deploy(ai-discovery): add safe existing-service update path
This commit is contained in:
parent
7c3c8e9238
commit
2739104088
14 changed files with 427 additions and 26 deletions
|
|
@ -5,7 +5,7 @@ const assert = require("node:assert/strict");
|
|||
const fs = require("node:fs");
|
||||
const os = require("node:os");
|
||||
const path = require("node:path");
|
||||
const { parseResource, safeRelative, validateManifest, validateUnit, provision } = require("./architecture-provision-broker");
|
||||
const { parseResource, safeRelative, validateManifest, validateUnit, validateUpdateUnit, provision } = require("./architecture-provision-broker");
|
||||
|
||||
const commit = "d".repeat(40);
|
||||
const requestId = "GLS-0231-JD-LAN-01-INITIAL-PROVISION-20260720";
|
||||
|
|
@ -44,6 +44,25 @@ test("unit permits a declared persona user, shared secret and state directory",
|
|||
assert.throws(() => validateUnit(unit.replaceAll("kezhou", "root"), "root", policy), /dedicated_service_user_required/);
|
||||
});
|
||||
|
||||
test("AI discovery update package declares all four route maps and passes the existing-service policy", () => {
|
||||
const root = path.resolve(__dirname, "../..");
|
||||
const request = JSON.parse(fs.readFileSync(path.join(root, "deployment", "requests", "AI-DISCOVERY-ICE-P-ROUTE-20260727.json")));
|
||||
const checked = validateManifest(request, { requestId: request.request_id, commit });
|
||||
assert.equal(checked.kind, "existing-service-update");
|
||||
assert.deepEqual(checked.files.map(item => item.destination), [
|
||||
"server.js",
|
||||
"repository-route-map.json",
|
||||
"server-node-map.json",
|
||||
"fifth-domain-subject-registry.json",
|
||||
"subject-id-alias-map.json",
|
||||
]);
|
||||
const unit = fs.readFileSync(path.join(root, request.unit_source), "utf8");
|
||||
assert.equal(validateUpdateUnit(unit, request.module.run_user, request.module.install_root), unit);
|
||||
for (const variable of ["GUANGHU_REPOSITORY_MAP", "GUANGHU_NODE_MAP", "GUANGHU_SUBJECT_REGISTRY", "GUANGHU_SUBJECT_ALIAS_MAP"]) {
|
||||
assert.match(unit, new RegExp(`^Environment=${variable}=`, "m"));
|
||||
}
|
||||
});
|
||||
|
||||
test("provision copies only declared files and verifies loopback health", async () => {
|
||||
const root = fs.mkdtempSync(path.join(os.tmpdir(), "architecture-provision-"));
|
||||
const repoDir = path.join(root, "repo");
|
||||
|
|
@ -75,3 +94,96 @@ test("provision copies only declared files and verifies loopback health", async
|
|||
assert.equal(healthChecks, 2);
|
||||
} finally { fs.rmSync(root, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test("existing service update backs up declared files, restarts, and verifies identity routes", async () => {
|
||||
const root = fs.mkdtempSync(path.join(os.tmpdir(), "existing-service-update-"));
|
||||
const repoDir = path.join(root, "repo"), releasesDir = path.join(root, "releases");
|
||||
const unitDir = path.join(root, "units"), receiptsDir = path.join(root, "receipts");
|
||||
const installRoot = path.join(root, "opt", "ai-discovery");
|
||||
const updateRequestId = "AI-DISCOVERY-ICE-P-ROUTE-20260727";
|
||||
const updateManifest = {
|
||||
schema: "guanghu.existing-service-update-request/v1",
|
||||
request_id: updateRequestId,
|
||||
target_node: "JD-FD-PRIMARY",
|
||||
status: "SERVICE_UPDATE_PACKAGE_READY · DEPLOYMENT_PENDING",
|
||||
module: { unit: "guanghu-ai-discovery.service", run_user: "guanghu", install_root: "/opt/guanghu/ai-discovery" },
|
||||
service_update: { kind: "existing-systemd-service", require_existing_unit: true, required_existing_files: ["server.js"] },
|
||||
unit_source: "server-tools/ai-discovery/guanghu-ai-discovery.service",
|
||||
files: [{ source: "server-tools/ai-discovery/server.js", destination: "server.js", mode: "0644" }],
|
||||
runtime_check: { url: "http://127.0.0.1:3922/health", expected: { ok: true, mode: "read-only" } },
|
||||
acceptance_checks: [{ url: "http://127.0.0.1:3922/v1/resolve?id=ICE-GL-ZY001", expected: { canonical_id: "ICE-P-ZY001", redirected: true } }],
|
||||
};
|
||||
fs.mkdirSync(path.join(repoDir, "deployment", "requests"), { recursive: true });
|
||||
fs.mkdirSync(path.join(repoDir, "server-tools", "ai-discovery"), { recursive: true });
|
||||
fs.mkdirSync(unitDir, { recursive: true });
|
||||
fs.mkdirSync(installRoot, { recursive: true });
|
||||
fs.writeFileSync(path.join(repoDir, "deployment", "requests", `${updateRequestId}.json`), JSON.stringify(updateManifest));
|
||||
fs.writeFileSync(path.join(repoDir, "server-tools", "ai-discovery", "server.js"), "new server\n");
|
||||
const newUnit = `[Service]\nUser=guanghu\nGroup=guanghu\nWorkingDirectory=${installRoot}\nNoNewPrivileges=true\nPrivateTmp=true\nProtectSystem=strict\nProtectHome=true\nReadOnlyPaths=${installRoot}\nExecStart=/usr/bin/node ${installRoot}/server.js\n`;
|
||||
fs.writeFileSync(path.join(repoDir, "server-tools", "ai-discovery", "guanghu-ai-discovery.service"), newUnit);
|
||||
fs.writeFileSync(path.join(installRoot, "server.js"), "old server\n");
|
||||
fs.writeFileSync(path.join(unitDir, "guanghu-ai-discovery.service"), "old unit\n");
|
||||
const commands = [];
|
||||
try {
|
||||
const result = await provision({ target: "JD-FD-PRIMARY", action: "provision-approved-architecture", resource: `${updateRequestId}@${commit}` }, {
|
||||
repoDir, releasesDir, unitDir, receiptsDir, installRootOverride: installRoot,
|
||||
run: async (file, args) => { commands.push([file, args]); return { stdout: args.includes("rev-parse") ? `${commit}\n` : "" }; },
|
||||
getJson: async url => url.endsWith("/health") ? { ok: true, mode: "read-only" } : { canonical_id: "ICE-P-ZY001", redirected: true },
|
||||
healthDelayMs: 0,
|
||||
});
|
||||
assert.equal(result.ok, true);
|
||||
assert.equal(fs.readFileSync(path.join(installRoot, "server.js"), "utf8"), "new server\n");
|
||||
assert.equal(commands.some(([, args]) => args[0] === "restart" && args[1] === "guanghu-ai-discovery.service"), true);
|
||||
const receipt = JSON.parse(fs.readFileSync(path.join(receiptsDir, `${updateRequestId}.json`)));
|
||||
assert.equal(receipt.result, "DEPLOYED_AND_VERIFIED");
|
||||
assert.equal(receipt.acceptance_checks.length, 1);
|
||||
} finally { fs.rmSync(root, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test("existing service update restores every changed file when acceptance fails", async () => {
|
||||
const root = fs.mkdtempSync(path.join(os.tmpdir(), "existing-service-rollback-"));
|
||||
const repoDir = path.join(root, "repo"), releasesDir = path.join(root, "releases");
|
||||
const unitDir = path.join(root, "units"), receiptsDir = path.join(root, "receipts");
|
||||
const installRoot = path.join(root, "opt", "ai-discovery");
|
||||
const updateRequestId = "AI-DISCOVERY-ROLLBACK-TEST";
|
||||
const updateManifest = {
|
||||
schema: "guanghu.existing-service-update-request/v1",
|
||||
request_id: updateRequestId,
|
||||
target_node: "JD-FD-PRIMARY",
|
||||
status: "SERVICE_UPDATE_PACKAGE_READY · DEPLOYMENT_PENDING",
|
||||
module: { unit: "guanghu-ai-discovery.service", run_user: "guanghu", install_root: "/opt/guanghu/ai-discovery" },
|
||||
service_update: { kind: "existing-systemd-service", require_existing_unit: true, required_existing_files: ["server.js"] },
|
||||
unit_source: "server-tools/ai-discovery/guanghu-ai-discovery.service",
|
||||
files: [
|
||||
{ source: "server-tools/ai-discovery/server.js", destination: "server.js", mode: "0644" },
|
||||
{ source: "identity/alias.json", destination: "alias.json", mode: "0644" }
|
||||
],
|
||||
runtime_check: { url: "http://127.0.0.1:3922/health", expected: { ok: true } },
|
||||
acceptance_checks: [],
|
||||
};
|
||||
fs.mkdirSync(path.join(repoDir, "deployment", "requests"), { recursive: true });
|
||||
fs.mkdirSync(path.join(repoDir, "server-tools", "ai-discovery"), { recursive: true });
|
||||
fs.mkdirSync(path.join(repoDir, "identity"), { recursive: true });
|
||||
fs.mkdirSync(unitDir, { recursive: true });
|
||||
fs.mkdirSync(installRoot, { recursive: true });
|
||||
fs.writeFileSync(path.join(repoDir, "deployment", "requests", `${updateRequestId}.json`), JSON.stringify(updateManifest));
|
||||
fs.writeFileSync(path.join(repoDir, "server-tools", "ai-discovery", "server.js"), "new server\n");
|
||||
fs.writeFileSync(path.join(repoDir, "identity", "alias.json"), "{}\n");
|
||||
fs.writeFileSync(path.join(repoDir, "server-tools", "ai-discovery", "guanghu-ai-discovery.service"), `[Service]\nUser=guanghu\nGroup=guanghu\nWorkingDirectory=${installRoot}\nNoNewPrivileges=true\nPrivateTmp=true\nProtectSystem=strict\nProtectHome=true\nReadOnlyPaths=${installRoot}\nExecStart=/usr/bin/node ${installRoot}/server.js\n`);
|
||||
fs.writeFileSync(path.join(installRoot, "server.js"), "old server\n");
|
||||
fs.writeFileSync(path.join(unitDir, "guanghu-ai-discovery.service"), "old unit\n");
|
||||
try {
|
||||
const result = await provision({ target: "JD-FD-PRIMARY", action: "provision-approved-architecture", resource: `${updateRequestId}@${commit}` }, {
|
||||
repoDir, releasesDir, unitDir, receiptsDir, installRootOverride: installRoot,
|
||||
run: async (file, args) => ({ stdout: args.includes("rev-parse") ? `${commit}\n` : "" }),
|
||||
getJson: async () => ({ ok: false }),
|
||||
healthAttempts: 1,
|
||||
healthDelayMs: 0,
|
||||
});
|
||||
assert.equal(result.ok, false);
|
||||
assert.match(result.error, /runtime_check_failed:ok/);
|
||||
assert.equal(fs.readFileSync(path.join(installRoot, "server.js"), "utf8"), "old server\n");
|
||||
assert.equal(fs.existsSync(path.join(installRoot, "alias.json")), false);
|
||||
assert.equal(fs.readFileSync(path.join(unitDir, "guanghu-ai-discovery.service"), "utf8"), "old unit\n");
|
||||
} finally { fs.rmSync(root, { recursive: true, force: true }); }
|
||||
});
|
||||
|
|
|
|||
Loading…
Reference in a new issue