Compare commits
10 Commits
v1.0.1-rc.
...
release/1.
| Author | SHA1 | Date | |
|---|---|---|---|
| 0f6ebd7041 | |||
| 0c508eecef | |||
| 24da782dcc | |||
| bcff710eb5 | |||
| fd4b2f67ae | |||
| b0235088ad | |||
| b99588a4e4 | |||
| 8d45e4670f | |||
| f4c724d984 | |||
| 1f9e5a8068 |
@@ -1,8 +1,8 @@
|
||||
{
|
||||
"moduleCode": "order",
|
||||
"candidateVersion": "1.0.1-rc.2",
|
||||
"buildRevision": 2,
|
||||
"buildChecksum": "e71d92cc440437054c77fef0dbee098c6ceb8700d9a7d828dcad86420f230f22",
|
||||
"schemaInputChecksum": "34ed49d330f45bd9933b582bc9265cf0f4e2e2683833d0f39e38a357d138ab65",
|
||||
"branchName": "release/1.0.1-rc.2"
|
||||
"candidateVersion": "1.0.5-rc.6",
|
||||
"buildRevision": 6,
|
||||
"buildChecksum": "9d3fcb8e096e7f79bcdf61234875bdfaa368db3e41deb5c192775546663ae075",
|
||||
"schemaInputChecksum": "18d11bb9ce859510f4a1830e1bdf00182da78acfd305262eed05c7e9358d0143",
|
||||
"branchName": "release/1.0.5-rc.6"
|
||||
}
|
||||
|
||||
4
.gitignore
vendored
4
.gitignore
vendored
@@ -9,3 +9,7 @@ coverage/
|
||||
.env.*
|
||||
!.env.example
|
||||
.tmp-*
|
||||
!pnpm-lock.yaml
|
||||
|
||||
# Local candidate archives are superseded by the private registry
|
||||
vendor/
|
||||
|
||||
48
README.md
48
README.md
@@ -1,3 +1,7 @@
|
||||
本项目固定使用私服发行的 Core 8.1.0、Module Runtime 9.0.4 和 RPC 9.0.7；精确依赖、锁文件与逐文件校验基线一并提交。
|
||||
|
||||
V2 发布与受控开发监听以 [RELEASE-V2.md](RELEASE-V2.md) 为准；历史 V1 操作说明不适用于新 V2 候选。
|
||||
|
||||
# COOL SaaS 模块微服务起始项目
|
||||
|
||||
这是一个可复制到 `cool-midway-biz/microservices/<service-name>` 的干净起始项目。
|
||||
@@ -54,36 +58,42 @@ pnpm build
|
||||
生成后可随时执行 `pnpm exec cool saas-model verify` 检查当前分支、候选锁、生成文件与
|
||||
控制面的精确 Candidate 是否一致。`pnpm dev` 会先执行同一校验，再调用
|
||||
`package.json` 中 `coolSaas.lifecycle.dev` 的非递归命令构建并启动原有开发宿主；因此
|
||||
配置里不要写回 `pnpm dev`。项目接入自己的 watch/reload 工具后，可将该命令替换为对应
|
||||
的开发启动命令。
|
||||
配置里不要写回 `pnpm dev`。持续开发使用 `pnpm exec cool saas-model dev --watch`，由外层
|
||||
CLI 捕获源码身份、构建独立快照、排空旧实例并发布新代次。不要用仅重启内层宿主的 watch
|
||||
替代这个入口；依赖或候选锁变化需要结束当前 watch 后重新启动。
|
||||
|
||||
CLI 生成的 `models.ts`、`contracts.ts`、`saas-actions.ts`、`saas-events.ts`、
|
||||
`module.ts`、`index.ts` 和锁文件属于同一个不可变 Build，请整体保留且不要手工修改。
|
||||
|
||||
## 固化 Candidate
|
||||
|
||||
开发联调完成后，先提交并将当前 release 分支推送到 `origin`，然后执行：
|
||||
开发联调完成后，停止开发 watch，提交并推送当前候选分支，然后使用外部 builder 配置：
|
||||
|
||||
```powershell
|
||||
pnpm run publish
|
||||
pnpm run publish --builder-config <外部绝对配置路径>
|
||||
```
|
||||
|
||||
该脚本只调用 `cool saas-model finalize`。CLI 从 `package.json` 的 `coolSaas.lifecycle`
|
||||
读取并依次执行 `test` 与 `build`（本模板分别为 typecheck 和原有 build），确认工作区仍然
|
||||
干净且当前提交已推送后，创建并推送 `v<candidate-version>` Tag，最后向控制面幂等提交
|
||||
freeze 证据。生命周期子命令不得调用 `pnpm dev`、`pnpm publish` 或再次调用
|
||||
`cool saas-model dev/finalize`，以免递归。
|
||||
`publish` 脚本执行 `cool saas-model finalize`，不会发布 npm 包或直接晋升 Stable。
|
||||
Core 8.1.0 先领取平台签名构建任务，从已推送的 Git 提交提取独立源码目录，复制并核对实际
|
||||
依赖，再按 `coolSaas.lifecycle` 执行测试和构建。源码、启动脚本、依赖在构建后发生变化
|
||||
都会拒绝固化。CLI 签名保存完整 bundle、推送版本 Tag，并幂等提交平台 freeze。
|
||||
生命周期子命令不能再次调用 `pnpm dev`、`pnpm publish` 或 `cool saas-model dev/finalize`。
|
||||
|
||||
freeze 成功后，原来的 development 实例会因身份不再匹配而停止参与路由。再次执行
|
||||
`pnpm dev`，CLI 会读取候选的 Frozen Artifact，只允许从完全一致且干净的 Git commit
|
||||
以 `runtimeMode=frozen` 启动。请用这个固化实例完成最终验收；验收通过后才能在管理端
|
||||
晋升 Stable。`accepted` 状态也可以用同一命令重启精确固化实例，但已晋升、拒绝、替代
|
||||
或放弃的候选会被拒绝。
|
||||
保存 CLI 输出的 frozen deployment directory 及其外部构建回执。目录内包含已经构建的
|
||||
`dist`、启动器和独立依赖；不要重新安装、构建或修改其中内容。freeze 后原 development
|
||||
身份不能继续参与路由，V2 候选也不能再用 `pnpm dev` 重建。配置精确候选 Release ID、
|
||||
BUILD_SHA、独立 Runtime 票据/状态、租户凭证、外部 builder 公钥信任文件和短期制品读取凭证，
|
||||
从该目录执行 `pnpm run start:frozen`，再由平台的专用 runner 执行自动验收。
|
||||
|
||||
控制面地址与凭证继续使用 `COOL_SAAS_CONTROL_PLANE_URL`、`COOL_SAAS_TOKEN`，或 CLI 的
|
||||
`--endpoint`、`--token` 参数。CLI token 只用于校验/freeze 请求，不会写入候选锁，也
|
||||
不会传给测试、构建或开发宿主子进程。freeze 调用
|
||||
`/internal/saas/module_release/freeze`，只发送 Bearer 凭证，不依赖浏览器 Cookie。
|
||||
管理员查看不可变报告，选择有效的 run 单独批准，随后晋升 Stable。Stable 使用同一份
|
||||
deployment directory 与独立运行身份执行 `pnpm run start:stable`。已晋升来源 RC 如需继续
|
||||
运行，也必须保留原制品和有效关联；拒绝、放弃、撤销或关联失效的候选不能重新启动。
|
||||
完整配置、回执恢复和验收顺序见 [RELEASE-V2.md](RELEASE-V2.md)。
|
||||
|
||||
控制面地址与凭证使用 `COOL_SAAS_CONTROL_PLANE_URL`、`COOL_SAAS_TOKEN`，或 CLI 的
|
||||
`--endpoint`、`--token` 参数。CLI token 不写入候选锁，也不传给测试、构建或开发宿主
|
||||
子进程。freeze 调用 `/internal/saas/module_release/freeze`，使用 Bearer 凭证和受限的二进制
|
||||
请求体传输完整 bundle，不依赖浏览器 Cookie。
|
||||
|
||||
## 依赖与发布
|
||||
|
||||
@@ -116,7 +126,7 @@ SAAS_CONTROL_PLANE_URL=https://control-plane.example.com
|
||||
生产环境由受信部署编排器在应用配置之外完成以下工作：
|
||||
|
||||
- 签发绑定精确 Build/Release 的 bootstrap ticket，并注入 `BUILD_SHA`、Redis 和
|
||||
RPC HMAC 材料；Release 身份及摘要由控制面权威响应回填，不要求手工填写。
|
||||
每个进程独立的 Ed25519 私钥及受限公钥信任文件；Release 身份及摘要由控制面权威响应回填。
|
||||
- 为每个副本分别挂载短期、一次性且绑定模块/Build/Release/制品的
|
||||
`SAAS_RUNTIME_BOOTSTRAP_TOKEN_FILE`，不能让两个副本共用一个票据。票据签发结果会
|
||||
同时返回并绑定该副本的 `instanceId`。
|
||||
|
||||
23
RELEASE-V2.md
Normal file
23
RELEASE-V2.md
Normal file
@@ -0,0 +1,23 @@
|
||||
# V2 开发、固化与验收
|
||||
|
||||
本项目固定使用私服发行的 Core 8.1.0、Module Runtime 9.0.4 和 RPC 9.0.7；精确依赖、锁文件与逐文件校验基线一并提交。
|
||||
|
||||
配套控制面使用 SaaS 9.2.0 的签名构建、自动验收、独立批准与证据撤销接口。
|
||||
|
||||
健康的 locked RC 仍可直接推送 development/test 租户。正式发布采用下面的顺序。
|
||||
|
||||
1. 在平台锁定 Build，用 CLI generate 获取精确候选分支及生成文件。
|
||||
2. 使用 `pnpm exec cool saas-model dev --watch` 开发。只替换本进程拥有的 generation；构建错误、依赖变化、平台停用不会让旧身份运行新代码。
|
||||
3. 结束开发，停止 watch，提交并推送候选分支。
|
||||
4. 使用 `pnpm exec cool saas-model finalize --builder-config <外部绝对配置路径>`。配置必须提供独立 Ed25519 builder 身份、平台任务公钥及外部 artifactRoot。CLI 从 Git 提交提取源码、独立复制实际 node_modules，然后测试和构建；源码、启动脚本及依赖在构建后被改写则拒绝固化。
|
||||
5. 保存 CLI 输出的 frozen deployment directory。平台保留已签名的 bundle，包含 dist、启动器、候选锁、依赖锁，以及每个已安装依赖文件和链接目标的清单。不要在部署时再次安装依赖或构建。
|
||||
6. 在这份目录设置精确 Release ID、BUILD_SHA、独立 Runtime state/ticket/租户凭证、`SAAS_RELEASE_TRUST_FILE` 外部 builder 公钥信任文件与短期制品读取凭证，运行 `pnpm start:frozen`。任何文件与签名制品不一致都必须先处理，再启动。
|
||||
7. 平台创建验收任务；专用 runner 执行固定的授权、业务、进程恢复套件，签名提交不可变报告。正常角色账号必须预先准备；中途改菜单、权限、路由、数据库连接或安装代次会使本次验收失效，恢复旧值也不能消除变化记录。
|
||||
8. 管理员查看报告，选择有效 run 单独批准，然后晋升 Stable。浏览器人工填写通过结论不能替代自动报告。
|
||||
9. 使用同一份 frozen deployment directory，切换为 Stable 的独立运行身份并运行 `pnpm start:stable`。启动器读取当前控制面证据及撤销状态，复核可信 builder 签名和完整本地字节，再验证 Runtime bootstrap 的精确身份。
|
||||
|
||||
响应丢失时，保留 build-task.json、freeze-submission.json 与 deployment。使用 `finalize --resume-submission <原提交文件的外部绝对路径> --builder-config <原配置>` 重传完全相同的固化请求；它不重新构建、签名或申请任务。只有原任务、源码、远端 Tag、签名和字节均一致时才允许重试。
|
||||
|
||||
task issuer、builder、runner 使用不同密钥。私钥和控制面凭据不得进入 Git、npm 或部署 bundle。执行器及其启动入口属于信任边界；独立构建目录不等同于操作系统沙箱。历史 V1 记录只走显式兼容流程，不能伪造为 V2 自动验收证据。
|
||||
|
||||
本项目的启动器测试属于本地校验；真实租户业务验收由平台的独立 runner 执行并保存报告。
|
||||
13
package.json
13
package.json
@@ -12,19 +12,22 @@
|
||||
"start": "node bootstrap.js",
|
||||
"start:stable": "node start-stable.js",
|
||||
"test:stable": "node --test test/start-stable.test.cjs",
|
||||
"start:local": "cross-env NODE_ENV=local SAAS_RUNTIME_BOOTSTRAP_LOCAL_FALLBACK_ENABLED=true node bootstrap.js"
|
||||
"test:business": "node --test test/orders-business-outcome.test.cjs",
|
||||
"start:local": "cross-env NODE_ENV=local SAAS_RUNTIME_BOOTSTRAP_LOCAL_FALLBACK_ENABLED=true node bootstrap.js",
|
||||
"verify:packages": "node scripts/verify-local-packages.cjs",
|
||||
"start:frozen": "node start-frozen.js"
|
||||
},
|
||||
"coolSaas": {
|
||||
"lifecycle": {
|
||||
"dev": "pnpm run build && pnpm run start:local",
|
||||
"test": "pnpm run typecheck && pnpm run test:stable",
|
||||
"test": "pnpm run typecheck && pnpm run test:stable && pnpm run test:business",
|
||||
"build": "pnpm run build",
|
||||
"artifactDir": "dist"
|
||||
}
|
||||
},
|
||||
"dependencies": {
|
||||
"@cool-midway/module-runtime": "9.0.2",
|
||||
"@cool-midway/rpc": "9.0.2",
|
||||
"@cool-midway/module-runtime": "9.1.0",
|
||||
"@cool-midway/rpc": "9.1.0",
|
||||
"@midwayjs/bootstrap": "^3.20.3",
|
||||
"@midwayjs/core": "^3.20.3",
|
||||
"@midwayjs/koa": "^3.20.3",
|
||||
@@ -35,7 +38,7 @@
|
||||
"typeorm": "npm:@cool-midway/typeorm@0.3.20"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@cool-midway/core": "8.0.11",
|
||||
"@cool-midway/core": "8.1.1",
|
||||
"@types/node": "22.10.7",
|
||||
"cross-env": "^7.0.3",
|
||||
"mwtsc": "^1.16.0",
|
||||
|
||||
35
pnpm-lock.yaml
generated
35
pnpm-lock.yaml
generated
@@ -9,11 +9,11 @@ importers:
|
||||
.:
|
||||
dependencies:
|
||||
'@cool-midway/module-runtime':
|
||||
specifier: 9.0.2
|
||||
version: 9.0.2(@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7)))(@midwayjs/core@3.20.24)
|
||||
specifier: 9.1.0
|
||||
version: 9.1.0(@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7)))(@midwayjs/core@3.20.24)
|
||||
'@cool-midway/rpc':
|
||||
specifier: 9.0.2
|
||||
version: 9.0.2(@cool-midway/module-runtime@9.0.2(@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7)))(@midwayjs/core@3.20.24))(@midwayjs/validate@3.20.24)(debug@4.4.3)
|
||||
specifier: 9.1.0
|
||||
version: 9.1.0(@cool-midway/module-runtime@9.1.0(@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7)))(@midwayjs/core@3.20.24))(@midwayjs/validate@3.20.24)(debug@4.4.3)
|
||||
'@midwayjs/bootstrap':
|
||||
specifier: ^3.20.3
|
||||
version: 3.20.24
|
||||
@@ -40,8 +40,8 @@ importers:
|
||||
version: '@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7))'
|
||||
devDependencies:
|
||||
'@cool-midway/core':
|
||||
specifier: 8.0.11
|
||||
version: 8.0.11(debug@4.4.3)
|
||||
specifier: 8.1.1
|
||||
version: 8.1.1(debug@4.4.3)
|
||||
'@types/node':
|
||||
specifier: 22.10.7
|
||||
version: 22.10.7
|
||||
@@ -68,20 +68,20 @@ packages:
|
||||
resolution: {integrity: sha512-Bl43bVCUm0V+w1wkfOicRfiHHZtaH1mQCp06baNapG86uC7OiXwMrml5+cvZD+mYSHdP07qUxtqkL8oUhrgAfg==}
|
||||
engines: {node: '>=8.0.0'}
|
||||
|
||||
'@cool-midway/core@8.0.11':
|
||||
resolution: {integrity: sha512-fcx4A67Nqjh7N4Ujc975ZPHvkHP+BGLSjcFXcmlozSBJvuxR+ftBh1zmoFWsJ3o35YUqKGC5eA4v9i2vV6kw/A==}
|
||||
'@cool-midway/core@8.1.1':
|
||||
resolution: {integrity: sha512-Kf4x3IrWnBM5o2k3hdHhDt7ujBG7MLn5JXV4o8glKEh4pqdzgoe/HgTcEvtdpIRvy80MsnIt5ZlH1Eq54qV4uQ==}
|
||||
hasBin: true
|
||||
|
||||
'@cool-midway/module-runtime@9.0.2':
|
||||
resolution: {integrity: sha512-eYB57p/wshDUSaqTmZHsh5LGDpPgQaii4jPG5vORcdgoCxxcGuRu9fhcTnuRhlfTYj+Gh71Oa1QgoRXdFE7tRA==}
|
||||
'@cool-midway/module-runtime@9.1.0':
|
||||
resolution: {integrity: sha512-8pWWQpzaR28gOLuZ8aQV+RVFmuFqtIfz8VHgu4uMMDnp4Jo3qPtKonQB6AV8BUNex2CBCkyFhmrZ8D+3YVNNeA==}
|
||||
peerDependencies:
|
||||
'@midwayjs/core': '>=3.20.0'
|
||||
typeorm: '>=0.3.20'
|
||||
|
||||
'@cool-midway/rpc@9.0.2':
|
||||
resolution: {integrity: sha512-GBxjGslo538m2v3Z2AeuKmtj8JMjAAIbnzqwSqYmjz9C/sQZ9V6trWgu5TcQIAnXVAGDY1aVcK8pVg16T6LRDg==}
|
||||
'@cool-midway/rpc@9.1.0':
|
||||
resolution: {integrity: sha512-G9auVH/bvCHrxVXVeDV17ejiUTEBvrnA54B/W6NtDFF0HaT0nk3lz8thrzFESACeHzwWppA0FAC51upwVCyxzA==}
|
||||
peerDependencies:
|
||||
'@cool-midway/module-runtime': '>=9.0.0'
|
||||
'@cool-midway/module-runtime': '>=9.1.0 <10'
|
||||
'@midwayjs/validate': '>=3.20.0'
|
||||
|
||||
'@cool-midway/typeorm@0.3.20':
|
||||
@@ -588,6 +588,7 @@ packages:
|
||||
|
||||
charm@0.1.2:
|
||||
resolution: {integrity: sha512-syedaZ9cPe7r3hoQA9twWYKu5AIyCswN5+szkmPBe9ccdLrj4bYaCnLVPTLd2kgVRc7+zoX4tyPgRnFKCj5YjQ==}
|
||||
deprecated: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
|
||||
|
||||
chokidar@3.6.0:
|
||||
resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
|
||||
@@ -2469,7 +2470,7 @@ snapshots:
|
||||
dependencies:
|
||||
lockfile: 1.0.4
|
||||
|
||||
'@cool-midway/core@8.0.11(debug@4.4.3)':
|
||||
'@cool-midway/core@8.1.1(debug@4.4.3)':
|
||||
dependencies:
|
||||
'@cool-midway/cache-manager-fs-hash': 7.0.0
|
||||
'@midwayjs/cache-manager': 3.20.24
|
||||
@@ -2492,14 +2493,14 @@ snapshots:
|
||||
- supports-color
|
||||
- utf-8-validate
|
||||
|
||||
'@cool-midway/module-runtime@9.0.2(@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7)))(@midwayjs/core@3.20.24)':
|
||||
'@cool-midway/module-runtime@9.1.0(@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7)))(@midwayjs/core@3.20.24)':
|
||||
dependencies:
|
||||
'@midwayjs/core': 3.20.24
|
||||
typeorm: '@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7))'
|
||||
|
||||
'@cool-midway/rpc@9.0.2(@cool-midway/module-runtime@9.0.2(@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7)))(@midwayjs/core@3.20.24))(@midwayjs/validate@3.20.24)(debug@4.4.3)':
|
||||
'@cool-midway/rpc@9.1.0(@cool-midway/module-runtime@9.1.0(@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7)))(@midwayjs/core@3.20.24))(@midwayjs/validate@3.20.24)(debug@4.4.3)':
|
||||
dependencies:
|
||||
'@cool-midway/module-runtime': 9.0.2(@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7)))(@midwayjs/core@3.20.24)
|
||||
'@cool-midway/module-runtime': 9.1.0(@cool-midway/typeorm@0.3.20(ioredis@5.11.1)(mysql2@3.24.3(@types/node@22.10.7)))(@midwayjs/core@3.20.24)
|
||||
'@midwayjs/validate': 3.20.24
|
||||
ioredis: 5.11.1
|
||||
moleculer: 0.14.36(debug@4.4.3)(ioredis@5.11.1)
|
||||
|
||||
270
release-artifact.js
Normal file
270
release-artifact.js
Normal file
@@ -0,0 +1,270 @@
|
||||
"use strict";
|
||||
Object.defineProperty(exports, "__esModule", { value: true });
|
||||
exports.releaseCanonicalJson = releaseCanonicalJson;
|
||||
exports.releaseJsonChecksum = releaseJsonChecksum;
|
||||
exports.assertReleaseArtifactPath = assertReleaseArtifactPath;
|
||||
exports.compiledArtifactDigestFromEntries = compiledArtifactDigestFromEntries;
|
||||
exports.calculateReleaseCompiledDigest = calculateReleaseCompiledDigest;
|
||||
exports.captureReleaseDependencies = captureReleaseDependencies;
|
||||
exports.createReleaseArtifactBundle = createReleaseArtifactBundle;
|
||||
exports.inspectReleaseArtifactBundle = inspectReleaseArtifactBundle;
|
||||
exports.verifyLocalReleaseArtifact = verifyLocalReleaseArtifact;
|
||||
exports.signReleaseEvidence = signReleaseEvidence;
|
||||
exports.verifyReleaseEvidence = verifyReleaseEvidence;
|
||||
exports.validateReleaseDependencyManifest = validateReleaseDependencyManifest;
|
||||
exports.captureReleaseSourceInputs = captureReleaseSourceInputs;
|
||||
exports.materializeCommittedReleaseSource = materializeCommittedReleaseSource;
|
||||
const fs_1 = require("fs");
|
||||
const path_1 = require("path");
|
||||
const child_process_1 = require("child_process");
|
||||
const crypto_1 = require("crypto");
|
||||
const MAX_BUNDLE_BYTES = 64 * 1024 * 1024;
|
||||
const MAX_FILES = 10000;
|
||||
const MAX_DEPENDENCIES = 150000;
|
||||
const SHA = /^[a-f0-9]{64}$/;
|
||||
const SIGNATURE_DOMAINS = {
|
||||
build: 'COOL_SAAS_RELEASE_BUILD_V2\0',
|
||||
task: 'COOL_SAAS_RELEASE_TASK_V2\0',
|
||||
run: 'COOL_SAAS_RELEASE_RUN_V2\0',
|
||||
claim: 'COOL_SAAS_RELEASE_CLAIM_V2\0',
|
||||
};
|
||||
function ensure(value, message) {
|
||||
if (!value)
|
||||
throw new Error(`Release artifact refused: ${message}`);
|
||||
}
|
||||
function releaseCanonicalJson(value) {
|
||||
if (value === null || typeof value === 'string' || typeof value === 'boolean')
|
||||
return JSON.stringify(value);
|
||||
if (typeof value === 'number') {
|
||||
ensure(Number.isFinite(value) && !Object.is(value, -0), 'invalid JSON number');
|
||||
return JSON.stringify(value);
|
||||
}
|
||||
if (Array.isArray(value))
|
||||
return `[${value.map(releaseCanonicalJson).join(',')}]`;
|
||||
ensure(value && typeof value === 'object' && [Object.prototype, null].includes(Object.getPrototypeOf(value)), 'invalid JSON value');
|
||||
return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${releaseCanonicalJson(value[key])}`).join(',')}}`;
|
||||
}
|
||||
function releaseJsonChecksum(value) {
|
||||
return (0, crypto_1.createHash)('sha256').update(releaseCanonicalJson(value), 'utf8').digest('hex');
|
||||
}
|
||||
function assertReleaseArtifactPath(name) {
|
||||
ensure(typeof name === 'string' && name.length > 0 && name.length <= 1024 && !/[\\:\x00-\x1f]/.test(name), 'invalid relative artifact path');
|
||||
ensure(!name.startsWith('/') && name.split('/').every(part => part && part !== '.' && part !== '..' && !/[. ]$/.test(part) && !/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part)), 'unsafe relative artifact path');
|
||||
return name;
|
||||
}
|
||||
function inside(root, target) {
|
||||
const name = (0, path_1.relative)(root, target);
|
||||
return name === '' || (!(0, path_1.isAbsolute)(name) && name !== '..' && !name.startsWith(`..${path_1.sep}`));
|
||||
}
|
||||
function regularDirectoryFiles(root) {
|
||||
var _a;
|
||||
ensure(((_a = (0, fs_1.lstatSync)(root, { throwIfNoEntry: false })) === null || _a === void 0 ? void 0 : _a.isDirectory()) && !(0, fs_1.lstatSync)(root).isSymbolicLink(), 'artifact directory is missing or linked');
|
||||
const files = [];
|
||||
const visit = (directory, depth = 0) => {
|
||||
ensure(depth <= 64, 'artifact directory nesting is too deep');
|
||||
for (const name of (0, fs_1.readdirSync)(directory).sort()) {
|
||||
const absolute = (0, path_1.resolve)(directory, name);
|
||||
const stat = (0, fs_1.lstatSync)(absolute);
|
||||
ensure(!stat.isSymbolicLink(), 'artifact must not contain symbolic links');
|
||||
if (stat.isDirectory())
|
||||
visit(absolute, depth + 1);
|
||||
else {
|
||||
ensure(stat.isFile(), 'artifact contains a non-file entry');
|
||||
files.push({ path: assertReleaseArtifactPath((0, path_1.relative)(root, absolute).replace(/\\/g, '/')), absolute });
|
||||
ensure(files.length <= MAX_FILES, 'too many artifact files');
|
||||
}
|
||||
}
|
||||
};
|
||||
visit(root);
|
||||
ensure(files.length > 0, 'compiled artifact is empty');
|
||||
return files.sort((left, right) => left.path.localeCompare(right.path));
|
||||
}
|
||||
function compiledArtifactDigestFromEntries(entries) {
|
||||
ensure(entries.length > 0, 'compiled artifact is empty');
|
||||
const hash = (0, crypto_1.createHash)('sha256').update('COOL_SAAS_ARTIFACT_DIRECTORY_V1\0', 'utf8');
|
||||
const seen = new Set();
|
||||
for (const { path, bytes } of [...entries].sort((left, right) => left.path.localeCompare(right.path))) {
|
||||
assertReleaseArtifactPath(path);
|
||||
ensure(!seen.has(path.toLowerCase()), 'duplicate or case-colliding compiled path');
|
||||
seen.add(path.toLowerCase());
|
||||
hash.update(`${Buffer.byteLength(path, 'utf8')}:`, 'utf8').update(path, 'utf8').update(`:${bytes.length}:`, 'utf8').update(bytes);
|
||||
}
|
||||
return `sha256:${hash.digest('hex')}`;
|
||||
}
|
||||
function calculateReleaseCompiledDigest(artifactDir) {
|
||||
return compiledArtifactDigestFromEntries(regularDirectoryFiles((0, path_1.resolve)(artifactDir)).map(file => ({ path: file.path, bytes: (0, fs_1.readFileSync)(file.absolute) })));
|
||||
}
|
||||
/** Captures the installed dependency bytes, including pnpm's physical store.
|
||||
* Links must resolve inside node_modules. Absolute OS link text is normalized
|
||||
* to its target relative to that root so copying the same tree is portable. */
|
||||
function captureReleaseDependencies(projectDir) {
|
||||
const root = (0, path_1.resolve)(projectDir, 'node_modules');
|
||||
const rootStat = (0, fs_1.lstatSync)(root, { throwIfNoEntry: false });
|
||||
ensure((rootStat === null || rootStat === void 0 ? void 0 : rootStat.isDirectory()) && !rootStat.isSymbolicLink(), 'node_modules must be an independent local directory');
|
||||
const actualRoot = (0, fs_1.realpathSync)(root);
|
||||
const entries = [];
|
||||
const visit = (directory, depth = 0) => {
|
||||
ensure(depth <= 64, 'dependency nesting is too deep');
|
||||
for (const name of (0, fs_1.readdirSync)(directory).sort()) {
|
||||
const absolute = (0, path_1.resolve)(directory, name);
|
||||
const entryPath = assertReleaseArtifactPath((0, path_1.relative)(root, absolute).replace(/\\/g, '/'));
|
||||
const stat = (0, fs_1.lstatSync)(absolute);
|
||||
if (stat.isSymbolicLink()) {
|
||||
const target = (0, fs_1.realpathSync)(absolute);
|
||||
ensure(inside(actualRoot, target) && target !== actualRoot, 'dependency link escapes node_modules');
|
||||
entries.push({ path: entryPath, type: 'link', target: assertReleaseArtifactPath((0, path_1.relative)(actualRoot, target).replace(/\\/g, '/')) });
|
||||
}
|
||||
else if (stat.isDirectory())
|
||||
visit(absolute, depth + 1);
|
||||
else {
|
||||
ensure(stat.isFile() && stat.size <= 256 * 1024 * 1024, 'invalid or oversized dependency file');
|
||||
const bytes = (0, fs_1.readFileSync)(absolute);
|
||||
entries.push({ path: entryPath, type: 'file', size: bytes.length, sha256: (0, crypto_1.createHash)('sha256').update(bytes).digest('hex') });
|
||||
}
|
||||
ensure(entries.length <= MAX_DEPENDENCIES, 'too many dependency entries');
|
||||
}
|
||||
};
|
||||
visit(root);
|
||||
ensure(entries.length > 0, 'dependencies are empty');
|
||||
return { formatVersion: 1, entries: entries.sort((a, b) => a.path.localeCompare(b.path)) };
|
||||
}
|
||||
function createReleaseArtifactBundle(projectDir) {
|
||||
const root = (0, path_1.resolve)(projectDir);
|
||||
const files = [];
|
||||
const required = ['.cool-saas-candidate.json', '.cool-saas-service.json', 'bootstrap.js', 'release-environment.js', 'start-stable.js', 'start-frozen.js', 'release-artifact.js', 'package.json', 'scripts/published-packages.json'];
|
||||
const locks = ['pnpm-lock.yaml', 'package-lock.json', 'npm-shrinkwrap.json', 'yarn.lock'].filter(name => (0, fs_1.lstatSync)((0, path_1.resolve)(root, name), { throwIfNoEntry: false }));
|
||||
ensure(locks.length === 1, 'exactly one dependency lock is required');
|
||||
for (const name of [...required, ...locks]) {
|
||||
const absolute = (0, path_1.resolve)(root, name);
|
||||
const stat = (0, fs_1.lstatSync)(absolute, { throwIfNoEntry: false });
|
||||
ensure((stat === null || stat === void 0 ? void 0 : stat.isFile()) && !stat.isSymbolicLink(), `required deployment file is missing or linked: ${name}`);
|
||||
ensure(inside((0, fs_1.realpathSync)(root), (0, fs_1.realpathSync)(absolute)), 'deployment file escapes project');
|
||||
files.push({ path: name, content: (0, fs_1.readFileSync)(absolute).toString('base64') });
|
||||
}
|
||||
for (const file of regularDirectoryFiles((0, path_1.resolve)(root, 'dist')))
|
||||
files.push({ path: `dist/${file.path}`, content: (0, fs_1.readFileSync)(file.absolute).toString('base64') });
|
||||
const dependencies = captureReleaseDependencies(root);
|
||||
files.push({ path: 'release-dependencies.json', content: Buffer.from(releaseCanonicalJson(dependencies), 'utf8').toString('base64') });
|
||||
const bundle = { formatVersion: 1, files: files.sort((a, b) => a.path.localeCompare(b.path)) };
|
||||
inspectReleaseArtifactBundle(bundle);
|
||||
return bundle;
|
||||
}
|
||||
function inspectReleaseArtifactBundle(bundle) {
|
||||
ensure(bundle && Object.keys(bundle).sort().join(',') === 'files,formatVersion' && bundle.formatVersion === 1 && Array.isArray(bundle.files), 'invalid bundle shape');
|
||||
ensure(bundle.files.length > 0 && bundle.files.length <= MAX_FILES, 'invalid bundle file count');
|
||||
ensure(Buffer.byteLength(releaseCanonicalJson(bundle), 'utf8') <= MAX_BUNDLE_BYTES, 'artifact bundle exceeds size limit');
|
||||
const files = new Map();
|
||||
const names = new Set();
|
||||
for (const file of bundle.files) {
|
||||
ensure(file && Object.keys(file).sort().join(',') === 'content,path', 'invalid artifact file shape');
|
||||
assertReleaseArtifactPath(file.path);
|
||||
ensure(typeof file.content === 'string', 'invalid artifact content');
|
||||
const bytes = Buffer.from(file.content, 'base64');
|
||||
ensure(bytes.toString('base64') === file.content, 'non-canonical base64 artifact content');
|
||||
ensure(!names.has(file.path.toLowerCase()), 'duplicate or case-colliding artifact path');
|
||||
names.add(file.path.toLowerCase());
|
||||
files.set(file.path, bytes);
|
||||
}
|
||||
const compiled = [...files].filter(([name]) => name.startsWith('dist/')).map(([name, bytes]) => ({ path: name.slice(5), bytes }));
|
||||
return { files, artifactDigest: compiledArtifactDigestFromEntries(compiled), bundleDigest: `sha256:${releaseJsonChecksum(bundle)}` };
|
||||
}
|
||||
function verifyLocalReleaseArtifact(projectDir, bundle) {
|
||||
const inspected = inspectReleaseArtifactBundle(bundle);
|
||||
const dependencyBytes = inspected.files.get('release-dependencies.json');
|
||||
ensure(dependencyBytes, 'installed dependency evidence is missing');
|
||||
const expected = JSON.parse(dependencyBytes.toString('utf8'));
|
||||
const actual = captureReleaseDependencies(projectDir);
|
||||
ensure(releaseJsonChecksum(expected) === releaseJsonChecksum(actual), 'installed dependency bytes or link targets differ from the signed build');
|
||||
for (const [name, bytes] of inspected.files) {
|
||||
if (name === 'release-dependencies.json')
|
||||
continue;
|
||||
const absolute = (0, path_1.resolve)(projectDir, name);
|
||||
const stat = (0, fs_1.lstatSync)(absolute, { throwIfNoEntry: false });
|
||||
ensure((stat === null || stat === void 0 ? void 0 : stat.isFile()) && !stat.isSymbolicLink() && inside((0, fs_1.realpathSync)(projectDir), (0, fs_1.realpathSync)(absolute)), `deployment file is missing or linked: ${name}`);
|
||||
ensure((0, fs_1.readFileSync)(absolute).equals(bytes), `deployment file differs from signed build: ${name}`);
|
||||
}
|
||||
ensure(calculateReleaseCompiledDigest((0, path_1.resolve)(projectDir, 'dist')) === inspected.artifactDigest, 'compiled file set differs from signed build');
|
||||
return inspected;
|
||||
}
|
||||
function signReleaseEvidence(kind, keyId, claims, privateKeyPem) {
|
||||
ensure(/^[a-z0-9][a-z0-9._-]{0,63}$/.test(keyId), 'invalid signing key id');
|
||||
const key = (0, crypto_1.createPrivateKey)(privateKeyPem);
|
||||
ensure(key.asymmetricKeyType === 'ed25519', 'release evidence requires Ed25519');
|
||||
const unsigned = { algorithm: 'Ed25519', keyId, claims };
|
||||
const bytes = Buffer.from(SIGNATURE_DOMAINS[kind] + releaseCanonicalJson(unsigned), 'utf8');
|
||||
return { ...unsigned, signature: (0, crypto_1.sign)(null, bytes, key).toString('base64url') };
|
||||
}
|
||||
function verifyReleaseEvidence(kind, envelope, trustedKeys) {
|
||||
ensure(envelope && Object.keys(envelope).sort().join(',') === 'algorithm,claims,keyId,signature' && envelope.algorithm === 'Ed25519', 'invalid signed evidence envelope');
|
||||
ensure(Object.prototype.hasOwnProperty.call(trustedKeys, envelope.keyId), 'untrusted evidence signer');
|
||||
const signature = Buffer.from(envelope.signature || '', 'base64url');
|
||||
ensure(signature.length === 64 && signature.toString('base64url') === envelope.signature, 'invalid evidence signature encoding');
|
||||
const key = (0, crypto_1.createPublicKey)(trustedKeys[envelope.keyId]);
|
||||
ensure(key.asymmetricKeyType === 'ed25519', 'invalid trusted evidence key');
|
||||
const unsigned = { algorithm: envelope.algorithm, keyId: envelope.keyId, claims: envelope.claims };
|
||||
ensure((0, crypto_1.verify)(null, Buffer.from(SIGNATURE_DOMAINS[kind] + releaseCanonicalJson(unsigned), 'utf8'), key, signature), 'release evidence signature does not match');
|
||||
return envelope.claims;
|
||||
}
|
||||
function validateReleaseDependencyManifest(value) {
|
||||
ensure(value && value.formatVersion === 1 && Array.isArray(value.entries) && value.entries.length > 0 && value.entries.length <= MAX_DEPENDENCIES, 'invalid dependency manifest');
|
||||
const paths = new Set();
|
||||
for (const entry of value.entries) {
|
||||
assertReleaseArtifactPath(entry.path);
|
||||
ensure(!paths.has(entry.path.toLowerCase()), 'duplicate dependency path');
|
||||
paths.add(entry.path.toLowerCase());
|
||||
if (entry.type === 'file')
|
||||
ensure(Number.isSafeInteger(entry.size) && entry.size >= 0 && SHA.test(entry.sha256 || ''), 'invalid dependency file proof');
|
||||
else {
|
||||
ensure(entry.type === 'link', 'invalid dependency entry type');
|
||||
assertReleaseArtifactPath(entry.target);
|
||||
}
|
||||
}
|
||||
}
|
||||
/** Captures every authored input, including unanticipated build-script inputs.
|
||||
* Only conventional generated output roots are excluded. */
|
||||
function captureReleaseSourceInputs(projectDir) {
|
||||
const root = (0, fs_1.realpathSync)(projectDir);
|
||||
const files = [];
|
||||
const walk = (directory) => {
|
||||
for (const entry of (0, fs_1.readdirSync)(directory, { withFileTypes: true })) {
|
||||
const absolute = (0, path_1.resolve)(directory, entry.name);
|
||||
const name = (0, path_1.relative)(root, absolute).replace(/\\/g, '/');
|
||||
if (/^(?:dist|node_modules|logs?|coverage|\.cache|\.git)(?:\/|$)/.test(name) || /^[^/]+\.tsbuildinfo$/.test(name))
|
||||
continue;
|
||||
assertReleaseArtifactPath(name);
|
||||
const stat = (0, fs_1.lstatSync)(absolute);
|
||||
ensure(!stat.isSymbolicLink(), `source input is linked: ${name}`);
|
||||
if (stat.isDirectory())
|
||||
walk(absolute);
|
||||
else {
|
||||
ensure(stat.isFile(), `source input is not a regular file: ${name}`);
|
||||
files.push({ path: name, sha256: (0, crypto_1.createHash)('sha256').update((0, fs_1.readFileSync)(absolute)).digest('hex') });
|
||||
}
|
||||
}
|
||||
};
|
||||
walk(root);
|
||||
return files.sort((a, b) => a.path.localeCompare(b.path));
|
||||
}
|
||||
/** Reads exact Git blobs instead of a mutable checkout while a build runs. */
|
||||
function materializeCommittedReleaseSource(repository, commit, destination) {
|
||||
ensure(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(commit), 'invalid source commit');
|
||||
ensure(!(0, fs_1.lstatSync)(destination, { throwIfNoEntry: false }), 'source snapshot destination already exists');
|
||||
const entries = (0, child_process_1.execFileSync)('git', ['ls-tree', '-r', '-z', commit], { cwd: repository, windowsHide: true, maxBuffer: 32 * 1024 * 1024 }).toString('utf8').split('\0').filter(Boolean);
|
||||
ensure(entries.length > 0 && entries.length <= 30000, 'invalid source snapshot size');
|
||||
(0, fs_1.mkdirSync)(destination, { recursive: true });
|
||||
for (const entry of entries) {
|
||||
const match = /^(100644|100755) blob ([a-f0-9]{40,64})\t([\s\S]+)$/.exec(entry);
|
||||
ensure(match, 'source snapshot contains a link or submodule');
|
||||
const name = assertReleaseArtifactPath(match[3]);
|
||||
// Credentials are never build inputs, even if an old repository tracked one.
|
||||
ensure(!/(^|\/)(?:\.env(?:\..*)?|.*\.pem|.*\.private\.(?:json|txt))$/i.test(name), 'private configuration must not be tracked in a release');
|
||||
if (/(^|\/)\.npmrc$/i.test(name))
|
||||
continue;
|
||||
ensure(!name.startsWith('node_modules/') && !name.startsWith('dist/'), 'compiled dependencies/artifacts must not be tracked as source');
|
||||
const target = (0, path_1.resolve)(destination, name);
|
||||
ensure(inside((0, path_1.resolve)(destination), target), 'source snapshot path escaped destination');
|
||||
const bytes = (0, child_process_1.execFileSync)('git', ['cat-file', 'blob', match[2]], { cwd: repository, windowsHide: true, maxBuffer: 64 * 1024 * 1024 });
|
||||
(0, fs_1.mkdirSync)((0, path_1.dirname)(target), { recursive: true });
|
||||
(0, fs_1.writeFileSync)(target, bytes, { flag: 'wx', mode: match[1] === '100755' ? 0o755 : 0o644 });
|
||||
}
|
||||
}
|
||||
289
scripts/published-packages.json
Normal file
289
scripts/published-packages.json
Normal file
@@ -0,0 +1,289 @@
|
||||
{
|
||||
"formatVersion": 1,
|
||||
"packages": [
|
||||
{
|
||||
"name": "@cool-midway/core",
|
||||
"version": "8.1.1",
|
||||
"sha256": "6c09ffbbf29bfd70cb8487ae1fa91f24b0cd27131676c6a92afbffc17ad2ce53",
|
||||
"integrity": "sha512-Kf4x3IrWnBM5o2k3hdHhDt7ujBG7MLn5JXV4o8glKEh4pqdzgoe/HgTcEvtdpIRvy80MsnIt5ZlH1Eq54qV4uQ==",
|
||||
"files": {
|
||||
"dist/controller/base.js": "c68dcb2ee7fe99389039333a5618cc3dfaf0ac87365b24b1bb443b670e81a46d",
|
||||
"dist/entity/base.js": "8363fa0ab183aae1cce4555070bb8b7cd454274fe873e80467371f54ea5c47af",
|
||||
"dist/exception/base.js": "d9e1f1cd65b051cfa2c5c67b58bde507da71986cedc35ee9a3f4b6e702ad1522",
|
||||
"dist/service/base.js": "d8f5276b77045900e2d7b3c6e10cda74cd8d81bac872bbf944b11a0b7484b370",
|
||||
"dist/decorator/cache.js": "524b850c621e2efe30a54243857ffeeaab1ca14c2976ca9eb4e605d9dc61a729",
|
||||
"dist/bin/check.js": "ae79d40c58bea4864ad914d148870b8bf9cc9d2bc40c2ef3408b91089915fcc9",
|
||||
"dist/exception/comm.js": "d747a79a35c8a81faaba46426e36612fd3b7092c4019be086d32d41048f6be42",
|
||||
"dist/config/config.default.js": "6ca05c58aff5f8ed6f6a340b27cc131587634e642c1bf72a97314f415f4f133d",
|
||||
"dist/module/config.js": "d043cc225850b2d4785c8dbf06646dca08a0d7ed85e55931460ed0bb6cb0c860",
|
||||
"dist/configuration.js": "51020f70b9f92cf07ad9c32b228450dc535a970b7de8863711ed920bfc003bae",
|
||||
"dist/decorator/controller.js": "d3633ec4d10ea4f871f17ffdbcd91d58eda1fbd5f2191c8fcb5ff6738d4efb86",
|
||||
"dist/exception/core.js": "10cd2c6ef01ed4e139a56aa9947cc536a3360e2d4662452bd91dbb91078b1d31",
|
||||
"dist/tag/data.js": "a498d491b221f8cc19973c0450c966c93ac1c9ac35bfe383a026ea20362f329c",
|
||||
"dist/bin/entity.js": "91dcc9e31bc16e6b7bc2824f1aede47c88b441d5ca5c453df423660b33f5e1ad",
|
||||
"dist/rest/eps.js": "22507382f7e0c09e718e3743671155eacac3211ca7b33b38e8b3cf3259667ba1",
|
||||
"dist/decorator/event.js": "69c91edf56c479fd36fbe27cdf4a5f215cb44efbe6aa7539bf361c0d2e239b20",
|
||||
"dist/exception/filter.js": "9c4eefb65168979ea7ae4b609407789ce3cc8f3a7f2d7baa8541dda0911c3195",
|
||||
"dist/util/func.js": "64ce78b9b5115de344c0c11790f658f2034bde0bd262640edb1d263a5130004e",
|
||||
"dist/constant/global.js": "e64496eead711739e85900659e72587115d02c52a1a10904758b632c4663345f",
|
||||
"dist/module/import.js": "f03e602f1bf5298b7f034d25fb4c72d82fa80e1c65b8f56c292d739dab4cc522",
|
||||
"dist/bin/index.js": "b77d91deae05013d82244249a5e74132b8395de81024a37b342ea8a60b1fd8e6",
|
||||
"dist/decorator/index.js": "f93c258081679f1e5d11517bc29bcc6ca066749b1813d72da927ded484a51550",
|
||||
"dist/event/index.js": "d6e1fd1e0e4949cad7299d4b332cc96549fd4174e20b1b85a44d1a6eabd6a31a",
|
||||
"dist/index.js": "6a5d80cb2841d17c810d872ff412c60de617227971a84e923b5994e8ec334906",
|
||||
"dist/interface.js": "7e811aba01a1704883608710e99deabe017128fdb69a9b760e541c9f3fd6f138",
|
||||
"dist/util/location.js": "2f1d906b82b6cae0a46797fc1683f822b688ab40800671268de565c0497ceb91",
|
||||
"dist/module/menu.js": "6c81c2372580ad11ea2507f84237eeb7654411abda008f6030ea813a24925c20",
|
||||
"dist/entity/mongo.js": "73a13671d213521aa59ffadf10b072ec1ce3c9c1ad72f06bd30d1bd22beb8965",
|
||||
"dist/service/mysql.js": "34ea6da1e9bd1c811436073d94c5b9ddb343448726e6a8a71d2cb5222ab9f7a8",
|
||||
"dist/bin/obfuscate.js": "803798e672a537c54e167837de34499592d0f5c991273a6f05515770357fa6ec",
|
||||
"dist/service/postgres.js": "007d4b1a1ed3ea4aed05ff37fb1832a1ac8f0b16a1becee56e534e77167a492b",
|
||||
"dist/service/query-safety.js": "7470e7fd1e3d616b6a31a19054ab86768c4086485f6e6a3eea0fd7165916fad8",
|
||||
"dist/bin/saas-dev-watch-child.js": "cb33b8b338515f9bebb6cf0ec412788ac43dd1ad92d90464431b02eec86663cc",
|
||||
"dist/bin/saas-dev-watch-files.js": "bf9aae8a5f413403c7850ada4bdf11e22a4c6708b7bcb27ba130af410289fd22",
|
||||
"dist/bin/saas-dev-watch-process.js": "d4d44ccaa2a739c5e36518dd40456cb2c3bdf778a1de0f1017cc57c8d0a03e65",
|
||||
"dist/bin/saas-dev-watch.js": "0d075d75e5f662eb06672d271a9aa67e99e233c6989f0fa140d713e8657b9cbb",
|
||||
"dist/bin/saas-model.js": "481096526967c7757cb21f2a295c2f06d88502879ac797a5985343ee16fd3934",
|
||||
"dist/bin/saas-release-artifact.js": "fae63fa5cadd726f0b0548bd7e6ed3572bae051b0a2fafd93aac73d09da5a671",
|
||||
"dist/bin/saas-release-finalize.js": "c0a49a01bd93817d383fd9175d8dc3ff1a8ea099ac9fc655943bd657bbd8e446",
|
||||
"dist/bin/saas-release-http.js": "11fe166ec5a3efc930c987afb1dabbdb2ce3ac796baec7ee88d3d922f8f18d24",
|
||||
"dist/bin/saas-release-resume.js": "599011aa4911ef625cacea1cf50db61835873f014d507032ba7fe444368977e9",
|
||||
"dist/service/sqlite.js": "7afa7127967f13211b6314f8a1baa03e8ca9eb3e5fb1b0958efbe70d3595a29b",
|
||||
"dist/cache/store.js": "3281e7851cd86dce35ab4db9b1915e00e11ff72cea7d1113b27721f0a547f04c",
|
||||
"dist/decorator/tag.js": "9db13ad2fefc16675b87545fd994297c0250975e3d4ab057111e95554068089b",
|
||||
"dist/decorator/transaction.js": "39bef98a66b7a2c28af8c820671a0962ae9d12442a5bac67f0613e13a8ee91d1",
|
||||
"dist/entity/typeorm.js": "e1829a29ff62787a3fa7c206f6695098e260dd94363619dcf9800c3ab61a6f75",
|
||||
"dist/exception/validate.js": "be57f7f715f714dde594013860fc14a18db5115ad8be754ecfb8532d4d8440d6",
|
||||
"package.json": "0b8037effa5789740ef58ce8c648254c2f8d8a3be2ba475851f2634b8b26c01a",
|
||||
"dist/controller/base.d.ts": "011b63eec356a69520b6a733f0dc5b2280f302c91f9c3c04fdc77b541340ab04",
|
||||
"dist/entity/base.d.ts": "50960ab93ad375f7e8296b3f8263d7def0c7af3ae4b7d35cc55612fb38fec9c8",
|
||||
"dist/exception/base.d.ts": "3e24d6c029e0f29a863b24b7d0f0509c7b0a3fbc74ee1aba4eb486ecd127e6ed",
|
||||
"dist/service/base.d.ts": "352fca2284346c216a6883dde2fb7b728e822f66b8eb43285468525c0832a8a8",
|
||||
"dist/decorator/cache.d.ts": "0f1df2f901d7c1015bde4d294a6a5a2dbbfe0e6d613478fc50e07144b26da0cc",
|
||||
"dist/bin/check.d.ts": "ad0ad50e02705414d917e4d7a6ee5140eebe8155312252299d944e246605ce05",
|
||||
"dist/exception/comm.d.ts": "0bf544d6a3c0712c94858eb14e82baa5e2f9890d65963a4082ea726b58413fcd",
|
||||
"dist/module/config.d.ts": "10c5151ac83da5bf21c0319dcb9cee9091a1624633688e2310f10fcda0ccb1eb",
|
||||
"dist/config/config.default.d.ts": "2ad1c815b50f99f6adde59633395afddef5a323205c6387e76bd34bff8ca9c10",
|
||||
"dist/configuration.d.ts": "687f08e182e41372c41d257bf357ca03de2d44a623d7320d81dda1f37dc12505",
|
||||
"dist/decorator/controller.d.ts": "0de521ff44f02336bf877f3952c56b3bf2ff4b0f0f7ae4787080d05f49ccaf34",
|
||||
"dist/exception/core.d.ts": "50948b0bc83b5ba3bebab64c554a5cd931cf2c0deeaa5b4d320b2634f6e374ed",
|
||||
"dist/tag/data.d.ts": "fa1a7b8bba229cc7c00b9e2cb8a69c917ab98d147adf743b544a77143bac87b5",
|
||||
"dist/bin/entity.d.ts": "762d7c22631edf51f93fb3f587102fbd7c6c88b1f73fa2511cbf262a6ece1cb4",
|
||||
"dist/rest/eps.d.ts": "3d9d3fe9e6a37d71a1670f12184d469726f737dbd82ed002d01cbfee89f3759d",
|
||||
"dist/decorator/event.d.ts": "f3c872d94fd6678719a2849f53b7747d6ac956d4e2a9a8df8fc488991c07bed3",
|
||||
"dist/exception/filter.d.ts": "6d78a77bd64fcb039991a885215e7d02fcd5dad1b18ef5ff593d6985cdb39d18",
|
||||
"dist/util/func.d.ts": "9fe99dc5dcda2b3b77215eeeb3fb845de408d9aea86340a4c857f55d7fd45c3f",
|
||||
"dist/constant/global.d.ts": "22868dfe8944c356ea28b5d7cc08926b751df5d46abcb4a90410e01c3d5bd543",
|
||||
"dist/module/import.d.ts": "e6802cbf02453ac71573bcff5ae8bf053423411b12330b57ae5f684fea9bb2d7",
|
||||
"dist/bin/index.d.ts": "43e818adf60173644896298637f47b01d5819b17eda46eaa32d0c7d64724d012",
|
||||
"dist/decorator/index.d.ts": "f53a6c43fd0d0f5d3b5d78d889ec62b3fc1909bf247c2eb99b3831c137092ac6",
|
||||
"dist/event/index.d.ts": "5e14df52a58984680890b13d471044cf71b2ce50a0a8e157088297696e09692e",
|
||||
"dist/index.d.ts": "a260cd478d8f6ef04880a0a9cdb412599596a928ef7ac5f36920a5b2adce3927",
|
||||
"index.d.ts": "b764a7488d90d3db5bc04ed44bbe06994574d25c052a139c15e9b11ffe1be954",
|
||||
"dist/interface.d.ts": "71596c601080e12af569f82134e8c4a9dec24710ec9a9a33f32d7c6b79aeb80e",
|
||||
"dist/util/location.d.ts": "bfbacbcd75579c1b6bd54cdafc6f7a152468802321a8fe0f7de3756073fd2334",
|
||||
"dist/module/menu.d.ts": "9758ddea9ca191cacc1784510472d2e3bf25cefd50aec6399482c69dd55c6cf9",
|
||||
"dist/entity/mongo.d.ts": "6379516a8b1da880a11e0734ecb7b2e66728977c320386c9f73e1a926d6edee3",
|
||||
"dist/service/mysql.d.ts": "5f3d0d44c41f477a55c92c4c8bc6e3e7cb897981b70bb9c904bc1d99d3827a96",
|
||||
"dist/bin/obfuscate.d.ts": "685b95a0e000d3a796d60d31cb1766d52d00f98a25e9455158b5ff58d962cd4f",
|
||||
"dist/service/postgres.d.ts": "7bf898ca2c277ad03521b719c87d56fd162e2e1f9e424042a268c245750a640e",
|
||||
"dist/service/query-safety.d.ts": "6ae69ec171f34f276da7eb77cd75eb2684ba8f623da5576103fd73b001bef5fe",
|
||||
"dist/bin/saas-dev-watch-child.d.ts": "8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881",
|
||||
"dist/bin/saas-dev-watch-files.d.ts": "a7c8d6359d11564548809a9e1a5122e003a5f578d5c9f79a7b0f5a4852b51cc3",
|
||||
"dist/bin/saas-dev-watch-process.d.ts": "efc1661083614da00f3f8907f618c185161f0418ad0ddc69a9b5acab1fa7eee1",
|
||||
"dist/bin/saas-dev-watch.d.ts": "4308f0195f99515d4bc92fa8d3e7a6b007caf59f6d1ae3f3eb6ec7bfacb64755",
|
||||
"dist/bin/saas-model.d.ts": "bfa30029644bc94fc5c3926939f935d770029b322e8bf18d9282459ecedd8329",
|
||||
"dist/bin/saas-release-artifact.d.ts": "4bd3770b85215304ba752b543ace28524aa05ad44cfe21b43c6bfd264ad85eb1",
|
||||
"dist/bin/saas-release-finalize.d.ts": "315fb866b0a1a7832b02bb2a64c3162fecde0d1741d977a538171c6562e3c6c7",
|
||||
"dist/bin/saas-release-http.d.ts": "e6983f5ab45670fb1c17df30ffb9e1771751ab979b6eb9dd9053000178119196",
|
||||
"dist/bin/saas-release-resume.d.ts": "9c42f26f074cf919e57c7f06d89a9c4838a85f3fe0b59e1fcf44ad6842e3d274",
|
||||
"dist/service/sqlite.d.ts": "7490be15aa4189a9c54a47169e7f3f0b745c0a0a4ddb3aae3ebbabb35353a0a1",
|
||||
"dist/cache/store.d.ts": "a0adf1432d64d871ed02adcf0a9665b30143fba768326ff4e791ea51e9db8880",
|
||||
"dist/decorator/tag.d.ts": "40fb36914821cf54a8d95ec54589af2d332b2a3c1dcf1f3e72b5c62b437220df",
|
||||
"dist/decorator/transaction.d.ts": "7675127009885859307b9389bcf2bd28775005495a3eff4e86ddb9410fb999a1",
|
||||
"dist/entity/typeorm.d.ts": "78ca457d1f1a9e47efdfcb1b140d27019677c776b8ded7e8fc43127c9a844127",
|
||||
"dist/exception/validate.d.ts": "d34062b220d8cdfd38aabc595c935c7bcc35182c1ad7ff549b49a282a52473c5"
|
||||
},
|
||||
"fileCount": 99,
|
||||
"credentialScanPassed": true,
|
||||
"registry": "https://npm.blendercg.art/",
|
||||
"tarball": "https://npm.blendercg.art/@cool-midway/core/-/core-8.1.1.tgz"
|
||||
},
|
||||
{
|
||||
"name": "@cool-midway/module-runtime",
|
||||
"version": "9.1.0",
|
||||
"sha256": "88caa11bb651e146b877809c5dbbe43a8161844b8f8f1f04f38437dcddc4ef0b",
|
||||
"integrity": "sha512-8pWWQpzaR28gOLuZ8aQV+RVFmuFqtIfz8VHgu4uMMDnp4Jo3qPtKonQB6AV8BUNex2CBCkyFhmrZ8D+3YVNNeA==",
|
||||
"files": {
|
||||
"dist/action.js": "86b35ec3d9d020f253cfa42f8030444da39a9742f6480c94010cc342056e0e4a",
|
||||
"dist/adapter.js": "d43aa81f5bc89faa359e0f97c814ba25155591ff078fbb9bfd40f8c7c9683230",
|
||||
"dist/business-reject.js": "1bea195b38fbcce97512400be8fe43f01596a03aa5ea5d6546346064c2cd1b03",
|
||||
"dist/configuration.js": "fed0a7dc7e6aa6e233f8d66109589b15ccd6b0f3fdd46dc6d55bbd8c38b45311",
|
||||
"dist/connection.js": "dc44aef513160623b1282b174e5bd17bc5ddeefcdaac1d328b23e061d7516f67",
|
||||
"dist/consumer.js": "18189e798ccaab3a0809f2d49430ec48361f0f705645b91dd0d889210cbf38e3",
|
||||
"dist/context.js": "eb2b3c97119f94c7f52498b591b7e63fe51b1ef8194b3b9cf6dbea6d0af555e7",
|
||||
"dist/crud-host.js": "19ab92b9744f8cb671c4dcbfce288160c60e008f14a0b018f38a1c0de55aa4b8",
|
||||
"dist/crud.js": "235a6ce66b54373c80bbba8ea444162ef44e8fa34863cb30be59b62b8a008043",
|
||||
"dist/data.js": "e54a8d582fadefd9dc75eec049d3eee1c80fb92ed656d46d384fc48d8ae4d7d0",
|
||||
"dist/error.js": "f2dced066aef06c895d00285ecf69d52203bfce1635539a4b8c88d9de2a733d3",
|
||||
"dist/event-writer-migration.js": "deee4d33d7c3049f2ab9f6a9605cfea17aaf9536db7d3d1305f4903d48ff5e4f",
|
||||
"dist/event-writer.js": "0c4a2f270ba868b772d83d002255cf60bf3c3f69425881121c3639184e5e17ac",
|
||||
"dist/decorator/event.js": "3801cf45836398239734611d4c58ea0261d32e870544a770e7ad667704aad143",
|
||||
"dist/executor.js": "e65ec1d28ee63bfc75b56a58485640a5c2f2e4af6f60122974bd73d047ceda0b",
|
||||
"dist/generated-module.js": "84739644067c446863ad34166602d0dcec9212661c61cbeea5bfe85a113b4c0a",
|
||||
"dist/index.js": "c0de3d4fae6a2f28f5ee89519c1daf7c36dc7bcc13aeccc0372999fec4b703c9",
|
||||
"dist/injected-action.js": "3fdee7be7fee4e07c41884cbc43cb23bbd1dd4ef0ffe49fee37c53f2a8d8ca97",
|
||||
"dist/injected-crud.js": "5f4593c1b12a50765f4112381a0db9f732202b908f84b6f13225da7a567eba0c",
|
||||
"dist/internal.js": "2d5ee68295abbaaf9a74aa7fb805cb1be70702354e1c058a2eb02fa11d1561e1",
|
||||
"dist/inventory.js": "c97c12ecb113302e4d21deef52a6d6b6b477ae2e192853d664211e19f539cd74",
|
||||
"dist/json-schema.js": "ef1a378710cfc285679fdb8130750169bc09e19611a2e577ef081b44e5f2eeb0",
|
||||
"dist/managed-action.js": "fb42b5f0b1992e2b2b3f5176081a2de06cac020ca3ed744f46d93f094cfe96dd",
|
||||
"dist/model.js": "9e548ad45b0cac4642ae9437cbcd52a6deb5dd316de5242ce601c2765f68554a",
|
||||
"dist/outbox.js": "f53bd5ddae974ef735488f7065bae6744074107318a8868605284875ee3037ed",
|
||||
"dist/projection-consumer.js": "31749ce9649d486ba374643fe896b4ed4ff586725ee886cfe41103fc36c71cb2",
|
||||
"dist/projection-fanout.js": "6c00a2b6bd6a243b76e9286a8241067f648cfb66ad412f70c2230a70eace2a0a",
|
||||
"dist/projection-observability.js": "1329606a57df9efb5916df8e700680007c3aa4533dcd28b659ca37d6167056ea",
|
||||
"dist/read-model.js": "bc4b50718df2120b2620d969be91cc6bf85dfeab77c70085b5d047ce60ec78ba",
|
||||
"dist/readonly-sql.js": "2ad61f3b5159ef5d62a8cc3f1d35210058d78629ff4d1dd2ba7ca109781c7b32",
|
||||
"dist/result-normalizer.js": "2c8da8f3926a3631e92479fbb8ef25865eba56df2934ec5066917333a21aab60",
|
||||
"dist/runtime-id.js": "90d0991517b910067d85a47f49fa4148a40282236d03d52a80d02fe1de512dfb",
|
||||
"dist/safe-error.js": "8404ea72f5d44bf3016cd6a0e3ac9a010869ac1b9c1d166ae953f0d7c0e67c6d",
|
||||
"dist/saga-contract.js": "22fd8729982dfa9e7824e0fc6c27a0839989c8f2ca70853d1a985b4df2bc4324",
|
||||
"dist/saga.js": "5d86cf0e8e762fdc5a41c30a7220400ab4c1d30ae8e50ca3c468eabf918abc6e",
|
||||
"dist/schema.js": "85a08a3fcf152697af3806dfebc3a3127a11c9b3a6fff543645e235e147467ae",
|
||||
"dist/tenant-deployment-execution.js": "e31d9e0fffb3a915e048af4f5d13f4143736c4598a9d5e1a07dfdac36a669faf",
|
||||
"dist/tenant-deployment.js": "39b09bc8baa6f9ddea00566c2005d37759464a88c5478272c90d05ce8ffd2237",
|
||||
"dist/types.js": "d43aa81f5bc89faa359e0f97c814ba25155591ff078fbb9bfd40f8c7c9683230",
|
||||
"dist/workflow-reply-authority.js": "90ad7bbd35bcc4a0a788d33721cdbc3ec54f5c28ebce288317a40152de50bb10",
|
||||
"dist/workflow.js": "79e25c6e0dc24c6b2277c18b02bedf4fda60754947ae1917b0b9cb2eecb53af3",
|
||||
"dist/write-fence.js": "95c6af20da75ca92a0149023ebbc515525ddbcd50da3e284209b77536bc2a5f2",
|
||||
"package.json": "f3638ab357be8eee6b01228a7e8f24dee63fe47f31382f45000abcec18df7fd2",
|
||||
"dist/action.d.ts": "8d0c6d6055c1acc4a6a6e70fdb83a70a81693965b20adf2afa0290245cd649cd",
|
||||
"adapter.d.ts": "ffa850716087cae3e3ef5f5bb54835143d16bcb3ad42b044c0f16aba08209074",
|
||||
"dist/adapter.d.ts": "f70f53cb90da78d4423f46debfea6d922068ea4f70fb063b53135d6538af1eb2",
|
||||
"dist/business-reject.d.ts": "dfa50bf278f47097aebfb6958ff80df127f0af978031653ad20d485e119b1f93",
|
||||
"dist/configuration.d.ts": "5603f82c62078b962be9f9a32690a66572cc41bd9e6cda38d0fe7f53ad63e14a",
|
||||
"dist/connection.d.ts": "418b87c47ef482112b60515d8e16d44789350529ad215a69a24baa0127a0695c",
|
||||
"dist/consumer.d.ts": "3eb6943931d02f655a5a6194ef919017af4b7aaad4c56fd689c4ae4f220fc44b",
|
||||
"dist/context.d.ts": "90d189268561122a6619fb1ab406e19610bd07631e0ab4be8a7e302cfbe2dc74",
|
||||
"dist/crud-host.d.ts": "9db03a23d96f3e982814ccc432209ffb36923bdc0e44b971121eb6c71a720364",
|
||||
"dist/crud.d.ts": "ac9c86a22ac52a19314707eac25e4a148b25fcfc9e6b0b68c9be05685cc0524e",
|
||||
"dist/data.d.ts": "7a0a42b4f3bb4c437168ec7a0ed8cb85380dfb17598629abd95c373be91db352",
|
||||
"dist/error.d.ts": "6d60304de29698609218d9fdd421a9f17b31399d412ae19b3287fe6b1669a89a",
|
||||
"dist/event-writer-migration.d.ts": "dd22ca345f7b15a5297b4c0d2265d1fe81fbb4507455c6aacfd037d85e7acf93",
|
||||
"dist/event-writer.d.ts": "a3808988437bc0633a718d6600dfb3a2a930f25be7daeb69d61c2f55aa2b7171",
|
||||
"dist/decorator/event.d.ts": "23cb20746ac54b5846774e03496c4f335c265773c044795ea07d727e7fe4859b",
|
||||
"dist/executor.d.ts": "7756e63e7ab4b2bdbafdf6d4ecbbf8a53e019a9883fef4c2045b9653264dc09d",
|
||||
"dist/generated-module.d.ts": "91a115bf54da00ca545f675a6f5cd1b5230c15028f9ac44afeafc034d7e5edd9",
|
||||
"dist/index.d.ts": "97ebc39d085af1c4ecccaf80c6581f9b44a725be3e2d3b0aacf809738379edd4",
|
||||
"index.d.ts": "4b4662b528dcdf65aea4f64db2ec4cc5f1ab9ca27ace965f7f3824cedcd12ec6",
|
||||
"dist/injected-action.d.ts": "1fa4714aeceeba0ec6c5bfc1b7afcfe1c92bb5000e77db6a82122395535a2532",
|
||||
"dist/injected-crud.d.ts": "b4a9f3c9756f6b13534ec2a643a905a5e9374ab3f5a6aeeb33b7a6cb9b481ef5",
|
||||
"dist/internal.d.ts": "a27c0213bb73fbd20543c42946a90d5ebd5c4ba298383bea21da894a9cbac265",
|
||||
"internal.d.ts": "647bd0edcc65c231dc7d03cf81bbd77b9dd063f1d9747abaee3ef10f449871e2",
|
||||
"dist/inventory.d.ts": "a947c0471139debd82c71092952027b5e645dcf6b04de6a5706630fd7ac388d2",
|
||||
"dist/json-schema.d.ts": "13da8d4cdc571ca7b38c5ae7af9a5877ead2dc2d66cbca9f4a5a20069b8bfdea",
|
||||
"dist/managed-action.d.ts": "41f457e76b0cefba70b909dd36d33515a81e95414f67e63af8e975e7349ba136",
|
||||
"dist/model.d.ts": "c51700d1bf5d5c76d281979f05592b8004bd036a5d6b0f74bb583a1e219e5ddc",
|
||||
"dist/outbox.d.ts": "db0ec4dbf5bb3e8bc01cf3cfb488713fac72bb35ae7d1b5684bbb64e786a0560",
|
||||
"dist/projection-consumer.d.ts": "4e7c0f6cdbce1abb3a73c57aec0af7898f1f70d1e6007c384da6efb083695e2a",
|
||||
"dist/projection-fanout.d.ts": "e222a92545786e5e8708b9f858a9cb7f840b83c88e04b4d86c63d804801f1683",
|
||||
"dist/projection-observability.d.ts": "185d60d16b64d7b0c59838ee9aaa3de558411d71d09c697f7cfc31816d83560a",
|
||||
"dist/read-model.d.ts": "8da05387b66b3bf90300ab06600e25327571fd9effe668fd67abe0053b8f65dd",
|
||||
"dist/readonly-sql.d.ts": "874ebfe1ac214f969f46fc1e1a25a2c301f610f3258570261e1e977196982de8",
|
||||
"dist/result-normalizer.d.ts": "a7dceb5b8acba49efb5e4b08821a43f81acea79bcc87ce0386c48e8c7e09b328",
|
||||
"dist/runtime-id.d.ts": "a36a22125f8abb297965707aa59f37506fb725acedfd9fe3e4f94876386acd67",
|
||||
"dist/safe-error.d.ts": "80209c9b0107ee6a2fd9db589de8a347f2e7efe31a74e043ed9d3529632947a7",
|
||||
"dist/saga-contract.d.ts": "1598b7adf45652f32557de74c912049f7cdf97326420c0fef3b762d256bcca88",
|
||||
"dist/saga.d.ts": "da12bdaef5c5d082ddae56c7e355831ae948bb77c9fb9a9ffa5d671201110231",
|
||||
"dist/schema.d.ts": "63f1460c8975047963048c5bae295a80f2e63f5e7e9110ff9ac6bd40f881303d",
|
||||
"dist/tenant-deployment-execution.d.ts": "24fc97eea039f0a0dc910ff8a66640d33e69863608c9b7d24ee6310f72c72b3e",
|
||||
"dist/tenant-deployment.d.ts": "e5f9a36d380989714a88058f9d29ce43e8c7d638a23c80618f6cf9eeba2403ac",
|
||||
"dist/types.d.ts": "60f6dc5014a611c5ba12aaa8a616c153291ac1ef172786775673f7269a6b6939",
|
||||
"dist/workflow-reply-authority.d.ts": "45c5b1071f779397e4a870f9663eab2c0b1fea22df6901b314201ca0549efd51",
|
||||
"dist/workflow.d.ts": "305566d5e30723285b2f4cc227577a8c003a7dd9f1628796fa8fe825c45874fa",
|
||||
"dist/write-fence.d.ts": "1623b1129c45481d165b604f7ca8090bfdc4eef278aab1a3dc1740cbf42bae15"
|
||||
},
|
||||
"fileCount": 90,
|
||||
"credentialScanPassed": true,
|
||||
"registry": "https://npm.blendercg.art/",
|
||||
"tarball": "https://npm.blendercg.art/@cool-midway/module-runtime/-/module-runtime-9.1.0.tgz"
|
||||
},
|
||||
{
|
||||
"name": "@cool-midway/rpc",
|
||||
"version": "9.1.0",
|
||||
"sha256": "7b5b5ce502888a500659cbf6030376dd5d93e57aab2567d53063d1725592653a",
|
||||
"integrity": "sha512-G9auVH/bvCHrxVXVeDV17ejiUTEBvrnA54B/W6NtDFF0HaT0nk3lz8thrzFESACeHzwWppA0FAC51upwVCyxzA==",
|
||||
"files": {
|
||||
"dist/action-registry.js": "04f77c61445d47f66eaad984ee8e059a38bb0e610d2f584f5754d5a0ead105c5",
|
||||
"dist/saas-host/bootstrap.js": "a53eb6f40c7a7c2427fbcd0cde78e8985f64dda15fcff1843e8957f5e7086271",
|
||||
"dist/caller-context.js": "688a823ed382ded556ef7c8d6b151d7e9f65fef56781f7d2ba9443b83877b680",
|
||||
"dist/circuit-breaker.js": "a128b6103704a74463f2765ee9fd97d10baec694abcd550f004570b29c1e65e0",
|
||||
"dist/codec.js": "1ba6e712f9c7c643267928ffdf6a3997d7d4ed52d51b8082f34938b75b48d127",
|
||||
"dist/config/config.default.js": "8afe036a5ac3e4c1a382dddc1bec0a5599129977c2c28fc4d9f3777791f5444b",
|
||||
"dist/saas-host/config.js": "ae96df84c49d25ba2dc2651b2ae24106a9bc173fa1788e8362940c5a63462023",
|
||||
"dist/configuration.js": "8e0ad7f8b784a39e6859fe18fb5fda56d44fa82d45ab15c9095ab2072d8187a3",
|
||||
"dist/saas-host/configuration.js": "555560131fe84336cc967de372afc2af842cfce7de43f0e8b1e0384a90259872",
|
||||
"dist/saas-host/control-plane.js": "d85048f065219754517d7e523df8b12553b8793ed5112744d086019876845ce3",
|
||||
"dist/saas-host/credential-store.js": "126587a35efbe86516eed33c26f98f394ad388061397511eefb30879acedbb6f",
|
||||
"dist/error.js": "8ab6a31e98e83ffbb105b9e33ea8801d9120c3192f5d94f6e782bcc4fc1c87a9",
|
||||
"dist/event-transport.js": "c056c6c1ab9e5aa9b24b659f03045f64c852ec9e5ac2603d92dcb1baedbc88c2",
|
||||
"dist/identity.js": "063718c26403ad5d8c6f8737f7351332f6ce5ddde9ee7ebf128e2085d8d70b25",
|
||||
"dist/index.js": "26d61f60277e769fa7f9379fc2a98af9840296ea7c4d0e65c8c354bf70d37bdd",
|
||||
"dist/saas-host/index.js": "ca038796a56260424afbea02215180fa319208403ddd2e5027901eb927277823",
|
||||
"dist/injected-action.js": "92fdaaa784e64b0babbcba16a941d3569367a47ccdc2137d7afc415e542f7bc9",
|
||||
"dist/managed-runtime.js": "1985cb709666c9f6bba561b1756cbc2420fd068e138f82180712a3c577760373",
|
||||
"dist/mode.js": "b986fe6d3623d6baad7ecd44496c1fa681203c934013af8baaa330ba371fc75d",
|
||||
"dist/saas-host/providers.js": "383fa29072c77f41e556e1c847b99c1f0e685e93dccf4ee41449802d6dde3219",
|
||||
"dist/redis.js": "871b8b7f906a83ce032b8a23d93471fed49c0e2a5baa5be3fab392a8e80eef9c",
|
||||
"dist/decorator/rpc.js": "14552fea525d683fc459fab2d9b846af70ec77aa4032e275dcf3b0d09288cedc",
|
||||
"dist/rpc.js": "b7606c7051b4b036c7218ad872b6297583e393fb51dc83fb606503350af78b2b",
|
||||
"dist/runtime-log.js": "672e35f1bb2c648ae58d2c55f724997a1e2a45bd2e62a8cd8180283f31d8b093",
|
||||
"dist/saas-host/runtime.js": "c21adbf03a7c6e2b05885011ccb33e0fe259b295fbeeec0b681b2504d209b685",
|
||||
"saas-host.js": "7c191f478052db1c7e876cf33aad154f879a33fa194f1cd1d216d949598dd09b",
|
||||
"dist/saas-host/security.js": "f25567da27233ebc3ad88ba3a0769163afeaf38b8f1eb92733446e3b5b9ab626",
|
||||
"dist/signer.js": "c8e64492947deec7bf277b3f7b56a5024928a0956bcc57ea62a3c1a10a47792c",
|
||||
"dist/test.js": "5386504311845b9dc3fe230d3c5a3b5ab3c6d36154add15e91d32d8442c25157",
|
||||
"dist/types.js": "d43aa81f5bc89faa359e0f97c814ba25155591ff078fbb9bfd40f8c7c9683230",
|
||||
"dist/workflow-recovery.js": "d423e33df1cca07250036ec6b61aaa7fcddea1e1440450487da13f01b16b26f0",
|
||||
"package.json": "6d210735ca72b9bc64983370af7f8d1245849500fd717c19858b4fa0496331ef",
|
||||
"dist/action-registry.d.ts": "40231dd8299c0bfae1b006105d49945eb2f20a40334856db32e4b7cc2851398b",
|
||||
"dist/saas-host/bootstrap.d.ts": "f639edef99770f091ac90e737a0ab2c857830241a8996171492768d108ad43f0",
|
||||
"dist/caller-context.d.ts": "3f58cb5d653e2d5179996c3302dddc5c4bfdc3ff2ac501ca8d6dcedb4cb606d5",
|
||||
"dist/circuit-breaker.d.ts": "04a630ec3eff5b0c38aebc5aa0f217234687991cdd15bb34a1ff901040aac3af",
|
||||
"dist/codec.d.ts": "69a5f0f77945ca937a6e0dc7c99e7a5b0e13c6c672ff528e36d125293aa390ed",
|
||||
"dist/saas-host/config.d.ts": "f4ed4b0c1c36f74ef24d16047139999912394a6a9a2164ca2cbcec6c762a82d2",
|
||||
"dist/config/config.default.d.ts": "42220f9e583d1e7294df9d24a6849b55f95ad04294209833a6d86e0a7fe7c211",
|
||||
"dist/configuration.d.ts": "0a0c26f470cacf671444db225efb4433d8fb097d6e97f6f22bb4bbc9aebbb89d",
|
||||
"dist/saas-host/configuration.d.ts": "2b18a8a64cceb9a9c5b0e5d5485e1f125a504bda01c9884a5920d17ab3d6c88c",
|
||||
"dist/saas-host/control-plane.d.ts": "913fd7adc8886fdb9abce6e7d44e6a13ea75bf84b613efbdb512e47c788b746a",
|
||||
"dist/saas-host/credential-store.d.ts": "f4a9120e4aefcabb78903697fa30a5e7fcef9c8eeb347a0d8fae60c7f94c1f9d",
|
||||
"dist/error.d.ts": "f89c87f491f25efd6fe247423b50dfc14908bb478cc5daf32a0e37e0cab3135b",
|
||||
"dist/event-transport.d.ts": "db3aad6cb1ed297c3cbc785101a26577beabae23e8255e18e993a9c0d42849e8",
|
||||
"dist/identity.d.ts": "5e7a2f9cbe80816cad22f678663f814f89e2295ecfb0b6d7436a8a1efb166f7c",
|
||||
"dist/index.d.ts": "d4ac7f2d87a93a50263ccbb3da781dcf4d3db9775ae5ba316327862f0c007d69",
|
||||
"dist/saas-host/index.d.ts": "2e5e01089a7a42c312456f44054a33a426ef18572affd687e79a90acb58956c9",
|
||||
"index.d.ts": "b764a7488d90d3db5bc04ed44bbe06994574d25c052a139c15e9b11ffe1be954",
|
||||
"dist/injected-action.d.ts": "10954865dd4ddd1f1bfd867e151d4fda993547fc206346d5ccf39a241d40527e",
|
||||
"dist/managed-runtime.d.ts": "f9c4f933c09ee7488d05cad68cd411de8239998a48738f2a90988aff6f691379",
|
||||
"dist/mode.d.ts": "cf6a400f1498ce1102c70f47719d6c58dfe3555a8aacce03eb09c7ea38c8d2b7",
|
||||
"dist/saas-host/providers.d.ts": "afa7ac804915450d7fba5ac210ea86191d1f3ee1c5fa82305aabe6028716087c",
|
||||
"dist/redis.d.ts": "794e9c53f6c36494562d1685483d826794af29218244d2692e2ce9e1a20163eb",
|
||||
"dist/decorator/rpc.d.ts": "eee9097a4845b107033ca9234ef8e6f089e03f130243250641bf0f8746b26725",
|
||||
"dist/rpc.d.ts": "fe9bd78835b1ecc2d47a819712e5bc43d6528e26aa44ff6e2b1d2dba910f05b9",
|
||||
"dist/runtime-log.d.ts": "2ae04a0fad229a7b2c207667f77492881898bdd5ed4199f0402bf5df2a4072d4",
|
||||
"dist/saas-host/runtime.d.ts": "20f2ce0293b4fa315af93e334901f2f6acffa9867f8e60ae62a78a984dda129b",
|
||||
"saas-host.d.ts": "cdc6609dcbb75e109b15e8644a4db268f303d23005a6338078ec215eef15a530",
|
||||
"dist/saas-host/security.d.ts": "e03aa4553fe661b2c89f5c062c68050d6350f14bc7879485540b497dc880adf7",
|
||||
"dist/signer.d.ts": "b0859783023e91f0326a702c91780cb436f5e726a8cc04860b3a408b81130cae",
|
||||
"dist/test.d.ts": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
||||
"dist/types.d.ts": "2d704471fd8d08abceb0e4db0901f56398d206717e6cc199d0260aea783d669c",
|
||||
"dist/workflow-recovery.d.ts": "dbcd593dee5a100614b68eb33fb89b1efd9bf5cb5f01879dc4990eb2fdd1a2cb"
|
||||
},
|
||||
"fileCount": 66,
|
||||
"credentialScanPassed": true,
|
||||
"registry": "https://npm.blendercg.art/",
|
||||
"tarball": "https://npm.blendercg.art/@cool-midway/rpc/-/rpc-9.1.0.tgz"
|
||||
}
|
||||
]
|
||||
}
|
||||
90
scripts/verify-local-packages.cjs
Normal file
90
scripts/verify-local-packages.cjs
Normal file
@@ -0,0 +1,90 @@
|
||||
// Published baselines take precedence. Invalid published data never falls
|
||||
// back to vendor candidates. This verifier performs no network/lifecycle work.
|
||||
const fs = require('node:fs');
|
||||
const path = require('node:path');
|
||||
const { createHash } = require('node:crypto');
|
||||
const hash = data => createHash('sha256').update(data).digest('hex');
|
||||
const packageName = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
|
||||
const exactVersion = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
|
||||
const sha256 = /^[a-f0-9]{64}$/;
|
||||
const checkedFile = relative => /(?:\.(?:c|m)?js|\.d\.ts)$/.test(relative) || path.posix.basename(relative) === 'package.json';
|
||||
function fail(message) { throw new Error(message); }
|
||||
function recordPath(relative) {
|
||||
if (typeof relative !== 'string' || !relative || relative.includes('\\') || relative.startsWith('/') || relative.includes(':') || /[\x00-\x1f]/.test(relative) ||
|
||||
relative.split('/').some(part => !part || part === '.' || part === '..') || !checkedFile(relative)) fail('Unsafe or unsupported baseline file path');
|
||||
return relative;
|
||||
}
|
||||
function containedFile(root, relative) {
|
||||
const actual = fs.realpathSync(path.join(root, recordPath(relative)));
|
||||
if (!actual.startsWith(root + path.sep) || !fs.statSync(actual).isFile()) fail('Installed file escapes package root');
|
||||
return actual;
|
||||
}
|
||||
function installedFiles(directory, prefix = '') {
|
||||
return fs.readdirSync(directory, { withFileTypes: true }).flatMap(entry => {
|
||||
if (entry.name === 'node_modules') return [];
|
||||
const relative = prefix + entry.name;
|
||||
// pnpm may link the package root; links within the artifact are forbidden.
|
||||
if (entry.isSymbolicLink()) fail('Unexpected link inside installed package');
|
||||
return entry.isDirectory() ? installedFiles(path.join(directory, entry.name), relative + '/') : checkedFile(relative) ? [relative] : [];
|
||||
});
|
||||
}
|
||||
function metadataUrl(value) {
|
||||
if (typeof value !== 'string') fail('Published registry metadata missing');
|
||||
let url;
|
||||
try { url = new URL(value); } catch { fail('Published registry metadata invalid'); }
|
||||
if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) fail('Published registry metadata must be a credential-free HTTP URL');
|
||||
}
|
||||
function validateRecord(record, published) {
|
||||
if (!record || typeof record !== 'object' || !packageName.test(record.name || '') || !exactVersion.test(record.version || '') ||
|
||||
!record.files || typeof record.files !== 'object' || Array.isArray(record.files) || !Object.keys(record.files).length) fail('Invalid package baseline');
|
||||
for (const [relative, checksum] of Object.entries(record.files)) {
|
||||
recordPath(relative);
|
||||
if (!sha256.test(checksum)) fail('Invalid baseline file digest');
|
||||
}
|
||||
if (published) {
|
||||
metadataUrl(record.registry); metadataUrl(record.tarball);
|
||||
const integrity=typeof record.integrity === 'string' && /^sha(256|384|512)-([A-Za-z0-9+/]+={0,2})$/.exec(record.integrity);
|
||||
if (!integrity || Buffer.from(integrity[2], 'base64').length !== Number(integrity[1])/8 || Buffer.from(integrity[2], 'base64').toString('base64') !== integrity[2]) fail('Published integrity missing or invalid');
|
||||
if (!Object.hasOwn(record.files, 'package.json')) fail('Published baseline must include package.json');
|
||||
} else if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*\.tgz$/.test(record.archive || '') || !sha256.test(record.sha256 || '')) fail('Invalid vendor archive baseline');
|
||||
}
|
||||
function verifyPackages(projectRoot = path.resolve(__dirname, '..')) {
|
||||
const root = fs.realpathSync(projectRoot);
|
||||
const publishedPath = path.join(root, 'scripts/published-packages.json');
|
||||
let published = false;
|
||||
try { fs.lstatSync(publishedPath); published = true; } catch (error) { if (error.code !== 'ENOENT') throw error; }
|
||||
const baseline = JSON.parse(fs.readFileSync(published ? publishedPath : path.join(root, 'vendor/local-packages.json'), 'utf8'));
|
||||
if (baseline.formatVersion !== 1 || !Array.isArray(baseline.packages) || !baseline.packages.length) fail('Unsupported or empty package baseline');
|
||||
const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
|
||||
const names = new Set(); let count = 0;
|
||||
for (const record of baseline.packages) {
|
||||
validateRecord(record, published);
|
||||
if (names.has(record.name)) fail('Duplicate package baseline');
|
||||
names.add(record.name);
|
||||
const expectedSpecifier = published ? record.version : `file:vendor/${record.archive}`;
|
||||
const declarations = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
|
||||
.filter(section => Object.hasOwn(manifest[section] || {}, record.name)).map(section => manifest[section][record.name]);
|
||||
if (!declarations.length || declarations.some(value => value !== expectedSpecifier)) fail(`Unpinned dependency ${record.name}`);
|
||||
if (!published && hash(fs.readFileSync(path.join(root, 'vendor', record.archive))) !== record.sha256) fail(`Archive drift ${record.name}`);
|
||||
// Resolve pnpm virtual stores and package.json exports through Node.
|
||||
const metadataPath = require.resolve(`${record.name}/package.json`, { paths: [root] });
|
||||
const installed = fs.realpathSync(path.dirname(metadataPath));
|
||||
const metadata = JSON.parse(fs.readFileSync(metadataPath, 'utf8'));
|
||||
if (metadata.name !== record.name || metadata.version !== record.version) fail(`Installed identity drift ${record.name}`);
|
||||
const extra = installedFiles(installed).filter(relative => !Object.hasOwn(record.files, relative));
|
||||
if (extra.length) fail(`Unexpected executable or metadata files ${record.name}: ${extra.join(', ')}`);
|
||||
for (const [relative, checksum] of Object.entries(record.files)) {
|
||||
// Historical vendor packages may normalize metadata. Published mode
|
||||
// instead checks package.json against the final published artifact.
|
||||
if (!published && relative === 'package.json') continue;
|
||||
if (hash(fs.readFileSync(containedFile(installed, relative))) !== checksum) fail(`Installed byte drift ${record.name}/${relative}`);
|
||||
count++;
|
||||
}
|
||||
}
|
||||
return { mode: published ? 'published' : 'vendor', packages: baseline.packages.length, files: count };
|
||||
}
|
||||
module.exports = { verifyPackages };
|
||||
if (require.main === module) {
|
||||
const result = verifyPackages();
|
||||
console.log(`Verified ${result.packages} ${result.mode} packages and ${result.files} installed files.`);
|
||||
}
|
||||
@@ -20,9 +20,9 @@ export class Orders extends SaasTableModel<OrdersRow> {
|
||||
static readonly definition = defineSaasTableModel({
|
||||
"kind": "table",
|
||||
"moduleCode": "order",
|
||||
"revision": 2,
|
||||
"schemaVersion": 2,
|
||||
"schemaInputChecksum": "34ed49d330f45bd9933b582bc9265cf0f4e2e2683833d0f39e38a357d138ab65",
|
||||
"revision": 6,
|
||||
"schemaVersion": 6,
|
||||
"schemaInputChecksum": "18d11bb9ce859510f4a1830e1bdf00182da78acfd305262eed05c7e9358d0143",
|
||||
"tableCode": "orders",
|
||||
"fields": [
|
||||
{
|
||||
|
||||
@@ -4,9 +4,9 @@ import { defineGeneratedSaasModule } from '@cool-midway/module-runtime';
|
||||
export const GeneratedSaasModule = defineGeneratedSaasModule({
|
||||
"formatVersion": 2,
|
||||
"moduleCode": "order",
|
||||
"revision": 2,
|
||||
"schemaVersion": 2,
|
||||
"schemaInputChecksum": "34ed49d330f45bd9933b582bc9265cf0f4e2e2683833d0f39e38a357d138ab65",
|
||||
"runtimeContractChecksum": "ba026a37cab981d8bdc1ed59db977b7c10df5f0528eaed02202e1303dc3d1194",
|
||||
"revision": 6,
|
||||
"schemaVersion": 6,
|
||||
"schemaInputChecksum": "18d11bb9ce859510f4a1830e1bdf00182da78acfd305262eed05c7e9358d0143",
|
||||
"runtimeContractChecksum": "7cf4e7cf42d440d18360887fa4d7cdf59652fd6b6a236c612cf22afe14b41409",
|
||||
"implementationManifestChecksum": "f25647d2dd90e14d6226683d2ff67ba32132b2dfdeb861015805240a96d4635b"
|
||||
});
|
||||
|
||||
@@ -83,10 +83,10 @@ export const SaasActions = {
|
||||
"actionChecksum": "3978a7ba9a3e0f91842031fd323ec63b3816eef68cb8dc82ffad6d187de8b7ea",
|
||||
"outputChecksum": "fe644424ef6a9e462b56edc9f70f48bb218783c69469469d4310de48589a0df5",
|
||||
"contractVersion": 1,
|
||||
"providerReleaseId": 41,
|
||||
"providerReleaseId": 50,
|
||||
"consumerModuleCode": "order",
|
||||
"providerModuleCode": "demo",
|
||||
"providerReleaseVersion": "1.0.1"
|
||||
"providerReleaseVersion": "1.0.5-rc.6"
|
||||
}),
|
||||
GoodsReleaseStock: defineInjectedSaasAction<DemoGoodsReleaseStockInput, DemoGoodsReleaseStockOutput>({
|
||||
"kind": "action",
|
||||
@@ -148,10 +148,10 @@ export const SaasActions = {
|
||||
"outputChecksum": "a632b9f89518c3c17861454b74173a4880d5e8482639d3ff7f761aee4d061bd9",
|
||||
"contractVersion": 1,
|
||||
"commandEventType": "saas.workflow.demo.goods.releaseStock",
|
||||
"providerReleaseId": 41,
|
||||
"providerReleaseId": 50,
|
||||
"consumerModuleCode": "order",
|
||||
"providerModuleCode": "demo",
|
||||
"providerReleaseVersion": "1.0.1",
|
||||
"providerReleaseVersion": "1.0.5-rc.6",
|
||||
"commandEventContractChecksum": "18a727b91cf9410c3b7ac14e3a8799dbbfa8937f84667bfe7e31e21e662396be"
|
||||
}),
|
||||
GoodsReserveStock: defineInjectedSaasAction<DemoGoodsReserveStockInput, DemoGoodsReserveStockOutput>({
|
||||
@@ -208,10 +208,10 @@ export const SaasActions = {
|
||||
"outputChecksum": "545bd8b0bf6eb8670b21497236038187ee0f1df1544a318b16a399458fcb796e",
|
||||
"contractVersion": 1,
|
||||
"commandEventType": "saas.workflow.demo.goods.reserveStock",
|
||||
"providerReleaseId": 41,
|
||||
"providerReleaseId": 50,
|
||||
"consumerModuleCode": "order",
|
||||
"providerModuleCode": "demo",
|
||||
"providerReleaseVersion": "1.0.1",
|
||||
"providerReleaseVersion": "1.0.5-rc.6",
|
||||
"commandEventContractChecksum": "ffbecad3a3d63b8bf92fde701dfaa11c8502a2c5f9f6bbb89b755e214024c3ae"
|
||||
})
|
||||
}
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
{
|
||||
"manifestVersion": 1,
|
||||
"moduleCode": "order",
|
||||
"revision": 2,
|
||||
"revision": 6,
|
||||
"schemaChecksum": null,
|
||||
"schemaInputChecksum": "34ed49d330f45bd9933b582bc9265cf0f4e2e2683833d0f39e38a357d138ab65",
|
||||
"schemaInputChecksum": "18d11bb9ce859510f4a1830e1bdf00182da78acfd305262eed05c7e9358d0143",
|
||||
"actionManifestChecksum": null,
|
||||
"runtimeContractChecksum": "ba026a37cab981d8bdc1ed59db977b7c10df5f0528eaed02202e1303dc3d1194",
|
||||
"runtimeContractChecksum": "7cf4e7cf42d440d18360887fa4d7cdf59652fd6b6a236c612cf22afe14b41409",
|
||||
"implementationManifestChecksum": "f25647d2dd90e14d6226683d2ff67ba32132b2dfdeb861015805240a96d4635b",
|
||||
"actions": [
|
||||
"OrdersAdd",
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"formatVersion": 2,
|
||||
"moduleCode": "order",
|
||||
"revision": 2,
|
||||
"revision": 6,
|
||||
"releaseVersion": null,
|
||||
"schemaVersion": 2,
|
||||
"schemaInputChecksum": "34ed49d330f45bd9933b582bc9265cf0f4e2e2683833d0f39e38a357d138ab65",
|
||||
"schemaVersion": 6,
|
||||
"schemaInputChecksum": "18d11bb9ce859510f4a1830e1bdf00182da78acfd305262eed05c7e9358d0143",
|
||||
"schemaChecksum": null,
|
||||
"actionManifestChecksum": null,
|
||||
"runtimeContractChecksum": "ba026a37cab981d8bdc1ed59db977b7c10df5f0528eaed02202e1303dc3d1194",
|
||||
"runtimeContractChecksum": "7cf4e7cf42d440d18360887fa4d7cdf59652fd6b6a236c612cf22afe14b41409",
|
||||
"implementationManifestChecksum": "f25647d2dd90e14d6226683d2ff67ba32132b2dfdeb861015805240a96d4635b",
|
||||
"models": [
|
||||
{
|
||||
@@ -2031,10 +2031,10 @@
|
||||
"actionChecksum": "3978a7ba9a3e0f91842031fd323ec63b3816eef68cb8dc82ffad6d187de8b7ea",
|
||||
"outputChecksum": "fe644424ef6a9e462b56edc9f70f48bb218783c69469469d4310de48589a0df5",
|
||||
"contractVersion": 1,
|
||||
"providerReleaseId": 41,
|
||||
"providerReleaseId": 50,
|
||||
"consumerModuleCode": "order",
|
||||
"providerModuleCode": "demo",
|
||||
"providerReleaseVersion": "1.0.1"
|
||||
"providerReleaseVersion": "1.0.5-rc.6"
|
||||
}
|
||||
},
|
||||
{
|
||||
@@ -2101,10 +2101,10 @@
|
||||
"outputChecksum": "a632b9f89518c3c17861454b74173a4880d5e8482639d3ff7f761aee4d061bd9",
|
||||
"contractVersion": 1,
|
||||
"commandEventType": "saas.workflow.demo.goods.releaseStock",
|
||||
"providerReleaseId": 41,
|
||||
"providerReleaseId": 50,
|
||||
"consumerModuleCode": "order",
|
||||
"providerModuleCode": "demo",
|
||||
"providerReleaseVersion": "1.0.1",
|
||||
"providerReleaseVersion": "1.0.5-rc.6",
|
||||
"commandEventContractChecksum": "18a727b91cf9410c3b7ac14e3a8799dbbfa8937f84667bfe7e31e21e662396be"
|
||||
}
|
||||
},
|
||||
@@ -2166,10 +2166,10 @@
|
||||
"outputChecksum": "545bd8b0bf6eb8670b21497236038187ee0f1df1544a318b16a399458fcb796e",
|
||||
"contractVersion": 1,
|
||||
"commandEventType": "saas.workflow.demo.goods.reserveStock",
|
||||
"providerReleaseId": 41,
|
||||
"providerReleaseId": 50,
|
||||
"consumerModuleCode": "order",
|
||||
"providerModuleCode": "demo",
|
||||
"providerReleaseVersion": "1.0.1",
|
||||
"providerReleaseVersion": "1.0.5-rc.6",
|
||||
"commandEventContractChecksum": "ffbecad3a3d63b8bf92fde701dfaa11c8502a2c5f9f6bbb89b755e214024c3ae"
|
||||
}
|
||||
}
|
||||
@@ -2209,8 +2209,8 @@
|
||||
},
|
||||
"additionalProperties": false
|
||||
},
|
||||
"providerReleaseId": 41,
|
||||
"providerReleaseVersion": "1.0.1"
|
||||
"providerReleaseId": 50,
|
||||
"providerReleaseVersion": "1.0.5-rc.6"
|
||||
}
|
||||
],
|
||||
"crud": [
|
||||
|
||||
@@ -1,14 +1,16 @@
|
||||
import { Provide } from '@midwayjs/core';
|
||||
import { createHash } from 'node:crypto';
|
||||
import { Inject, Provide } from '@midwayjs/core';
|
||||
import {
|
||||
InjectSaasAction,
|
||||
InjectSaasCrud,
|
||||
ModuleRuntimeError,
|
||||
SaasAction,
|
||||
SaasBusinessReject,
|
||||
type SaasActionCaller,
|
||||
type SaasCrudCaller,
|
||||
SaasCrudService,
|
||||
SaasCrudServiceBase,
|
||||
SaasWorkflow,
|
||||
SaasActionContext,
|
||||
} from '@cool-midway/module-runtime';
|
||||
import {
|
||||
Actions,
|
||||
@@ -18,6 +20,7 @@ import {
|
||||
type OrdersCancelOrderOutput,
|
||||
type OrdersCreateOrderInput,
|
||||
type OrdersCreateOrderOutput,
|
||||
type OrdersCrudBeforeChange,
|
||||
type OrdersDetailWithGoodsInput,
|
||||
type OrdersDetailWithGoodsOutput,
|
||||
} from '../saas/generated/order';
|
||||
@@ -27,6 +30,8 @@ type GoodsRecord = Record<string, unknown>;
|
||||
@Provide()
|
||||
@SaasCrudService(Crud.Orders)
|
||||
export class OrdersService extends SaasCrudServiceBase<typeof Crud.Orders> {
|
||||
@Inject() private readonly workflow!: SaasWorkflow;
|
||||
@Inject() private readonly actionContext!: SaasActionContext;
|
||||
@InjectSaasCrud(Crud.Orders)
|
||||
private readonly orders!: SaasCrudCaller<typeof Crud.Orders>;
|
||||
|
||||
@@ -35,15 +40,27 @@ export class OrdersService extends SaasCrudServiceBase<typeof Crud.Orders> {
|
||||
typeof SaasActions.Demo.GoodsBatchInfo
|
||||
>;
|
||||
|
||||
@InjectSaasAction(SaasActions.Demo.GoodsReserveStock)
|
||||
private readonly reserveStock!: SaasActionCaller<
|
||||
typeof SaasActions.Demo.GoodsReserveStock
|
||||
>;
|
||||
|
||||
@InjectSaasAction(SaasActions.Demo.GoodsReleaseStock)
|
||||
private readonly releaseStock!: SaasActionCaller<
|
||||
typeof SaasActions.Demo.GoodsReleaseStock
|
||||
>;
|
||||
protected async modifyBefore(change: OrdersCrudBeforeChange): Promise<void> {
|
||||
const caller = this.actionContext.managedCrudCaller;
|
||||
if (change.operation === 'add') {
|
||||
if (caller?.kind !== 'business' || caller.actionName !== 'orders.createOrder' || change.input.status !== 'pending_reservation') throw new SaasBusinessReject('ORDER_COMMAND_REQUIRED','创建订单必须使用下单业务命令');
|
||||
return;
|
||||
}
|
||||
if (change.operation === 'delete') throw new SaasBusinessReject('ORDER_COMMAND_REQUIRED','订单保留作为库存预留及工作流凭据，不能通过通用CRUD删除');
|
||||
const protectedFields = ['order_no','goods_id','quantity','unit_price','amount','status'];
|
||||
if (!protectedFields.some(field => Object.prototype.hasOwnProperty.call(change.input,field))) return;
|
||||
const keys = Object.keys(change.input);
|
||||
if (keys.some(key => key !== 'id' && key !== 'status')) throw new SaasBusinessReject('ORDER_COMMAND_REQUIRED','订单商品、数量和金额在创建后不可修改');
|
||||
const status = change.input.status;
|
||||
if (caller?.kind === 'business' && caller.actionName === 'orders.cancelOrder' && status === 'cancel_pending') return;
|
||||
const outcomes: Record<string,string[]> = {
|
||||
'saas.saga.step.completed':['confirmed','cancelled'],
|
||||
'saas.saga.step.failed':['rejected','manual_review'],
|
||||
'saas.saga.compensation.completed':['failed','manual_review'],
|
||||
};
|
||||
if (caller?.kind === 'saga' && outcomes[caller.eventType || '']?.includes(String(status))) return;
|
||||
throw new SaasBusinessReject('ORDER_COMMAND_REQUIRED','订单受管字段只能由业务命令和工作流回执变更');
|
||||
}
|
||||
|
||||
@SaasAction(Actions.OrdersCreateOrder)
|
||||
async createOrder(
|
||||
@@ -51,30 +68,32 @@ export class OrdersService extends SaasCrudServiceBase<typeof Crud.Orders> {
|
||||
): Promise<OrdersCreateOrderOutput> {
|
||||
const goods = await this.requireGoods(input.goodsId);
|
||||
if (integer(goods.status, '商品状态') !== 1) {
|
||||
throw conflict('商品未上架，不能下单');
|
||||
throw new SaasBusinessReject('GOODS_UNAVAILABLE', '商品未上架，不能下单');
|
||||
}
|
||||
|
||||
const unitPrice = decimal(goods.price, '商品价格');
|
||||
const amount = multiplyDecimal(unitPrice, input.quantity);
|
||||
|
||||
// Complete the remote write before the local eventized CRUD acquires the
|
||||
// tenant-wide outbox sequence lock. Holding that lock across a synchronous
|
||||
// module call would make the provider wait for this transaction itself.
|
||||
await this.reserveStock(
|
||||
{
|
||||
goodsId: input.goodsId,
|
||||
quantity: input.quantity,
|
||||
},
|
||||
{ idempotencyKey: businessKey('reserve', input.orderNo) }
|
||||
);
|
||||
|
||||
const order = await this.orders.add({
|
||||
order_no: input.orderNo,
|
||||
goods_id: String(input.goodsId),
|
||||
quantity: input.quantity,
|
||||
unit_price: unitPrice,
|
||||
amount,
|
||||
status: 'created',
|
||||
status: 'pending_reservation',
|
||||
});
|
||||
|
||||
await this.workflow.start({
|
||||
type: 'order.create@1', businessKey: input.orderNo,
|
||||
steps: [{key:'reserve',action:SaasActions.Demo.GoodsReserveStock,
|
||||
input:{goodsId:input.goodsId,quantity:input.quantity},
|
||||
compensate:{action:SaasActions.Demo.GoodsReleaseStock,input:{goodsId:input.goodsId,quantity:input.quantity,orderNo:input.orderNo}}}],
|
||||
terminal: Crud.Orders,
|
||||
outcomes: {
|
||||
completed:{id:order.id,status:'confirmed'},
|
||||
failed:{id:order.id,status:'rejected'},
|
||||
compensated:{id:order.id,status:'failed'},
|
||||
},
|
||||
});
|
||||
|
||||
return {
|
||||
@@ -98,56 +117,42 @@ export class OrdersService extends SaasCrudServiceBase<typeof Crud.Orders> {
|
||||
async cancelOrder(
|
||||
input: OrdersCancelOrderInput
|
||||
): Promise<OrdersCancelOrderOutput> {
|
||||
const order = await this.requireOrder(input.id);
|
||||
const order = await this.orders.lock({id:String(input.id)});
|
||||
if (!order) throw new SaasBusinessReject('ORDER_NOT_FOUND', `订单不存在: ${input.id}`);
|
||||
if (order.status === 'cancelled') {
|
||||
return { id: input.id, status: 'cancelled', restoredStock: 0 };
|
||||
}
|
||||
|
||||
if (order.status === 'cancel_pending') return {id:input.id,status:'cancel_pending',restoredStock:0};
|
||||
if (order.status !== 'confirmed') throw new SaasBusinessReject('ORDER_STATE_CONFLICT','订单当前状态不能取消；历史订单需要先核对预留记录');
|
||||
const goodsId = safeInteger(order.goods_id, '商品 ID');
|
||||
await this.releaseStock(
|
||||
{
|
||||
goodsId,
|
||||
quantity: order.quantity,
|
||||
orderNo: order.order_no,
|
||||
},
|
||||
{ idempotencyKey: businessKey('cancel', String(order.id)) }
|
||||
);
|
||||
|
||||
const update = await this.orders.update({
|
||||
id: order.id,
|
||||
status: 'cancelled',
|
||||
await this.orders.update({id:order.id,status:'cancel_pending'});
|
||||
await this.workflow.start({
|
||||
type:'order.cancel@1',businessKey:String(order.id),
|
||||
steps:[{key:'release',action:SaasActions.Demo.GoodsReleaseStock,input:{goodsId,quantity:order.quantity,orderNo:order.order_no}}],
|
||||
terminal:Crud.Orders,
|
||||
outcomes:{completed:{id:order.id,status:'cancelled'},failed:{id:order.id,status:'manual_review'},compensated:{id:order.id,status:'manual_review'}},
|
||||
});
|
||||
if (update.affected === 0) {
|
||||
return { id: input.id, status: 'cancelled', restoredStock: 0 };
|
||||
}
|
||||
|
||||
return {
|
||||
id: input.id,
|
||||
status: 'cancelled',
|
||||
restoredStock: order.quantity,
|
||||
};
|
||||
return {id:input.id,status:'cancel_pending',restoredStock:0};
|
||||
}
|
||||
|
||||
private async requireOrder(id: number) {
|
||||
const order = await this.orders.info({ id: String(id) });
|
||||
if (!order) throw conflict(`订单不存在: ${id}`);
|
||||
// The locked info contract requires an object; its empty result would fail
|
||||
// output validation before business code can classify a missing order.
|
||||
// The existing list contract permits an empty array and this exact ID filter.
|
||||
const [order] = await this.orders.list({ where: { id: String(id) }, take: 1 });
|
||||
if (!order) throw new SaasBusinessReject('ORDER_NOT_FOUND', `订单不存在: ${id}`);
|
||||
return order;
|
||||
}
|
||||
|
||||
private async requireGoods(goodsId: number): Promise<GoodsRecord> {
|
||||
const result = await this.batchInfo({ ids: [goodsId] });
|
||||
const goods = result.list.find(item => String(item.id) === String(goodsId));
|
||||
if (!goods) throw conflict(`商品不存在: ${goodsId}`);
|
||||
if (!goods) throw new SaasBusinessReject('GOODS_NOT_FOUND', `商品不存在: ${goodsId}`);
|
||||
return goods;
|
||||
}
|
||||
}
|
||||
|
||||
function businessKey(operation: string, identity: string): string {
|
||||
return createHash('sha256')
|
||||
.update(`${operation}:${identity}`, 'utf8')
|
||||
.digest('hex');
|
||||
}
|
||||
|
||||
function decimal(value: unknown, label: string): string {
|
||||
const normalized = String(value ?? '').trim();
|
||||
if (!/^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$/.test(normalized)) {
|
||||
|
||||
10
start-frozen.js
Normal file
10
start-frozen.js
Normal file
@@ -0,0 +1,10 @@
|
||||
'use strict';
|
||||
|
||||
// Explicit acceptance mode for an already built and signed V2 RC artifact.
|
||||
// The same deployment directory is used later by start-stable.js after promotion.
|
||||
const { startStable } = require('./start-stable');
|
||||
if (require.main === module) startStable({ mode: 'frozen' }).catch(error => {
|
||||
process.stderr.write(`${error?.message || error}\n`);
|
||||
process.exitCode = 1;
|
||||
});
|
||||
module.exports = { startFrozen: options => startStable({ ...options, mode: 'frozen' }) };
|
||||
@@ -3,7 +3,7 @@
|
||||
// Starts an already-built, frozen directory. There is intentionally no build,
|
||||
// codegen, Git checkout, publish, or fallback-to-RC operation in this entrypoint.
|
||||
const { createHash } = require('node:crypto');
|
||||
const { readdirSync, lstatSync, readFileSync } = require('node:fs');
|
||||
const { readdirSync, lstatSync, readFileSync, realpathSync } = require('node:fs');
|
||||
const path = require('node:path');
|
||||
const { spawnSync } = require('node:child_process');
|
||||
|
||||
@@ -96,31 +96,39 @@ async function fetchReleaseEvidence(environment, fetcher = fetch) {
|
||||
return body.data;
|
||||
}
|
||||
|
||||
function verifyStableEvidence({ release, lock, generated, digest, commit, releaseId }) {
|
||||
function verifyStableEvidence({ release, lock, generated, digest, commit, releaseId, mode = 'production' }) {
|
||||
const build = release?.build;
|
||||
const artifact = release?.frozenArtifact;
|
||||
ensure(release?.id === Number(releaseId) && release.releaseType === 'stable' && release.status === 'published' && release.lifecycleVersion === 1, 'target is not a published lifecycle Stable release');
|
||||
ensure(STABLE.test(release.version || '') && release.serviceVersion === release.version, 'Stable version identity is invalid');
|
||||
ensure(build && artifact && Number(release.promotedFromReleaseId) === Number(artifact.rcReleaseId) && Number(release.frozenArtifactId) === Number(artifact.id), 'Stable does not reference its source RC frozen artifact');
|
||||
const stable = mode === 'production';
|
||||
ensure(['production', 'frozen'].includes(mode), 'unsupported artifact runtime mode');
|
||||
ensure(release?.id === Number(releaseId) && release.status === 'published' && release.lifecycleVersion === 1 &&
|
||||
(stable ? release.releaseType === 'stable' : release.releaseType === 'rc' && ['frozen', 'accepted', 'promoted'].includes(release.candidateStatus) && release.releaseEvidenceVersion === 2), 'target is not a published lifecycle Stable release or explicit V2 frozen RC');
|
||||
const targetVersion = stable ? release.version : release.targetVersion;
|
||||
ensure(STABLE.test(targetVersion || '') && release.serviceVersion === release.version, 'Stable version identity is invalid');
|
||||
ensure(build && artifact && Number(stable ? release.promotedFromReleaseId : release.id) === Number(artifact.rcReleaseId) && Number(release.frozenArtifactId) === Number(artifact.id), 'Stable does not reference its source RC frozen artifact');
|
||||
ensure(Number(build.id) === Number(release.buildSnapshotId) && Number(build.moduleId) === Number(release.moduleId) && Number(artifact.moduleId) === Number(release.moduleId), 'Build/module/artifact association differs');
|
||||
ensure(Number(build.revision) === Number(lock.buildRevision) && Number(release.buildRevision) === Number(lock.buildRevision) && Number(artifact.buildRevision) === Number(lock.buildRevision), 'Build Revision differs from the Candidate lock');
|
||||
ensure(SHA256.test(build.buildChecksum || '') && build.buildChecksum === lock.buildChecksum && build.schemaInputChecksum === lock.schemaInputChecksum, 'Build checksums differ from the Candidate lock');
|
||||
ensure(lock.candidateVersion === `${release.version}-rc.${lock.buildRevision}` && lock.branchName === `release/${lock.candidateVersion}` && artifact.sourceBranch === lock.branchName && artifact.tagName === `v${lock.candidateVersion}`, 'source Candidate branch/version/tag differs');
|
||||
ensure(lock.candidateVersion === `${targetVersion}-rc.${lock.buildRevision}` && lock.branchName === `release/${lock.candidateVersion}` && artifact.sourceBranch === lock.branchName && artifact.tagName === `v${lock.candidateVersion}` && (stable || release.version === lock.candidateVersion), 'source Candidate branch/version/tag differs');
|
||||
ensure(candidateLockChecksum(lock) === artifact.generatedLockChecksum, 'generated Candidate lock checksum differs');
|
||||
ensure(COMMIT.test(artifact.sourceCommit || '') && artifact.sourceCommit === commit, 'source commit differs from the Frozen Artifact');
|
||||
ensure(/^sha256:[a-f0-9]{64}$/.test(artifact.artifactDigest || ''), 'Frozen Artifact has no compiled digest; old Git-only evidence cannot be upgraded or forged here');
|
||||
ensure(artifact.artifactDigest === digest, 'compiled artifact digest differs from the Frozen Artifact');
|
||||
ensure(SHA256.test(artifact.artifactIdentityChecksum || '') && SHA256.test(artifact.implementationManifestChecksum || ''), 'frozen implementation identity is incomplete');
|
||||
ensure(generated.moduleCode === lock.moduleCode && generated.revision === lock.buildRevision && generated.schemaInputChecksum === lock.schemaInputChecksum, 'compiled generated identity differs from the immutable Build');
|
||||
ensure(!generated.releaseVersion || generated.releaseVersion === release.version, 'generated runtime embeds a different Release version');
|
||||
ensure(!generated.releaseVersion || generated.releaseVersion === targetVersion, 'generated runtime embeds a different Release version');
|
||||
ensure(!generated.implementationManifestChecksum || generated.implementationManifestChecksum === artifact.implementationManifestChecksum, 'compiled implementation checksum differs');
|
||||
const manifest = release.schemaSnapshot?.actionManifest;
|
||||
const contracts = release.schemaSnapshot?.runtimeContracts;
|
||||
ensure(manifest && contracts?.implementationManifestChecksum === artifact.implementationManifestChecksum && manifest.artifactDigest === artifact.artifactDigest, 'Stable release envelope differs from the frozen implementation/artifact');
|
||||
// A frozen RC keeps its original immutable envelope. Its actual bytes are
|
||||
// selected by the separately signed Frozen Artifact; Stable's new envelope
|
||||
// must explicitly reuse that digest.
|
||||
ensure(manifest && contracts?.implementationManifestChecksum === artifact.implementationManifestChecksum &&
|
||||
(stable ? manifest.artifactDigest === artifact.artifactDigest : /^sha256:[a-f0-9]{64}$/.test(manifest.artifactDigest || '')), 'Stable release envelope differs from the frozen implementation/artifact');
|
||||
ensure(generated.runtimeContractChecksum === contracts.runtimeContractChecksum && SHA256.test(contracts.runtimeContractChecksum || ''), 'compiled Runtime contract checksum differs');
|
||||
ensure(generated.schemaVersion === release.schemaVersion && build.schemaVersion === release.schemaVersion, 'compiled Schema version differs');
|
||||
return {
|
||||
SAAS_RUNTIME_MODE: 'production', RPC_REQUIRE_EXACT_RELEASE: 'true',
|
||||
SAAS_RUNTIME_MODE: mode, RPC_REQUIRE_EXACT_RELEASE: 'true',
|
||||
RPC_MODULE_CODE: lock.moduleCode, RPC_RELEASE_ID: String(release.id),
|
||||
RPC_RELEASE_VERSION: release.version, RPC_SERVICE_VERSION: release.serviceVersion,
|
||||
SAAS_BUILD_REVISION: String(build.revision), SAAS_BUILD_CHECKSUM: build.buildChecksum,
|
||||
@@ -150,22 +158,62 @@ function verifyBootstrapSession(session, exact) {
|
||||
releaseId: 'RPC_RELEASE_ID', releaseVersion: 'RPC_RELEASE_VERSION', serviceVersion: 'RPC_SERVICE_VERSION',
|
||||
runtimeMode: 'SAAS_RUNTIME_MODE', buildRevision: 'SAAS_BUILD_REVISION', buildChecksum: 'SAAS_BUILD_CHECKSUM',
|
||||
schemaInputChecksum: 'SAAS_SCHEMA_INPUT_CHECKSUM', implementationManifestChecksum: 'RPC_IMPLEMENTATION_MANIFEST_CHECKSUM',
|
||||
artifactDigest: 'RPC_ARTIFACT_DIGEST', artifactIdentityChecksum: 'RPC_ARTIFACT_IDENTITY_CHECKSUM'
|
||||
artifactDigest: 'RPC_ARTIFACT_DIGEST', artifactIdentityChecksum: 'RPC_ARTIFACT_IDENTITY_CHECKSUM',
|
||||
schemaChecksum: 'RPC_SCHEMA_CHECKSUM', actionManifestChecksum: 'RPC_ACTION_MANIFEST_CHECKSUM', runtimeContractChecksum: 'RPC_RUNTIME_CONTRACT_CHECKSUM'
|
||||
};
|
||||
for (const [field, key] of Object.entries(mapping)) ensure(String(session.release?.[field]) === exact[key], `authenticated bootstrap ${field} differs from Stable evidence`);
|
||||
}
|
||||
|
||||
async function verifyTrustedReleaseBundle(projectDir, environment, release, fetcher = fetch) {
|
||||
const file = String(environment.SAAS_RELEASE_TRUST_FILE || '');
|
||||
ensure(path.isAbsolute(file) && lstatSync(file, {throwIfNoEntry:false})?.isFile() && !lstatSync(file).isSymbolicLink(), 'V2 startup needs an external build trust configuration');
|
||||
const relative = path.relative(realpathSync(projectDir), realpathSync(file));
|
||||
ensure(path.isAbsolute(relative) || relative === '..' || relative.startsWith('..' + path.sep), 'build trust must be supplied outside the signed deployment');
|
||||
const trust = JSON.parse(readFileSync(file, 'utf8'));
|
||||
const artifact = release.frozenArtifact;
|
||||
const keyId = artifact?.buildEvidence?.keyId;
|
||||
const builder = trust.builders?.[keyId];
|
||||
ensure(builder && builder.enabled !== false && builder.moduleIds?.includes(release.moduleId) && builder.repositories?.includes(artifact.sourceRepository), 'build signer is not trusted for this module and repository');
|
||||
const helper = require('./release-artifact');
|
||||
const claims = helper.verifyReleaseEvidence('build', artifact.buildEvidence, {[keyId]:builder.publicKey});
|
||||
ensure(release.releaseEvidenceVersion === 2 && artifact.releaseEvidenceVersion === 2 && claims.version === 2, 'release evidence version differs');
|
||||
for (const [field, expected] of Object.entries({
|
||||
releaseId: artifact.rcReleaseId, moduleId: release.moduleId, buildRevision: release.buildRevision, buildChecksum: release.build.buildChecksum,
|
||||
sourceRepository: artifact.sourceRepository, sourceBranch: artifact.sourceBranch, sourceCommit: artifact.sourceCommit, tagName: artifact.tagName,
|
||||
generatedLockChecksum: artifact.generatedLockChecksum, implementationManifestChecksum: artifact.implementationManifestChecksum,
|
||||
dependencyLockChecksum: artifact.dependencyLockChecksum, bundleDigest: artifact.bundleDigest, artifactDigest: artifact.artifactDigest,
|
||||
})) ensure(claims[field] === expected, `build signature ${field} differs from the frozen artifact`);
|
||||
const base = new URL(environment.SAAS_CONTROL_PLANE_URL || environment.COOL_SAAS_CONTROL_PLANE_URL || 'http://127.0.0.1:8080');
|
||||
const url = new URL('/admin/saas/module_release/artifact-bundle',base); url.searchParams.set('releaseId',String(release.id));
|
||||
const response = await fetcher(url,{headers:{Authorization:`Bearer ${environment.COOL_SAAS_TOKEN}`},redirect:'error',signal:AbortSignal.timeout(30000)});
|
||||
ensure(response.ok, `trusted artifact is unavailable or revoked (${response.status})`);
|
||||
const body = await response.json();
|
||||
ensure(body?.code === 1000 && body.data, 'trusted artifact response is invalid');
|
||||
const evidence = body.data;
|
||||
ensure(evidence.bundleDigest === artifact.bundleDigest && evidence.artifactDigest === artifact.artifactDigest &&
|
||||
helper.releaseJsonChecksum(evidence.buildEvidence) === helper.releaseJsonChecksum(artifact.buildEvidence), 'stored artifact and signed source differ');
|
||||
const inspected = helper.verifyLocalReleaseArtifact(projectDir,evidence.bundle);
|
||||
ensure(inspected.artifactDigest === artifact.artifactDigest && inspected.bundleDigest === artifact.bundleDigest, 'deployed bytes differ from the trusted artifact');
|
||||
ensure(createHash('sha256').update(inspected.files.get('pnpm-lock.yaml')).digest('hex') === artifact.dependencyLockChecksum, 'signed dependency lock differs');
|
||||
return { recheck: () => helper.verifyLocalReleaseArtifact(projectDir,evidence.bundle) };
|
||||
}
|
||||
|
||||
async function startStable(options = {}) {
|
||||
const projectDir = path.resolve(options.projectDir || __dirname);
|
||||
const environment = options.environment || process.env;
|
||||
const release = await fetchReleaseEvidence(environment, options.fetch);
|
||||
const mode = options.mode || 'production';
|
||||
const lock = JSON.parse(readFileSync(path.join(projectDir, '.cool-saas-candidate.json'), 'utf8'));
|
||||
const digest = calculateCompiledArtifactDigest(projectDir);
|
||||
const commit = sourceCommit(projectDir, environment);
|
||||
// Do not execute generated JavaScript before its compiled digest is verified.
|
||||
ensure(digest === release.frozenArtifact?.artifactDigest, 'compiled artifact digest differs from the Frozen Artifact');
|
||||
ensure(release.releaseEvidenceVersion == null || [1, 2].includes(release.releaseEvidenceVersion), 'unknown release evidence version');
|
||||
const trusted = release.releaseEvidenceVersion === 2
|
||||
? await verifyTrustedReleaseBundle(projectDir,environment,release,options.fetch)
|
||||
: null;
|
||||
const generated = (options.loadGenerated || (() => require(path.join(projectDir, 'dist/saas/generated')).GeneratedSaasModule))();
|
||||
const exact = verifyStableEvidence({ release, lock, generated, digest, commit, releaseId: environment.RPC_RELEASE_ID });
|
||||
const exact = verifyStableEvidence({ release, lock, generated, digest, commit, releaseId: environment.RPC_RELEASE_ID, mode });
|
||||
applyExactEnvironment(environment, exact);
|
||||
environment.SAAS_CONTROL_PLANE_URL ||= environment.COOL_SAAS_CONTROL_PLANE_URL || 'http://127.0.0.1:8080';
|
||||
delete environment.COOL_SAAS_TOKEN;
|
||||
@@ -175,6 +223,7 @@ async function startStable(options = {}) {
|
||||
return start({ verifySession: session => {
|
||||
verifyBootstrapSession(session, exact);
|
||||
ensure(calculateCompiledArtifactDigest(projectDir) === digest, 'compiled bytes changed during bootstrap');
|
||||
trusted?.recheck();
|
||||
} });
|
||||
}
|
||||
|
||||
@@ -183,4 +232,4 @@ if (require.main === module) startStable().catch(error => {
|
||||
process.exitCode = 1;
|
||||
});
|
||||
|
||||
module.exports = { startStable, verifyStableEvidence, verifyBootstrapSession, applyExactEnvironment, calculateCompiledArtifactDigest, candidateLockChecksum, fetchReleaseEvidence, sourceCommit };
|
||||
module.exports = { startStable, verifyStableEvidence, verifyBootstrapSession, applyExactEnvironment, calculateCompiledArtifactDigest, candidateLockChecksum, fetchReleaseEvidence, sourceCommit, verifyTrustedReleaseBundle };
|
||||
|
||||
170
test/orders-business-outcome.test.cjs
Normal file
170
test/orders-business-outcome.test.cjs
Normal file
@@ -0,0 +1,170 @@
|
||||
'use strict';
|
||||
|
||||
// Exercise the actual TypeScript service, with only its injected CRUD/Action
|
||||
// collaborators stubbed. No application bootstrap, network, database or dist
|
||||
// writes are needed; generated contracts and decorators remain the real ones.
|
||||
require('reflect-metadata');
|
||||
const test = require('node:test');
|
||||
const assert = require('node:assert/strict');
|
||||
const fs = require('node:fs');
|
||||
const path = require('node:path');
|
||||
const ts = require('typescript');
|
||||
const { SaasBusinessReject, ModuleRuntimeError } = require('@cool-midway/module-runtime');
|
||||
const sourceRoot = path.resolve(__dirname, '../src');
|
||||
const previousTsLoader = require.extensions['.ts'];
|
||||
let OrdersService;
|
||||
try {
|
||||
require.extensions['.ts'] = (module, filename) => {
|
||||
assert.ok(filename.startsWith(sourceRoot + path.sep), 'only this service source tree is compiled in memory');
|
||||
const compiled = ts.transpileModule(fs.readFileSync(filename, 'utf8'), {
|
||||
fileName: filename,
|
||||
compilerOptions: { target: ts.ScriptTarget.ES2018, module: ts.ModuleKind.CommonJS,
|
||||
experimentalDecorators: true, emitDecoratorMetadata: true, esModuleInterop: true },
|
||||
});
|
||||
module._compile(compiled.outputText, filename);
|
||||
};
|
||||
({ OrdersService } = require('../src/service/orders.ts'));
|
||||
} finally {
|
||||
if (previousTsLoader) require.extensions['.ts'] = previousTsLoader;
|
||||
else delete require.extensions['.ts'];
|
||||
}
|
||||
|
||||
function fixture(overrides = {}) {
|
||||
const state = {
|
||||
goods: { id: '24', status: 1, price: '12.50', stock: 20 },
|
||||
order: { id: '27', order_no: 'UNIT-ORDER', goods_id: '24', quantity: 3, amount: '37.50', status: 'confirmed' },
|
||||
calls: [], ...overrides,
|
||||
};
|
||||
const service = new OrdersService();
|
||||
service.batchInfo = async input => { state.calls.push(['batchInfo', input]); return { list: state.goods ? [state.goods] : [] }; };
|
||||
service.reserveStock = async input => { state.calls.push(['reserveStock', input]); return { goodsId: input.goodsId, remainingStock: 17 }; };
|
||||
service.releaseStock = async input => { state.calls.push(['releaseStock', input]); return { goodsId: input.goodsId, currentStock: 20 }; };
|
||||
service.orders = {
|
||||
lock: async input => {state.calls.push(['lock',input]);return state.order;},
|
||||
info: async () => assert.fail('missing-record lookup must not invoke the nonnullable info contract'),
|
||||
list: async input => { state.calls.push(['list', input]); return state.order ? [state.order] : []; },
|
||||
add: async input => { state.calls.push(['add', input]); return { id: '27', ...input, ...state.addResult }; },
|
||||
update: async input => { state.calls.push(['update', input]); return { affected: 1 }; },
|
||||
};
|
||||
service.workflow = {start: async input => {state.calls.push(['workflow',input]);return {sagaId:'test-saga'};}};
|
||||
return { service, state };
|
||||
}
|
||||
const createInput = { orderNo: 'UNIT-ORDER', goodsId: 24, quantity: 3 };
|
||||
const business = code => error => error instanceof SaasBusinessReject && !(error instanceof ModuleRuntimeError) && error.code === code;
|
||||
const contract = error => error instanceof ModuleRuntimeError && !(error instanceof SaasBusinessReject) &&
|
||||
error.errorCode === 'MODULE_ACTION_INPUT_INVALID' && error.statusCode === 409;
|
||||
const noWrites = state => assert.ok(state.calls.every(([name]) => !['reserveStock', 'releaseStock', 'add', 'update'].includes(name)));
|
||||
|
||||
test('the existing locked list contract authorizes ID filtering and valid empty-array results', () => {
|
||||
const lock = JSON.parse(fs.readFileSync(path.join(sourceRoot, 'saas/generated/order/saas-schema.lock.json'), 'utf8'));
|
||||
const model = lock.models.find(item => item.tableCode === 'orders');
|
||||
assert.equal(model.fields.find(field => field.code === 'id').filterable, true);
|
||||
const list = lock.actions.find(item => item.manifestDescriptor.name === 'orders.list').manifestDescriptor;
|
||||
assert.equal(list.inputSchema.properties.where.properties.id.type, 'string');
|
||||
assert.equal(list.inputSchema.properties.take.minimum, 1);
|
||||
assert.equal(list.outputSchema.type, 'array');
|
||||
assert.ok(list.tables.some(table => table.tableCode === 'orders' && table.select === true && table.fields.includes('id')));
|
||||
});
|
||||
|
||||
test('unlisted goods is an explicit GOODS_UNAVAILABLE business rejection before any write', async () => {
|
||||
const f = fixture({ goods: { id: '24', status: 0, price: '12.50' } });
|
||||
await assert.rejects(f.service.createOrder(createInput), business('GOODS_UNAVAILABLE'));
|
||||
noWrites(f.state);
|
||||
});
|
||||
|
||||
test('missing goods is GOODS_NOT_FOUND in both order creation and details', async t => {
|
||||
for (const method of ['createOrder', 'detailWithGoods']) await t.test(method, async () => {
|
||||
const f = fixture({ goods: null });
|
||||
await assert.rejects(f.service[method](method === 'createOrder' ? createInput : { id: 27 }), business('GOODS_NOT_FOUND'));
|
||||
noWrites(f.state);
|
||||
});
|
||||
});
|
||||
|
||||
test('missing order is ORDER_NOT_FOUND in details and cancellation', async t => {
|
||||
for (const method of ['detailWithGoods', 'cancelOrder']) await t.test(method, async () => {
|
||||
const f = fixture({ order: null });
|
||||
await assert.rejects(f.service[method]({ id: 27 }), business('ORDER_NOT_FOUND'));
|
||||
assert.deepEqual(f.state.calls, method === 'cancelOrder' ? [['lock',{id:'27'}]] : [['list', { where: { id: '27' }, take: 1 }]]);
|
||||
noWrites(f.state);
|
||||
});
|
||||
});
|
||||
|
||||
test('malformed goods status and price remain contract errors, not business warnings', async t => {
|
||||
for (const [label, patch] of [['fractional status', { status: 1.2 }], ['invalid status', { status: 'bad' }],
|
||||
['invalid price', { price: '12.5oops' }], ['nonfinite price', { price: Infinity }]]) {
|
||||
await t.test(label, async () => {
|
||||
const f = fixture(); Object.assign(f.state.goods, patch);
|
||||
await assert.rejects(f.service.createOrder(createInput), contract);
|
||||
noWrites(f.state);
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
test('unsafe stored goods IDs remain contract failures before a cross-module call', async t => {
|
||||
for (const id of ['0', '-1', '1.5', '9007199254740992', 'bad']) await t.test(id, async () => {
|
||||
const f = fixture(); f.state.order.goods_id = id;
|
||||
await assert.rejects(f.service.detailWithGoods({ id: 27 }), contract);
|
||||
assert.deepEqual(f.state.calls.map(([name]) => name), ['list']);
|
||||
});
|
||||
});
|
||||
|
||||
test('invalid generated order ID or amount stays a contract error after mocked CRUD', async t => {
|
||||
for (const [label, addResult] of [['unsafe order ID', { id: '9007199254740992' }], ['nonfinite amount', { amount: 'NaN' }]]) {
|
||||
await t.test(label, async () => {
|
||||
const f = fixture({ addResult });
|
||||
await assert.rejects(f.service.createOrder(createInput), contract);
|
||||
assert.deepEqual(f.state.calls.map(([name]) => name), ['batchInfo', 'add', 'workflow']);
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
test('failure to persist workflow propagates to the enclosing transaction', async () => {
|
||||
const f = fixture();
|
||||
const downstream = new SaasBusinessReject('INSUFFICIENT_STOCK', '库存不足');
|
||||
f.service.workflow.start = async () => { throw downstream; };
|
||||
await assert.rejects(f.service.createOrder(createInput), error => error === downstream);
|
||||
assert.equal(f.state.calls.some(([name]) => name === 'reserveStock'), false);
|
||||
});
|
||||
|
||||
test('list contract and database failures propagate unchanged instead of becoming ORDER_NOT_FOUND', async t => {
|
||||
for (const error of [new ModuleRuntimeError('MODULE_ACTION_OUTPUT_INVALID', 'invalid list output', 500),
|
||||
new ModuleRuntimeError('MODULE_ACTION_FORBIDDEN', 'list access denied', 403), new Error('database unavailable')]) {
|
||||
await t.test(error.message, async () => {
|
||||
const f = fixture();
|
||||
f.service.orders.list = async () => { throw error; };
|
||||
await assert.rejects(f.service.detailWithGoods({ id: 27 }), observed => observed === error && !(observed instanceof SaasBusinessReject));
|
||||
noWrites(f.state);
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
test('creation persists pending intent and starts durable workflow without a synchronous stock write', async () => {
|
||||
const f = fixture();
|
||||
assert.deepEqual(await f.service.createOrder(createInput), { id: 27, orderNo: 'UNIT-ORDER', amount: 37.5, status: 'pending_reservation' });
|
||||
assert.deepEqual(f.state.calls.map(([name]) => name), ['batchInfo', 'add', 'workflow']);
|
||||
const flow=f.state.calls[2][1];
|
||||
assert.equal(flow.type,'order.create@1');
|
||||
assert.deepEqual(flow.steps[0].input,{goodsId:24,quantity:3});
|
||||
assert.deepEqual(flow.outcomes.completed,{id:'27',status:'confirmed'});
|
||||
assert.deepEqual(flow.outcomes.failed,{id:'27',status:'rejected'});
|
||||
});
|
||||
|
||||
test('cancellation locks state and persists release workflow; terminal and pending repeats are inert', async () => {
|
||||
const f = fixture();
|
||||
assert.deepEqual(await f.service.cancelOrder({ id: 27 }), { id: 27, status: 'cancel_pending', restoredStock: 0 });
|
||||
assert.deepEqual(f.state.calls.map(([name]) => name), ['lock', 'update', 'workflow']);
|
||||
const repeated = fixture(); repeated.state.order.status = 'cancelled';
|
||||
assert.deepEqual(await repeated.service.cancelOrder({ id: 27 }), { id: 27, status: 'cancelled', restoredStock: 0 });
|
||||
assert.deepEqual(repeated.state.calls.map(([name]) => name), ['lock']);
|
||||
const pending=fixture(); pending.state.order.status='cancel_pending';
|
||||
assert.equal((await pending.service.cancelOrder({id:27})).status,'cancel_pending');
|
||||
assert.deepEqual(pending.state.calls.map(([name])=>name),['lock']);
|
||||
});
|
||||
|
||||
test('legacy or unconfirmed orders cannot manufacture a stock release', async () => {
|
||||
for (const status of ['created','pending_reservation','rejected','manual_review']) {
|
||||
const f=fixture();f.state.order.status=status;
|
||||
await assert.rejects(f.service.cancelOrder({id:27}),business('ORDER_STATE_CONFLICT'));
|
||||
noWrites(f.state);
|
||||
}
|
||||
});
|
||||
@@ -6,7 +6,7 @@ const { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, symlinkSync
|
||||
const path = require('node:path');
|
||||
const os = require('node:os');
|
||||
const { spawnSync } = require('node:child_process');
|
||||
const { createHash } = require('node:crypto');
|
||||
const { createHash, generateKeyPairSync } = require('node:crypto');
|
||||
const {
|
||||
startStable, verifyStableEvidence, verifyBootstrapSession, applyExactEnvironment,
|
||||
calculateCompiledArtifactDigest, candidateLockChecksum, fetchReleaseEvidence, sourceCommit
|
||||
@@ -33,7 +33,8 @@ function sessionFor(exact) {
|
||||
releaseId: Number(exact.RPC_RELEASE_ID), releaseVersion: exact.RPC_RELEASE_VERSION, serviceVersion: exact.RPC_SERVICE_VERSION,
|
||||
runtimeMode: exact.SAAS_RUNTIME_MODE, buildRevision: Number(exact.SAAS_BUILD_REVISION), buildChecksum: exact.SAAS_BUILD_CHECKSUM,
|
||||
schemaInputChecksum: exact.SAAS_SCHEMA_INPUT_CHECKSUM, implementationManifestChecksum: exact.RPC_IMPLEMENTATION_MANIFEST_CHECKSUM,
|
||||
artifactDigest: exact.RPC_ARTIFACT_DIGEST, artifactIdentityChecksum: exact.RPC_ARTIFACT_IDENTITY_CHECKSUM
|
||||
artifactDigest: exact.RPC_ARTIFACT_DIGEST, artifactIdentityChecksum: exact.RPC_ARTIFACT_IDENTITY_CHECKSUM,
|
||||
schemaChecksum: exact.RPC_SCHEMA_CHECKSUM, actionManifestChecksum: exact.RPC_ACTION_MANIFEST_CHECKSUM, runtimeContractChecksum: exact.RPC_RUNTIME_CONTRACT_CHECKSUM
|
||||
} };
|
||||
}
|
||||
|
||||
@@ -193,3 +194,56 @@ test('dirty Git checkouts cannot be presented as the frozen source commit', t =>
|
||||
writeFileSync(path.join(root, 'business.js'), 'modified');
|
||||
assert.throws(() => sourceCommit(root, {}), /dirty/);
|
||||
});
|
||||
|
||||
test('V2 frozen and Stable starts reuse signed executable and dependency bytes and reject tampering before generated code loads', async t => {
|
||||
const helper = require('../release-artifact');
|
||||
const parent = mkdtempSync(path.join(os.tmpdir(), 'stable-v2-test-'));
|
||||
t.after(() => rmSync(parent, { recursive:true, force:true }));
|
||||
const root = path.join(parent, 'deployment');
|
||||
for (const name of ['dist/saas/generated', 'scripts', 'node_modules/pkg']) mkdirSync(path.join(root,name), {recursive:true});
|
||||
const data = fixture();
|
||||
for (const name of ['bootstrap.js','release-environment.js','start-stable.js','start-frozen.js','release-artifact.js','dist/configuration.js','dist/saas/generated/index.js']) writeFileSync(path.join(root,name), 'module.exports = {};');
|
||||
writeFileSync(path.join(root,'.cool-saas-candidate.json'),JSON.stringify(data.lock));
|
||||
for (const name of ['.cool-saas-service.json','package.json','scripts/published-packages.json']) writeFileSync(path.join(root,name),'{}');
|
||||
writeFileSync(path.join(root,'pnpm-lock.yaml'),'lockfileVersion: 9\n');
|
||||
writeFileSync(path.join(root,'node_modules/pkg/index.js'),'exports.identity = "frozen";');
|
||||
const bundle = helper.createReleaseArtifactBundle(root);
|
||||
const inspected = helper.inspectReleaseArtifactBundle(bundle);
|
||||
const keys = generateKeyPairSync('ed25519');
|
||||
const privatePem = keys.privateKey.export({type:'pkcs8',format:'pem'}).toString();
|
||||
const publicKey = keys.publicKey.export({type:'spki',format:'pem'}).toString();
|
||||
const trustFile = path.join(parent,'trust.json');
|
||||
writeFileSync(trustFile,JSON.stringify({builders:{'builder-1':{publicKey,moduleIds:[2],repositories:['https://git.example.invalid/demo.git']}}}));
|
||||
const artifact = data.release.frozenArtifact;
|
||||
Object.assign(artifact,{releaseEvidenceVersion:2,sourceRepository:'https://git.example.invalid/demo.git',
|
||||
artifactDigest:inspected.artifactDigest,bundleDigest:inspected.bundleDigest,
|
||||
dependencyLockChecksum:createHash('sha256').update(inspected.files.get('pnpm-lock.yaml')).digest('hex')});
|
||||
const claims = {version:2,taskId:'build-task',taskNonce:'nonce',releaseId:41,moduleId:2,buildRevision:2,buildChecksum:data.lock.buildChecksum};
|
||||
for (const name of ['sourceRepository','sourceBranch','sourceCommit','tagName','generatedLockChecksum','implementationManifestChecksum','artifactDigest','bundleDigest','dependencyLockChecksum']) claims[name] = artifact[name];
|
||||
artifact.buildEvidence = helper.signReleaseEvidence('build','builder-1',claims,privatePem);
|
||||
data.release.releaseEvidenceVersion = 2;
|
||||
data.release.schemaSnapshot.actionManifest.artifactDigest = inspected.artifactDigest;
|
||||
const originalBytes = helper.releaseJsonChecksum(helper.createReleaseArtifactBundle(root));
|
||||
let starts = 0, loads = 0;
|
||||
async function launch(mode, edit) {
|
||||
const release = structuredClone(data.release);
|
||||
if (mode === 'frozen') Object.assign(release,{id:41,releaseType:'rc',candidateStatus:'promoted',targetVersion:'1.0.1',version:data.lock.candidateVersion,serviceVersion:data.lock.candidateVersion,promotedReleaseId:42});
|
||||
edit?.(release);
|
||||
const environment = {NODE_ENV:'local',RPC_RELEASE_ID:String(release.id),BUILD_SHA:data.commit,COOL_SAAS_TOKEN:'short-lived-test',SAAS_RELEASE_TRUST_FILE:trustFile};
|
||||
return startStable({projectDir:root,mode,environment,fetch:async url => ({ok:true,json:async()=>({code:1000,data:url.pathname.endsWith('/artifact-bundle') ? {bundle,...inspected,files:undefined,buildEvidence:artifact.buildEvidence} : release})}),
|
||||
loadGenerated:()=>{loads++;return data.generated;},start:({verifySession})=>{starts++;verifySession(sessionFor(environment));return 'started';}});
|
||||
}
|
||||
assert.equal(await launch('frozen'),'started');
|
||||
assert.equal(await launch('production'),'started');
|
||||
assert.equal(starts,2);
|
||||
assert.equal(helper.releaseJsonChecksum(helper.createReleaseArtifactBundle(root)),originalBytes);
|
||||
for (const name of ['bootstrap.js','node_modules/pkg/index.js','pnpm-lock.yaml']) {
|
||||
const file = path.join(root,name), bytes = readFileSync(file);
|
||||
writeFileSync(file,'tampered');
|
||||
await assert.rejects(launch('production'),/differs|differ/);
|
||||
writeFileSync(file,bytes);
|
||||
}
|
||||
await assert.rejects(launch('production',release=>{release.frozenArtifact.buildEvidence.signature='a'.repeat(86);}),/signature/);
|
||||
await assert.rejects(launch('production',release=>{release.frozenArtifact.sourceCommit='9'.repeat(40);}),/sourceCommit/);
|
||||
assert.equal(loads,2,'tampered bytes must fail before loading generated JavaScript');
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user