Spaces:
Running
Running
Deploy Aureon OS (deploy/selfhost stack: nginx edge + fusion API x2 + console + HNC organ + redis + postgres; paper mode) (part 9)
002f18c verified | import fs from "node:fs"; | |
| import path from "node:path"; | |
| import { fileURLToPath, pathToFileURL } from "node:url"; | |
| const EXPECTED_RATE_LIMITS = new Map([ | |
| ["API_PREAUTH_RATE_LIMITER", { limit: 20, period: 60 }], | |
| ["API_RATE_LIMITER", { limit: 60, period: 60 }], | |
| ]); | |
| export class DeploymentPreflightError extends Error { | |
| constructor(message) { | |
| super(message); | |
| this.name = "DeploymentPreflightError"; | |
| } | |
| } | |
| export function validateDeploymentEnvironment(env = {}) { | |
| const accessSecret = env.AUREON_WORKER_ACCESS_SECRET; | |
| if ( | |
| typeof accessSecret !== "string" | |
| || !accessSecret | |
| || accessSecret !== accessSecret.trim() | |
| || Buffer.byteLength(accessSecret, "utf8") < 32 | |
| ) { | |
| throw new DeploymentPreflightError( | |
| "AUREON_WORKER_ACCESS_SECRET must be trimmed and at least 32 UTF-8 bytes.", | |
| ); | |
| } | |
| const rawOrigins = env.AUREON_ALLOWED_ORIGINS; | |
| if (typeof rawOrigins !== "string" || !rawOrigins) { | |
| throw new DeploymentPreflightError( | |
| "AUREON_ALLOWED_ORIGINS must contain at least one exact HTTPS origin.", | |
| ); | |
| } | |
| const origins = rawOrigins.split(","); | |
| const uniqueOrigins = new Set(); | |
| for (let index = 0; index < origins.length; index += 1) { | |
| const candidate = origins[index]; | |
| if (!candidate || candidate !== candidate.trim() || candidate === "*") { | |
| throw new DeploymentPreflightError( | |
| `AUREON_ALLOWED_ORIGINS entry ${index + 1} is not an exact HTTPS origin.`, | |
| ); | |
| } | |
| try { | |
| const parsed = new URL(candidate); | |
| if (parsed.protocol !== "https:" || parsed.origin !== candidate) { | |
| throw new Error("not canonical"); | |
| } | |
| } catch { | |
| throw new DeploymentPreflightError( | |
| `AUREON_ALLOWED_ORIGINS entry ${index + 1} is not an exact HTTPS origin.`, | |
| ); | |
| } | |
| if (uniqueOrigins.has(candidate)) { | |
| throw new DeploymentPreflightError( | |
| `AUREON_ALLOWED_ORIGINS entry ${index + 1} is duplicated.`, | |
| ); | |
| } | |
| uniqueOrigins.add(candidate); | |
| } | |
| const paidProviders = env.AUREON_ALLOW_PAID_PROVIDERS; | |
| if (paidProviders !== undefined && paidProviders !== "true") { | |
| throw new DeploymentPreflightError( | |
| "AUREON_ALLOW_PAID_PROVIDERS must be omitted or exactly true.", | |
| ); | |
| } | |
| return { | |
| originCount: uniqueOrigins.size, | |
| paidProvidersEnabled: paidProviders === "true", | |
| }; | |
| } | |
| export function validateWranglerRateLimits(config) { | |
| if (!config || typeof config !== "object" || Array.isArray(config)) { | |
| throw new DeploymentPreflightError("Wrangler configuration must be an object."); | |
| } | |
| if ( | |
| config.vars | |
| && Object.prototype.hasOwnProperty.call(config.vars, "AUREON_WORKER_ACCESS_SECRET") | |
| ) { | |
| throw new DeploymentPreflightError( | |
| "AUREON_WORKER_ACCESS_SECRET must be a provider secret, not a Wrangler vars value.", | |
| ); | |
| } | |
| if (!Array.isArray(config.ratelimits)) { | |
| throw new DeploymentPreflightError("Wrangler rate-limit bindings are missing."); | |
| } | |
| for (const [name, expected] of EXPECTED_RATE_LIMITS) { | |
| const matches = config.ratelimits.filter((entry) => entry?.name === name); | |
| if (matches.length !== 1) { | |
| throw new DeploymentPreflightError( | |
| `Wrangler must define exactly one ${name} rate-limit binding.`, | |
| ); | |
| } | |
| const binding = matches[0]; | |
| if (typeof binding.namespace_id !== "string" || !binding.namespace_id.trim()) { | |
| throw new DeploymentPreflightError(`${name} must have a namespace_id.`); | |
| } | |
| if ( | |
| binding.simple?.limit !== expected.limit | |
| || binding.simple?.period !== expected.period | |
| ) { | |
| throw new DeploymentPreflightError( | |
| `${name} must use limit ${expected.limit} and period ${expected.period}.`, | |
| ); | |
| } | |
| } | |
| return { bindingCount: EXPECTED_RATE_LIMITS.size }; | |
| } | |
| export function loadWranglerConfig(configPath) { | |
| let source; | |
| try { | |
| source = fs.readFileSync(configPath, "utf8").replace(/^\uFEFF/, ""); | |
| } catch { | |
| throw new DeploymentPreflightError("Wrangler configuration could not be read."); | |
| } | |
| try { | |
| return JSON.parse(source); | |
| } catch { | |
| throw new DeploymentPreflightError( | |
| "Wrangler configuration must remain JSON-compatible JSONC for offline validation.", | |
| ); | |
| } | |
| } | |
| export function runPreflight({ env = process.env, configPath } = {}) { | |
| const environment = validateDeploymentEnvironment(env); | |
| const rateLimits = validateWranglerRateLimits(loadWranglerConfig(configPath)); | |
| return { ...environment, ...rateLimits }; | |
| } | |
| const modulePath = fileURLToPath(import.meta.url); | |
| const invokedPath = process.argv[1] ? path.resolve(process.argv[1]) : null; | |
| if (invokedPath && pathToFileURL(invokedPath).href === import.meta.url) { | |
| const defaultConfigPath = path.resolve(path.dirname(modulePath), "..", "wrangler.jsonc"); | |
| try { | |
| const result = runPreflight({ | |
| env: process.env, | |
| configPath: process.argv[2] ? path.resolve(process.argv[2]) : defaultConfigPath, | |
| }); | |
| console.log( | |
| `Cloudflare deployment security preflight passed: ${result.originCount} origin(s), ` | |
| + `${result.bindingCount} rate-limit binding(s), paid providers ` | |
| + `${result.paidProvidersEnabled ? "enabled" : "disabled"}.`, | |
| ); | |
| } catch (error) { | |
| const message = error instanceof DeploymentPreflightError | |
| ? error.message | |
| : "unexpected validation error"; | |
| console.error(`Cloudflare deployment security preflight failed: ${message}`); | |
| process.exitCode = 1; | |
| } | |
| } | |