66 lines
6.9 KiB
TypeScript
66 lines
6.9 KiB
TypeScript
/** Explicit operator process only. No HTTP, runtime import, role provisioning or READY. */
|
|
import assert from 'node:assert/strict'
|
|
import path from 'node:path'
|
|
import {pathToFileURL} from 'node:url'
|
|
import {createPublicKey} from 'node:crypto'
|
|
import {readProtected,protectedDirectory,sha} from './writer-profile/operator-files.mjs'
|
|
import {approval,reconciliationApproval,poolOptions,roleKeys,assertJsDriverEnvironment} from './writer-profile/operator-contract.mjs'
|
|
import {deploymentRequest} from './database-writer-bootstrap-operator.mjs'
|
|
const hex=(v:unknown)=>typeof v==='string'&&/^[a-f0-9]{64}$/.test(v)
|
|
const parse=(b:Buffer)=>JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(b))
|
|
export async function main(args:string[]){
|
|
if(['maintenance-inspect','maintenance-resolve'].includes(args[0]))return (await import('./writer-profile/maintenance-resolution.mjs')).maintenanceMain(args)
|
|
const flags=['bootstrap','bootstrap-sha256','approval','approval-sha256','definition','definition-sha256','transport','transport-sha256','ca','source-registry','source-spki-sha256','journal']
|
|
assert(['publish','reconcile','preflight'].includes(args[0])&&args.length===1+2*flags.length)
|
|
assertJsDriverEnvironment(process.env)
|
|
const values=new Map<string,string>()
|
|
for(let i=1;i<args.length;i+=2){assert(args[i].startsWith('--')&&flags.includes(args[i].slice(2))&&!values.has(args[i].slice(2))&&args[i+1]);values.set(args[i].slice(2),args[i+1])}
|
|
const get=(name:string)=>values.get(name)!
|
|
for(const flag of flags.filter(f=>f.endsWith('sha256')))assert(hex(get(flag)))
|
|
const bootstrap=parse(await readProtected(get('bootstrap'),32768,get('bootstrap-sha256')))
|
|
assert(bootstrap.format==='application-writer-bootstrap-v1'&&bootstrap.publicationAuthorized===false&&bootstrap.readyAuthorized===false)
|
|
const request=deploymentRequest(bootstrap.deploymentRequest),subject=bootstrap.verificationSubject
|
|
assert(subject.installationId===request.installationId&&hex(subject.publicKeySpkiSha256)&&sha(createPublicKey(subject.publicKeyPem).export({format:'der',type:'spki'}))===subject.publicKeySpkiSha256)
|
|
const pinned=(args[0]==='reconcile'?reconciliationApproval:approval)(parse(await readProtected(get('approval'),16384,get('approval-sha256'))))
|
|
const definition=parse(await readProtected(get('definition'),4194304,get('definition-sha256')))
|
|
const transport=parse(await readProtected(get('transport'),16384,get('transport-sha256')))
|
|
const ca=await readProtected(get('ca'),65536,request.tls.caSha256)
|
|
const options=poolOptions(transport,request,ca)
|
|
await protectedDirectory(get('journal'));await protectedDirectory(get('source-registry'))
|
|
const privateKeyFile=path.join(path.dirname(get('bootstrap')),'signing-private.pem')
|
|
if(args[0]==='publish'){const key=await readProtected(privateKeyFile,8192);key.fill(0)}
|
|
// All explicit trust files are checked before app helper/PG imports. No .env URL is used.
|
|
// Existing source helper loads config/dotenv. Complete it BEFORE pg's first
|
|
// import so a newly loaded NODE_PG_FORCE_NATIVE cannot select another driver.
|
|
const {createDatabaseSourceBindingVerifier}=await import('../src/db/database-source-binding.js')
|
|
assertJsDriverEnvironment(process.env)
|
|
const [{default:pg},{createConnectedPublisher},{collectSource44Catalogue,approvedDefinition}]=await Promise.all([
|
|
import('pg'),import('./writer-profile/publisher.mjs'),import('./writer-profile/catalogue.mjs')])
|
|
assertJsDriverEnvironment(process.env)
|
|
assert.equal(approvedDefinition(definition),pinned.definitionSha256)
|
|
const installation=Object.freeze({...subject,roles:Object.fromEntries(roleKeys.map(k=>[k,request.roles[k].signedOid])),roleBindings:request.roles,expectedSource:request.source})
|
|
const sourcePin={registryDirectory:get('source-registry'),installationId:subject.installationId,publicKeySpkiSha256:get('source-spki-sha256'),currentHeadSha256:request.sourceHeadSha256}
|
|
// Preflight is the read-only lifecycle entry for protected registry evidence.
|
|
// A refused protection check never falls back to the signature-only verifier.
|
|
const verifier=args[0]==='preflight'
|
|
?(await import('./writer-profile/protected-source-registry.mjs')).createProtectedDatabaseSourceBindingVerifier(sourcePin)
|
|
:createDatabaseSourceBindingVerifier(sourcePin)
|
|
const publisher=createConnectedPublisher(installation,(s:Parameters<typeof collectSource44Catalogue>[0])=>collectSource44Catalogue(s,installation),verifier,pinned)
|
|
const pool=new pg.Pool(options)
|
|
// A pool-level async error never becomes raw stdout or a retry signal.
|
|
let asyncFailure=false;pool.on('error',()=>{asyncFailure=true})
|
|
let result,primary:unknown,failed=false
|
|
try{result=args[0]==='preflight'?await publisher.preflightCurrentProfile(pool,{deadlineAt:Date.now()+120000}):args[0]==='reconcile'?await publisher.reconcilePendingPublication(pool,{journalDirectory:get('journal'),deadlineAt:Date.now()+120000}):await publisher.publishCurrentProfile(pool,{privateKeyFile,expectedHeadSha256:pinned.expectedHeadSha256,journalDirectory:get('journal'),validityMs:pinned.validityMs,deadlineAt:Date.now()+120000})}
|
|
catch(error){primary=error;failed=true}
|
|
try{await pool.end()}catch(error){primary??=error;failed=true}
|
|
if(args[0]==='preflight'&&result?.state==='matched'&&result.platformProtectionVerified===true&&!failed&&!asyncFailure)return {event:'application-writer-profile-preflight',outcome:'matched',epoch:result.epoch,headSha256:result.headSha256,notAfter:result.notAfter,sourceMatched:true,rolesMatched:true,catalogueMatched:true,platformProtectionVerified:true,writerAuthorized:false,cleanupUnconfirmed:false,automaticReplay:false,generationAuthenticated:false,readyAuthorized:false}
|
|
if(result?.outcome==='committed')return {event:'application-writer-profile-publication',outcome:'committed',epoch:result.epoch,headSha256:result.headSha256,notAfter:result.notAfter,
|
|
cleanupUnconfirmed:result.cleanupUnconfirmed||asyncFailure||failed,journalUnconfirmed:!!result.journalUnconfirmed,automaticReplay:false,generationAuthenticated:false,readyAuthorized:false}
|
|
if(args[0]==='reconcile'&&result&&!failed&&!asyncFailure&&['idle','confirmed','not-committed'].includes(result.state))return {event:'application-writer-profile-reconciliation',outcome:result.state,headSha256:result.headSha256??null,cleanupUnconfirmed:false,journalUnconfirmed:false,automaticReplay:false,generationAuthenticated:false,readyAuthorized:false}
|
|
throw primary??Error('Publisher terminal unconfirmed')
|
|
}
|
|
if(process.argv[1]&&import.meta.url===pathToFileURL(path.resolve(process.argv[1])).href){
|
|
try{const result=await main(process.argv.slice(2));console.log(JSON.stringify(result));if(result.cleanupUnconfirmed||result.journalUnconfirmed)process.exitCode=2}
|
|
catch{console.error(JSON.stringify({event:['maintenance-inspect','maintenance-resolve'].includes(process.argv[2])?'database-maintenance-command-refused':'application-writer-profile-publication-refused',automaticReplay:false,inspectPendingBeforeRetry:true,readyAuthorized:false}));process.exitCode=1}
|
|
}
|