Jens/ForgeFlow
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 24 Wiki Activity

fix: make server discovery and audits read-only

Browse Source
This commit is contained in:
NuklearRabbit
2026-07-29 16:09:39 +02:00
parent 56efd1a00c
commit 430d40354b
13 changed files with 352 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/config-store.cjs
+13
View File
@@ -142,6 +142,19 @@ class ConfigStore {
return this.saveQueue;
}
async createRecoverySnapshot(reason = 'configuration-change') {
await this.saveQueue.catch(() => {});
const safeReason = String(reason || 'configuration-change').toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80) || 'configuration-change';
const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
const snapshotDirectory = path.join(path.dirname(this.filePath), 'snapshots');
const snapshotPath = path.join(snapshotDirectory, `${timestamp}-${safeReason}.json`);
await fs.mkdir(snapshotDirectory, { recursive: true });
await fs.writeFile(snapshotPath, `${JSON.stringify(this.data, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
try { await fs.chmod(snapshotDirectory, 0o700); } catch {}
try { await fs.chmod(snapshotPath, 0o600); } catch {}
return { filePath: snapshotPath, reason: safeReason, createdAt: new Date().toISOString() };
}
setToken(token, { preserveExisting = false } = {}) {
const value = String(token || '').trim();
if (!value && preserveExisting && this.getToken()) return { persistent: Boolean(this.data.gitea.encryptedToken), preserved: true };
src/main/ipc.cjs
+25
View File
@@ -1244,6 +1244,31 @@ function registerIpc({
}
return results;
});
register("deployment:plan-server-reconciliation", async ({ serverId }) => {
const repositoryList = await repositories.refresh();
const remoteRepositories = repositoryList.filter((repository) => repository.owner?.login !== "local");
const result = await unraid.planServerInventoryReconciliation(serverId, remoteRepositories, { autoLink: true });
await audit.append("deployment.server-reconciliation-planned", {
serverId,
planId: result.plan.id,
summary: result.plan.summary,
});
return result;
});
register("deployment:apply-server-reconciliation", async ({ serverId, planId }) => {
const repositoryList = await repositories.refresh();
const remoteRepositories = repositoryList.filter((repository) => repository.owner?.login !== "local");
const result = await unraid.reconcileServerInventory(serverId, remoteRepositories, { autoLink: true, expectedPlanId: planId });
await audit.append("deployment.server-reconciliation-applied", {
serverId,
planId,
adopted: result.adopted,
refreshed: result.refreshed,
retired: result.retired,
recoverySnapshot: result.recoverySnapshot?.filePath || null,
});
return { ...result, state: store.getPublicState() };
});
register("deployment:profile-state", async ({ fullName, profileId }) => {
const profile = store.getDeploymentProfile(fullName, profileId);
if (profile?.provider === "ssh-unraid") {
src/main/unraid-deployment-service.cjs
+129 -37
View File
@@ -1128,7 +1128,7 @@ $extra"
});
}
async scanServerInventory(serverId, repositories, { autoLink = true } = {}) {
async collectServerInventory(serverId, repositories) {
const server = this.store.getServer(serverId);
if (!server) throw new Error("The deployment server no longer exists.");
const result = await this.ssh.exec(server.id, bash(this.inventoryScript(server)), {
@@ -1162,9 +1162,123 @@ $extra"
workload.link = null;
workload.status = workload.candidates?.length ? "suggested" : "unmatched";
}
return { server, inventory, workloads };
}
inventoryResponse(server, inventory, workloads, changes = {}) {
const summary = {
serverId: server.id,
serverName: server.name,
detected: workloads.length,
adopted: Number(changes.adopted || 0),
refreshed: Number(changes.refreshed || 0),
retired: Number(changes.retired || 0),
staleProfiles: Array.isArray(changes.staleProfiles) ? changes.staleProfiles : [],
verified: workloads.filter((item) => item.runtime.health === "healthy" && item.link).length,
linked: workloads.filter((item) => item.status === "linked").length,
unmatched: workloads.filter((item) => !item.link).length,
needsReview: workloads.filter((item) => ["suggested", "ambiguous", "unmatched"].includes(item.status)).length,
running: workloads.filter((item) => item.runtime.running).length,
stopped: workloads.filter((item) => !item.runtime.running).length,
};
return {
...summary,
server: { id: server.id, name: server.name, host: server.host, basePath: server.basePath },
capabilities: inventory.capabilities,
warnings: inventory.warnings,
workloads,
observedAt: new Date().toISOString(),
};
}
async scanServerInventory(serverId, repositories) {
const { server, inventory, workloads } = await this.collectServerInventory(serverId, repositories);
const response = this.inventoryResponse(server, inventory, workloads);
await this.diagnostics?.info("unraid.workloads.scanned", {
serverId,
detected: response.detected,
linked: response.linked,
needsReview: response.needsReview,
readOnly: true,
});
return response;
}
reconciliationPlan(server, workloads, repositories, { autoLink = true } = {}) {
const profiles = this.allSshProfiles().filter((profile) => profile.serverId === server.id);
const activeWorkloadIds = new Set(workloads.map((item) => item.workloadId));
const linkedRepositories = new Set(workloads.filter((item) => item.link?.repositoryFullName).map((item) => String(item.link.repositoryFullName).toLowerCase()));
const additions = [];
const updates = [];
const conflicts = [];
for (const workload of workloads) {
if (workload.link?.profileId && workload.link?.repositoryFullName) {
updates.push({
workloadId: workload.workloadId,
profileId: workload.link.profileId,
repositoryFullName: workload.link.repositoryFullName,
impact: "Refresh detected Compose identity and observed deployment state",
});
continue;
}
const candidate = workload.candidates?.[0];
const unique = workload.candidates?.length === 1;
const exact = unique && (candidate?.exact === true || (candidate?.identityExact === true && candidate.score >= 70));
if (autoLink && exact && workload.runtime?.running && !linkedRepositories.has(String(candidate.repositoryFullName).toLowerCase())) {
additions.push({
workloadId: workload.workloadId,
repositoryFullName: candidate.repositoryFullName,
evidence: candidate.exact ? "exact-provenance" : "exact-runtime-identity",
impact: "Create a server-pull deployment profile; no container changes",
});
} else if (["suggested", "ambiguous"].includes(workload.status) || (workload.runtime?.running && workload.candidates?.length)) {
conflicts.push({
workloadId: workload.workloadId,
displayName: workload.displayName,
status: workload.status,
candidates: (workload.candidates || []).slice(0, 5).map((item) => ({ repositoryFullName: item.repositoryFullName, score: item.score, exact: item.exact === true })),
});
}
}
const stale = profiles.filter((profile) =>
String(profile.workloadIdentity?.linkSource || "").startsWith("automatic")
&& profile.workloadIdentity?.workloadId
&& !activeWorkloadIds.has(profile.workloadIdentity.workloadId),
).map((profile) => ({
profileId: profile.id,
repositoryFullName: profile._repositoryFullName,
reason: "workload-missing",
impact: "Review only; ForgeFlow will not remove this profile automatically",
}));
const payload = { serverId: server.id, additions, updates, stale, conflicts };
return {
id: crypto.createHash("sha256").update(JSON.stringify(payload)).digest("hex"),
createdAt: new Date().toISOString(),
...payload,
summary: { additions: additions.length, updates: updates.length, stale: stale.length, conflicts: conflicts.length },
};
}
async planServerInventoryReconciliation(serverId, repositories, options = {}) {
const { server, inventory, workloads } = await this.collectServerInventory(serverId, repositories);
const plan = this.reconciliationPlan(server, workloads, repositories, options);
return { inventory: this.inventoryResponse(server, inventory, workloads), plan };
}
async reconcileServerInventory(serverId, repositories, { autoLink = true, expectedPlanId = "" } = {}) {
const { server, inventory, workloads } = await this.collectServerInventory(serverId, repositories);
const plan = this.reconciliationPlan(server, workloads, repositories, { autoLink });
if (!expectedPlanId || expectedPlanId !== plan.id) {
const error = new Error(expectedPlanId ? "The server inventory changed after the reconciliation preview. Review a fresh plan before applying it." : "Apply reconciliation only with an explicitly reviewed plan ID.");
error.code = expectedPlanId ? "RECONCILIATION_PLAN_STALE" : "RECONCILIATION_PLAN_REQUIRED";
error.plan = plan;
throw error;
}
const recoverySnapshot = await this.store.createRecoverySnapshot?.(`server-reconciliation-${serverId}`) || null;
let adopted = 0;
let refreshed = 0;
let retired = 0;
let staleProfiles = [];
const inventoryStable = (inventory.warnings || []).every((warning) => /stale container reference\(s\) disappeared during inventory/i.test(warning));
if (inventoryStable && workloads.length) {
const activeWorkloadIds = new Set(workloads.map((item) => item.workloadId));
@@ -1174,10 +1288,6 @@ $extra"
&& profile.workloadIdentity?.workloadId
&& !activeWorkloadIds.has(profile.workloadIdentity.workloadId),
);
for (const profile of staleAutomaticProfiles) {
await this.store.deleteDeploymentProfile(profile._repositoryFullName, profile.id);
retired += 1;
}
const runningRepositoryLinks = new Set(workloads
.filter((workload) => workload.runtime?.running && workload.link?.repositoryFullName)
.map((workload) => String(workload.link.repositoryFullName).toLowerCase()));
@@ -1188,10 +1298,11 @@ $extra"
.filter((workload) => !workload.runtime?.running && workload.link?.profileId && !runningProfileIds.has(workload.link.profileId) && runningRepositoryLinks.has(String(workload.link.repositoryFullName).toLowerCase()))
.map((workload) => this.allSshProfiles().find((profile) => profile.id === workload.link.profileId && String(profile._repositoryFullName).toLowerCase() === String(workload.link.repositoryFullName).toLowerCase()))
.filter((profile) => profile && String(profile.workloadIdentity?.linkSource || "").startsWith("automatic"));
for (const profile of shadowedAutomaticProfiles) {
await this.store.deleteDeploymentProfile(profile._repositoryFullName, profile.id);
retired += 1;
}
staleProfiles = [...new Map([...staleAutomaticProfiles, ...shadowedAutomaticProfiles].map((profile) => [profile.id, {
profileId: profile.id,
repositoryFullName: profile._repositoryFullName,
reason: staleAutomaticProfiles.includes(profile) ? "workload-missing" : "shadowed-by-running-workload",
}])).values()];
}
for (const workload of workloads) {
if (workload.status !== "linked" || !workload.link?.profileId || !workload.link?.repositoryFullName) continue;
@@ -1214,21 +1325,16 @@ $extra"
const uniqueCandidate = workload.candidates.length === 1;
if (candidate && alreadyLinkedRepositories.has(String(candidate.repositoryFullName).toLowerCase())) continue;
const exactMatch = uniqueCandidate && candidate?.exact === true;
const strongComposeMatch = uniqueCandidate
&& candidate?.confidence === "strong"
&& candidate.score >= 90
&& Boolean(workload.compose?.workingDir)
&& Boolean(workload.compose?.configFiles?.length);
const exactRuntimeIdentity = uniqueCandidate
&& candidate?.identityExact === true
&& candidate.score >= 70
&& workload.runtime?.running === true
&& Boolean(workload.remoteFolderCandidate)
&& !alreadyLinkedRepositories.has(String(candidate.repositoryFullName).toLowerCase());
if (!exactMatch && !strongComposeMatch && !exactRuntimeIdentity) continue;
if (!exactMatch && !exactRuntimeIdentity) continue;
const repository = (repositories || []).find((item) => item.fullName === candidate.repositoryFullName);
if (!repository) continue;
const linkSource = exactMatch ? "automatic" : exactRuntimeIdentity ? "automatic-runtime-identity" : "automatic-compose";
const linkSource = exactMatch ? "automatic" : "automatic-runtime-identity";
const profile = this.profileFromWorkload(repository, server, workload, { linkSource, deploymentMode: "server-git" });
const saved = await this.store.saveDeploymentProfile(repository.fullName, profile);
await this.saveWorkloadState(saved, workload, server);
@@ -1238,34 +1344,20 @@ $extra"
adopted += 1;
}
}
const summary = {
const response = this.inventoryResponse(server, inventory, workloads, { adopted, refreshed, retired, staleProfiles });
response.recoverySnapshot = recoverySnapshot;
await this.diagnostics?.info("unraid.workloads.reconciled", {
serverId,
serverName: server.name,
detected: workloads.length,
detected: response.detected,
adopted,
refreshed,
retired,
verified: workloads.filter((item) => item.runtime.health === "healthy" && item.link).length,
linked: workloads.filter((item) => item.status === "linked").length,
unmatched: workloads.filter((item) => !item.link).length,
needsReview: workloads.filter((item) => ["suggested", "ambiguous", "unmatched"].includes(item.status)).length,
running: workloads.filter((item) => item.runtime.running).length,
stopped: workloads.filter((item) => !item.runtime.running).length,
};
const response = {
...summary,
server: { id: server.id, name: server.name, host: server.host, basePath: server.basePath },
capabilities: inventory.capabilities,
warnings: inventory.warnings,
workloads,
observedAt: new Date().toISOString(),
};
await this.diagnostics?.info("unraid.workloads.discovered", summary);
});
return response;
}
async discoverServerWorkloads(serverId, repositories) {
return this.scanServerInventory(serverId, repositories, { autoLink: true });
return this.scanServerInventory(serverId, repositories);
}
async linkServerWorkload({ repository, serverId, workloadId, deploymentMode = "server-git", remoteFolder = "" }) {
@@ -1274,7 +1366,7 @@ $extra"
: "server-git";
const server = this.store.getServer(serverId);
if (!server) throw new Error("The deployment server no longer exists.");
const inventory = await this.scanServerInventory(serverId, [repository], { autoLink: false });
const inventory = await this.scanServerInventory(serverId, [repository]);
const workload = inventory.workloads.find((item) => item.workloadId === workloadId);
if (!workload) throw new Error("The selected server workload no longer exists. Scan the server again.");
const existing = this.allSshProfiles().find((profile) => profile.workloadIdentity?.workloadId === workloadId && profile.serverId === serverId);