Merge remote-tracking branch 'origin/main' into APL-1200

Author: svcAPLBot

ARCHITECTURE.md

@@ -37,7 +37,8 @@
     "swagger-ui-express": "5.0.1",
     "ts-custom-error": "3.3.1",
     "uuid": "13.0.0",
-    "yaml": "2.8.2"
+    "yaml": "2.8.2",
+    "zod": "^4.1.12"
   },
   "description": "The brain of the Otomi Container Platform. Handling console input and talking to core, it knows what to do.",
   "devDependencies": {
@@ -50,6 +51,7 @@
     "@redocly/openapi-cli": "1.0.0-beta.95",
     "@semantic-release/changelog": "6.0.3",
     "@semantic-release/git": "10.0.1",
+    "@types/debug": "^4.1.12",
     "@types/expect": "24.3.2",
     "@types/express": "^5.0.0",
     "@types/fs-extra": "11.0.4",

package-lock.json

@@ -7,10 +7,10 @@ import request from 'supertest'
 import { HttpError } from './error'
 import { Git } from './git'
 import { getSessionStack } from './middleware'
-import { App, CodeRepo, Repo, SealedSecret } from './otomi-models'
-import { RepoService } from './services/RepoService'
+import { App, CodeRepo, SealedSecret } from './otomi-models'
 import * as getValuesSchemaModule from './utils'
 import TestAgent from 'supertest/lib/agent'
+import { FileStore } from './fileStore/file-store'
 
 const platformAdminToken = getToken(['platform-admin'])
 const teamAdminToken = getToken(['team-admin', 'team-team1'])
@@ -40,22 +40,33 @@ describe('API authz tests', () => {
   beforeAll(async () => {
     const _otomiStack = await getSessionStack()
     _otomiStack.git = mockDeep<Git>()
-    _otomiStack.transformApps = jest.fn().mockReturnValue([])
-    _otomiStack.repoService = new RepoService({} as Repo)
+    _otomiStack.fileStore = new FileStore()
     otomiStack = _otomiStack as jest.Mocked<OtomiStack>
 
     otomiStack.saveTeam = jest.fn().mockResolvedValue(undefined)
-    otomiStack.doRepoDeployment = jest.fn().mockImplementation(() => Promise.resolve())
-    otomiStack.doTeamDeployment = jest.fn().mockImplementation(() => Promise.resolve())
-    otomiStack.isLoaded = true
-    await otomiStack.createTeam({
-      name: 'team1',
-      resourceQuota: [],
-    })
-    await otomiStack.createTeam({
-      name: 'team2',
-      resourceQuota: [],
+    otomiStack.doDeleteDeployment = jest.fn().mockImplementation(() => Promise.resolve())
+    otomiStack.doDeployment = jest.fn().mockImplementation(() => Promise.resolve())
+    otomiStack.fileStore.set('env/teams/team1/settings.yaml', {
+      kind: 'AplTeamSettingSet',
+      spec: {},
+      metadata: {
+        name: 'team1',
+        labels: {
+          'apl.io/teamId': 'team1',
+        },
+      },
+    })
+    otomiStack.fileStore.set('env/teams/team2/settings.yaml', {
+      kind: 'AplTeamSettingSet',
+      spec: {},
+      metadata: {
+        name: 'team2',
+        labels: {
+          'apl.io/teamId': 'team2',
+        },
+      },
     })
+    otomiStack.isLoaded = true
     app = await initApp(otomiStack)
     agent = request.agent(app)
     agent.set('Accept', 'application/json')
@@ -92,6 +103,7 @@ describe('API authz tests', () => {
   })
 
   test('platform admin can update team self-service-flags', async () => {
+    jest.spyOn(otomiStack, 'editTeam').mockReturnValue({} as any)
     await agent
       .put('/v1/teams/team1')
       .send({
@@ -746,6 +758,7 @@ describe('API authz tests', () => {
     })
 
     test('platform admin can update policies', async () => {
+      jest.spyOn(otomiStack, 'editAplPolicy').mockReturnValue({} as any)
       await agent
         .put('/v1/teams/team1/policies/disallow-selinux')
         .send(data)
@@ -1031,7 +1044,7 @@ describe('API authz tests', () => {
     })
 
     test('platform admin can get specific agent', async () => {
-      jest.spyOn(otomiStack, 'getAplAgent').mockResolvedValue({} as any)
+      jest.spyOn(otomiStack, 'getAplAgent').mockReturnValue({} as any)
       await agent
         .get('/alpha/teams/team1/agents/test-agent')
         .set('Authorization', `Bearer ${platformAdminToken}`)
@@ -1040,7 +1053,7 @@ describe('API authz tests', () => {
     })
 
     test('team admin can get specific agent', async () => {
-      jest.spyOn(otomiStack, 'getAplAgent').mockResolvedValue({} as any)
+      jest.spyOn(otomiStack, 'getAplAgent').mockReturnValue({} as any)
       await agent
         .get('/alpha/teams/team1/agents/test-agent')
         .set('Authorization', `Bearer ${teamAdminToken}`)
@@ -1049,7 +1062,7 @@ describe('API authz tests', () => {
     })
 
     test('team member can get specific agent', async () => {
-      jest.spyOn(otomiStack, 'getAplAgent').mockResolvedValue({} as any)
+      jest.spyOn(otomiStack, 'getAplAgent').mockReturnValue({} as any)
       await agent
         .get('/alpha/teams/team1/agents/test-agent')
         .set('Authorization', `Bearer ${teamMemberToken}`)

package.json

@@ -86,10 +86,10 @@ const resourceStatus = async (errorSet) => {
   const { cluster } = otomiStack.getSettings(['cluster'])
   const domainSuffix = cluster?.domainSuffix
   const resources: Record<string, AplResponseObject[]> = {
-    workloads: otomiStack.repoService.getAllWorkloads(),
-    builds: otomiStack.repoService.getAllBuilds(),
-    services: otomiStack.repoService.getAllServices(),
-    secrets: otomiStack.repoService.getAllSealedSecrets(),
+    workloads: otomiStack.getAllAplWorkloads(),
+    builds: otomiStack.getAllAplBuilds(),
+    services: otomiStack.getAllAplServices(),
+    secrets: otomiStack.getAllAplSealedSecrets(),
   }
   const statusFunctions = {
     workloads: getWorkloadStatus,
@@ -132,6 +132,10 @@ export const loadSpec = async (): Promise<void> => {
 export const getSpec = (): OtomiSpec => {
   return otomiSpec
 }
+export function getSecretPaths(): string[] {
+  const { secretPaths } = getSpec()
+  return secretPaths
+}
 export const getAppSchema = (appId: string): Schema => {
   let id: string = appId
   if (appId.startsWith('ingress-nginx')) id = 'ingress-nginx-platform'

src/api.authz.test.ts

@@ -14,19 +14,19 @@ export class OtomiError extends CustomError {
 }
 export class ForbiddenError extends OtomiError {
   public constructor(err?: string) {
-    super('Forbidden', err)
+    super(err || 'Forbidden', err)
     this.code = 403
   }
 }
 export class NotExistError extends OtomiError {
   public constructor(err?: string) {
-    super('Not Found', err)
+    super(err || 'Not Found', err)
     this.code = 404
   }
 }
 export class AlreadyExists extends OtomiError {
   public constructor(err?: string) {
-    super('Conflict', err)
+    super(err || 'Conflict', err)
     this.code = 409
   }
 }
@@ -45,7 +45,7 @@ export class PublicUrlExists extends OtomiError {
 }
 export class ValidationError extends OtomiError {
   public constructor(err?: string) {
-    super('Invalid values detected', err)
+    super(err || 'Invalid values detected', err)
     this.code = 422
   }
 }