0e89c96170
## Summary - **npm + tarball app distribution**: Apps can be installed from the npm registry (public or private) or uploaded as `.tar.gz` tarballs, with `AppRegistrationSourceType` tracking the origin - **Upgrade mechanism**: `AppUpgradeService` checks for newer versions, supports rollback for npm-sourced apps, and a cron job runs every 6 hours to update `latestAvailableVersion` on registrations - **Security hardening**: Tarball extraction uses path traversal protection, and `enableScripts: false` in `.yarnrc.yml` disables all lifecycle scripts during `yarn install` to prevent RCE - **Frontend**: "Install from npm" and "Upload tarball" modals, upgrade button on app detail page, blue "Update" badge on installed apps table when a newer version is available - **Marketplace catalog sync**: Hourly cron job syncs a hardcoded catalog index into `ApplicationRegistration` entities - **Integration tests**: Coverage for install, upgrade, tarball upload, and catalog sync flows ## Backend changes | Area | Files | |------|-------| | Entity & migration | `ApplicationRegistrationEntity` (sourceType, sourcePackage, latestAvailableVersion), `ApplicationEntity` (applicationRegistrationId), migration | | Services | `AppPackageResolverService`, `ApplicationInstallService`, `AppUpgradeService`, `MarketplaceCatalogSyncService` | | Cron jobs | `MarketplaceCatalogSyncCronJob` (hourly), `AppVersionCheckCronJob` (every 6h) | | REST endpoint | `AppRegistrationUploadController` — tarball upload with secure extraction | | Resolver | `MarketplaceResolver` — simplified `installMarketplaceApp` (removed redundant `sourcePackage` arg) | | Security | `.yarnrc.yml` — `enableScripts: false` to block postinstall RCE | ## Frontend changes | Area | Files | |------|-------| | Modals | `SettingsInstallNpmAppModal`, `SettingsUploadTarballModal`, `SettingsAppModalLayout` | | Hooks | `useUploadAppTarball`, `useInstallMarketplaceApp` (cleaned up) | | Upgrade UI | `SettingsApplicationVersionContainer`, `SettingsApplicationDetailAboutTab` | | Badge | `SettingsApplicationTableRow` — blue "Update" tag, `SettingsApplicationsInstalledTab` — fetches registrations for version comparison | | Styling | Migrated to Linaria (matching main) | ## Test plan - [ ] Install an app from npm via the "Install from npm" modal - [ ] Upload a `.tar.gz` tarball via the "Upload tarball" modal - [ ] Verify upgrade badge appears when `latestAvailableVersion > version` - [ ] Verify upgrade flow from app detail page - [ ] Run integration tests: `app-distribution.integration-spec.ts`, `marketplace-catalog-sync.integration-spec.ts` - [ ] Verify `enableScripts: false` blocks postinstall scripts during yarn install Made with [Cursor](https://cursor.com)
57 lines
1.7 KiB
TypeScript
57 lines
1.7 KiB
TypeScript
import { uploadAppTarballQueryFactory } from 'test/integration/metadata/suites/application/utils/upload-app-tarball-query-factory.util';
|
|
import { makeMetadataAPIRequestWithFileUpload } from 'test/integration/metadata/suites/utils/make-metadata-api-request-with-file-upload.util';
|
|
import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
|
|
import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
|
|
import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
|
|
|
|
type UploadAppTarballResult = {
|
|
id: string;
|
|
universalIdentifier: string;
|
|
name: string;
|
|
};
|
|
|
|
export const uploadAppTarball = async ({
|
|
tarballBuffer,
|
|
universalIdentifier,
|
|
expectToFail = false,
|
|
token,
|
|
}: {
|
|
tarballBuffer: Buffer;
|
|
universalIdentifier?: string;
|
|
expectToFail?: boolean;
|
|
token?: string;
|
|
}): CommonResponseBody<{
|
|
uploadAppTarball: UploadAppTarballResult;
|
|
}> => {
|
|
const graphqlOperation = uploadAppTarballQueryFactory({
|
|
universalIdentifier,
|
|
});
|
|
|
|
const response = await makeMetadataAPIRequestWithFileUpload(
|
|
graphqlOperation,
|
|
{
|
|
field: 'file',
|
|
buffer: tarballBuffer,
|
|
filename: 'app.tar.gz',
|
|
contentType: 'application/gzip',
|
|
},
|
|
token,
|
|
);
|
|
|
|
if (expectToFail === true) {
|
|
warnIfNoErrorButExpectedToFail({
|
|
response,
|
|
errorMessage: 'Upload app tarball should have failed but did not',
|
|
});
|
|
}
|
|
|
|
if (expectToFail === false) {
|
|
warnIfErrorButNotExpectedToFail({
|
|
response,
|
|
errorMessage: 'Upload app tarball has failed but should not',
|
|
});
|
|
}
|
|
|
|
return { data: response.body.data, errors: response.body.errors };
|
|
};
|