config/apps.go
Rama main · réplica de lectura del repositorio original.
package config
import (
"encoding/base64"
"fmt"
"os"
"strconv"
"strings"
"sync"
"time"
"unicode"
)
// maxAppIdLen caps the app id length. Long enough for UUIDs (36), ULIDs (26),
// Expo project ids (36), and reasonable slug prefixes; short enough that a
// hostile or typo'd value can't DoS our path-building or map-keying paths.
const maxAppIdLen = 64
// reservedAppIds are names that collide with top-level HTTP routes. Gorilla
// mux resolves static routes before pattern routes, so a config with an app
// id of "dashboard" would never receive traffic on /{APP_ID}/…, routes would
// route to the dashboard static handler instead. Rejecting these at boot
// surfaces the misconfiguration before it becomes a silent outage.
var reservedAppIds = map[string]struct{}{
"api": {},
"assets": {},
"auth": {},
"dashboard": {},
"hc": {},
"manifest": {},
"metrics": {},
}
// KeysMode identifies how an app's signing key pair is stored.
type KeysMode string
const (
KeysModeLocal KeysMode = "local"
KeysModeAWSSM KeysMode = "aws-secrets-manager"
KeysModeEnvironment KeysMode = "environment"
KeysModeDatabase KeysMode = "database"
)
// KeysConfig is a tagged union: exactly one set of fields must be populated,
// matched by Mode. Validated at LoadConfig time, downstream code assumes a
// valid config and does not re-check invariants.
type KeysConfig struct {
Mode KeysMode `json:"mode"`
// mode=local
PublicPath string `json:"publicPath,omitempty"`
PrivatePath string `json:"privatePath,omitempty"`
// mode=aws-secrets-manager
PublicSecretId string `json:"publicSecretId,omitempty"`
PrivateSecretId string `json:"privateSecretId,omitempty"`
// mode=environment
PublicB64 string `json:"publicB64,omitempty"`
PrivateB64 string `json:"privateB64,omitempty"`
// mode=database
SealedPublicKey string `json:"sealedPublicKey,omitempty"`
SealedPrivateKey string `json:"sealedPrivateKey,omitempty"`
}
// AppConfig is the resolved configuration for one app. In stateless mode it
// is built from the flat env vars; in control-plane mode it is hydrated from
// a database row. Each app has its own identity (id, accessToken) and signing
// key pair. Name is optional and used purely as a display label in the
// dashboard, it does not participate in request routing, which always goes
// by Id.
type AppConfig struct {
Id string `json:"id"`
Name string `json:"name,omitempty"`
GitURL string `json:"gitUrl,omitempty"`
AccessToken string `json:"accessToken,omitempty"`
Keys KeysConfig `json:"keys"`
CreatedAt time.Duration `json:"createTime,omitempty"`
}
// AppDescriptor is the public-safe view of an AppConfig (no token, no keys)
// intended for dashboard listings and anything else that needs to enumerate
// apps without touching secrets.
type AppDescriptor struct {
Id string `json:"id"`
Name string `json:"name,omitempty"`
}
var (
appsByIdMu sync.RWMutex
appsById map[string]*AppConfig
)
// LoadAppsFromFlatEnv resolves the single-app stateless config from the flat
// env vars (EXPO_APP_ID, EXPO_ACCESS_TOKEN, KEYS_STORAGE_TYPE and its mode-
// specific siblings), validates it, and caches the result in memory. This
// mirrors the v1 env layout unchanged, so a v1 install upgrades to v2 with
// zero config changes. Multi-app deployments are served by the control plane
// (DB mode), which loads apps from the database and never calls this.
//
// Must be called once from wire.go (stateless branch) before any handler
// resolves an app. Returns a non-nil error on any structural or semantic
// issue; callers are expected to log.Fatal on error.
func LoadAppsFromFlatEnv() error {
apps, source, err := ReadAppsFromFlatEnv()
if err != nil {
return err
}
if len(apps) == 0 {
return fmt.Errorf("%s: must declare at least one app", source)
}
index := make(map[string]*AppConfig, len(apps))
for i := range apps {
app := &apps[i]
if err := validateApp(app, i); err != nil {
return fmt.Errorf("%s: %w", source, err)
}
if _, dup := index[app.Id]; dup {
return fmt.Errorf("%s: duplicate app id %q", source, app.Id)
}
index[app.Id] = app
}
appsByIdMu.Lock()
appsById = index
appsByIdMu.Unlock()
return nil
}
// ReadAppsFromFlatEnv returns the parsed (but not yet validated) single-app
// config plus a human-readable source tag used for error messages. It reads
// the legacy v1 variable names verbatim to preserve upgrade-in-place. Returned
// as a slice so callers (LoadAppsFromFlatEnv, the infra→DB migration) share one
// iteration shape whether the config carries one app (stateless) or many
// (control plane).
func ReadAppsFromFlatEnv() ([]AppConfig, string, error) {
if appId := strings.TrimSpace(os.Getenv("EXPO_APP_ID")); appId != "" {
return []AppConfig{parseFlatEnvApp(appId)}, "flat env (EXPO_APP_ID)", nil
}
return nil, "", fmt.Errorf("no app config found: set EXPO_APP_ID + EXPO_ACCESS_TOKEN + key vars (multi-app deployments are managed by the control plane / DB mode)")
}
// LegacyFallbackAppId names the app that manifest and asset requests arriving
// without an expo-app-id header belong to, or "" when no such app exists.
//
// v1 clients predate the header. It is baked into Expo.plist /
// AndroidManifest.xml at build time, so an already-installed v1 binary can
// never start sending it without a store release, and an OTA server that
// requires a store release to keep serving OTA updates has defeated its own
// purpose. EXPO_APP_ID is the Expo project id v1 already identified the deploy
// by, and the infra→DB migration carries it over verbatim as the apps row key,
// so it names the legacy app whether the deploy stayed stateless or grew into a
// control plane. A control plane created fresh leaves it unset and gets "" back,
// which keeps the header mandatory exactly where no legacy client can exist.
//
// Adding more apps later does not make this ambiguous: their clients are v2 and
// send the header, so a header-less request still belongs to the legacy app.
func LegacyFallbackAppId() string {
if skip, _ := strconv.ParseBool(GetEnv("SKIP_LEGACY_APP_ID_FALLBACK")); skip {
return ""
}
return strings.TrimSpace(GetEnv("EXPO_APP_ID"))
}
// parseFlatEnvApp reads the v1 single-app env vars and returns an AppConfig.
// Validation is deferred to validateApp so the error path is uniform with the
// JSON case.
func parseFlatEnvApp(appId string) AppConfig {
app := AppConfig{
Id: appId,
AccessToken: os.Getenv("EXPO_ACCESS_TOKEN"),
}
switch os.Getenv("KEYS_STORAGE_TYPE") {
case "local", "":
// "local" is the default when unset, matching v1 DefaultEnvValues.
app.Keys = KeysConfig{
Mode: KeysModeLocal,
PublicPath: os.Getenv("PUBLIC_LOCAL_EXPO_KEY_PATH"),
PrivatePath: os.Getenv("PRIVATE_LOCAL_EXPO_KEY_PATH"),
}
case "aws-secrets-manager":
app.Keys = KeysConfig{
Mode: KeysModeAWSSM,
PublicSecretId: os.Getenv("AWSSM_EXPO_PUBLIC_KEY_SECRET_ID"),
PrivateSecretId: os.Getenv("AWSSM_EXPO_PRIVATE_KEY_SECRET_ID"),
}
case "environment":
app.Keys = KeysConfig{
Mode: KeysModeEnvironment,
PublicB64: os.Getenv("PUBLIC_EXPO_KEY_B64"),
PrivateB64: os.Getenv("PRIVATE_EXPO_KEY_B64"),
}
default:
// Leave Mode empty; validateApp will surface a clear error naming
// the invalid KEYS_STORAGE_TYPE in the boot log.
}
return app
}
func validateApp(app *AppConfig, index int) error {
prefix := fmt.Sprintf("apps[%d]", index)
if err := ValidateAppId(app.Id, prefix+".id"); err != nil {
return err
}
if app.AccessToken == "" {
return fmt.Errorf("%s.accessToken is required", prefix)
}
return ValidateKeys(&app.Keys, prefix+".keys")
}
// ValidateAppId centralizes every rule an app id must satisfy before it can
// be used as a path segment, map key, or route parameter. Kept together so
// the constraints stay in sync with isValidAppID / validateSegment.
func ValidateAppId(id, fieldPath string) error {
if id == "" {
return fmt.Errorf("%s is required", fieldPath)
}
if len(id) > maxAppIdLen {
return fmt.Errorf("%s %q exceeds max length %d", fieldPath, id, maxAppIdLen)
}
// Reserved filesystem names, match validateSegment / isValidAppID so
// every id-validation path agrees. "." and ".." would resolve to the
// bucket root (or its parent) when interpolated into {appId}/{branch}/…
// on the local backend.
if id == "." || id == ".." {
return fmt.Errorf("%s %q is reserved", fieldPath, id)
}
if _, reserved := reservedAppIds[strings.ToLower(id)]; reserved {
return fmt.Errorf("%s %q collides with a top-level route name", fieldPath, id)
}
for _, r := range id {
if r == '/' || r == '\\' {
return fmt.Errorf("%s %q must not contain path separators", fieldPath, id)
}
if unicode.IsSpace(r) {
return fmt.Errorf("%s %q must not contain whitespace", fieldPath, id)
}
if unicode.IsControl(r) {
return fmt.Errorf("%s %q must not contain control characters", fieldPath, id)
}
// Only ASCII alphanumerics plus `-` / `_` / `.` are safe across
// filesystems, URL paths and S3/GCS key rules. Unicode lookalikes
// (e.g. U+2215 ∕, fullwidth slash U+FF0F ／) would bypass the
// separator check above while still tripping up downstream consumers.
if r > unicode.MaxASCII {
return fmt.Errorf("%s %q must be ASCII", fieldPath, id)
}
if !unicode.IsLetter(r) && !unicode.IsDigit(r) && r != '-' && r != '_' && r != '.' {
return fmt.Errorf("%s %q contains invalid character %q", fieldPath, id, r)
}
}
return nil
}
func ValidateKeys(k *KeysConfig, prefix string) error {
// No config.IsDBMode() check here since to avoid circular depdency
isDBMode := os.Getenv("DB_URL") != ""
allowedModes := []string{string(KeysModeLocal), string(KeysModeAWSSM), string(KeysModeEnvironment)}
if isDBMode {
allowedModes = append(allowedModes, string(KeysModeDatabase))
}
if k.Mode == "" {
return fmt.Errorf("%s.mode is required (%s)", prefix, strings.Join(allowedModes, "|"))
}
hasLocal := k.PublicPath != "" || k.PrivatePath != ""
hasAWSSM := k.PublicSecretId != "" || k.PrivateSecretId != ""
hasEnv := k.PublicB64 != "" || k.PrivateB64 != ""
switch k.Mode {
case KeysModeLocal:
if k.PublicPath == "" || k.PrivatePath == "" {
return fmt.Errorf("%s: mode=local requires publicPath and privatePath", prefix)
}
if hasAWSSM || hasEnv {
return fmt.Errorf("%s: mode=local must not set aws-sm or b64 fields", prefix)
}
case KeysModeAWSSM:
if k.PublicSecretId == "" || k.PrivateSecretId == "" {
return fmt.Errorf("%s: mode=aws-secrets-manager requires publicSecretId and privateSecretId", prefix)
}
if hasLocal || hasEnv {
return fmt.Errorf("%s: mode=aws-secrets-manager must not set local or b64 fields", prefix)
}
case KeysModeEnvironment:
if k.PublicB64 == "" || k.PrivateB64 == "" {
return fmt.Errorf("%s: mode=environment requires publicB64 and privateB64", prefix)
}
if hasLocal || hasAWSSM {
return fmt.Errorf("%s: mode=environment must not set local or aws-sm fields", prefix)
}
if err := validatePEMKeyB64(k.PublicB64, prefix+".publicB64"); err != nil {
return err
}
if err := validatePEMKeyB64(k.PrivateB64, prefix+".privateB64"); err != nil {
return err
}
case KeysModeDatabase:
if !isDBMode {
return fmt.Errorf("%s: mode=database is not allowed when DB_URL is not set", prefix)
}
if hasLocal || hasAWSSM {
return fmt.Errorf("%s: mode=database must not set local or aws-sm fields", prefix)
}
default:
return fmt.Errorf("%s.mode=%q is invalid (expected %s)", prefix, k.Mode, strings.Join(allowedModes, "|"))
}
return nil
}
// validatePEMKeyB64 fails fast when a mode=environment key is structurally
// broken: not base64, or base64 that decodes to something that is clearly
// not a PEM-encoded key. Catches two common operator mistakes (double-
// encoded input, pasting raw PEM into a b64 field) at boot instead of at
// first manifest sign, where the symptom is an opaque 500.
func validatePEMKeyB64(b64, fieldPath string) error {
decoded, err := base64.StdEncoding.DecodeString(b64)
if err != nil {
return fmt.Errorf("%s: invalid base64: %w", fieldPath, err)
}
if !strings.Contains(string(decoded), "-----BEGIN ") {
return fmt.Errorf("%s: decoded value is not a PEM key (missing BEGIN marker)", fieldPath)
}
return nil
}
// ListAppIds returns the configured app ids in an unspecified order. Meant
// for read-only introspection (e.g. the dashboard /api/settings endpoint);
// never expose tokens or keys from the same path.
func ListAppIds() []string {
appsByIdMu.RLock()
defer appsByIdMu.RUnlock()
ids := make([]string, 0, len(appsById))
for id := range appsById {
ids = append(ids, id)
}
return ids
}
// ListApps returns a public-safe descriptor for each configured app. Same
// contract as ListAppIds (unspecified order, snapshot-at-call-time) but
// includes the optional display name so clients like the dashboard can show
// a human-readable label instead of the raw UUID.
func ListApps() []AppDescriptor {
appsByIdMu.RLock()
defer appsByIdMu.RUnlock()
out := make([]AppDescriptor, 0, len(appsById))
for _, app := range appsById {
out = append(out, AppDescriptor{Id: app.Id, Name: app.Name})
}
return out
}
// GetAppConfig returns the resolved configuration for the given app id.
// Returns an error when the id is unknown so callers can return a clear 404
// instead of silently serving a different app's content.
func GetAppConfig(appId string) (*AppConfig, error) {
appsByIdMu.RLock()
defer appsByIdMu.RUnlock()
app, ok := appsById[appId]
if !ok {
return nil, fmt.Errorf("unknown app id %q", appId)
}
return app, nil
}
// ResetAppsForTest clears the loaded apps cache. Intended for tests that
// need to reinitialize the config between runs. Unexported-equivalent
// naming keeps it out of "normal" autocompletion.
func ResetAppsForTest() {
appsByIdMu.Lock()
appsById = nil
appsByIdMu.Unlock()
}
// SetAppsForTest replaces the in-memory registry with the given apps. Test-
// only: lets tests exercise the multi-app resolution paths (dashboard tenant
// isolation, per-app routing) directly, without going through the flat-env
// loader, which is single-app. Production multi-app lives in the control
// plane (DB mode); this shortcut just seeds the same registry the bucket
// store reads.
func SetAppsForTest(apps []AppConfig) {
index := make(map[string]*AppConfig, len(apps))
for i := range apps {
app := &apps[i]
index[app.Id] = app
}
appsByIdMu.Lock()
appsById = index
appsByIdMu.Unlock()
}