52 lines
2.8 KiB
JavaScript
52 lines
2.8 KiB
JavaScript
"use strict";
|
|
const crypto = require("node:crypto");
|
|
const fs = require("node:fs");
|
|
const path = require("node:path");
|
|
const { validateDeploymentSource } = require("./deployment-source-policy");
|
|
|
|
// A push can request deployment, but it can never execute deployment itself.
|
|
// The separate resident deployment agent consumes these immutable event files.
|
|
function enqueueDeploymentEvent(intent, push, queueDir, context = {}) {
|
|
if (!intent) return { state: "not_requested" };
|
|
const invalid = validateIntent(intent, push, context);
|
|
if (invalid) return { state: "rejected", diagnostic_code: invalid };
|
|
fs.mkdirSync(queueDir, { recursive: true, mode: 0o750 });
|
|
const event = {
|
|
schema: "guanghu.deployment-event/v1",
|
|
event_id: crypto.randomUUID(),
|
|
created_at: Date.now() / 1000,
|
|
state: "queued_for_resident_agent",
|
|
repo: push.repo, branch: push.branch, commit_sha: push.commit_sha,
|
|
workorder_id: String(intent.workorder_id || ""),
|
|
resource: intent.resource, action: "provision-approved-architecture",
|
|
manifest: intent.manifest,
|
|
authorizer_id: String(context.authorizer_id || ""),
|
|
persona_id: String(context.persona_id || ""),
|
|
execution_runtime_id: String(context.execution_runtime_id || ""),
|
|
target: String(context.target || ""),
|
|
deployment_source: intent.deployment_source || null,
|
|
};
|
|
const target = path.join(queueDir, `${event.created_at}-${event.event_id}.json`);
|
|
const temporary = `${target}.${process.pid}.tmp`;
|
|
fs.writeFileSync(temporary, JSON.stringify(event), { mode: 0o640 });
|
|
fs.renameSync(temporary, target);
|
|
return { state: event.state, event_id: event.event_id };
|
|
}
|
|
function validateIntent(intent, push, context = {}) {
|
|
if (intent.schema !== "guanghu.deployment-intent/v1") return "deployment_intent_schema_invalid";
|
|
if (String(intent.repo || "").toLowerCase() !== push.repo || intent.branch !== push.branch || String(intent.commit_sha || "").toLowerCase() !== push.commit_sha) return "deployment_intent_binding_mismatch";
|
|
if (!/^[A-Z0-9][A-Z0-9._-]{5,119}@[0-9a-f]{40}$/.test(String(intent.resource || "")) || !String(intent.resource).endsWith(`@${push.commit_sha}`)) return "deployment_intent_resource_invalid";
|
|
if (!/^deployment\/requests\/[A-Za-z0-9._/-]{1,180}\.json$/.test(String(intent.manifest || ""))) return "deployment_intent_manifest_invalid";
|
|
if (context.registry) {
|
|
return validateDeploymentSource({
|
|
repo: push.repo,
|
|
authorizer_id: String(context.authorizer_id || ""),
|
|
persona_id: String(context.persona_id || ""),
|
|
execution_runtime_id: String(context.execution_runtime_id || ""),
|
|
target: String(context.target || ""),
|
|
deployment_source: intent.deployment_source || null,
|
|
}, context.registry);
|
|
}
|
|
return "";
|
|
}
|
|
module.exports = { enqueueDeploymentEvent, validateIntent };
|