@akanjs/devkit 3.0.0-beta.26 → 3.0.0-beta.28

package/transforms/serverEnvPlugin.test.ts

@@ -0,0 +1,100 @@
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import { tempDirs, writeText as write } from "../testHelpers";
+import { createServerEnvPlugin } from "./serverEnvPlugin";
+
+const makeTempRoot = tempDirs("akan-devkit-server-env-");
+const environments = ["local", "testing", "debug", "develop", "main", "qa"];
+
+const writeApp = async (root: string) => {
+  const envDir = path.join(root, "apps/demo/env");
+  await write(
+    path.join(envDir, "env.server.ts"),
+    [
+      ...environments.map((name) => `import { env as ${name} } from "./env.server.${name}";`),
+      `const envConfigs = { ${environments.join(", ")} };`,
+      'const currentEnv = process.env.AKAN_PUBLIC_ENV ?? "local";',
+      "export const env = envConfigs[currentEnv as keyof typeof envConfigs];",
+      "",
+    ].join("\n"),
+  );
+  await write(path.join(envDir, "env.server.type.ts"), 'export const libEnv = { shared: "shared-value" };\n');
+  for (const name of environments)
+    await write(
+      path.join(envDir, `env.server.${name}.ts`),
+      [
+        'import { libEnv } from "./env.server.type";',
+        `export const env = { ...libEnv, secret: "${name}-secret" };`,
+        `export default "${name}-default";`,
+        "",
+      ].join("\n"),
+    );
+  const entry = path.join(root, "apps/demo/server.ts");
+  await write(entry, 'import { env } from "./env/env.server";\nconsole.info(JSON.stringify({ ...env }));\n');
+  return { envDir, entry };
+};
+
+const build = async (root: string, environment: string) => {
+  const { envDir, entry } = await writeApp(root);
+  const result = await Bun.build({
+    entrypoints: [entry],
+    outdir: path.join(root, "out"),
+    target: "bun",
+    plugins: [createServerEnvPlugin({ envDir, environment, environments })],
+  });
+  expect(result.success).toBe(true);
+  const output = result.outputs.find((artifact) => artifact.kind === "entry-point");
+  if (!output) throw new Error("no entry output");
+  return { file: output.path, text: await output.text() };
+};
+
+const run = (file: string, environment: string) =>
+  Bun.spawnSync([process.execPath, file], { env: { ...process.env, AKAN_PUBLIC_ENV: environment } });
+
+describe("createServerEnvPlugin", () => {
+  test("bundles only the environment the image runs", async () => {
+    const { text } = await build(await makeTempRoot(), "main");
+    expect(text).toContain("main-secret");
+    expect(text).toContain("shared-value");
+    for (const name of environments.filter((name) => name !== "main")) {
+      expect(text).not.toContain(`${name}-secret`);
+      expect(text).not.toContain(`${name}-default`);
+    }
+  });
+
+  test("the built environment boots with its own values", async () => {
+    const { file } = await build(await makeTempRoot(), "main");
+    const proc = run(file, "main");
+    expect(proc.exitCode).toBe(0);
+    expect(JSON.parse(proc.stdout.toString())).toEqual({ shared: "shared-value", secret: "main-secret" });
+  });
+
+  test("another environment refuses to boot and names the build to make", async () => {
+    const { file } = await build(await makeTempRoot(), "main");
+    const proc = run(file, "develop");
+    expect(proc.exitCode).not.toBe(0);
+    expect(proc.stderr.toString()).toContain(
+      "env/env.server.develop.ts is not in this build: `akan build` bundles the server env of AKAN_PUBLIC_ENV=main alone",
+    );
+  });
+
+  test("a custom branch is its own environment", async () => {
+    const { text } = await build(await makeTempRoot(), "qa");
+    expect(text).toContain("qa-secret");
+    expect(text).not.toContain("main-secret");
+  });
+
+  test("leaves env files outside the app's env directory alone", async () => {
+    const root = await makeTempRoot();
+    const other = path.join(root, "libs/shared/env/env.server.testing.ts");
+    await write(other, 'export const env = { secret: "lib-testing-secret" };\n');
+    const { envDir, entry } = await writeApp(root);
+    await write(entry, `import { env } from ${JSON.stringify(other)};\nconsole.info(env.secret);\n`);
+    const result = await Bun.build({
+      entrypoints: [entry],
+      target: "bun",
+      plugins: [createServerEnvPlugin({ envDir, environment: "main", environments })],
+    });
+    expect(await result.outputs[0]?.text()).toContain("lib-testing-secret");
+  });
+});

package/transforms/serverEnvPlugin.ts

@@ -0,0 +1,41 @@
+import { existsSync, realpathSync } from "node:fs";
+import path from "node:path";
+import type { BunPlugin } from "bun";
+
+export interface ServerEnvPluginOptions {
+  envDir: string;
+  /** The environment the image runs: its Dockerfile fixes `AKAN_PUBLIC_ENV` to it. */
+  environment: string;
+  environments: Iterable<string>;
+}
+
+const escapeRegExp = (value: string) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+//* `env.server.ts` imports every environment's file, so an image would hand out the secrets of each environment it
+//* never runs. Every file but the image's own is swapped for exports that refuse to be read.
+export const createServerEnvPlugin = ({ envDir, environment, environments }: ServerEnvPluginOptions): BunPlugin => {
+  const others = [...new Set(environments)].filter((name) => name !== environment);
+  //? Bun hands onLoad the real path, which differs from the given one under a symlink (macOS's /var -> /private/var).
+  const dirs = new Set([path.resolve(envDir), existsSync(envDir) ? realpathSync.native(envDir) : envDir]);
+  const names = others.map(escapeRegExp).join("|");
+  const filter = new RegExp(`^(?:${[...dirs].map(escapeRegExp).join("|")})[\\\\/]env\\.server\\.(?:${names})\\.ts$`);
+  return {
+    name: "akan-server-env",
+    setup(build) {
+      if (!others.length) return;
+      build.onLoad({ filter }, async (args) => {
+        const name = path.basename(args.path, ".ts").slice("env.server.".length);
+        const { exports } = new Bun.Transpiler({ loader: "ts" }).scan(await Bun.file(args.path).text());
+        const message = `env/env.server.${name}.ts is not in this build: \`akan build\` bundles the server env of AKAN_PUBLIC_ENV=${environment} alone, the environment its image runs. Build with AKAN_PUBLIC_ENV=${name} to run ${name}.`;
+        return {
+          loader: "js",
+          contents: [
+            `const refuse = () => { throw new Error(${JSON.stringify(message)}); };`,
+            "const unbuilt = new Proxy({}, { get: refuse, has: refuse, ownKeys: refuse, getOwnPropertyDescriptor: refuse });",
+            `export { ${exports.map((exported) => `unbuilt as ${JSON.stringify(exported)}`).join(", ")} };`,
+          ].join("\n"),
+        };
+      });
+    },
+  };
+};

package/types.ts

@@ -10,6 +10,7 @@ export interface PackageJson {
   peerDependencies?: Record<string, string>;
   peerDependenciesMeta?: Record<string, { optional?: boolean }>;
   optionalDependencies?: Record<string, string>;
+  trustedDependencies?: string[];
   overrides?: Record<string, string>;
   engines?: Record<string, string>;
   exports?: Record<string, string | Record<string, string>>;

package/workspaceLayout.test.ts

@@ -21,6 +21,11 @@ describe("app root layout allowlist", () => {
     }
   });
 
+  test("admits the native plugins an app owns, and a lib too", () => {
+    expect(appRootAllowedDirs.has("native")).toBe(true);
+    expect(libRootAllowedDirs.has("native")).toBe(true);
+  });
+
   test("rejects an app root entry no facet owns", () => {
     expect(appRootAllowedFiles.has("helper.ts")).toBe(false);
     expect(appRootAllowedDirs.has("base")).toBe(false);

package/workspaceLayout.ts

@@ -21,6 +21,7 @@ export const appRootAllowedDirs = new Set([
   "common",
   "env",
   "lib",
+  "native",
   "page",
   "plugin",
   "private",
@@ -52,6 +53,7 @@ export const libRootAllowedDirs = new Set([
   "common",
   "env",
   "lib",
+  "native",
   "page",
   "plugin",
   "private",