merge master into codex/wechat-mini-program-virtual-payment

2026-05-30 16:46:11 +08:00
parent aaaba77c3a ca2a4c0295
commit 78448d2a7b
119 changed files with 3345 additions and 428 deletions
--- a/scripts/database-backup-to-oss.mjs
+++ b/scripts/database-backup-to-oss.mjs
@@ -20,10 +20,12 @@ const UNSIGNED_PAYLOAD = 'UNSIGNED-PAYLOAD';
 function usage() {
  console.log(`用法:
  npm run database:backup:oss -- [--data-dir <path>] [--work-dir <path>] [--bucket <bucket>] [--object-prefix <prefix>] [--keep-local]
-  node scripts/database-backup-to-oss.mjs [--stop-service spacetimedb.service]
+  node scripts/database-backup-to-oss.mjs [--stop-service spacetimedb.service] [--defer-upload]
+  node scripts/database-backup-to-oss.mjs --upload-archive <path>

 说明:
  将 SpacetimeDB 数据目录打包成 .tar.gz，并上传到阿里云 OSS 指定 bucket。
+  --defer-upload 只生成本地冷备份和 manifest，不上传；后续用 --upload-archive 异步上传。
  默认读取 .env / .env.local / .env.secrets.local；生产服务可传 --env-file /etc/genarrative/api-server.env。
  shell 环境变量优先级最高，不会被 env 文件覆盖。

@@ -100,6 +102,11 @@ function parseArgs(argv) {
    stopService: '',
    database: '',
    dryRun: false,
+    deferUpload: false,
+    uploadArchive: '',
+    manifestFile: '',
+    objectKey: '',
+    resultFile: '',
  };

  for (let index = 0; index < argv.length; index += 1) {
@@ -134,6 +141,9 @@ function parseArgs(argv) {
      case '--object-prefix':
        options.objectPrefix = readValue();
        break;
+      case '--object-key':
+        options.objectKey = readValue();
+        break;
      case '--access-key-id':
        options.accessKeyId = readValue();
        break;
@@ -155,6 +165,19 @@ function parseArgs(argv) {
      case '--dry-run':
        options.dryRun = true;
        break;
+      case '--defer-upload':
+        options.deferUpload = true;
+        options.keepLocal = true;
+        break;
+      case '--upload-archive':
+        options.uploadArchive = readValue();
+        break;
+      case '--manifest-file':
+        options.manifestFile = readValue();
+        break;
+      case '--result-file':
+        options.resultFile = readValue();
+        break;
      default:
        throw new Error(`未知参数: ${arg}`);
    }
@@ -260,6 +283,17 @@ function createArchive({dataDir, workDir, fileName}) {
  return archivePath;
 }

+function writeManifest({manifestPath, payload}) {
+  writeFileSync(manifestPath, `${JSON.stringify(payload, null, 2)}\n`, 'utf8');
+}
+
+function readManifest(manifestPath) {
+  if (!existsSync(manifestPath)) {
+    throw new Error(`备份清单不存在: ${manifestPath}`);
+  }
+  return JSON.parse(readFileSync(manifestPath, 'utf8'));
+}
+
 function hmac(key, content, encoding) {
  return createHmac('sha256', key).update(content).digest(encoding);
 }
@@ -372,6 +406,59 @@ async function uploadArchive({archivePath, bucket, endpoint, objectKey, accessKe
  };
 }

+async function uploadExistingArchive({args, env, bucket, endpoint, accessKeyId, accessKeySecret, objectPrefix}) {
+  const archivePath = resolvePath(args.uploadArchive);
+  if (!existsSync(archivePath)) {
+    throw new Error(`待上传备份文件不存在: ${archivePath}`);
+  }
+
+  const manifestPath = resolvePath(args.manifestFile || `${archivePath}.manifest.json`);
+  const manifest = existsSync(manifestPath) ? readManifest(manifestPath) : {};
+  const dataDir = firstNonEmpty(manifest.dataDir, env.GENARRATIVE_DATABASE_BACKUP_DATA_DIR, DEFAULT_PRODUCTION_DATA_DIR);
+  const database = firstNonEmpty(args.database, manifest.database, env.GENARRATIVE_SPACETIME_DATABASE, basename(dataDir));
+  const objectKey = firstNonEmpty(args.objectKey, manifest.objectKey, buildBackupNames({database, dataDir, objectPrefix}).objectKey);
+
+  console.log(`[database-backup] 上传已有备份: ${archivePath}`);
+  console.log(`[database-backup] 目标对象: oss://${bucket}/${objectKey}`);
+
+  if (args.dryRun) {
+    console.log('[database-backup] dry-run，仅校验上传配置。');
+    return;
+  }
+
+  const result = await uploadArchive({archivePath, bucket, endpoint, objectKey, accessKeyId, accessKeySecret});
+  console.log(`[database-backup] 上传完成: ${JSON.stringify(result)}`);
+
+  const uploadedAt = new Date().toISOString();
+  writeManifest({
+    manifestPath,
+    payload: {
+      ...manifest,
+      database,
+      bucket: result.bucket,
+      objectKey: result.objectKey,
+      contentLength: result.contentLength,
+      etag: result.etag,
+      uploadedAt,
+      uploadStatus: 'uploaded',
+    },
+  });
+
+  if (args.resultFile) {
+    writeFileSync(resolvePath(args.resultFile), `${JSON.stringify({archivePath, manifestPath, ...result, uploadedAt}, null, 2)}\n`, 'utf8');
+  }
+
+  const keepLocal = args.keepLocal || String(env.GENARRATIVE_DATABASE_BACKUP_KEEP_LOCAL ?? '').trim().toLowerCase() === 'true';
+  if (!keepLocal) {
+    rmSync(archivePath, {force: true});
+    rmSync(manifestPath, {force: true});
+    console.log('[database-backup] 已删除本地临时备份文件；如需保留请设置 --keep-local。');
+  } else {
+    console.log(`[database-backup] 已保留本地备份: ${archivePath}`);
+    console.log(`[database-backup] 已保留备份清单: ${manifestPath}`);
+  }
+}
+
 async function main() {
  const args = parseArgs(process.argv.slice(2));
  const env = loadEffectiveEnv(args.envFiles);
@@ -400,6 +487,11 @@ async function main() {
    }
  }

+  if (args.uploadArchive) {
+    await uploadExistingArchive({args, env, bucket, endpoint, accessKeyId, accessKeySecret, objectPrefix});
+    return;
+  }
+
  const {fileName, objectKey} = buildBackupNames({database, dataDir, objectPrefix});
  console.log(`[database-backup] 数据目录: ${dataDir}`);
  console.log(`[database-backup] 本地临时目录: ${workDir}`);
@@ -419,22 +511,47 @@ async function main() {
    startServiceIfNeeded(args.stopService || firstNonEmpty(env.GENARRATIVE_DATABASE_BACKUP_STOP_SERVICE), serviceStopped);
  }

+  const manifestPath = `${archivePath}.manifest.json`;
+  writeManifest({
+    manifestPath,
+    payload: {
+      createdAt: new Date().toISOString(),
+      database,
+      dataDir,
+      bucket,
+      objectKey,
+      archivePath,
+      uploadStatus: args.deferUpload ? 'deferred' : 'pending',
+    },
+  });
+
+  if (args.deferUpload) {
+    console.log(`[database-backup] 已生成本地冷备份，延后上传: ${archivePath}`);
+    console.log(`[database-backup] 已写入备份清单: ${manifestPath}`);
+    if (args.resultFile) {
+      writeFileSync(resolvePath(args.resultFile), `${JSON.stringify({archivePath, manifestPath, bucket, objectKey}, null, 2)}\n`, 'utf8');
+    }
+    return;
+  }
+
  const result = await uploadArchive({archivePath, bucket, endpoint, objectKey, accessKeyId, accessKeySecret});
  console.log(`[database-backup] 上传完成: ${JSON.stringify(result)}`);

-  const manifestPath = `${archivePath}.manifest.json`;
-  writeFileSync(
+  writeManifest({
    manifestPath,
-    `${JSON.stringify({
+    payload: {
      createdAt: new Date().toISOString(),
+      database,
      dataDir,
      bucket: result.bucket,
      objectKey: result.objectKey,
+      archivePath,
      contentLength: result.contentLength,
      etag: result.etag,
-    }, null, 2)}\n`,
-    'utf8',
-  );
+      uploadedAt: new Date().toISOString(),
+      uploadStatus: 'uploaded',
+    },
+  });

  if (!keepLocal) {
    rmSync(archivePath, {force: true});
--- a/scripts/deploy/production-api-deploy.sh
+++ b/scripts/deploy/production-api-deploy.sh
@@ -331,6 +331,15 @@ mkdir -p "${RELEASE_DIR}"
 cp "${SOURCE_DIR}/api-server" "${RELEASE_DIR}/api-server"
 chmod +x "${RELEASE_DIR}/api-server"

+SCRIPT_SOURCE_DIR="$(cd "${SCRIPT_DIR}/../.." && pwd)/scripts"
+mkdir -p "${RELEASE_DIR}/scripts"
+if [[ -f "${SCRIPT_SOURCE_DIR}/database-backup-to-oss.mjs" ]]; then
+  cp "${SCRIPT_SOURCE_DIR}/database-backup-to-oss.mjs" "${RELEASE_DIR}/scripts/database-backup-to-oss.mjs"
+  chmod 0644 "${RELEASE_DIR}/scripts/database-backup-to-oss.mjs"
+else
+  echo "[production-api-deploy] 未找到数据库备份脚本，release 目录不会包含 scripts/database-backup-to-oss.mjs" >&2
+fi
+
 if [[ -f "${SOURCE_DIR}/release-manifest.json" ]]; then
  cp "${SOURCE_DIR}/release-manifest.json" "${RELEASE_DIR}/release-manifest.api-server.json"
 fi
--- a/scripts/deploy/production-stdb-publish.sh
+++ b/scripts/deploy/production-stdb-publish.sh
@@ -5,14 +5,15 @@ set -euo pipefail
 usage() {
  cat <<'EOF'
 用法:
-  ./scripts/deploy/production-stdb-publish.sh --source-dir build/<version> --database <database> [--server-url http://127.0.0.1:3101] [--server local] [--root-dir /stdb] [--run-as-user spacetimedb] [--clear-database] [--skip-backup]
+  ./scripts/deploy/production-stdb-publish.sh --source-dir build/<version> --database <database> [--server-url http://127.0.0.1:3101] [--server local] [--root-dir /stdb] [--run-as-user spacetimedb] [--clear-database] [--backup-mode async|sync|skip]

 说明:
  进入维护模式，校验 spacetime_module.wasm.sha256，并在生产实例本机执行 spacetime publish。
  默认使用 http://127.0.0.1:3101，避免与部署机本机 Git/Web 服务的 3000 端口冲突。
  默认使用 /stdb 作为 spacetime CLI root-dir，并以 spacetimedb 用户发布，避免 root CLI 身份污染自托管实例。
  发布时固定追加 --no-config，只使用显式参数，避免工作区或用户目录里的 spacetime 配置干扰目标。
-  publish 前默认执行一次 OSS 冷备份；备份失败会阻断 publish。仅明确传入 --skip-backup 时跳过。
+  async 模式会在 publish 前先做本地冷备份，再在 publish 完成后后台上传 OSS，避免低带宽上传阻塞部署。
+  如需强制等待备份完成并在失败时阻断 publish，传入 --backup-mode sync。
  失败时保留维护模式。
 EOF
 }
@@ -44,9 +45,15 @@ SERVER_URL="http://127.0.0.1:3101"
 SPACETIME_ROOT_DIR="/stdb"
 RUN_AS_USER="spacetimedb"
 CLEAR_DATABASE=0
-SKIP_BACKUP=0
+BACKUP_MODE="${GENARRATIVE_STDB_PUBLISH_BACKUP_MODE:-async}"
 DEPLOY_COMPLETED=0
 PUBLISH_TMP_DIR=""
+ASYNC_BACKUP_STATUS_FILE=""
+ASYNC_BACKUP_SCRIPT=""
+ASYNC_BACKUP_ARCHIVE=""
+ASYNC_BACKUP_MANIFEST=""
+ASYNC_BACKUP_LOG=""
+SPACETIME_READY_TIMEOUT_SECONDS="${GENARRATIVE_STDB_PUBLISH_READY_TIMEOUT_SECONDS:-60}"

 while [[ $# -gt 0 ]]; do
  case "$1" in
@@ -84,9 +91,17 @@ while [[ $# -gt 0 ]]; do
      shift
      ;;
    --skip-backup)
-      SKIP_BACKUP=1
+      BACKUP_MODE="skip"
      shift
      ;;
+    --sync-backup)
+      BACKUP_MODE="sync"
+      shift
+      ;;
+    --backup-mode)
+      BACKUP_MODE="${2:?缺少 --backup-mode 的值}"
+      shift 2
+      ;;
    *)
      echo "[production-stdb-publish] 未知参数: $1" >&2
      usage >&2
@@ -104,11 +119,21 @@ if [[ ! "${SPACETIME_ROOT_DIR}" == /* || "${SPACETIME_ROOT_DIR}" == *".."* ]]; t
  exit 1
 fi

+if [[ ! "${BACKUP_MODE}" =~ ^(async|sync|skip)$ ]]; then
+  echo "[production-stdb-publish] --backup-mode 只能是 async、sync 或 skip: ${BACKUP_MODE}" >&2
+  exit 1
+fi
+
 if [[ -n "${RUN_AS_USER}" && ! "${RUN_AS_USER}" =~ ^[A-Za-z_][A-Za-z0-9_-]*$ ]]; then
  echo "[production-stdb-publish] --run-as-user 只能是本机用户名: ${RUN_AS_USER}" >&2
  exit 1
 fi

+if [[ ! "${SPACETIME_READY_TIMEOUT_SECONDS}" =~ ^[0-9]+$ || "${SPACETIME_READY_TIMEOUT_SECONDS}" -le 0 ]]; then
+  echo "[production-stdb-publish] GENARRATIVE_STDB_PUBLISH_READY_TIMEOUT_SECONDS 必须是正整数: ${SPACETIME_READY_TIMEOUT_SECONDS}" >&2
+  exit 1
+fi
+
 if [[ ! -d "${SOURCE_DIR}" ]]; then
  echo "[production-stdb-publish] 发布目录不存在: ${SOURCE_DIR}" >&2
  exit 1
@@ -123,6 +148,9 @@ fi

 on_exit() {
  local exit_code=$?
+  if [[ "${BACKUP_MODE}" == "async" && -n "${ASYNC_BACKUP_STATUS_FILE}" && -f "${ASYNC_BACKUP_STATUS_FILE}" ]]; then
+    start_async_backup_upload || true
+  fi
  if [[ -n "${PUBLISH_TMP_DIR}" && -d "${PUBLISH_TMP_DIR}" ]]; then
    rm -rf "${PUBLISH_TMP_DIR}"
  fi
@@ -134,27 +162,107 @@ on_exit() {

 trap on_exit EXIT

-"${SCRIPT_DIR}/maintenance-on.sh" "spacetime module publish ${DATABASE}"
-
-if [[ "${SKIP_BACKUP}" -ne 1 ]]; then
-  BACKUP_SCRIPT="${SCRIPT_DIR}/../database-backup-to-oss.mjs"
-  if [[ ! -f "${BACKUP_SCRIPT}" ]]; then
-    BACKUP_SCRIPT="${SOURCE_DIR}/scripts/database-backup-to-oss.mjs"
+prepare_async_backup() {
+  ASYNC_BACKUP_SCRIPT="${SCRIPT_DIR}/../database-backup-to-oss.mjs"
+  if [[ ! -f "${ASYNC_BACKUP_SCRIPT}" ]]; then
+    ASYNC_BACKUP_SCRIPT="${SOURCE_DIR}/scripts/database-backup-to-oss.mjs"
  fi
-  if [[ ! -f "${BACKUP_SCRIPT}" ]]; then
-    echo "[production-stdb-publish] 缺少 publish 前数据库备份脚本: ${BACKUP_SCRIPT}" >&2
+  if [[ ! -f "${ASYNC_BACKUP_SCRIPT}" ]]; then
+    echo "[production-stdb-publish] 缺少数据库备份脚本: ${ASYNC_BACKUP_SCRIPT}" >&2
    exit 1
  fi

-  echo "[production-stdb-publish] publish 前执行 OSS 冷备份"
-  node "${BACKUP_SCRIPT}" \
+  ASYNC_BACKUP_STATUS_FILE="$(mktemp /tmp/genarrative-stdb-backup-status.XXXXXX.json)"
+  echo "[production-stdb-publish] publish 前生成本地冷备份，随后会异步上传 OSS"
+  node "${ASYNC_BACKUP_SCRIPT}" \
    --env-file /etc/genarrative/api-server.env \
    --data-dir "${SPACETIME_ROOT_DIR}" \
    --database "${DATABASE}" \
-    --stop-service spacetimedb.service
-else
-  echo "[production-stdb-publish] 已按参数跳过 publish 前数据库备份"
-fi
+    --stop-service spacetimedb.service \
+    --defer-upload \
+    --result-file "${ASYNC_BACKUP_STATUS_FILE}"
+}
+
+start_async_backup_upload() {
+  if [[ -z "${ASYNC_BACKUP_STATUS_FILE}" || ! -f "${ASYNC_BACKUP_STATUS_FILE}" ]]; then
+    echo "[production-stdb-publish] 警告：未找到可上传的本地备份状态文件，跳过异步上传" >&2
+    return 0
+  fi
+
+  ASYNC_BACKUP_ARCHIVE="$(node -e 'const fs=require("node:fs"); const p=process.argv[1]; const o=JSON.parse(fs.readFileSync(p,"utf8")); process.stdout.write(o.archivePath || "");' "${ASYNC_BACKUP_STATUS_FILE}")"
+  ASYNC_BACKUP_MANIFEST="$(node -e 'const fs=require("node:fs"); const p=process.argv[1]; const o=JSON.parse(fs.readFileSync(p,"utf8")); process.stdout.write(o.manifestPath || "");' "${ASYNC_BACKUP_STATUS_FILE}")"
+  if [[ -z "${ASYNC_BACKUP_ARCHIVE}" || -z "${ASYNC_BACKUP_MANIFEST}" ]]; then
+    echo "[production-stdb-publish] 警告：备份状态文件缺少 archivePath 或 manifestPath，跳过异步上传" >&2
+    return 0
+  fi
+
+  mkdir -p "$(dirname "${ASYNC_BACKUP_ARCHIVE}")"
+  ASYNC_BACKUP_LOG="$(dirname "${ASYNC_BACKUP_ARCHIVE}")/${DATABASE}-upload.log"
+  echo "[production-stdb-publish] 后台上传本地备份到 OSS: ${ASYNC_BACKUP_ARCHIVE}"
+  nohup node "${ASYNC_BACKUP_SCRIPT}" \
+    --env-file /etc/genarrative/api-server.env \
+    --upload-archive "${ASYNC_BACKUP_ARCHIVE}" \
+    --manifest-file "${ASYNC_BACKUP_MANIFEST}" \
+    >"${ASYNC_BACKUP_LOG}" 2>&1 &
+  echo "[production-stdb-publish] OSS 后台上传日志: ${ASYNC_BACKUP_LOG}"
+  rm -f "${ASYNC_BACKUP_STATUS_FILE}"
+  ASYNC_BACKUP_STATUS_FILE=""
+}
+
+wait_for_spacetime_ready() {
+  if [[ -z "${SERVER_URL}" ]]; then
+    echo "[production-stdb-publish] 使用 server alias=${SERVER_ALIAS}，跳过 URL 健康检查等待"
+    return 0
+  fi
+
+  local ping_url="${SERVER_URL%/}/v1/ping"
+  local deadline=$((SECONDS + SPACETIME_READY_TIMEOUT_SECONDS))
+  local last_status=""
+
+  echo "[production-stdb-publish] 等待 SpacetimeDB 就绪: ${ping_url}，timeout=${SPACETIME_READY_TIMEOUT_SECONDS}s"
+  while (( SECONDS < deadline )); do
+    # curl 失败时通常表示服务尚未监听；不立即失败，等待冷备份恢复后的 systemd 启动完成。
+    if last_status="$(curl -fsS --max-time 2 "${ping_url}" 2>&1)"; then
+      echo "[production-stdb-publish] SpacetimeDB 已就绪: ${ping_url}"
+      return 0
+    fi
+    sleep 2
+  done
+
+  echo "[production-stdb-publish] SpacetimeDB 未在超时内就绪: ${ping_url}" >&2
+  if [[ -n "${last_status}" ]]; then
+    echo "[production-stdb-publish] 最后一次健康检查输出: ${last_status}" >&2
+  fi
+  return 1
+}
+
+"${SCRIPT_DIR}/maintenance-on.sh" "spacetime module publish ${DATABASE}"
+
+case "${BACKUP_MODE}" in
+  async)
+    prepare_async_backup
+    ;;
+  sync)
+    BACKUP_SCRIPT="${SCRIPT_DIR}/../database-backup-to-oss.mjs"
+    if [[ ! -f "${BACKUP_SCRIPT}" ]]; then
+      BACKUP_SCRIPT="${SOURCE_DIR}/scripts/database-backup-to-oss.mjs"
+    fi
+    if [[ ! -f "${BACKUP_SCRIPT}" ]]; then
+      echo "[production-stdb-publish] 缺少 publish 前数据库备份脚本: ${BACKUP_SCRIPT}" >&2
+      exit 1
+    fi
+
+    echo "[production-stdb-publish] publish 前同步执行 OSS 冷备份，失败会阻断发布"
+    node "${BACKUP_SCRIPT}" \
+      --env-file /etc/genarrative/api-server.env \
+      --data-dir "${SPACETIME_ROOT_DIR}" \
+      --database "${DATABASE}" \
+      --stop-service spacetimedb.service
+    ;;
+  skip)
+    echo "[production-stdb-publish] 已按参数跳过 publish 前数据库备份"
+    ;;
+esac

 echo "[production-stdb-publish] 校验 wasm"
 (
@@ -162,6 +270,8 @@ echo "[production-stdb-publish] 校验 wasm"
  sha256sum -c spacetime_module.wasm.sha256
 )

+wait_for_spacetime_ready
+
 PUBLISH_ARGS=(
  --root-dir="${SPACETIME_ROOT_DIR}"
  publish
@@ -218,4 +328,5 @@ fi

 "${SCRIPT_DIR}/maintenance-off.sh"
 DEPLOY_COMPLETED=1
+
 echo "[production-stdb-publish] 完成"