jschoubben
962bc359a7
occ's user:info says 'user not found' on stdout with an empty stderr, so the error read as 'occ produced no output' and mesh-admin was never made on novox: occ now says stderr and stdout both, and existence is read from user:list. The repair could reset whatever account the user setting names, the operator's included, and the 'admin' fallback is a hand-made install's human administrator: only mesh-admin is repaired now, and it is the default. The shares poll needs no admin rights, so the account gets no group. After a repair the throttle of the caller's address is reset, and a failing repair reaches the back-off's one loud line with occ's message.
380 lines
17 KiB
TypeScript
380 lines
17 KiB
TypeScript
// Nextcloud's client — nextcloud's own code, living in the module (novox/hq ADR 0039). Both this
|
|
// module's tools and its events entrypoint import it, and nothing outside nextcloud does.
|
|
//
|
|
// Nextcloud is administered two ways, and this client speaks both:
|
|
// - occ, its admin CLI, is a PHP script inside the container runnable only as the web user. We
|
|
// reach it with `docker exec`, the same side channel an operator would use by hand — turned
|
|
// into something the mesh can call. Users and apps come from here.
|
|
// - the OCS Sharing API answers over HTTP with the admin credentials. Shares come from here,
|
|
// because occ has no version-stable "list every share" across the releases we run.
|
|
|
|
import { execFileSync } from "node:child_process";
|
|
import { readFileSync } from "node:fs";
|
|
|
|
export interface NextcloudUser {
|
|
uid: string;
|
|
displayName: string;
|
|
}
|
|
|
|
export interface NextcloudShare {
|
|
/** The OCS share id — the stable identity a new share is diffed on. */
|
|
id: string;
|
|
path: string;
|
|
shareType: number;
|
|
shareWith?: string;
|
|
owner: string;
|
|
}
|
|
|
|
/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
|
|
function meshConfig(file?: string): Record<string, string> {
|
|
if (!file) return {};
|
|
try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
|
|
catch { return {}; }
|
|
}
|
|
|
|
/**
|
|
* A password, token or API key is the vault's, never a setting (novox/hq issue 342): a value for one of
|
|
* them in the settings file is ignored, and that is said once — by its key, never with its value.
|
|
*/
|
|
const saidIgnored = new Set<string>();
|
|
function ignoreSecretSetting(cfg: Record<string, unknown>, key: string): void {
|
|
if (cfg[key] === undefined || saidIgnored.has(key)) return;
|
|
saidIgnored.add(key);
|
|
console.error(`the setting ${key} is ignored: it comes from the vault`);
|
|
}
|
|
|
|
/** What applyOnlyOffice changed and whether it checked the connection (novox/hq issue 1830). */
|
|
export interface OnlyOfficeResult {
|
|
/** The onlyoffice occ keys that were set this call — key names only, never a value. */
|
|
changed: string[];
|
|
/** Whether `onlyoffice:documentserver --check` ran, and passed; absent when nothing changed. */
|
|
checkOk?: boolean;
|
|
}
|
|
|
|
// occ's config key, and the mesh-delivered config.json key it comes from (files/config.json).
|
|
const ONLYOFFICE_KEYS: ReadonlyArray<readonly [occKey: string, configKey: string]> = [
|
|
["DocumentServerUrl", "onlyofficeUrl"],
|
|
["DocumentServerInternalUrl", "onlyofficeInternalUrl"],
|
|
["StorageUrl", "onlyofficeStorageUrl"],
|
|
["jwt_secret", "onlyofficeSecret"],
|
|
];
|
|
|
|
let saidOnlyOfficeNotGiven = false;
|
|
|
|
/**
|
|
* The one Nextcloud account the module makes and keeps for itself: the same name files/server.env
|
|
* gives NEXTCLOUD_ADMIN_USER (novox/hq issue 1253). Only this account is ever repaired; a `user`
|
|
* setting naming any other account is used as given and never written to.
|
|
*/
|
|
export const MESH_ACCOUNT = "mesh-admin";
|
|
|
|
/**
|
|
* Nextcloud refused the mesh's own login on its OCS surface (HTTP 401), or throttled it after
|
|
* refusals (HTTP 429, its brute-force protection). Said by its status and the account, never a
|
|
* password; the events loop backs off on it instead of asking again every tick.
|
|
*/
|
|
export class LoginRefusedError extends Error {
|
|
constructor(readonly status: number, readonly user: string, detail: string) {
|
|
super(`Nextcloud refused the login of ${user} (${status}${detail ? ": " + detail : ""})`);
|
|
this.name = "LoginRefusedError";
|
|
}
|
|
}
|
|
|
|
/** The OCS envelope's own message, the one line worth saying of a refusal; empty when none. */
|
|
function ocsMessage(body: string): string {
|
|
const xml = /<message>([^<]*)<\/message>/.exec(body);
|
|
if (xml) return xml[1].trim();
|
|
try { return String(JSON.parse(body)?.ocs?.meta?.message ?? "").trim(); } catch { return ""; }
|
|
}
|
|
|
|
/**
|
|
* How long to leave a failing poll alone: the base interval after the first failure, doubling on
|
|
* each further one up to `maxMs`, and back to every tick once a poll passes. `due` says whether a
|
|
* tick should poll; `failed` records a failure and answers whether it is the first of a run (said
|
|
* loud) or the one that reached the ceiling (said once more), so a failure is never said every tick.
|
|
*/
|
|
export class Backoff {
|
|
private delayMs = 0;
|
|
private nextAt = 0;
|
|
private failures = 0;
|
|
|
|
constructor(private readonly baseMs: number, private readonly maxMs: number) {}
|
|
|
|
due(now: number): boolean {
|
|
return now >= this.nextAt;
|
|
}
|
|
|
|
failed(now: number): { first: boolean; atCeiling: boolean; delayMs: number } {
|
|
this.failures += 1;
|
|
const before = this.delayMs;
|
|
this.delayMs = before === 0 ? this.baseMs : Math.min(before * 2, this.maxMs);
|
|
this.nextAt = now + this.delayMs;
|
|
return { first: this.failures === 1, atCeiling: this.delayMs === this.maxMs && before !== this.maxMs, delayMs: this.delayMs };
|
|
}
|
|
|
|
/** A poll passed; answers whether it ended a run of failures. */
|
|
passed(): boolean {
|
|
const wasFailing = this.failures > 0;
|
|
this.failures = 0;
|
|
this.delayMs = 0;
|
|
this.nextAt = 0;
|
|
return wasFailing;
|
|
}
|
|
}
|
|
|
|
export class NextcloudClient {
|
|
// Whether the last connection check failed (novox/hq issue 1832): while it did, every tick runs
|
|
// the check again, even when nothing changed, until it passes.
|
|
private lastCheckFailed = false;
|
|
// Whether the account was already made right since the last accepted login (novox/hq issue
|
|
// 1253): a refusal makes it right once, and a refusal after that is said, not repaired again.
|
|
private accountMadeRight = false;
|
|
|
|
constructor(
|
|
private readonly container: string,
|
|
private readonly ocsUrl: string,
|
|
private readonly adminUser: string,
|
|
private readonly adminPassword: string,
|
|
) {}
|
|
|
|
/**
|
|
* Build from the module's resolved environment. occ needs only the container name (default
|
|
* "nextcloud"); the OCS surface needs the admin password the module keeps as its own secret
|
|
* (MESH_NEXTCLOUD_ADMIN_PASSWORD, user MESH_NEXTCLOUD_ADMIN_USER default mesh-admin, URL the local
|
|
* container). The admin password is treated as the "configured for mesh administration" signal:
|
|
* throws without it, and the module then contributes nothing rather than failing.
|
|
*/
|
|
static fromEnv(env: NodeJS.ProcessEnv = process.env): NextcloudClient {
|
|
const cfg = meshConfig(env.MESH_NEXTCLOUD_CONFIG_FILE);
|
|
// An empty setting is the manifest's "empty is the default", never an empty name.
|
|
const container = cfg.container || env.MESH_NEXTCLOUD_CONTAINER || "nextcloud";
|
|
const ocsUrl = cfg.url || env.MESH_NEXTCLOUD_URL || `http://127.0.0.1:${env.NEXTCLOUD_PORT ?? "80"}`;
|
|
// No "admin" fallback: that is what a hand-made install calls its human administrator.
|
|
const adminUser = cfg.user || env.MESH_NEXTCLOUD_ADMIN_USER || MESH_ACCOUNT;
|
|
const passwordFile = env.MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE;
|
|
ignoreSecretSetting(cfg, "password");
|
|
const adminPassword = env.MESH_NEXTCLOUD_ADMIN_PASSWORD
|
|
?? (passwordFile ? readFileSync(passwordFile, "utf8").trim() : undefined);
|
|
if (!adminPassword) {
|
|
throw new Error("no Nextcloud admin password — set MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE " +
|
|
"(or MESH_NEXTCLOUD_ADMIN_PASSWORD)");
|
|
}
|
|
return new NextcloudClient(container, ocsUrl.replace(/\/$/, ""), adminUser, adminPassword);
|
|
}
|
|
|
|
/**
|
|
* Run occ inside the container as the web user, returning its stdout, throwing its own message.
|
|
* With `opts.input` given, occ reads it from stdin (`docker exec -i`) instead of taking it on the
|
|
* command line — the only way a secret value reaches occ without sitting in the docker CLI's argv,
|
|
* the container's php argv and docker's exec record (novox/hq issue 1831). With `opts.env` given,
|
|
* each variable is passed by name alone (`docker exec -e NAME`), its value taken from the docker
|
|
* CLI's own environment, so it is on no argv either (occ's `--password-from-env` reads OC_PASS).
|
|
*/
|
|
occ(args: string[], opts: { input?: string; env?: Record<string, string> } = {}): string {
|
|
const dockerArgs = ["exec"];
|
|
if (opts.input !== undefined) dockerArgs.push("-i");
|
|
for (const name of Object.keys(opts.env ?? {})) dockerArgs.push("-e", name);
|
|
dockerArgs.push("-u", "www-data", this.container, "php", "occ", ...args);
|
|
try {
|
|
return execFileSync("docker", dockerArgs, {
|
|
encoding: "utf8", timeout: 60_000,
|
|
...(opts.input !== undefined ? { input: opts.input } : {}),
|
|
...(opts.env ? { env: { ...process.env, ...opts.env } } : {}),
|
|
}).trim();
|
|
} catch (err: any) {
|
|
// occ writes many refusals ("user not found") to stdout with an empty stderr: say both.
|
|
const detail = [err?.stderr, err?.stdout].map((x) => String(x ?? "").trim()).filter(Boolean).join("\n")
|
|
|| String(err?.message ?? "").trim();
|
|
throw new Error(detail || `occ produced no output — is the ${this.container} container running?`);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Applies OnlyOffice's settings from the mesh-delivered config (novox/hq issue 1830), read fresh
|
|
* from the config file on every call. Sets only the occ keys that differ from Nextcloud's current
|
|
* ones, then runs the connection check once something changed. When any of the four values is not
|
|
* given yet (document-server not bound, or its secret not given), changes nothing and says so once
|
|
* — never on every call. Never logs, returns or emits the secret's value: `changed` holds key names
|
|
* only, `jwt_secret` among them, never jwt_secret's value.
|
|
*/
|
|
applyOnlyOffice(configFile: string | undefined = process.env.MESH_NEXTCLOUD_CONFIG_FILE): OnlyOfficeResult {
|
|
const cfg = meshConfig(configFile);
|
|
const desired = ONLYOFFICE_KEYS.map(([occKey, configKey]) => [occKey, cfg[configKey] ?? ""] as const);
|
|
if (desired.some(([, value]) => !value)) {
|
|
if (!saidOnlyOfficeNotGiven) {
|
|
saidOnlyOfficeNotGiven = true;
|
|
console.error("onlyoffice: document-server is not bound yet, or its secret is not given yet — nothing applied");
|
|
}
|
|
return { changed: [] };
|
|
}
|
|
|
|
const changed: string[] = [];
|
|
for (const [occKey, value] of desired) {
|
|
if (this.currentAppConfig(occKey) !== value) {
|
|
// jwt_secret is a secret: apply it by stdin of config:import, never on an argv (issue 1831).
|
|
if (occKey === "jwt_secret") {
|
|
this.occ(["config:import"], { input: JSON.stringify({ apps: { onlyoffice: { jwt_secret: value } } }) });
|
|
} else {
|
|
this.occ(["config:app:set", "onlyoffice", occKey, `--value=${value}`]);
|
|
}
|
|
changed.push(occKey);
|
|
}
|
|
}
|
|
// Nothing changed, and the last check (if any) passed: there is nothing to check again
|
|
// (novox/hq issue 1832). Otherwise — something changed, or the last check failed — run it.
|
|
if (changed.length === 0 && !this.lastCheckFailed) return { changed };
|
|
|
|
let checkOk = true;
|
|
try {
|
|
this.occ(["onlyoffice:documentserver", "--check"]);
|
|
} catch {
|
|
checkOk = false;
|
|
}
|
|
this.lastCheckFailed = !checkOk;
|
|
return { changed, checkOk };
|
|
}
|
|
|
|
/**
|
|
* config:app:get of a key onlyoffice never set can throw occ's own "produced no output" error
|
|
* (occ above) rather than answer an empty string; read either as unset, so a first run sets it
|
|
* rather than aborting the loop.
|
|
*/
|
|
private currentAppConfig(key: string): string {
|
|
try {
|
|
return this.occ(["config:app:get", "onlyoffice", key]);
|
|
} catch {
|
|
return "";
|
|
}
|
|
}
|
|
|
|
listUsers(): NextcloudUser[] {
|
|
// user:list --output=json answers an object of uid → display name.
|
|
const raw = this.occ(["user:list", "--output=json"]);
|
|
const map = JSON.parse(raw || "{}") as Record<string, string>;
|
|
return Object.entries(map).map(([uid, displayName]) => ({ uid, displayName }));
|
|
}
|
|
|
|
listApps(): { enabled: string[]; disabled: string[] } {
|
|
const raw = this.occ(["app:list", "--output=json"]);
|
|
const parsed = JSON.parse(raw || "{}") as { enabled?: Record<string, unknown>; disabled?: Record<string, unknown> };
|
|
return { enabled: Object.keys(parsed.enabled ?? {}), disabled: Object.keys(parsed.disabled ?? {}) };
|
|
}
|
|
|
|
/**
|
|
* Makes the mesh's own account in Nextcloud match the module's own secret (novox/hq issue 1253).
|
|
* The image creates NEXTCLOUD_ADMIN_USER only when it installs a fresh instance, so an instance
|
|
* the mesh adopted never has it, and a secret made anew never reaches it. Only the module's own
|
|
* account (MESH_ACCOUNT) is touched: under any other name it writes nothing and throws
|
|
* LoginRefusedError. Through occ: whether the account exists is read from user:list's
|
|
* membership; a missing one is added, an existing one gets its password set to the secret. It
|
|
* gets no admin group: the shares poll needs no admin rights (least privilege). The password
|
|
* goes by OC_PASS (`--password-from-env`), never on an argv. Then the brute-force record of the
|
|
* addresses the module's calls arrive from is reset, so the first good login is not held behind
|
|
* the throttle. A failing occ write is thrown as LoginRefusedError carrying occ's own message.
|
|
*/
|
|
ensureAdminAccount(): { account: "created" | "password-set"; throttleReset: boolean } {
|
|
if (this.adminUser !== MESH_ACCOUNT) {
|
|
throw new LoginRefusedError(401, this.adminUser, `not repaired: only ${MESH_ACCOUNT}, the module's own account, is`);
|
|
}
|
|
const pass = { env: { OC_PASS: this.adminPassword } };
|
|
let account: "created" | "password-set";
|
|
try {
|
|
if (!this.listUsers().some((u) => u.uid === this.adminUser)) {
|
|
this.occ(["user:add", "--password-from-env", "--display-name=Mesh administration", this.adminUser], pass);
|
|
account = "created";
|
|
} else {
|
|
this.occ(["user:resetpassword", "--password-from-env", this.adminUser], pass);
|
|
account = "password-set";
|
|
}
|
|
} catch (err) {
|
|
throw new LoginRefusedError(401, this.adminUser, `repair failed: ${String((err as Error)?.message ?? err).split("\n")[0]}`);
|
|
}
|
|
let throttleReset = true;
|
|
try {
|
|
for (const address of this.callerAddresses()) this.occ(["security:bruteforce:reset", address]);
|
|
} catch {
|
|
throttleReset = false;
|
|
}
|
|
return { account, throttleReset };
|
|
}
|
|
|
|
/**
|
|
* The addresses the module's calls reach Nextcloud from, as Nextcloud sees them: the gateway of
|
|
* each network the container is on (a published port arrives from it; the access log shows
|
|
* 172.17.0.1 on the default bridge).
|
|
*/
|
|
callerAddresses(): string[] {
|
|
const out = execFileSync("docker", ["inspect", "-f", "{{range .NetworkSettings.Networks}}{{.Gateway}} {{end}}", this.container], {
|
|
encoding: "utf8", timeout: 30_000,
|
|
});
|
|
return out.split(/\s+/).filter(Boolean);
|
|
}
|
|
|
|
private fetchShares(): Promise<Response> {
|
|
const auth = Buffer.from(`${this.adminUser}:${this.adminPassword}`).toString("base64");
|
|
return fetch(
|
|
`${this.ocsUrl}/ocs/v2.php/apps/files_sharing/api/v1/shares?format=json`,
|
|
{ headers: { Authorization: `Basic ${auth}`, "OCS-APIRequest": "true", Accept: "application/json" } },
|
|
);
|
|
}
|
|
|
|
/**
|
|
* List every share, over the OCS Sharing API as the mesh's own account. A refused login (401) or
|
|
* a throttle (429) makes the account right once (ensureAdminAccount) and asks again; a refusal
|
|
* or a throttle after that throws LoginRefusedError, so the caller backs off (novox/hq issue 1253).
|
|
*/
|
|
async listShares(): Promise<NextcloudShare[]> {
|
|
let res = await this.fetchShares();
|
|
// A throttle (429) follows refusals, so it gets the same one repair: the repair goes by occ,
|
|
// never by a login, and the throttle then wears off under the caller's back-off.
|
|
if ((res.status === 401 || res.status === 429) && !this.accountMadeRight) {
|
|
await res.text();
|
|
this.accountMadeRight = true;
|
|
this.ensureAdminAccount();
|
|
res = await this.fetchShares();
|
|
}
|
|
if (res.status === 401 || res.status === 429) {
|
|
throw new LoginRefusedError(res.status, this.adminUser, ocsMessage(await res.text()));
|
|
}
|
|
if (!res.ok) throw new Error(`Nextcloud OCS shares: ${res.status} ${ocsMessage(await res.text())}`.trim());
|
|
this.accountMadeRight = false;
|
|
const rows = ((await res.json())?.ocs?.data ?? []) as any[];
|
|
return rows.map((s) => ({
|
|
id: String(s.id),
|
|
path: s.path ?? "",
|
|
shareType: Number(s.share_type ?? -1),
|
|
shareWith: s.share_with || undefined,
|
|
owner: s.uid_owner ?? "unknown",
|
|
}));
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Runs one poll of the shares under a back-off (novox/hq issue 1253): skipped while backing off;
|
|
* a LoginRefusedError is said loud at the first failure and once more when the wait reaches its
|
|
* ceiling, never on every tick; one line says when it passes again. Other errors are thrown on,
|
|
* so the loop logs them as before.
|
|
*/
|
|
export async function pollSharesGuarded(
|
|
client: NextcloudClient,
|
|
backoff: Backoff,
|
|
poll: (c: NextcloudClient) => Promise<void>,
|
|
now: () => number = Date.now,
|
|
): Promise<void> {
|
|
if (!backoff.due(now())) return;
|
|
try {
|
|
await poll(client);
|
|
} catch (err) {
|
|
if (!(err instanceof LoginRefusedError)) throw err;
|
|
const step = backoff.failed(now());
|
|
const minutes = Math.round(step.delayMs / 60_000);
|
|
if (step.first) {
|
|
console.error(`[nextcloud] shares: ${err.message}; not asking again for ${minutes} min, then less often, up to every hour`);
|
|
} else if (step.atCeiling) {
|
|
console.error(`[nextcloud] shares: ${err.message}, still; asking once an hour from now on`);
|
|
}
|
|
return;
|
|
}
|
|
if (backoff.passed()) console.log("[nextcloud] shares: the login is accepted again");
|
|
}
|