355 lines
22 KiB
JavaScript
355 lines
22 KiB
JavaScript
"use strict";
|
|
|
|
const fs = require("node:fs");
|
|
const http = require("node:http");
|
|
const net = require("node:net");
|
|
const path = require("node:path");
|
|
const { execFile } = require("node:child_process");
|
|
|
|
const SOCKET_PATH = process.env.LAKE_LAMP_ARCHITECTURE_PROVISION_SOCKET || "/run/guanghu-architecture-provision/provision.sock";
|
|
const REPO_DIR = process.env.ARCHITECTURE_PROVISION_REPO_DIR || "/var/lib/guanghu/architecture-provision/repo";
|
|
const REPO_URL = process.env.ARCHITECTURE_PROVISION_REPO_URL || "https://guanghulab.com/code/bingshuo/guanghu-ice-heart.git";
|
|
const RELEASES_DIR = process.env.ARCHITECTURE_PROVISION_RELEASES_DIR || "/opt/guanghu/architecture-releases";
|
|
const UNIT_DIR = process.env.ARCHITECTURE_PROVISION_UNIT_DIR || "/etc/systemd/system";
|
|
const RECEIPTS_DIR = process.env.ARCHITECTURE_PROVISION_RECEIPTS_DIR || "/var/lib/guanghu/architecture-provision/receipts";
|
|
|
|
function parseResource(value) {
|
|
const match = String(value || "").match(/^([A-Z0-9][A-Z0-9._-]{5,119})@([0-9a-f]{40})$/);
|
|
return match ? { requestId: match[1], commit: match[2] } : null;
|
|
}
|
|
|
|
function safeRelative(value) {
|
|
const item = String(value || "");
|
|
return item.length > 0 && item.length <= 240 && !path.isAbsolute(item) && !item.split("/").includes("..") && /^[A-Za-z0-9._/-]+$/.test(item);
|
|
}
|
|
|
|
function validateManifest(manifest, resource) {
|
|
if (!manifest || !["guanghu.architecture-provision-request/v1", "guanghu.existing-service-update-request/v1"].includes(manifest.schema)) throw new Error("invalid_manifest_schema");
|
|
if (manifest.request_id !== resource.requestId || manifest.target_node !== "JD-FD-PRIMARY") throw new Error("manifest_identity_mismatch");
|
|
const unit = String(manifest.module && manifest.module.unit || "");
|
|
if (!/^[A-Za-z0-9_.@-]+\.service$/.test(unit)) throw new Error("invalid_unit_name");
|
|
if (manifest.schema === "guanghu.existing-service-update-request/v1") return validateServiceUpdateManifest(manifest, unit);
|
|
if (manifest.status !== "ARCHITECTURE_PACKAGE_READY · INITIAL_PROVISION_PENDING") throw new Error("manifest_not_pending");
|
|
if (!manifest.initial_provision || manifest.initial_provision.kind !== "new-architecture-unit") throw new Error("not_initial_architecture_unit");
|
|
if (!Array.isArray(manifest.source_paths) || manifest.source_paths.length < 1 || manifest.source_paths.length > 64 || manifest.source_paths.some(item => !safeRelative(item))) throw new Error("invalid_source_paths");
|
|
const unitMatches = manifest.source_paths.filter(item => path.basename(item) === unit);
|
|
if (unitMatches.length !== 1) throw new Error("unit_not_uniquely_declared");
|
|
const check = manifest.runtime_check || {};
|
|
if (!/^http:\/\/127\.0\.0\.1:\d{2,5}\/[A-Za-z0-9._/?=&-]*$/.test(String(check.url || ""))) throw new Error("invalid_loopback_runtime_check");
|
|
if (!check.expected || typeof check.expected !== "object" || Array.isArray(check.expected)) throw new Error("invalid_runtime_expectation");
|
|
return { kind: "initial-provision", unit, unitSource: unitMatches[0], sourcePaths: manifest.source_paths, runtimeCheck: check };
|
|
}
|
|
|
|
function validateServiceUpdateManifest(manifest, unit) {
|
|
if (manifest.status !== "SERVICE_UPDATE_PACKAGE_READY · DEPLOYMENT_PENDING") throw new Error("manifest_not_pending");
|
|
if (!manifest.service_update || manifest.service_update.kind !== "existing-systemd-service" || manifest.service_update.require_existing_unit !== true) throw new Error("not_existing_service_update");
|
|
const installRoot = String(manifest.module && manifest.module.install_root || "");
|
|
if (!/^\/opt\/guanghu\/[a-z0-9][a-z0-9-]{1,62}$/.test(installRoot)) throw new Error("invalid_service_install_root");
|
|
const unitSource = String(manifest.unit_source || "");
|
|
if (!safeRelative(unitSource) || path.basename(unitSource) !== unit) throw new Error("invalid_unit_source");
|
|
if (!Array.isArray(manifest.files) || manifest.files.length < 1 || manifest.files.length > 64) throw new Error("invalid_update_files");
|
|
const seenDestinations = new Set();
|
|
for (const item of manifest.files) {
|
|
if (!item || !safeRelative(item.source) || !safeRelative(item.destination)) throw new Error("invalid_update_file_path");
|
|
if (!/^(?:0?644|0?755)$/.test(String(item.mode || ""))) throw new Error("invalid_update_file_mode");
|
|
if (seenDestinations.has(item.destination)) throw new Error("duplicate_update_destination");
|
|
seenDestinations.add(item.destination);
|
|
}
|
|
const requiredExisting = manifest.service_update.required_existing_files || [];
|
|
if (!Array.isArray(requiredExisting) || requiredExisting.some(item => !safeRelative(item) || !seenDestinations.has(item))) throw new Error("invalid_required_existing_files");
|
|
const check = manifest.runtime_check || {};
|
|
if (!/^http:\/\/127\.0\.0\.1:\d{2,5}\/[A-Za-z0-9._/?=&-]*$/.test(String(check.url || ""))) throw new Error("invalid_loopback_runtime_check");
|
|
if (!check.expected || typeof check.expected !== "object" || Array.isArray(check.expected)) throw new Error("invalid_runtime_expectation");
|
|
const acceptanceChecks = manifest.acceptance_checks || [];
|
|
if (!Array.isArray(acceptanceChecks) || acceptanceChecks.length > 16) throw new Error("invalid_acceptance_checks");
|
|
for (const item of acceptanceChecks) {
|
|
if (!item || !/^http:\/\/127\.0\.0\.1:\d{2,5}\/[A-Za-z0-9._/?=&-]*$/.test(String(item.url || ""))) throw new Error("invalid_acceptance_check_url");
|
|
if (!item.expected || typeof item.expected !== "object" || Array.isArray(item.expected)) throw new Error("invalid_acceptance_expectation");
|
|
}
|
|
return {
|
|
kind: "existing-service-update",
|
|
unit,
|
|
unitSource,
|
|
installRoot,
|
|
files: manifest.files,
|
|
requiredExisting,
|
|
sourcePaths: [unitSource, ...manifest.files.map(item => item.source)],
|
|
runtimeCheck: check,
|
|
acceptanceChecks,
|
|
};
|
|
}
|
|
|
|
function declaredPaths(value) {
|
|
return String(value || "").split(/\s+/).filter(Boolean);
|
|
}
|
|
|
|
function pathAllowed(candidate, allowed) {
|
|
const clean = String(candidate || "").replace(/^-/, "");
|
|
return allowed.some(base => clean === base || clean.startsWith(`${base}/`));
|
|
}
|
|
|
|
function validateUnit(text, expectedUser = "guanghu", policy = {}) {
|
|
const value = String(text || "");
|
|
if (!value.includes("[Service]") || !/^NoNewPrivileges=(true|yes)$/m.test(value) || !/^ProtectSystem=strict$/m.test(value) || !/^ProtectHome=(true|yes)$/m.test(value) || !/^PrivateTmp=(true|yes)$/m.test(value)) throw new Error("unit_hardening_required");
|
|
if (!/^[a-z_][a-z0-9_-]{0,30}$/.test(expectedUser) || expectedUser === "root" || !new RegExp(`^User=${expectedUser}$`, "m").test(value) || !new RegExp(`^Group=${expectedUser}$`, "m").test(value)) throw new Error("dedicated_service_user_required");
|
|
if (/^(SupplementaryGroups|AmbientCapabilities|CapabilityBoundingSet|BindPaths|BindReadOnlyPaths|RootDirectory|RootImage|DeviceAllow)=/m.test(value)) throw new Error("privileged_unit_directive_forbidden");
|
|
const environmentFiles = Array.isArray(policy.environment_files) ? policy.environment_files : [];
|
|
const writablePaths = Array.isArray(policy.writable_paths) ? policy.writable_paths : [];
|
|
const readOnlyPaths = Array.isArray(policy.read_only_paths) ? policy.read_only_paths : [];
|
|
for (const match of value.matchAll(/^EnvironmentFile=(.+)$/gm)) {
|
|
if (!pathAllowed(match[1], environmentFiles) || !String(match[1]).replace(/^-/, "").startsWith("/etc/guanghu/persona-secrets/")) throw new Error("environment_file_not_declared");
|
|
}
|
|
for (const match of value.matchAll(/^ReadWritePaths=(.+)$/gm)) {
|
|
for (const item of declaredPaths(match[1])) if (!pathAllowed(item, writablePaths) || !item.startsWith(`/var/lib/guanghu/personas/${expectedUser}`)) throw new Error("writable_path_not_declared");
|
|
}
|
|
for (const match of value.matchAll(/^ReadOnlyPaths=(.+)$/gm)) {
|
|
for (const item of declaredPaths(match[1])) if (item !== "__RELEASE_ROOT__" && !pathAllowed(item, readOnlyPaths)) throw new Error("read_only_path_not_declared");
|
|
}
|
|
if (!value.includes("__RELEASE_ROOT__")) throw new Error("release_root_placeholder_required");
|
|
return value;
|
|
}
|
|
|
|
function validateUpdateUnit(text, expectedUser, installRoot) {
|
|
const value = String(text || "");
|
|
if (!value.includes("[Service]") || !/^NoNewPrivileges=(true|yes)$/m.test(value) || !/^ProtectSystem=strict$/m.test(value) || !/^ProtectHome=(true|yes)$/m.test(value) || !/^PrivateTmp=(true|yes)$/m.test(value)) throw new Error("unit_hardening_required");
|
|
if (!/^[a-z_][a-z0-9_-]{0,30}$/.test(expectedUser) || expectedUser === "root" || !new RegExp(`^User=${expectedUser}$`, "m").test(value) || !new RegExp(`^Group=${expectedUser}$`, "m").test(value)) throw new Error("dedicated_service_user_required");
|
|
if (!value.includes(`WorkingDirectory=${installRoot}`) || !value.includes(`ReadOnlyPaths=${installRoot}`)) throw new Error("service_install_root_not_confined");
|
|
const execStart = value.match(/^ExecStart=(.+)$/m);
|
|
if (!execStart || !execStart[1].includes(`${installRoot}/`) || /[;&|`$<>]/.test(execStart[1])) throw new Error("service_exec_start_not_confined");
|
|
if (/^(SupplementaryGroups|AmbientCapabilities|BindPaths|BindReadOnlyPaths|RootDirectory|RootImage|DeviceAllow|EnvironmentFile|ReadWritePaths)=/m.test(value)) throw new Error("privileged_unit_directive_forbidden");
|
|
return value;
|
|
}
|
|
|
|
async function provision(request, options = {}) {
|
|
if (!request || request.target !== "JD-FD-PRIMARY" || request.action !== "provision-approved-architecture") return { ok: false, error: "action_not_registered" };
|
|
const resource = parseResource(request.resource);
|
|
if (!resource) return { ok: false, error: "immutable_architecture_resource_required" };
|
|
const repoDir = options.repoDir || REPO_DIR;
|
|
const releasesDir = options.releasesDir || RELEASES_DIR;
|
|
const unitDir = options.unitDir || UNIT_DIR;
|
|
const receiptsDir = options.receiptsDir || RECEIPTS_DIR;
|
|
const run = options.run || runFile;
|
|
let installedUnit = null;
|
|
let unitBackup = null;
|
|
try {
|
|
await prepareRepo(repoDir, resource.commit, run, options.repoUrl || REPO_URL);
|
|
const manifestPath = path.join(repoDir, "deployment", "requests", `${resource.requestId}.json`);
|
|
const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
|
|
let checked = validateManifest(manifest, resource);
|
|
if (checked.kind === "existing-service-update") {
|
|
if (options.installRootOverride) checked = { ...checked, installRoot: options.installRootOverride };
|
|
return await updateExistingService({
|
|
checked, manifest, resource, repoDir, releasesDir, unitDir, receiptsDir, run,
|
|
getJson: options.getJson, healthAttempts: options.healthAttempts, healthDelayMs: options.healthDelayMs,
|
|
});
|
|
}
|
|
const releaseRoot = path.join(releasesDir, resource.commit);
|
|
fs.mkdirSync(releaseRoot, { recursive: true, mode: 0o755 });
|
|
for (const relative of checked.sourcePaths) copyDeclaredFile(repoDir, releaseRoot, relative);
|
|
const unitSource = path.join(releaseRoot, checked.unitSource);
|
|
const unitText = validateUnit(fs.readFileSync(unitSource, "utf8"), String(manifest.module.run_user || ""), manifest.module).replaceAll("__RELEASE_ROOT__", releaseRoot);
|
|
fs.mkdirSync(unitDir, { recursive: true, mode: 0o755 });
|
|
installedUnit = path.join(unitDir, checked.unit);
|
|
if (fs.existsSync(installedUnit)) unitBackup = fs.readFileSync(installedUnit);
|
|
const backupDir = path.join(receiptsDir, "backups", resource.requestId, resource.commit);
|
|
fs.mkdirSync(backupDir, { recursive: true, mode: 0o700 });
|
|
if (unitBackup) fs.writeFileSync(path.join(backupDir, checked.unit), unitBackup, { mode: 0o600 });
|
|
else fs.writeFileSync(path.join(backupDir, `${checked.unit}.previously-absent`), "\n", { mode: 0o600 });
|
|
writeAtomic(installedUnit, unitText, 0o644);
|
|
await run("/usr/bin/systemctl", ["daemon-reload"]);
|
|
if (unitBackup) {
|
|
await run("/usr/bin/systemctl", ["enable", checked.unit]);
|
|
await run("/usr/bin/systemctl", ["restart", checked.unit]);
|
|
} else {
|
|
await run("/usr/bin/systemctl", ["enable", "--now", checked.unit]);
|
|
}
|
|
const runtime = await getJsonWithRetry(checked.runtimeCheck.url, options.getJson, options.healthAttempts, options.healthDelayMs);
|
|
for (const [key, expected] of Object.entries(checked.runtimeCheck.expected)) if (runtime[key] !== expected) throw new Error(`runtime_check_failed:${key}`);
|
|
const receipt = { schema: "guanghu.architecture-provision-receipt/v1", request_id: resource.requestId, source_commit: resource.commit, target_node: "JD-FD-PRIMARY", unit: checked.unit, runtime_check: checked.runtimeCheck.url, backup: path.join("backups", resource.requestId, resource.commit), rollback: unitBackup ? "restore-previous-unit" : "remove-new-unit", result: "DEPLOYED_AND_VERIFIED", recorded_at: new Date().toISOString() };
|
|
fs.mkdirSync(receiptsDir, { recursive: true, mode: 0o700 });
|
|
writeAtomic(path.join(receiptsDir, `${resource.requestId}.json`), `${JSON.stringify(receipt, null, 2)}\n`, 0o600);
|
|
return { ok: true, request_id: resource.requestId, source_commit: resource.commit, unit: checked.unit, runtime: "verified" };
|
|
} catch (error) {
|
|
if (installedUnit) {
|
|
try {
|
|
await run("/usr/bin/systemctl", ["disable", "--now", path.basename(installedUnit)]);
|
|
if (unitBackup) fs.writeFileSync(installedUnit, unitBackup, { mode: 0o644 });
|
|
else fs.rmSync(installedUnit, { force: true });
|
|
await run("/usr/bin/systemctl", ["daemon-reload"]);
|
|
if (unitBackup) await run("/usr/bin/systemctl", ["enable", "--now", path.basename(installedUnit)]);
|
|
} catch { /* The original error remains authoritative; backup is retained for manual recovery. */ }
|
|
}
|
|
return { ok: false, error: String(error && error.message || "provision_failed").slice(0, 240) };
|
|
}
|
|
}
|
|
|
|
async function updateExistingService(context) {
|
|
const { checked, manifest, resource, repoDir, releasesDir, unitDir, receiptsDir, run } = context;
|
|
const releaseRoot = path.join(releasesDir, resource.commit);
|
|
const installedUnit = path.join(unitDir, checked.unit);
|
|
const backupDir = path.join(receiptsDir, "backups", resource.requestId, resource.commit);
|
|
const backups = [];
|
|
let updateStarted = false;
|
|
try {
|
|
if (!fs.existsSync(installedUnit) || !fs.lstatSync(installedUnit).isFile() || fs.lstatSync(installedUnit).isSymbolicLink()) throw new Error("existing_service_unit_required");
|
|
for (const relative of checked.requiredExisting) {
|
|
const existing = path.join(checked.installRoot, relative);
|
|
if (!fs.existsSync(existing) || !fs.lstatSync(existing).isFile() || fs.lstatSync(existing).isSymbolicLink()) throw new Error(`required_existing_file_missing:${relative}`);
|
|
}
|
|
fs.mkdirSync(releaseRoot, { recursive: true, mode: 0o755 });
|
|
for (const relative of checked.sourcePaths) copyDeclaredFile(repoDir, releaseRoot, relative);
|
|
const unitText = validateUpdateUnit(fs.readFileSync(path.join(releaseRoot, checked.unitSource), "utf8"), String(manifest.module.run_user || ""), checked.installRoot);
|
|
fs.mkdirSync(backupDir, { recursive: true, mode: 0o700 });
|
|
backupFile(installedUnit, path.join(backupDir, "systemd", checked.unit), backups);
|
|
for (const item of checked.files) {
|
|
const destination = path.join(checked.installRoot, item.destination);
|
|
backupFile(destination, path.join(backupDir, "files", item.destination), backups);
|
|
}
|
|
updateStarted = true;
|
|
fs.mkdirSync(checked.installRoot, { recursive: true, mode: 0o755 });
|
|
for (const item of checked.files) {
|
|
const destination = path.join(checked.installRoot, item.destination);
|
|
if (fs.existsSync(destination) && fs.lstatSync(destination).isSymbolicLink()) throw new Error("update_destination_symlink_forbidden");
|
|
fs.mkdirSync(path.dirname(destination), { recursive: true, mode: 0o755 });
|
|
writeAtomic(destination, fs.readFileSync(path.join(releaseRoot, item.source)), Number.parseInt(String(item.mode), 8));
|
|
}
|
|
writeAtomic(installedUnit, unitText, 0o644);
|
|
await run("/usr/bin/systemctl", ["daemon-reload"]);
|
|
await run("/usr/bin/systemctl", ["restart", checked.unit]);
|
|
const runtime = await getJsonWithRetry(checked.runtimeCheck.url, context.getJson, context.healthAttempts, context.healthDelayMs);
|
|
for (const [key, expected] of Object.entries(checked.runtimeCheck.expected)) if (runtime[key] !== expected) throw new Error(`runtime_check_failed:${key}`);
|
|
for (const check of checked.acceptanceChecks) {
|
|
const observed = await getJsonWithRetry(check.url, context.getJson, context.healthAttempts, context.healthDelayMs);
|
|
for (const [key, expected] of Object.entries(check.expected)) if (observed[key] !== expected) throw new Error(`acceptance_check_failed:${key}`);
|
|
}
|
|
const receipt = {
|
|
schema: "guanghu.existing-service-update-receipt/v1",
|
|
request_id: resource.requestId,
|
|
source_commit: resource.commit,
|
|
target_node: "JD-FD-PRIMARY",
|
|
unit: checked.unit,
|
|
install_root: checked.installRoot,
|
|
runtime_check: checked.runtimeCheck.url,
|
|
acceptance_checks: checked.acceptanceChecks.map(item => item.url),
|
|
backup: path.join("backups", resource.requestId, resource.commit),
|
|
rollback: "restore-all-declared-files-and-previous-unit",
|
|
result: "DEPLOYED_AND_VERIFIED",
|
|
recorded_at: new Date().toISOString(),
|
|
};
|
|
fs.mkdirSync(receiptsDir, { recursive: true, mode: 0o700 });
|
|
writeAtomic(path.join(receiptsDir, `${resource.requestId}.json`), `${JSON.stringify(receipt, null, 2)}\n`, 0o600);
|
|
return { ok: true, request_id: resource.requestId, source_commit: resource.commit, unit: checked.unit, runtime: "verified" };
|
|
} catch (error) {
|
|
if (updateStarted) {
|
|
try {
|
|
restoreBackups(backups);
|
|
await run("/usr/bin/systemctl", ["daemon-reload"]);
|
|
await run("/usr/bin/systemctl", ["restart", checked.unit]);
|
|
} catch { /* The original error remains authoritative; backups stay available for recovery. */ }
|
|
}
|
|
return { ok: false, error: String(error && error.message || "service_update_failed").slice(0, 240) };
|
|
}
|
|
}
|
|
|
|
function backupFile(source, backup, records) {
|
|
if (!fs.existsSync(source)) {
|
|
records.push({ source, backup, existed: false });
|
|
return;
|
|
}
|
|
const stat = fs.lstatSync(source);
|
|
if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("backup_source_not_regular_file");
|
|
fs.mkdirSync(path.dirname(backup), { recursive: true, mode: 0o700 });
|
|
fs.copyFileSync(source, backup, fs.constants.COPYFILE_EXCL);
|
|
fs.chmodSync(backup, stat.mode & 0o777);
|
|
records.push({ source, backup, existed: true, mode: stat.mode & 0o777 });
|
|
}
|
|
|
|
function restoreBackups(records) {
|
|
for (const record of records.slice().reverse()) {
|
|
if (!record.existed) {
|
|
fs.rmSync(record.source, { force: true });
|
|
continue;
|
|
}
|
|
fs.mkdirSync(path.dirname(record.source), { recursive: true, mode: 0o755 });
|
|
writeAtomic(record.source, fs.readFileSync(record.backup), record.mode);
|
|
}
|
|
}
|
|
|
|
async function prepareRepo(repoDir, commit, run, repoUrl) {
|
|
fs.mkdirSync(path.dirname(repoDir), { recursive: true, mode: 0o700 });
|
|
if (!fs.existsSync(path.join(repoDir, ".git"))) await run("/usr/bin/git", ["clone", "--filter=blob:none", "--no-checkout", repoUrl, repoDir]);
|
|
await run("/usr/bin/git", ["-C", repoDir, "fetch", "--depth=1", "origin", commit]);
|
|
await run("/usr/bin/git", ["-C", repoDir, "checkout", "--detach", "--force", commit]);
|
|
const head = (await run("/usr/bin/git", ["-C", repoDir, "rev-parse", "HEAD"])).stdout.trim();
|
|
if (head !== commit) throw new Error("commit_verification_failed");
|
|
}
|
|
|
|
function copyDeclaredFile(repoDir, releaseRoot, relative) {
|
|
const source = path.join(repoDir, relative);
|
|
const stat = fs.lstatSync(source);
|
|
if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("declared_source_not_regular_file");
|
|
const destination = path.join(releaseRoot, relative);
|
|
fs.mkdirSync(path.dirname(destination), { recursive: true, mode: 0o755 });
|
|
if (fs.existsSync(destination)) {
|
|
if (!fs.readFileSync(source).equals(fs.readFileSync(destination))) throw new Error("immutable_release_collision");
|
|
return;
|
|
}
|
|
fs.copyFileSync(source, destination, fs.constants.COPYFILE_EXCL);
|
|
fs.chmodSync(destination, stat.mode & 0o755);
|
|
}
|
|
|
|
function writeAtomic(file, content, mode) {
|
|
const temp = `${file}.${process.pid}.tmp`;
|
|
fs.writeFileSync(temp, content, { mode });
|
|
fs.renameSync(temp, file);
|
|
}
|
|
|
|
function runFile(file, args) {
|
|
return new Promise((resolve, reject) => execFile(file, args, { timeout: 120000, maxBuffer: 200000 }, (error, stdout, stderr) => error ? reject(new Error(`command_failed:${path.basename(file)}:${String(stderr || error.message).slice(0, 120)}`)) : resolve({ stdout: String(stdout || ""), stderr: String(stderr || "") })));
|
|
}
|
|
|
|
function getJson(url, override) {
|
|
if (override) return override(url);
|
|
return new Promise((resolve, reject) => {
|
|
const req = http.get(url, { timeout: 5000 }, response => {
|
|
let body = "";
|
|
response.on("data", chunk => { body += chunk; if (body.length > 100000) req.destroy(); });
|
|
response.on("end", () => { try { resolve(JSON.parse(body)); } catch { reject(new Error("invalid_runtime_response")); } });
|
|
});
|
|
req.on("timeout", () => req.destroy(new Error("runtime_check_timeout")));
|
|
req.on("error", reject);
|
|
});
|
|
}
|
|
|
|
async function getJsonWithRetry(url, override, attempts = 15, delayMs = 1000) {
|
|
let lastError;
|
|
for (let attempt = 1; attempt <= attempts; attempt += 1) {
|
|
try { return await getJson(url, override); }
|
|
catch (error) {
|
|
lastError = error;
|
|
if (attempt < attempts) await new Promise(resolve => setTimeout(resolve, delayMs));
|
|
}
|
|
}
|
|
throw lastError;
|
|
}
|
|
|
|
function reply(socket, value) { socket.end(`${JSON.stringify(value)}\n`); }
|
|
|
|
if (require.main === module) {
|
|
fs.mkdirSync(path.dirname(SOCKET_PATH), { recursive: true, mode: 0o755 });
|
|
try { fs.unlinkSync(SOCKET_PATH); } catch (error) { if (error.code !== "ENOENT") throw error; }
|
|
const server = net.createServer({ allowHalfOpen: true }, socket => {
|
|
let input = "";
|
|
socket.setTimeout(140000, () => socket.destroy());
|
|
socket.on("data", chunk => { input += chunk.toString("utf8"); if (input.length > 4096) socket.destroy(); });
|
|
socket.on("end", async () => {
|
|
let request;
|
|
try { request = JSON.parse(input); } catch { return reply(socket, { ok: false, error: "invalid_request" }); }
|
|
if (!request || request.cmd || request.command || request.shell || request.args) return reply(socket, { ok: false, error: "arbitrary_command_forbidden" });
|
|
reply(socket, await provision(request));
|
|
});
|
|
});
|
|
server.listen(SOCKET_PATH, () => { fs.chownSync(SOCKET_PATH, 0, Number(process.env.LAKE_LAMP_AUTHZ_GID || 0)); fs.chmodSync(SOCKET_PATH, 0o660); });
|
|
}
|
|
|
|
module.exports = { parseResource, safeRelative, validateManifest, validateUnit, validateUpdateUnit, provision };
|