mirror of
https://github.com/hanzoai/base.git
synced 2026-10-21 03:41:50 +00:00
Rename / namespace: - Finish github.com/pocketbase/* → github.com/hanzoai/base (+ /dbx) sweep across all Go sources; restore the renamed root launcher (Base, base.go). - Drop the upstream-only surfaces ours doesn't ship (admin ui/, the password/OTP/oauth2/impersonate auth files, extensions) re-added by the upstream merge. - Decomplect the on-disk layout to one base_/ namespace: data/, migrations/, hooks/, types.d.ts are siblings under base_/ (default data dir base_/data). Drop the hz_ prefix everywhere; collapse migratecmd's identical JS/Go branches to one path. - Remove the accidentally-committed hz_data/ dev dir (db + iam.key) and gitignore the runtime namespace dirs. Deps / build: - kmsclient now imported from the light github.com/hanzoai/kms/sdk/go module (the root kms module zip exceeds Go's download limit); cloud/pkg/base Mount removed (lives in the fused daemon). - replicate v0.4.0 → v0.8.0; metric.Counter.Get() (no prometheus dto); network/metrics.go import fix; auth gitlab/github tidy. Tests / behavior: - Wire registerNotifyWatcherHooks; debounce notify files past the kqueue rescan window so cross-instance settings/collections reload fires. - migratecmd: exclude createdAt/updatedAt (not created/updated); regenerate Go+JS automigration goldens from canonical output. - Convert the two stale archive red-probes to assert the landed defenses (backlog cap bounds memory; forged-segment signature is rejected). IAM-native (Base = pure IAM client): - Rip the ~1k-line home-grown embedded IAM (iam_embedded*.go) and the iam-user CLI. Base no longer reinvents identity as _iam_users/_superusers rows. IAM_ENDPOINT (hanzo.id, or an in-process iam.Embed in the fused daemon) is required; Base validates IAM JWTs via JWKS only — superuser is the IAM admin claim, resolved to an ephemeral unpersisted record. - Extract the IDV reverse-proxy (/v1/idv/*) into idv_proxy.go — it was mis-colocated in the embedded onboarding file and is independent of IAM. - Bind the SQL console (/v1/sql) and test it through real IAM JWTs against a JWKS stub (no hardcoded record tokens, no persisted rows).
218 lines
5.6 KiB
Go
218 lines
5.6 KiB
Go
package core
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/fatih/color"
|
|
"github.com/fsnotify/fsnotify"
|
|
"github.com/hanzoai/base/tools/hook"
|
|
"github.com/hanzoai/base/tools/security"
|
|
)
|
|
|
|
const systemHookIdNotifyWatcher = "__hzNotifyWatcherSystemHook__"
|
|
|
|
// notifyFileTTL is how long a notify file stays on disk before cleanup.
|
|
// kqueue-backed watchers (macOS) detect directory children by rescanning
|
|
// on dir-change events — a file created and unlinked within one scan
|
|
// window is never observed, so the signal file must outlive the watcher
|
|
// latency (event delivery + 50ms debounce).
|
|
const notifyFileTTL = 200 * time.Millisecond
|
|
|
|
func (app *BaseApp) registerNotifyWatcherHooks() {
|
|
var notifyWatcher *fsnotify.Watcher
|
|
|
|
instanceId := "@" + security.PseudorandomString(10)
|
|
|
|
localNotifyDirPath := filepath.Join(app.DataDir(), LocalNotifyDirName)
|
|
settingsFile := filepath.Join(localNotifyDirPath, "settings"+instanceId)
|
|
collectionsFile := filepath.Join(localNotifyDirPath, "collections"+instanceId)
|
|
|
|
// init
|
|
app.OnBootstrap().Bind(&hook.Handler[*BootstrapEvent]{
|
|
Id: systemHookIdNotifyWatcher,
|
|
Func: func(e *BootstrapEvent) error {
|
|
err := e.Next()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if notifyWatcher != nil {
|
|
_ = notifyWatcher.Close()
|
|
}
|
|
|
|
notifyWatcher, err = createNotifyDirWatcher(e.App, instanceId, localNotifyDirPath)
|
|
if err != nil {
|
|
e.App.Logger().Warn("Notify dir watcher failure.", "error", err)
|
|
}
|
|
|
|
return nil
|
|
},
|
|
Priority: -998,
|
|
})
|
|
|
|
// cleanup
|
|
app.OnTerminate().Bind(&hook.Handler[*TerminateEvent]{
|
|
Id: systemHookIdNotifyWatcher,
|
|
Func: func(e *TerminateEvent) error {
|
|
if notifyWatcher != nil {
|
|
_ = notifyWatcher.Close()
|
|
}
|
|
|
|
_ = os.Remove(settingsFile)
|
|
_ = os.Remove(collectionsFile)
|
|
|
|
return e.Next()
|
|
},
|
|
Priority: -998,
|
|
})
|
|
|
|
// ---------------------------------------------------------------
|
|
|
|
settingsNotify := func(e *ModelEvent) error {
|
|
err := e.Next()
|
|
if err != nil || e.Model.PK() != paramsKeySettings {
|
|
return err
|
|
}
|
|
|
|
if notifyWatcher != nil {
|
|
if err := os.WriteFile(settingsFile, nil, 0644); err != nil {
|
|
e.App.Logger().Warn("Failed to write watcher file", "error", err, "file", settingsFile)
|
|
}
|
|
time.AfterFunc(notifyFileTTL, func() { _ = os.Remove(settingsFile) })
|
|
}
|
|
|
|
return nil
|
|
}
|
|
app.OnModelAfterCreateSuccess(paramsTable).Bind(&hook.Handler[*ModelEvent]{
|
|
Id: systemHookIdNotifyWatcher,
|
|
Func: settingsNotify,
|
|
Priority: 999,
|
|
})
|
|
app.OnModelAfterUpdateSuccess(paramsTable).Bind(&hook.Handler[*ModelEvent]{
|
|
Id: systemHookIdNotifyWatcher,
|
|
Func: settingsNotify,
|
|
Priority: 999,
|
|
})
|
|
|
|
// ---------------------------------------------------------------
|
|
|
|
collectionsNotify := func(e *CollectionEvent) error {
|
|
if err := e.Next(); err != nil {
|
|
return err
|
|
}
|
|
|
|
if notifyWatcher != nil {
|
|
if err := os.WriteFile(collectionsFile, nil, 0644); err != nil {
|
|
e.App.Logger().Warn("Failed to write watcher file", "error", err, "file", collectionsFile)
|
|
}
|
|
time.AfterFunc(notifyFileTTL, func() { _ = os.Remove(collectionsFile) })
|
|
}
|
|
|
|
return nil
|
|
}
|
|
app.OnCollectionAfterCreateSuccess().Bind(&hook.Handler[*CollectionEvent]{
|
|
Id: systemHookIdNotifyWatcher,
|
|
Func: collectionsNotify,
|
|
Priority: 999,
|
|
})
|
|
app.OnCollectionAfterUpdateSuccess().Bind(&hook.Handler[*CollectionEvent]{
|
|
Id: systemHookIdNotifyWatcher,
|
|
Func: collectionsNotify,
|
|
Priority: 999,
|
|
})
|
|
app.OnCollectionAfterDeleteSuccess().Bind(&hook.Handler[*CollectionEvent]{
|
|
Id: systemHookIdNotifyWatcher,
|
|
Func: collectionsNotify,
|
|
Priority: 999,
|
|
})
|
|
}
|
|
|
|
func createNotifyDirWatcher(app App, instanceId string, localNotifyDirPath string) (*fsnotify.Watcher, error) {
|
|
// create the notify dir (if not already)
|
|
err := os.MkdirAll(localNotifyDirPath, os.ModePerm)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to create a notify dir: %w", err)
|
|
}
|
|
|
|
watcher, err := fsnotify.NewWatcher()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to init notify dir watcher: %w", err)
|
|
}
|
|
|
|
err = watcher.Add(localNotifyDirPath)
|
|
if err != nil {
|
|
_ = watcher.Close()
|
|
return nil, fmt.Errorf("unable to watch notify dir: %w", err)
|
|
}
|
|
|
|
var debounceTimer *time.Timer
|
|
|
|
stopDebounceTimer := func() {
|
|
if debounceTimer != nil {
|
|
debounceTimer.Stop()
|
|
debounceTimer = nil
|
|
}
|
|
}
|
|
|
|
// watch
|
|
go func() {
|
|
defer stopDebounceTimer()
|
|
|
|
for {
|
|
select {
|
|
case event, ok := <-watcher.Events:
|
|
if !ok {
|
|
return
|
|
}
|
|
|
|
// modified from within the current app instance or cleanup event
|
|
if strings.HasSuffix(event.Name, instanceId) || event.Has(fsnotify.Remove) || !app.IsBootstrapped() {
|
|
continue
|
|
}
|
|
|
|
stopDebounceTimer()
|
|
|
|
debounceTimer = time.AfterFunc(50*time.Millisecond, func() {
|
|
filename := filepath.Base(event.Name)
|
|
|
|
// settings changed
|
|
if strings.HasPrefix(filename, "settings@") {
|
|
app.Logger().Debug("Reloading settings after notify event")
|
|
|
|
err := app.ReloadSettings()
|
|
if err != nil {
|
|
app.Logger().Warn("Failed to reload app settings after notify", "error", err)
|
|
}
|
|
return
|
|
}
|
|
|
|
// collections changed
|
|
if strings.HasPrefix(filename, "collections@") {
|
|
app.Logger().Debug("Reloading cached collections after notify event")
|
|
|
|
err := app.ReloadCachedCollections()
|
|
if err != nil {
|
|
app.Logger().Warn("Failed to reload cached collections after notify", "error", err)
|
|
}
|
|
return
|
|
}
|
|
})
|
|
case err, ok := <-watcher.Errors:
|
|
if app.IsDev() && err != nil {
|
|
color.Red("Notify dir watch error:", err)
|
|
}
|
|
|
|
if !ok {
|
|
return
|
|
}
|
|
}
|
|
}
|
|
}()
|
|
|
|
return watcher, err
|
|
}
|