Take the catalogue's composition rules into the node-engine

ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk carries no composition rule. The catalogue functions only the node-engine's composition reaches (Resolve, Resolution's Compose, Declaration, DataItems, LeftOut, Rules and the rest, the settings, placeholder and template refusals, the rendering helpers) are copied with their tests into internal/compose/resolution; a method of a mesh-sdk shape becomes a function taking it first. The composition calls its own copies, and the captured catalogue its tests read lives here now, shared by mesh-compose's tests. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
2026-11-02 19:15:55 +01:00
parent be0226b624
commit d68e241724
686 changed files with 35703 additions and 80 deletions
@@ -0,0 +1,3 @@
+{
+  "token": "${secret:api-token}"
+}
@@ -0,0 +1,4 @@
+MESH_NODERED_URL=http://127.0.0.1:${port:1880}
+MESH_NODERED_CONFIG_FILE=${dir:mesh-state}/config.json
+MESH_PROVISIONS_DIR=${dir:state}
+MESH_WRITTEN_DIR=${dir:written}
@@ -0,0 +1,48 @@
+// Node-RED's settings, written by the mesh from the nodered module. What an assignment may change
+// is settings.json beside this file (merged key by key); the credentials are the mesh's secrets and
+// reach Node-RED only through this file. The flows' own credentials stay encrypted in the user
+// directory under the key Node-RED keeps there (.config.runtime.json), which is data, not this.
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+
+const ADMIN_PASSWORD = "${secret:admin}";
+const API_TOKEN = "${secret:api-token}";
+const ADMIN = { username: "admin", permissions: "*" };
+
+const settings = JSON.parse(fs.readFileSync(path.join(__dirname, "settings.json"), "utf8"));
+// The mesh's keys, not Node-RED's: endpoints lands in every merged file; timeZone is the
+// assignment's way to set the zone flows schedule and format in; mqtt names the broker nodes the
+// module's MQTT step keeps pointed at the mesh's broker; topics is what nodered asks the broker for.
+if (settings.timeZone) process.env.TZ = settings.timeZone;
+delete settings.timeZone;
+delete settings.endpoints;
+delete settings.mqtt;
+delete settings.topics;
+
+function same(a, b) {
+  const x = crypto.createHash("sha256").update(String(a)).digest();
+  const y = crypto.createHash("sha256").update(String(b)).digest();
+  return crypto.timingSafeEqual(x, y);
+}
+
+// The admin secret is a password, or, accepted from an existing install, the bcrypt hash its
+// settings held, so the password people already use keeps working.
+function passwordMatches(given) {
+  if (/^\$2[aby]\$\d\d\$/.test(ADMIN_PASSWORD)) return require("bcryptjs").compare(String(given), ADMIN_PASSWORD);
+  return Promise.resolve(same(given, ADMIN_PASSWORD));
+}
+
+module.exports = Object.assign(settings, {
+  uiPort: 1880,
+  adminAuth: {
+    type: "credentials",
+    users: (username) => Promise.resolve(username === ADMIN.username ? ADMIN : null),
+    authenticate: (username, password) =>
+      username === ADMIN.username
+        ? passwordMatches(password).then((ok) => (ok ? ADMIN : null))
+        : Promise.resolve(null),
+    // The module's own tools call the admin API with this bearer token.
+    tokens: (token) => Promise.resolve(same(token, API_TOKEN) ? { username: "mesh", permissions: "*" } : null),
+  },
+});
@@ -0,0 +1,14 @@
+{
+  "flowFile": "flows.json",
+  "flowFilePretty": true,
+  "diagnostics": { "enabled": true, "ui": true },
+  "runtimeState": { "enabled": false, "ui": false },
+  "logging": { "console": { "level": "info", "metrics": false, "audit": false } },
+  "exportGlobalContextKeys": false,
+  "externalModules": {},
+  "editorTheme": { "projects": { "enabled": false } },
+  "functionExternalModules": true,
+  "debugMaxLength": 1000,
+  "mqttReconnectTime": 15000,
+  "serialReconnectTime": 15000
+}
@@ -0,0 +1,297 @@
+{
+  "module": "nodered",
+  "version": "1",
+  "emits": [
+    "flows.deployed"
+  ],
+  "own-secrets": {
+    "admin": {
+      "path": "${dir:mesh-state}/admin",
+      "taken": "at-start"
+    },
+    "api-token": {
+      "path": "${dir:mesh-state}/api-token",
+      "taken": "at-start"
+    }
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 1880,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the flow editor and the endpoints flows expose"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "why": "flows and their credentials"
+      }
+    ]
+  },
+  "config": {
+    "flow-file": {
+      "type": "string",
+      "description": "Node-RED's flowFile setting: the file in the user directory the flows are kept in.",
+      "trusted": true,
+      "default": "flows.json"
+    },
+    "flow-file-pretty": {
+      "type": "boolean",
+      "description": "Node-RED's flowFilePretty setting: whether the flows file is written indented.",
+      "trusted": true,
+      "default": true
+    },
+    "diagnostics": {
+      "type": "object",
+      "description": "Node-RED's diagnostics setting: whether its diagnostics report is on, and shown in the editor.",
+      "trusted": true,
+      "default": {
+        "enabled": true,
+        "ui": true
+      }
+    },
+    "runtime-state": {
+      "type": "object",
+      "description": "Node-RED's runtimeState setting: whether flows may be started and stopped from the editor.",
+      "trusted": true,
+      "default": {
+        "enabled": false,
+        "ui": false
+      }
+    },
+    "logging": {
+      "type": "object",
+      "description": "Node-RED's logging setting: the console log's level, and whether metrics and audit events are logged.",
+      "trusted": true,
+      "default": {
+        "console": {
+          "level": "info",
+          "metrics": false,
+          "audit": false
+        }
+      }
+    },
+    "export-global-context-keys": {
+      "type": "boolean",
+      "description": "Node-RED's exportGlobalContextKeys setting: whether a function node may list the global context's keys.",
+      "trusted": true,
+      "default": false
+    },
+    "external-modules": {
+      "type": "object",
+      "description": "Node-RED's externalModules setting: which modules the editor may install, and from where.",
+      "trusted": true,
+      "default": {}
+    },
+    "editor-theme": {
+      "type": "object",
+      "description": "Node-RED's editorTheme setting: the editor's look and features, projects among them.",
+      "trusted": true,
+      "default": {
+        "projects": {
+          "enabled": false
+        }
+      }
+    },
+    "function-external-modules": {
+      "type": "boolean",
+      "description": "Node-RED's functionExternalModules setting: whether a function node may load modules of its own.",
+      "trusted": true,
+      "default": true
+    },
+    "debug-max-length": {
+      "type": "number",
+      "description": "Node-RED's debugMaxLength setting: the most characters a debug message shows, a count.",
+      "trusted": true,
+      "default": 1000
+    },
+    "mqtt-reconnect-time": {
+      "type": "number",
+      "description": "Node-RED's mqttReconnectTime setting: how long an MQTT node waits before reconnecting, in milliseconds.",
+      "trusted": true,
+      "default": 15000
+    },
+    "serial-reconnect-time": {
+      "type": "number",
+      "description": "Node-RED's serialReconnectTime setting: how long a serial node waits before reconnecting, in milliseconds.",
+      "trusted": true,
+      "default": 15000
+    },
+    "mqtt": {
+      "type": "object",
+      "description": "The broker nodes the module's MQTT step keeps pointed at the mesh's broker, as {\"brokers\": [their ids]}; empty, none.",
+      "trusted": true,
+      "default": {}
+    },
+    "time-zone": {
+      "type": "string",
+      "description": "The time zone the flows schedule and format in, an IANA name such as Europe/Brussels; unset, the container's UTC.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000",
+      "unknown": "program"
+    },
+    {
+      "id": "written",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "settings-code",
+      "type": "file",
+      "path": "${dir:state}/settings.js",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "template": "files/settings.js"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "merge": "json",
+      "takes-config": [{"key": "flow-file", "as": "flowFile"}, {"key": "flow-file-pretty", "as": "flowFilePretty"}, "diagnostics", {"key": "runtime-state", "as": "runtimeState"}, "logging", {"key": "export-global-context-keys", "as": "exportGlobalContextKeys"}, {"key": "external-modules", "as": "externalModules"}, {"key": "editor-theme", "as": "editorTheme"}, {"key": "function-external-modules", "as": "functionExternalModules"}, {"key": "debug-max-length", "as": "debugMaxLength"}, {"key": "mqtt-reconnect-time", "as": "mqttReconnectTime"}, {"key": "serial-reconnect-time", "as": "serialReconnectTime"}, "mqtt", {"key": "time-zone", "as": "timeZone"}],
+      "template": "files/settings.json"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "nodered",
+      "image": "nodered/node-red@sha256:a649dd711d55490151a2c39a8e48ad0c44325488fbc0e66315f2d2e19e5e1ace",
+      "health": {
+        "kind": "runtime"
+      },
+      "env": {
+        "TZ": "Etc/UTC"
+      },
+      "ports": [
+        "1880"
+      ],
+      "args": [
+        "--settings",
+        "/data/settings.js"
+      ],
+      "volumes": [
+        "${dir:data}:/data",
+        "${dir:state}/settings.js:/data/settings.js:ro",
+        "${dir:state}/settings.json:/data/settings.json:ro"
+      ],
+      "restart-on": [
+        "settings-code",
+        "settings"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json"
+    },
+    {
+      "id": "mqtt-env",
+      "type": "file",
+      "path": "${dir:state}/mqtt.env",
+      "mode": "0600",
+      "template": "files/mqtt.env"
+    },
+    {
+      "id": "mqtt",
+      "type": "process",
+      "name": "nodered-mqtt",
+      "artifact": "code",
+      "run": [
+        "node",
+        "mqtt/index.js"
+      ],
+      "run-once": true,
+      "env-file": [
+        "${dir:state}/mqtt.env"
+      ],
+      "restart-on": [
+        "mqtt-env",
+        "bound-mqtt-topic",
+        "secret-mqtt-topic",
+        "settings"
+      ]
+    }
+  ],
+  "requires": [
+    "mqtt-topic",
+    "route"
+  ],
+  "contributes": {
+    "mqtt-topic": {
+      "topics": [
+        "#"
+      ]
+    },
+    "route": {
+      "label": "nodered",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json",
+    "mqtt-topic": "${dir:state}/mqtt-topic.json"
+  },
+  "secrets": {
+    "mqtt-topic": "${dir:state}/mqtt-topic.secret"
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "mqtt/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
+          "MESH_NODERED_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}