pleno-vue/scripts/release/update-server-version.mjs

import { execSync } from "node:child_process";
import { fileURLToPath } from "node:url";

function gitCommit() {
  try {
    return execSync("git rev-parse --short HEAD", { encoding: "utf8" }).trim();
  } catch {
    return "";
  }
}

async function boundedJson(response, limit = 64 * 1024) {
  const declared = Number(response.headers.get("content-length"));
  if (Number.isFinite(declared) && declared > limit) throw new Error("Server version response is too large.");
  const reader = response.body?.getReader();
  const chunks = [];
  let bytes = 0;
  if (reader) {
    while (true) {
      const { done, value } = await reader.read();
      if (done) break;
      bytes += value.byteLength;
      if (bytes > limit) {
        await reader.cancel().catch(() => {});
        throw new Error("Server version response is too large.");
      }
      chunks.push(Buffer.from(value));
    }
  }
  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
}

export async function updateServerVersion(env = process.env, fetchImpl = globalThis.fetch) {
  const token = env.SERVER_UPDATE_TOKEN;
  const required = env.RELEASE_VERSION_UPDATE_REQUIRED === "true";
  if (!token) {
    if (required) {
      throw new Error("SERVER_UPDATE_TOKEN is required after deploy verification.");
    }
    console.log("SERVER_UPDATE_TOKEN is not set. Skipping server version update.");
    return;
  }

  const version = String(env.RELEASE_VERSION || env.RELEASE_EXPECTED_COMMIT || env.GITHUB_SHA || gitCommit())
    .toLowerCase();
  if (!/^[a-f0-9]{40}$/.test(version)) {
    throw new Error("Server release version must be a full lowercase commit SHA.");
  }

  const baseUrl = env.SERVER_UPDATE_URL || "https://api-v2.truckwash.io/master/api/worker/update-version";
  const url = new URL(baseUrl);
  if (url.protocol !== "https:" || url.username || url.password) {
    throw new Error("SERVER_UPDATE_URL must be an HTTPS URL without embedded credentials.");
  }
  url.searchParams.set("version", version);

  const response = await fetchImpl(url, {
    method: "GET",
    redirect: "manual",
    signal: AbortSignal.timeout(30_000),
    headers: {
      Authorization: `Bearer ${token}`,
      "Cache-Control": "no-cache",
    },
  });

  const body = await boundedJson(response).catch(() => ({}));
  if (!response.ok) {
    throw new Error(`Server version update failed with HTTP ${response.status}.`);
  }

  const readUrl = new URL(env.SERVER_VERSION_READ_URL
    || "https://api-v2.truckwash.io/master/api/worker/version");
  if (readUrl.protocol !== "https:" || readUrl.origin !== url.origin
    || readUrl.username || readUrl.password || readUrl.search || readUrl.hash) {
    throw new Error("SERVER_VERSION_READ_URL must be an exact HTTPS URL on the update origin.");
  }
  readUrl.searchParams.set("verify", `${Date.now()}`);
  const verification = await fetchImpl(readUrl, {
    method: "GET",
    redirect: "manual",
    signal: AbortSignal.timeout(30_000),
    headers: {
      Authorization: `Bearer ${token}`,
      "Cache-Control": "no-cache",
      Pragma: "no-cache",
    },
  });
  if (!verification.ok) {
    throw new Error(`Server version read-back failed with HTTP ${verification.status}.`);
  }
  const verified = await boundedJson(verification);
  const observed = String(verified?.data?.version ?? verified?.version ?? "").toLowerCase();
  if (observed !== version) {
    throw new Error(`Server version read-back did not match ${version}.`);
  }
  console.log(`Server version updated to ${version}.`);
  return { version, update: body, observed };
}

async function main() {
  await updateServerVersion();
}

if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
  main().catch((error) => {
    console.error(error instanceof Error ? error.stack || error.message : error);
    process.exit(1);
  });
}