|
| 1 | +<!-- version-type: minor --> |
| 2 | +# service |
| 3 | + |
| 4 | +## ✨ Features |
| 5 | + |
| 6 | +### Process Manager |
| 7 | + |
| 8 | +Added `ProcessManager` to orchestrate service lifecycle (clone, install, build, run, pull, setup, update) with child process management, `ServiceStateHistory` audit trail, and batched log forwarding to `LogStorageService`. Automatically reconciles stale states on startup. |
| 9 | + |
| 10 | +### Git Integration |
| 11 | + |
| 12 | +- `GitService` — wrapper for git operations: clone, fetch, pull, list branches, current branch, commits behind remote, and checkout |
| 13 | +- `GitWatcher` — periodic remote fetch (default 5 min) per service with auto-fetch toggle; updates `ServiceGitStatus` and service status when remotes change |
| 14 | +- `GitHeadWatcher` — monitors `.git/HEAD` for branch switches and updates branch/behind counts in `ServiceGitStatus` |
| 15 | + |
| 16 | +### MCP Server |
| 17 | + |
| 18 | +Exposed a Model Context Protocol server (Streamable HTTP on port 9091) with bearer token authentication and tools for: |
| 19 | + |
| 20 | +- `stack-tools` — list, get, create, update, delete, export, import, and setup stacks |
| 21 | +- `service-tools` — list, create, edit, delete services; start/stop/restart/install/build/pull/setup/update lifecycle; get logs and state history |
| 22 | +- `prerequisite-tools` — list, check, create, update, and delete prerequisites |
| 23 | +- `repository-tools` — list, get, create, update, delete, and validate repositories |
| 24 | +- `env-variable-tools` — set/remove stack env variables and service env overrides |
| 25 | +- `service-file-tools` — manage shared and local encrypted service files (list/read/add/update/remove/apply) |
| 26 | +- `system-tools` — check environment variable availability |
| 27 | + |
| 28 | +### Security |
| 29 | + |
| 30 | +- `CryptoService` with AES-256-GCM encryption for sensitive environment variables and service files, keyed from `STACK_CRAFT_ENCRYPTION_KEY` or auto-generated `~/.stack-craft/encryption.key` |
| 31 | +- `SecretDetector` with heuristic scanning for secrets in commands and file content |
| 32 | +- Bearer API token authentication (`BearerTokenAuth`) with SHA-256 hashed storage; plaintext returned only at creation time |
| 33 | +- Sensitive data masking on REST responses for environment variables and service files |
| 34 | +- Startup migration (`encryptExistingSecrets`) to encrypt pre-existing plaintext secrets in the database |
| 35 | + |
| 36 | +### Prerequisite Evaluation |
| 37 | + |
| 38 | +Prerequisite check system supporting Node.js version, Yarn version, .NET SDK version, NuGet feed availability, environment variable presence, and custom script execution. Evaluates all prerequisites in the background after startup. |
| 39 | + |
| 40 | +### Stack Import/Export |
| 41 | + |
| 42 | +- `exportStackAction` — serializes a stack with its services, repositories, and prerequisites to JSON |
| 43 | +- `importStackAction` — imports a stack from JSON with environment variable remapping, deduplication, and conflict resolution |
| 44 | + |
| 45 | +### WebSocket Entity Sync |
| 46 | + |
| 47 | +Real-time entity synchronization via WebSocket at `/api/ws` using `SyncSubscribeAction` / `SyncUnsubscribeAction` for live frontend updates. |
| 48 | + |
| 49 | +### Additional REST Endpoints |
| 50 | + |
| 51 | +- Password reset flow via `/api/identity/password-reset` |
| 52 | +- `LogStorageService` for per-service log persistence, query, and pruning |
| 53 | +- Repository URL validation via `git ls-remote` |
| 54 | +- Environment variable availability check at `/api/system/check-env-availability` |
| 55 | +- Service file application to disk via `/api/services/:id/apply-files` |
| 56 | + |
| 57 | +## ♻️ Refactoring |
| 58 | + |
| 59 | +### PostgreSQL Migration |
| 60 | + |
| 61 | +Migrated from `@furystack/filesystem-store` (file-backed JSON) to PostgreSQL via `@furystack/sequelize-store` with Sequelize models and JSONB columns for flexible fields. In-memory stores retained for transient data (`ServiceGitStatus`, `PrerequisiteCheckResult`, sessions, log entries). |
| 62 | + |
| 63 | +### REST API Reorganization |
| 64 | + |
| 65 | +Restructured the REST API into domain-specific modules: identity, install, stacks, services, github-repositories, prerequisites, tokens, and system — each with dedicated setup, actions, and authorization. |
| 66 | + |
| 67 | +### Seed Removal |
| 68 | + |
| 69 | +Replaced the `seed.ts` script with an installer flow triggered from the frontend on first run. |
| 70 | + |
| 71 | +## 🧪 Tests |
| 72 | + |
| 73 | +- `ProcessManager` — lifecycle orchestration, state transitions, log batching, stale state reconciliation |
| 74 | +- `GitService` — clone, fetch, pull, branches, current branch, commits behind, checkout |
| 75 | +- `CryptoService` — encrypt/decrypt round-trip, key generation, tamper detection |
| 76 | +- `env-encryption-helpers` — encrypt/mask/decrypt for stack and service payloads, `UNCHANGED_SENTINEL` handling |
| 77 | +- `secret-detector` — heuristic pattern matching for secrets in commands and file content |
| 78 | +- `apply-service-files` — merge and write service file definitions to disk |
| 79 | +- `check-prerequisite-action` — all prerequisite types and edge cases |
| 80 | +- `service-branches-action` / `service-checkout-action` — branch listing and checkout flows |
| 81 | +- `service-lifecycle-action` — lifecycle action dispatching |
| 82 | +- `import-export-actions` — stack export/import with remapping and deduplication |
| 83 | +- `setup-tokens-rest-api` — token CRUD with hashed storage |
| 84 | +- `bearer-token-auth` — token resolution and user loading |
| 85 | +- `service-installer` — installation flow |
| 86 | +- `config` / `get-cors-options` / `get-port` — configuration resolution |
| 87 | + |
| 88 | +## ⬆️ Dependencies |
| 89 | + |
| 90 | +- Added `sequelize`, `pg`, `pg-hstore`, `@furystack/sequelize-store` for PostgreSQL support |
| 91 | +- Removed `@furystack/filesystem-store` |
0 commit comments