mirror of
https://github.com/fosrl/pangolin.git
synced 2026-10-15 00:59:04 +02:00
Export blueprint functionality
This commit is contained in:
Owen
@@ -0,0 +1,682 @@
|
||||
import { stringify as stringifyYaml } from "yaml";
|
||||
import { and, asc, eq, isNull, not, or } from "drizzle-orm";
|
||||
import {
|
||||
aiBudgets,
|
||||
aiModels,
|
||||
clients,
|
||||
clientSiteResources,
|
||||
db,
|
||||
labels,
|
||||
resourceAiModels,
|
||||
resourceHeaderAuth,
|
||||
resourceLabels,
|
||||
resourcePassword,
|
||||
resourcePincode,
|
||||
resourcePolicies,
|
||||
resourceRules,
|
||||
resources,
|
||||
resourceWhitelist,
|
||||
roles,
|
||||
roleResources,
|
||||
roleSiteResources,
|
||||
siteNetworks,
|
||||
siteResourceAiModels,
|
||||
siteResourceLabels,
|
||||
siteResources,
|
||||
sites,
|
||||
targetHealthCheck,
|
||||
targets,
|
||||
userResources,
|
||||
userSiteResources,
|
||||
users
|
||||
} from "@server/db";
|
||||
import { queryResourcePolicy } from "@server/routers/policy/getResourcePolicy";
|
||||
import {
|
||||
listPublicResourceAiProviders,
|
||||
listSiteResourceAiProviders
|
||||
} from "@server/lib/aiInferenceResource";
|
||||
|
||||
const HTTP_LIKE_PUBLIC_MODES = ["http", "ssh", "rdp", "vnc", "inference"];
|
||||
|
||||
function reverseRuleAction(action: string): "allow" | "deny" | "pass" {
|
||||
if (action === "ACCEPT") return "allow";
|
||||
if (action === "PASS") return "pass";
|
||||
return "deny";
|
||||
}
|
||||
|
||||
function reverseRuleMatch(match: string): string {
|
||||
return match.toLowerCase();
|
||||
}
|
||||
|
||||
function stripUndefined<T extends Record<string, any>>(obj: T): T {
|
||||
for (const key of Object.keys(obj)) {
|
||||
if (obj[key] === undefined) {
|
||||
delete obj[key];
|
||||
}
|
||||
}
|
||||
return obj;
|
||||
}
|
||||
|
||||
function buildHealthcheck(row: {
|
||||
hcHostname: string | null;
|
||||
hcPort: number | null;
|
||||
hcEnabled: boolean | null;
|
||||
hcPath: string | null;
|
||||
hcScheme: string | null;
|
||||
hcMode: string | null;
|
||||
hcInterval: number | null;
|
||||
hcUnhealthyInterval: number | null;
|
||||
hcTimeout: number | null;
|
||||
hcHeaders: string | null;
|
||||
hcFollowRedirects: boolean | null;
|
||||
hcMethod: string | null;
|
||||
hcStatus: number | null;
|
||||
hcHealthyThreshold: number | null;
|
||||
hcUnhealthyThreshold: number | null;
|
||||
}) {
|
||||
if (!row.hcHostname) {
|
||||
return undefined;
|
||||
}
|
||||
|
||||
let headers: { name: string; value: string }[] | undefined;
|
||||
if (row.hcHeaders) {
|
||||
try {
|
||||
headers = JSON.parse(row.hcHeaders);
|
||||
} catch {
|
||||
headers = undefined;
|
||||
}
|
||||
}
|
||||
|
||||
return stripUndefined({
|
||||
hostname: row.hcHostname,
|
||||
port: row.hcPort ?? undefined,
|
||||
enabled: row.hcEnabled ?? undefined,
|
||||
path: row.hcPath ?? undefined,
|
||||
scheme: row.hcScheme ?? undefined,
|
||||
mode: row.hcMode ?? undefined,
|
||||
interval: row.hcInterval ?? undefined,
|
||||
"unhealthy-interval": row.hcUnhealthyInterval ?? undefined,
|
||||
timeout: row.hcTimeout ?? undefined,
|
||||
headers,
|
||||
"follow-redirects": row.hcFollowRedirects ?? undefined,
|
||||
method: row.hcMethod ?? undefined,
|
||||
status: row.hcStatus ?? undefined,
|
||||
"healthy-threshold": row.hcHealthyThreshold ?? undefined,
|
||||
"unhealthy-threshold": row.hcUnhealthyThreshold ?? undefined
|
||||
});
|
||||
}
|
||||
|
||||
async function buildPublicAuthAndRules(resource: {
|
||||
resourceId: number;
|
||||
resourcePolicyId: number | null;
|
||||
defaultResourcePolicyId: number | null;
|
||||
sso: boolean | null;
|
||||
skipToIdpId: number | null;
|
||||
}): Promise<{
|
||||
policy: string | undefined;
|
||||
auth: Record<string, any> | undefined;
|
||||
rules: Record<string, any>[];
|
||||
notes: string[];
|
||||
}> {
|
||||
const notes: string[] = [];
|
||||
|
||||
if (resource.resourcePolicyId) {
|
||||
// Shared policy attached: the policy's own auth config lives on the
|
||||
// policy entity itself (edited separately). The resource only carries
|
||||
// its own overrides in the legacy resource-level tables.
|
||||
const [policyRow] = await db
|
||||
.select({ niceId: resourcePolicies.niceId })
|
||||
.from(resourcePolicies)
|
||||
.where(eq(resourcePolicies.resourcePolicyId, resource.resourcePolicyId))
|
||||
.limit(1);
|
||||
|
||||
const [roleRows, userRows, whitelistRows, ruleRows, passwordRow, pincodeRow, headerAuthRow] =
|
||||
await Promise.all([
|
||||
db
|
||||
.select({ name: roles.name })
|
||||
.from(roleResources)
|
||||
.innerJoin(
|
||||
roles,
|
||||
and(
|
||||
eq(roleResources.roleId, roles.roleId),
|
||||
or(isNull(roles.isAdmin), not(roles.isAdmin))
|
||||
)
|
||||
)
|
||||
.where(eq(roleResources.resourceId, resource.resourceId)),
|
||||
db
|
||||
.select({ username: users.username })
|
||||
.from(userResources)
|
||||
.innerJoin(users, eq(userResources.userId, users.userId))
|
||||
.where(eq(userResources.resourceId, resource.resourceId)),
|
||||
db
|
||||
.select({ email: resourceWhitelist.email })
|
||||
.from(resourceWhitelist)
|
||||
.where(eq(resourceWhitelist.resourceId, resource.resourceId)),
|
||||
db
|
||||
.select({
|
||||
enabled: resourceRules.enabled,
|
||||
priority: resourceRules.priority,
|
||||
action: resourceRules.action,
|
||||
match: resourceRules.match,
|
||||
value: resourceRules.value
|
||||
})
|
||||
.from(resourceRules)
|
||||
.where(eq(resourceRules.resourceId, resource.resourceId)),
|
||||
db
|
||||
.select({ passwordId: resourcePassword.passwordId })
|
||||
.from(resourcePassword)
|
||||
.where(eq(resourcePassword.resourceId, resource.resourceId))
|
||||
.limit(1),
|
||||
db
|
||||
.select({ pincodeId: resourcePincode.pincodeId })
|
||||
.from(resourcePincode)
|
||||
.where(eq(resourcePincode.resourceId, resource.resourceId))
|
||||
.limit(1),
|
||||
db
|
||||
.select({ headerAuthId: resourceHeaderAuth.headerAuthId })
|
||||
.from(resourceHeaderAuth)
|
||||
.where(eq(resourceHeaderAuth.resourceId, resource.resourceId))
|
||||
.limit(1)
|
||||
]);
|
||||
|
||||
if (passwordRow.length > 0) {
|
||||
notes.push(
|
||||
"A password is configured on this resource. Passwords cannot be exported for security reasons; re-set it after applying this blueprint."
|
||||
);
|
||||
}
|
||||
if (pincodeRow.length > 0) {
|
||||
notes.push(
|
||||
"A pincode is configured on this resource. Pincodes cannot be exported for security reasons; re-set it after applying this blueprint."
|
||||
);
|
||||
}
|
||||
if (headerAuthRow.length > 0) {
|
||||
notes.push(
|
||||
"Basic auth is configured on this resource. Basic auth credentials cannot be exported for security reasons; re-set it after applying this blueprint."
|
||||
);
|
||||
}
|
||||
|
||||
const auth = stripUndefined({
|
||||
"sso-enabled": resource.sso ?? undefined,
|
||||
"sso-roles": roleRows.length ? roleRows.map((r) => r.name) : undefined,
|
||||
"sso-users": userRows.length
|
||||
? userRows.map((u) => u.username)
|
||||
: undefined,
|
||||
"whitelist-users": whitelistRows.length
|
||||
? whitelistRows.map((w) => w.email)
|
||||
: undefined,
|
||||
"auto-login-idp": resource.skipToIdpId ?? undefined
|
||||
});
|
||||
|
||||
return {
|
||||
policy: policyRow?.niceId,
|
||||
auth: Object.keys(auth).length > 0 ? auth : undefined,
|
||||
rules: ruleRows.map((r) =>
|
||||
stripUndefined({
|
||||
action: reverseRuleAction(r.action),
|
||||
match: reverseRuleMatch(r.match),
|
||||
value: r.value,
|
||||
priority: r.priority,
|
||||
enabled: r.enabled
|
||||
})
|
||||
),
|
||||
notes
|
||||
};
|
||||
}
|
||||
|
||||
if (!resource.defaultResourcePolicyId) {
|
||||
return { policy: undefined, auth: undefined, rules: [], notes };
|
||||
}
|
||||
|
||||
// Inline policy: the resource's own default (non-shared) policy carries
|
||||
// all of its auth config.
|
||||
const policy = await queryResourcePolicy({
|
||||
resourcePolicyId: resource.defaultResourcePolicyId
|
||||
});
|
||||
|
||||
if (!policy) {
|
||||
return { policy: undefined, auth: undefined, rules: [], notes };
|
||||
}
|
||||
|
||||
if (policy.passwordId) {
|
||||
notes.push(
|
||||
"A password is configured on this resource. Passwords cannot be exported for security reasons; re-set it after applying this blueprint."
|
||||
);
|
||||
}
|
||||
if (policy.pincodeId) {
|
||||
notes.push(
|
||||
"A pincode is configured on this resource. Pincodes cannot be exported for security reasons; re-set it after applying this blueprint."
|
||||
);
|
||||
}
|
||||
if (policy.headerAuth?.id) {
|
||||
notes.push(
|
||||
"Basic auth is configured on this resource. Basic auth credentials cannot be exported for security reasons; re-set it after applying this blueprint."
|
||||
);
|
||||
}
|
||||
|
||||
const auth = stripUndefined({
|
||||
"sso-enabled": policy.sso ?? undefined,
|
||||
"sso-roles": policy.roles.length
|
||||
? policy.roles.map((r) => r.name)
|
||||
: undefined,
|
||||
"sso-users": policy.users.length
|
||||
? policy.users.map((u) => u.username)
|
||||
: undefined,
|
||||
"whitelist-users": policy.emailWhiteList.length
|
||||
? policy.emailWhiteList.map((w) => w.email)
|
||||
: undefined,
|
||||
"auto-login-idp": policy.idpId ?? undefined
|
||||
});
|
||||
|
||||
return {
|
||||
policy: undefined,
|
||||
auth: Object.keys(auth).length > 0 ? auth : undefined,
|
||||
rules: policy.rules.map((r) =>
|
||||
stripUndefined({
|
||||
action: reverseRuleAction(r.action),
|
||||
match: reverseRuleMatch(r.match),
|
||||
value: r.value,
|
||||
priority: r.priority,
|
||||
enabled: r.enabled
|
||||
})
|
||||
),
|
||||
notes
|
||||
};
|
||||
}
|
||||
|
||||
async function buildAiProvidersAndBudget(input:
|
||||
| { scope: "public"; resourceId: number }
|
||||
| { scope: "site"; siteResourceId: number }
|
||||
) {
|
||||
const providers =
|
||||
input.scope === "public"
|
||||
? await listPublicResourceAiProviders(input.resourceId)
|
||||
: await listSiteResourceAiProviders(input.siteResourceId);
|
||||
|
||||
const aiProvidersConfig = await Promise.all(
|
||||
providers.map(async (p) => {
|
||||
const entry: Record<string, any> = {
|
||||
provider: p.niceId,
|
||||
"access-mode": p.accessMode,
|
||||
enabled: p.enabled
|
||||
};
|
||||
|
||||
if (p.accessMode === "select") {
|
||||
const modelRows =
|
||||
input.scope === "public"
|
||||
? await db
|
||||
.select({ modelKey: aiModels.modelKey })
|
||||
.from(resourceAiModels)
|
||||
.innerJoin(
|
||||
aiModels,
|
||||
eq(resourceAiModels.modelId, aiModels.modelId)
|
||||
)
|
||||
.where(
|
||||
and(
|
||||
eq(
|
||||
resourceAiModels.resourceId,
|
||||
input.resourceId
|
||||
),
|
||||
eq(aiModels.providerId, p.providerId)
|
||||
)
|
||||
)
|
||||
: await db
|
||||
.select({ modelKey: aiModels.modelKey })
|
||||
.from(siteResourceAiModels)
|
||||
.innerJoin(
|
||||
aiModels,
|
||||
eq(siteResourceAiModels.modelId, aiModels.modelId)
|
||||
)
|
||||
.where(
|
||||
and(
|
||||
eq(
|
||||
siteResourceAiModels.siteResourceId,
|
||||
input.siteResourceId
|
||||
),
|
||||
eq(aiModels.providerId, p.providerId)
|
||||
)
|
||||
);
|
||||
|
||||
if (modelRows.length > 0) {
|
||||
entry.models = modelRows.map((m) => m.modelKey);
|
||||
}
|
||||
}
|
||||
|
||||
return entry;
|
||||
})
|
||||
);
|
||||
|
||||
const budgetRows = await db
|
||||
.select()
|
||||
.from(aiBudgets)
|
||||
.where(
|
||||
input.scope === "public"
|
||||
? eq(aiBudgets.resourceId, input.resourceId)
|
||||
: eq(aiBudgets.siteResourceId, input.siteResourceId)
|
||||
);
|
||||
|
||||
const aiBudgetConfig = budgetRows.map((b) => ({
|
||||
amount: b.amount,
|
||||
unit: b.unit,
|
||||
period: b.period,
|
||||
enforcement: b.enforcement,
|
||||
enabled: b.enabled
|
||||
}));
|
||||
|
||||
return { aiProvidersConfig, aiBudgetConfig };
|
||||
}
|
||||
|
||||
export async function generatePublicResourceBlueprintYaml(
|
||||
resourceId: number
|
||||
): Promise<{ niceId: string; contents: string }> {
|
||||
const [resource] = await db
|
||||
.select()
|
||||
.from(resources)
|
||||
.where(eq(resources.resourceId, resourceId))
|
||||
.limit(1);
|
||||
|
||||
if (!resource) {
|
||||
throw new Error(`Resource ${resourceId} not found`);
|
||||
}
|
||||
|
||||
const mode = resource.mode;
|
||||
const isHttpLike = HTTP_LIKE_PUBLIC_MODES.includes(mode);
|
||||
const isInference = mode === "inference";
|
||||
|
||||
const resourceConfig: Record<string, any> = {
|
||||
name: resource.name,
|
||||
mode,
|
||||
enabled: resource.enabled
|
||||
};
|
||||
|
||||
if (isHttpLike) {
|
||||
if (resource.fullDomain) {
|
||||
resourceConfig["full-domain"] = resource.fullDomain;
|
||||
}
|
||||
resourceConfig.ssl = resource.ssl;
|
||||
} else {
|
||||
if (resource.proxyPort) {
|
||||
resourceConfig["proxy-port"] = resource.proxyPort;
|
||||
}
|
||||
if (mode === "tcp") {
|
||||
resourceConfig["proxy-protocol"] = resource.proxyProtocol;
|
||||
resourceConfig["proxy-protocol-version"] =
|
||||
resource.proxyProtocolVersion ?? undefined;
|
||||
}
|
||||
}
|
||||
|
||||
if (resource.setHostHeader) {
|
||||
resourceConfig["host-header"] = resource.setHostHeader;
|
||||
}
|
||||
if (resource.tlsServerName) {
|
||||
resourceConfig["tls-server-name"] = resource.tlsServerName;
|
||||
}
|
||||
if (resource.requestHeaders) {
|
||||
try {
|
||||
resourceConfig.requestHeaders = JSON.parse(resource.requestHeaders);
|
||||
} catch {
|
||||
// ignore malformed stored headers
|
||||
}
|
||||
}
|
||||
if (resource.responseHeaders) {
|
||||
try {
|
||||
resourceConfig.responseHeaders = JSON.parse(resource.responseHeaders);
|
||||
} catch {
|
||||
// ignore malformed stored headers
|
||||
}
|
||||
}
|
||||
|
||||
if (mode === "ssh") {
|
||||
resourceConfig["auth-daemon"] = stripUndefined({
|
||||
pam: resource.pamMode ?? undefined,
|
||||
mode: resource.authDaemonMode ?? undefined,
|
||||
port: resource.authDaemonPort ?? undefined
|
||||
});
|
||||
}
|
||||
|
||||
if (resource.maintenanceModeEnabled) {
|
||||
resourceConfig.maintenance = stripUndefined({
|
||||
enabled: resource.maintenanceModeEnabled,
|
||||
type: resource.maintenanceModeType ?? undefined,
|
||||
title: resource.maintenanceTitle ?? undefined,
|
||||
message: resource.maintenanceMessage ?? undefined,
|
||||
"estimated-time": resource.maintenanceEstimatedTime ?? undefined
|
||||
});
|
||||
}
|
||||
|
||||
// Labels
|
||||
const labelRows = await db
|
||||
.select({ name: labels.name })
|
||||
.from(resourceLabels)
|
||||
.innerJoin(labels, eq(resourceLabels.labelId, labels.labelId))
|
||||
.where(eq(resourceLabels.resourceId, resourceId));
|
||||
if (labelRows.length > 0) {
|
||||
resourceConfig.labels = labelRows.map((l) => l.name);
|
||||
}
|
||||
|
||||
// Auth / rules / shared policy
|
||||
const { policy, auth, rules, notes } = await buildPublicAuthAndRules(
|
||||
resource
|
||||
);
|
||||
if (policy) {
|
||||
resourceConfig.policy = policy;
|
||||
}
|
||||
if (auth) {
|
||||
resourceConfig.auth = auth;
|
||||
}
|
||||
if (rules.length > 0) {
|
||||
resourceConfig.rules = rules;
|
||||
}
|
||||
|
||||
// Targets (all modes except inference use targets)
|
||||
if (!isInference) {
|
||||
const targetRows = await db
|
||||
.select({
|
||||
ip: targets.ip,
|
||||
method: targets.method,
|
||||
port: targets.port,
|
||||
enabled: targets.enabled,
|
||||
internalPort: targets.internalPort,
|
||||
path: targets.path,
|
||||
pathMatchType: targets.pathMatchType,
|
||||
rewritePath: targets.rewritePath,
|
||||
rewritePathType: targets.rewritePathType,
|
||||
priority: targets.priority,
|
||||
siteNiceId: sites.niceId,
|
||||
hcEnabled: targetHealthCheck.hcEnabled,
|
||||
hcPath: targetHealthCheck.hcPath,
|
||||
hcScheme: targetHealthCheck.hcScheme,
|
||||
hcMode: targetHealthCheck.hcMode,
|
||||
hcHostname: targetHealthCheck.hcHostname,
|
||||
hcPort: targetHealthCheck.hcPort,
|
||||
hcInterval: targetHealthCheck.hcInterval,
|
||||
hcUnhealthyInterval: targetHealthCheck.hcUnhealthyInterval,
|
||||
hcTimeout: targetHealthCheck.hcTimeout,
|
||||
hcHeaders: targetHealthCheck.hcHeaders,
|
||||
hcFollowRedirects: targetHealthCheck.hcFollowRedirects,
|
||||
hcMethod: targetHealthCheck.hcMethod,
|
||||
hcStatus: targetHealthCheck.hcStatus,
|
||||
hcHealthyThreshold: targetHealthCheck.hcHealthyThreshold,
|
||||
hcUnhealthyThreshold: targetHealthCheck.hcUnhealthyThreshold
|
||||
})
|
||||
.from(targets)
|
||||
.leftJoin(sites, eq(sites.siteId, targets.siteId))
|
||||
.leftJoin(
|
||||
targetHealthCheck,
|
||||
eq(targetHealthCheck.targetId, targets.targetId)
|
||||
)
|
||||
.where(eq(targets.resourceId, resourceId))
|
||||
.orderBy(asc(targets.targetId));
|
||||
|
||||
resourceConfig.targets = targetRows.map((row) =>
|
||||
stripUndefined({
|
||||
site: row.siteNiceId ?? undefined,
|
||||
method: mode === "http" ? row.method ?? undefined : undefined,
|
||||
hostname: row.ip,
|
||||
port: row.port,
|
||||
enabled: row.enabled,
|
||||
"internal-port": row.internalPort ?? undefined,
|
||||
path: row.path ?? undefined,
|
||||
"path-match": row.pathMatchType ?? undefined,
|
||||
"rewrite-path": row.rewritePath ?? undefined,
|
||||
"rewrite-match": row.rewritePathType ?? undefined,
|
||||
priority: row.priority,
|
||||
healthcheck: buildHealthcheck(row)
|
||||
})
|
||||
);
|
||||
} else {
|
||||
const { aiProvidersConfig, aiBudgetConfig } =
|
||||
await buildAiProvidersAndBudget({ scope: "public", resourceId });
|
||||
resourceConfig["ai-providers"] = aiProvidersConfig;
|
||||
if (aiBudgetConfig.length > 0) {
|
||||
resourceConfig["ai-budget"] = aiBudgetConfig;
|
||||
}
|
||||
}
|
||||
|
||||
const config = {
|
||||
"proxy-resources": {
|
||||
[resource.niceId]: resourceConfig
|
||||
}
|
||||
};
|
||||
|
||||
const notesPrefix =
|
||||
notes.length > 0
|
||||
? notes.map((n) => `# ${n}`).join("\n") + "\n\n"
|
||||
: "";
|
||||
|
||||
return {
|
||||
niceId: resource.niceId,
|
||||
contents: notesPrefix + stringifyYaml(config)
|
||||
};
|
||||
}
|
||||
|
||||
export async function generatePrivateResourceBlueprintYaml(
|
||||
siteResourceId: number
|
||||
): Promise<{ niceId: string; contents: string }> {
|
||||
const [siteResource] = await db
|
||||
.select()
|
||||
.from(siteResources)
|
||||
.where(eq(siteResources.siteResourceId, siteResourceId))
|
||||
.limit(1);
|
||||
|
||||
if (!siteResource) {
|
||||
throw new Error(`Site resource ${siteResourceId} not found`);
|
||||
}
|
||||
|
||||
const mode = siteResource.mode;
|
||||
const isInference = mode === "inference";
|
||||
const isHttpLike = mode === "http" || isInference;
|
||||
|
||||
const resourceConfig: Record<string, any> = {
|
||||
name: siteResource.name,
|
||||
mode,
|
||||
enabled: siteResource.enabled
|
||||
};
|
||||
|
||||
if (!isInference && siteResource.networkId) {
|
||||
const siteRows = await db
|
||||
.select({ niceId: sites.niceId })
|
||||
.from(siteNetworks)
|
||||
.innerJoin(sites, eq(siteNetworks.siteId, sites.siteId))
|
||||
.where(eq(siteNetworks.networkId, siteResource.networkId));
|
||||
if (siteRows.length > 0) {
|
||||
resourceConfig.sites = siteRows.map((s) => s.niceId);
|
||||
}
|
||||
}
|
||||
|
||||
if (siteResource.destination) {
|
||||
resourceConfig.destination = siteResource.destination;
|
||||
}
|
||||
if (siteResource.destinationPort) {
|
||||
resourceConfig["destination-port"] = siteResource.destinationPort;
|
||||
}
|
||||
|
||||
if (!isHttpLike) {
|
||||
resourceConfig["tcp-ports"] = siteResource.tcpPortRangeString;
|
||||
resourceConfig["udp-ports"] = siteResource.udpPortRangeString;
|
||||
resourceConfig["disable-icmp"] = siteResource.disableIcmp;
|
||||
}
|
||||
|
||||
if (isHttpLike) {
|
||||
if (siteResource.fullDomain) {
|
||||
resourceConfig["full-domain"] = siteResource.fullDomain;
|
||||
}
|
||||
resourceConfig.ssl = siteResource.ssl;
|
||||
if (siteResource.scheme) {
|
||||
resourceConfig.scheme = siteResource.scheme;
|
||||
}
|
||||
}
|
||||
|
||||
if (siteResource.alias) {
|
||||
resourceConfig.alias = siteResource.alias;
|
||||
}
|
||||
|
||||
if (mode === "ssh") {
|
||||
resourceConfig["auth-daemon"] = stripUndefined({
|
||||
pam: siteResource.pamMode ?? undefined,
|
||||
mode: siteResource.authDaemonMode ?? undefined,
|
||||
port: siteResource.authDaemonPort ?? undefined
|
||||
});
|
||||
}
|
||||
|
||||
const [roleRows, userRows, clientRows, labelRows] = await Promise.all([
|
||||
db
|
||||
.select({ name: roles.name })
|
||||
.from(roleSiteResources)
|
||||
.innerJoin(
|
||||
roles,
|
||||
and(
|
||||
eq(roleSiteResources.roleId, roles.roleId),
|
||||
or(isNull(roles.isAdmin), not(roles.isAdmin))
|
||||
)
|
||||
)
|
||||
.where(eq(roleSiteResources.siteResourceId, siteResourceId)),
|
||||
db
|
||||
.select({ username: users.username })
|
||||
.from(userSiteResources)
|
||||
.innerJoin(users, eq(userSiteResources.userId, users.userId))
|
||||
.where(eq(userSiteResources.siteResourceId, siteResourceId)),
|
||||
db
|
||||
.select({ niceId: clients.niceId })
|
||||
.from(clientSiteResources)
|
||||
.innerJoin(clients, eq(clientSiteResources.clientId, clients.clientId))
|
||||
.where(eq(clientSiteResources.siteResourceId, siteResourceId)),
|
||||
db
|
||||
.select({ name: labels.name })
|
||||
.from(siteResourceLabels)
|
||||
.innerJoin(labels, eq(siteResourceLabels.labelId, labels.labelId))
|
||||
.where(eq(siteResourceLabels.siteResourceId, siteResourceId))
|
||||
]);
|
||||
|
||||
if (roleRows.length > 0) {
|
||||
resourceConfig.roles = roleRows.map((r) => r.name);
|
||||
}
|
||||
if (userRows.length > 0) {
|
||||
resourceConfig.users = userRows.map((u) => u.username);
|
||||
}
|
||||
if (clientRows.length > 0) {
|
||||
resourceConfig.machines = clientRows.map((c) => c.niceId);
|
||||
}
|
||||
if (labelRows.length > 0) {
|
||||
resourceConfig.labels = labelRows.map((l) => l.name);
|
||||
}
|
||||
|
||||
if (isInference) {
|
||||
const { aiProvidersConfig, aiBudgetConfig } =
|
||||
await buildAiProvidersAndBudget({ scope: "site", siteResourceId });
|
||||
resourceConfig["ai-providers"] = aiProvidersConfig;
|
||||
if (aiBudgetConfig.length > 0) {
|
||||
resourceConfig["ai-budget"] = aiBudgetConfig;
|
||||
}
|
||||
}
|
||||
|
||||
const config = {
|
||||
"client-resources": {
|
||||
[siteResource.niceId]: resourceConfig
|
||||
}
|
||||
};
|
||||
|
||||
return {
|
||||
niceId: siteResource.niceId,
|
||||
contents: stringifyYaml(config)
|
||||
};
|
||||
}
|
||||
@@ -386,6 +386,13 @@ authenticated.get(
|
||||
siteResource.getSiteResource
|
||||
);
|
||||
|
||||
authenticated.get(
|
||||
"/site-resource/:siteResourceId/blueprint",
|
||||
verifySiteResourceAccess,
|
||||
verifyUserHasAction(ActionsEnum.getSiteResource),
|
||||
siteResource.exportSiteResourceBlueprint
|
||||
);
|
||||
|
||||
authenticated.post(
|
||||
"/site-resource/:siteResourceId",
|
||||
verifySiteResourceAccess,
|
||||
@@ -764,6 +771,13 @@ authenticated.get(
|
||||
verifyUserHasAction(ActionsEnum.getResource),
|
||||
resource.getResource
|
||||
);
|
||||
|
||||
authenticated.get(
|
||||
"/resource/:resourceId/blueprint",
|
||||
verifyResourceAccess,
|
||||
verifyUserHasAction(ActionsEnum.getResource),
|
||||
resource.exportResourceBlueprint
|
||||
);
|
||||
authenticated.get(
|
||||
"/org/:orgId/resource/:niceId",
|
||||
verifyOrgAccess,
|
||||
|
||||
@@ -0,0 +1,100 @@
|
||||
import { Request, Response, NextFunction } from "express";
|
||||
import { z } from "zod";
|
||||
import { db, resources } from "@server/db";
|
||||
import { eq } from "drizzle-orm";
|
||||
import response from "@server/lib/response";
|
||||
import HttpCode from "@server/types/HttpCode";
|
||||
import createHttpError from "http-errors";
|
||||
import logger from "@server/logger";
|
||||
import { fromError } from "zod-validation-error";
|
||||
import { OpenAPITags, registry } from "@server/openApi";
|
||||
import { generatePublicResourceBlueprintYaml } from "@server/lib/blueprints/exportResourceBlueprint";
|
||||
|
||||
const exportResourceBlueprintSchema = z.strictObject({
|
||||
resourceId: z.coerce.number().int().positive()
|
||||
});
|
||||
|
||||
export type ExportResourceBlueprintResponse = {
|
||||
name: string;
|
||||
contents: string;
|
||||
};
|
||||
|
||||
registry.registerPath({
|
||||
method: "get",
|
||||
path: "/resource/{resourceId}/blueprint",
|
||||
description:
|
||||
"Generate a blueprint YAML snippet that recreates this resource.",
|
||||
tags: [OpenAPITags.PublicResource, OpenAPITags.Blueprint],
|
||||
request: {
|
||||
params: exportResourceBlueprintSchema
|
||||
},
|
||||
responses: {
|
||||
200: {
|
||||
description: "Successful response",
|
||||
content: {
|
||||
"application/json": {
|
||||
schema: z.object({
|
||||
data: z.record(z.string(), z.any()).nullable(),
|
||||
success: z.boolean(),
|
||||
error: z.boolean(),
|
||||
message: z.string(),
|
||||
status: z.number()
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
export async function exportResourceBlueprint(
|
||||
req: Request,
|
||||
res: Response,
|
||||
next: NextFunction
|
||||
): Promise<any> {
|
||||
try {
|
||||
const parsedParams = exportResourceBlueprintSchema.safeParse(
|
||||
req.params
|
||||
);
|
||||
if (!parsedParams.success) {
|
||||
return next(
|
||||
createHttpError(
|
||||
HttpCode.BAD_REQUEST,
|
||||
fromError(parsedParams.error).toString()
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
const { resourceId } = parsedParams.data;
|
||||
|
||||
const [resource] = await db
|
||||
.select({ niceId: resources.niceId })
|
||||
.from(resources)
|
||||
.where(eq(resources.resourceId, resourceId))
|
||||
.limit(1);
|
||||
|
||||
if (!resource) {
|
||||
return next(
|
||||
createHttpError(HttpCode.NOT_FOUND, "Resource not found")
|
||||
);
|
||||
}
|
||||
|
||||
const { niceId, contents } =
|
||||
await generatePublicResourceBlueprintYaml(resourceId);
|
||||
|
||||
return response<ExportResourceBlueprintResponse>(res, {
|
||||
data: { name: niceId, contents },
|
||||
success: true,
|
||||
error: false,
|
||||
message: "Blueprint generated successfully",
|
||||
status: HttpCode.OK
|
||||
});
|
||||
} catch (error) {
|
||||
logger.error(error);
|
||||
return next(
|
||||
createHttpError(
|
||||
HttpCode.INTERNAL_SERVER_ERROR,
|
||||
error instanceof Error ? error.message : "An error occurred"
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -43,3 +43,4 @@ export * from "./listResourceAiProviders";
|
||||
export * from "./setResourceAiProviders";
|
||||
export * from "./addAiProviderToResource";
|
||||
export * from "./removeAiProviderFromResource";
|
||||
export * from "./exportResourceBlueprint";
|
||||
|
||||
@@ -0,0 +1,100 @@
|
||||
import { Request, Response, NextFunction } from "express";
|
||||
import { z } from "zod";
|
||||
import { db, siteResources } from "@server/db";
|
||||
import { eq } from "drizzle-orm";
|
||||
import response from "@server/lib/response";
|
||||
import HttpCode from "@server/types/HttpCode";
|
||||
import createHttpError from "http-errors";
|
||||
import logger from "@server/logger";
|
||||
import { fromError } from "zod-validation-error";
|
||||
import { OpenAPITags, registry } from "@server/openApi";
|
||||
import { generatePrivateResourceBlueprintYaml } from "@server/lib/blueprints/exportResourceBlueprint";
|
||||
|
||||
const exportSiteResourceBlueprintSchema = z.strictObject({
|
||||
siteResourceId: z.coerce.number().int().positive()
|
||||
});
|
||||
|
||||
export type ExportSiteResourceBlueprintResponse = {
|
||||
name: string;
|
||||
contents: string;
|
||||
};
|
||||
|
||||
registry.registerPath({
|
||||
method: "get",
|
||||
path: "/site-resource/{siteResourceId}/blueprint",
|
||||
description:
|
||||
"Generate a blueprint YAML snippet that recreates this site resource.",
|
||||
tags: [OpenAPITags.PrivateResource, OpenAPITags.Blueprint],
|
||||
request: {
|
||||
params: exportSiteResourceBlueprintSchema
|
||||
},
|
||||
responses: {
|
||||
200: {
|
||||
description: "Successful response",
|
||||
content: {
|
||||
"application/json": {
|
||||
schema: z.object({
|
||||
data: z.record(z.string(), z.any()).nullable(),
|
||||
success: z.boolean(),
|
||||
error: z.boolean(),
|
||||
message: z.string(),
|
||||
status: z.number()
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
export async function exportSiteResourceBlueprint(
|
||||
req: Request,
|
||||
res: Response,
|
||||
next: NextFunction
|
||||
): Promise<any> {
|
||||
try {
|
||||
const parsedParams = exportSiteResourceBlueprintSchema.safeParse(
|
||||
req.params
|
||||
);
|
||||
if (!parsedParams.success) {
|
||||
return next(
|
||||
createHttpError(
|
||||
HttpCode.BAD_REQUEST,
|
||||
fromError(parsedParams.error).toString()
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
const { siteResourceId } = parsedParams.data;
|
||||
|
||||
const [siteResource] = await db
|
||||
.select({ niceId: siteResources.niceId })
|
||||
.from(siteResources)
|
||||
.where(eq(siteResources.siteResourceId, siteResourceId))
|
||||
.limit(1);
|
||||
|
||||
if (!siteResource) {
|
||||
return next(
|
||||
createHttpError(HttpCode.NOT_FOUND, "Site resource not found")
|
||||
);
|
||||
}
|
||||
|
||||
const { niceId, contents } =
|
||||
await generatePrivateResourceBlueprintYaml(siteResourceId);
|
||||
|
||||
return response<ExportSiteResourceBlueprintResponse>(res, {
|
||||
data: { name: niceId, contents },
|
||||
success: true,
|
||||
error: false,
|
||||
message: "Blueprint generated successfully",
|
||||
status: HttpCode.OK
|
||||
});
|
||||
} catch (error) {
|
||||
logger.error(error);
|
||||
return next(
|
||||
createHttpError(
|
||||
HttpCode.INTERNAL_SERVER_ERROR,
|
||||
error instanceof Error ? error.message : "An error occurred"
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -25,3 +25,4 @@ export * from "./listSiteResourceAiProviders";
|
||||
export * from "./setSiteResourceAiProviders";
|
||||
export * from "./addAiProviderToSiteResource";
|
||||
export * from "./removeAiProviderFromSiteResource";
|
||||
export * from "./exportSiteResourceBlueprint";
|
||||
|
||||
Reference in New Issue
Block a user