965541bbc1
Coolify injects SOURCE_COMMIT and the COOLIFY_* family into an application's
runtime environment itself, and SKIPS its own injection of a name the resource
already carries a var of (ApplicationDeploymentJob.php v4.1.2, line 2994 —
`->where('key', 'SOURCE_COMMIT')->isEmpty()`). A resource-level var of that
name therefore SUPPRESSES the platform's value. An empty one suppresses it
just as completely: presence, not value.
And it fails green — the deploy succeeds, health checks pass, and the only
symptom is /version reporting "unknown", the endpoint a production cutover is
gated on (D-266).
The rule is now a property of cast, not of one code path. A new src/reserved.ts
owns it, and every place cast touches an env var honors it:
- resolve — every manifest read (desiredFromManifest, requiredSecrets,
manifestResources) refuses a template declaring a reserved name, before any
write. So apply, diff, capture and inventory all refuse identically.
- draft — a reserved name read off a live box gets its own provenance,
`suppressed`: out of the template, out of the age store, its live value read
into no artifact, and named in UNCAPTURED.md with the consequence.
- diff — promoted out of the remove-candidate orphan list ("apply never removes
these; read them by eye") and printed as a FINDING with its consequence. Not
clean. apply still never deletes: cast reports, the human removes it.
- capture (classify) and cli (syncEnv) carry the same assertion at the file and
at the wire — unreachable through the CLI today, and kept because the
invariant is "cast never writes one", not "the CLI happens to check first".
- smoke writes an env var too; its probe names are asserted outside the space.
The rule lives in cast's code, NOT beside forbidden_var_patterns in private
state: that one is policy an environment may set for itself, this one is a fact
about Coolify, true on every box — nothing a manifest change could lower.
19 tests in test/reserved.test.ts, one per path.
Closes #50.
84 lines
3.2 KiB
TypeScript
84 lines
3.2 KiB
TypeScript
import type { CoolifyClient } from "./coolify.js";
|
|
import { assertNoReservedEnvNames, reservedHits } from "./reserved.js";
|
|
|
|
// smoke writes env vars onto a REAL application — the one thing in cast that
|
|
// mutates a live resource purely to learn something. So the reserved-name rule
|
|
// binds it too, and these are the two names it may pick from.
|
|
//
|
|
// Exported, and asserted below, because the rule is about what cast writes, not
|
|
// about what one function happens to have been written to write today: an
|
|
// operator renaming a probe (`COOLIFY_SMOKE_PROBE` reads like the natural name)
|
|
// would otherwise set the very trap this rule exists to prevent, on a live app,
|
|
// and the smoke would pass while suppressing the app's SOURCE_COMMIT injection
|
|
// for as long as the probe lived — and the delete at the end restores nothing:
|
|
// Coolify only injects at deploy time.
|
|
export const SMOKE_KEEP_KEY = "INFRA_SMOKE_KEEP";
|
|
export const SMOKE_PROBE_KEY = "INFRA_SMOKE_PROBE";
|
|
|
|
export async function smoke(
|
|
client: CoolifyClient,
|
|
targetAppUuid: string,
|
|
): Promise<void> {
|
|
const KEEP_KEY = SMOKE_KEEP_KEY;
|
|
const PROBE_KEY = SMOKE_PROBE_KEY;
|
|
assertNoReservedEnvNames(
|
|
reservedHits(`smoke probe on ${targetAppUuid}`, [KEEP_KEY, PROBE_KEY]),
|
|
);
|
|
const envsPath = `/applications/${targetAppUuid}/envs`;
|
|
type EnvVar = {
|
|
key: string;
|
|
value: string;
|
|
is_buildtime?: boolean;
|
|
uuid: string;
|
|
};
|
|
const readEnvs = async (): Promise<EnvVar[]> =>
|
|
(await client.get(envsPath)) as EnvVar[];
|
|
|
|
// First var goes in via the singular envs endpoint — this is the
|
|
// never-delete canary the bulk write below must not disturb.
|
|
await client.post(envsPath, {
|
|
key: KEEP_KEY,
|
|
value: "1",
|
|
is_buildtime: false,
|
|
is_preview: false,
|
|
});
|
|
|
|
// Second var goes in via the bulk endpoint (the one apply's syncEnv uses,
|
|
// see cli.ts) with a payload containing ONLY the second var. The bulk
|
|
// envs endpoint is documented/verified as UPSERT-only (never deletes
|
|
// unlisted keys) — that's the load-bearing guarantee behind the iron rule
|
|
// that apply never deletes. If a Coolify upgrade regresses it to
|
|
// full-replace, KEEP_KEY will vanish from the read-back below.
|
|
await client.patch(`${envsPath}/bulk`, {
|
|
data: [
|
|
{
|
|
key: PROBE_KEY,
|
|
value: "1",
|
|
is_buildtime: false,
|
|
is_preview: false,
|
|
},
|
|
],
|
|
});
|
|
|
|
const envs = await readEnvs();
|
|
const keep = envs.find((e) => e.key === KEEP_KEY);
|
|
const probe = envs.find((e) => e.key === PROBE_KEY);
|
|
|
|
if (!keep) {
|
|
// Clean up whatever did survive before failing loudly.
|
|
if (probe) await client.delete_(`${envsPath}/${probe.uuid}`);
|
|
throw new Error(
|
|
"smoke FAIL: bulk env write is destructive (full-replace) — never-delete broken; do not apply with this Coolify version",
|
|
);
|
|
}
|
|
if (!probe) throw new Error("smoke FAIL: probe var not readable back");
|
|
if (probe.is_buildtime !== false) {
|
|
throw new Error(
|
|
`smoke FAIL: is_buildtime round-trip broken (got ${probe.is_buildtime}) — Coolify upgrade regression?`,
|
|
);
|
|
}
|
|
|
|
await client.delete_(`${envsPath}/${keep.uuid}`);
|
|
await client.delete_(`${envsPath}/${probe.uuid}`);
|
|
console.log(`smoke OK against Coolify ${await client.version()}`);
|
|
}
|