SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(deploy): register Depttrans zone authority

Browse Source
This commit is contained in:
Codex
2026-07-21 14:20:06 +03:00
parent 9bebd2f504
commit 77bf8036d2
7 changed files with 642 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/deploy-runner/nodedc-deploy
+272
View File
@@ -419,6 +419,29 @@ ENGINE_PROVIDER_AUTHORITY_DIAGNOSTICS_PREDECESSOR_SHA256 = {
ENGINE_PROVIDER_AUTHORITY_DIAGNOSTICS_TARGET_SHA256 = {
"nodedc-source/server/dataProductPublishGrant/providerCatalog.js": "1a14299167ebe17efd677fa3c59b84c80e12d6846bac6f40f9bcae0729ab22c6",
}
ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_ARTIFACT_ENTRIES = (
"nodedc-source/server/assets/provider-packages/v1/catalog.json",
"nodedc-source/server/assets/provider-packages/v1/depttrans-zone-authority-v1.json",
"nodedc-source/server/dataProductPublishGrant/providerCatalog.js",
"nodedc-source/server/dataProductPublishGrant/service.js",
"nodedc-source/server/dataProductPublishGrant/store.js",
)
ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_PREDECESSOR_SHA256 = {
"nodedc-source/server/assets/provider-packages/v1/catalog.json": "63e0741646197f0b1b3c64a4095e1bc8fb3a95ee6caf20b0293f89d869c9e620",
"nodedc-source/server/dataProductPublishGrant/providerCatalog.js": "1a14299167ebe17efd677fa3c59b84c80e12d6846bac6f40f9bcae0729ab22c6",
"nodedc-source/server/dataProductPublishGrant/service.js": "83f045f4e0f332644310172ed51bb652d808bf04155b11c02e46bdffc95f7220",
"nodedc-source/server/dataProductPublishGrant/store.js": "98662da6acd0489a9cae4b726eb61ce89d9b2c788b2ea95433e9c4f02930c095",
}
ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_TARGET_SHA256 = {
"nodedc-source/server/assets/provider-packages/v1/catalog.json": "1aac712a05e55137d69eedaf363969460ffe866288e8e18e35711967ab232f39",
"nodedc-source/server/assets/provider-packages/v1/depttrans-zone-authority-v1.json": "1482032178b4816e599df570face9b1dfa8ae1fa2943ac8f941c561e8cb9aa9d",
"nodedc-source/server/dataProductPublishGrant/providerCatalog.js": "e4c216b0affd89ddbd48abcec86febd48eb12a4c56507851daeb47f2ccd60c9a",
"nodedc-source/server/dataProductPublishGrant/service.js": "408836564e9a422eb5e648cc24d764f4bfdf7f83d93306742e8615fa8186a642",
"nodedc-source/server/dataProductPublishGrant/store.js": "ace5971d0772e9a9499f0849e6b754e3677cc2ca3080e573a12e26acf5a6c0c0",
}
ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_NEW_PATHS = (
"nodedc-source/server/assets/provider-packages/v1/depttrans-zone-authority-v1.json",
)
ENGINE_PROVIDER_TARGET_HOST_POLICY_ARTIFACT_ENTRIES = (
"nodedc-source/server/routes/n8n.js",
)
@@ -4071,6 +4094,44 @@ process.stdout.write('engine-provider-authority-diagnostics:exact-reason-codes:v
}
def accept_engine_depttrans_zone_authority_v1_runtime():
root = component_root("engine")
validate_engine_depttrans_zone_authority_v1_slice(
root,
ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_ARTIFACT_ENTRIES,
)
live = run_engine_backend_probe(
(
"node",
"--input-type=module",
"-e",
"""
const module=await import('file:///app/server/dataProductPublishGrant/providerCatalog.js');
const catalog=await module.loadProviderSecurityCatalog();
const parameters={method:'GET',url:'http://map-gateway:18103/internal/zone-sources/v1/profiles/moscow-pmd-slow-zones/current',authentication:'none',sendQuery:false,sendHeaders:true,specifyHeaders:'keypair',headerParameters:{parameters:[{name:'Accept',value:'application/json'}]},sendBody:false,options:{response:{response:{fullResponse:false,responseFormat:'json'}},allowUnauthorizedCerts:false,redirect:{redirect:{followRedirects:false}},timeout:15000}};
const graph={nodes:[{id:'source',data:{n8n:{id:'source',name:'source',type:'n8n-nodes-base.httpRequest',parameters}}},{id:'publish',data:{n8n:{id:'publish',name:'publish',type:'n8n-nodes-ndc.ndcDataProductPublish',parameters:{dataProductId:'map.zones.current.v2',publishMode:'replace'},credentials:{}}}}],edges:[{source:'source',target:'publish'}]};
const resolved=module.resolveProviderConnectionFromGraph({graph,targetNodeId:'publish',catalog});
const drift=structuredClone(graph);drift.nodes[0].data.n8n.parameters.options.redirect.redirect.followRedirects=true;
const rejected=module.resolveProviderConnectionFromGraph({graph:drift,targetNodeId:'publish',catalog});
if(!module.validateProviderSecurityCatalog(catalog).ok||!resolved.ok||resolved.descriptor?.providerId!=='moscow-department-of-transport'||resolved.descriptor?.authorityBoundary!=='platform-service'||resolved.descriptor?.providerCredentialRef!==null||resolved.descriptor?.platformServiceIds?.join(',')!=='nodedc-map-gateway'||rejected.blockers?.join(',')!=='publish_grant_provider_request_not_exact')process.exit(2);
process.stdout.write('engine-depttrans-zone-authority:platform-service:map.zones.current.v2:nodedc-map-gateway');
""".strip(),
),
"Engine Depttrans zone authority v1",
container_id=engine_backend_container_id(),
)
expected = (
"engine-depttrans-zone-authority:platform-service:"
"map.zones.current.v2:nodedc-map-gateway"
)
if live != expected:
die("Engine Depttrans zone authority v1 live acceptance mismatch")
return {
"target_sha256": dict(ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_TARGET_SHA256),
"live": live,
}
def accept_engine_provider_target_host_policy_runtime():
root = component_root("engine")
validate_engine_provider_target_host_policy_slice(
@@ -4514,6 +4575,96 @@ def validate_engine_provider_authority_diagnostics_slice(payload_dir, entries):
die("Engine provider authority diagnostics reason-code contract mismatch")
def validate_engine_depttrans_zone_authority_v1_slice(payload_dir, entries):
if tuple(entries) != ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_ARTIFACT_ENTRIES:
die("Engine Depttrans zone authority v1 files.txt exact set/order mismatch")
for rel, expected_sha256 in ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_TARGET_SHA256.items():
path = payload_dir / rel
try:
path_stat = path.lstat()
except FileNotFoundError:
die(f"Engine Depttrans zone authority v1 target is missing: {rel}")
if (
stat.S_ISLNK(path_stat.st_mode)
or not stat.S_ISREG(path_stat.st_mode)
or sha256_file(path) != expected_sha256
):
die(f"Engine Depttrans zone authority v1 target sha256 mismatch: {rel}")
catalog = read_strict_json(
payload_dir / ENGINE_PROVIDER_SECURITY_CATALOG_REL,
"Engine Depttrans zone authority v1 catalog",
)
packages = catalog.get("packages") if isinstance(catalog, dict) else None
package_ids = [item.get("id") for item in packages if isinstance(item, dict)] \
if isinstance(packages, list) else None
provider = next(
(
item for item in packages
if isinstance(item, dict)
and item.get("id") == "moscow-department-of-transport.pmd-slow-zones.v1"
),
None,
) if isinstance(packages, list) else None
capability = provider.get("capabilities", [None])[0] if isinstance(provider, dict) else None
request = capability.get("request") if isinstance(capability, dict) else None
marker = read_strict_json(
payload_dir / "nodedc-source/server/assets/provider-packages/v1/depttrans-zone-authority-v1.json",
"Engine Depttrans zone authority v1 marker",
)
if (
catalog.get("schemaVersion") != "nodedc.engine.provider-security-catalog/v1"
or package_ids != [
"gelios.provider.v1",
"gelios.provider.v4",
"gelios.provider.v5",
"moscow-department-of-transport.pmd-slow-zones.v1",
]
or provider.get("providerId") != "moscow-department-of-transport"
or provider.get("version") != "1.0.0"
or "providerCredential" in provider
or capability.get("id") != "depttrans.pmd-slow-zones.current.read"
or capability.get("dataProductIds") != ["map.zones.current.v2"]
or request != {
"method": "GET",
"url": "http://map-gateway:18103/internal/zone-sources/v1/profiles/moscow-pmd-slow-zones/current",
"authorityBoundary": "platform-service",
"serviceId": "nodedc-map-gateway",
"network": "engine",
}
or marker != {
"schemaVersion": "nodedc.engine.platform-service-authority/v1",
"id": "moscow-department-of-transport.pmd-slow-zones.v1",
"providerId": "moscow-department-of-transport",
"authorityBoundary": "platform-service",
"serviceId": "nodedc-map-gateway",
"network": "engine",
"dataProductId": "map.zones.current.v2",
}
):
die("Engine Depttrans zone authority v1 catalog projection mismatch")
required_markers = {
"nodedc-source/server/dataProductPublishGrant/providerCatalog.js": (
"function platformServiceRequestIsExact",
"authorityBoundary === 'platform-service'",
"platformServiceIds",
),
"nodedc-source/server/dataProductPublishGrant/service.js": (
"pinned_platform_service_no_graph_credential",
"platformServiceIds: descriptor.platformServiceIds",
),
"nodedc-source/server/dataProductPublishGrant/store.js": (
"new Set(['provider-credential', 'platform-service'])",
"descriptor.authorityBoundary === 'platform-service'",
),
}
for rel, markers in required_markers.items():
source = (payload_dir / rel).read_text(encoding="utf-8")
if any(marker not in source for marker in markers):
die(f"Engine Depttrans zone authority v1 source contract mismatch: {rel}")
def validate_engine_provider_target_host_policy_slice(payload_dir, entries):
if tuple(entries) != ENGINE_PROVIDER_TARGET_HOST_POLICY_ARTIFACT_ENTRIES:
die("Engine provider target host policy files.txt exact set/order mismatch")
@@ -4791,6 +4942,8 @@ def load_artifact(artifact, work_dir):
validate_engine_provider_rotating_slot_slice(payload_dir, entries)
if is_engine_provider_authority_diagnostics_slice(manifest["component"], entries):
validate_engine_provider_authority_diagnostics_slice(payload_dir, entries)
if is_engine_depttrans_zone_authority_v1_slice(manifest["component"], entries):
validate_engine_depttrans_zone_authority_v1_slice(payload_dir, entries)
if is_engine_provider_target_host_policy_slice(manifest["component"], entries):
validate_engine_provider_target_host_policy_slice(payload_dir, entries)
if is_engine_provider_security_catalog_slice(manifest["component"], entries):
@@ -4804,6 +4957,7 @@ def load_artifact(artifact, work_dir):
and not is_engine_composite_provider_v4_slice(manifest["component"], entries)
and not is_engine_provider_rotating_slot_slice(manifest["component"], entries)
and not is_engine_provider_authority_diagnostics_slice(manifest["component"], entries)
and not is_engine_depttrans_zone_authority_v1_slice(manifest["component"], entries)
and not is_engine_provider_target_host_policy_slice(manifest["component"], entries)
and (
touches_engine_data_product_publish_grant(entries)
@@ -4956,6 +5110,14 @@ def is_engine_provider_authority_diagnostics_slice(component, entries):
)
def is_engine_depttrans_zone_authority_v1_slice(component, entries):
return (
component == "engine"
and entries is not None
and tuple(entries) == ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_ARTIFACT_ENTRIES
)
def is_engine_provider_target_host_policy_slice(component, entries):
return (
component == "engine"
@@ -5262,6 +5424,39 @@ def preflight_engine_provider_authority_diagnostics_predecessor():
}
def preflight_engine_depttrans_zone_authority_v1_predecessor():
root = component_root("engine")
actual = {}
for rel, expected_sha256 in ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_PREDECESSOR_SHA256.items():
path = root / rel
try:
path_stat = path.lstat()
except FileNotFoundError:
die(f"Engine Depttrans zone authority v1 predecessor is missing: {rel}")
if stat.S_ISLNK(path_stat.st_mode) or not stat.S_ISREG(path_stat.st_mode):
die(f"Engine Depttrans zone authority v1 predecessor is unsafe: {rel}")
actual_sha256 = sha256_file(path)
if actual_sha256 != expected_sha256:
die(
"Engine Depttrans zone authority v1 predecessor drift detected: "
f"path={rel} expected={expected_sha256} actual={actual_sha256}"
)
actual[rel] = actual_sha256
for rel in ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_NEW_PATHS:
path = root / rel
if path.exists() or path.is_symlink():
die(f"Engine Depttrans zone authority v1 new path already exists: {rel}")
backend = preflight_engine_credential_backend_runtime()
if backend["mode"] != "verified-derived-retry":
die("Engine Depttrans zone authority v1 requires the active immutable backend")
return {
"mode": "exact-platform-service-authority-v1",
"predecessor_sha256": actual,
"target_sha256": dict(ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_TARGET_SHA256),
"backend_mode": backend["mode"],
}
def preflight_engine_provider_target_host_policy_predecessor():
root = component_root("engine")
actual = {}
@@ -5336,6 +5531,7 @@ def component_services(component, entries=None):
or is_engine_composite_provider_v4_slice(component, entries)
or is_engine_provider_rotating_slot_slice(component, entries)
or is_engine_provider_authority_diagnostics_slice(component, entries)
or is_engine_depttrans_zone_authority_v1_slice(component, entries)
or is_engine_provider_target_host_policy_slice(component, entries)
or is_engine_provider_security_catalog_slice(component, entries)
):
@@ -7478,6 +7674,7 @@ def plan_artifact(artifact):
composite_provider_v4_preflight = None
provider_rotating_slot_preflight = None
provider_authority_diagnostics_preflight = None
depttrans_zone_authority_v1_preflight = None
provider_target_host_policy_preflight = None
provider_catalog_preflight = None
with tempfile.TemporaryDirectory(prefix="plan-", dir=TMP_DIR) as tmp:
@@ -7520,6 +7717,10 @@ def plan_artifact(artifact):
provider_authority_diagnostics_preflight = (
preflight_engine_provider_authority_diagnostics_predecessor()
)
if is_engine_depttrans_zone_authority_v1_slice(manifest["component"], entries):
depttrans_zone_authority_v1_preflight = (
preflight_engine_depttrans_zone_authority_v1_predecessor()
)
if is_engine_provider_target_host_policy_slice(manifest["component"], entries):
provider_target_host_policy_preflight = (
preflight_engine_provider_target_host_policy_predecessor()
@@ -7548,6 +7749,10 @@ def plan_artifact(artifact):
component,
entries,
)
touches_depttrans_zone_authority_v1 = is_engine_depttrans_zone_authority_v1_slice(
component,
entries,
)
touches_provider_target_host_policy = is_engine_provider_target_host_policy_slice(
component,
entries,
@@ -7565,6 +7770,7 @@ def plan_artifact(artifact):
or touches_composite_provider_v4
or touches_provider_rotating_slot
or touches_provider_authority_diagnostics
or touches_depttrans_zone_authority_v1
or touches_provider_target_host_policy
or touches_agent_grant_migration
):
@@ -7590,6 +7796,11 @@ def plan_artifact(artifact):
die("Engine provider authority diagnostics preflight is missing")
if credential_backend_preflight["mode"] != "verified-derived-retry":
die("Engine provider authority diagnostics requires the active immutable credential backend")
if touches_depttrans_zone_authority_v1:
if depttrans_zone_authority_v1_preflight is None:
die("Engine Depttrans zone authority v1 preflight is missing")
if credential_backend_preflight["mode"] != "verified-derived-retry":
die("Engine Depttrans zone authority v1 requires the active immutable credential backend")
if touches_provider_target_host_policy:
if provider_target_host_policy_preflight is None:
die("Engine provider target host policy preflight is missing")
@@ -7772,6 +7983,33 @@ def plan_artifact(artifact):
print("n8n_l1=untouched")
print("engine_ui=untouched")
print("engine_databases=untouched")
if depttrans_zone_authority_v1_preflight:
print("engine_provider_authority_transition=platform-service-v1")
print("engine_provider_package=moscow-department-of-transport.pmd-slow-zones.v1")
print("engine_provider_id=moscow-department-of-transport")
print("engine_provider_authority_boundary=platform-service")
print("engine_provider_platform_service=nodedc-map-gateway")
print("engine_provider_platform_network=engine")
print("engine_data_product=map.zones.current.v2")
print("provider_credential_values=preserved")
for changed_path in ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_ARTIFACT_ENTRIES:
print(f"engine_depttrans_zone_authority_changed_path={changed_path}")
print(
f"engine_depttrans_zone_authority_predecessor_sha256[{changed_path}]="
f"{depttrans_zone_authority_v1_preflight['predecessor_sha256'][changed_path]}"
)
print(
f"engine_depttrans_zone_authority_target_sha256[{changed_path}]="
f"{depttrans_zone_authority_v1_preflight['target_sha256'][changed_path]}"
)
print(f"backend_current_barrier={depttrans_zone_authority_v1_preflight['backend_mode']}")
print("backend_force_recreate=yes")
print("backend_pull=never")
print("l2_graph=untouched")
print("n8n_l1=untouched")
print("engine_ui=untouched")
print("engine_databases=untouched")
print("mcp_nginx=untouched")
if provider_target_host_policy_preflight:
print("engine_provider_transport_transition=exact-literal-target-host")
print("engine_provider_package=gelios.provider.v4")
@@ -8791,6 +9029,7 @@ def component_healthchecks(component, entries=None, services=None):
or is_engine_composite_provider_v4_slice(component, entries)
or is_engine_provider_rotating_slot_slice(component, entries)
or is_engine_provider_authority_diagnostics_slice(component, entries)
or is_engine_depttrans_zone_authority_v1_slice(component, entries)
or is_engine_provider_target_host_policy_slice(component, entries)
or is_engine_agent_full_grant_migration_slice(component, entries)
or is_engine_mcp_control_plane_slice(component, entries)
@@ -9117,6 +9356,10 @@ def run_healthchecks(component, entries=None, services=None):
component,
entries,
)
touches_depttrans_zone_authority_v1 = is_engine_depttrans_zone_authority_v1_slice(
component,
entries,
)
touches_provider_target_host_policy = is_engine_provider_target_host_policy_slice(
component,
entries,
@@ -9135,6 +9378,7 @@ def run_healthchecks(component, entries=None, services=None):
or touches_composite_provider_v4
or touches_provider_rotating_slot
or touches_provider_authority_diagnostics
or touches_depttrans_zone_authority_v1
or touches_provider_target_host_policy
or touches_agent_grant_migration
or touches_mcp_control_plane
@@ -9154,6 +9398,7 @@ def run_healthchecks(component, entries=None, services=None):
or touches_composite_provider_v4
or touches_provider_rotating_slot
or touches_provider_authority_diagnostics
or touches_depttrans_zone_authority_v1
or touches_provider_target_host_policy
or touches_agent_grant_migration
or touches_mcp_control_plane
@@ -9209,6 +9454,27 @@ def run_healthchecks(component, entries=None, services=None):
accept_engine_provider_authority_diagnostics_runtime()
elif installed_sha256 != ENGINE_PROVIDER_AUTHORITY_DIAGNOSTICS_PREDECESSOR_SHA256:
die("Engine provider authority diagnostics installed state is neither target nor rollback predecessor")
if touches_depttrans_zone_authority_v1:
root = component_root("engine")
target_state = all(
(root / rel).is_file()
and not (root / rel).is_symlink()
and sha256_file(root / rel) == expected
for rel, expected in ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_TARGET_SHA256.items()
)
predecessor_state = all(
(root / rel).is_file()
and not (root / rel).is_symlink()
and sha256_file(root / rel) == expected
for rel, expected in ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_PREDECESSOR_SHA256.items()
) and all(
not (root / rel).exists() and not (root / rel).is_symlink()
for rel in ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_NEW_PATHS
)
if target_state:
accept_engine_depttrans_zone_authority_v1_runtime()
elif not predecessor_state:
die("Engine Depttrans zone authority v1 installed state is neither target nor rollback predecessor")
if touches_provider_target_host_policy:
root = component_root("engine")
installed_sha256 = {
@@ -9298,6 +9564,11 @@ def apply_artifact(artifact):
authority_diagnostics_backend_preflight = preflight_engine_credential_backend_runtime()
if authority_diagnostics_backend_preflight["mode"] != "verified-derived-retry":
die("Engine provider authority diagnostics requires the active immutable credential backend")
if is_engine_depttrans_zone_authority_v1_slice(component, entries):
preflight_engine_depttrans_zone_authority_v1_predecessor()
depttrans_authority_backend_preflight = preflight_engine_credential_backend_runtime()
if depttrans_authority_backend_preflight["mode"] != "verified-derived-retry":
die("Engine Depttrans zone authority v1 requires the active immutable credential backend")
if is_engine_provider_target_host_policy_slice(component, entries):
preflight_engine_provider_target_host_policy_predecessor()
target_host_policy_backend_preflight = preflight_engine_credential_backend_runtime()
@@ -9499,6 +9770,7 @@ def apply_artifact(artifact):
or is_engine_composite_provider_v4_slice(component, entries)
or is_engine_provider_rotating_slot_slice(component, entries)
or is_engine_provider_authority_diagnostics_slice(component, entries)
or is_engine_depttrans_zone_authority_v1_slice(component, entries)
or is_engine_provider_target_host_policy_slice(component, entries)
or is_engine_agent_full_grant_migration_slice(component, entries)
or is_engine_mcp_control_plane_slice(component, entries)