Skip to content

Commit 7ad5541

Browse files
bigcat88andrey18106nextcloud-botrakekniven
authored
removed "optional API Scope" support (#220)
* added URL encoding for Docker Container Pull action * added two logs with `info` level for PullImage action * removed "optional API Scope" support * added AppAPI options toggles in Admin settings * added RestartPolicy option to created containers CI fails unrelated: pytest-dev/pytest-asyncio#737 --------- Signed-off-by: Alexander Piskun <[email protected]> Signed-off-by: Andrey Borysenko <[email protected]> Signed-off-by: Nextcloud bot <[email protected]> Co-authored-by: Andrey Borysenko <[email protected]> Co-authored-by: Nextcloud bot <[email protected]> Co-authored-by: rakekniven <[email protected]>
1 parent 1568a92 commit 7ad5541

22 files changed

+488
-252
lines changed

‎.github/workflows/tests-deploy.yml

+7-7
Original file line numberDiff line numberDiff line change
@@ -237,8 +237,8 @@ jobs:
237237
docker network create master_bridge
238238
docker run -v /var/run/docker.sock:/var/run/docker.sock \
239239
-e NC_HAPROXY_PASSWORD="some_secure_password" \
240-
--net master_bridge --name aa-docker-socket-proxy -h aa-docker-socket-proxy \
241-
--privileged -d ghcr.io/cloud-py-api/aa-docker-socket-proxy:latest
240+
--net master_bridge --name nextcloud-appapi-dsp -h nextcloud-appapi-dsp \
241+
--privileged -d ghcr.io/cloud-py-api/nextcloud-appapi-dsp:latest
242242
docker run --net master_bridge --name nextcloud --rm -d ${{ env.docker-image }}
243243
sleep 60s
244244
@@ -249,7 +249,7 @@ jobs:
249249
docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud git checkout FETCH_HEAD
250250
docker exec nextcloud sudo -u www-data php occ app:enable app_api
251251
docker exec nextcloud sudo -u www-data php occ app_api:daemon:register \
252-
docker_by_port Docker docker-install http aa-docker-socket-proxy:2375 http://nextcloud/index.php \
252+
docker_by_port Docker docker-install http nextcloud-appapi-dsp:2375 http://nextcloud/index.php \
253253
--net=master_bridge --haproxy_password=some_secure_password
254254
docker exec nextcloud sudo -u www-data php occ app_api:daemon:list
255255
docker exec nextcloud sudo -u www-data php occ app_api:app:deploy skeleton docker_by_port \
@@ -326,12 +326,12 @@ jobs:
326326
-e NC_HAPROXY_PASSWORD="some_secure_password" \
327327
-e BIND_ADDRESS="172.17.0.1" \
328328
-e EX_APPS_NET_FOR_HTTPS="ipv4@localhost" \
329-
--net host --name aa-docker-socket-proxy -h aa-docker-socket-proxy \
330-
--privileged -d ghcr.io/cloud-py-api/aa-docker-socket-proxy:latest
329+
--net host --name nextcloud-appapi-dsp -h nextcloud-appapi-dsp \
330+
--privileged -d ghcr.io/cloud-py-api/nextcloud-appapi-dsp:latest
331331
docker run --net=bridge --name=nextcloud -p 8080:80 --rm -d ${{ env.docker-image }}
332332
sleep 60s
333333
hostname -I
334-
docker exec aa-docker-socket-proxy ip addr show | grep inet | awk '{print $2}' | cut -d/ -f1
334+
docker exec nextcloud-appapi-dsp ip addr show | grep inet | awk '{print $2}' | cut -d/ -f1
335335
336336
- name: Install AppAPI
337337
run: |
@@ -363,7 +363,7 @@ jobs:
363363
364364
- name: Save HaProxy logs
365365
if: always()
366-
run: docker logs aa-docker-socket-proxy > haproxy.log 2>&1
366+
run: docker logs nextcloud-appapi-dsp > haproxy.log 2>&1
367367

368368
- name: Save container info & logs
369369
if: always()

‎.github/workflows/tests-special.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ jobs:
117117
sleep 5s
118118
php occ app_api:daemon:register manual_install "Manual Install" manual-install http localhost 0
119119
php occ app_api:app:register $APP_ID manual_install --json-info \
120-
"{\"appid\":\"$APP_ID\",\"name\":\"$APP_ID\",\"daemon_config_name\":\"manual_install\",\"version\":\"$APP_VERSION\",\"secret\":\"$APP_SECRET\",\"port\":$APP_PORT,\"scopes\":{\"required\":[\"SYSTEM\", \"NOTIFICATIONS\"],\"optional\":[\"USER_INFO\"]},\"system_app\":1}" \
120+
"{\"appid\":\"$APP_ID\",\"name\":\"$APP_ID\",\"daemon_config_name\":\"manual_install\",\"version\":\"$APP_VERSION\",\"secret\":\"$APP_SECRET\",\"port\":$APP_PORT,\"scopes\":[\"SYSTEM\", \"NOTIFICATIONS\", \"USER_INFO\"],\"system_app\":1}" \
121121
--force-scopes --wait-finish
122122
kill -15 $(cat /tmp/_install.pid)
123123
timeout 3m tail --pid=$(cat /tmp/_install.pid) -f /dev/null
@@ -220,7 +220,7 @@ jobs:
220220
sleep 5s
221221
php occ app_api:daemon:register manual_install "Manual Install" manual-install http localhost 0
222222
php occ app_api:app:register $APP_ID manual_install --json-info \
223-
"{\"appid\":\"$APP_ID\",\"name\":\"$APP_ID\",\"daemon_config_name\":\"manual_install\",\"version\":\"$APP_VERSION\",\"secret\":\"$APP_SECRET\",\"port\":$APP_PORT,\"scopes\":{\"required\":[\"ALL\"],\"optional\":[]},\"system_app\":1}" \
223+
"{\"appid\":\"$APP_ID\",\"name\":\"$APP_ID\",\"daemon_config_name\":\"manual_install\",\"version\":\"$APP_VERSION\",\"secret\":\"$APP_SECRET\",\"port\":$APP_PORT,\"scopes\":[\"ALL\"],\"system_app\":1}" \
224224
--force-scopes --wait-finish
225225
kill -15 $(cat /tmp/_install.pid)
226226
timeout 3m tail --pid=$(cat /tmp/_install.pid) -f /dev/null
@@ -238,7 +238,7 @@ jobs:
238238
echo $! > /tmp/_install.pid
239239
sleep 5s
240240
php occ app_api:app:register $APP_ID manual_install --json-info \
241-
"{\"appid\":\"$APP_ID\",\"name\":\"$APP_ID\",\"daemon_config_name\":\"manual_install\",\"version\":\"$APP_VERSION\",\"secret\":\"$APP_SECRET\",\"port\":$APP_PORT,\"scopes\":{\"required\":[\"SYSTEM\"],\"optional\":[]},\"system_app\":1}" \
241+
"{\"appid\":\"$APP_ID\",\"name\":\"$APP_ID\",\"daemon_config_name\":\"manual_install\",\"version\":\"$APP_VERSION\",\"secret\":\"$APP_SECRET\",\"port\":$APP_PORT,\"scopes\":[\"SYSTEM\"],\"system_app\":1}" \
242242
--force-scopes --wait-finish
243243
kill -15 $(cat /tmp/_install.pid)
244244
timeout 3m tail --pid=$(cat /tmp/_install.pid) -f /dev/null
@@ -253,7 +253,7 @@ jobs:
253253
echo $! > /tmp/_install.pid
254254
sleep 5s
255255
php occ app_api:app:register $APP_ID manual_install --json-info \
256-
"{\"appid\":\"$APP_ID\",\"name\":\"$APP_ID\",\"daemon_config_name\":\"manual_install\",\"version\":\"$APP_VERSION\",\"secret\":\"$APP_SECRET\",\"port\":$APP_PORT,\"scopes\":{\"required\":[\"ALL\"],\"optional\":[]},\"system_app\":0}" \
256+
"{\"appid\":\"$APP_ID\",\"name\":\"$APP_ID\",\"daemon_config_name\":\"manual_install\",\"version\":\"$APP_VERSION\",\"secret\":\"$APP_SECRET\",\"port\":$APP_PORT,\"scopes\":[\"ALL\"],\"system_app\":0}" \
257257
--force-scopes --wait-finish
258258
kill -15 $(cat /tmp/_install.pid)
259259
timeout 3m tail --pid=$(cat /tmp/_install.pid) -f /dev/null

‎CHANGELOG.md

+11
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
77

88
## [Unreleased]
99

10+
## [2.0.3 - 2024-02-01]
11+
12+
### Added
13+
14+
- Added RestartPolicy option (Admin settings) #220
15+
- Added ExApp init timeout option (Admin settings) #220
16+
17+
### Changed
18+
19+
- Removed support of `Optional` API scopes. #220
20+
1021
## [2.0.2 - 2024-01-28]
1122

1223
### Fixed

‎appinfo/info.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ to join us in shaping a more versatile, stable, and secure app landscape.
4242
*Your insights, suggestions, and contributions are invaluable to us.*
4343
4444
]]></description>
45-
<version>2.0.2</version>
45+
<version>2.0.3</version>
4646
<licence>agpl</licence>
4747
<author mail="[email protected]" homepage="https://github.com/andrey18106">Andrey Borysenko</author>
4848
<author mail="[email protected]" homepage="https://github.com/bigcat88">Alexander Piskun</author>

‎docs/Concepts.rst

+1-3
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,7 @@ Concepts
44
API Access Control Mechanism
55
----------------------------
66

7-
Each application defines required and an optional list of API groups it intends to access.
8-
9-
Administrators can permit or deny an application's access to any API from the **optional** list.
7+
Each application defines list of API groups it intends to access.
108

119
This system easily allows you to increase the level of trust in applications.
1210
Even prior to installation, it's possible to ascertain the API groups to which an application will gain access.

‎docs/DeployConfigurations.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ Suggested way to communicate with Docker: via ``docker-socket-proxy``.
195195
class ExApp3 python
196196

197197
Suggested config values(template *Docker Socket Proxy*):
198-
1. Daemon host: aa-docker-socket-proxy:2375
198+
1. Daemon host: nextcloud-appapi-dsp:2375
199199
2. HTTPS checkbox: ``disabled``
200200
3. Network: `user defined network <https://docs.docker.com/network/#user-defined-networks>`_
201201
4. HaProxy password: ``optional``

‎docs/tech_details/Deployment.rst

+9-63
Original file line numberDiff line numberDiff line change
@@ -27,59 +27,24 @@ This can be done by ``occ`` CLI command **app_api:daemon:register**:
2727

2828
.. code-block:: bash
2929
30-
app_api:daemon:register <name> <display-name> <accepts-deploy-id> <protocol> <host> <nextcloud_url> [--net NET] [--host HOST] [--ssl_key SSL_KEY] [--ssl_key_password SSL_KEY_PASSWORD] [--ssl_cert SSL_CERT] [--ssl_cert_password SSL_CERT_PASSWORD] [--]
30+
app_api:daemon:register <name> <display-name> <accepts-deploy-id> <protocol> <host> <nextcloud_url> [--net NET] [--haproxy_password PASSWORD] [--]
3131
3232
Arguments
3333
*********
3434

3535
* ``name`` - unique name of the daemon (e.g. ``docker_local_sock``)
3636
* ``display-name`` - name of the daemon (e.g. ``My Local Docker``, will be displayed in the UI)
3737
* ``accepts-deploy-id`` - type of deployment (``docker-install`` or ``manual-install``)
38-
* ``protocol`` - protocol used to connect to the daemon (``unix-socket``, ``http`` or ``https``)
39-
* ``host`` - host of the daemon (e.g. ``/var/run/docker.sock`` for ``unix-socket`` protocol or ``host:port`` for ``http(s)`` protocol)
38+
* ``protocol`` - protocol used to connect to the daemon (``http`` or ``https``)
39+
* ``host`` - host of the daemon (e.g. ``/var/run/docker.sock`` or ``host:port``)
4040
* ``nextcloud_url`` - Nextcloud URL, Daemon config required option (e.g. ``https://nextcloud.local``)
41-
* ``--gpu`` - ``[optional]`` GPU device to expose to the daemon (e.g. ``/dev/dri``)
4241

4342
Options
4443
*******
4544

4645
* ``--net [network-name]`` - ``[required]`` network name to bind docker container to (default: ``host``)
47-
* ``--hostname HOST`` - ``[required]`` host to expose daemon to (defaults to ExApp appid)
48-
* ``--ssl_key SSL_KEY`` - ``[optional]`` path to SSL key file (local absolute path)
49-
* ``--ssl_password SSL_PASSWORD`` - ``[optional]`` SSL key password
50-
* ``--ssl_cert SSL_CERT`` - ``[optional]`` path to SSL cert file (local absolute path)
51-
* ``--ssl_cert_password SSL_CERT_PASSWORD`` - ``[optional]`` SSL cert password
52-
53-
DeployConfig
54-
************
55-
56-
DeployConfig is a set of additional options in Daemon config, which are used in deployment algorithms to configure
57-
ExApp container.
58-
59-
.. code-block:: json
60-
61-
{
62-
"net": "nextcloud",
63-
"host": null,
64-
"nextcloud_url": "https://nextcloud.local",
65-
"ssl_key": "/path/to/ssl/key.pem",
66-
"ssl_key_password": "ssl_key_password",
67-
"ssl_cert": "/path/to/ssl/cert.pem",
68-
"ssl_cert_password": "ssl_cert_password",
69-
"gpus": ["/dev/dri"],
70-
}
71-
72-
73-
DeployConfig options
74-
""""""""""""""""""""
75-
76-
* ``net`` **[required]** - network name to bind docker container to (default: ``host``)
77-
* ``host`` *[optional]* - in case Docker is on remote host, this should be a hostname of remote machine
78-
* ``nextcloud_url`` **[required]** - Nextcloud URL (e.g. ``https://nextcloud.local``)
79-
* ``ssl_key`` *[optional]* - path to SSL key file (local absolute path)
80-
* ``ssl_key_password`` *[optional]* - SSL key password
81-
* ``ssl_cert`` *[optional]* - path to SSL cert file (local absolute path)
82-
* ``ssl_cert_password`` *[optional]* - SSL cert password
46+
* ``--haproxy_password PASSWORD`` - ``[optional]`` password if ``AppAPI Docker Socket Proxy`` is used
47+
* ``--gpu`` - ``[optional]`` GPU device to expose to the daemon (e.g. ``/dev/dri``)
8348

8449
.. note::
8550
Common configurations are tested by CI in our repository, see `workflows on github <https://github.com/cloud-py-api/app_api/blob/main/.github/workflows/tests-deploy.yml>`_.
@@ -91,7 +56,7 @@ Example of ``occ`` **app_api:daemon:register** command:
9156

9257
.. code-block:: bash
9358
94-
sudo -u www-data php occ app_api:daemon:register docker_local_sock "My Local Docker" docker-install unix-socket /var/run/docker.sock "https://nextcloud.local" --net nextcloud
59+
sudo -u www-data php occ app_api:daemon:register docker_local_sock "My Local Docker" docker-install http /var/run/docker.sock "https://nextcloud.local" --net nextcloud
9560
9661
9762
ExApp deployment
@@ -156,7 +121,7 @@ For all examples and applications we release we usually add manual_install comma
156121
.. code-block::
157122
158123
php occ app_api:app:register nc_py_api manual_install --json-info \
159-
"{\"appid\":\"nc_py_api\",\"name\":\"nc_py_api\",\"daemon_config_name\":\"manual_install\",\"version\":\"1.0.0\",\"secret\":\"12345\",\"host\":\"localhost\",\"port\":$APP_PORT,\"scopes\":{\"required\":[\"SYSTEM\", \"FILES\", \"FILES_SHARING\"],\"optional\":[\"USER_INFO\", \"USER_STATUS\", \"NOTIFICATIONS\", \"WEATHER_STATUS\", \"TALK\"]},\"protocol\":\"http\",\"system_app\":1}" \
124+
"{\"appid\":\"nc_py_api\",\"name\":\"nc_py_api\",\"daemon_config_name\":\"manual_install\",\"version\":\"1.0.0\",\"secret\":\"12345\",\"port\":$APP_PORT,\"scopes\":[\"SYSTEM\", \"FILES\", \"FILES_SHARING\", \"USER_INFO\", \"USER_STATUS\", \"NOTIFICATIONS\", \"WEATHER_STATUS\", \"TALK\"],\"system_app\":1}" \
160125
--force-scopes
161126
162127
.. note:: **Deployment/Startup of App should be done by developer when manual_install DeployConfig type is used.**
@@ -172,7 +137,6 @@ The following env variables are required and built automatically:
172137
* ``APP_ID`` - ExApp appid
173138
* ``APP_DISPLAY_NAME`` - ExApp display name
174139
* ``APP_VERSION`` - ExApp version
175-
* ``APP_PROTOCOL`` - protocol ExApp is listening on (http|https)
176140
* ``APP_HOST`` - host ExApp is listening on
177141
* ``APP_PORT`` - port ExApp is listening on (randomly selected by AppAPI)
178142
* ``APP_PERSISTENT_STORAGE`` - path to mounted volume for persistent data storage between ExApp updates
@@ -182,19 +146,6 @@ The following env variables are required and built automatically:
182146
.. note::
183147
Additional envs can be passed using multiple ``--env ENV_NAME=ENV_VAL`` options
184148

185-
Docker daemon remote
186-
********************
187-
188-
If you want to connect to remote docker daemon with TLS enabled, you need to provide SSL key and cert by provided options.
189-
Important: before deploy you need to import ca.pem file using `occ security <https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html#security>`_ command:
190-
191-
``php occ security:certificates:import /path/to/ca.pem``
192-
193-
The daemon must be configured with ``protocol=http|https``, ``host=https://dockerapihost``, ``port=8443``.
194-
DaemonConfig deploy options ``ssl_key`` and ``ssl_cert`` must be provided with local absolute paths to SSL key and cert files.
195-
In case of password protected key or cert, you can provide ``ssl_key_password`` and ``ssl_cert_password`` options.
196-
More info about how to configure daemon will be added soon.
197-
198149
ExApp registration
199150
------------------
200151

@@ -250,14 +201,9 @@ It has the same structure as Nextcloud appinfo/info.xml file, but with some addi
250201
<image-tag>latest</image-tag>
251202
</docker-install>
252203
<scopes>
253-
<required>
254-
<value>TALK</value>
255-
<value>TALK_BOT</value>
256-
</required>
257-
<optional>
258-
</optional>
204+
<value>TALK</value>
205+
<value>TALK_BOT</value>
259206
</scopes>
260-
<protocol>http</protocol>
261207
<system>0</system>
262208
</ex-app>
263209
...

‎lib/BackgroundJob/ExAppInitStatusCheckJob.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,11 @@ public function __construct(
2727
}
2828

2929
protected function run($argument): void {
30-
// Iterate over all ExApp and check for status.init_start_time if it is older than ex_app_init_timeout minutes
30+
// Iterate over all ExApp and check for status.init_start_time if it is older than init_timeout minutes
3131
// set status.progress=0 and status.error message with timeout error
3232
try {
3333
$exApps = $this->mapper->findAll();
34-
$initTimeoutMinutes = intval($this->config->getAppValue(Application::APP_ID, 'ex_app_init_timeout', '40'));
34+
$initTimeoutMinutes = intval($this->config->getAppValue(Application::APP_ID, 'init_timeout', '40'));
3535
foreach ($exApps as $exApp) {
3636
$status = $exApp->getStatus();
3737
if (!isset($status['init_start_time'])) {

‎lib/Capabilities.php

+2-22
Original file line numberDiff line numberDiff line change
@@ -5,23 +5,16 @@
55
namespace OCA\AppAPI;
66

77
use OCA\AppAPI\AppInfo\Application;
8-
use OCA\AppAPI\Db\ExAppScope;
9-
use OCA\AppAPI\Service\ExAppScopesService;
10-
use OCA\AppAPI\Service\ExAppService;
118
use OCA\AppAPI\Service\ProvidersAI\TextProcessingService;
129
use OCP\App\IAppManager;
1310
use OCP\Capabilities\ICapability;
1411
use OCP\IConfig;
15-
use OCP\IRequest;
1612

1713
class Capabilities implements ICapability {
1814

1915
public function __construct(
20-
private IConfig $config,
21-
private IAppManager $appManager,
22-
private ExAppService $service,
23-
private ExAppScopesService $exAppScopesService,
24-
private IRequest $request,
16+
private readonly IConfig $config,
17+
private readonly IAppManager $appManager,
2518
) {
2619
}
2720

@@ -33,21 +26,8 @@ public function getCapabilities(): array {
3326
'task_types' => array_keys(TextProcessingService::TASK_TYPES),
3427
]
3528
];
36-
$this->attachExAppScopes($capabilities);
3729
return [
3830
'app_api' => $capabilities,
3931
];
4032
}
41-
42-
private function attachExAppScopes(&$capabilities): void {
43-
$appId = $this->request->getHeader('EX-APP-ID');
44-
if ($appId !== '') {
45-
$exApp = $this->service->getExApp($appId);
46-
if ($exApp !== null) {
47-
$capabilities['scopes'] = array_map(function (ExAppScope $scope) {
48-
return intval($scope->getScopeGroup());
49-
}, $this->exAppScopesService->getExAppScopes($exApp));
50-
}
51-
}
52-
}
5333
}

‎lib/Command/ExApp/Deploy.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int
101101
$daemonConfig->getProtocol(),
102102
$daemonConfig->getHost(),
103103
$daemonConfig->getDeployConfig(),
104-
(int)explode('=', $deployParams['container_params']['env'][7])[1],
104+
(int)explode('=', $deployParams['container_params']['env'][6])[1],
105105
$auth,
106106
);
107107
if (!$this->service->heartbeatExApp($exAppUrl, $auth)) {

0 commit comments

Comments
 (0)