378 lines
15 KiB
TypeScript
378 lines
15 KiB
TypeScript
import path from "node:path";
|
|
import { statSync } from "node:fs";
|
|
import {
|
|
createAuthenticationConfigProvider,
|
|
type AuthenticationConfigProvider,
|
|
type AuthMode,
|
|
} from "./auth/config.js";
|
|
import { createProjectedAuthenticationConfigProvider } from "./auth/runtime-projection.js";
|
|
import type { WorkspaceRegistryConfig } from "./workspaces/types.js";
|
|
|
|
export interface AppConfig {
|
|
host: string; port: number; harnessDir: string; thtBin: string; piBin: string;
|
|
authMode: AuthMode;
|
|
authConfigFile: string;
|
|
authStateRoot: string;
|
|
authentication?: AuthenticationConfigProvider;
|
|
publicExposure: boolean;
|
|
sessionStorage: {
|
|
mode: "local" | "postgres";
|
|
host?: string; port?: number; database?: string; runtimeUser?: string;
|
|
runtimePasswordFile?: string; sslmode?: "verify-ca" | "verify-full"; sslrootcert?: string;
|
|
};
|
|
defaults: { provider?: string; model?: string; thinking?: string };
|
|
maxPiProcesses: number;
|
|
settingsFile: string;
|
|
maintenanceFile: string;
|
|
dataRoot?: string;
|
|
ollamaEnsureTimeoutMs: number;
|
|
piManagementTimeoutMs: number;
|
|
secretsFile?: string;
|
|
piAuthFile?: string;
|
|
secretFiles: Readonly<Record<string, string | undefined>>;
|
|
modelApiKeyFile?: string;
|
|
/**
|
|
* Local-only: when true, POST /sessions probes DWH reachability (`tht db ping`) and
|
|
* refuses to create a session if it is down. Off by default so containers/CI never
|
|
* pay the probe; the local dev launcher (run-stack.sh) opts in via THT_DWH_PRECHECK.
|
|
*/
|
|
dwhPrecheck: boolean;
|
|
/** Explicit compatibility mode for old loopback clients that send `workspace` in POST /sessions. */
|
|
legacyWorkspaceMode: boolean;
|
|
workspaceDiagnosticTimeoutMs: number;
|
|
workspaceRegistry: WorkspaceRegistryConfig;
|
|
workspaceSecretStoreRoot: string;
|
|
workspaceSecretRuntimeRoot: string;
|
|
internalQdrantUrl: string;
|
|
internalEmbeddingUrl: string;
|
|
internalEmbeddingModel: string;
|
|
internalEmbeddingDimensions: number;
|
|
}
|
|
|
|
export const MAX_WORKSPACE_DIAGNOSTIC_TIMEOUT_MS = 10_000;
|
|
|
|
function requiredRegistryValue(value: string, label: string): string {
|
|
if (value.length === 0 || value.trim() !== value || value.includes("\0")) {
|
|
throw new Error(`workspace registry ${label} configuration is invalid`);
|
|
}
|
|
return value;
|
|
}
|
|
|
|
function absoluteRegistryPath(value: string, label: string): string {
|
|
const pathValue = requiredRegistryValue(value, label);
|
|
if (!path.isAbsolute(pathValue)) {
|
|
throw new Error(`workspace registry ${label} must be absolute`);
|
|
}
|
|
return pathValue;
|
|
}
|
|
|
|
function absoluteAuthPath(value: string, label: string): string {
|
|
if (value.length === 0 || value.trim() !== value || value.includes("\0") || !path.isAbsolute(value)) {
|
|
throw new Error(`authentication ${label} configuration is invalid`);
|
|
}
|
|
return value;
|
|
}
|
|
|
|
function authConfigFileExists(file: string): boolean {
|
|
try {
|
|
if (!statSync(file).isFile()) throw new Error("authentication configuration is invalid");
|
|
return true;
|
|
} catch (error: any) {
|
|
if (error?.code === "ENOENT") return false;
|
|
throw new Error("authentication configuration is invalid");
|
|
}
|
|
}
|
|
|
|
function refSafeGitBranch(value: string): string {
|
|
const branch = requiredRegistryValue(value, "branch");
|
|
if (
|
|
branch === "@"
|
|
|| branch === "HEAD"
|
|
|| branch.startsWith("-")
|
|
|| branch.startsWith("/")
|
|
|| branch.endsWith("/")
|
|
|| branch.endsWith(".")
|
|
|| branch.includes("..")
|
|
|| branch.includes("@{")
|
|
|| branch.includes("//")
|
|
|| branch.split("/").some((component) => component.startsWith(".") || component.endsWith(".lock"))
|
|
|| /[\p{Cc} ~^:?*\[\\]/u.test(branch)
|
|
) {
|
|
throw new Error("workspace registry branch configuration is invalid");
|
|
}
|
|
return branch;
|
|
}
|
|
|
|
function safeInstallationId(value: string): string {
|
|
const installationId = requiredRegistryValue(value, "installation ID");
|
|
if (/\p{Cc}/u.test(installationId)) {
|
|
throw new Error("workspace registry installation ID configuration is invalid");
|
|
}
|
|
return installationId;
|
|
}
|
|
|
|
function positiveImportLimit(value: string | undefined, fallback: number): number {
|
|
const limit = Number(value ?? fallback);
|
|
if (!Number.isSafeInteger(limit) || limit <= 0) {
|
|
throw new Error("workspace limit configuration is invalid");
|
|
}
|
|
return limit;
|
|
}
|
|
|
|
function diagnosticTimeout(value: string | undefined): number {
|
|
const timeout = Number(value ?? 5_000);
|
|
if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > MAX_WORKSPACE_DIAGNOSTIC_TIMEOUT_MS) {
|
|
throw new Error("workspace diagnostic timeout configuration is invalid");
|
|
}
|
|
return timeout;
|
|
}
|
|
|
|
function piManagementTimeout(value: string | undefined): number {
|
|
const timeout = Number(value ?? 8_000);
|
|
if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30_000) {
|
|
throw new Error("Pi management timeout configuration is invalid");
|
|
}
|
|
return timeout;
|
|
}
|
|
|
|
function loopbackHost(host: string): boolean {
|
|
return host === "::1"
|
|
|| host === "127.0.0.1"
|
|
|| /^127(?:\.\d{1,3}){3}$/.test(host);
|
|
}
|
|
|
|
function internalServiceUrl(
|
|
value: string | undefined,
|
|
fallback: string,
|
|
label: string,
|
|
allowedHosts: readonly string[],
|
|
): string {
|
|
const raw = value ?? fallback;
|
|
let parsed: URL;
|
|
try {
|
|
parsed = new URL(raw);
|
|
} catch {
|
|
throw new Error(`${label} configuration is invalid`);
|
|
}
|
|
if (
|
|
parsed.protocol !== "http:"
|
|
|| parsed.username.length > 0
|
|
|| parsed.password.length > 0
|
|
|| parsed.pathname !== "/"
|
|
|| parsed.search.length > 0
|
|
|| parsed.hash.length > 0
|
|
|| (!allowedHosts.includes(parsed.hostname) && !loopbackHost(parsed.hostname))
|
|
) {
|
|
throw new Error(`${label} configuration is invalid`);
|
|
}
|
|
return parsed.toString().replace(/\/$/, "");
|
|
}
|
|
|
|
function positiveDimension(value: string | undefined, fallback: number): number {
|
|
const parsed = Number(value ?? fallback);
|
|
if (!Number.isSafeInteger(parsed) || parsed <= 0) {
|
|
throw new Error("internal embedding dimensions configuration is invalid");
|
|
}
|
|
return parsed;
|
|
}
|
|
|
|
export function loadConfig(env: Record<string, string | undefined>): AppConfig {
|
|
const defaultAuthConfigFile = "/run/thothii-auth/auth.yaml";
|
|
const authConfigFile = absoluteAuthPath(env.THT_AUTH_CONFIG_FILE ?? defaultAuthConfigFile, "file");
|
|
const authStateRoot = absoluteAuthPath(env.THT_AUTH_STATE_ROOT ?? "/data/auth", "state root");
|
|
const runtimeProjectionRoot = env.THT_AUTH_RUNTIME_PROJECTION_ROOT;
|
|
let hasAuthenticationConfig = false;
|
|
let authentication: AuthenticationConfigProvider | undefined;
|
|
if (runtimeProjectionRoot !== undefined) {
|
|
let projectionRoot: string;
|
|
try {
|
|
projectionRoot = absoluteAuthPath(runtimeProjectionRoot, "runtime projection root");
|
|
} catch {
|
|
throw new Error("authentication configuration is invalid");
|
|
}
|
|
if (env.THT_AUTH_CONFIG_FILE !== undefined && env.THT_AUTH_CONFIG_FILE !== defaultAuthConfigFile) {
|
|
throw new Error("authentication configuration is invalid");
|
|
}
|
|
authentication = createProjectedAuthenticationConfigProvider(projectionRoot);
|
|
hasAuthenticationConfig = true;
|
|
} else {
|
|
hasAuthenticationConfig = authConfigFileExists(authConfigFile);
|
|
authentication = hasAuthenticationConfig ? createAuthenticationConfigProvider(authConfigFile) : undefined;
|
|
}
|
|
if (hasAuthenticationConfig && env.AUTH_MODE !== undefined) {
|
|
throw new Error("authentication configuration and AUTH_MODE cannot both be set");
|
|
}
|
|
let authMode: AuthMode;
|
|
if (authentication) {
|
|
authMode = authentication.current().value.mode;
|
|
} else {
|
|
const requestedMode = env.AUTH_MODE ?? "none";
|
|
if (!(["none", "mock", "upstream"] as const).includes(requestedMode as "none" | "mock" | "upstream")) {
|
|
throw new Error(`unsupported AUTH_MODE=${requestedMode}; use none, mock, or upstream`);
|
|
}
|
|
const nodeEnvironment = env.NODE_ENV ?? process.env.NODE_ENV;
|
|
if ((requestedMode === "none" || requestedMode === "mock")
|
|
&& nodeEnvironment !== "development" && nodeEnvironment !== "test") {
|
|
throw new Error("production requires auth.yaml or AUTH_MODE=upstream");
|
|
}
|
|
authMode = requestedMode as "none" | "mock" | "upstream";
|
|
}
|
|
const publicExposure = env.THOTH_PUBLIC_EXPOSURE === "true";
|
|
if (publicExposure && authMode !== "oidc" && authMode !== "upstream") {
|
|
throw new Error("public exposure requires AUTH_MODE=upstream or configured OIDC behind a trusted proxy");
|
|
}
|
|
const sessionStorageMode = env.THT_SESSION_STORAGE ?? "local";
|
|
if (sessionStorageMode !== "local" && sessionStorageMode !== "postgres") {
|
|
throw new Error("session storage configuration is invalid");
|
|
}
|
|
if (sessionStorageMode === "local" && publicExposure) {
|
|
throw new Error("local session storage requires loopback-only deployment");
|
|
}
|
|
const legacyWorkspaceMode = env.THT_LEGACY_WORKSPACE_MODE;
|
|
if (legacyWorkspaceMode !== undefined && legacyWorkspaceMode !== "local") {
|
|
throw new Error("legacy workspace mode configuration is invalid");
|
|
}
|
|
if (legacyWorkspaceMode === "local" && sessionStorageMode !== "local") {
|
|
throw new Error("legacy workspace mode requires local session storage");
|
|
}
|
|
const sessionStorage: AppConfig["sessionStorage"] = { mode: sessionStorageMode };
|
|
if (sessionStorageMode === "postgres") {
|
|
const host = env.THT_SESSION_DB_HOST;
|
|
const database = env.THT_SESSION_DB_NAME;
|
|
const runtimeUser = env.THT_SESSION_RUNTIME_USER;
|
|
const runtimePasswordFile = env.THT_SESSION_RUNTIME_PASSWORD_FILE;
|
|
const sslmode = env.THT_SESSION_DB_SSLMODE;
|
|
const sslrootcert = env.THT_SESSION_DB_SSLROOTCERT;
|
|
const port = Number(env.THT_SESSION_DB_PORT ?? 5432);
|
|
if (
|
|
(authMode !== "upstream" && authMode !== "oidc")
|
|
|| !host || !database || !runtimeUser
|
|
|| !runtimePasswordFile || !path.isAbsolute(runtimePasswordFile)
|
|
|| (sslmode !== "verify-ca" && sslmode !== "verify-full")
|
|
|| !sslrootcert || !path.isAbsolute(sslrootcert)
|
|
|| !Number.isInteger(port) || port < 1 || port > 65535
|
|
) {
|
|
if (authMode !== "upstream" && authMode !== "oidc") {
|
|
throw new Error("server session storage requires AUTH_MODE=upstream or configured OIDC");
|
|
}
|
|
throw new Error("server session storage configuration is invalid");
|
|
}
|
|
sessionStorage.host = host;
|
|
sessionStorage.port = port;
|
|
sessionStorage.database = database;
|
|
sessionStorage.runtimeUser = runtimeUser;
|
|
sessionStorage.runtimePasswordFile = runtimePasswordFile;
|
|
sessionStorage.sslmode = sslmode;
|
|
sessionStorage.sslrootcert = sslrootcert;
|
|
}
|
|
const modelApiKeyFile = env.THT_MODEL_API_KEY_FILE;
|
|
if (modelApiKeyFile !== undefined && (
|
|
modelApiKeyFile.trim() !== modelApiKeyFile
|
|
|| modelApiKeyFile.length === 0
|
|
|| modelApiKeyFile.includes("\0")
|
|
|| !path.isAbsolute(modelApiKeyFile)
|
|
)) {
|
|
throw new Error("model credential configuration is invalid");
|
|
}
|
|
const secretsFile = env.THT_SECRETS_FILE;
|
|
if (secretsFile !== undefined && (
|
|
secretsFile.trim() !== secretsFile || secretsFile.length === 0 || secretsFile.includes("\0")
|
|
|| !path.isAbsolute(secretsFile)
|
|
)) throw new Error("secret bundle configuration is invalid");
|
|
const piAuthFile = env.THT_PI_AUTH_FILE;
|
|
if (piAuthFile !== undefined && (
|
|
piAuthFile.trim() !== piAuthFile || piAuthFile.length === 0 || piAuthFile.includes("\0")
|
|
|| !path.isAbsolute(piAuthFile)
|
|
)) throw new Error("Pi authentication source configuration is invalid");
|
|
const secretFiles: Record<string, string | undefined> = {};
|
|
for (const name of [
|
|
"THT_MODEL_API_KEY_SECRET_FILE", "THT_DWH_API_KEY_SECRET_FILE", "THT_VEC_API_KEY_SECRET_FILE",
|
|
"THT_VEC_WRITE_API_KEY_SECRET_FILE", "THT_CA_SECRET_FILE", "THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE",
|
|
"THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE", "THT_VECTOR_READER_PASSWORD_SECRET_FILE",
|
|
"THT_VECTOR_WRITER_PASSWORD_SECRET_FILE",
|
|
]) secretFiles[name] = env[name];
|
|
const registryRoot = absoluteRegistryPath(
|
|
env.THT_WORKSPACE_REGISTRY_ROOT ?? "/data/workspace-registry",
|
|
"root",
|
|
);
|
|
const registryBranch = refSafeGitBranch(env.THT_WORKSPACE_GIT_BRANCH ?? "main");
|
|
const installationId = safeInstallationId(
|
|
env.THT_WORKSPACE_INSTALLATION_ID ?? "local",
|
|
);
|
|
const remoteUrl = env.THT_WORKSPACE_GIT_REMOTE === undefined
|
|
? undefined
|
|
: requiredRegistryValue(env.THT_WORKSPACE_GIT_REMOTE, "remote");
|
|
const secretRoots = (env.THT_WORKSPACE_SECRET_ROOTS ?? "")
|
|
.split(",")
|
|
.filter((root) => root.length > 0)
|
|
.map((root) => absoluteRegistryPath(root, "secret root"));
|
|
const workspaceRegistry: WorkspaceRegistryConfig = {
|
|
root: registryRoot,
|
|
remoteUrl,
|
|
branch: registryBranch,
|
|
installationId,
|
|
secretRoots,
|
|
dataRoot: env.THT_DATA_ROOT,
|
|
maxEvidenceEntries: positiveImportLimit(env.THT_WORKSPACE_MAX_EVIDENCE_ENTRIES, 4096),
|
|
maxEvidenceBytes: positiveImportLimit(env.THT_WORKSPACE_MAX_EVIDENCE_BYTES, 64 * 1024 * 1024),
|
|
maxEvidenceFileBytes: positiveImportLimit(env.THT_WORKSPACE_MAX_EVIDENCE_FILE_BYTES, 8 * 1024 * 1024),
|
|
maxEvidencePathBytes: positiveImportLimit(env.THT_WORKSPACE_MAX_EVIDENCE_PATH_BYTES, 4096),
|
|
maxEvidenceManifestBytes: positiveImportLimit(env.THT_WORKSPACE_MAX_EVIDENCE_MANIFEST_BYTES, 1024 * 1024),
|
|
};
|
|
const workspaceSecretStoreRoot = absoluteRegistryPath(
|
|
env.THT_WORKSPACE_SECRET_STORE_ROOT ?? path.join(path.dirname(registryRoot), "workspace-secrets"),
|
|
"secret store root",
|
|
);
|
|
const workspaceSecretRuntimeRoot = absoluteRegistryPath(
|
|
env.THT_WORKSPACE_SECRET_RUNTIME_ROOT ?? "/tmp/thothii-workspace-secrets",
|
|
"secret runtime root",
|
|
);
|
|
const settingsFile = env.SETTINGS_FILE ?? "data/settings.json";
|
|
const internalQdrantUrl = internalServiceUrl(
|
|
env.THT_INTERNAL_QDRANT_URL,
|
|
"http://qdrant:6333",
|
|
"internal Qdrant URL",
|
|
["qdrant", "localhost"],
|
|
);
|
|
const internalEmbeddingUrl = internalServiceUrl(
|
|
env.THT_INTERNAL_EMBEDDING_URL,
|
|
"http://embedding:11434",
|
|
"internal embedding URL",
|
|
["embedding", "localhost"],
|
|
);
|
|
return {
|
|
host: env.HOST ?? "127.0.0.1",
|
|
port: Number(env.PORT ?? 8787),
|
|
harnessDir: env.THT_HARNESS_DIR ?? "../harness",
|
|
thtBin: env.THT_BIN ?? "tht",
|
|
piBin: env.PI_BIN ?? "pi",
|
|
authMode,
|
|
authConfigFile,
|
|
authStateRoot,
|
|
authentication,
|
|
publicExposure,
|
|
sessionStorage,
|
|
defaults: { provider: env.PI_PROVIDER, model: env.PI_MODEL, thinking: env.PI_THINKING },
|
|
maxPiProcesses: Number(env.MAX_PI_PROCESSES ?? 4),
|
|
settingsFile,
|
|
maintenanceFile: env.THT_MAINTENANCE_FILE ?? path.join(path.dirname(settingsFile), "maintenance.json"),
|
|
dataRoot: env.THT_DATA_ROOT,
|
|
ollamaEnsureTimeoutMs: Number(env.OLLAMA_ENSURE_TIMEOUT_MS ?? 60000),
|
|
piManagementTimeoutMs: piManagementTimeout(env.PI_MANAGEMENT_TIMEOUT_MS),
|
|
secretsFile,
|
|
piAuthFile,
|
|
secretFiles,
|
|
modelApiKeyFile,
|
|
dwhPrecheck: env.THT_DWH_PRECHECK === "true" || env.THT_DWH_PRECHECK === "1",
|
|
legacyWorkspaceMode: legacyWorkspaceMode === "local",
|
|
workspaceDiagnosticTimeoutMs: diagnosticTimeout(env.THT_WORKSPACE_DIAGNOSTIC_TIMEOUT_MS),
|
|
workspaceRegistry,
|
|
workspaceSecretStoreRoot,
|
|
workspaceSecretRuntimeRoot,
|
|
internalQdrantUrl,
|
|
internalEmbeddingUrl,
|
|
internalEmbeddingModel: env.THT_INTERNAL_EMBEDDING_MODEL ?? "qwen3-embedding:0.6b",
|
|
internalEmbeddingDimensions: positiveDimension(env.THT_INTERNAL_EMBEDDING_DIMENSIONS, 1024),
|
|
};
|
|
}
|