Harden atomic cPanel release recovery (#238)

Adds exact-SHA cPanel release proof v2, atomic rollback restoration, and protected recovery gating.
2026-07-29 20:30:34 +02:00
parent c85a82b9ac
commit 468d436d3e
5 changed files with 520 additions and 39 deletions
@@ -1,4 +1,5 @@
 import { execSync } from "node:child_process";
+import { fileURLToPath } from "node:url";

 function gitCommit() {
  try {
@@ -8,9 +9,30 @@ function gitCommit() {
  }
 }

-async function main() {
-  const token = process.env.SERVER_UPDATE_TOKEN;
-  const required = process.env.RELEASE_VERSION_UPDATE_REQUIRED === "true";
+async function boundedJson(response, limit = 64 * 1024) {
+  const declared = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > limit) throw new Error("Server version response is too large.");
+  const reader = response.body?.getReader();
+  const chunks = [];
+  let bytes = 0;
+  if (reader) {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > limit) {
+        await reader.cancel().catch(() => {});
+        throw new Error("Server version response is too large.");
+      }
+      chunks.push(Buffer.from(value));
+    }
+  }
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+
+export async function updateServerVersion(env = process.env, fetchImpl = globalThis.fetch) {
+  const token = env.SERVER_UPDATE_TOKEN;
+  const required = env.RELEASE_VERSION_UPDATE_REQUIRED === "true";
  if (!token) {
    if (required) {
      throw new Error("SERVER_UPDATE_TOKEN is required after deploy verification.");
@@ -19,32 +41,70 @@ async function main() {
    return;
  }

-  const version = process.env.RELEASE_VERSION || process.env.RELEASE_EXPECTED_COMMIT || process.env.GITHUB_SHA || gitCommit();
-  if (!version) {
-    throw new Error("Could not determine release version for server update.");
+  const version = String(env.RELEASE_VERSION || env.RELEASE_EXPECTED_COMMIT || env.GITHUB_SHA || gitCommit())
+    .toLowerCase();
+  if (!/^[a-f0-9]{40}$/.test(version)) {
+    throw new Error("Server release version must be a full lowercase commit SHA.");
  }

-  const baseUrl = process.env.SERVER_UPDATE_URL || "https://api-v2.truckwash.io/master/api/worker/update-version";
+  const baseUrl = env.SERVER_UPDATE_URL || "https://api-v2.truckwash.io/master/api/worker/update-version";
  const url = new URL(baseUrl);
+  if (url.protocol !== "https:" || url.username || url.password) {
+    throw new Error("SERVER_UPDATE_URL must be an HTTPS URL without embedded credentials.");
+  }
  url.searchParams.set("version", version);

-  const response = await fetch(url, {
+  const response = await fetchImpl(url, {
    method: "GET",
+    redirect: "manual",
+    signal: AbortSignal.timeout(30_000),
    headers: {
      Authorization: `Bearer ${token}`,
      "Cache-Control": "no-cache",
    },
  });

-  const body = await response.text();
+  const body = await boundedJson(response).catch(() => ({}));
  if (!response.ok) {
-    throw new Error(`Server version update failed with HTTP ${response.status}: ${body}`);
+    throw new Error(`Server version update failed with HTTP ${response.status}.`);
  }

+  const readUrl = new URL(env.SERVER_VERSION_READ_URL
+    || "https://api-v2.truckwash.io/master/api/worker/version");
+  if (readUrl.protocol !== "https:" || readUrl.origin !== url.origin
+    || readUrl.username || readUrl.password || readUrl.search || readUrl.hash) {
+    throw new Error("SERVER_VERSION_READ_URL must be an exact HTTPS URL on the update origin.");
+  }
+  readUrl.searchParams.set("verify", `${Date.now()}`);
+  const verification = await fetchImpl(readUrl, {
+    method: "GET",
+    redirect: "manual",
+    signal: AbortSignal.timeout(30_000),
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Cache-Control": "no-cache",
+      Pragma: "no-cache",
+    },
+  });
+  if (!verification.ok) {
+    throw new Error(`Server version read-back failed with HTTP ${verification.status}.`);
+  }
+  const verified = await boundedJson(verification);
+  const observed = String(verified?.data?.version ?? verified?.version ?? "").toLowerCase();
+  if (observed !== version) {
+    throw new Error(`Server version read-back did not match ${version}.`);
+  }
  console.log(`Server version updated to ${version}.`);
+  return { version, update: body, observed };
 }

-main().catch((error) => {
-  console.error(error instanceof Error ? error.stack || error.message : error);
-  process.exit(1);
-});
+async function main() {
+  await updateServerVersion();
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  main().catch((error) => {
+    console.error(error instanceof Error ? error.stack || error.message : error);
+    process.exit(1);
+  });
+}