backend: require confirmation for signed channel updates [CI]

backend/src/MoShiro.Backend.Application/Updates/ReleaseService.cs

@@ -8,29 +8,38 @@ using MoShiro.Protocol;
 namespace MoShiro.Backend.Application;
 
 /// <summary>面板记下的、CI 签名的发布清单（只留每个组件最新的一份）。<c>Manifest</c> 是签名对象的原始文本，面板一个字节也不改。</summary>
-public sealed record ReleaseOffer(string Component, long Seq, string Tag, string Version, string Digest, string Manifest, string Signature);
+public sealed record ReleaseOffer(string Component, long Seq, string Tag, string Version, string Digest, string Manifest, string Signature, string Channel = "release");
 
 /// <summary>
 /// 发布清单的分发：CI 签名之后推给面板，面板存下来并原样转给在线的 Agent、Probe（节点连上时再补发一次）。
 /// <b>面板不验签、也不决定拉什么</b>：节点宿主机上的更新器用本机的发布公钥验签，并且只认本机配置的镜像仓库；
 /// 所以面板即使被攻破，也推不出一个能被装上的假镜像。面板只负责「通知」和「请求更新」，状态由节点随心跳报回来。
 /// </summary>
-public sealed partial class ReleaseService
+public sealed partial class ReleaseService : IDisposable
 {
     public const int MaxManifestBytes = 4096;
     public const int MaxSignatureBytes = 512;
-    private static readonly string[] s_components = [NodeKinds.Agent, NodeKinds.Probe];
+    public const string BackendComponent = "backend";
+    private static readonly string[] s_components = [NodeKinds.Agent, NodeKinds.Probe, BackendComponent];
 
     private readonly ISettingsStore _settings;
     private readonly IAgentGateway _gateway;
+    private readonly IBackendUpdateFiles _backendFiles;
+    private readonly BackendOptions _options;
     private readonly ConcurrentDictionary<string, UpdateStatus> _status = new();
 
-    public ReleaseService(ISettingsStore settings, IAgentGateway gateway)
+    public ReleaseService(ISettingsStore settings, IAgentGateway gateway, IBackendUpdateFiles backendFiles, BackendOptions options)
     {
         _settings = settings;
         _gateway = gateway;
+        _backendFiles = backendFiles;
+        _options = options;
     }
 
+    internal SemaphoreSlim BackendGate { get; } = new(1, 1);
+
+    public void Dispose() => BackendGate.Dispose();
+
     /// <summary>登记一份新清单并推给在线的同类节点。只要格式对、<c>seq</c> 比现有的新就收下（签名由节点验证）。</summary>
     public async ValueTask<Result<ReleaseOffer>> PublishAsync(string manifest, string signature, CancellationToken ct)
     {
@@ -39,20 +48,40 @@ public sealed partial class ReleaseService
             return ValidationError.Fail<ReleaseOffer>("manifest", problem);
         }
 
-        ReleaseOffer? current = await GetAsync(offer.Component, ct);
-        if (current is not null && offer.Seq <= current.Seq)
+        await BackendGate.WaitAsync(ct);
+        try
         {
-            return Result<ReleaseOffer>.Fail(MoShiroErrors.NameConflict, $"a release with seq {current.Seq} or newer is already registered");
-        }
+            bool backend = offer.Component == BackendComponent;
+            ReleaseOffer? current = backend ? await GetBackendAsync(offer.Channel, ct) : await GetAsync(offer.Component, ct);
+            if (current is not null && offer.Seq <= current.Seq)
+            {
+                return Result<ReleaseOffer>.Fail(MoShiroErrors.NameConflict, $"a release with seq {current.Seq} or newer is already registered");
+            }
 
-        await _settings.SetAsync(Key(offer.Component, "manifest"), offer.Manifest, ct);
-        await _settings.SetAsync(Key(offer.Component, "signature"), offer.Signature, ct);
-        foreach (NodeId node in OnlineOf(offer.Component))
+            string componentKey = backend ? BackendComponent + "." + offer.Channel : offer.Component;
+            await _settings.SetAsync(Key(componentKey, "manifest"), offer.Manifest, ct);
+            await _settings.SetAsync(Key(componentKey, "signature"), offer.Signature, ct);
+            if (backend)
+            {
+                if (offer.Channel == BackendUpdates.ChannelOf(_options))
+                {
+                    await _backendFiles.WriteOfferAsync(offer.Manifest, offer.Signature, ct);
+                }
+            }
+            else
+            {
+                foreach (NodeId node in OnlineOf(offer.Component))
+                {
+                    await _gateway.NotifyUpdateOfferAsync(node, offer.Manifest, offer.Signature, ct);
+                }
+            }
+
+            return Result<ReleaseOffer>.Ok(offer);
+        }
+        finally
         {
-            await _gateway.NotifyUpdateOfferAsync(node, offer.Manifest, offer.Signature, ct);
+            BackendGate.Release();
         }
-
-        return Result<ReleaseOffer>.Ok(offer);
     }
 
     public async ValueTask<ReleaseOffer?> GetAsync(string component, CancellationToken ct)
@@ -67,7 +96,8 @@ public sealed partial class ReleaseService
         var list = new List<ReleaseOffer>();
         foreach (string component in s_components)
         {
-            if (await GetAsync(component, ct) is { } offer)
+            ReleaseOffer? offer = component == BackendComponent ? await GetBackendAsync(BackendUpdates.ChannelOf(_options), ct) : await GetAsync(component, ct);
+            if (offer is not null)
             {
                 list.Add(offer);
             }
@@ -76,6 +106,15 @@ public sealed partial class ReleaseService
         return list;
     }
 
+    public async ValueTask<ReleaseOffer?> GetBackendAsync(string channel, CancellationToken ct)
+    {
+        string key = BackendComponent + "." + channel;
+        string? manifest = await _settings.GetAsync(Key(key, "manifest"), ct);
+        string? signature = await _settings.GetAsync(Key(key, "signature"), ct);
+        return manifest is not null && signature is not null && TryParse(manifest, signature, out ReleaseOffer? offer, out _)
+            && offer.Component == BackendComponent && offer.Channel == channel ? offer : null;
+    }
+
     /// <summary>节点刚连上：把它这个组件最新的清单补发一份（节点离线时发布的也不会错过）。</summary>
     public async ValueTask OfferToNodeAsync(NodeId node, CancellationToken ct)
     {
@@ -129,7 +168,14 @@ public sealed partial class ReleaseService
             JsonElement root = document.RootElement;
             string component = Text(root, "component");
             string digest = Text(root, "digest");
+            string channel = Text(root, "channel");
+            if (channel.Length == 0)
+            {
+                channel = "release"; // 老节点的清单没有 channel，保留原来的兼容性
+            }
+
             if (root.ValueKind != JsonValueKind.Object || Array.IndexOf(s_components, component) < 0
+                || channel is not ("dev" or "release")
                 || !root.TryGetProperty("seq", out JsonElement seq) || !seq.TryGetInt64(out long seqValue) || seqValue <= 0
                 || !Digest().IsMatch(digest) || Text(root, "image").Length is 0 or > 200)
             {
@@ -137,7 +183,7 @@ public sealed partial class ReleaseService
                 return false;
             }
 
-            offer = new ReleaseOffer(component, seqValue, Text(root, "tag"), Text(root, "version"), digest, manifest, signature);
+            offer = new ReleaseOffer(component, seqValue, Text(root, "tag"), Text(root, "version"), digest, manifest, signature, channel);
             return true;
         }
         catch (JsonException)