From c2eade6db582966fa7fc3dd037f952baf3ae1cb5 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 4 Sep 2026 14:33:33 +0200 Subject: fix(packaging): actually ship the TMDB token, on Linux and Windows default.env was empty in every build, for three independent reasons: 1. build-node.sh read QE/node.env, which does not exist. Even pointed at the real file it would have failed: its `grep MESHBAY_TMDB_DEFAULT_TOKEN=` cannot match QE/tmdb.txt, which is a free-form note, not KEY=VALUE. 2. Nothing consumed default.env. packaging/README.md and build-node.sh both claimed `meshbay-node init` copies it to /node.env; grep found the name in exactly two places, the README and the script that writes it. No code implemented the copy, and `EnvironmentFile=-` hid the absence. 3. build-win.ps1 had no env handling at all, so Windows was empty for a different reason than Linux. Now: the build extracts the v4 read token -- tmdb.py sends `Authorization: Bearer`, so it is the JWT, not the 32-char v3 key beside it in the same file -- matching KEY=VALUE first and then by shape, from MESHBAY_TMDB_TOKEN, MESHBAY_TMDB_TOKEN_FILE, QE/node.env, QE/tmdb.txt. It writes default.env 0600 and *fails the build* if no token resolves; MESHBAY_ALLOW_NO_TMDB=1 opts out. An empty default.env is invisible until a user opens Videos and finds no metadata, which is how this shipped empty on two platforms at once. platform.py gains packaged_default_env()/install_node_env()/load_node_env(). init copies the packaged file once, never overwriting an existing node.env, and the daemon loads node.env itself at startup: systemd does this on Linux via EnvironmentFile, but Windows autostart is a Startup-folder .vbs with no equivalent. Already-set variables always win. Also fixes an UnboundLocalError in main(): `config_dir` was assigned at the top of the init branch, which made it function-local for all of main(), while the reset branch calls `config_dir()` as the imported function. init returns before that line, so `meshbay-node reset` could only ever raise. The local is now cfg_dir. Verified end to end on Linux: token baked (239 chars), init writes /node.env 0600 with it. The PowerShell half is written but unrun -- no pwsh on this machine. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01DtfG7z6wHWj8RKHCvxQtY1 --- packages/meshbay-node/src/meshbay_node/daemon.py | 21 ++++-- packages/meshbay-node/src/meshbay_node/platform.py | 80 ++++++++++++++++++++++ packages/meshbay-node/tests/test_platform.py | 80 ++++++++++++++++++++++ packaging/build/build-node.sh | 47 ++++++++++--- packaging/win/build-node-runtime.ps1 | 52 +++++++++++++- 5 files changed, 263 insertions(+), 17 deletions(-) diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py index b5a249d..37a2472 100644 --- a/packages/meshbay-node/src/meshbay_node/daemon.py +++ b/packages/meshbay-node/src/meshbay_node/daemon.py @@ -1634,9 +1634,15 @@ def _systemctl_user(verb: str, unit: str, *, not_running_hint: str, def main() -> None: import argparse - from meshbay_node.platform import configure_event_loop, force_utf8_stdio + from meshbay_node.platform import (configure_event_loop, force_utf8_stdio, + load_node_env) force_utf8_stdio() configure_event_loop() + # Before anything reads the environment. On Linux systemd has usually loaded + # the same file already via EnvironmentFile=; this is what makes a Windows + # run (Startup-folder .vbs, no systemd) and a bare `meshbay-node` behave the + # same. Already-set variables are left alone, so it cannot undo either. + load_node_env(config_dir()) parser = argparse.ArgumentParser(description="MeshBay Node daemon") parser.add_argument("command", nargs="?", @@ -1698,8 +1704,13 @@ def main() -> None: if args.command == "init": cfg_path = args.config or DEFAULT_CONFIG_PATH - config_dir = cfg_path.parent - config_dir.mkdir(parents=True, exist_ok=True) + cfg_dir = cfg_path.parent + cfg_dir.mkdir(parents=True, exist_ok=True) + + from meshbay_node.platform import install_node_env + env_written = install_node_env(cfg_dir) + if env_written: + print(f"Wrote {env_written} (packaged defaults).") hub_url = args.hub_url username = args.username @@ -1731,7 +1742,7 @@ def main() -> None: else: print(f"Config already exists: {cfg_path}") else: - unlock_file = config_dir / "unlock.key" + unlock_file = cfg_dir / "unlock.key" toml_lines = [ "[hub]", f'url = "{hub_url}"', @@ -1752,7 +1763,7 @@ def main() -> None: chmod_private(cfg_path) print(f"Config written to {cfg_path}") - unlock_file = config_dir / "unlock.key" + unlock_file = cfg_dir / "unlock.key" if not unlock_file.exists(): import secrets key = secrets.token_urlsafe(32) diff --git a/packages/meshbay-node/src/meshbay_node/platform.py b/packages/meshbay-node/src/meshbay_node/platform.py index b59418f..3c160a1 100644 --- a/packages/meshbay-node/src/meshbay_node/platform.py +++ b/packages/meshbay-node/src/meshbay_node/platform.py @@ -68,6 +68,86 @@ def state_dir() -> Path: return Path.home() / ".local" / "state" / "meshbay" +# ── Packaged defaults ──────────────────────────────────────────────────────── + + +def packaged_default_env() -> Path | None: + """ + The `default.env` shipped with the package: build-time defaults, currently + the shared read-only TMDB token. `init` copies it to config_dir()/node.env + and nothing reads it in place, so an operator's edits to their own copy + survive an upgrade. + + Frozen (PyInstaller/Windows): beside the executable, where + build-node-runtime.ps1 puts it -- the same placement it uses for ffmpeg. + Packaged (Linux): /opt/meshbay-node/share/default.env, from build-node.sh. + None in a source checkout, where no package wrote one. + """ + candidates = [] + if getattr(sys, "frozen", False): + candidates.append(Path(sys.executable).parent / "default.env") + candidates.append(Path("/opt/meshbay-node/share/default.env")) + for path in candidates: + try: + if path.is_file(): + return path + except OSError: + continue + return None + + +def install_node_env(target_dir: Path) -> Path | None: + """ + Copy the packaged default.env to /node.env, once, at init. + + Never overwrites: an existing node.env holds the operator's own values, and + silently replacing a configured token with the packaged one would be worse + than doing nothing. Returns the path when written, None when there was + nothing to copy or a file was already there. + """ + src = packaged_default_env() + if src is None: + return None + dest = target_dir / "node.env" + if dest.exists(): + return None + dest.write_bytes(src.read_bytes()) + chmod_private(dest) + return dest + + +def load_node_env(source_dir: Path) -> int: + """ + Read /node.env into os.environ, returning how many names were + set. + + systemd does this on Linux through `EnvironmentFile=`, but the Windows + autostart is a Startup-folder .vbs with no equivalent, so the daemon reads + the file itself and both platforms behave the same. An existing environment + variable always wins -- an operator exporting a value, or systemd having + already loaded the same file, overrides the packaged default rather than + being overridden by it. + """ + path = source_dir / "node.env" + try: + text = path.read_text(encoding="utf-8") + except (OSError, UnicodeDecodeError): + return 0 + count = 0 + for line in text.splitlines(): + line = line.strip() + if not line or line.startswith("#") or "=" not in line: + continue + name, _, value = line.partition("=") + name = name.strip() + value = value.strip().strip('"').strip("'") + if not name or name in os.environ: + continue + os.environ[name] = value + count += 1 + return count + + # ── File permissions ───────────────────────────────────────────────────────── diff --git a/packages/meshbay-node/tests/test_platform.py b/packages/meshbay-node/tests/test_platform.py index f9464c3..7042afb 100644 --- a/packages/meshbay-node/tests/test_platform.py +++ b/packages/meshbay-node/tests/test_platform.py @@ -5,6 +5,7 @@ here by monkeypatching that (and `os.environ`) rather than only on the OS the suite happens to run on. """ +import os import asyncio import sys from pathlib import Path @@ -177,3 +178,82 @@ def test_autostart_run_refuses_off_windows(monkeypatch): monkeypatch.setattr(sys, "platform", "linux") with pytest.raises(RuntimeError, match="Windows-only"): plat.autostart_run() + + +# ── Packaged defaults ──────────────────────────────────────────────────────── + +def test_frozen_build_finds_default_env_beside_the_executable(monkeypatch, tmp_path): + """Where build-node-runtime.ps1 puts it, alongside ffmpeg.""" + exe = tmp_path / "meshbay-node.exe" + exe.write_bytes(b"") + (tmp_path / "default.env").write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJtest\n") + monkeypatch.setattr(sys, "frozen", True, raising=False) + monkeypatch.setattr(sys, "executable", str(exe)) + assert plat.packaged_default_env() == tmp_path / "default.env" + + +def test_source_checkout_has_no_packaged_default(monkeypatch, tmp_path): + monkeypatch.setattr(sys, "frozen", False, raising=False) + monkeypatch.setattr(sys, "executable", str(tmp_path / "python")) + monkeypatch.setattr(plat, "Path", Path) + # /opt/meshbay-node/share/default.env is absent on a dev machine + assert plat.packaged_default_env() is None + + +def test_install_node_env_copies_once(monkeypatch, tmp_path): + src = tmp_path / "default.env" + src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJfirst\n") + monkeypatch.setattr(plat, "packaged_default_env", lambda: src) + cfg = tmp_path / "config" + cfg.mkdir() + + written = plat.install_node_env(cfg) + assert written == cfg / "node.env" + assert "eyJfirst" in written.read_text() + + +def test_install_node_env_never_overwrites_operator_values(monkeypatch, tmp_path): + """An existing node.env holds the operator's own token; clobbering it would + silently downgrade a configured node to the shared default.""" + src = tmp_path / "default.env" + src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJpackaged\n") + monkeypatch.setattr(plat, "packaged_default_env", lambda: src) + cfg = tmp_path / "config" + cfg.mkdir() + (cfg / "node.env").write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJoperator\n") + + assert plat.install_node_env(cfg) is None + assert "eyJoperator" in (cfg / "node.env").read_text() + + +def test_install_node_env_is_a_noop_without_a_package(monkeypatch, tmp_path): + monkeypatch.setattr(plat, "packaged_default_env", lambda: None) + assert plat.install_node_env(tmp_path) is None + assert not (tmp_path / "node.env").exists() + + +def test_load_node_env_sets_names(monkeypatch, tmp_path): + (tmp_path / "node.env").write_text( + "# a comment\n" + "\n" + "MESHBAY_TMDB_DEFAULT_TOKEN=eyJloaded\n" + 'QUOTED="value"\n' + ) + monkeypatch.delenv("MESHBAY_TMDB_DEFAULT_TOKEN", raising=False) + monkeypatch.delenv("QUOTED", raising=False) + assert plat.load_node_env(tmp_path) == 2 + assert os.environ["MESHBAY_TMDB_DEFAULT_TOKEN"] == "eyJloaded" + assert os.environ["QUOTED"] == "value" + + +def test_load_node_env_does_not_override_the_environment(monkeypatch, tmp_path): + """systemd may have loaded the same file already, and an operator export + must win over a packaged default.""" + (tmp_path / "node.env").write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJfromfile\n") + monkeypatch.setenv("MESHBAY_TMDB_DEFAULT_TOKEN", "eyJfromenv") + assert plat.load_node_env(tmp_path) == 0 + assert os.environ["MESHBAY_TMDB_DEFAULT_TOKEN"] == "eyJfromenv" + + +def test_load_node_env_tolerates_a_missing_file(tmp_path): + assert plat.load_node_env(tmp_path) == 0 diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh index bd81096..8970176 100755 --- a/packaging/build/build-node.sh +++ b/packaging/build/build-node.sh @@ -45,26 +45,53 @@ ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node" # --- Node-specific assets ------------------------------------------------- mkdir -p "$ROOT/opt/meshbay-node/share" -# Default env with TMDB token (read at build time). -# Override with MESHBAY_TMDB_TOKEN_FILE; falls back to QE/node.env (gitignored). -TMDB_TOKEN_FILE="${MESHBAY_TMDB_TOKEN_FILE:-$REPO/QE/node.env}" -TMDB_TOKEN="" -if [ -f "$TMDB_TOKEN_FILE" ]; then - TMDB_TOKEN=$(grep -oP 'MESHBAY_TMDB_DEFAULT_TOKEN=\K.*' "$TMDB_TOKEN_FILE" || true) +# Default env with the shared TMDB token, read at build time and copied to +# /node.env by `meshbay-node init`. +# +# tmdb.py sends `Authorization: Bearer`, so this is the v4 *read access token* +# (a JWT, "eyJ..."), not the 32-char v3 API key that sits beside it in the same +# note file. Sources, in order: an explicit variable, an explicit file, the +# KEY=VALUE form, then QE/tmdb.txt -- which is free-form prose, so the token is +# matched by shape rather than by a label. +extract_tmdb_token() { + local file="$1" tok="" + [ -f "$file" ] || return 0 + tok=$(sed -n 's/^[[:space:]]*MESHBAY_TMDB_DEFAULT_TOKEN[[:space:]]*=[[:space:]]*//p' \ + "$file" | head -1) + [ -n "$tok" ] || tok=$(grep -oE '^eyJ[A-Za-z0-9._-]{40,}$' "$file" | head -1 || true) + printf '%s' "$tok" | tr -d '"'"'"'\r' +} + +TMDB_TOKEN="${MESHBAY_TMDB_TOKEN:-}" +if [ -z "$TMDB_TOKEN" ] && [ -n "${MESHBAY_TMDB_TOKEN_FILE:-}" ]; then + TMDB_TOKEN=$(extract_tmdb_token "$MESHBAY_TMDB_TOKEN_FILE") fi +[ -n "$TMDB_TOKEN" ] || TMDB_TOKEN=$(extract_tmdb_token "$REPO/QE/node.env") +[ -n "$TMDB_TOKEN" ] || TMDB_TOKEN=$(extract_tmdb_token "$REPO/QE/tmdb.txt") + if [ -n "$TMDB_TOKEN" ]; then cat > "$ROOT/opt/meshbay-node/share/default.env" </node.env by 'meshbay-node init' if it does not exist. # The operator may override any value there or in the systemd EnvironmentFile. # TMDB API token for the Videos app (read-only, shared across installations) MESHBAY_TMDB_DEFAULT_TOKEN=$TMDB_TOKEN EOF - echo " TMDB token baked into default.env" + chmod 600 "$ROOT/opt/meshbay-node/share/default.env" + echo " TMDB token baked into default.env (${#TMDB_TOKEN} chars)" +elif [ "${MESHBAY_ALLOW_NO_TMDB:-0}" = "1" ]; then + echo " !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" >&2 + : > "$ROOT/opt/meshbay-node/share/default.env" else - echo " !! TMDB token not found in QE/node.env — default.env will be empty" >&2 - touch "$ROOT/opt/meshbay-node/share/default.env" + # Failing here is deliberate: an empty default.env is invisible until a user + # opens the Videos app and finds no metadata, which is exactly how this + # shipped empty on two platforms at once. + echo "!! TMDB token not found. Looked at:" >&2 + echo " \$MESHBAY_TMDB_TOKEN, \$MESHBAY_TMDB_TOKEN_FILE," >&2 + echo " $REPO/QE/node.env, $REPO/QE/tmdb.txt" >&2 + echo " Set MESHBAY_ALLOW_NO_TMDB=1 to build without it." >&2 + exit 1 fi # --- Systemd units -------------------------------------------------------- diff --git a/packaging/win/build-node-runtime.ps1 b/packaging/win/build-node-runtime.ps1 index c432e01..5097b37 100644 --- a/packaging/win/build-node-runtime.ps1 +++ b/packaging/win/build-node-runtime.ps1 @@ -117,14 +117,62 @@ else { Write-Host " ffmpeg not bundled -- the node will look for it on PATH" -ForegroundColor Yellow } -# --- 5. publish ---------------------------------------------------- +# --- 5. default.env (shared TMDB token) ------------------------------ +# Beside the exe, where platform.packaged_default_env() looks for it, and the +# same placement ffmpeg gets above. `meshbay-node init` copies it to +# %LOCALAPPDATA%\meshbay\node.env, and the daemon loads that file itself: +# Windows autostart is a Startup-folder .vbs, with no systemd EnvironmentFile. +function Get-TmdbToken([string]$File) { + if (-not $File -or -not (Test-Path -LiteralPath $File)) { return "" } + $lines = Get-Content -LiteralPath $File + foreach ($line in $lines) { + if ($line -match '^\s*MESHBAY_TMDB_DEFAULT_TOKEN\s*=\s*(.+)$') { + return $Matches[1].Trim().Trim('"').Trim("'") + } + } + # QE\tmdb.txt is free-form prose: match the v4 read token by shape. The + # 32-char v3 API key in the same file is NOT what tmdb.py sends (Bearer). + foreach ($line in $lines) { + if ($line -match '^(eyJ[A-Za-z0-9._-]{40,})\s*$') { return $Matches[1] } + } + return "" +} + +$tmdb = $env:MESHBAY_TMDB_TOKEN +if (-not $tmdb) { $tmdb = Get-TmdbToken $env:MESHBAY_TMDB_TOKEN_FILE } +if (-not $tmdb) { $tmdb = Get-TmdbToken (Join-Path $Repo "QE\node.env") } +if (-not $tmdb) { $tmdb = Get-TmdbToken (Join-Path $Repo "QE\tmdb.txt") } + +$envFile = Join-Path $frozen "default.env" +$noBom = New-Object System.Text.UTF8Encoding $false # a BOM would break parsing +if ($tmdb) { + $body = @( + "# Default environment for meshbay-node.", + "# Copied to \node.env by 'meshbay-node init' if it does not exist.", + "", + "# TMDB API token for the Videos app (read-only, shared across installations)", + "MESHBAY_TMDB_DEFAULT_TOKEN=$tmdb" + ) -join "`n" + [System.IO.File]::WriteAllText($envFile, $body + "`n", $noBom) + Step ("TMDB token baked into default.env ({0} chars)" -f $tmdb.Length) +} +elseif ($env:MESHBAY_ALLOW_NO_TMDB -eq "1") { + [System.IO.File]::WriteAllText($envFile, "", $noBom) + Write-Host " !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" -ForegroundColor Yellow +} +else { + throw ("TMDB token not found (MESHBAY_TMDB_TOKEN, MESHBAY_TMDB_TOKEN_FILE, " + + "QE\node.env, QE\tmdb.txt). Set MESHBAY_ALLOW_NO_TMDB=1 to build without it.") +} + +# --- 6. publish ---------------------------------------------------- Move-Item $frozen $OutDir Remove-Item -Recurse -Force $pyiWork, $pyiDist -ErrorAction SilentlyContinue if ($createdVenv -and -not $KeepBuildVenv) { Remove-Item -Recurse -Force $BuildVenv -ErrorAction SilentlyContinue } -# --- 6. smoke test ----------------------------------------------- +# --- 7. smoke test ----------------------------------------------- # Capture, do NOT pipe to Select-Object -First: that stops the native process # mid-write and reports a spurious non-zero exit. Step "smoke test: meshbay-node --help" -- cgit v1.2.3