mirror of
https://github.com/lobehub/lobehub.git
synced 2026-09-20 04:56:13 +08:00
c5ec20abab
* ✨ feat(docker): run self-hosted Compose chats in Gateway Mode by default - Add the lobehub-gateway service to docker-compose and wire the lobe service to it; AGENT_GATEWAY_INTERNAL_URL keeps server pushes on the Compose network while browsers use AGENT_GATEWAY_URL. - S3_INTERNAL_ENDPOINT routes the server's own S3 requests to rustfs:9000 while presigned URLs keep the browser-facing S3_ENDPOINT, which local mode sets to localhost and the container cannot reach. - setup.sh generates a per-deployment JWKS_KEY and gateway token and writes the gateway URL for each deploy mode; the .env template drops the public JWKS key. - Warn loudly at container startup when an upgraded stack lacks the gateway settings or still uses the public example JWKS_KEY, and document the upgrade. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * 🔒 fix(docker): pass only the public JWK to the gateway container The gateway only needs the public half of JWKS_KEY to verify browser sessions, but it received the full private key set, so anyone able to read the gateway environment could sign tokens LobeHub trusts. setup.sh now also writes JWKS_PUBLIC_KEY (the same key without d/p/q/dp/dq/qi), Compose passes only that to the gateway, and the startup check warns when it is missing, still contains private fields, or does not match JWKS_KEY. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
108 lines
3.9 KiB
TypeScript
108 lines
3.9 KiB
TypeScript
import { EventEmitter } from 'node:events';
|
|
import { readFile } from 'node:fs/promises';
|
|
import path from 'node:path';
|
|
import vm from 'node:vm';
|
|
|
|
import { describe, expect, it } from 'vitest';
|
|
|
|
const launcher = path.join(import.meta.dirname, 'startServer.js');
|
|
|
|
/** Exercise the real launcher with child processes replaced by deterministic exits. */
|
|
const launch = async (env: Record<string, string>, failure?: { code: number; script: string }) => {
|
|
const commands: string[][] = [];
|
|
const exits: number[] = [];
|
|
const source = await readFile(launcher, 'utf8');
|
|
const modules: Record<string, unknown> = {
|
|
'node:child_process': {
|
|
spawn: (executable: string, args: string[]) => {
|
|
commands.push([executable, ...args]);
|
|
const child = new EventEmitter();
|
|
queueMicrotask(() => child.emit('close', args[0] === failure?.script ? failure.code : 0));
|
|
return child;
|
|
},
|
|
},
|
|
'node:dns': { promises: { getServers: () => [] } },
|
|
'node:fs': { existsSync: () => true, promises: { access: async () => undefined } },
|
|
'node:path': { join: (...parts: string[]) => parts.join('/') },
|
|
};
|
|
await vm
|
|
.runInNewContext(source, {
|
|
__dirname: '/app',
|
|
console: { error: () => undefined, log: () => undefined, warn: () => undefined },
|
|
process: {
|
|
env,
|
|
exit: (code: number) => {
|
|
exits.push(code);
|
|
throw new Error('launcher exited');
|
|
},
|
|
},
|
|
require: (name: string) =>
|
|
modules[name] ?? { checkDeprecatedAuth: () => undefined, checkGatewayConfig: () => [] },
|
|
})
|
|
.catch((error: Error) => {
|
|
if (error.message !== 'launcher exited') throw error;
|
|
});
|
|
return { commands, exits };
|
|
};
|
|
|
|
describe('Docker startup migrations', () => {
|
|
it('finishes PostgreSQL and Elasticsearch migrations before serving requests', async () => {
|
|
const result = await launch({ DATABASE_DRIVER: 'node', FTS_SEARCH_PROVIDER: 'elasticsearch' });
|
|
expect(result.commands).toEqual([
|
|
['/bin/node', '/app/docker.cjs'],
|
|
['/bin/node', '/app/fts-search-elasticsearch-reindex.cjs', '--startup', '--yes'],
|
|
['/bin/node', '/app/server.js'],
|
|
]);
|
|
expect(result.exits).toEqual([]);
|
|
});
|
|
|
|
it('runs PostgreSQL first for Elasticsearch even without an explicit driver', async () => {
|
|
const result = await launch({ FTS_SEARCH_PROVIDER: 'elasticsearch' });
|
|
expect(result.commands.map((command) => command[1])).toEqual([
|
|
'/app/docker.cjs',
|
|
'/app/fts-search-elasticsearch-reindex.cjs',
|
|
'/app/server.js',
|
|
]);
|
|
});
|
|
|
|
it('supplies the migration telemetry environment when Docker telemetry is enabled', async () => {
|
|
const result = await launch({
|
|
ENABLE_TELEMETRY: '1',
|
|
FTS_SEARCH_PROVIDER: 'elasticsearch',
|
|
OTEL_EXPORTER_OTLP_ENDPOINT: 'http://collector:4318',
|
|
});
|
|
expect(result.commands).toEqual([
|
|
['/bin/node', '/app/docker.cjs'],
|
|
[
|
|
'/bin/node',
|
|
'/app/fts-search-elasticsearch-reindex.cjs',
|
|
'--startup',
|
|
'--yes',
|
|
'--telemetry-environment=production',
|
|
],
|
|
['/bin/node', '/app/server.js'],
|
|
]);
|
|
expect(result.exits).toEqual([]);
|
|
});
|
|
|
|
it('keeps PostgreSQL-only startup free of Elasticsearch operations', async () => {
|
|
const result = await launch({ DATABASE_DRIVER: 'node', FTS_SEARCH_PROVIDER: 'pg_search' });
|
|
expect(result.commands.map((command) => command[1])).toEqual([
|
|
'/app/docker.cjs',
|
|
'/app/server.js',
|
|
]);
|
|
});
|
|
|
|
it.each(['/app/docker.cjs', '/app/fts-search-elasticsearch-reindex.cjs'])(
|
|
'does not serve requests when %s fails',
|
|
async (script) => {
|
|
const result = await launch(
|
|
{ DATABASE_DRIVER: 'node', FTS_SEARCH_PROVIDER: 'elasticsearch' },
|
|
{ code: 1, script },
|
|
);
|
|
expect(result.commands.some((command) => command[1] === '/app/server.js')).toBe(false);
|
|
expect(result.exits).toEqual([1]);
|
|
},
|
|
);
|
|
});
|