[codex] tighten update center and proxy debug UX (#325)

* tighten update center and proxy debug UX * Address update center review feedback
2026-03-30 13:39:20 +08:00
parent 71be4cb63a
commit 26d87db2cb
16 changed files with 1252 additions and 134 deletions
@@ -409,6 +409,110 @@ describe('update center routes', () => {
    }), expect.any(Function));
  });

+  it('rejects deploy requests when the target image is already running', async () => {
+    await saveValidConfig();
+
+    getUpdateCenterHelperStatusMock.mockResolvedValue({
+      ok: true,
+      releaseName: 'metapi',
+      namespace: 'ai',
+      revision: '17',
+      imageRepository: '1467078763/metapi',
+      imageTag: 'latest',
+      imageDigest: 'sha256:efb2ee6553866bd3268dcc54c02fa5f9789728c51ed4af63328aaba6da67df35',
+      healthy: true,
+    });
+
+    const deployResponse = await app.inject({
+      method: 'POST',
+      url: '/api/update-center/deploy',
+      payload: {
+        source: 'docker-hub-tag',
+        targetTag: 'latest',
+        targetDigest: 'sha256:efb2ee6553866bd3268dcc54c02fa5f9789728c51ed4af63328aaba6da67df35',
+      },
+    });
+
+    expect(deployResponse.statusCode).toBe(409);
+    expect(deployResponse.json()).toMatchObject({
+      success: false,
+      message: 'target image is already running',
+    });
+    expect(streamUpdateCenterDeployMock).not.toHaveBeenCalled();
+  });
+
+  it('does not reject a same-version deploy when the requested digest differs from the running image', async () => {
+    await saveValidConfig();
+
+    getUpdateCenterHelperStatusMock.mockResolvedValue({
+      ok: true,
+      releaseName: 'metapi',
+      namespace: 'ai',
+      revision: '17',
+      imageRepository: '1467078763/metapi',
+      imageTag: '1.2.3',
+      imageDigest: 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+      healthy: true,
+    });
+    streamUpdateCenterDeployMock.mockResolvedValue({
+      success: true,
+      targetSource: 'docker-hub-tag',
+      targetTag: '1.2.3',
+      targetDigest: 'sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+      previousRevision: '17',
+      finalRevision: '18',
+      rolledBack: false,
+      logLines: ['Running helm upgrade'],
+    });
+
+    const deployResponse = await app.inject({
+      method: 'POST',
+      url: '/api/update-center/deploy',
+      payload: {
+        source: 'docker-hub-tag',
+        targetTag: '1.2.3',
+        targetDigest: 'sha256:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB',
+      },
+    });
+
+    expect(deployResponse.statusCode).toBe(202);
+    expect(streamUpdateCenterDeployMock).toHaveBeenCalledWith(expect.objectContaining({
+      targetTag: '1.2.3',
+      targetDigest: 'sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+    }), expect.any(Function));
+  });
+
+  it('normalizes invalid target digests to null before forwarding the deploy request', async () => {
+    await saveValidConfig();
+
+    streamUpdateCenterDeployMock.mockResolvedValue({
+      success: true,
+      targetSource: 'docker-hub-tag',
+      targetTag: 'latest',
+      targetDigest: null,
+      previousRevision: '13',
+      finalRevision: '14',
+      rolledBack: false,
+      logLines: ['Running helm upgrade'],
+    });
+
+    const deployResponse = await app.inject({
+      method: 'POST',
+      url: '/api/update-center/deploy',
+      payload: {
+        source: 'docker-hub-tag',
+        targetTag: 'latest',
+        targetDigest: 'not-a-real-digest',
+      },
+    });
+
+    expect(deployResponse.statusCode).toBe(202);
+    expect(streamUpdateCenterDeployMock).toHaveBeenCalledWith(expect.objectContaining({
+      targetTag: 'latest',
+      targetDigest: null,
+    }), expect.any(Function));
+  });
+
  it('starts rollback tasks for explicit revision requests', async () => {
    await saveValidConfig();

@@ -15,6 +15,10 @@ import {
  type UpdateCenterVersionCandidate,
  type UpdateCenterVersionSource,
 } from '../../services/updateCenterVersionService.js';
+import {
+  getUpdateCenterDeployBlockMessage,
+  normalizeUpdateCenterTargetDigest,
+} from '../../services/updateCenterDeployGuardService.js';
 import {
  getDefaultUpdateCenterConfig,
  loadUpdateCenterConfig,
@@ -168,6 +172,7 @@ export async function updateCenterRoutes(app: FastifyInstance) {
        message: summarizeHelperError(error),
      });
    }
+    const helperToken = getUpdateCenterHelperToken();

    const source = request.body?.source === 'docker-hub-tag'
      ? 'docker-hub-tag'
@@ -175,7 +180,7 @@ export async function updateCenterRoutes(app: FastifyInstance) {
        ? 'github-release'
        : config.defaultDeploySource;
    const targetTag = String(request.body?.targetTag || request.body?.targetVersion || '').trim();
-    const targetDigest = String(request.body?.targetDigest || '').trim() || null;
+    const targetDigest = normalizeUpdateCenterTargetDigest(request.body?.targetDigest);
    if (!targetTag) {
      return reply.code(400).send({
        success: false,
@@ -183,6 +188,19 @@ export async function updateCenterRoutes(app: FastifyInstance) {
      });
    }

+    const deployBlockMessage = await getUpdateCenterDeployBlockMessage({
+      config,
+      helperToken,
+      targetTag,
+      targetDigest,
+    });
+    if (deployBlockMessage) {
+      return reply.code(409).send({
+        success: false,
+        message: deployBlockMessage,
+      });
+    }
+
    let taskId = '';
    const { task, reused } = startBackgroundTask(
      {
@@ -200,7 +218,7 @@ export async function updateCenterRoutes(app: FastifyInstance) {
        const result = await streamUpdateCenterDeploy(
          {
            config,
-            helperToken: getUpdateCenterHelperToken(),
+            helperToken,
            source,
            targetTag,
            targetDigest,
@@ -0,0 +1,95 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const {
+  getUpdateCenterHelperStatusMock,
+  getCurrentRuntimeVersionMock,
+  parseStableSemVerMock,
+} = vi.hoisted(() => ({
+  getUpdateCenterHelperStatusMock: vi.fn(),
+  getCurrentRuntimeVersionMock: vi.fn(),
+  parseStableSemVerMock: vi.fn(),
+}));
+
+vi.mock('./updateCenterHelperClient.js', () => ({
+  getUpdateCenterHelperStatus: (...args: unknown[]) => getUpdateCenterHelperStatusMock(...args),
+}));
+
+vi.mock('./updateCenterVersionService.js', () => ({
+  getCurrentRuntimeVersion: () => getCurrentRuntimeVersionMock(),
+  parseStableSemVer: (...args: unknown[]) => parseStableSemVerMock(...args),
+}));
+
+import {
+  getUpdateCenterDeployBlockMessage,
+  normalizeUpdateCenterTargetDigest,
+} from './updateCenterDeployGuardService.js';
+
+describe('updateCenterDeployGuardService', () => {
+  beforeEach(() => {
+    getUpdateCenterHelperStatusMock.mockReset();
+    getCurrentRuntimeVersionMock.mockReset();
+    parseStableSemVerMock.mockReset();
+    getCurrentRuntimeVersionMock.mockReturnValue('1.2.3');
+    parseStableSemVerMock.mockImplementation((value: string | null | undefined) => {
+      const normalized = String(value || '').trim().replace(/^v/i, '');
+      const match = normalized.match(/^(\d+)\.(\d+)\.(\d+)$/);
+      if (!match) return null;
+      return {
+        raw: String(value || ''),
+        normalized,
+        major: Number.parseInt(match[1], 10),
+        minor: Number.parseInt(match[2], 10),
+        patch: Number.parseInt(match[3], 10),
+      };
+    });
+  });
+
+  it('normalizes valid digests and drops invalid ones', () => {
+    expect(normalizeUpdateCenterTargetDigest(' sha256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA '))
+      .toBe('sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+    expect(normalizeUpdateCenterTargetDigest('not-a-real-digest')).toBeNull();
+  });
+
+  it('treats digest equality as the source of truth when a digest is supplied', async () => {
+    getUpdateCenterHelperStatusMock.mockResolvedValue({
+      imageDigest: 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+    });
+
+    await expect(getUpdateCenterDeployBlockMessage({
+      config: {
+        enabled: true,
+        helperBaseUrl: 'http://helper.local',
+        namespace: 'ai',
+        releaseName: 'metapi',
+        chartRef: 'oci://ghcr.io/cita-777/charts/metapi',
+        imageRepository: '1467078763/metapi',
+        githubReleasesEnabled: true,
+        dockerHubTagsEnabled: true,
+        defaultDeploySource: 'github-release',
+      },
+      helperToken: 'helper-token',
+      targetTag: '1.2.3',
+      targetDigest: 'sha256:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB',
+    })).resolves.toBeNull();
+  });
+
+  it('falls back to semver equality only when no digest is provided', async () => {
+    await expect(getUpdateCenterDeployBlockMessage({
+      config: {
+        enabled: true,
+        helperBaseUrl: 'http://helper.local',
+        namespace: 'ai',
+        releaseName: 'metapi',
+        chartRef: 'oci://ghcr.io/cita-777/charts/metapi',
+        imageRepository: '1467078763/metapi',
+        githubReleasesEnabled: true,
+        dockerHubTagsEnabled: true,
+        defaultDeploySource: 'github-release',
+      },
+      helperToken: 'helper-token',
+      targetTag: '1.2.3',
+      targetDigest: null,
+    })).resolves.toBe('target version is already running');
+    expect(getUpdateCenterHelperStatusMock).not.toHaveBeenCalled();
+  });
+});
@@ -0,0 +1,46 @@
+import type { UpdateCenterConfig } from './updateCenterConfigService.js';
+import { getUpdateCenterHelperStatus } from './updateCenterHelperClient.js';
+import { getCurrentRuntimeVersion, parseStableSemVer } from './updateCenterVersionService.js';
+
+function normalizeDigest(value: string | null | undefined) {
+  const digest = String(value || '').trim();
+  return /^sha256:[a-f0-9]{64}$/i.test(digest) ? digest.toLowerCase() : '';
+}
+
+function isSameTargetVersion(currentVersion: string, targetTag: string) {
+  const current = parseStableSemVer(currentVersion);
+  const target = parseStableSemVer(targetTag);
+  return !!current && !!target && current.normalized === target.normalized;
+}
+
+export function normalizeUpdateCenterTargetDigest(value: string | null | undefined): string | null {
+  return normalizeDigest(value) || null;
+}
+
+export async function getUpdateCenterDeployBlockMessage(input: {
+  config: UpdateCenterConfig;
+  helperToken: string;
+  targetTag: string;
+  targetDigest: string | null;
+}): Promise<string | null> {
+  const normalizedTargetDigest = normalizeDigest(input.targetDigest);
+  if (normalizedTargetDigest) {
+    try {
+      const helperStatus = await getUpdateCenterHelperStatus(input.config, input.helperToken);
+      const currentDigest = normalizeDigest(helperStatus?.imageDigest);
+      if (currentDigest && currentDigest === normalizedTargetDigest) {
+        return 'target image is already running';
+      }
+    } catch {
+      return null;
+    }
+
+    return null;
+  }
+
+  if (isSameTargetVersion(getCurrentRuntimeVersion(), input.targetTag)) {
+    return 'target version is already running';
+  }
+
+  return null;
+}