652 lines
32 KiB
JavaScript
652 lines
32 KiB
JavaScript
'use strict';
|
|
|
|
const fs = require('node:fs/promises');
|
|
const path = require('node:path');
|
|
const crypto = require('node:crypto');
|
|
const { safeStorage } = require('electron');
|
|
const { assertHttpUrl, assertWorkflowFileName, assertBranchName, assertEnvironmentName, assertCloneRemote, assertRepositoryRelativePath, assertRepositoryRelativePaths } = require('../shared/validation.cjs');
|
|
|
|
const DEFAULT_CONFIG = {
|
|
schemaVersion: 13,
|
|
setupComplete: false,
|
|
appearance: 'dark',
|
|
gitea: { baseUrl: '', user: null, encryptedToken: null },
|
|
workspaceRoots: [],
|
|
repositoryMappings: {},
|
|
deploymentProfiles: {},
|
|
deploymentStates: {},
|
|
inventoryReviewDecisions: {},
|
|
gitValidator: { policies: {}, suppressions: {}, trends: {} },
|
|
favorites: [],
|
|
updates: {
|
|
owner: 'Jens',
|
|
repo: 'ForgeFlow',
|
|
branch: 'main',
|
|
autoCheck: true,
|
|
lastCheckedAt: null
|
|
},
|
|
servers: [],
|
|
preferences: {
|
|
autoRefresh: true,
|
|
repositoryPollSeconds: 4,
|
|
operationPollSeconds: 5,
|
|
fetchIntervalMinutes: 10,
|
|
preferredCloneProtocol: 'https',
|
|
diagnosticsEnabled: true,
|
|
diagnosticLevel: 'info',
|
|
logRetentionDays: 14,
|
|
maxLogFileMb: 8,
|
|
editor: { executable: 'code', args: ['--reuse-window', '--goto', '{file}:{line}'] },
|
|
terminal: { executable: 'wt.exe', args: ['-d', '{path}'] },
|
|
notificationsEnabled: true,
|
|
trayEnabled: true,
|
|
closeToTray: false,
|
|
startAtLogin: false
|
|
},
|
|
operations: []
|
|
};
|
|
|
|
function uniqueStrings(values) {
|
|
return [...new Set((Array.isArray(values) ? values : []).map((value) => String(value || '').trim()).filter(Boolean))];
|
|
}
|
|
|
|
class ConfigStore {
|
|
constructor(userDataPath) {
|
|
this.filePath = path.join(userDataPath, 'forgeflow-config.json');
|
|
this.sessionToken = null;
|
|
this.data = structuredClone(DEFAULT_CONFIG);
|
|
this.saveQueue = Promise.resolve();
|
|
}
|
|
|
|
migrate(parsed) {
|
|
const source = parsed && typeof parsed === 'object' ? parsed : {};
|
|
return {
|
|
...structuredClone(DEFAULT_CONFIG),
|
|
...source,
|
|
schemaVersion: DEFAULT_CONFIG.schemaVersion,
|
|
gitea: { ...DEFAULT_CONFIG.gitea, ...(source.gitea || {}) },
|
|
workspaceRoots: uniqueStrings(source.workspaceRoots),
|
|
repositoryMappings: source.repositoryMappings && typeof source.repositoryMappings === 'object' ? source.repositoryMappings : {},
|
|
inventoryReviewDecisions: source.inventoryReviewDecisions && typeof source.inventoryReviewDecisions === 'object' ? structuredClone(source.inventoryReviewDecisions) : {},
|
|
gitValidator: {
|
|
policies: source.gitValidator?.policies && typeof source.gitValidator.policies === 'object' ? structuredClone(source.gitValidator.policies) : {},
|
|
suppressions: source.gitValidator?.suppressions && typeof source.gitValidator.suppressions === 'object' ? structuredClone(source.gitValidator.suppressions) : {},
|
|
trends: source.gitValidator?.trends && typeof source.gitValidator.trends === 'object' ? structuredClone(source.gitValidator.trends) : {}
|
|
},
|
|
deploymentProfiles: source.deploymentProfiles && typeof source.deploymentProfiles === 'object'
|
|
? Object.fromEntries(Object.entries(source.deploymentProfiles).map(([key, profiles]) => [key, (Array.isArray(profiles) ? profiles : []).map((profile) => {
|
|
if (!profile || typeof profile !== 'object' || profile.provider !== 'ssh-unraid') return profile;
|
|
const iconUrl = String(profile.iconUrl || '').trim();
|
|
const iconFilePath = String(profile.iconFilePath || '').trim();
|
|
const requestedMode = String(profile.iconMode || '').trim();
|
|
const iconMode = ['builtin', 'upload', 'url', 'none'].includes(requestedMode)
|
|
? requestedMode
|
|
: iconFilePath ? 'upload' : iconUrl && !/itworx\.tech\/assets\/itworx-icon\.png/i.test(iconUrl) ? 'url' : 'builtin';
|
|
const visibleName = String(profile.containerName || profile.remoteFolder || '').trim();
|
|
const internalService = String(profile.composeService || profile.remoteFolder || 'app').trim().toLowerCase().replace(/[^a-z0-9._-]/g, '-') || 'app';
|
|
const requestedDeploymentMode = String(profile.deploymentMode || '').trim();
|
|
const deploymentMode = ['push-bundle', 'server-git', 'monitor-only'].includes(requestedDeploymentMode)
|
|
? requestedDeploymentMode
|
|
: 'push-bundle';
|
|
const composeFiles = uniqueStrings(profile.composeFiles || [profile.composeFile || 'docker-compose.yml']);
|
|
const composeServices = uniqueStrings(profile.composeServices || [internalService]).map((value) => value.toLowerCase());
|
|
return {
|
|
...profile,
|
|
deploymentMode,
|
|
composeFile: composeFiles[0] || 'docker-compose.yml',
|
|
composeFiles: composeFiles.length ? composeFiles : ['docker-compose.yml'],
|
|
composeServices,
|
|
composeProject: String(profile.composeProject || '').trim(),
|
|
composeWorkingDir: String(profile.composeWorkingDir || '').trim(),
|
|
composeService: internalService,
|
|
containerName: visibleName || internalService,
|
|
iconMode,
|
|
manageDockerMan: profile.manageDockerMan === true,
|
|
forceRecreate: profile.forceRecreate === true,
|
|
removeOrphans: profile.removeOrphans === true,
|
|
workloadIdentity: profile.workloadIdentity && typeof profile.workloadIdentity === 'object' ? structuredClone(profile.workloadIdentity) : null
|
|
};
|
|
})]))
|
|
: {},
|
|
deploymentStates: source.deploymentStates && typeof source.deploymentStates === 'object' ? source.deploymentStates : {},
|
|
favorites: [...new Set(uniqueStrings(source.favorites).map((item) => item.toLowerCase()))],
|
|
updates: { ...DEFAULT_CONFIG.updates, ...(source.updates || {}) },
|
|
servers: Array.isArray(source.servers) ? source.servers.filter((item) => item && typeof item === 'object') : [],
|
|
preferences: { ...DEFAULT_CONFIG.preferences, ...(source.preferences || {}) },
|
|
operations: Array.isArray(source.operations) ? source.operations.slice(0, 250).map((operation) => { const { runnerLog, ...safeOperation } = operation || {}; return safeOperation; }) : []
|
|
};
|
|
}
|
|
|
|
async load() {
|
|
try {
|
|
const raw = await fs.readFile(this.filePath, 'utf8');
|
|
try {
|
|
this.data = this.migrate(JSON.parse(raw));
|
|
} catch (parseError) {
|
|
const suffix = new Date().toISOString().replace(/[:.]/g, '-');
|
|
const recoveryPath = `${this.filePath}.corrupt-${suffix}`;
|
|
await fs.rename(this.filePath, recoveryPath).catch(async () => fs.writeFile(recoveryPath, raw, { mode: 0o600 }));
|
|
this.data = structuredClone(DEFAULT_CONFIG);
|
|
console.error(`ForgeFlow recovered a malformed configuration file to ${recoveryPath}.`, parseError);
|
|
}
|
|
await this.save();
|
|
} catch (error) {
|
|
if (error.code !== 'ENOENT') throw error;
|
|
await this.save();
|
|
}
|
|
return this.getPublicState();
|
|
}
|
|
|
|
async save() {
|
|
const snapshot = JSON.stringify(this.data, null, 2);
|
|
const operation = async () => {
|
|
await fs.mkdir(path.dirname(this.filePath), { recursive: true });
|
|
const temporary = `${this.filePath}.${process.pid}.${Date.now()}.${crypto.randomUUID()}.tmp`;
|
|
await fs.writeFile(temporary, snapshot, { mode: 0o600 });
|
|
await fs.rename(temporary, this.filePath);
|
|
try { await fs.chmod(this.filePath, 0o600); } catch {}
|
|
};
|
|
this.saveQueue = this.saveQueue.then(operation, operation);
|
|
return this.saveQueue;
|
|
}
|
|
|
|
getGitValidatorState(fullName) {
|
|
const key = String(fullName || '').toLowerCase();
|
|
return {
|
|
policy: structuredClone(this.data.gitValidator.policies[key] || { id: 'standard' }),
|
|
suppressions: structuredClone(this.data.gitValidator.suppressions[key] || []),
|
|
trends: structuredClone(this.data.gitValidator.trends[key] || [])
|
|
};
|
|
}
|
|
|
|
async setGitValidatorPolicy(fullName, policy) {
|
|
const key = String(fullName || '').toLowerCase();
|
|
this.data.gitValidator.policies[key] = structuredClone(policy);
|
|
await this.save();
|
|
return this.getGitValidatorState(key);
|
|
}
|
|
|
|
async addGitValidatorSuppression(fullName, suppression) {
|
|
const key = String(fullName || '').toLowerCase();
|
|
this.data.gitValidator.suppressions[key] = [...(this.data.gitValidator.suppressions[key] || []), structuredClone(suppression)].slice(-250);
|
|
await this.save();
|
|
return this.getGitValidatorState(key);
|
|
}
|
|
|
|
async appendGitValidatorTrend(fullName, trend) {
|
|
const key = String(fullName || '').toLowerCase();
|
|
this.data.gitValidator.trends[key] = [...(this.data.gitValidator.trends[key] || []), structuredClone(trend)].slice(-100);
|
|
await this.save();
|
|
return this.getGitValidatorState(key);
|
|
}
|
|
|
|
async createRecoverySnapshot(reason = 'configuration-change') {
|
|
await this.saveQueue.catch(() => {});
|
|
const safeReason = String(reason || 'configuration-change').toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80) || 'configuration-change';
|
|
const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
|
|
const snapshotDirectory = path.join(path.dirname(this.filePath), 'snapshots');
|
|
const snapshotPath = path.join(snapshotDirectory, `${timestamp}-${safeReason}.json`);
|
|
await fs.mkdir(snapshotDirectory, { recursive: true });
|
|
await fs.writeFile(snapshotPath, `${JSON.stringify(this.data, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
|
|
try { await fs.chmod(snapshotDirectory, 0o700); } catch {}
|
|
try { await fs.chmod(snapshotPath, 0o600); } catch {}
|
|
return { filePath: snapshotPath, reason: safeReason, createdAt: new Date().toISOString() };
|
|
}
|
|
|
|
setToken(token, { preserveExisting = false } = {}) {
|
|
const value = String(token || '').trim();
|
|
if (!value && preserveExisting && this.getToken()) return { persistent: Boolean(this.data.gitea.encryptedToken), preserved: true };
|
|
if (!value) {
|
|
this.data.gitea.encryptedToken = null;
|
|
this.sessionToken = null;
|
|
return { persistent: true, preserved: false };
|
|
}
|
|
|
|
if (safeStorage?.isEncryptionAvailable?.()) {
|
|
this.data.gitea.encryptedToken = safeStorage.encryptString(value).toString('base64');
|
|
this.sessionToken = null;
|
|
return { persistent: true, preserved: false };
|
|
}
|
|
|
|
this.data.gitea.encryptedToken = null;
|
|
this.sessionToken = value;
|
|
return { persistent: false, preserved: false };
|
|
}
|
|
|
|
getToken() {
|
|
if (this.sessionToken) return this.sessionToken;
|
|
if (!this.data.gitea.encryptedToken) return '';
|
|
try {
|
|
return safeStorage?.decryptString?.(Buffer.from(this.data.gitea.encryptedToken, 'base64')) || '';
|
|
} catch {
|
|
return '';
|
|
}
|
|
}
|
|
|
|
|
|
encryptSecret(value) {
|
|
const text = String(value || '');
|
|
if (!text) return null;
|
|
if (!safeStorage?.isEncryptionAvailable?.()) {
|
|
const error = new Error('Secure credential storage is unavailable. ForgeFlow will not persist server passwords or key passphrases.');
|
|
error.code = 'SECURE_STORAGE_UNAVAILABLE';
|
|
throw error;
|
|
}
|
|
return safeStorage.encryptString(text).toString('base64');
|
|
}
|
|
|
|
decryptSecret(value) {
|
|
if (!value) return '';
|
|
try { return safeStorage?.decryptString?.(Buffer.from(value, 'base64')) || ''; }
|
|
catch { return ''; }
|
|
}
|
|
|
|
normalizeServer(server, existing = null) {
|
|
const source = server || {};
|
|
const name = String(source.name || existing?.name || 'Unraid').trim().slice(0, 100);
|
|
const host = String(source.host || existing?.host || '').trim();
|
|
if (!host || /[\s/@]/.test(host)) throw new Error('Enter a valid SSH hostname or IP address.');
|
|
const port = Math.min(Math.max(Number(source.port || existing?.port || 22), 1), 65535);
|
|
const username = String(source.username || existing?.username || '').trim();
|
|
if (!username || /[\s@]/.test(username)) throw new Error('Enter a valid SSH username.');
|
|
const authType = ['password', 'privateKey'].includes(source.authType) ? source.authType : (existing?.authType || 'password');
|
|
const basePath = String(source.basePath || existing?.basePath || '/mnt/user/appdata').trim().replace(/\/+$/, '');
|
|
if (!basePath.startsWith('/') || /[\r\n\0]/.test(basePath)) throw new Error('The server base path must be an absolute Unix path.');
|
|
const privateKeyPath = String(source.privateKeyPath || existing?.privateKeyPath || '').trim();
|
|
const hostFingerprint = String(source.hostFingerprint || existing?.hostFingerprint || '').trim();
|
|
const scanRoots = uniqueStrings(source.scanRoots || existing?.scanRoots || [basePath]).map((value) => value.replace(/\/+$/, '')).filter((value) => value.startsWith('/') && !/[\r\n\0]/.test(value));
|
|
const scanExcludes = uniqueStrings(source.scanExcludes || existing?.scanExcludes || ['backups', 'archives', 'releases', 'staging', 'testdata']).filter((value) => /^[a-zA-Z0-9._*-]+$/.test(value));
|
|
return {
|
|
id: source.id || existing?.id || crypto.randomUUID(),
|
|
name,
|
|
host,
|
|
port,
|
|
username,
|
|
authType,
|
|
basePath,
|
|
scanRoots: scanRoots.length ? scanRoots : [basePath],
|
|
scanExcludes,
|
|
privateKeyPath,
|
|
hostFingerprint,
|
|
encryptedPassword: existing?.encryptedPassword || null,
|
|
encryptedPassphrase: existing?.encryptedPassphrase || null,
|
|
createdAt: existing?.createdAt || new Date().toISOString(),
|
|
updatedAt: new Date().toISOString()
|
|
};
|
|
}
|
|
|
|
async saveServer(server, secrets = {}) {
|
|
const existing = this.data.servers.find((item) => item.id === server?.id) || null;
|
|
const normalized = this.normalizeServer(server, existing);
|
|
if (Object.prototype.hasOwnProperty.call(secrets, 'password') && String(secrets.password || '')) {
|
|
normalized.encryptedPassword = this.encryptSecret(secrets.password);
|
|
}
|
|
if (Object.prototype.hasOwnProperty.call(secrets, 'passphrase') && String(secrets.passphrase || '')) {
|
|
normalized.encryptedPassphrase = this.encryptSecret(secrets.passphrase);
|
|
}
|
|
if (normalized.authType === 'password') {
|
|
normalized.privateKeyPath = '';
|
|
normalized.encryptedPassphrase = null;
|
|
} else {
|
|
normalized.encryptedPassword = null;
|
|
}
|
|
if (normalized.authType === 'password' && !normalized.encryptedPassword) throw new Error('A password is required for password authentication.');
|
|
if (normalized.authType === 'privateKey' && !normalized.privateKeyPath) throw new Error('Select a private key file.');
|
|
this.data.servers = [normalized, ...this.data.servers.filter((item) => item.id !== normalized.id)];
|
|
await this.save();
|
|
return this.getPublicServer(normalized);
|
|
}
|
|
|
|
async deleteServer(serverId) {
|
|
this.data.servers = this.data.servers.filter((item) => item.id !== serverId);
|
|
const removedProfileIds = new Set();
|
|
for (const [key, profiles] of Object.entries(this.data.deploymentProfiles)) {
|
|
for (const profile of profiles) if (profile.serverId === serverId) removedProfileIds.add(profile.id);
|
|
this.data.deploymentProfiles[key] = profiles.filter((profile) => profile.serverId !== serverId);
|
|
if (!this.data.deploymentProfiles[key].length) delete this.data.deploymentProfiles[key];
|
|
}
|
|
for (const profileId of removedProfileIds) delete this.data.deploymentStates[profileId];
|
|
await this.save();
|
|
}
|
|
|
|
getServer(serverId) {
|
|
return this.data.servers.find((item) => item.id === serverId) || null;
|
|
}
|
|
|
|
getServerCredentials(serverId) {
|
|
const server = this.getServer(serverId);
|
|
if (!server) throw new Error('The configured server no longer exists.');
|
|
return {
|
|
password: this.decryptSecret(server.encryptedPassword),
|
|
passphrase: this.decryptSecret(server.encryptedPassphrase)
|
|
};
|
|
}
|
|
|
|
getPublicServer(server) {
|
|
if (!server) return null;
|
|
const { encryptedPassword, encryptedPassphrase, ...publicServer } = server;
|
|
return {
|
|
...structuredClone(publicServer),
|
|
hasPassword: Boolean(encryptedPassword),
|
|
hasPassphrase: Boolean(encryptedPassphrase)
|
|
};
|
|
}
|
|
|
|
async setUpdatePreferences(updates) {
|
|
const next = { ...this.data.updates, ...(updates || {}) };
|
|
next.owner = String(next.owner || 'Jens').trim().slice(0, 100);
|
|
next.repo = String(next.repo || 'ForgeFlow').trim().slice(0, 100);
|
|
next.branch = assertBranchName(next.branch || 'main');
|
|
next.autoCheck = next.autoCheck !== false;
|
|
this.data.updates = next;
|
|
await this.save();
|
|
return this.getPublicState();
|
|
}
|
|
|
|
async patch(patch) {
|
|
this.data = this.migrate({ ...this.data, ...patch });
|
|
await this.save();
|
|
return this.getPublicState();
|
|
}
|
|
|
|
async restoreConfiguration(configuration) {
|
|
const restored = this.migrate(configuration);
|
|
restored.gitea.encryptedToken = String(restored.gitea.baseUrl || '').replace(/\/+$/, '').toLowerCase() === String(this.data.gitea.baseUrl || '').replace(/\/+$/, '').toLowerCase()
|
|
? this.data.gitea.encryptedToken
|
|
: null;
|
|
const existingServers = new Map(this.data.servers.map((server) => [server.id, server]));
|
|
restored.servers = restored.servers.map((server) => {
|
|
const existing = existingServers.get(server.id);
|
|
const sameCredentialTarget = existing
|
|
&& ['host', 'port', 'username', 'authType', 'privateKeyPath'].every((key) => String(existing[key] || '') === String(server[key] || ''));
|
|
return {
|
|
...server,
|
|
encryptedPassword: sameCredentialTarget ? existing.encryptedPassword || null : null,
|
|
encryptedPassphrase: sameCredentialTarget ? existing.encryptedPassphrase || null : null
|
|
};
|
|
});
|
|
restored.operations = this.data.operations;
|
|
this.data = restored;
|
|
await this.save();
|
|
return this.getPublicState();
|
|
}
|
|
|
|
async updateGitea({ baseUrl, token, user }) {
|
|
const tokenState = this.setToken(token, { preserveExisting: true });
|
|
this.data.gitea = {
|
|
...this.data.gitea,
|
|
baseUrl,
|
|
user: user || this.data.gitea.user,
|
|
encryptedToken: this.data.gitea.encryptedToken
|
|
};
|
|
await this.save();
|
|
return tokenState;
|
|
}
|
|
|
|
async completeSetup({ baseUrl, token, user, workspaceRoots }) {
|
|
const tokenState = this.setToken(token);
|
|
this.data.setupComplete = true;
|
|
this.data.gitea = { baseUrl, user, encryptedToken: this.data.gitea.encryptedToken };
|
|
this.data.workspaceRoots = uniqueStrings(workspaceRoots);
|
|
await this.save();
|
|
return { state: this.getPublicState(), tokenState };
|
|
}
|
|
|
|
async saveMapping(fullName, localPath) {
|
|
this.data.repositoryMappings[String(fullName).toLowerCase()] = localPath;
|
|
await this.save();
|
|
}
|
|
|
|
async removeMapping(fullName) {
|
|
delete this.data.repositoryMappings[String(fullName).toLowerCase()];
|
|
await this.save();
|
|
}
|
|
|
|
async setFavorite(fullName, favorite) {
|
|
const key = String(fullName || '').toLowerCase();
|
|
const favorites = new Set(this.data.favorites || []);
|
|
if (favorite) favorites.add(key); else favorites.delete(key);
|
|
this.data.favorites = [...favorites];
|
|
await this.save();
|
|
return this.getPublicState();
|
|
}
|
|
|
|
normalizeDeploymentProfile(profile) {
|
|
const environment = assertEnvironmentName(profile.environment || 'production');
|
|
const provider = ['gitea-actions', 'ssh-unraid'].includes(profile.provider) ? profile.provider : 'gitea-actions';
|
|
const healthcheckUrl = assertHttpUrl(profile.healthcheckUrl, { optional: true, label: 'Healthcheck URL' });
|
|
const common = {
|
|
id: profile.id || crypto.randomUUID(),
|
|
name: String(profile.name || environment || 'Production').trim().slice(0, 100),
|
|
environment,
|
|
provider,
|
|
branch: assertBranchName(profile.branch || 'main'),
|
|
healthcheckUrl,
|
|
confirmationRequired: profile.confirmationRequired !== false,
|
|
deploymentPolicy: {
|
|
frozen: profile.deploymentPolicy?.frozen === true,
|
|
freezeReason: String(profile.deploymentPolicy?.freezeReason || '').trim().slice(0, 500),
|
|
requireNote: profile.deploymentPolicy?.requireNote === true,
|
|
maintenanceWindows: (Array.isArray(profile.deploymentPolicy?.maintenanceWindows) ? profile.deploymentPolicy.maintenanceWindows : []).slice(0, 20).map((window) => ({
|
|
days: [...new Set((Array.isArray(window?.days) ? window.days : []).map(Number).filter((day) => Number.isInteger(day) && day >= 0 && day <= 6))],
|
|
start: String(window?.start || '00:00'),
|
|
end: String(window?.end || '23:59')
|
|
}))
|
|
},
|
|
inputs: {}
|
|
};
|
|
if (provider === 'ssh-unraid') {
|
|
const remoteFolder = assertRepositoryRelativePath(String(profile.remoteFolder || '').trim());
|
|
if (!remoteFolder || remoteFolder === '.' || remoteFolder.split('/').some((part) => !part || part === '.')) throw new Error('Remote folder must be a safe path relative to the configured server base path.');
|
|
const preservePaths = assertRepositoryRelativePaths(uniqueStrings(profile.preservePaths || ['.env', 'appdata', 'data', 'logs', 'config', 'compose.override.yml']));
|
|
const composeFiles = assertRepositoryRelativePaths(uniqueStrings(profile.composeFiles || [profile.composeFile || 'docker-compose.yml']));
|
|
if (!composeFiles.length && profile.generatedCompose !== true) throw new Error('Select at least one Compose file.');
|
|
const composeService = (() => {
|
|
const value = String(profile.composeService || profile.composeServices?.[0] || remoteFolder.split('/').pop()).trim().toLowerCase();
|
|
if (!/^[a-z0-9._-]+$/.test(value)) throw new Error('Compose service must be lowercase and contain only letters, numbers, dots, underscores and dashes.');
|
|
return value;
|
|
})();
|
|
const composeServices = uniqueStrings(profile.composeServices || [composeService]).map((value) => {
|
|
const normalized = String(value).trim().toLowerCase();
|
|
if (!/^[a-z0-9._-]+$/.test(normalized)) throw new Error('Compose services must be lowercase and contain only letters, numbers, dots, underscores and dashes.');
|
|
return normalized;
|
|
});
|
|
const composeProject = String(profile.composeProject || '').trim();
|
|
if (composeProject && !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(composeProject)) throw new Error('Compose project name contains unsupported characters.');
|
|
const composeWorkingDir = String(profile.composeWorkingDir || '').trim();
|
|
if (composeWorkingDir && (!composeWorkingDir.startsWith('/') || /[\r\n\0]/.test(composeWorkingDir))) throw new Error('Compose working directory must be an absolute safe Unix path.');
|
|
const deploymentMode = ['push-bundle', 'server-git', 'monitor-only'].includes(profile.deploymentMode)
|
|
? profile.deploymentMode
|
|
: 'push-bundle';
|
|
return {
|
|
...common,
|
|
serverId: String(profile.serverId || '').trim(),
|
|
remoteFolder,
|
|
deploymentMode,
|
|
composeFile: composeFiles[0] || 'docker-compose.yml',
|
|
composeFiles: composeFiles.length ? composeFiles : ['docker-compose.yml'],
|
|
composeProject,
|
|
composeWorkingDir,
|
|
composeService,
|
|
composeServices,
|
|
containerName: (() => {
|
|
const value = String(profile.containerName || remoteFolder.split('/').pop()).trim();
|
|
if (!/^[A-Za-z0-9._-]+$/.test(value)) throw new Error('Container name must contain only letters, numbers, dots, underscores and dashes.');
|
|
return value;
|
|
})(),
|
|
cloneUrl: profile.cloneUrl ? assertCloneRemote(profile.cloneUrl) : '',
|
|
alignRemote: profile.alignRemote === true,
|
|
hostPort: profile.hostPort ? Math.min(Math.max(Number(profile.hostPort), 1), 65535) : null,
|
|
containerPort: profile.containerPort ? Math.min(Math.max(Number(profile.containerPort), 1), 65535) : null,
|
|
webUiUrl: assertHttpUrl(profile.webUiUrl, { optional: true, label: 'Web UI URL', allowUnraidTemplate: true }),
|
|
iconMode: ['builtin', 'upload', 'url', 'none'].includes(profile.iconMode)
|
|
? profile.iconMode
|
|
: profile.iconFilePath ? 'upload' : profile.iconUrl ? 'url' : 'builtin',
|
|
iconUrl: assertHttpUrl(profile.iconUrl, { optional: true, label: 'Icon URL' }),
|
|
iconFilePath: String(profile.iconFilePath || '').trim(),
|
|
dockerShell: ['/bin/sh', '/bin/bash'].includes(profile.dockerShell) ? profile.dockerShell : '/bin/sh',
|
|
preservePaths,
|
|
generatedCompose: profile.generatedCompose === true,
|
|
adoptedFromServer: profile.adoptedFromServer === true,
|
|
serverSourceOfTruth: profile.serverSourceOfTruth === true,
|
|
manageDockerMan: profile.manageDockerMan === true,
|
|
forceRecreate: profile.forceRecreate === true,
|
|
removeOrphans: profile.removeOrphans === true,
|
|
workloadIdentity: profile.workloadIdentity && typeof profile.workloadIdentity === 'object' ? structuredClone(profile.workloadIdentity) : null,
|
|
serverGitAccess: profile.serverGitAccess && typeof profile.serverGitAccess === 'object' ? {
|
|
configured: profile.serverGitAccess.configured === true,
|
|
deployKeyId: Number.isFinite(Number(profile.serverGitAccess.deployKeyId)) ? Number(profile.serverGitAccess.deployKeyId) : null,
|
|
keyFingerprint: String(profile.serverGitAccess.keyFingerprint || '').trim().slice(0, 200) || null,
|
|
hostFingerprint: String(profile.serverGitAccess.hostFingerprint || '').trim().slice(0, 200) || null,
|
|
configuredAt: profile.serverGitAccess.configuredAt || null
|
|
} : null,
|
|
detectedAt: profile.detectedAt || null,
|
|
provenance: profile.provenance && typeof profile.provenance === 'object' ? structuredClone(profile.provenance) : {},
|
|
detectedMetadata: profile.detectedMetadata && typeof profile.detectedMetadata === 'object' ? structuredClone(profile.detectedMetadata) : {},
|
|
serverIconReference: String(profile.serverIconReference || '').trim()
|
|
};
|
|
}
|
|
const statusUrl = assertHttpUrl(profile.statusUrl, { label: 'Application status URL' });
|
|
return {
|
|
...common,
|
|
workflowFile: assertWorkflowFileName(profile.workflowFile || 'deploy.yml'),
|
|
rollbackWorkflowFile: profile.rollbackWorkflowFile ? assertWorkflowFileName(profile.rollbackWorkflowFile) : '',
|
|
statusUrl
|
|
};
|
|
}
|
|
|
|
async saveDeploymentProfile(fullName, profile) {
|
|
const key = String(fullName).toLowerCase();
|
|
const profiles = Array.isArray(this.data.deploymentProfiles[key]) ? this.data.deploymentProfiles[key] : [];
|
|
const normalized = this.normalizeDeploymentProfile(profile || {});
|
|
const next = profiles.filter((item) => item.id !== normalized.id);
|
|
next.push(normalized);
|
|
this.data.deploymentProfiles[key] = next;
|
|
await this.save();
|
|
return normalized;
|
|
}
|
|
|
|
async deleteDeploymentProfile(fullName, profileId) {
|
|
const key = String(fullName || '').toLowerCase();
|
|
const profiles = Array.isArray(this.data.deploymentProfiles[key]) ? this.data.deploymentProfiles[key] : [];
|
|
const next = profiles.filter((item) => item.id !== profileId);
|
|
if (next.length) this.data.deploymentProfiles[key] = next;
|
|
else delete this.data.deploymentProfiles[key];
|
|
delete this.data.deploymentStates[profileId];
|
|
await this.save();
|
|
return next;
|
|
}
|
|
|
|
getDeploymentProfiles(fullName) {
|
|
return structuredClone(this.data.deploymentProfiles[String(fullName || '').toLowerCase()] || []);
|
|
}
|
|
|
|
getDeploymentProfile(fullName, profileId) {
|
|
return this.getDeploymentProfiles(fullName).find((item) => item.id === profileId) || null;
|
|
}
|
|
|
|
getInventoryReviewDecisions(serverId) {
|
|
return structuredClone(this.data.inventoryReviewDecisions[String(serverId || '')] || []);
|
|
}
|
|
|
|
async saveInventoryReviewDecision(serverId, decision) {
|
|
const key = String(serverId || '');
|
|
if (!key || !decision?.workloadId || !/^[0-9a-f]{64}$/i.test(String(decision.evidenceHash || ''))) throw new Error('A server, workload and evidence hash are required for an inventory review decision.');
|
|
const decisions = this.getInventoryReviewDecisions(key).filter((item) => item.workloadId !== decision.workloadId);
|
|
decisions.push(structuredClone(decision));
|
|
this.data.inventoryReviewDecisions[key] = decisions;
|
|
await this.save();
|
|
return structuredClone(decision);
|
|
}
|
|
|
|
async deleteInventoryReviewDecision(serverId, workloadId) {
|
|
const key = String(serverId || '');
|
|
this.data.inventoryReviewDecisions[key] = this.getInventoryReviewDecisions(key).filter((item) => item.workloadId !== workloadId);
|
|
await this.save();
|
|
return this.getInventoryReviewDecisions(key);
|
|
}
|
|
|
|
async saveDeploymentState(profileId, state) {
|
|
this.data.deploymentStates[profileId] = {
|
|
...(this.data.deploymentStates[profileId] || {}),
|
|
...state,
|
|
checkedAt: state.checkedAt || new Date().toISOString()
|
|
};
|
|
await this.save();
|
|
return structuredClone(this.data.deploymentStates[profileId]);
|
|
}
|
|
|
|
getDeploymentState(profileId) {
|
|
return structuredClone(this.data.deploymentStates[profileId] || null);
|
|
}
|
|
|
|
async addOperation(operation) {
|
|
const existing = this.data.operations.find((item) => item.id === operation.id);
|
|
const normalized = {
|
|
id: operation.id || crypto.randomUUID(),
|
|
createdAt: existing?.createdAt || operation.createdAt || new Date().toISOString(),
|
|
...existing,
|
|
...operation,
|
|
updatedAt: new Date().toISOString()
|
|
};
|
|
this.data.operations = [normalized, ...this.data.operations.filter((item) => item.id !== normalized.id)].slice(0, 250);
|
|
await this.save();
|
|
return structuredClone(normalized);
|
|
}
|
|
|
|
getOperation(operationId) {
|
|
return structuredClone(this.data.operations.find((item) => item.id === operationId) || null);
|
|
}
|
|
|
|
async setPreferences(preferences) {
|
|
const next = { ...this.data.preferences, ...(preferences || {}) };
|
|
next.repositoryPollSeconds = Math.min(Math.max(Number(next.repositoryPollSeconds) || 4, 2), 60);
|
|
next.operationPollSeconds = Math.min(Math.max(Number(next.operationPollSeconds) || 5, 3), 120);
|
|
next.fetchIntervalMinutes = Math.min(Math.max(Number(next.fetchIntervalMinutes) || 10, 0), 240);
|
|
next.autoRefresh = next.autoRefresh !== false;
|
|
next.preferredCloneProtocol = ['https', 'ssh'].includes(next.preferredCloneProtocol) ? next.preferredCloneProtocol : 'https';
|
|
next.diagnosticsEnabled = next.diagnosticsEnabled !== false;
|
|
next.diagnosticLevel = ['debug', 'info', 'warning', 'error'].includes(next.diagnosticLevel) ? next.diagnosticLevel : 'info';
|
|
next.logRetentionDays = Math.min(Math.max(Number(next.logRetentionDays) || 14, 1), 90);
|
|
next.maxLogFileMb = Math.min(Math.max(Number(next.maxLogFileMb) || 8, 1), 50);
|
|
const normalizeTool = (tool, fallback) => ({
|
|
executable: String(tool?.executable || fallback.executable).trim().slice(0, 500),
|
|
args: (Array.isArray(tool?.args) ? tool.args : fallback.args).map((item) => String(item).slice(0, 500)).slice(0, 20)
|
|
});
|
|
next.editor = normalizeTool(next.editor, DEFAULT_CONFIG.preferences.editor);
|
|
next.terminal = normalizeTool(next.terminal, DEFAULT_CONFIG.preferences.terminal);
|
|
next.notificationsEnabled = next.notificationsEnabled !== false;
|
|
next.trayEnabled = next.trayEnabled !== false;
|
|
next.closeToTray = next.closeToTray === true;
|
|
next.startAtLogin = next.startAtLogin === true;
|
|
this.data.preferences = next;
|
|
await this.save();
|
|
return this.getPublicState();
|
|
}
|
|
|
|
getPublicState() {
|
|
return {
|
|
schemaVersion: this.data.schemaVersion,
|
|
setupComplete: this.data.setupComplete,
|
|
appearance: this.data.appearance,
|
|
gitea: {
|
|
baseUrl: this.data.gitea.baseUrl,
|
|
user: this.data.gitea.user,
|
|
hasToken: Boolean(this.getToken())
|
|
},
|
|
workspaceRoots: [...this.data.workspaceRoots],
|
|
repositoryMappings: { ...this.data.repositoryMappings },
|
|
deploymentProfiles: structuredClone(this.data.deploymentProfiles),
|
|
deploymentStates: structuredClone(this.data.deploymentStates),
|
|
gitValidator: structuredClone(this.data.gitValidator),
|
|
favorites: [...this.data.favorites],
|
|
updates: { ...this.data.updates },
|
|
servers: this.data.servers.map((server) => this.getPublicServer(server)),
|
|
preferences: { ...this.data.preferences },
|
|
operations: structuredClone(this.data.operations)
|
|
};
|
|
}
|
|
}
|
|
|
|
module.exports = { ConfigStore, DEFAULT_CONFIG };
|