Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Evelyn Chen
|
069d1baaba |
@@ -52,7 +52,6 @@ artifacts:
|
||||
- name: distributions
|
||||
type: static
|
||||
content_dir: dist
|
||||
cors_origins: ['*']
|
||||
publish:
|
||||
bucket: baseline-dist
|
||||
credentials:
|
||||
@@ -129,35 +128,13 @@ cache policy, content type, and bytes. That content address makes concurrent
|
||||
writes identical even though Garage v2.2.0 has no conditional destination
|
||||
write. An identical retry converges; a changed object, missing digest metadata,
|
||||
wrong address, or nested policy under that immutable prefix fails publication.
|
||||
Every immutable target across every artifact is validated and published before
|
||||
any route's mutable objects change.
|
||||
Mutable default and override partitions receive their final cache policy before
|
||||
the matching prefix-scoped stale deletion, so publication never exposes a
|
||||
provisional cache policy or a pointer to a missing immutable target.
|
||||
Generated Ingress annotations and `site-publish-history.yaml` retain every
|
||||
seen bucket's access, prior route, and cumulative bucket-relative immutable key
|
||||
prefixes, including while an artifact is absent. Removed or renamed rules stay
|
||||
recorded. When a move places a retired prefix inside the new sync scope, its
|
||||
immutable subtrees are excluded; a current-file collision fails publication.
|
||||
The bucket-keyed history rejects a protected-to-public transition even when the
|
||||
artifact is renamed; publishing that artifact publicly requires a new bucket.
|
||||
Legacy single-surface is public for this downgrade check. Removing or renaming
|
||||
an immutable rule preserves its prior URLs; current mutable content at one of
|
||||
those paths is rejected instead of replacing it.
|
||||
|
||||
Artifact input directories must be pairwise disjoint after filesystem
|
||||
resolution. Publication stops before build or upload if one contains another or
|
||||
escapes the repository. Symlinked roots, components, and descendants are also rejected, preventing
|
||||
protected input from entering a public artifact through dereference. Split
|
||||
storage endpoints are pinned to Garage, and each website
|
||||
escapes the repository, preventing protected input from entering a public
|
||||
artifact. Split storage endpoints are pinned to Garage, and each website
|
||||
authority is derived from its bucket; a site cannot expose an arbitrary backend.
|
||||
|
||||
`cors_origins` is reconciled as a bucket policy on every split publication. Values are either `*`
|
||||
or HTTPS origins; browser access is limited to `GET` and `HEAD`. Omitting the field removes stale
|
||||
CORS from that bucket. Protected artifacts cannot allow wildcard CORS. All immutable objects and
|
||||
all bucket CORS policies complete before mutable channels change; if any policy write fails, the
|
||||
policies already attempted are restored to their pre-publication values.
|
||||
|
||||
Each split route gets a bucket-specific `<bucket>.web.sjc001.fritzlab.net`
|
||||
ExternalName Service annotated to disable pass-host-header and a separate Ingress. Route
|
||||
Ingresses share the hostname's certificate Secret. The access middleware and
|
||||
|
||||
+30
-293
@@ -8,13 +8,10 @@ import os
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import tempfile
|
||||
from pathlib import Path
|
||||
from urllib.error import HTTPError, URLError
|
||||
from urllib.request import Request, urlopen
|
||||
|
||||
import yaml
|
||||
|
||||
from utils import (
|
||||
NAMESPACE,
|
||||
clone_apps,
|
||||
@@ -152,8 +149,9 @@ def publish_immutable_rule(artifact, route, rule, html_dir, aws_env):
|
||||
)
|
||||
|
||||
|
||||
def publication_aws_env(artifact, credential_env_names=None):
|
||||
"""Build the route-scoped AWS environment without leaking other credentials."""
|
||||
def s3_sync(artifact, route, site_dir, credential_env_names=None):
|
||||
endpoint = artifact["s3_endpoint"]
|
||||
html_dir = site_dir / artifact["build_dir"]
|
||||
access_key = env(artifact["credentials"]["access_key_env"])
|
||||
secret_key = env(artifact["credentials"]["secret_key_env"])
|
||||
aws_env = os.environ.copy()
|
||||
@@ -167,155 +165,6 @@ def publication_aws_env(artifact, credential_env_names=None):
|
||||
"AWS_SECRET_ACCESS_KEY": secret_key,
|
||||
"AWS_DEFAULT_REGION": os.environ.get("AWS_DEFAULT_REGION", "sjc001"),
|
||||
})
|
||||
return aws_env
|
||||
|
||||
|
||||
def configure_cors(bucket, origins, endpoint, aws_env):
|
||||
"""Reconcile read-only browser access without exposing publication credentials."""
|
||||
if origins is None:
|
||||
return
|
||||
config = None
|
||||
if origins:
|
||||
config = {
|
||||
"CORSRules": [{
|
||||
"AllowedOrigins": origins,
|
||||
"AllowedMethods": ["GET", "HEAD"],
|
||||
"AllowedHeaders": ["*"],
|
||||
"ExposeHeaders": ["ETag"],
|
||||
"MaxAgeSeconds": 3600,
|
||||
}],
|
||||
}
|
||||
set_cors_configuration(bucket, config, endpoint, aws_env)
|
||||
|
||||
|
||||
def set_cors_configuration(bucket, config, endpoint, aws_env):
|
||||
"""Apply an exact bucket CORS configuration, or remove it when absent."""
|
||||
if config is None:
|
||||
run([
|
||||
"aws", "--endpoint-url", endpoint, "s3api", "delete-bucket-cors",
|
||||
"--bucket", bucket,
|
||||
], env=aws_env)
|
||||
return
|
||||
with tempfile.NamedTemporaryFile("w", suffix=".json", encoding="utf-8") as handle:
|
||||
json.dump(config, handle)
|
||||
handle.flush()
|
||||
run([
|
||||
"aws", "--endpoint-url", endpoint, "s3api", "put-bucket-cors",
|
||||
"--bucket", bucket, "--cors-configuration", f"file://{handle.name}",
|
||||
], env=aws_env)
|
||||
|
||||
|
||||
def get_cors_configuration(bucket, endpoint, aws_env):
|
||||
"""Read the exact bucket CORS configuration for rollback."""
|
||||
result = _aws_capture([
|
||||
"aws", "--endpoint-url", endpoint, "s3api", "get-bucket-cors",
|
||||
"--bucket", bucket, "--output", "json",
|
||||
], aws_env)
|
||||
if result.returncode == 0:
|
||||
try:
|
||||
config = json.loads(result.stdout)
|
||||
except json.JSONDecodeError as error:
|
||||
raise RuntimeError(f"get-bucket-cors returned invalid JSON for {bucket}") from error
|
||||
if not isinstance(config, dict) or not isinstance(config.get("CORSRules"), list):
|
||||
raise RuntimeError(f"get-bucket-cors returned an invalid policy for {bucket}")
|
||||
return config
|
||||
error = f"{result.stdout}\n{result.stderr}"
|
||||
if "NoSuchCORSConfiguration" in error:
|
||||
return None
|
||||
raise RuntimeError(f"get-bucket-cors failed for {bucket}: {error.strip()}")
|
||||
|
||||
|
||||
def reconcile_artifact_cors(artifacts, credential_env_names=None):
|
||||
"""Reconcile all policies, restoring the prior set if any write fails."""
|
||||
snapshots = []
|
||||
for artifact in artifacts:
|
||||
if artifact["cors_origins"] is None:
|
||||
continue
|
||||
aws_env = publication_aws_env(artifact, credential_env_names)
|
||||
snapshots.append((
|
||||
artifact,
|
||||
aws_env,
|
||||
get_cors_configuration(artifact["bucket"], artifact["s3_endpoint"], aws_env),
|
||||
))
|
||||
|
||||
attempted = []
|
||||
try:
|
||||
for artifact, aws_env, previous in snapshots:
|
||||
attempted.append((artifact, aws_env, previous))
|
||||
configure_cors(
|
||||
artifact["bucket"], artifact["cors_origins"], artifact["s3_endpoint"], aws_env,
|
||||
)
|
||||
except Exception as error:
|
||||
rollback_errors = []
|
||||
for artifact, aws_env, previous in reversed(attempted):
|
||||
try:
|
||||
set_cors_configuration(
|
||||
artifact["bucket"], previous, artifact["s3_endpoint"], aws_env,
|
||||
)
|
||||
except Exception as rollback_error:
|
||||
rollback_errors.append(f"{artifact['bucket']}: {rollback_error}")
|
||||
if rollback_errors:
|
||||
raise RuntimeError(
|
||||
f"CORS reconciliation failed ({error}); rollback also failed for "
|
||||
f"{'; '.join(rollback_errors)}"
|
||||
) from error
|
||||
raise
|
||||
|
||||
|
||||
def publish_route_immutables(artifact, route, site_dir, credential_env_names=None):
|
||||
"""Publish one route's immutable partitions during the global preflight."""
|
||||
html_dir = site_dir / artifact["build_dir"]
|
||||
aws_env = publication_aws_env(artifact, credential_env_names)
|
||||
for rule in artifact["cache_rules"]:
|
||||
if _is_immutable(rule):
|
||||
publish_immutable_rule(artifact, route, rule, html_dir, aws_env)
|
||||
|
||||
|
||||
def immutable_key_prefixes(artifact, route):
|
||||
"""Return immutable partitions as bucket-relative key prefixes."""
|
||||
route_prefix = route["path"].strip("/")
|
||||
return [
|
||||
"/".join(part for part in (route_prefix, rule["path"]) if part)
|
||||
for rule in artifact["cache_rules"] if _is_immutable(rule)
|
||||
]
|
||||
|
||||
|
||||
def retained_immutable_paths(artifact, route, previous_contract):
|
||||
"""Carry all bucket history forward so later route moves cannot delete it."""
|
||||
previous_paths = previous_contract["immutable_paths"] if previous_contract else []
|
||||
return sorted(set(previous_paths) | set(immutable_key_prefixes(artifact, route)))
|
||||
|
||||
|
||||
def retired_immutable_filters(artifact, route, html_dir, previous_contract):
|
||||
"""Protect historical immutable keys that fall inside the current sync scope."""
|
||||
if not previous_contract:
|
||||
return []
|
||||
current_prefix = route["path"].strip("/")
|
||||
filters = []
|
||||
current_immutable = set(immutable_key_prefixes(artifact, route))
|
||||
for immutable_path in previous_contract["immutable_paths"]:
|
||||
if immutable_path in current_immutable:
|
||||
continue
|
||||
if current_prefix:
|
||||
marker = f"{current_prefix}/"
|
||||
if not immutable_path.startswith(marker):
|
||||
continue
|
||||
retired_path = immutable_path[len(marker):]
|
||||
else:
|
||||
retired_path = immutable_path
|
||||
collision = html_dir / retired_path
|
||||
if collision.exists() and any(path.is_file() for path in collision.rglob("*")):
|
||||
raise RuntimeError(
|
||||
f"current artifact collides with retired immutable partition: {retired_path}"
|
||||
)
|
||||
filters.extend(("--exclude", f"{retired_path}/*"))
|
||||
return filters
|
||||
|
||||
|
||||
def s3_sync(artifact, route, site_dir, credential_env_names=None, previous_contract=None):
|
||||
endpoint = artifact["s3_endpoint"]
|
||||
html_dir = site_dir / artifact["build_dir"]
|
||||
aws_env = publication_aws_env(artifact, credential_env_names)
|
||||
bucket = artifact["bucket"]
|
||||
object_prefix = route["path"].strip("/")
|
||||
destination = f"s3://{bucket}/{object_prefix + '/' if object_prefix else ''}"
|
||||
@@ -327,26 +176,33 @@ def s3_sync(artifact, route, site_dir, credential_env_names=None, previous_contr
|
||||
exclude_args = [arg for pattern in artifact["excludes"] for arg in ("--exclude", pattern)]
|
||||
if artifact["excludes"]:
|
||||
print(f"Excluding patterns: {artifact['excludes']}")
|
||||
# Validate and publish every append-only target before a mutable channel can
|
||||
# point at it. Partial immutable success is safe; partial mutable success is
|
||||
# not.
|
||||
for rule in artifact["cache_rules"]:
|
||||
if _is_immutable(rule):
|
||||
publish_immutable_rule(artifact, route, rule, html_dir, aws_env)
|
||||
print(f"Syncing artifact {artifact['name']} → {destination} via {endpoint}")
|
||||
# Upload with the final cache policy before cleanup. Sync and deletion are
|
||||
# scoped to the same current route prefix and cache partition. A route move
|
||||
# Sync and deletion are scoped to the current route prefix. A route move
|
||||
# leaves its old bucket partition intact but unreachable after the old
|
||||
# Ingress disappears, while stale mutable keys on the serving prefix are
|
||||
# deleted. Immutable subtrees are structurally excluded. `cp --recursive`
|
||||
# refreshes metadata atomically per object before `sync --delete` removes
|
||||
# stale keys without ever exposing new bytes under a provisional policy.
|
||||
# deleted. Immutable subtrees are structurally excluded. Partitioned
|
||||
# `cp --recursive` calls then re-upload each file once to refresh metadata
|
||||
# (cache-control, content-type) on objects sync skipped as unchanged.
|
||||
# A no-op deploy therefore transfers the artifact bytes once.
|
||||
# AWS CLI guesses Content-Type from file extension on local→S3 uploads,
|
||||
# so a fresh upload always carries the right MIME type.
|
||||
specific_paths = [rule["path"] for rule in artifact["cache_rules"] if rule["path"]]
|
||||
default_filters = [arg for path in specific_paths for arg in ("--exclude", f"{path}/*")]
|
||||
retired_filters = retired_immutable_filters(artifact, route, html_dir, previous_contract)
|
||||
run(["aws", "--endpoint-url", endpoint, "s3", "cp", f"{html_dir}/", destination,
|
||||
"--recursive", "--only-show-errors", "--cache-control", default_cache,
|
||||
*default_filters, *retired_filters, *exclude_args], env=aws_env)
|
||||
sync_excludes = [*exclude_args,
|
||||
*(arg for path in immutable_paths for arg in ("--exclude", f"{path}/*"))]
|
||||
run(["aws", "--endpoint-url", endpoint, "s3", "sync", f"{html_dir}/", destination,
|
||||
"--delete", "--only-show-errors", "--cache-control", default_cache,
|
||||
*default_filters, *retired_filters, *exclude_args], env=aws_env)
|
||||
*sync_excludes], env=aws_env)
|
||||
print("Re-stamping metadata on all objects...")
|
||||
specific_paths = [rule["path"] for rule in artifact["cache_rules"] if rule["path"]]
|
||||
default_filters = [arg for path in specific_paths for arg in ("--exclude", f"{path}/*")]
|
||||
run(["aws", "--endpoint-url", endpoint, "s3", "cp", f"{html_dir}/", destination,
|
||||
"--recursive", "--only-show-errors", "--cache-control", default_cache,
|
||||
*default_filters, *exclude_args], env=aws_env)
|
||||
for rule in artifact["cache_rules"]:
|
||||
if not rule["path"]:
|
||||
continue
|
||||
@@ -361,9 +217,6 @@ def s3_sync(artifact, route, site_dir, credential_env_names=None, previous_contr
|
||||
run(["aws", "--endpoint-url", endpoint, "s3", "cp", f"{html_dir}/", destination,
|
||||
"--recursive", "--only-show-errors", "--cache-control", rule["cache_control"],
|
||||
"--exclude", "*", "--include", include, *child_filters, *exclude_args], env=aws_env)
|
||||
run(["aws", "--endpoint-url", endpoint, "s3", "sync", f"{html_dir}/", destination,
|
||||
"--delete", "--only-show-errors", "--cache-control", rule["cache_control"],
|
||||
"--exclude", "*", "--include", include, *child_filters, *exclude_args], env=aws_env)
|
||||
|
||||
|
||||
def garage_admin(method, path, token, body=None):
|
||||
@@ -412,32 +265,16 @@ def ensure_bucket_aliases(site_name, aliases, admin_token):
|
||||
raise
|
||||
|
||||
|
||||
def render_site_manifests(
|
||||
site_name, action_dir, app_dir, manifests_dir, cfg, previous_contracts=None,
|
||||
):
|
||||
def render_site_manifests(site_name, action_dir, app_dir, manifests_dir, cfg):
|
||||
"""Always re-render manifests from current site.yaml. Templates own
|
||||
domain + aliases, so changes propagate without manual edits."""
|
||||
manifests_dir.mkdir(parents=True, exist_ok=True)
|
||||
artifact_by_name = {artifact["name"]: artifact for artifact in cfg["artifacts"]}
|
||||
routes = []
|
||||
previous_contracts = previous_contracts or {}
|
||||
next_contracts = {bucket: dict(contract)
|
||||
for bucket, contract in previous_contracts.items()}
|
||||
for route in cfg["routes"]:
|
||||
artifact = artifact_by_name[route["artifact"]]
|
||||
resource_name = k8s_name(site_name) if cfg["compatibility"] else f"{k8s_name(site_name)}-{route['name']}"
|
||||
previous = previous_contracts.get(artifact["bucket"])
|
||||
immutable_paths = retained_immutable_paths(artifact, route, previous)
|
||||
next_contracts[artifact["bucket"]] = {
|
||||
"path": route["path"],
|
||||
"access": "public" if route["access"] == "legacy" else route["access"],
|
||||
"artifact": route["artifact"],
|
||||
"immutable_paths": immutable_paths,
|
||||
}
|
||||
routes.append({
|
||||
**route, "resource_name": resource_name, "artifact_config": artifact,
|
||||
"immutable_paths_json": json.dumps(immutable_paths, separators=(",", ":")),
|
||||
})
|
||||
routes.append({**route, "resource_name": resource_name, "artifact_config": artifact})
|
||||
template_vars = {
|
||||
"site": site_name,
|
||||
"site_k8s": k8s_name(site_name),
|
||||
@@ -448,89 +285,6 @@ def render_site_manifests(
|
||||
"routes": routes,
|
||||
}
|
||||
render_templates(action_dir, template_vars, app_dir, manifests_dir)
|
||||
if not cfg["compatibility"] or previous_contracts:
|
||||
(app_dir / "site-publish-history.yaml").write_text(yaml.safe_dump(
|
||||
{"version": 1, "buckets": next_contracts}, sort_keys=True,
|
||||
))
|
||||
|
||||
|
||||
def _validate_route_contract(bucket, contract, path):
|
||||
expected = {"path", "access", "artifact", "immutable_paths"}
|
||||
if (not isinstance(bucket, str) or not bucket or not isinstance(contract, dict)
|
||||
or set(contract) != expected
|
||||
or contract.get("access") not in {"public", "protected"}
|
||||
or not isinstance(contract.get("path"), str)
|
||||
or not contract["path"].startswith("/")
|
||||
or not isinstance(contract.get("artifact"), str) or not contract["artifact"]
|
||||
or not isinstance(contract.get("immutable_paths"), list)
|
||||
or any(not isinstance(item, str) or not item or item.startswith("/")
|
||||
or any(part in {"", ".", ".."} for part in item.split("/"))
|
||||
for item in contract["immutable_paths"])):
|
||||
raise RuntimeError(f"invalid site-publish route history in {path}")
|
||||
return {
|
||||
"path": contract["path"], "access": contract["access"],
|
||||
"artifact": contract["artifact"],
|
||||
"immutable_paths": sorted(set(contract["immutable_paths"])),
|
||||
}
|
||||
|
||||
|
||||
def previous_route_contracts(app_dir):
|
||||
"""Read bucket-keyed route history from generated Ingresses."""
|
||||
history_path = app_dir / "site-publish-history.yaml"
|
||||
if history_path.exists():
|
||||
document = yaml.safe_load(history_path.read_text())
|
||||
if (not isinstance(document, dict) or set(document) != {"version", "buckets"}
|
||||
or document["version"] != 1 or not isinstance(document["buckets"], dict)):
|
||||
raise RuntimeError(f"invalid site-publish route history in {history_path}")
|
||||
return {
|
||||
bucket: _validate_route_contract(bucket, contract, history_path)
|
||||
for bucket, contract in document["buckets"].items()
|
||||
}
|
||||
contracts = {}
|
||||
manifests = app_dir / "manifests"
|
||||
if not manifests.exists():
|
||||
return contracts
|
||||
for path in sorted(manifests.glob("ingress*.yaml")):
|
||||
document = yaml.safe_load(path.read_text()) or {}
|
||||
annotations = document.get("metadata", {}).get("annotations", {})
|
||||
artifact = annotations.get("site-publish.fritzlab.net/artifact")
|
||||
access = annotations.get("site-publish.fritzlab.net/access")
|
||||
bucket = annotations.get("site-publish.fritzlab.net/bucket")
|
||||
immutable_paths_json = annotations.get("site-publish.fritzlab.net/immutable-paths")
|
||||
route_path = annotations.get("site-publish.fritzlab.net/route-path")
|
||||
values = (artifact, access, bucket, immutable_paths_json, route_path)
|
||||
if all(value is None for value in values):
|
||||
continue
|
||||
if (not all(isinstance(value, str) for value in values)
|
||||
or access not in {"public", "protected"} or not route_path.startswith("/")):
|
||||
raise RuntimeError(f"invalid site-publish route history in {path}")
|
||||
try:
|
||||
immutable_paths = json.loads(immutable_paths_json)
|
||||
except json.JSONDecodeError as exc:
|
||||
raise RuntimeError(f"invalid site-publish route history in {path}") from exc
|
||||
if not isinstance(immutable_paths, list) or any(not isinstance(item, str) for item in immutable_paths):
|
||||
raise RuntimeError(f"invalid site-publish route history in {path}")
|
||||
if bucket in contracts:
|
||||
raise RuntimeError(f"duplicate site-publish route history for bucket {bucket}")
|
||||
contracts[bucket] = _validate_route_contract(bucket, {
|
||||
"path": route_path, "access": access, "artifact": artifact,
|
||||
"immutable_paths": immutable_paths,
|
||||
}, path)
|
||||
return contracts
|
||||
|
||||
|
||||
def validate_route_migrations(cfg, previous_contracts):
|
||||
artifacts = {artifact["name"]: artifact for artifact in cfg["artifacts"]}
|
||||
for route in cfg["routes"]:
|
||||
artifact = artifacts[route["artifact"]]
|
||||
previous = previous_contracts.get(artifact["bucket"])
|
||||
if (previous and previous["access"] == "protected"
|
||||
and route["access"] in {"public", "legacy"}
|
||||
):
|
||||
raise RuntimeError(
|
||||
f"artifact {route['artifact']} cannot become public while reusing protected "
|
||||
f"bucket {artifact['bucket']}"
|
||||
)
|
||||
|
||||
|
||||
def deploy_static(site_name, site_dir, action_dir, token, cfg):
|
||||
@@ -541,33 +295,16 @@ def deploy_static(site_name, site_dir, action_dir, token, cfg):
|
||||
validate_publication_environment(cfg)
|
||||
for artifact in cfg["artifacts"]:
|
||||
validate_artifact_output(site_dir, artifact)
|
||||
apps_dir = clone_apps(token)
|
||||
app_dir = apps_dir / "sjc001" / "websites" / site_name
|
||||
manifests_dir = app_dir / "manifests"
|
||||
previous_contracts = previous_route_contracts(app_dir)
|
||||
validate_route_migrations(cfg, previous_contracts)
|
||||
# Complete immutable work across the whole publication before any route's
|
||||
# mutable pointers can change. Partial immutable success is safe; mixing a
|
||||
# new route with an old route after a later immutable failure is not.
|
||||
for route in cfg["routes"]:
|
||||
publish_route_immutables(
|
||||
artifact_by_name[route["artifact"]], route, site_dir, credential_env_names,
|
||||
)
|
||||
# Reconcile every browser-read policy before publishing mutable content.
|
||||
# A CORS failure therefore cannot leave a new channel pointing at a release
|
||||
# whose cross-origin assets browsers cannot consume.
|
||||
reconcile_artifact_cors(cfg["artifacts"], credential_env_names)
|
||||
for route in cfg["routes"]:
|
||||
s3_sync(
|
||||
artifact_by_name[route["artifact"]], route, site_dir, credential_env_names,
|
||||
previous_contracts.get(artifact_by_name[route["artifact"]]["bucket"]),
|
||||
)
|
||||
s3_sync(artifact_by_name[route["artifact"]], route, site_dir, credential_env_names)
|
||||
if cfg["compatibility"]:
|
||||
ensure_bucket_aliases(site_name, cfg["aliases"], os.environ.get("GARAGE_ADMIN_TOKEN"))
|
||||
|
||||
render_site_manifests(
|
||||
site_name, action_dir, app_dir, manifests_dir, cfg, previous_contracts,
|
||||
)
|
||||
apps_dir = clone_apps(token)
|
||||
app_dir = apps_dir / "sjc001" / "websites" / site_name
|
||||
manifests_dir = app_dir / "manifests"
|
||||
|
||||
render_site_manifests(site_name, action_dir, app_dir, manifests_dir, cfg)
|
||||
|
||||
commit_and_push(apps_dir, f"Deploy {site_name}", token)
|
||||
|
||||
|
||||
+2
-82
@@ -1,6 +1,5 @@
|
||||
"""Shared utilities for the site-publish action."""
|
||||
|
||||
import ipaddress
|
||||
import os
|
||||
import re
|
||||
import shutil
|
||||
@@ -105,55 +104,6 @@ def _strings(value, label):
|
||||
return values
|
||||
|
||||
|
||||
def _cors_origins(value, label):
|
||||
origins = _list(value, label)
|
||||
if any(not isinstance(item, str) or not item for item in origins):
|
||||
raise ConfigError(f"{label} must be a list of non-empty strings")
|
||||
canonical = []
|
||||
for origin in origins:
|
||||
if origin == "*":
|
||||
canonical.append(origin)
|
||||
continue
|
||||
parsed = urlparse(origin)
|
||||
try:
|
||||
port = parsed.port
|
||||
except ValueError:
|
||||
raise ConfigError(f"{label} must contain '*' or canonical HTTPS origins") from None
|
||||
if parsed.scheme != "https" or not parsed.hostname or parsed.path or parsed.params or (
|
||||
parsed.query or parsed.fragment or parsed.username or parsed.password
|
||||
):
|
||||
raise ConfigError(f"{label} must contain '*' or canonical HTTPS origins")
|
||||
try:
|
||||
address = ipaddress.ip_address(parsed.hostname)
|
||||
except ValueError:
|
||||
try:
|
||||
hostname = parsed.hostname.encode("idna").decode("ascii")
|
||||
except UnicodeError:
|
||||
raise ConfigError(
|
||||
f"{label} must contain '*' or canonical HTTPS origins"
|
||||
) from None
|
||||
try:
|
||||
_hostname(hostname, f"{label} hostname")
|
||||
except ConfigError:
|
||||
raise ConfigError(
|
||||
f"{label} must contain '*' or canonical HTTPS origins"
|
||||
) from None
|
||||
else:
|
||||
if getattr(address, "scope_id", None) is not None:
|
||||
raise ConfigError(
|
||||
f"{label} must contain '*' or canonical HTTPS origins"
|
||||
)
|
||||
hostname = f"[{address.compressed}]" if address.version == 6 else address.compressed
|
||||
canonical.append(f"https://{hostname}{f':{port}' if port not in (None, 443) else ''}")
|
||||
if len(canonical) != len(set(canonical)):
|
||||
raise ConfigError(f"{label} must not contain duplicate canonical origins")
|
||||
if "*" in canonical and len(canonical) != 1:
|
||||
raise ConfigError(f"{label} wildcard must be the only origin")
|
||||
if origins != canonical:
|
||||
raise ConfigError(f"{label} must contain '*' or canonical HTTPS origins")
|
||||
return origins
|
||||
|
||||
|
||||
def _hostname(value, label):
|
||||
if not isinstance(value, str) or len(value) > 253 or value.endswith("."):
|
||||
raise ConfigError(f"{label} must be a lowercase DNS hostname without a trailing dot")
|
||||
@@ -265,7 +215,6 @@ def _legacy_config(raw, site_name):
|
||||
"website_authority": "garage-s3.storage.svc.k8s.sjc001.fritzlab.net",
|
||||
"credentials": {"access_key_env": "AWS_ACCESS_KEY_ID", "secret_key_env": "AWS_SECRET_ACCESS_KEY"},
|
||||
"cache_rules": [{"path": "", "cache_control": DEFAULT_CACHE_CONTROL}],
|
||||
"cors_origins": None,
|
||||
}
|
||||
return {
|
||||
"version": 1,
|
||||
@@ -285,11 +234,7 @@ def _legacy_config(raw, site_name):
|
||||
def _artifact(item, index):
|
||||
label = f"artifacts[{index}]"
|
||||
item = _mapping(item, label)
|
||||
_known_keys(
|
||||
item,
|
||||
{"name", "type", "content_dir", "tidy", "excludes", "publish", "cache", "cors_origins"},
|
||||
label,
|
||||
)
|
||||
_known_keys(item, {"name", "type", "content_dir", "tidy", "excludes", "publish", "cache"}, label)
|
||||
name = item.get("name")
|
||||
if not isinstance(name, str) or not NAME_RE.fullmatch(name):
|
||||
raise ConfigError(f"{label}.name must be a DNS label")
|
||||
@@ -358,10 +303,6 @@ def _artifact(item, index):
|
||||
"website_authority": authority,
|
||||
"credentials": normalized_credentials,
|
||||
"cache_rules": cache_rules,
|
||||
"cors_origins": (
|
||||
_cors_origins(item["cors_origins"], f"{label}.cors_origins")
|
||||
if "cors_origins" in item else []
|
||||
),
|
||||
}
|
||||
|
||||
|
||||
@@ -448,10 +389,6 @@ def _validate_multi(cfg):
|
||||
raise ConfigError(f"protected route {route['name']} cannot use shared-cache max-age")
|
||||
if route["access"] == "public" and "private" in directives:
|
||||
raise ConfigError(f"public route {route['name']} cannot use private cache policy")
|
||||
if route["access"] == "protected" and "*" in artifact["cors_origins"]:
|
||||
raise ConfigError(
|
||||
f"protected route {route['name']} cannot allow wildcard CORS"
|
||||
)
|
||||
root = next(route for route in routes if route["path"] == "/")
|
||||
if any(route["access"] == "protected" for route in routes) and root["access"] == "public":
|
||||
raise ConfigError("a public '/' catch-all would expose unmatched protected content")
|
||||
@@ -490,31 +427,14 @@ def normalize_site_config(raw, site_name):
|
||||
|
||||
def validate_artifact_inputs(site_dir, cfg):
|
||||
"""Reject source containment before a public or protected build starts."""
|
||||
if cfg["compatibility"]:
|
||||
return
|
||||
root = Path(site_dir).resolve()
|
||||
sources = []
|
||||
for artifact in cfg["artifacts"]:
|
||||
declared = root
|
||||
for component in Path(artifact["content_dir"]).parts:
|
||||
declared /= component
|
||||
if declared.is_symlink():
|
||||
raise ConfigError(
|
||||
f"artifact {artifact['name']} content_dir contains symlink component: "
|
||||
f"{declared.relative_to(root)}"
|
||||
)
|
||||
source = declared.resolve()
|
||||
source = (root / artifact["content_dir"]).resolve()
|
||||
if source != root and root not in source.parents:
|
||||
raise ConfigError(
|
||||
f"artifact {artifact['name']} content_dir resolves outside the repository"
|
||||
)
|
||||
if source.exists():
|
||||
symlink = next((path for path in source.rglob("*") if path.is_symlink()), None)
|
||||
if symlink is not None:
|
||||
raise ConfigError(
|
||||
f"artifact {artifact['name']} build input contains symlink: "
|
||||
f"{symlink.relative_to(root)}"
|
||||
)
|
||||
sources.append((artifact["name"], source))
|
||||
for index, (name, source) in enumerate(sources):
|
||||
for other_name, other_source in sources[index + 1:]:
|
||||
|
||||
@@ -4,13 +4,6 @@ metadata:
|
||||
name: {{ route.resource_name }}
|
||||
namespace: {{ namespace }}
|
||||
annotations:
|
||||
{%- if not compatibility %}
|
||||
site-publish.fritzlab.net/artifact: {{ route.artifact | tojson }}
|
||||
site-publish.fritzlab.net/access: {{ route.access | tojson }}
|
||||
site-publish.fritzlab.net/bucket: {{ route.artifact_config.bucket | tojson }}
|
||||
site-publish.fritzlab.net/immutable-paths: {{ route.immutable_paths_json | tojson }}
|
||||
site-publish.fritzlab.net/route-path: {{ route.path | tojson }}
|
||||
{%- endif %}
|
||||
traefik.ingress.kubernetes.io/router.middlewares: https-redirect@file,retry-upstream@file{% if route.access_middleware %},{{ route.access_middleware }}@file{% endif %}{% for m in route.middlewares %},{{ m }}@file{% endfor %}
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
|
||||
Vendored
-1
@@ -15,7 +15,6 @@ artifacts:
|
||||
- name: distributions
|
||||
type: static
|
||||
content_dir: dist
|
||||
cors_origins: ['*']
|
||||
publish:
|
||||
bucket: baseline-dist
|
||||
credentials:
|
||||
|
||||
+2
-400
@@ -113,69 +113,6 @@ class ConfigContractTests(unittest.TestCase):
|
||||
self.assertEqual(["/dist", "/"], [route["path"] for route in cfg["routes"]])
|
||||
credentials = {artifact["name"]: artifact["credentials"] for artifact in cfg["artifacts"]}
|
||||
self.assertNotEqual(credentials["distributions"], credentials["portal"])
|
||||
distributions = next(
|
||||
artifact for artifact in cfg["artifacts"] if artifact["name"] == "distributions"
|
||||
)
|
||||
self.assertEqual(["*"], distributions["cors_origins"])
|
||||
|
||||
def test_cors_origins_are_https_origins_or_wildcard(self):
|
||||
self.assert_invalid(
|
||||
lambda raw: raw["artifacts"][1].__setitem__(
|
||||
"cors_origins", ["http://consumer.example"]
|
||||
),
|
||||
"must contain '\\*' or canonical HTTPS origins",
|
||||
)
|
||||
for origin in (
|
||||
"https://consumer example",
|
||||
"https://Consumer.example",
|
||||
"https://consumer.example:443",
|
||||
"https://consumer.example/",
|
||||
"https://consumer.example:invalid",
|
||||
"https://[fe80::1%eth0]",
|
||||
"https://[fe80::1%25eth0]",
|
||||
):
|
||||
with self.subTest(origin=origin):
|
||||
self.assert_invalid(
|
||||
lambda raw, origin=origin: raw["artifacts"][1].__setitem__(
|
||||
"cors_origins", [origin]
|
||||
),
|
||||
"must contain '\\*' or canonical HTTPS origins",
|
||||
)
|
||||
self.assert_invalid(
|
||||
lambda raw: raw["artifacts"][1].__setitem__(
|
||||
"cors_origins", ["https://consumer.example", "https://consumer.example:443"]
|
||||
),
|
||||
"must not contain duplicate canonical origins",
|
||||
)
|
||||
self.assert_invalid(
|
||||
lambda raw: raw["artifacts"][1].__setitem__(
|
||||
"cors_origins", ["*", "https://consumer.example"]
|
||||
),
|
||||
"wildcard must be the only origin",
|
||||
)
|
||||
raw = copy.deepcopy(self.raw)
|
||||
raw["artifacts"][1]["cors_origins"] = ["https://[2602:817:3000::1]:8443"]
|
||||
cfg = normalize_site_config(raw, "baseline.fritzlab.net")
|
||||
self.assertEqual(
|
||||
["https://[2602:817:3000::1]:8443"],
|
||||
next(a for a in cfg["artifacts"] if a["name"] == "distributions")["cors_origins"],
|
||||
)
|
||||
|
||||
def test_declared_cors_origins_must_be_a_list(self):
|
||||
for value in (None, False, 0, "", {}):
|
||||
with self.subTest(value=value):
|
||||
self.assert_invalid(
|
||||
lambda raw, value=value: raw["artifacts"][1].__setitem__(
|
||||
"cors_origins", value
|
||||
),
|
||||
"cors_origins must be a list",
|
||||
)
|
||||
|
||||
def test_protected_route_rejects_wildcard_cors(self):
|
||||
self.assert_invalid(
|
||||
lambda raw: raw["artifacts"][0].__setitem__("cors_origins", ["*"]),
|
||||
"protected route portal cannot allow wildcard CORS",
|
||||
)
|
||||
|
||||
def test_equivalent_route_paths_are_ambiguous(self):
|
||||
self.assert_invalid(lambda raw: raw["routes"].append({
|
||||
@@ -194,7 +131,6 @@ class ConfigContractTests(unittest.TestCase):
|
||||
raw["routes"][1]["access"] = {
|
||||
"mode": "protected", "middleware": "authentik-forwardauth"
|
||||
}
|
||||
raw["artifacts"][1]["cors_origins"] = []
|
||||
raw["artifacts"][0]["cache"]["rules"][0]["cache_control"] = (
|
||||
"public, max-age=0, must-revalidate"
|
||||
)
|
||||
@@ -283,27 +219,6 @@ class ConfigContractTests(unittest.TestCase):
|
||||
with self.assertRaisesRegex(ConfigError, "build inputs overlap after resolution"):
|
||||
validate_artifact_inputs(root, cfg)
|
||||
|
||||
def test_descendant_symlink_cannot_cross_artifact_boundary(self):
|
||||
cfg = normalize_site_config(self.raw, "baseline.fritzlab.net")
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
(root / "dist").mkdir()
|
||||
(root / "portal" / "build").mkdir(parents=True)
|
||||
(root / "portal" / "build" / "private.txt").write_text("private")
|
||||
(root / "dist" / "portal-link").symlink_to(root / "portal" / "build")
|
||||
with self.assertRaisesRegex(ConfigError, "build input contains symlink"):
|
||||
validate_artifact_inputs(root, cfg)
|
||||
|
||||
def test_artifact_root_symlink_is_rejected_before_resolution(self):
|
||||
cfg = normalize_site_config(self.raw, "baseline.fritzlab.net")
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
(root / "dist-real").mkdir()
|
||||
(root / "dist").symlink_to(root / "dist-real")
|
||||
(root / "portal" / "build").mkdir(parents=True)
|
||||
with self.assertRaisesRegex(ConfigError, "content_dir contains symlink component"):
|
||||
validate_artifact_inputs(root, cfg)
|
||||
|
||||
|
||||
class GenerationTests(unittest.TestCase):
|
||||
def render(self, raw):
|
||||
@@ -327,7 +242,6 @@ class GenerationTests(unittest.TestCase):
|
||||
"app.yaml", "manifests/certificate.yaml", "manifests/ingress-distributions.yaml",
|
||||
"manifests/ingress-portal.yaml", "manifests/kustomization.yaml",
|
||||
"manifests/service-distributions.yaml", "manifests/service-portal.yaml",
|
||||
"site-publish-history.yaml",
|
||||
}, set(files))
|
||||
for content in files.values():
|
||||
self.assertIsNotNone(yaml.safe_load(content))
|
||||
@@ -338,17 +252,6 @@ class GenerationTests(unittest.TestCase):
|
||||
self.assertNotIn("passhostheader", files["manifests/ingress-portal.yaml"])
|
||||
self.assertIn("baseline-dist.web.sjc001.fritzlab.net", files["manifests/service-distributions.yaml"])
|
||||
|
||||
def test_yaml_ambiguous_artifact_name_stays_a_string_annotation(self):
|
||||
raw = fixture("split-site.yaml")
|
||||
raw["artifacts"][0]["name"] = "yes"
|
||||
raw["routes"][0]["artifact"] = "yes"
|
||||
tmp, _, files = self.render(raw)
|
||||
self.addCleanup(tmp.cleanup)
|
||||
ingress = yaml.safe_load(files["manifests/ingress-portal.yaml"])
|
||||
self.assertEqual(
|
||||
"yes", ingress["metadata"]["annotations"]["site-publish.fritzlab.net/artifact"],
|
||||
)
|
||||
|
||||
def test_generation_is_deterministic_when_input_lists_are_reversed(self):
|
||||
raw = fixture("split-site.yaml")
|
||||
first_tmp, _, first = self.render(raw)
|
||||
@@ -372,14 +275,12 @@ class GenerationTests(unittest.TestCase):
|
||||
self.assertFalse(stale.exists())
|
||||
|
||||
def test_legacy_names_and_garage_s3_target_are_preserved(self):
|
||||
tmp, app_dir, files = self.render(fixture("legacy-site.yaml"))
|
||||
tmp, _, files = self.render(fixture("legacy-site.yaml"))
|
||||
self.addCleanup(tmp.cleanup)
|
||||
self.assertIn("manifests/service.yaml", files)
|
||||
self.assertIn("manifests/ingress.yaml", files)
|
||||
self.assertIn("garage-s3.storage.svc.k8s.sjc001.fritzlab.net", files["manifests/service.yaml"])
|
||||
self.assertNotIn("passhostheader", files["manifests/ingress.yaml"])
|
||||
self.assertNotIn("site-publish.fritzlab.net", files["manifests/ingress.yaml"])
|
||||
self.assertEqual({}, deploy.previous_route_contracts(app_dir))
|
||||
|
||||
|
||||
class BuildTests(unittest.TestCase):
|
||||
@@ -405,75 +306,6 @@ class BuildTests(unittest.TestCase):
|
||||
|
||||
|
||||
class PublishingTests(unittest.TestCase):
|
||||
def test_cors_policy_is_reconciled_as_read_only_browser_access(self):
|
||||
captured = {}
|
||||
|
||||
def capture(command, **_kwargs):
|
||||
config_path = command[command.index("--cors-configuration") + 1]
|
||||
captured["command"] = command
|
||||
captured["config"] = json.loads(Path(config_path.removeprefix("file://")).read_text())
|
||||
|
||||
with patch.object(deploy, "run", side_effect=capture):
|
||||
deploy.configure_cors(
|
||||
"baseline-dist", ["*"], "http://garage-s3.storage.svc:3900", {}
|
||||
)
|
||||
|
||||
self.assertIn("put-bucket-cors", captured["command"])
|
||||
self.assertEqual(["GET", "HEAD"], captured["config"]["CORSRules"][0]["AllowedMethods"])
|
||||
self.assertEqual(["*"], captured["config"]["CORSRules"][0]["AllowedOrigins"])
|
||||
|
||||
def test_empty_cors_policy_removes_stale_bucket_cors(self):
|
||||
with patch.object(deploy, "run") as request:
|
||||
deploy.configure_cors(
|
||||
"baseline-catalogue", [], "http://garage-s3.storage.svc:3900", {}
|
||||
)
|
||||
self.assertIn("delete-bucket-cors", request.call_args.args[0])
|
||||
|
||||
def test_cors_reconciliation_restores_prior_policies_on_failure(self):
|
||||
artifacts = [
|
||||
{
|
||||
"bucket": "first", "cors_origins": ["https://new.example"],
|
||||
"s3_endpoint": "http://garage-s3.storage.svc:3900", "credentials": {},
|
||||
},
|
||||
{
|
||||
"bucket": "second", "cors_origins": [],
|
||||
"s3_endpoint": "http://garage-s3.storage.svc:3900", "credentials": {},
|
||||
},
|
||||
]
|
||||
prior = [
|
||||
{"CORSRules": [{"AllowedOrigins": ["https://old.example"]}]},
|
||||
None,
|
||||
]
|
||||
writes = []
|
||||
|
||||
def write(bucket, config, *_args):
|
||||
writes.append((bucket, config))
|
||||
if bucket == "second" and len(writes) == 2:
|
||||
raise RuntimeError("write failed")
|
||||
|
||||
with patch.object(deploy, "publication_aws_env", return_value={}), patch.object(
|
||||
deploy, "get_cors_configuration", side_effect=prior,
|
||||
) as read, patch.object(deploy, "set_cors_configuration", side_effect=write), \
|
||||
self.assertRaisesRegex(RuntimeError, "write failed"):
|
||||
deploy.reconcile_artifact_cors(artifacts)
|
||||
|
||||
self.assertEqual(2, read.call_count)
|
||||
self.assertEqual(
|
||||
[
|
||||
("first", {"CORSRules": [{
|
||||
"AllowedOrigins": ["https://new.example"],
|
||||
"AllowedMethods": ["GET", "HEAD"],
|
||||
"AllowedHeaders": ["*"],
|
||||
"ExposeHeaders": ["ETag"],
|
||||
"MaxAgeSeconds": 3600,
|
||||
}]}),
|
||||
("second", None),
|
||||
("second", None),
|
||||
("first", prior[0]),
|
||||
],
|
||||
writes,
|
||||
)
|
||||
|
||||
def test_apps_clone_never_places_token_in_argv_or_log(self):
|
||||
calls = []
|
||||
secret = "clone-secret-must-not-appear"
|
||||
@@ -563,7 +395,6 @@ class PublishingTests(unittest.TestCase):
|
||||
}, clear=False), patch.object(deploy, "run", side_effect=capture), \
|
||||
patch.object(deploy, "publish_immutable_rule", side_effect=publish_immutable) as immutable_publish, \
|
||||
redirect_stdout(output):
|
||||
deploy.publish_route_immutables(artifact, route, root)
|
||||
deploy.s3_sync(artifact, route, root)
|
||||
|
||||
self.assertTrue(all(secret not in " ".join(command) for command, _ in commands))
|
||||
@@ -574,8 +405,7 @@ class PublishingTests(unittest.TestCase):
|
||||
rendered = [" ".join(command) for command, _ in commands]
|
||||
self.assertIn("s3://baseline-dist/dist/", rendered[0])
|
||||
self.assertIn("releases/*", rendered[0])
|
||||
self.assertNotIn("--delete", rendered[0])
|
||||
self.assertIn("--delete", rendered[1])
|
||||
self.assertIn("--delete", rendered[0])
|
||||
self.assertTrue(all("s3://baseline-dist/dist/" in command for command in rendered[1:]))
|
||||
self.assertTrue(any("channels/" in command and
|
||||
"public, max-age=0, must-revalidate" in command
|
||||
@@ -586,234 +416,6 @@ class PublishingTests(unittest.TestCase):
|
||||
immutable_publish.call_args.args[2]["cache_control"],
|
||||
)
|
||||
|
||||
def test_root_move_preserves_only_actual_retired_immutable_prefix(self):
|
||||
cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
|
||||
artifact = next(item for item in cfg["artifacts"] if item["name"] == "distributions")
|
||||
route = {**next(item for item in cfg["routes"] if item["artifact"] == "distributions"),
|
||||
"path": "/"}
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
html = root / artifact["build_dir"]
|
||||
(html / "releases").mkdir(parents=True)
|
||||
(html / "channels").mkdir()
|
||||
(html / "docs" / "releases").mkdir(parents=True)
|
||||
(html / "channels" / "stable.json").write_text("channel")
|
||||
(html / "docs" / "releases" / "index.html").write_text("mutable")
|
||||
commands = []
|
||||
with patch.dict(os.environ, {
|
||||
"DIST_S3_ACCESS_KEY": "dist-key", "DIST_S3_SECRET_KEY": "dist-secret"
|
||||
}, clear=False), patch.object(
|
||||
deploy, "run", side_effect=lambda command, **_: commands.append(command)
|
||||
):
|
||||
deploy.s3_sync(artifact, route, root, previous_contract={
|
||||
"path": "/foo", "access": "public", "artifact": "distributions",
|
||||
"immutable_paths": ["foo/releases"],
|
||||
})
|
||||
rendered = [" ".join(command) for command in commands]
|
||||
self.assertTrue(all("foo/releases/*" in command for command in rendered[:2]))
|
||||
self.assertTrue(all("*/releases/*" not in command for command in rendered))
|
||||
|
||||
def test_protected_bucket_cannot_become_public_across_deployments(self):
|
||||
cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
|
||||
previous = {
|
||||
"baseline-dist": {
|
||||
"path": "/dist", "access": "protected", "artifact": "old-name",
|
||||
"immutable_paths": ["dist/releases"],
|
||||
}
|
||||
}
|
||||
with self.assertRaisesRegex(RuntimeError, "cannot become public while reusing protected"):
|
||||
deploy.validate_route_migrations(cfg, previous)
|
||||
renamed = copy.deepcopy(cfg)
|
||||
artifact = next(item for item in renamed["artifacts"] if item["name"] == "distributions")
|
||||
artifact["name"] = "downloads"
|
||||
route = next(item for item in renamed["routes"] if item["artifact"] == "distributions")
|
||||
route["artifact"] = "downloads"
|
||||
with self.assertRaisesRegex(RuntimeError, "cannot become public while reusing protected"):
|
||||
deploy.validate_route_migrations(renamed, previous)
|
||||
previous = {"retired-protected-bucket": previous["baseline-dist"]}
|
||||
deploy.validate_route_migrations(cfg, previous)
|
||||
|
||||
def test_protected_split_bucket_cannot_become_legacy_public(self):
|
||||
cfg = normalize_site_config(fixture("legacy-site.yaml"), "baseline.fritzlab.net")
|
||||
previous = {
|
||||
"baseline.fritzlab.net": {
|
||||
"path": "/portal", "access": "protected", "artifact": "portal",
|
||||
"immutable_paths": [],
|
||||
}
|
||||
}
|
||||
with self.assertRaisesRegex(RuntimeError, "cannot become public while reusing protected"):
|
||||
deploy.validate_route_migrations(cfg, previous)
|
||||
|
||||
def test_removed_immutable_rule_preserves_prior_keys(self):
|
||||
cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
|
||||
artifact = next(item for item in cfg["artifacts"] if item["name"] == "distributions")
|
||||
artifact["cache_rules"] = [
|
||||
rule for rule in artifact["cache_rules"] if rule["path"] != "releases"
|
||||
]
|
||||
route = next(item for item in cfg["routes"] if item["artifact"] == "distributions")
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
html = Path(tmp)
|
||||
filters = deploy.retired_immutable_filters(artifact, route, html, {
|
||||
"path": "/dist", "access": "public", "artifact": "distributions",
|
||||
"immutable_paths": ["dist/releases"],
|
||||
})
|
||||
self.assertEqual(["--exclude", "releases/*"], filters)
|
||||
(html / "releases").mkdir()
|
||||
(html / "releases" / "replacement.js").write_text("mutable")
|
||||
with self.assertRaisesRegex(RuntimeError, "collides with retired immutable"):
|
||||
deploy.retired_immutable_filters(artifact, route, html, {
|
||||
"path": "/dist", "access": "public", "artifact": "distributions",
|
||||
"immutable_paths": ["dist/releases"],
|
||||
})
|
||||
|
||||
def test_removed_immutable_rule_remains_in_next_manifest_history(self):
|
||||
cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
|
||||
artifact = next(item for item in cfg["artifacts"] if item["name"] == "distributions")
|
||||
artifact["cache_rules"] = [
|
||||
rule for rule in artifact["cache_rules"] if rule["path"] != "releases"
|
||||
]
|
||||
previous = {
|
||||
"baseline-dist": {
|
||||
"path": "/dist", "access": "public", "artifact": "distributions",
|
||||
"immutable_paths": ["dist/releases"],
|
||||
}
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
app_dir = Path(tmp) / "app"
|
||||
manifests = app_dir / "manifests"
|
||||
deploy.render_site_manifests(
|
||||
"baseline.fritzlab.net", ROOT, app_dir, manifests, cfg, previous,
|
||||
)
|
||||
first = deploy.previous_route_contracts(app_dir)
|
||||
self.assertEqual(["dist/releases"], first["baseline-dist"]["immutable_paths"])
|
||||
deploy.render_site_manifests(
|
||||
"baseline.fritzlab.net", ROOT, app_dir, manifests, cfg, first,
|
||||
)
|
||||
second = deploy.previous_route_contracts(app_dir)
|
||||
self.assertEqual(first, second)
|
||||
|
||||
def test_protected_split_bucket_survives_absence_and_blocks_legacy(self):
|
||||
raw = fixture("split-site.yaml")
|
||||
raw["artifacts"] = [
|
||||
item for item in raw["artifacts"] if item["name"] == "distributions"
|
||||
]
|
||||
raw["routes"] = [
|
||||
item for item in raw["routes"] if item["artifact"] == "distributions"
|
||||
]
|
||||
raw["routes"][0]["path"] = "/"
|
||||
cfg = normalize_site_config(raw, "baseline.fritzlab.net")
|
||||
previous = {
|
||||
"baseline.fritzlab.net": {
|
||||
"path": "/", "access": "protected", "artifact": "portal",
|
||||
"immutable_paths": [],
|
||||
}
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
app_dir = Path(tmp) / "app"
|
||||
deploy.render_site_manifests(
|
||||
"baseline.fritzlab.net", ROOT, app_dir, app_dir / "manifests", cfg, previous,
|
||||
)
|
||||
retained = deploy.previous_route_contracts(app_dir)
|
||||
self.assertEqual(
|
||||
previous["baseline.fritzlab.net"], retained["baseline.fritzlab.net"],
|
||||
)
|
||||
legacy = normalize_site_config(
|
||||
fixture("legacy-site.yaml"), "baseline.fritzlab.net",
|
||||
)
|
||||
with self.assertRaisesRegex(RuntimeError, "cannot become public while reusing protected"):
|
||||
deploy.validate_route_migrations(legacy, retained)
|
||||
|
||||
def test_malformed_persistent_history_fails_closed(self):
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
app_dir = Path(tmp)
|
||||
(app_dir / "site-publish-history.yaml").write_text(
|
||||
"version: 1\nbuckets:\n bucket:\n path: /\n"
|
||||
" access: public\n artifact: site\n"
|
||||
" immutable_paths: [../releases]\n"
|
||||
)
|
||||
with self.assertRaisesRegex(RuntimeError, "invalid site-publish route history"):
|
||||
deploy.previous_route_contracts(app_dir)
|
||||
|
||||
def test_retired_immutable_history_survives_a_route_move(self):
|
||||
cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
|
||||
artifact = next(item for item in cfg["artifacts"] if item["name"] == "distributions")
|
||||
artifact["cache_rules"] = [
|
||||
rule for rule in artifact["cache_rules"] if rule["path"] != "releases"
|
||||
]
|
||||
route = next(item for item in cfg["routes"] if item["artifact"] == "distributions")
|
||||
route["path"] = "/"
|
||||
previous = {
|
||||
"baseline-dist": {
|
||||
"path": "/foo", "access": "public", "artifact": "distributions",
|
||||
"immutable_paths": ["foo/releases"],
|
||||
}
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
app_dir = root / "app"
|
||||
manifests = app_dir / "manifests"
|
||||
app_dir.mkdir()
|
||||
deploy.render_site_manifests(
|
||||
"baseline.fritzlab.net", ROOT, app_dir, manifests, cfg, previous,
|
||||
)
|
||||
following = deploy.previous_route_contracts(app_dir)
|
||||
self.assertEqual(["foo/releases"], following["baseline-dist"]["immutable_paths"])
|
||||
html = root / "html"
|
||||
html.mkdir()
|
||||
first_filters = deploy.retired_immutable_filters(
|
||||
artifact, route, html, previous["baseline-dist"],
|
||||
)
|
||||
following_filters = deploy.retired_immutable_filters(
|
||||
artifact, route, html, following["baseline-dist"],
|
||||
)
|
||||
self.assertEqual(["--exclude", "foo/releases/*"], first_filters)
|
||||
self.assertEqual(first_filters, following_filters)
|
||||
|
||||
def test_later_route_immutable_failure_stops_all_mutable_publication(self):
|
||||
cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
with patch.object(deploy, "validate_publication_environment"), \
|
||||
patch.object(deploy, "validate_artifact_output"), \
|
||||
patch.object(deploy, "clone_apps", return_value=root / "apps"), patch.object(
|
||||
deploy, "publish_route_immutables",
|
||||
side_effect=[None, RuntimeError("immutable failed")],
|
||||
) as immutable_publish, patch.object(
|
||||
deploy, "reconcile_artifact_cors"
|
||||
) as cors_reconcile, patch.object(deploy, "s3_sync") as mutable_sync, \
|
||||
self.assertRaisesRegex(
|
||||
RuntimeError, "immutable failed"
|
||||
):
|
||||
deploy.deploy_static("baseline", root, root, "token", cfg)
|
||||
|
||||
self.assertEqual(2, immutable_publish.call_count)
|
||||
cors_reconcile.assert_not_called()
|
||||
mutable_sync.assert_not_called()
|
||||
|
||||
def test_all_cors_policies_complete_before_mutable_publication(self):
|
||||
cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
|
||||
events = []
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
apps = root / "apps"
|
||||
apps.mkdir()
|
||||
with patch.object(deploy, "validate_publication_environment"), patch.object(
|
||||
deploy, "validate_artifact_output"
|
||||
), patch.object(
|
||||
deploy, "publish_route_immutables", side_effect=lambda *_args: events.append("immutable")
|
||||
), patch.object(
|
||||
deploy, "reconcile_artifact_cors", side_effect=lambda *_args: events.append("cors")
|
||||
), patch.object(
|
||||
deploy, "s3_sync", side_effect=lambda *_args: events.append("mutable")
|
||||
), patch.object(deploy, "clone_apps", return_value=apps), patch.object(
|
||||
deploy, "render_site_manifests"
|
||||
), patch.object(deploy, "commit_and_push"):
|
||||
deploy.deploy_static("baseline", root, root, "token", cfg)
|
||||
|
||||
self.assertEqual(
|
||||
["immutable", "immutable", "cors", "mutable", "mutable"], events
|
||||
)
|
||||
|
||||
|
||||
def test_absent_artifact_is_detected_before_publish(self):
|
||||
cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
|
||||
|
||||
Reference in New Issue
Block a user