pleno-vue/scripts/release/update-server-version.mjs

import { execSync } from "node:child_process";
import { fileURLToPath } from "node:url";

function gitCommit() {
  try {
    return execSync("git rev-parse --short HEAD", { encoding: "utf8" }).trim();
  } catch {
    return "";
  }
}

async function boundedJson(response, limit = 64 * 1024) {
  const declared = Number(response.headers.get("content-length"));
  if (Number.isFinite(declared) && declared > limit) throw new Error("Server version response is too large.");
  const reader = response.body?.getReader();
  const chunks = [];
  let bytes = 0;
  if (reader) {
    while (true) {
      const { done, value } = await reader.read();
      if (done) break;
      bytes += value.byteLength;
      if (bytes > limit) {
        await reader.cancel().catch(() => {});
        throw new Error("Server version response is too large.");
      }
      chunks.push(Buffer.from(value));
    }
  }
  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
}

export async function updateServerVersion(env = process.env, fetchImpl = globalThis.fetch) {
  const serverToken = String(env.SERVER_UPDATE_TOKEN || "").trim();
  const releaseGateToken = String(env.RELEASE_MANAGER_GATE_TOKEN || "").trim();
  const token = serverToken || releaseGateToken;
  const useReleaseGate = !serverToken && Boolean(releaseGateToken);
  const required = env.RELEASE_VERSION_UPDATE_REQUIRED === "true";
  if (!token) {
    if (required) {
      throw new Error("SERVER_UPDATE_TOKEN or RELEASE_MANAGER_GATE_TOKEN is required after deploy verification.");
    }
    console.log("No server version credential is set. Skipping server version update.");
    return;
  }

  const version = String(
    env.RELEASE_VERSION || env.RELEASE_EXPECTED_COMMIT || env.GITHUB_SHA || gitCommit()
  ).toLowerCase();
  if (!/^[a-f0-9]{40}$/.test(version)) {
    throw new Error("Server release version must be a full lowercase commit SHA.");
  }

  const baseUrl =
    env.SERVER_UPDATE_URL ||
    (useReleaseGate
      ? "https://api-v2.truckwash.io/master/api/release/gate/frontend-version"
      : "https://api-v2.truckwash.io/master/api/worker/update-version");
  const url = new URL(baseUrl);
  if (url.protocol !== "https:" || url.username || url.password) {
    throw new Error("SERVER_UPDATE_URL must be an HTTPS URL without embedded credentials.");
  }
  const request = {
    method: useReleaseGate ? "POST" : "GET",
    redirect: "manual",
    signal: AbortSignal.timeout(30_000),
    headers: {
      Authorization: `Bearer ${token}`,
      "Cache-Control": "no-cache",
    },
  };
  if (useReleaseGate) {
    const repository = String(env.GITHUB_REPOSITORY || "copenhagentruckwash/pleno-vue").trim();
    const branch = String(env.RELEASE_BRANCH || "master")
      .trim()
      .toLowerCase();
    const buildId = String(env.RELEASE_BUILD_ID || env.RELEASE_EXPECTED_BUILD_ID || "").trim();
    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository)) {
      throw new Error("Frontend release repository is invalid.");
    }
    if (branch !== "master") {
      throw new Error("Frontend release branch must be master.");
    }
    if (!/^[1-9][0-9]*-[1-9][0-9]*$/.test(buildId)) {
      throw new Error("Frontend release build id is invalid.");
    }
    request.headers["Content-Type"] = "application/json";
    request.body = JSON.stringify({ version, repository, branch, build_id: buildId });
  } else {
    url.searchParams.set("version", version);
  }

  const response = await fetchImpl(url, request);

  const body = await boundedJson(response).catch(() => ({}));
  if (!response.ok) {
    throw new Error(`Server version update failed with HTTP ${response.status}.`);
  }

  const readUrl = new URL(
    env.SERVER_VERSION_READ_URL ||
      (useReleaseGate
        ? "https://api-v2.truckwash.io/master/api/release/gate/frontend-version"
        : "https://api-v2.truckwash.io/master/api/worker/version")
  );
  if (
    readUrl.protocol !== "https:" ||
    readUrl.origin !== url.origin ||
    readUrl.username ||
    readUrl.password ||
    readUrl.search ||
    readUrl.hash
  ) {
    throw new Error("SERVER_VERSION_READ_URL must be an exact HTTPS URL on the update origin.");
  }
  readUrl.searchParams.set("verify", `${Date.now()}`);
  const verification = await fetchImpl(readUrl, {
    method: "GET",
    redirect: "manual",
    signal: AbortSignal.timeout(30_000),
    headers: {
      Authorization: `Bearer ${token}`,
      "Cache-Control": "no-cache",
      Pragma: "no-cache",
    },
  });
  if (!verification.ok) {
    throw new Error(`Server version read-back failed with HTTP ${verification.status}.`);
  }
  const verified = await boundedJson(verification);
  const observed = String(verified?.data?.version ?? verified?.version ?? "").toLowerCase();
  if (observed !== version) {
    throw new Error(`Server version read-back did not match ${version}.`);
  }
  console.log(`Server version updated to ${version}.`);
  return { version, update: body, observed };
}

async function main() {
  await updateServerVersion();
}

if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
  main().catch((error) => {
    console.error(error instanceof Error ? error.stack || error.message : error);
    process.exit(1);
  });
}