0e89c96170
## Summary - **npm + tarball app distribution**: Apps can be installed from the npm registry (public or private) or uploaded as `.tar.gz` tarballs, with `AppRegistrationSourceType` tracking the origin - **Upgrade mechanism**: `AppUpgradeService` checks for newer versions, supports rollback for npm-sourced apps, and a cron job runs every 6 hours to update `latestAvailableVersion` on registrations - **Security hardening**: Tarball extraction uses path traversal protection, and `enableScripts: false` in `.yarnrc.yml` disables all lifecycle scripts during `yarn install` to prevent RCE - **Frontend**: "Install from npm" and "Upload tarball" modals, upgrade button on app detail page, blue "Update" badge on installed apps table when a newer version is available - **Marketplace catalog sync**: Hourly cron job syncs a hardcoded catalog index into `ApplicationRegistration` entities - **Integration tests**: Coverage for install, upgrade, tarball upload, and catalog sync flows ## Backend changes | Area | Files | |------|-------| | Entity & migration | `ApplicationRegistrationEntity` (sourceType, sourcePackage, latestAvailableVersion), `ApplicationEntity` (applicationRegistrationId), migration | | Services | `AppPackageResolverService`, `ApplicationInstallService`, `AppUpgradeService`, `MarketplaceCatalogSyncService` | | Cron jobs | `MarketplaceCatalogSyncCronJob` (hourly), `AppVersionCheckCronJob` (every 6h) | | REST endpoint | `AppRegistrationUploadController` — tarball upload with secure extraction | | Resolver | `MarketplaceResolver` — simplified `installMarketplaceApp` (removed redundant `sourcePackage` arg) | | Security | `.yarnrc.yml` — `enableScripts: false` to block postinstall RCE | ## Frontend changes | Area | Files | |------|-------| | Modals | `SettingsInstallNpmAppModal`, `SettingsUploadTarballModal`, `SettingsAppModalLayout` | | Hooks | `useUploadAppTarball`, `useInstallMarketplaceApp` (cleaned up) | | Upgrade UI | `SettingsApplicationVersionContainer`, `SettingsApplicationDetailAboutTab` | | Badge | `SettingsApplicationTableRow` — blue "Update" tag, `SettingsApplicationsInstalledTab` — fetches registrations for version comparison | | Styling | Migrated to Linaria (matching main) | ## Test plan - [ ] Install an app from npm via the "Install from npm" modal - [ ] Upload a `.tar.gz` tarball via the "Upload tarball" modal - [ ] Verify upgrade badge appears when `latestAvailableVersion > version` - [ ] Verify upgrade flow from app detail page - [ ] Run integration tests: `app-distribution.integration-spec.ts`, `marketplace-catalog-sync.integration-spec.ts` - [ ] Verify `enableScripts: false` blocks postinstall scripts during yarn install Made with [Cursor](https://cursor.com)
155 lines
4.3 KiB
TypeScript
155 lines
4.3 KiB
TypeScript
import {
|
|
createApplicationRegistrationVariableMutationFactory,
|
|
deleteApplicationRegistrationVariableMutationFactory,
|
|
findApplicationRegistrationVariablesQueryFactory,
|
|
updateApplicationRegistrationVariableMutationFactory,
|
|
} from 'test/integration/metadata/suites/application-registration-variable/utils/application-registration-variable-query-factories.util';
|
|
import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
|
|
import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
|
|
import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
|
|
import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
|
|
|
|
import { type ApplicationRegistrationVariableEntity } from 'src/engine/core-modules/application/application-registration/application-registration-variable.entity';
|
|
|
|
type VariableFields = Pick<
|
|
ApplicationRegistrationVariableEntity,
|
|
| 'id'
|
|
| 'key'
|
|
| 'description'
|
|
| 'isSecret'
|
|
| 'isRequired'
|
|
| 'isFilled'
|
|
| 'createdAt'
|
|
| 'updatedAt'
|
|
>;
|
|
|
|
const handleExpectation = (
|
|
response: { body: { errors?: unknown[]; data?: unknown } },
|
|
expectToFail: boolean | undefined,
|
|
operationName: string,
|
|
) => {
|
|
if (expectToFail === true) {
|
|
warnIfNoErrorButExpectedToFail({
|
|
response: response as never,
|
|
errorMessage: `${operationName} should have failed but did not`,
|
|
});
|
|
}
|
|
|
|
if (expectToFail === false) {
|
|
warnIfErrorButNotExpectedToFail({
|
|
response: response as never,
|
|
errorMessage: `${operationName} has failed but should not`,
|
|
});
|
|
}
|
|
};
|
|
|
|
export const findApplicationRegistrationVariables = async ({
|
|
applicationRegistrationId,
|
|
expectToFail,
|
|
token,
|
|
}: {
|
|
applicationRegistrationId: string;
|
|
expectToFail?: boolean;
|
|
token?: string;
|
|
}): CommonResponseBody<{
|
|
findApplicationRegistrationVariables: VariableFields[];
|
|
}> => {
|
|
const graphqlOperation = findApplicationRegistrationVariablesQueryFactory({
|
|
applicationRegistrationId,
|
|
});
|
|
|
|
const response = await makeMetadataAPIRequest(graphqlOperation, token);
|
|
|
|
handleExpectation(response, expectToFail, 'Find variables');
|
|
|
|
return { data: response.body.data, errors: response.body.errors };
|
|
};
|
|
|
|
export const createApplicationRegistrationVariable = async ({
|
|
applicationRegistrationId,
|
|
key,
|
|
value,
|
|
description,
|
|
isSecret,
|
|
expectToFail,
|
|
token,
|
|
}: {
|
|
applicationRegistrationId: string;
|
|
key: string;
|
|
value: string;
|
|
description?: string;
|
|
isSecret?: boolean;
|
|
expectToFail?: boolean;
|
|
token?: string;
|
|
}): CommonResponseBody<{
|
|
createApplicationRegistrationVariable: VariableFields;
|
|
}> => {
|
|
const graphqlOperation = createApplicationRegistrationVariableMutationFactory(
|
|
{
|
|
applicationRegistrationId,
|
|
key,
|
|
value,
|
|
description,
|
|
isSecret,
|
|
},
|
|
);
|
|
|
|
const response = await makeMetadataAPIRequest(graphqlOperation, token);
|
|
|
|
handleExpectation(response, expectToFail, 'Create variable');
|
|
|
|
return { data: response.body.data, errors: response.body.errors };
|
|
};
|
|
|
|
export const updateApplicationRegistrationVariable = async ({
|
|
id,
|
|
value,
|
|
description,
|
|
expectToFail,
|
|
token,
|
|
}: {
|
|
id: string;
|
|
value?: string;
|
|
description?: string;
|
|
expectToFail?: boolean;
|
|
token?: string;
|
|
}): CommonResponseBody<{
|
|
updateApplicationRegistrationVariable: VariableFields;
|
|
}> => {
|
|
const graphqlOperation = updateApplicationRegistrationVariableMutationFactory(
|
|
{
|
|
id,
|
|
value,
|
|
description,
|
|
},
|
|
);
|
|
|
|
const response = await makeMetadataAPIRequest(graphqlOperation, token);
|
|
|
|
handleExpectation(response, expectToFail, 'Update variable');
|
|
|
|
return { data: response.body.data, errors: response.body.errors };
|
|
};
|
|
|
|
export const deleteApplicationRegistrationVariable = async ({
|
|
id,
|
|
expectToFail,
|
|
token,
|
|
}: {
|
|
id: string;
|
|
expectToFail?: boolean;
|
|
token?: string;
|
|
}): CommonResponseBody<{
|
|
deleteApplicationRegistrationVariable: boolean;
|
|
}> => {
|
|
const graphqlOperation = deleteApplicationRegistrationVariableMutationFactory(
|
|
{ id },
|
|
);
|
|
|
|
const response = await makeMetadataAPIRequest(graphqlOperation, token);
|
|
|
|
handleExpectation(response, expectToFail, 'Delete variable');
|
|
|
|
return { data: response.body.data, errors: response.body.errors };
|
|
};
|