@ -127,6 +128,18 @@ function stringArrayField(obj: Record<string, unknown>, key: string, path: strin
   return value as string[];
 }
 
+function optionalRestrictedHostAccess(network: Record<string, unknown>): UniDeskConfig["network"]["restrictedHostAccess"] {
+  const value = network.restrictedHostAccess;
+  if (value === undefined) return undefined;
+  const record = asRecord(value, "network.restrictedHostAccess");
+  const allowedSourceCidrs = stringArrayField(record, "allowedSourceCidrs", "network.restrictedHostAccess");
+  if (allowedSourceCidrs.length === 0) throw new Error("network.restrictedHostAccess.allowedSourceCidrs must not be empty");
+  return {
+    bindHost: stringField(record, "bindHost", "network.restrictedHostAccess"),
+    allowedSourceCidrs,
+  };
+}
+
 function microserviceConfig(item: Record<string, unknown>, index: number): UniDeskMicroserviceConfig {
   const path = `microservices[${index}]`;
   const repository = asRecord(item.repository, `${path}.repository`);
@@ -200,6 +213,7 @@ export function readConfig(): UniDeskConfig {
       frontend: portPair(network, "frontend"),
       database: portPair(network, "database"),
       providerIngress: portPair(network, "providerIngress"),
+      restrictedHostAccess: optionalRestrictedHostAccess(network),
     },
     database: {
       user: stringField(database, "user", "database"),