SECURITY - LAUNCHER: harden storage and access lifecycle

scripts/seed-live-control-plane.mjs

@@ -1,14 +1,15 @@
 import { existsSync, readFileSync } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const projectRoot = dirname(dirname(fileURLToPath(import.meta.url)));
-const publicDataPath = join(projectRoot, "public", "storage", "launcher-data.json");
-const distDataPath = join(projectRoot, "dist", "storage", "launcher-data.json");
+const serverStorageRoot = resolveStorageRoot(projectRoot);
+const dataPath = join(serverStorageRoot, "launcher-data.json");
+const legacyPublicDataPath = join(projectRoot, "public", "storage", "launcher-data.json");
 
 const now = new Date().toISOString();
-const existingData = readJson(publicDataPath);
+const existingData = existsSync(dataPath) ? readJson(dataPath) : readJson(legacyPublicDataPath);
 const services = Array.isArray(existingData.services) ? existingData.services : [];
 const existingUsersByEmail = new Map(
   (Array.isArray(existingData.users) ? existingData.users : []).map((user) => [String(user.email || "").toLowerCase(), user])
@@ -214,11 +215,7 @@ const liveData = {
   services,
 };
 
-await writeJson(publicDataPath, liveData);
-
-if (existsSync(join(projectRoot, "dist"))) {
-  await writeJson(distDataPath, liveData);
-}
+await writeJson(dataPath, liveData);
 
 console.log(`Seeded ${liveData.users.length} users, ${liveData.clients.length} client, ${liveData.groups.length} groups.`);
 
@@ -234,3 +231,13 @@ async function writeJson(path, data) {
   await mkdir(dirname(path), { recursive: true });
   await writeFile(path, `${JSON.stringify(data, null, 2)}\n`, "utf8");
 }
+
+function resolveStorageRoot(projectRoot) {
+  const configuredRoot = process.env.NODEDC_LAUNCHER_STORAGE_DIR;
+
+  if (configuredRoot && configuredRoot.trim()) {
+    return isAbsolute(configuredRoot) ? configuredRoot : resolve(projectRoot, configuredRoot);
+  }
+
+  return join(projectRoot, "server", "storage");
+}