mirror of
https://github.com/fosrl/pangolin.git
synced 2026-10-15 09:09:05 +02:00
690 lines
24 KiB
TypeScript
690 lines
24 KiB
TypeScript
import { stringify as stringifyYaml } from "yaml";
|
|
import { and, asc, eq, isNull, not, or } from "drizzle-orm";
|
|
import {
|
|
aiBudgets,
|
|
aiModels,
|
|
clients,
|
|
clientSiteResources,
|
|
db,
|
|
labels,
|
|
resourceAiModels,
|
|
resourceHeaderAuth,
|
|
resourceLabels,
|
|
resourcePassword,
|
|
resourcePincode,
|
|
resourcePolicies,
|
|
resourceRules,
|
|
resources,
|
|
resourceWhitelist,
|
|
roles,
|
|
roleResources,
|
|
roleSiteResources,
|
|
siteNetworks,
|
|
siteResourceAiModels,
|
|
siteResourceLabels,
|
|
siteResources,
|
|
sites,
|
|
targetHealthCheck,
|
|
targets,
|
|
userResources,
|
|
userSiteResources,
|
|
users
|
|
} from "@server/db";
|
|
import { queryResourcePolicy } from "@server/routers/policy/getResourcePolicy";
|
|
import {
|
|
listPublicResourceAiProviders,
|
|
listSiteResourceAiProviders
|
|
} from "@server/lib/aiInferenceResource";
|
|
|
|
const HTTP_LIKE_PUBLIC_MODES = ["http", "ssh", "rdp", "vnc", "inference"];
|
|
|
|
function reverseRuleAction(action: string): "allow" | "deny" | "pass" {
|
|
if (action === "ACCEPT") return "allow";
|
|
if (action === "PASS") return "pass";
|
|
return "deny";
|
|
}
|
|
|
|
function reverseRuleMatch(match: string): string {
|
|
return match.toLowerCase();
|
|
}
|
|
|
|
function stripUndefined<T extends Record<string, any>>(obj: T): T {
|
|
for (const key of Object.keys(obj)) {
|
|
if (obj[key] === undefined) {
|
|
delete obj[key];
|
|
}
|
|
}
|
|
return obj;
|
|
}
|
|
|
|
function buildHealthcheck(row: {
|
|
hcHostname: string | null;
|
|
hcPort: number | null;
|
|
hcEnabled: boolean | null;
|
|
hcPath: string | null;
|
|
hcScheme: string | null;
|
|
hcMode: string | null;
|
|
hcInterval: number | null;
|
|
hcUnhealthyInterval: number | null;
|
|
hcTimeout: number | null;
|
|
hcHeaders: string | null;
|
|
hcFollowRedirects: boolean | null;
|
|
hcMethod: string | null;
|
|
hcStatus: number | null;
|
|
hcHealthyThreshold: number | null;
|
|
hcUnhealthyThreshold: number | null;
|
|
}) {
|
|
if (!row.hcHostname) {
|
|
return undefined;
|
|
}
|
|
|
|
let headers: { name: string; value: string }[] | undefined;
|
|
if (row.hcHeaders) {
|
|
try {
|
|
headers = JSON.parse(row.hcHeaders);
|
|
} catch {
|
|
headers = undefined;
|
|
}
|
|
}
|
|
|
|
return stripUndefined({
|
|
hostname: row.hcHostname,
|
|
port: row.hcPort ?? undefined,
|
|
enabled: row.hcEnabled ?? undefined,
|
|
path: row.hcPath ?? undefined,
|
|
scheme: row.hcScheme ?? undefined,
|
|
mode: row.hcMode ?? undefined,
|
|
interval: row.hcInterval ?? undefined,
|
|
"unhealthy-interval": row.hcUnhealthyInterval ?? undefined,
|
|
timeout: row.hcTimeout ?? undefined,
|
|
headers,
|
|
"follow-redirects": row.hcFollowRedirects ?? undefined,
|
|
method: row.hcMethod ?? undefined,
|
|
status: row.hcStatus ?? undefined,
|
|
"healthy-threshold": row.hcHealthyThreshold ?? undefined,
|
|
"unhealthy-threshold": row.hcUnhealthyThreshold ?? undefined
|
|
});
|
|
}
|
|
|
|
async function buildPublicAuthAndRules(resource: {
|
|
resourceId: number;
|
|
resourcePolicyId: number | null;
|
|
defaultResourcePolicyId: number | null;
|
|
sso: boolean | null;
|
|
skipToIdpId: number | null;
|
|
}): Promise<{
|
|
policy: string | undefined;
|
|
auth: Record<string, any> | undefined;
|
|
rules: Record<string, any>[];
|
|
notes: string[];
|
|
}> {
|
|
const notes: string[] = [];
|
|
|
|
if (resource.resourcePolicyId) {
|
|
// Shared policy attached: the policy's own auth config lives on the
|
|
// policy entity itself (edited separately). The resource only carries
|
|
// its own overrides in the legacy resource-level tables.
|
|
const [policyRow] = await db
|
|
.select({ niceId: resourcePolicies.niceId })
|
|
.from(resourcePolicies)
|
|
.where(eq(resourcePolicies.resourcePolicyId, resource.resourcePolicyId))
|
|
.limit(1);
|
|
|
|
const [roleRows, userRows, whitelistRows, ruleRows, passwordRow, pincodeRow, headerAuthRow] =
|
|
await Promise.all([
|
|
db
|
|
.select({ name: roles.name })
|
|
.from(roleResources)
|
|
.innerJoin(
|
|
roles,
|
|
and(
|
|
eq(roleResources.roleId, roles.roleId),
|
|
or(isNull(roles.isAdmin), not(roles.isAdmin))
|
|
)
|
|
)
|
|
.where(eq(roleResources.resourceId, resource.resourceId)),
|
|
db
|
|
.select({ username: users.username })
|
|
.from(userResources)
|
|
.innerJoin(users, eq(userResources.userId, users.userId))
|
|
.where(eq(userResources.resourceId, resource.resourceId)),
|
|
db
|
|
.select({ email: resourceWhitelist.email })
|
|
.from(resourceWhitelist)
|
|
.where(eq(resourceWhitelist.resourceId, resource.resourceId)),
|
|
db
|
|
.select({
|
|
enabled: resourceRules.enabled,
|
|
priority: resourceRules.priority,
|
|
action: resourceRules.action,
|
|
match: resourceRules.match,
|
|
value: resourceRules.value
|
|
})
|
|
.from(resourceRules)
|
|
.where(eq(resourceRules.resourceId, resource.resourceId)),
|
|
db
|
|
.select({ passwordId: resourcePassword.passwordId })
|
|
.from(resourcePassword)
|
|
.where(eq(resourcePassword.resourceId, resource.resourceId))
|
|
.limit(1),
|
|
db
|
|
.select({ pincodeId: resourcePincode.pincodeId })
|
|
.from(resourcePincode)
|
|
.where(eq(resourcePincode.resourceId, resource.resourceId))
|
|
.limit(1),
|
|
db
|
|
.select({ headerAuthId: resourceHeaderAuth.headerAuthId })
|
|
.from(resourceHeaderAuth)
|
|
.where(eq(resourceHeaderAuth.resourceId, resource.resourceId))
|
|
.limit(1)
|
|
]);
|
|
|
|
if (passwordRow.length > 0) {
|
|
notes.push(
|
|
"A password is configured on this resource. Passwords cannot be exported for security reasons; re-set it after applying this blueprint."
|
|
);
|
|
}
|
|
if (pincodeRow.length > 0) {
|
|
notes.push(
|
|
"A pincode is configured on this resource. Pincodes cannot be exported for security reasons; re-set it after applying this blueprint."
|
|
);
|
|
}
|
|
if (headerAuthRow.length > 0) {
|
|
notes.push(
|
|
"Basic auth is configured on this resource. Basic auth credentials cannot be exported for security reasons; re-set it after applying this blueprint."
|
|
);
|
|
}
|
|
|
|
const auth = stripUndefined({
|
|
"sso-enabled": resource.sso ?? undefined,
|
|
"sso-roles": roleRows.length ? roleRows.map((r) => r.name) : undefined,
|
|
"sso-users": userRows.length
|
|
? userRows.map((u) => u.username)
|
|
: undefined,
|
|
"whitelist-users": whitelistRows.length
|
|
? whitelistRows.map((w) => w.email)
|
|
: undefined,
|
|
"auto-login-idp": resource.skipToIdpId ?? undefined
|
|
});
|
|
|
|
return {
|
|
policy: policyRow?.niceId,
|
|
auth: Object.keys(auth).length > 0 ? auth : undefined,
|
|
rules: ruleRows.map((r) =>
|
|
stripUndefined({
|
|
action: reverseRuleAction(r.action),
|
|
match: reverseRuleMatch(r.match),
|
|
value: r.value,
|
|
priority: r.priority,
|
|
enabled: r.enabled
|
|
})
|
|
),
|
|
notes
|
|
};
|
|
}
|
|
|
|
if (!resource.defaultResourcePolicyId) {
|
|
return { policy: undefined, auth: undefined, rules: [], notes };
|
|
}
|
|
|
|
// Inline policy: the resource's own default (non-shared) policy carries
|
|
// all of its auth config.
|
|
const policy = await queryResourcePolicy({
|
|
resourcePolicyId: resource.defaultResourcePolicyId
|
|
});
|
|
|
|
if (!policy) {
|
|
return { policy: undefined, auth: undefined, rules: [], notes };
|
|
}
|
|
|
|
if (policy.passwordId) {
|
|
notes.push(
|
|
"A password is configured on this resource. Passwords cannot be exported for security reasons; re-set it after applying this blueprint."
|
|
);
|
|
}
|
|
if (policy.pincodeId) {
|
|
notes.push(
|
|
"A pincode is configured on this resource. Pincodes cannot be exported for security reasons; re-set it after applying this blueprint."
|
|
);
|
|
}
|
|
if (policy.headerAuth?.id) {
|
|
notes.push(
|
|
"Basic auth is configured on this resource. Basic auth credentials cannot be exported for security reasons; re-set it after applying this blueprint."
|
|
);
|
|
}
|
|
|
|
const auth = stripUndefined({
|
|
"sso-enabled": policy.sso ?? undefined,
|
|
"sso-roles": policy.roles.length
|
|
? policy.roles.map((r) => r.name)
|
|
: undefined,
|
|
"sso-users": policy.users.length
|
|
? policy.users.map((u) => u.username)
|
|
: undefined,
|
|
"whitelist-users": policy.emailWhiteList.length
|
|
? policy.emailWhiteList.map((w) => w.email)
|
|
: undefined,
|
|
"auto-login-idp": policy.idpId ?? undefined
|
|
});
|
|
|
|
return {
|
|
policy: undefined,
|
|
auth: Object.keys(auth).length > 0 ? auth : undefined,
|
|
rules: policy.rules.map((r) =>
|
|
stripUndefined({
|
|
action: reverseRuleAction(r.action),
|
|
match: reverseRuleMatch(r.match),
|
|
value: r.value,
|
|
priority: r.priority,
|
|
enabled: r.enabled
|
|
})
|
|
),
|
|
notes
|
|
};
|
|
}
|
|
|
|
async function buildAiProvidersAndBudget(input:
|
|
| { scope: "public"; resourceId: number }
|
|
| { scope: "site"; siteResourceId: number }
|
|
) {
|
|
const providers =
|
|
input.scope === "public"
|
|
? await listPublicResourceAiProviders(input.resourceId)
|
|
: await listSiteResourceAiProviders(input.siteResourceId);
|
|
|
|
const aiProvidersConfig = await Promise.all(
|
|
providers.map(async (p) => {
|
|
const entry: Record<string, any> = {
|
|
provider: p.niceId,
|
|
"access-mode": p.accessMode,
|
|
enabled: p.enabled
|
|
};
|
|
|
|
if (p.accessMode === "select") {
|
|
const modelRows =
|
|
input.scope === "public"
|
|
? await db
|
|
.select({ modelKey: aiModels.modelKey })
|
|
.from(resourceAiModels)
|
|
.innerJoin(
|
|
aiModels,
|
|
eq(resourceAiModels.modelId, aiModels.modelId)
|
|
)
|
|
.where(
|
|
and(
|
|
eq(
|
|
resourceAiModels.resourceId,
|
|
input.resourceId
|
|
),
|
|
eq(aiModels.providerId, p.providerId)
|
|
)
|
|
)
|
|
: await db
|
|
.select({ modelKey: aiModels.modelKey })
|
|
.from(siteResourceAiModels)
|
|
.innerJoin(
|
|
aiModels,
|
|
eq(siteResourceAiModels.modelId, aiModels.modelId)
|
|
)
|
|
.where(
|
|
and(
|
|
eq(
|
|
siteResourceAiModels.siteResourceId,
|
|
input.siteResourceId
|
|
),
|
|
eq(aiModels.providerId, p.providerId)
|
|
)
|
|
);
|
|
|
|
if (modelRows.length > 0) {
|
|
entry.models = modelRows.map((m) => m.modelKey);
|
|
}
|
|
}
|
|
|
|
return entry;
|
|
})
|
|
);
|
|
|
|
const budgetRows = await db
|
|
.select()
|
|
.from(aiBudgets)
|
|
.where(
|
|
input.scope === "public"
|
|
? eq(aiBudgets.resourceId, input.resourceId)
|
|
: eq(aiBudgets.siteResourceId, input.siteResourceId)
|
|
);
|
|
|
|
const aiBudgetConfig = budgetRows.map((b) => ({
|
|
amount: b.amount,
|
|
unit: b.unit,
|
|
period: b.period,
|
|
enforcement: b.enforcement,
|
|
enabled: b.enabled
|
|
}));
|
|
|
|
return { aiProvidersConfig, aiBudgetConfig };
|
|
}
|
|
|
|
export async function generatePublicResourceBlueprintYaml(
|
|
resourceId: number
|
|
): Promise<{ niceId: string; contents: string }> {
|
|
const [resource] = await db
|
|
.select()
|
|
.from(resources)
|
|
.where(eq(resources.resourceId, resourceId))
|
|
.limit(1);
|
|
|
|
if (!resource) {
|
|
throw new Error(`Resource ${resourceId} not found`);
|
|
}
|
|
|
|
const mode = resource.mode;
|
|
const isHttpLike = HTTP_LIKE_PUBLIC_MODES.includes(mode);
|
|
const isInference = mode === "inference";
|
|
|
|
const resourceConfig: Record<string, any> = {
|
|
name: resource.name,
|
|
mode,
|
|
enabled: resource.enabled
|
|
};
|
|
|
|
if (isHttpLike) {
|
|
if (resource.fullDomain) {
|
|
resourceConfig["full-domain"] = resource.fullDomain;
|
|
}
|
|
resourceConfig.ssl = resource.ssl;
|
|
} else {
|
|
if (resource.proxyPort) {
|
|
resourceConfig["proxy-port"] = resource.proxyPort;
|
|
}
|
|
if (mode === "tcp") {
|
|
resourceConfig["proxy-protocol"] = resource.proxyProtocol;
|
|
resourceConfig["proxy-protocol-version"] =
|
|
resource.proxyProtocolVersion ?? undefined;
|
|
}
|
|
}
|
|
|
|
if (resource.setHostHeader) {
|
|
resourceConfig["host-header"] = resource.setHostHeader;
|
|
}
|
|
if (resource.tlsServerName) {
|
|
resourceConfig["tls-server-name"] = resource.tlsServerName;
|
|
}
|
|
if (
|
|
resource.loadBalancingStrategy &&
|
|
resource.loadBalancingStrategy !== "wrr"
|
|
) {
|
|
resourceConfig["load-balancing-strategy"] =
|
|
resource.loadBalancingStrategy;
|
|
}
|
|
if (resource.requestHeaders) {
|
|
try {
|
|
resourceConfig.requestHeaders = JSON.parse(resource.requestHeaders);
|
|
} catch {
|
|
// ignore malformed stored headers
|
|
}
|
|
}
|
|
if (resource.responseHeaders) {
|
|
try {
|
|
resourceConfig.responseHeaders = JSON.parse(resource.responseHeaders);
|
|
} catch {
|
|
// ignore malformed stored headers
|
|
}
|
|
}
|
|
|
|
if (mode === "ssh") {
|
|
resourceConfig["auth-daemon"] = stripUndefined({
|
|
pam: resource.pamMode ?? undefined,
|
|
mode: resource.authDaemonMode ?? undefined,
|
|
port: resource.authDaemonPort ?? undefined
|
|
});
|
|
}
|
|
|
|
if (resource.maintenanceModeEnabled) {
|
|
resourceConfig.maintenance = stripUndefined({
|
|
enabled: resource.maintenanceModeEnabled,
|
|
type: resource.maintenanceModeType ?? undefined,
|
|
title: resource.maintenanceTitle ?? undefined,
|
|
message: resource.maintenanceMessage ?? undefined,
|
|
"estimated-time": resource.maintenanceEstimatedTime ?? undefined
|
|
});
|
|
}
|
|
|
|
// Labels
|
|
const labelRows = await db
|
|
.select({ name: labels.name })
|
|
.from(resourceLabels)
|
|
.innerJoin(labels, eq(resourceLabels.labelId, labels.labelId))
|
|
.where(eq(resourceLabels.resourceId, resourceId));
|
|
if (labelRows.length > 0) {
|
|
resourceConfig.labels = labelRows.map((l) => l.name);
|
|
}
|
|
|
|
// Auth / rules / shared policy
|
|
const { policy, auth, rules, notes } = await buildPublicAuthAndRules(
|
|
resource
|
|
);
|
|
if (policy) {
|
|
resourceConfig.policy = policy;
|
|
}
|
|
if (auth) {
|
|
resourceConfig.auth = auth;
|
|
}
|
|
if (rules.length > 0) {
|
|
resourceConfig.rules = rules;
|
|
}
|
|
|
|
// Targets (all modes except inference use targets)
|
|
if (!isInference) {
|
|
const targetRows = await db
|
|
.select({
|
|
ip: targets.ip,
|
|
method: targets.method,
|
|
port: targets.port,
|
|
enabled: targets.enabled,
|
|
internalPort: targets.internalPort,
|
|
path: targets.path,
|
|
pathMatchType: targets.pathMatchType,
|
|
rewritePath: targets.rewritePath,
|
|
rewritePathType: targets.rewritePathType,
|
|
priority: targets.priority,
|
|
siteNiceId: sites.niceId,
|
|
hcEnabled: targetHealthCheck.hcEnabled,
|
|
hcPath: targetHealthCheck.hcPath,
|
|
hcScheme: targetHealthCheck.hcScheme,
|
|
hcMode: targetHealthCheck.hcMode,
|
|
hcHostname: targetHealthCheck.hcHostname,
|
|
hcPort: targetHealthCheck.hcPort,
|
|
hcInterval: targetHealthCheck.hcInterval,
|
|
hcUnhealthyInterval: targetHealthCheck.hcUnhealthyInterval,
|
|
hcTimeout: targetHealthCheck.hcTimeout,
|
|
hcHeaders: targetHealthCheck.hcHeaders,
|
|
hcFollowRedirects: targetHealthCheck.hcFollowRedirects,
|
|
hcMethod: targetHealthCheck.hcMethod,
|
|
hcStatus: targetHealthCheck.hcStatus,
|
|
hcHealthyThreshold: targetHealthCheck.hcHealthyThreshold,
|
|
hcUnhealthyThreshold: targetHealthCheck.hcUnhealthyThreshold
|
|
})
|
|
.from(targets)
|
|
.leftJoin(sites, eq(sites.siteId, targets.siteId))
|
|
.leftJoin(
|
|
targetHealthCheck,
|
|
eq(targetHealthCheck.targetId, targets.targetId)
|
|
)
|
|
.where(eq(targets.resourceId, resourceId))
|
|
.orderBy(asc(targets.targetId));
|
|
|
|
resourceConfig.targets = targetRows.map((row) =>
|
|
stripUndefined({
|
|
site: row.siteNiceId ?? undefined,
|
|
method: mode === "http" ? row.method ?? undefined : undefined,
|
|
hostname: row.ip,
|
|
port: row.port,
|
|
enabled: row.enabled,
|
|
"internal-port": row.internalPort ?? undefined,
|
|
path: row.path ?? undefined,
|
|
"path-match": row.pathMatchType ?? undefined,
|
|
"rewrite-path": row.rewritePath ?? undefined,
|
|
"rewrite-match": row.rewritePathType ?? undefined,
|
|
priority: row.priority,
|
|
healthcheck: buildHealthcheck(row)
|
|
})
|
|
);
|
|
} else {
|
|
const { aiProvidersConfig, aiBudgetConfig } =
|
|
await buildAiProvidersAndBudget({ scope: "public", resourceId });
|
|
resourceConfig["ai-providers"] = aiProvidersConfig;
|
|
if (aiBudgetConfig.length > 0) {
|
|
resourceConfig["ai-budget"] = aiBudgetConfig;
|
|
}
|
|
}
|
|
|
|
const config = {
|
|
"proxy-resources": {
|
|
[resource.niceId]: resourceConfig
|
|
}
|
|
};
|
|
|
|
const notesPrefix =
|
|
notes.length > 0
|
|
? notes.map((n) => `# ${n}`).join("\n") + "\n\n"
|
|
: "";
|
|
|
|
return {
|
|
niceId: resource.niceId,
|
|
contents: notesPrefix + stringifyYaml(config)
|
|
};
|
|
}
|
|
|
|
export async function generatePrivateResourceBlueprintYaml(
|
|
siteResourceId: number
|
|
): Promise<{ niceId: string; contents: string }> {
|
|
const [siteResource] = await db
|
|
.select()
|
|
.from(siteResources)
|
|
.where(eq(siteResources.siteResourceId, siteResourceId))
|
|
.limit(1);
|
|
|
|
if (!siteResource) {
|
|
throw new Error(`Site resource ${siteResourceId} not found`);
|
|
}
|
|
|
|
const mode = siteResource.mode;
|
|
const isInference = mode === "inference";
|
|
const isHttpLike = mode === "http" || isInference;
|
|
|
|
const resourceConfig: Record<string, any> = {
|
|
name: siteResource.name,
|
|
mode,
|
|
enabled: siteResource.enabled
|
|
};
|
|
|
|
if (!isInference && siteResource.networkId) {
|
|
const siteRows = await db
|
|
.select({ niceId: sites.niceId })
|
|
.from(siteNetworks)
|
|
.innerJoin(sites, eq(siteNetworks.siteId, sites.siteId))
|
|
.where(eq(siteNetworks.networkId, siteResource.networkId));
|
|
if (siteRows.length > 0) {
|
|
resourceConfig.sites = siteRows.map((s) => s.niceId);
|
|
}
|
|
}
|
|
|
|
if (siteResource.destination) {
|
|
resourceConfig.destination = siteResource.destination;
|
|
}
|
|
if (siteResource.destinationPort) {
|
|
resourceConfig["destination-port"] = siteResource.destinationPort;
|
|
}
|
|
|
|
if (!isHttpLike) {
|
|
resourceConfig["tcp-ports"] = siteResource.tcpPortRangeString;
|
|
resourceConfig["udp-ports"] = siteResource.udpPortRangeString;
|
|
resourceConfig["disable-icmp"] = siteResource.disableIcmp;
|
|
}
|
|
|
|
if (isHttpLike) {
|
|
if (siteResource.fullDomain) {
|
|
resourceConfig["full-domain"] = siteResource.fullDomain;
|
|
}
|
|
resourceConfig.ssl = siteResource.ssl;
|
|
if (siteResource.scheme) {
|
|
resourceConfig.scheme = siteResource.scheme;
|
|
}
|
|
}
|
|
|
|
if (siteResource.alias) {
|
|
resourceConfig.alias = siteResource.alias;
|
|
}
|
|
|
|
if (mode === "ssh") {
|
|
resourceConfig["auth-daemon"] = stripUndefined({
|
|
pam: siteResource.pamMode ?? undefined,
|
|
mode: siteResource.authDaemonMode ?? undefined,
|
|
port: siteResource.authDaemonPort ?? undefined
|
|
});
|
|
}
|
|
|
|
const [roleRows, userRows, clientRows, labelRows] = await Promise.all([
|
|
db
|
|
.select({ name: roles.name })
|
|
.from(roleSiteResources)
|
|
.innerJoin(
|
|
roles,
|
|
and(
|
|
eq(roleSiteResources.roleId, roles.roleId),
|
|
or(isNull(roles.isAdmin), not(roles.isAdmin))
|
|
)
|
|
)
|
|
.where(eq(roleSiteResources.siteResourceId, siteResourceId)),
|
|
db
|
|
.select({ username: users.username })
|
|
.from(userSiteResources)
|
|
.innerJoin(users, eq(userSiteResources.userId, users.userId))
|
|
.where(eq(userSiteResources.siteResourceId, siteResourceId)),
|
|
db
|
|
.select({ niceId: clients.niceId })
|
|
.from(clientSiteResources)
|
|
.innerJoin(clients, eq(clientSiteResources.clientId, clients.clientId))
|
|
.where(eq(clientSiteResources.siteResourceId, siteResourceId)),
|
|
db
|
|
.select({ name: labels.name })
|
|
.from(siteResourceLabels)
|
|
.innerJoin(labels, eq(siteResourceLabels.labelId, labels.labelId))
|
|
.where(eq(siteResourceLabels.siteResourceId, siteResourceId))
|
|
]);
|
|
|
|
if (roleRows.length > 0) {
|
|
resourceConfig.roles = roleRows.map((r) => r.name);
|
|
}
|
|
if (userRows.length > 0) {
|
|
resourceConfig.users = userRows.map((u) => u.username);
|
|
}
|
|
if (clientRows.length > 0) {
|
|
resourceConfig.machines = clientRows.map((c) => c.niceId);
|
|
}
|
|
if (labelRows.length > 0) {
|
|
resourceConfig.labels = labelRows.map((l) => l.name);
|
|
}
|
|
|
|
if (isInference) {
|
|
const { aiProvidersConfig, aiBudgetConfig } =
|
|
await buildAiProvidersAndBudget({ scope: "site", siteResourceId });
|
|
resourceConfig["ai-providers"] = aiProvidersConfig;
|
|
if (aiBudgetConfig.length > 0) {
|
|
resourceConfig["ai-budget"] = aiBudgetConfig;
|
|
}
|
|
}
|
|
|
|
const config = {
|
|
"client-resources": {
|
|
[siteResource.niceId]: resourceConfig
|
|
}
|
|
};
|
|
|
|
return {
|
|
niceId: siteResource.niceId,
|
|
contents: stringifyYaml(config)
|
|
};
|
|
}
|