135 lines
14 KiB
YAML
135 lines
14 KiB
YAML
name: F4 one-shot final review fixes
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- feature/f4-backend-saneamiento-documental
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
patch:
|
|
if: github.actor != 'github-actions[bot]'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: feature/f4-backend-saneamiento-documental
|
|
|
|
- name: Apply final audited F4 corrections
|
|
run: |
|
|
python - <<'PY'
|
|
from pathlib import Path
|
|
|
|
def replace_once(path: str, old: str, new: str) -> None:
|
|
file = Path(path)
|
|
text = file.read_text()
|
|
count = text.count(old)
|
|
if count != 1:
|
|
raise SystemExit(f"{path}: expected exactly one match, got {count}")
|
|
file.write_text(text.replace(old, new))
|
|
|
|
workflow = 'api-v3/src/inspection-reports/inspection-report-workflow.service.ts'
|
|
replace_once(
|
|
workflow,
|
|
"import { mkdir, unlink, writeFile } from 'node:fs/promises';",
|
|
"import { mkdir, readFile, stat, unlink, writeFile } from 'node:fs/promises';",
|
|
)
|
|
replace_once(
|
|
workflow,
|
|
""" ConflictException,\n Injectable,\n NotFoundException,\n""",
|
|
""" ConflictException,\n Injectable,\n InternalServerErrorException,\n NotFoundException,\n""",
|
|
)
|
|
replace_once(
|
|
workflow,
|
|
"?? '/app/storage/inspection-reports';",
|
|
"?? '/app/storage/asset-media/inspection-reports';",
|
|
)
|
|
replace_once(
|
|
workflow,
|
|
""" await manager.query(`\n UPDATE inspection_reports\n SET executive_summary=$2,\n report_description=$3,\n updated_at=CURRENT_TIMESTAMP\n WHERE id=$1\n `, [reportId, executiveSummary, reportDescription]);\n""",
|
|
""" await manager.query(`\n UPDATE inspection_reports\n SET executive_summary=$2,\n report_description=$3,\n word_status=CASE\n WHEN executive_summary IS DISTINCT FROM $2 OR report_description IS DISTINCT FROM $3\n THEN 'PENDING' ELSE word_status END,\n word_original_name=CASE\n WHEN executive_summary IS DISTINCT FROM $2 OR report_description IS DISTINCT FROM $3\n THEN NULL ELSE word_original_name END,\n word_stored_name=CASE\n WHEN executive_summary IS DISTINCT FROM $2 OR report_description IS DISTINCT FROM $3\n THEN NULL ELSE word_stored_name END,\n word_mime_type=CASE\n WHEN executive_summary IS DISTINCT FROM $2 OR report_description IS DISTINCT FROM $3\n THEN NULL ELSE word_mime_type END,\n word_size_bytes=CASE\n WHEN executive_summary IS DISTINCT FROM $2 OR report_description IS DISTINCT FROM $3\n THEN NULL ELSE word_size_bytes END,\n word_sha256=CASE\n WHEN executive_summary IS DISTINCT FROM $2 OR report_description IS DISTINCT FROM $3\n THEN NULL ELSE word_sha256 END,\n word_generated_at=CASE\n WHEN executive_summary IS DISTINCT FROM $2 OR report_description IS DISTINCT FROM $3\n THEN NULL ELSE word_generated_at END,\n word_error=CASE\n WHEN executive_summary IS DISTINCT FROM $2 OR report_description IS DISTINCT FROM $3\n THEN NULL ELSE word_error END,\n updated_at=CURRENT_TIMESTAMP\n WHERE id=$1\n `, [reportId, executiveSummary, reportDescription]);\n""",
|
|
)
|
|
replace_once(
|
|
workflow,
|
|
""" async addFollowUp(\n""",
|
|
""" async officialPdfContent(reportId: string): Promise<{ filePath: string; originalName: string; mimeType: string }> {\n const [row] = await this.dataSource.query(`\n SELECT\n gedo_pdf_original_name AS \"originalName\",\n gedo_pdf_stored_name AS \"storedName\",\n gedo_pdf_mime_type AS \"mimeType\",\n gedo_pdf_size_bytes::integer AS \"sizeBytes\",\n gedo_pdf_sha256 AS sha256\n FROM inspection_reports\n WHERE id=$1\n `, [reportId]) as Array<{\n originalName: string | null;\n storedName: string | null;\n mimeType: string | null;\n sizeBytes: number | null;\n sha256: string | null;\n }>;\n if (!row) throw reportNotFound();\n if (!row.originalName || !row.storedName || !row.sizeBytes || !row.sha256) {\n throw new NotFoundException({\n code: 'INSPECTION_REPORT_GEDO_PDF_NOT_AVAILABLE',\n message: 'El PDF oficial de GEDO todavía no está disponible',\n });\n }\n const filePath = resolve(this.root, row.storedName);\n if (filePath === this.root || !filePath.startsWith(`${this.root}/`)) throw this.reportStorageError();\n const fileStat = await stat(filePath).catch(() => null);\n if (!fileStat?.isFile() || fileStat.size !== row.sizeBytes) throw this.reportStorageError();\n const buffer = await readFile(filePath);\n const sha256 = createHash('sha256').update(buffer).digest('hex');\n if (sha256 !== row.sha256) throw this.reportStorageError();\n return {\n filePath,\n originalName: row.originalName,\n mimeType: row.mimeType ?? 'application/pdf',\n };\n }\n\n async addFollowUp(\n""",
|
|
)
|
|
replace_once(
|
|
workflow,
|
|
""" private assertPdf(file: UploadedInspectionReportFile | undefined): void {\n""",
|
|
""" private reportStorageError(): InternalServerErrorException {\n return new InternalServerErrorException({\n code: 'INSPECTION_REPORT_GEDO_PDF_STORAGE_ERROR',\n message: 'El PDF oficial de GEDO no está disponible o no supera la validación de integridad',\n });\n }\n\n private assertPdf(file: UploadedInspectionReportFile | undefined): void {\n""",
|
|
)
|
|
|
|
word = 'api-v3/src/inspection-reports/inspection-report-word.service.ts'
|
|
replace_once(
|
|
word,
|
|
"const storedName = `${row.id}.docx`;",
|
|
"const storedName = `${row.id}-${built.sha256.slice(0, 16)}.docx`;",
|
|
)
|
|
|
|
compose = 'docker-compose.yml'
|
|
replace_once(
|
|
compose,
|
|
""" INSPECTION_REPORT_WORD_ROOT: /app/storage/asset-media/inspection-reports-word\n""",
|
|
""" INSPECTION_REPORT_UPLOAD_ROOT: /app/storage/asset-media/inspection-reports\n INSPECTION_REPORT_WORD_ROOT: /app/storage/asset-media/inspection-reports-word\n""",
|
|
)
|
|
|
|
controller = 'api-v3/src/inspection-reports/inspection-reports.controller.ts'
|
|
replace_once(
|
|
controller,
|
|
""" @Patch(':id')\n""",
|
|
""" @Get(':id/gedo-pdf')\n @RequirePermissions('inspection_reports.read')\n async gedoPdfContent(\n @Param('id', new ParseUUIDPipe({ version: '4' })) id: string,\n @Res() response: Response,\n ) {\n const content = await this.workflow.officialPdfContent(id);\n response.setHeader('Content-Type', content.mimeType);\n response.setHeader('Content-Disposition', `attachment; filename=\"${content.originalName.replaceAll('\\\"', '')}\"`);\n return response.sendFile(content.filePath);\n }\n\n @Patch(':id')\n""",
|
|
)
|
|
|
|
web_api = 'web-v2/src/lib/reportWorkflowApi.ts'
|
|
replace_once(
|
|
web_api,
|
|
"""export function inspectionReportWordDownloadUrl(id: string) {\n return `/api/v3/inspection-reports/${id}/word`;\n}\n""",
|
|
"""export function inspectionReportWordDownloadUrl(id: string) {\n return `/api/v3/inspection-reports/${id}/word`;\n}\n\nexport function inspectionReportGedoPdfDownloadUrl(id: string) {\n return `/api/v3/inspection-reports/${id}/gedo-pdf`;\n}\n""",
|
|
)
|
|
|
|
page = 'web-v2/src/pages/ReportDetailPage.tsx'
|
|
replace_once(
|
|
page,
|
|
""" getInspectionReportF4,\n inspectionReportWordDownloadUrl,\n""",
|
|
""" getInspectionReportF4,\n inspectionReportGedoPdfDownloadUrl,\n inspectionReportWordDownloadUrl,\n""",
|
|
)
|
|
replace_once(
|
|
page,
|
|
""" {report.gedoPdfSha256 && <div className=\"temporal-notice\"><Icon name=\"check\" /><p><strong>PDF GEDO fijado.</strong> SHA-256: <code>{report.gedoPdfSha256}</code></p></div>}\n""",
|
|
""" {report.gedoPdfOriginalName && <div className=\"form-actions\"><a className=\"button secondary\" href={inspectionReportGedoPdfDownloadUrl(report.id)}>Descargar PDF oficial</a></div>}\n {report.gedoPdfSha256 && <div className=\"temporal-notice\"><Icon name=\"check\" /><p><strong>PDF GEDO fijado.</strong> SHA-256: <code>{report.gedoPdfSha256}</code></p></div>}\n""",
|
|
)
|
|
|
|
migration = Path('api-v3/src/database/migrations/1790000700000-f4-align-asset-version-function-change.ts')
|
|
if migration.exists():
|
|
raise SystemExit(f'{migration}: file already exists')
|
|
migration.write_text("""import { MigrationInterface, QueryRunner } from 'typeorm';\n\nexport class F4AlignAssetVersionFunctionChange1790000700000 implements MigrationInterface {\n name = 'F4AlignAssetVersionFunctionChange1790000700000';\n\n public async up(queryRunner: QueryRunner): Promise<void> {\n await queryRunner.query(`\n ALTER TABLE asset_versions\n DROP CONSTRAINT IF EXISTS chk_asset_versions_change_type\n `);\n await queryRunner.query(`\n ALTER TABLE asset_versions\n ADD CONSTRAINT chk_asset_versions_change_type CHECK (change_type IN (\n 'BASELINE', 'CREATED', 'UPDATED', 'CONTEXT_CHANGED', 'FUNCTION_CHANGED',\n 'STATUS_CHANGED', 'OPERATIONAL_STATUS_CHANGED', 'REGISTRY_UPDATED',\n 'GEOMETRY_UPDATED', 'GEOMETRY_REMOVED',\n 'MEDIA_UPLOADED', 'MEDIA_UPDATED', 'MEDIA_REMOVED',\n 'PROVENANCE_BASELINE', 'PROVENANCE_UPDATED', 'PROVENANCE_VERIFIED'\n ))\n `);\n }\n\n public async down(queryRunner: QueryRunner): Promise<void> {\n await queryRunner.query(`\n UPDATE asset_versions\n SET change_type='UPDATED'\n WHERE change_type='FUNCTION_CHANGED'\n `);\n await queryRunner.query(`\n ALTER TABLE asset_versions\n DROP CONSTRAINT IF EXISTS chk_asset_versions_change_type\n `);\n await queryRunner.query(`\n ALTER TABLE asset_versions\n ADD CONSTRAINT chk_asset_versions_change_type CHECK (change_type IN (\n 'BASELINE', 'CREATED', 'UPDATED', 'CONTEXT_CHANGED',\n 'STATUS_CHANGED', 'OPERATIONAL_STATUS_CHANGED', 'REGISTRY_UPDATED',\n 'GEOMETRY_UPDATED', 'GEOMETRY_REMOVED',\n 'MEDIA_UPLOADED', 'MEDIA_UPDATED', 'MEDIA_REMOVED',\n 'PROVENANCE_BASELINE', 'PROVENANCE_UPDATED', 'PROVENANCE_VERIFIED'\n ))\n `);\n }\n}\n""")
|
|
|
|
test_path = Path('api-v3/test/unit/f4-final-review-contract.test.ts')
|
|
if test_path.exists():
|
|
raise SystemExit(f'{test_path}: file already exists')
|
|
test_path.write_text("""import assert from 'node:assert/strict';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport test from 'node:test';\n\nconst root = process.cwd();\nconst read = (relative: string) => fs.readFileSync(path.join(root, relative), 'utf8');\n\nconst migration = read('src/database/migrations/1790000700000-f4-align-asset-version-function-change.ts');\nconst workflow = read('src/inspection-reports/inspection-report-workflow.service.ts');\nconst word = read('src/inspection-reports/inspection-report-word.service.ts');\nconst controller = read('src/inspection-reports/inspection-reports.controller.ts');\nconst compose = read('../docker-compose.yml');\nconst webApi = read('../web-v2/src/lib/reportWorkflowApi.ts');\nconst reportPage = read('../web-v2/src/pages/ReportDetailPage.tsx');\n\ntest('F4 physically permits FUNCTION_CHANGED asset versions with a reversible downgrade', () => {\n const up = migration.slice(migration.indexOf(' public async up('), migration.indexOf(' public async down('));\n const down = migration.slice(migration.indexOf(' public async down('));\n assert.match(up, /FUNCTION_CHANGED/);\n assert.match(down, /SET change_type='UPDATED'[\\s\\S]*WHERE change_type='FUNCTION_CHANGED'/);\n});\n\ntest('F4 GEDO and follow-up uploads stay under the persisted asset-media volume', () => {\n assert.match(workflow, /\\?\\? '\\/app\\/storage\\/asset-media\\/inspection-reports'/);\n assert.match(compose, /INSPECTION_REPORT_UPLOAD_ROOT: \\/app\\/storage\\/asset-media\\/inspection-reports/);\n assert.match(compose, /dhv2_asset_media:\\/app\\/storage\\/asset-media/);\n});\n\ntest('F4 narrative edits invalidate the current generated Word without overwriting its historical file', () => {\n const update = workflow.slice(workflow.indexOf(' async updateNarrative('), workflow.indexOf(' async officialize('));\n assert.match(update, /word_status=CASE[\\s\\S]*THEN 'PENDING'/);\n assert.match(update, /word_stored_name=CASE[\\s\\S]*THEN NULL/);\n assert.match(update, /word_sha256=CASE[\\s\\S]*THEN NULL/);\n assert.match(word, /built\\.sha256\\.slice\\(0, 16\\)/);\n});\n\ntest('F4 exposes the immutable official GEDO PDF through a protected integrity-checked download', () => {\n assert.match(controller, /@Get\\(':id\\/gedo-pdf'\\)[\\s\\S]*@RequirePermissions\\('inspection_reports\\.read'\\)/);\n assert.match(controller, /this\\.workflow\\.officialPdfContent\\(id\\)/);\n assert.match(workflow, /async officialPdfContent\\(/);\n assert.match(workflow, /fileStat\\.size !== row\\.sizeBytes/);\n assert.match(workflow, /createHash\\('sha256'\\)\\.update\\(buffer\\)\\.digest\\('hex'\\)/);\n assert.match(webApi, /inspectionReportGedoPdfDownloadUrl/);\n assert.match(reportPage, /Descargar PDF oficial/);\n});\n""")
|
|
|
|
helper = Path('.github/workflows/f4-one-shot-final-review-fix.yml')
|
|
if not helper.exists():
|
|
raise SystemExit('one-shot helper workflow is missing')
|
|
helper.unlink()
|
|
PY
|
|
|
|
git diff --check
|
|
|
|
- name: Commit final audited corrections
|
|
run: |
|
|
set -Eeuo pipefail
|
|
if git diff --quiet; then
|
|
echo 'No changes produced; refusing silent success.'
|
|
exit 1
|
|
fi
|
|
git config user.name 'github-actions[bot]'
|
|
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
|
|
git add -A
|
|
git commit -m 'fix: close final F4 review gaps'
|
|
git push origin HEAD:feature/f4-backend-saneamiento-documental
|