Skip to content

Commit 3fdea04

Browse files
coodoscoodos
authored
Fix/evault access guard permission issue (#646)
* fix: middleware applies to bulk routes * tests: add VAG tests * fix: validation logic * fix: test token creation logic * fix: registry mocking in e2e tests
1 parent 6b5b420 commit 3fdea04

31 files changed

Lines changed: 1358 additions & 839 deletions

‎docker-compose.core.yml‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
version: '3.8'
2+
3+
x-common-host-access: &common-host-access
4+
extra_hosts:
5+
- "host.docker.internal:host-gateway"
6+
dns:
7+
- 8.8.8.8
8+
- 8.8.4.4
9+
- 1.1.1.1
10+
11+
services:
12+
# PostgreSQL database for registry and evault-core
13+
postgres:
14+
image: postgres:15-alpine
15+
container_name: metastate-postgres
16+
ports:
17+
- "5433:5432"
18+
environment:
19+
- POSTGRES_USER=postgres
20+
- POSTGRES_PASSWORD=postgres
21+
- POSTGRES_MULTIPLE_DATABASES=registry
22+
volumes:
23+
- postgres_data:/var/lib/postgresql/data
24+
- ./db/init-multiple-databases.sh:/docker-entrypoint-initdb.d/init-multiple-databases.sh
25+
networks:
26+
- metastate-core-network
27+
<<: *common-host-access
28+
healthcheck:
29+
test: ["CMD-SHELL", "pg_isready -U postgres"]
30+
interval: 10s
31+
timeout: 5s
32+
retries: 5
33+
logging:
34+
driver: "none"
35+
36+
# Neo4j for evault-core graph data
37+
neo4j:
38+
image: neo4j:5.15
39+
container_name: metastate-neo4j
40+
ports:
41+
- "7474:7474" # HTTP
42+
- "7687:7687" # Bolt
43+
environment:
44+
- NEO4J_AUTH=${NEO4J_USER:-neo4j}/${NEO4J_PASSWORD:-neo4j}
45+
- NEO4J_USER=${NEO4J_USER:-neo4j}
46+
- NEO4J_PASSWORD=${NEO4J_PASSWORD:-neo4j}
47+
- NEO4J_dbms_connector_bolt_listen__address=0.0.0.0:7687
48+
- NEO4J_dbms_connector_http_listen__address=0.0.0.0:7474
49+
- NEO4J_dbms_connector_bolt_advertised__address=neo4j:7687
50+
volumes:
51+
- neo4j_data:/var/lib/neo4j/data
52+
networks:
53+
- metastate-core-network
54+
<<: *common-host-access
55+
entrypoint: ["/bin/sh", "-c"]
56+
command:
57+
- |
58+
# Remove any stale PID files before starting Neo4j
59+
rm -f /var/lib/neo4j/run/neo4j.pid 2>/dev/null || true
60+
rm -f /var/lib/neo4j/data/run/neo4j.pid 2>/dev/null || true
61+
rm -f /var/lib/neo4j/data/neo4j.pid 2>/dev/null || true
62+
find /var/lib/neo4j -name "*.pid" -type f -delete 2>/dev/null || true
63+
find /var/lib/neo4j/data -name "*.pid" -type f -delete 2>/dev/null || true
64+
exec /startup/docker-entrypoint.sh neo4j
65+
healthcheck:
66+
test: ["CMD-SHELL", "cypher-shell -u neo4j -p ${NEO4J_PASSWORD:-neo4j} 'RETURN 1' || exit 1"]
67+
interval: 10s
68+
timeout: 5s
69+
retries: 10
70+
start_period: 30s
71+
72+
# Registry service
73+
registry:
74+
profiles:
75+
- core
76+
build:
77+
context: .
78+
dockerfile: ./docker/Dockerfile.registry
79+
network: host
80+
container_name: metastate-registry
81+
ports:
82+
- "4321:4321"
83+
environment:
84+
- NODE_ENV=${NODE_ENV:-production}
85+
- DATABASE_URL=${REGISTRY_DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/registry}
86+
- REGISTRY_SHARED_SECRET=${REGISTRY_SHARED_SECRET:-dev-secret-change-me}
87+
- PUBLIC_REGISTRY_URL=${PUBLIC_REGISTRY_URL:-http://localhost:4321}
88+
depends_on:
89+
postgres:
90+
condition: service_healthy
91+
networks:
92+
- metastate-core-network
93+
<<: *common-host-access
94+
restart: unless-stopped
95+
96+
# eVault Core service
97+
evault-core:
98+
profiles:
99+
- core
100+
build:
101+
context: .
102+
dockerfile: ./docker/Dockerfile.evault-core
103+
network: host
104+
container_name: metastate-evault-core
105+
ports:
106+
- "3001:3001" # Express (provisioning API)
107+
- "4000:4000" # Fastify (GraphQL/HTTP)
108+
environment:
109+
- NODE_ENV=${NODE_ENV:-production}
110+
- EXPRESS_PORT=3001
111+
- FASTIFY_PORT=4000
112+
- PORT=4000
113+
- REGISTRY_DATABASE_URL=${REGISTRY_DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/registry}
114+
- PUBLIC_REGISTRY_URL=${PUBLIC_REGISTRY_URL:-http://registry:4321}
115+
- REGISTRY_SHARED_SECRET=${REGISTRY_SHARED_SECRET:-dev-secret-change-me}
116+
- NEO4J_URI=${NEO4J_URI:-bolt://neo4j:7687}
117+
- NEO4J_USER=${NEO4J_USER:-neo4j}
118+
- NEO4J_PASSWORD=${NEO4J_PASSWORD:-neo4j}
119+
- EVAULT_PUBLIC_KEY=${EVAULT_PUBLIC_KEY:-}
120+
- W3ID=${W3ID:-}
121+
depends_on:
122+
postgres:
123+
condition: service_healthy
124+
registry:
125+
condition: service_started
126+
neo4j:
127+
condition: service_healthy
128+
networks:
129+
- metastate-core-network
130+
<<: *common-host-access
131+
restart: unless-stopped
132+
133+
volumes:
134+
postgres_data:
135+
driver: local
136+
neo4j_data:
137+
driver: local
138+
139+
networks:
140+
metastate-core-network:
141+
driver: bridge
142+
driver_opts:
143+
com.docker.network.bridge.enable_icc: "true"
144+
com.docker.network.bridge.enable_ip_masquerade: "true"
145+
ipam:
146+
config:
147+
- subnet: 172.28.0.0/16

‎docker-compose.socials.yml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
version: '3.8'
2+
3+
x-common-host-access: &common-host-access
4+
extra_hosts:
5+
- "host.docker.internal:host-gateway"
6+
7+
services:
8+
# PostgreSQL database for social platforms
9+
postgres:
10+
image: postgres:15-alpine
11+
container_name: metastate-postgres-socials
12+
ports:
13+
- "5434:5432"
14+
environment:
15+
- POSTGRES_USER=postgres
16+
- POSTGRES_PASSWORD=postgres
17+
- POSTGRES_MULTIPLE_DATABASES=blabsy_auth,pictique
18+
volumes:
19+
- postgres_socials_data:/var/lib/postgresql/data
20+
- ./db/init-multiple-databases.sh:/docker-entrypoint-initdb.d/init-multiple-databases.sh
21+
networks:
22+
- metastate-socials-network
23+
<<: *common-host-access
24+
healthcheck:
25+
test: ["CMD-SHELL", "pg_isready -U postgres"]
26+
interval: 10s
27+
timeout: 5s
28+
retries: 5
29+
logging:
30+
driver: "none"
31+
32+
# Blabsy W3DS Auth API
33+
blabsy-w3ds-auth-api:
34+
profiles:
35+
- socials
36+
build:
37+
context: .
38+
dockerfile: ./docker/Dockerfile.blabsy-w3ds-auth-api
39+
container_name: metastate-blabsy-api
40+
ports:
41+
- "3000:3000"
42+
environment:
43+
- NODE_ENV=${NODE_ENV:-production}
44+
- PORT=3000
45+
- DATABASE_URL=${BLABSY_DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/blabsy_auth}
46+
- PUBLIC_REGISTRY_URL=${PUBLIC_REGISTRY_URL:-http://localhost:4321}
47+
- REGISTRY_SHARED_SECRET=${REGISTRY_SHARED_SECRET:-dev-secret-change-me}
48+
- GOOGLE_APPLICATION_CREDENTIALS=${GOOGLE_APPLICATION_CREDENTIALS:-}
49+
- FIREBASE_CREDENTIALS_PATH=${FIREBASE_CREDENTIALS_PATH:-}
50+
- BLABSY_MAPPING_DB_PATH=${BLABSY_MAPPING_DB_PATH:-/app/data/mapping-dbs/blabsy}
51+
volumes:
52+
- mapping_db_data:/app/data/mapping-dbs
53+
depends_on:
54+
postgres:
55+
condition: service_healthy
56+
networks:
57+
- metastate-socials-network
58+
<<: *common-host-access
59+
restart: unless-stopped
60+
61+
# Blabsy Frontend
62+
blabsy:
63+
profiles:
64+
- socials
65+
build:
66+
context: .
67+
dockerfile: ./docker/Dockerfile.blabsy
68+
container_name: metastate-blabsy
69+
ports:
70+
- "8080:8080"
71+
environment:
72+
- NODE_ENV=${NODE_ENV:-production}
73+
- NEXT_PUBLIC_BASE_URL=${PUBLIC_BLABSY_BASE_URL:-http://localhost:3000}
74+
- NEXT_PUBLIC_REGISTRY_URL=${PUBLIC_REGISTRY_URL:-http://localhost:4321}
75+
depends_on:
76+
blabsy-w3ds-auth-api:
77+
condition: service_started
78+
networks:
79+
- metastate-socials-network
80+
<<: *common-host-access
81+
restart: unless-stopped
82+
83+
# Pictique API
84+
pictique-api:
85+
profiles:
86+
- socials
87+
build:
88+
context: .
89+
dockerfile: ./docker/Dockerfile.pictique-api
90+
container_name: metastate-pictique-api
91+
ports:
92+
- "1111:1111"
93+
environment:
94+
- NODE_ENV=${NODE_ENV:-production}
95+
- PORT=1111
96+
- DATABASE_URL=${PICTIQUE_DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/pictique}
97+
- PUBLIC_REGISTRY_URL=${PUBLIC_REGISTRY_URL:-http://localhost:4321}
98+
- REGISTRY_SHARED_SECRET=${REGISTRY_SHARED_SECRET:-dev-secret-change-me}
99+
- PICTIQUE_MAPPING_DB_PATH=${PICTIQUE_MAPPING_DB_PATH:-/app/data/mapping-dbs/pictique}
100+
volumes:
101+
- mapping_db_data:/app/data/mapping-dbs
102+
depends_on:
103+
postgres:
104+
condition: service_healthy
105+
networks:
106+
- metastate-socials-network
107+
<<: *common-host-access
108+
restart: unless-stopped
109+
110+
# Pictique Frontend
111+
pictique:
112+
profiles:
113+
- socials
114+
build:
115+
context: .
116+
dockerfile: ./docker/Dockerfile.pictique
117+
container_name: metastate-pictique
118+
ports:
119+
- "5173:5173"
120+
environment:
121+
- NODE_ENV=${NODE_ENV:-production}
122+
- PUBLIC_PICTIQUE_BASE_URL=${PUBLIC_PICTIQUE_BASE_URL:-http://localhost:1111}
123+
- PUBLIC_REGISTRY_URL=${PUBLIC_REGISTRY_URL:-http://localhost:4321}
124+
depends_on:
125+
pictique-api:
126+
condition: service_started
127+
networks:
128+
- metastate-socials-network
129+
<<: *common-host-access
130+
restart: unless-stopped
131+
132+
volumes:
133+
postgres_socials_data:
134+
driver: local
135+
mapping_db_data:
136+
driver: local
137+
138+
networks:
139+
metastate-socials-network:
140+
driver: bridge

‎docker/Dockerfile.blabsy‎

Lines changed: 29 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,43 @@
1-
FROM node:18-alpine AS base
2-
RUN apk update && apk add --no-cache libc6-compat
1+
FROM node:20-alpine AS base
2+
RUN apk add --no-cache libc6-compat python3 make g++
33
WORKDIR /app
44

5+
# Set CI environment for non-interactive pnpm operations
6+
ENV CI=true
7+
ENV PYTHON=/usr/bin/python3
8+
RUN ln -sf python3 /usr/bin/python
9+
510
# ---
611
FROM base AS prepare
7-
RUN corepack enable && corepack prepare pnpm@10.13.1 --activate
8-
RUN npm install -g turbo@^2
12+
RUN npm install -g pnpm@10.25.0 turbo@^2
913
COPY . .
1014
RUN turbo prune blabsy --docker
1115

1216
# ---
13-
FROM base AS runner
14-
RUN corepack enable && corepack prepare pnpm@10.13.1 --activate
15-
# Copy workspace config
16-
COPY --from=prepare /app/pnpm-workspace.yaml ./
17-
COPY --from=prepare /app/package.json ./
18-
# Copy pruned workspace
17+
FROM base AS builder
18+
RUN npm install -g pnpm@10.25.0
19+
# First install the dependencies (as they change less often)
1920
COPY --from=prepare /app/out/json/ .
20-
# Install dependencies (build will happen at runtime with volumes)
2121
RUN pnpm install --frozen-lockfile
22+
# Build the project
2223
COPY --from=prepare /app/out/full/ .
24+
RUN pnpm turbo build --filter=blabsy
25+
26+
# ---
27+
FROM base AS runner
28+
# Copy built application
29+
COPY --from=builder /app/platforms/blabsy/package.json ./
30+
COPY --from=builder /app/platforms/blabsy/.next ./.next
31+
COPY --from=builder /app/platforms/blabsy/public ./public
32+
COPY --from=builder /app/platforms/blabsy/next.config.ts ./
33+
COPY --from=builder /app/platforms/blabsy/node_modules ./node_modules
2334

24-
WORKDIR /app/platforms/blabsy
2535
EXPOSE 8080
26-
CMD ["pnpm", "dev"]
36+
ENV NODE_ENV=production
37+
ENV PORT=8080
38+
ENV HOSTNAME=0.0.0.0
39+
40+
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
41+
CMD node -e "require('http').get('http://localhost:8080', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"
2742

43+
CMD ["node_modules/.bin/next", "start"]

0 commit comments

Comments
 (0)