feat(auth-broker): register dry-run service surface
This commit is contained in:
Codex
+244
-2
@@ -1,7 +1,13 @@
|
||||
import { readFileSync } from "node:fs";
|
||||
import { type UniDeskConfig, readConfig, rootPath } from "./config";
|
||||
|
||||
const DEFAULT_REPO = "pikasTech/unidesk";
|
||||
const DEFAULT_BASE = "master";
|
||||
const SECRET_ENV_KEYS = ["GH_TOKEN", "GITHUB_TOKEN"] as const;
|
||||
const BROKER_URL_ENV_KEYS = ["UNIDESK_AUTH_BROKER_URL", "AUTH_BROKER_URL"] as const;
|
||||
const BROKER_CREDENTIAL_REF_ENV_KEYS = ["UNIDESK_AUTH_BROKER_GITHUB_CREDENTIAL_REF", "AUTH_BROKER_GITHUB_CREDENTIAL_REF"] as const;
|
||||
const BROKER_CONFIGURED_ENV_KEYS = ["UNIDESK_AUTH_BROKER_GITHUB_CONFIGURED", "AUTH_BROKER_GITHUB_CONFIGURED"] as const;
|
||||
const AUTH_BROKER_SERVICE_ID = "auth-broker";
|
||||
const DEFAULT_CAPABILITIES = [
|
||||
"github.auth.status",
|
||||
"github.issue.list",
|
||||
@@ -15,6 +21,7 @@ const DEFAULT_CAPABILITIES = [
|
||||
|
||||
type BrokerCommand = "contract" | "credential-request" | "pr-preflight" | "health";
|
||||
type RunnerDisposition = "ready" | "infra-blocked" | "business-failed";
|
||||
type ConfigSource = "config.json" | "unavailable";
|
||||
|
||||
interface BrokerAdapterOptions {
|
||||
command: BrokerCommand;
|
||||
@@ -27,10 +34,76 @@ interface BrokerAdapterOptions {
|
||||
issueNumber: number | null;
|
||||
}
|
||||
|
||||
interface AuthBrokerServiceRegistration {
|
||||
ok: boolean;
|
||||
serviceId: "auth-broker";
|
||||
source: ConfigSource;
|
||||
configured: boolean;
|
||||
providerId: string | null;
|
||||
deploymentMode: string | null;
|
||||
proxyMode: string | null;
|
||||
backendBaseUrl: string | null;
|
||||
healthPath: string | null;
|
||||
allowedPathPrefixes: string[];
|
||||
composeService: string | null;
|
||||
containerName: string | null;
|
||||
dockerfile: string | null;
|
||||
public: boolean | null;
|
||||
error: string | null;
|
||||
}
|
||||
|
||||
interface ComposeProfileRegistration {
|
||||
ok: boolean;
|
||||
source: "docker-compose.yml";
|
||||
serviceId: "auth-broker";
|
||||
servicePresent: boolean;
|
||||
profileGated: boolean;
|
||||
profiles: string[];
|
||||
restart: string | null;
|
||||
publicPortPublished: boolean;
|
||||
exposesPort: boolean;
|
||||
mutatesDefaultRuntime: false;
|
||||
}
|
||||
|
||||
interface DeployManifestRegistration {
|
||||
ok: boolean;
|
||||
source: "deploy.json";
|
||||
serviceId: "auth-broker";
|
||||
prod: { present: boolean; commitId: string | null };
|
||||
dev: { present: boolean; commitId: string | null };
|
||||
dryRunOnly: true;
|
||||
}
|
||||
|
||||
interface RuntimeCredentialRefPresence {
|
||||
ok: boolean;
|
||||
source: string | null;
|
||||
configuredFlag: {
|
||||
present: boolean;
|
||||
key: string | null;
|
||||
truthy: boolean;
|
||||
};
|
||||
credentialRef: {
|
||||
present: boolean;
|
||||
key: string | null;
|
||||
valuePrinted: false;
|
||||
valuePreview: string | null;
|
||||
};
|
||||
presenceOnly: true;
|
||||
valuesRead: false;
|
||||
valuesPrinted: false;
|
||||
}
|
||||
|
||||
function hasEnvKey(name: string): boolean {
|
||||
return Object.prototype.hasOwnProperty.call(process.env, name);
|
||||
}
|
||||
|
||||
function firstPresentEnvKey(keys: readonly string[]): string | null {
|
||||
for (const key of keys) {
|
||||
if (hasEnvKey(key)) return key;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function stringOption(args: string[], name: string): string | undefined {
|
||||
const index = args.indexOf(name);
|
||||
if (index === -1) return undefined;
|
||||
@@ -52,6 +125,14 @@ function sanitizeEndpoint(value: string): string {
|
||||
}
|
||||
}
|
||||
|
||||
function sanitizeCredentialRef(value: string): string {
|
||||
const trimmed = value.trim();
|
||||
if (trimmed.length === 0) return "<empty>";
|
||||
const separator = trimmed.indexOf(":");
|
||||
if (separator <= 0) return "<credential-ref>";
|
||||
return `${trimmed.slice(0, separator)}:<ref>`;
|
||||
}
|
||||
|
||||
function numberOption(args: string[], name: string): number | null {
|
||||
const raw = stringOption(args, name);
|
||||
if (raw === undefined) return null;
|
||||
@@ -67,6 +148,160 @@ function firstConfiguredBrokerUrl(): string | null {
|
||||
return null;
|
||||
}
|
||||
|
||||
function envTruthy(key: string | null): boolean {
|
||||
if (key === null) return false;
|
||||
const value = process.env[key]?.trim().toLowerCase();
|
||||
return value === "1" || value === "true" || value === "yes" || value === "on";
|
||||
}
|
||||
|
||||
function runtimeCredentialRefPresence(): RuntimeCredentialRefPresence {
|
||||
const configuredKey = firstPresentEnvKey(BROKER_CONFIGURED_ENV_KEYS);
|
||||
const refKey = firstPresentEnvKey(BROKER_CREDENTIAL_REF_ENV_KEYS);
|
||||
return {
|
||||
ok: configuredKey !== null && envTruthy(configuredKey) && refKey !== null,
|
||||
source: refKey === null ? null : "broker-held-github-credential-ref",
|
||||
configuredFlag: {
|
||||
present: configuredKey !== null,
|
||||
key: configuredKey,
|
||||
truthy: envTruthy(configuredKey),
|
||||
},
|
||||
credentialRef: {
|
||||
present: refKey !== null,
|
||||
key: refKey,
|
||||
valuePrinted: false,
|
||||
valuePreview: refKey === null ? null : sanitizeCredentialRef(process.env[refKey] ?? ""),
|
||||
},
|
||||
presenceOnly: true,
|
||||
valuesRead: false,
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
|
||||
function readConfigRegistration(): AuthBrokerServiceRegistration {
|
||||
let config: UniDeskConfig;
|
||||
try {
|
||||
config = readConfig();
|
||||
} catch (error) {
|
||||
return {
|
||||
ok: false,
|
||||
serviceId: AUTH_BROKER_SERVICE_ID,
|
||||
source: "unavailable",
|
||||
configured: false,
|
||||
providerId: null,
|
||||
deploymentMode: null,
|
||||
proxyMode: null,
|
||||
backendBaseUrl: null,
|
||||
healthPath: null,
|
||||
allowedPathPrefixes: [],
|
||||
composeService: null,
|
||||
containerName: null,
|
||||
dockerfile: null,
|
||||
public: null,
|
||||
error: error instanceof Error ? error.message : String(error),
|
||||
};
|
||||
}
|
||||
const service = config.microservices.find((item) => item.id === AUTH_BROKER_SERVICE_ID);
|
||||
return {
|
||||
ok: service !== undefined,
|
||||
serviceId: AUTH_BROKER_SERVICE_ID,
|
||||
source: "config.json",
|
||||
configured: service !== undefined,
|
||||
providerId: service?.providerId ?? null,
|
||||
deploymentMode: service?.deployment.mode ?? null,
|
||||
proxyMode: service?.backend.proxyMode ?? null,
|
||||
backendBaseUrl: service?.backend.nodeBaseUrl ?? null,
|
||||
healthPath: service?.backend.healthPath ?? null,
|
||||
allowedPathPrefixes: service?.backend.allowedPathPrefixes ?? [],
|
||||
composeService: service?.repository.composeService ?? null,
|
||||
containerName: service?.repository.containerName ?? null,
|
||||
dockerfile: service?.repository.dockerfile ?? null,
|
||||
public: service?.backend.public ?? null,
|
||||
error: service === undefined ? "auth-broker is not registered in config.json microservices" : null,
|
||||
};
|
||||
}
|
||||
|
||||
function extractComposeServiceBlock(composeText: string, serviceName: string): string {
|
||||
const lines = composeText.split("\n");
|
||||
const startLine = lines.findIndex((line) => line === ` ${serviceName}:`);
|
||||
if (startLine < 0) return "";
|
||||
let endLine = lines.length;
|
||||
for (let index = startLine + 1; index < lines.length; index += 1) {
|
||||
if (/^ [A-Za-z0-9][A-Za-z0-9_-]*:$/u.test(lines[index] ?? "")) {
|
||||
endLine = index;
|
||||
break;
|
||||
}
|
||||
}
|
||||
return lines.slice(startLine, endLine).join("\n");
|
||||
}
|
||||
|
||||
function composeProfileRegistration(): ComposeProfileRegistration {
|
||||
const composeText = readFileSync(rootPath("docker-compose.yml"), "utf8");
|
||||
const block = extractComposeServiceBlock(composeText, AUTH_BROKER_SERVICE_ID);
|
||||
const blockLines = block.split("\n");
|
||||
const profiles: string[] = [];
|
||||
const profileStart = blockLines.findIndex((line) => /^\s{4}profiles:\s*$/u.test(line));
|
||||
if (profileStart >= 0) {
|
||||
for (let index = profileStart + 1; index < blockLines.length; index += 1) {
|
||||
const line = blockLines[index] ?? "";
|
||||
if (/^\s{4}[A-Za-z0-9_-]+:/u.test(line)) break;
|
||||
const profile = line.match(/^\s{6}-\s+"?([A-Za-z0-9_.-]+)"?\s*$/u)?.[1];
|
||||
if (profile !== undefined) profiles.push(profile);
|
||||
}
|
||||
}
|
||||
const restart = block.match(/^\s{4}restart:\s+"?([^"\n]+)"?\s*$/mu)?.[1] ?? null;
|
||||
const portsSection = /^\s{4}ports:\s*$/mu.test(block);
|
||||
const portMapping = /^\s{6}-\s+["']?[^"'\n]*4291:/mu.test(block);
|
||||
return {
|
||||
ok: block.length > 0 && profiles.includes(AUTH_BROKER_SERVICE_ID) && !portsSection && !portMapping,
|
||||
source: "docker-compose.yml",
|
||||
serviceId: AUTH_BROKER_SERVICE_ID,
|
||||
servicePresent: block.length > 0,
|
||||
profileGated: profiles.includes(AUTH_BROKER_SERVICE_ID),
|
||||
profiles,
|
||||
restart,
|
||||
publicPortPublished: portsSection || portMapping,
|
||||
exposesPort: block.includes('"4291"'),
|
||||
mutatesDefaultRuntime: false,
|
||||
};
|
||||
}
|
||||
|
||||
function serviceCommitFromDeployJson(environment: "prod" | "dev"): string | null {
|
||||
const parsed = JSON.parse(readFileSync(rootPath("deploy.json"), "utf8")) as {
|
||||
environments?: Record<string, { services?: Array<{ id?: unknown; commitId?: unknown }> }>;
|
||||
};
|
||||
const service = parsed.environments?.[environment]?.services?.find((item) => item.id === AUTH_BROKER_SERVICE_ID);
|
||||
return typeof service?.commitId === "string" ? service.commitId : null;
|
||||
}
|
||||
|
||||
function deployManifestRegistration(): DeployManifestRegistration {
|
||||
const prodCommit = serviceCommitFromDeployJson("prod");
|
||||
const devCommit = serviceCommitFromDeployJson("dev");
|
||||
return {
|
||||
ok: prodCommit !== null && devCommit !== null,
|
||||
source: "deploy.json",
|
||||
serviceId: AUTH_BROKER_SERVICE_ID,
|
||||
prod: { present: prodCommit !== null, commitId: prodCommit },
|
||||
dev: { present: devCommit !== null, commitId: devCommit },
|
||||
dryRunOnly: true,
|
||||
};
|
||||
}
|
||||
|
||||
function serviceRegistrationContract(): Record<string, unknown> {
|
||||
return {
|
||||
config: readConfigRegistration(),
|
||||
compose: composeProfileRegistration(),
|
||||
deploy: deployManifestRegistration(),
|
||||
runtimeCredentialRef: runtimeCredentialRefPresence(),
|
||||
defaultRuntimeMutation: {
|
||||
ok: true,
|
||||
mutatesCurrentProd: false,
|
||||
composeProfileRequired: AUTH_BROKER_SERVICE_ID,
|
||||
publicPortPublished: false,
|
||||
liveDeployPerformed: false,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function parseOptions(args: string[]): BrokerAdapterOptions {
|
||||
const rawCommand = args[0] ?? "contract";
|
||||
if (!["contract", "credential-request", "pr-preflight", "health"].includes(rawCommand)) {
|
||||
@@ -101,11 +336,14 @@ function runnerEnvTokenCoverage(): Record<string, unknown> {
|
||||
}
|
||||
|
||||
function brokerCoverage(endpoint: string | null): Record<string, unknown> {
|
||||
const credential = runtimeCredentialRefPresence();
|
||||
return {
|
||||
ok: endpoint !== null,
|
||||
source: endpoint === null ? null : "auth-broker",
|
||||
endpoint: endpoint ?? null,
|
||||
credentialRef: endpoint === null ? null : "github:unidesk-dev",
|
||||
credentialRef: endpoint === null ? null : credential.credentialRef.valuePreview ?? "github:<ref>",
|
||||
credentialRefPresent: credential.credentialRef.present,
|
||||
credentialRefSourceKey: credential.credentialRef.key,
|
||||
scope: endpoint === null ? null : "broker-held-github-credential",
|
||||
runnerEnvTokenRequired: false,
|
||||
valuesRead: false,
|
||||
@@ -124,6 +362,7 @@ function brokerNeededResult(options: BrokerAdapterOptions): Record<string, unkno
|
||||
message: "No auth broker endpoint is configured for this dry-run contract; runner env token coverage is reported only for migration diagnostics.",
|
||||
tokenCoverage: runnerEnvTokenCoverage(),
|
||||
brokerCoverage: brokerCoverage(options.endpoint),
|
||||
serviceRegistration: serviceRegistrationContract(),
|
||||
authBroker: {
|
||||
ok: false,
|
||||
source: "broker/auth-broker-needed",
|
||||
@@ -158,7 +397,7 @@ function auditEventShape(options: BrokerAdapterOptions): Record<string, unknown>
|
||||
? { base: options.base, head: options.head, issueNumber: options.issueNumber }
|
||||
: null,
|
||||
dryRun: true,
|
||||
credentialRef: "github:unidesk-dev",
|
||||
credentialRef: "github:<ref>",
|
||||
credentialKind: "github-rest-token-ref",
|
||||
credentialValuePrinted: false,
|
||||
upstream: { method: "planned", path: "planned GitHub REST path without query secrets" },
|
||||
@@ -218,6 +457,7 @@ function readyContract(options: BrokerAdapterOptions): Record<string, unknown> {
|
||||
brokerCoverage: brokerCoverage(options.endpoint),
|
||||
credentialRequest: plannedCredentialRequest(options),
|
||||
auditEventShape: auditEventShape(options),
|
||||
serviceRegistration: serviceRegistrationContract(),
|
||||
prCapabilityContract: {
|
||||
targetBranch: options.base,
|
||||
headBranch: options.head,
|
||||
@@ -263,6 +503,7 @@ function contractResult(options: BrokerAdapterOptions): Record<string, unknown>
|
||||
registryCredentials: false,
|
||||
deployPermissions: false,
|
||||
},
|
||||
serviceRegistration: serviceRegistrationContract(),
|
||||
runnerNoTokenResult: brokerNeededResult({ ...options, endpoint: null }),
|
||||
readyShape: readyContract({ ...options, endpoint: "<UNIDESK_AUTH_BROKER_URL>" }),
|
||||
};
|
||||
@@ -305,6 +546,7 @@ export function runAuthBrokerCommand(args: string[]): Record<string, unknown> {
|
||||
phase: "p0",
|
||||
brokerCoverage: broker,
|
||||
tokenCoverage: envCoverage,
|
||||
serviceRegistration: serviceRegistrationContract(),
|
||||
healthRequest: {
|
||||
method: "GET",
|
||||
path: "/health",
|
||||
|
||||
Reference in New Issue
Block a user