[Feature] Reading file from WebDAV Nginx server

.cspell.json

@@ -37,7 +37,9 @@
     "Multichoice",
     "Gridster",
     "gridster",
-    "datetime"
+    "datetime",
+    "PUID",
+    "PGID"
   ],
   "flagWords": [],
   "ignorePaths": [

.gitattributes

@@ -0,0 +1 @@
+*.sh text eol=lf

.github/workflows/pr-build.yaml

@@ -29,6 +29,12 @@ jobs:
             -   name: Build
                 run: npm run build
 
+            -   name: Build container image
+                run: docker build -t application-builder:smoke .
+
+            -   name: Smoke-test process file storage
+                run: scripts/container-smoke-test.sh application-builder:smoke
+
 #            -   name: Edit Path
 #                run: |
 #                    sed -i 's/SF:.*.src/SF:src/g' coverage/lcov.info

.github/workflows/release-build.yaml

@@ -20,28 +20,37 @@ jobs:
                     username: ${{ secrets.DOCKER_USERNAME }}
                     password: ${{ secrets.DOCKER_AUTH_TOKEN }}
 
+            -   name: Set up QEMU
+                uses: docker/setup-qemu-action@v3
+
+            -   name: Set up Docker Buildx
+                uses: docker/setup-buildx-action@v3
+
             -   name: Read package.json
                 uses: zvonimirsun/read-package-version-actions@v2
                 id: getVersion
 
             -   name: Push Version ${{ steps.getVersion.outputs.version }}
-                uses: docker/build-push-action@v5
+                uses: docker/build-push-action@v6
                 with:
                     push: true
+                    platforms: linux/amd64,linux/arm64
                     tags: netgrif/application-builder:${{ steps.getVersion.outputs.version }}
 
             -   name: Push Latest
                 if: ${{ !contains(steps.getVersion.outputs.version, '-') }}
-                uses: docker/build-push-action@v5
+                uses: docker/build-push-action@v6
                 with:
                     push: true
+                    platforms: linux/amd64,linux/arm64
                     tags: netgrif/application-builder:latest
 
             -   name: Push Next
                 if: ${{ contains(steps.getVersion.outputs.version, '-') }}
-                uses: docker/build-push-action@v5
+                uses: docker/build-push-action@v6
                 with:
                     push: true
+                    platforms: linux/amd64,linux/arm64
                     tags: netgrif/application-builder:next
 
     publish-assets:

Dockerfile

@@ -1,13 +1,27 @@
-FROM node:18 as build
+FROM node:18.20.8 AS build
 MAINTAINER NETGRIF <devops@netgrif.com>
 WORKDIR /app
 COPY . .
 RUN npm install --legacy-peer-deps
 RUN npm run build
 
-FROM nginx:alpine
+FROM nginx/nginx-unprivileged:1.31.8-alpine-slim
+
 MAINTAINER NETGRIF <devops@netgrif.com>
+
+USER root
+
+RUN apk add --no-cache su-exec gettext-envsubst libcap-utils curl \
+    && setcap cap_net_bind_service=+ep /usr/sbin/nginx \
+    && getcap /usr/sbin/nginx | grep -q cap_net_bind_service \
+    && nginx -V 2>&1 | grep -q -- '--with-http_dav_module'
+
 COPY default.nginx.conf /etc/nginx/conf.d/default.conf
+COPY process-files.nginx.conf /etc/nginx/process-files-enabled.conf
 COPY --from=build /app/dist/application-builder/ /usr/share/nginx/html/
+COPY entrypoint.sh /usr/local/bin/application-builder-entrypoint
+
+RUN chmod 755 /usr/local/bin/application-builder-entrypoint
+
 EXPOSE 80
-ENTRYPOINT ["/bin/sh","-c","envsubst < /usr/share/nginx/html/env.template.js > /usr/share/nginx/html/env.js && exec nginx -g 'daemon off;'"]
+ENTRYPOINT ["/usr/local/bin/application-builder-entrypoint"]

README.md

@@ -15,7 +15,7 @@ Petriflow processes can be run/interpreted in Netgrif Application Engine.
 Live build: [https://builder.netgrif.cloud](https://builder.netgrif.cloud)
 
 Application Builder consists of several modules that helps with development of business processes, application's dataset, permission schema, and many more.
-Builder can be deployed as is directly from the release artifact or as a docker container. It doesn't save your work on any server. It works only in a browser.
+Builder can be deployed as is directly from the release artifact or as a Docker container. By default, work stays in the browser; the container's optional process-file storage writes only to an explicitly mounted directory and is disabled unless enabled at startup.
 
 * Petriflow low-code language: [http://petriflow.com](https://petriflow.com)
 * Netgrif Application Engine: [NAE repository](https://github.com/netgrif/application-engine), [NAE documentation](https://engine.netgrif.com)
@@ -38,6 +38,51 @@ npm i --legacy-peer-deps
 npm run start
 ```
 
+### Optional process-file storage
+
+The container can store process files on a mounted directory. Each Petriflow
+application has its own subdirectory, for example
+`processes/demo-app/demo-app.xml`.
+The reserved `manifest.xml` file is not treated as a process model. Process-file
+storage is disabled by default; enable it only on a trusted/private instance.
+The **Save process file** toolbar action appears only when
+`PROCESS_FILES_ENABLED=true`.
+
+```shell
+mkdir -p processes/demo-app
+docker build -t application-builder:local .
+docker run --rm -p 18080:80 \
+  -e PROCESS_FILES_ENABLED=true \
+  -v "$PWD/processes:/data/processes:z" \
+  application-builder:local
+```
+
+Open `http://localhost:18080/?process=demo-app/demo-app.xml` to load a named
+model. For a new model, Save uses its model ID for both the app directory and
+the XML filename (`<model-id>/<model-id>.xml`). For a loaded model, Save keeps
+the path it was opened from.
+For local Angular development, start the storage container as above and run
+`npm run start`; the dev-server proxy forwards `/processes` to port `18080`.
+
+The mounted directory must contain a writable subdirectory for each app. The
+entrypoint uses the mounted directory's numeric owner by default. You can set
+`PUID` and `PGID` to select another non-root owner; the selected user must be
+able to write to the mount, and `PUID=0` is refused.
+When an ETag check finds the file has changed, the UI offers reload, overwrite,
+or cancel. This detects changes made before the save check, but Nginx DAV does
+not make the subsequent PUT conditional; simultaneous writers can still race.
+
+To verify the SPA flow manually, create
+`processes/demo-app/demo-app.xml`, open
+`http://localhost:18080/?process=demo-app/demo-app.xml`, change a model property,
+press **Save process file**, and confirm the mounted XML changed. The image
+smoke test checks the HTTP listing, PUT/GET behavior, manifest exclusion, and
+host ownership:
+
+```shell
+scripts/container-smoke-test.sh application-builder:local
+```
+
 ## Other projects
 
 ### Application Engine

angular.json

@@ -96,7 +96,9 @@
                 },
                 "serve": {
                     "builder": "@angular-devkit/build-angular:dev-server",
-                    "options": {},
+                    "options": {
+                        "proxyConfig": "proxy.conf.json"
+                    },
                     "configurations": {
                         "production": {
                             "buildTarget": "application-builder:build:production"

default.nginx.conf

@@ -10,9 +10,16 @@ server {
   listen 80;
   root /usr/share/nginx/html;
   index index.html index.htm;
+  location = /processes {
+      return 308 /processes/;
+  }
+  location /processes/ {
+      return 404;
+  }
+  include /etc/nginx/process-files.conf;
   location / {
       try_files $uri $uri/ /index.html;
-    }
+  }
   expires $expires;
   gzip  on;
 }

entrypoint.sh

@@ -0,0 +1,51 @@
+#!/bin/sh
+set -eu
+
+envsubst < /usr/share/nginx/html/env.template.js > /usr/share/nginx/html/env.js
+
+if [ "${PROCESS_FILES_ENABLED:-false}" = "true" ]; then
+    if [ ! -d /data/processes ]; then
+        echo "PROCESS_FILES_ENABLED=true requires /data/processes to be mounted." >&2
+        exit 1
+    fi
+    cp /etc/nginx/process-files-enabled.conf /etc/nginx/process-files.conf
+    if [ -n "${PUID:-}" ]; then
+            process_uid=$PUID
+            process_gid=${PGID:-$PUID}
+        else
+            process_owner=$(stat -c '%u:%g' /data/processes)
+            process_uid=${process_owner%:*}
+            process_gid=${process_owner#*:}
+        fi
+        case "$process_uid$process_gid" in
+            ''|*[!0-9]*) echo "PUID and PGID must be numeric." >&2; exit 1 ;;
+        esac
+        if [ "$process_uid" = "0" ]; then
+            host_root_uid=$(awk '$1 == 0 {print $2; exit}' /proc/self/uid_map)
+            if [ -z "$host_root_uid" ] || [ "$host_root_uid" = "0" ]; then
+                if [ -n "${PUID:-}" ]; then
+                    echo "Refusing to run process storage as host root (PUID=0)." >&2
+                    exit 1
+                fi
+                echo "WARNING: /data/processes looks root-owned; running as 101:101. Set PUID and PGID to choose another user." >&2
+                process_uid=101
+                process_gid=101
+            fi
+        fi
+        if ! su-exec "$process_uid:$process_gid" test -w /data/processes; then
+            echo "User $process_uid:$process_gid cannot write to /data/processes. Set PUID and PGID to the owner of the mounted folder." >&2
+            exit 1
+        fi
+else
+    : > /etc/nginx/process-files.conf
+    process_uid=101
+    process_gid=101
+fi
+
+chmod 644 /etc/nginx/process-files.conf
+nginx -t
+nginx_globals='daemon off;'
+if [ "$process_uid" = "0" ]; then
+    nginx_globals='daemon off; user root;'
+fi
+exec su-exec "$process_uid:$process_gid" nginx -g "$nginx_globals"