Pre-computed merge for change #1

El cliente S3 lee osRelease; sin --allow-sys el ping a R2 falla
con NotCapable aunque endpoint y bucket estén bien.

Co-authored-by: alberto.martinez <alberto.martinez@mrdev.mx>

.github/workflows/ci.yml

@@ -103,7 +103,7 @@ jobs:
         working-directory: api
         env:
           DATABASE_URL_CORE_OWNER: postgresql://panels_core_owner:ci-core-owner@localhost:5432/panels_product
-        run: deno test --allow-net --allow-read --allow-write --allow-env
+        run: deno test --allow-net --allow-read --allow-write --allow-env --allow-sys
 
   web:
     runs-on: ubuntu-latest

Dockerfile.api

@@ -20,4 +20,5 @@ EXPOSE 8000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
   CMD ["deno", "eval", "const r=await fetch('http://127.0.0.1:'+(Deno.env.get('PORT')||'8000')+'/v1/health'); if(!r.ok) Deno.exit(1)"]
 
-CMD ["deno", "run", "--allow-net", "--allow-read", "--allow-write", "--allow-env", "main.ts"]
+# --allow-sys: AWS SDK v3 (R2) lee osRelease; sin esto Deno lanza NotCapable.
+CMD ["deno", "run", "--allow-net", "--allow-read", "--allow-write", "--allow-env", "--allow-sys", "main.ts"]

api/deno.json

@@ -2,11 +2,11 @@
   "name": "panel-obra-api",
   "exports": "./main.ts",
   "tasks": {
-    "dev": "deno run --allow-net --allow-read --allow-write --allow-env --env-file=../.env main.ts",
+    "dev": "deno run --allow-net --allow-read --allow-write --allow-env --allow-sys --env-file=../.env main.ts",
-    "start": "deno run --allow-net --allow-read --allow-write --allow-env main.ts",
+    "start": "deno run --allow-net --allow-read --allow-write --allow-env --allow-sys main.ts",
     "migrate": "cd .. && ./db/update.sh all",
     "check": "deno check main.ts",
-    "test": "deno test --allow-net --allow-read --allow-write --allow-env"
+    "test": "deno test --allow-net --allow-read --allow-write --allow-env --allow-sys"
   },
   "imports": {
     "hono": "jsr:@hono/hono@4",

api/scripts/verify-storage.ts

@@ -3,7 +3,7 @@
  * R2 suele devolver 403 con tokens acotados al bucket.
  *
  * Desde api/:
- *   deno run --allow-net --allow-env --allow-read --allow-write scripts/verify-storage.ts
+ *   deno run --allow-net --allow-env --allow-read --allow-write --allow-sys scripts/verify-storage.ts
  *
  * Requiere S3_ENDPOINT, S3_BUCKET, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY.
  * Si REQUIRE_S3=1 y no hay credenciales, sale con error (staging/prod).

db/provision/verify-connectivity.sh

@@ -60,7 +60,7 @@ need REDIS_URL_CORE && check "core redis PING" redis-cli -u "$REDIS_URL_CORE" PI
 
 echo "== Contabo (S3) =="
 if command -v deno >/dev/null 2>&1; then
-  if (cd "$ROOT/api" && REQUIRE_S3="${REQUIRE_S3:-}" deno run --allow-net --allow-env --allow-read --allow-write scripts/verify-storage.ts); then
+  if (cd "$ROOT/api" && REQUIRE_S3="${REQUIRE_S3:-}" deno run --allow-net --allow-env --allow-read --allow-write --allow-sys scripts/verify-storage.ts); then
     :
   else
     fail=1