e93c1159b4
Security (must-fix):
- /git smart-HTTP gate: an authenticated NON-member of a git-sync space now gets
404 (not 403), so the 403<->404 difference can no longer be used to brute-force
which spaces exist / have git-sync enabled. 403 is reserved for a MEMBER who
lacks the required role (existence already known). New gate input
userIsSpaceMember; decision-table + service specs extended.
Config (must-fix):
- Remove the dead GIT_SYNC_SSH_KEY_PATH knob (getter + validation field + two
.env.example lines) — it had zero consumers and advertised a nonexistent push
capability.
Stability/docs (warnings):
- Wire the lost-lock AbortSignal into runReceivePack -> git http-backend so the
receive-pack child is killed if the per-space lock lapses mid-write.
- Raise the divergent-`docmost` (invariant §5) push refusal from info -> warn and
surface divergentDocmost in the run status (/status).
- Comment the stale read-after-debounced-collab-write updatedAt in
importPageMarkdown (deferred §10 loop-guard must not trust it).
- Fix the Dockerfile comment: the loader uses require.resolve + dynamic import(),
it deliberately does NOT require('@docmost/git-sync').
- Merge the two near-identical space toggle handlers into one parameterized
handler; add the 2 missing en-US i18n keys for the auto-merge switch (ru-RU not
maintained for these git-sync strings, mirrored).
Tests:
- isGitSyncHttpEnabled() default-branch (unset -> isGitSyncEnabled fallback).
- agentSourceFields 'git-sync' case (source stamped, chat key omitted).
- editor-ext name-level schema contract (vendored mirror superset of editor-ext
node/mark types) + the new shared resolver + non-member 404 gate cases.
Architecture:
- Extract resolveRequestWorkspace shared by DomainMiddleware + GitHttpService
(the two real self-hosted/cloud copies; McpService has no cloud branch).
- Document the in-process setInterval multi-replica limitation + BullMQ/fencing
future direction (deferred, not implemented).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
72 lines
2.4 KiB
Docker
72 lines
2.4 KiB
Docker
FROM node:22-slim AS base
|
|
LABEL org.opencontainers.image.source="https://github.com/vvzvlad/gitmost"
|
|
|
|
RUN npm install -g pnpm@10.4.0
|
|
|
|
FROM base AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
COPY . .
|
|
|
|
RUN pnpm install --frozen-lockfile
|
|
# Version string shown in the UI (computed outside Docker because .git is not in the build context).
|
|
ARG APP_VERSION=""
|
|
ENV APP_VERSION=$APP_VERSION
|
|
RUN pnpm build
|
|
|
|
FROM base AS installer
|
|
|
|
# git: required by the git-sync VaultGit (shells out to git)
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl bash git \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
# Agent-roles catalog base URL: per-branch default set at build time (CI);
|
|
# overridable at runtime via the AI_AGENT_ROLES_CATALOG_URL env var.
|
|
ARG AI_AGENT_ROLES_CATALOG_URL=""
|
|
ENV AI_AGENT_ROLES_CATALOG_URL=$AI_AGENT_ROLES_CATALOG_URL
|
|
|
|
# Copy apps
|
|
COPY --from=builder /app/apps/server/dist /app/apps/server/dist
|
|
COPY --from=builder /app/apps/client/dist /app/apps/client/dist
|
|
COPY --from=builder /app/apps/server/package.json /app/apps/server/package.json
|
|
|
|
# Copy packages
|
|
COPY --from=builder /app/packages/editor-ext/dist /app/packages/editor-ext/dist
|
|
COPY --from=builder /app/packages/editor-ext/package.json /app/packages/editor-ext/package.json
|
|
COPY --from=builder /app/packages/mcp/build /app/packages/mcp/build
|
|
COPY --from=builder /app/packages/mcp/package.json /app/packages/mcp/package.json
|
|
# git-sync: the server loads @docmost/git-sync at runtime via the loader
|
|
# (git-sync.loader.ts), which deliberately does NOT `require()` it — the package is
|
|
# ESM-only, so the loader uses `require.resolve` + a dynamic `import()`. Without
|
|
# these copied build artifacts that resolve/import fails and the server crashes on
|
|
# first use. Built fresh by the builder's `pnpm build` (nx builds the package's tsc
|
|
# `build` target).
|
|
COPY --from=builder /app/packages/git-sync/build /app/packages/git-sync/build
|
|
COPY --from=builder /app/packages/git-sync/package.json /app/packages/git-sync/package.json
|
|
|
|
# Copy root package files
|
|
COPY --from=builder /app/package.json /app/package.json
|
|
COPY --from=builder /app/pnpm*.yaml /app/
|
|
COPY --from=builder /app/.npmrc /app/.npmrc
|
|
|
|
# Copy patches
|
|
COPY --from=builder /app/patches /app/patches
|
|
|
|
RUN chown -R node:node /app
|
|
|
|
USER node
|
|
|
|
RUN pnpm install --frozen-lockfile --prod
|
|
|
|
RUN mkdir -p /app/data/storage
|
|
|
|
VOLUME ["/app/data/storage"]
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["pnpm", "start"]
|