@ankhorage/infra 0.0.0 → 0.2.0

package/src/adapters/minikube/auth/supabase/index.ts

@@ -10,10 +10,12 @@ export function generateSupabaseAuthArtifacts(args: {
   const root = 'infra/minikube/k8s/auth/supabase';
   const resourceRoot = 'auth/supabase';
   const docsRoot = 'infra/minikube/auth';
+  const migrationRoot = 'infra/minikube/supabase/migrations';
   const scope = manifest.auth?.scope ?? 'global';
   const authzEngine = manifest.auth?.authorization.engine ?? 'native';
   const authzKind = manifest.auth?.authorization.kind ?? 'RBAC';
   const authFieldModel = resolveAuthFieldModel(manifest);
+  const profileModel = resolveProfileModel(manifest);
 
   const warnings: string[] = [];
   if (scope !== 'global') {
@@ -32,6 +34,7 @@ export function generateSupabaseAuthArtifacts(args: {
           authzEngine,
           authzKind,
           authFieldModel,
+          profileModel,
         }),
       },
       {
@@ -46,11 +49,20 @@ export function generateSupabaseAuthArtifacts(args: {
           authzEngine,
           authzKind,
           authFieldModel,
+          profileModel,
         }),
       },
+      ...(profileModel.enabled
+        ? [
+            {
+              path: `${migrationRoot}/0001_auth_profiles.sql`,
+              content: getSupabaseProfileMigration(profileModel),
+            },
+          ]
+        : []),
       {
         path: `${docsRoot}/supabase-runtime-wiring.md`,
-        content: getSupabaseRuntimeWiringGuide(),
+        content: getSupabaseRuntimeWiringGuide(profileModel),
       },
     ],
     resources: [
@@ -77,8 +89,9 @@ function getSupabaseConfigMap(args: {
   authzEngine: string;
   authzKind: string;
   authFieldModel: ResolvedAuthFieldModel;
+  profileModel: ResolvedProfileModel;
 }) {
-  const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;
+  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
 
   return `apiVersion: v1
 kind: ConfigMap
@@ -95,6 +108,10 @@ data:
   AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
   AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
   AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
+  AUTH_PROFILE_TABLE: "${escapeYamlDoubleQuoted(profileModel.table)}"
+  AUTH_PROFILE_PRIMARY_KEY: "${profileModel.primaryKey}"
+  AUTH_PROFILE_CREATE_STRATEGY: "${profileModel.createStrategy}"
+  AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
 `;
 }
 
@@ -121,8 +138,9 @@ function getRuntimeAuthEnvConfigMap(args: {
   authzEngine: string;
   authzKind: string;
   authFieldModel: ResolvedAuthFieldModel;
+  profileModel: ResolvedProfileModel;
 }) {
-  const { namespace, scope, authzEngine, authzKind, authFieldModel } = args;
+  const { namespace, scope, authzEngine, authzKind, authFieldModel, profileModel } = args;
 
   return `apiVersion: v1
 kind: ConfigMap
@@ -140,12 +158,33 @@ data:
   AUTH_SIGN_UP_OPTIONAL_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.signUpOptionalFieldsCsv)}"
   AUTH_SIGN_UP_POLICY: "${authFieldModel.signUpPolicy}"
   AUTH_PROFILE_FIELDS: "${escapeYamlDoubleQuoted(authFieldModel.profileFieldsCsv)}"
+  AUTH_PROFILE_TABLE: "${escapeYamlDoubleQuoted(profileModel.table)}"
+  AUTH_PROFILE_PRIMARY_KEY: "${profileModel.primaryKey}"
+  AUTH_PROFILE_CREATE_STRATEGY: "${profileModel.createStrategy}"
+  AUTH_PROFILE_UPDATE_STRATEGY: "${profileModel.updateStrategy}"
   AUTH_TOKEN_HEADER: "Authorization"
   AUTH_TOKEN_PREFIX: "Bearer"
 `;
 }
 
-function getSupabaseRuntimeWiringGuide() {
+function getSupabaseRuntimeWiringGuide(profileModel: ResolvedProfileModel) {
+  const profileSection = profileModel.enabled
+    ? `
+## App Profile Table
+
+Identity remains provider-owned in \`auth.users\`. App-facing profile data is generated in
+\`public.${profileModel.table}\` and linked through \`${profileModel.table}.id -> auth.users.id\`.
+
+The generated migration:
+
+- creates the profile table
+- enables row-level security
+- allows signed-in users to read and update their own profile row
+- protects the generated \`role\` column from self-service profile updates
+- creates a trigger for new auth users when \`AUTH_PROFILE_CREATE_STRATEGY=trigger\`
+`
+    : '';
+
   return `# Supabase Runtime Wiring
 
 This file documents the runtime conventions generated by the minikube Supabase adapter.
@@ -188,6 +227,10 @@ with \`optional: true\` for auth sources.
 - \`AUTH_SIGN_UP_OPTIONAL_FIELDS\`
 - \`AUTH_SIGN_UP_POLICY\`
 - \`AUTH_PROFILE_FIELDS\`
+- \`AUTH_PROFILE_TABLE\`
+- \`AUTH_PROFILE_PRIMARY_KEY\`
+- \`AUTH_PROFILE_CREATE_STRATEGY\`
+- \`AUTH_PROFILE_UPDATE_STRATEGY\`
 - \`SUPABASE_SECRET_SYNC_ENABLED\`
 - \`SUPABASE_URL\`
 - \`SUPABASE_ANON_KEY\`
@@ -195,7 +238,7 @@ with \`optional: true\` for auth sources.
 - \`SUPABASE_JWT_SECRET\`
 - \`EXPO_PUBLIC_SUPABASE_URL\`
 - \`EXPO_PUBLIC_SUPABASE_ANON_KEY\`
-
+${profileSection}
 ## Secret Sync
 
 When \`SUPABASE_SECRET_SYNC_ENABLED=true\`, \`scripts/up.sh\` will create/update
@@ -208,6 +251,9 @@ const DEFAULT_SIGN_UP_REQUIRED_FIELDS = ['email', 'password'];
 const DEFAULT_SIGN_UP_OPTIONAL_FIELDS = ['firstName', 'lastName'];
 const DEFAULT_SIGN_UP_POLICY = 'autoSignIn';
 const DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];
+const DEFAULT_PROFILE_PRIMARY_KEY = 'authUserId';
+const DEFAULT_PROFILE_CREATE_STRATEGY = 'trigger';
+const DEFAULT_PROFILE_UPDATE_STRATEGY = 'api';
 
 interface ResolvedAuthFieldModel {
   signInIdentifiersCsv: string;
@@ -217,6 +263,22 @@ interface ResolvedAuthFieldModel {
   profileFieldsCsv: string;
 }
 
+interface ProfileColumnSpec {
+  readonly field: string;
+  readonly column: string;
+  readonly sqlType: string;
+  readonly fromNewUser: string;
+}
+
+interface ResolvedProfileModel {
+  readonly enabled: boolean;
+  readonly table: string;
+  readonly primaryKey: string;
+  readonly createStrategy: string;
+  readonly updateStrategy: string;
+  readonly columns: readonly ProfileColumnSpec[];
+}
+
 function resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldModel {
   const signInIdentifiers = normalizeFieldList(
     manifest.auth?.signIn?.identifiers,
@@ -242,6 +304,164 @@ function resolveAuthFieldModel(manifest: InfraManifestInput): ResolvedAuthFieldM
   };
 }
 
+function resolveProfileModel(manifest: InfraManifestInput): ResolvedProfileModel {
+  const table = normalizeIdentifier(manifest.auth?.profile?.table ?? '');
+  const fields = normalizeFieldList(manifest.auth?.profile?.fields, DEFAULT_PROFILE_FIELDS);
+
+  return {
+    enabled: table.length > 0,
+    table,
+    primaryKey: manifest.auth?.profile?.primaryKey ?? DEFAULT_PROFILE_PRIMARY_KEY,
+    createStrategy: manifest.auth?.profile?.createStrategy ?? DEFAULT_PROFILE_CREATE_STRATEGY,
+    updateStrategy: manifest.auth?.profile?.updateStrategy ?? DEFAULT_PROFILE_UPDATE_STRATEGY,
+    columns: resolveProfileColumns(fields),
+  };
+}
+
+function getSupabaseProfileMigration(profileModel: ResolvedProfileModel): string {
+  const table = quoteIdentifier(profileModel.table);
+  const functionName = quoteIdentifier(`handle_new_${profileModel.table}_user`);
+  const triggerName = quoteIdentifier(`on_auth_user_created_${profileModel.table}`);
+  const columnDefinitions = profileModel.columns
+    .map((column) => `  ${quoteIdentifier(column.column)} ${column.sqlType}`)
+    .join(',\n');
+  const insertColumns = ['id', ...profileModel.columns.map((column) => column.column)]
+    .map(quoteIdentifier)
+    .join(', ');
+  const insertValues = ['new.id', ...profileModel.columns.map((column) => column.fromNewUser)].join(
+    ', ',
+  );
+  const updateAssignments = profileModel.columns
+    .filter((column) => column.field === 'email')
+    .map(
+      (column) => `${quoteIdentifier(column.column)} = excluded.${quoteIdentifier(column.column)}`,
+    );
+  const conflictUpdate = [...updateAssignments, 'updated_at = now()'].join(',\n    ');
+  const updateGrantColumns = profileModel.columns.map((column) => quoteIdentifier(column.column));
+  const updateGrantSql =
+    updateGrantColumns.length > 0
+      ? `grant update (${updateGrantColumns.join(', ')}) on table public.${table} to authenticated;\n`
+      : '';
+  const triggerSql =
+    profileModel.createStrategy === 'trigger'
+      ? `
+create or replace function public.${functionName}()
+returns trigger
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+  insert into public.${table} (${insertColumns})
+  values (${insertValues})
+  on conflict (id) do update set
+    ${conflictUpdate};
+
+  return new;
+end;
+$$;
+
+drop trigger if exists ${triggerName} on auth.users;
+create trigger ${triggerName}
+  after insert on auth.users
+  for each row execute function public.${functionName}();
+`
+      : '';
+
+  return `-- Generated by @ankhorage/infra from manifest.infra.auth.profile.
+-- Supabase Auth owns identity in auth.users. App-facing profile data lives in public.${profileModel.table}.
+
+create table if not exists public.${table} (
+  id uuid primary key references auth.users(id) on delete cascade${
+    columnDefinitions ? `,\n${columnDefinitions}` : ''
+  },
+  role text not null default 'user',
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+alter table public.${table} enable row level security;
+
+revoke all on table public.${table} from anon, authenticated;
+grant select on table public.${table} to authenticated;
+${updateGrantSql}
+create policy ${quoteIdentifier(`${profileModel.table}_select_own`)}
+  on public.${table}
+  for select
+  using (auth.uid() = id);
+
+create policy ${quoteIdentifier(`${profileModel.table}_update_own`)}
+  on public.${table}
+  for update
+  using (auth.uid() = id)
+  with check (auth.uid() = id);
+${triggerSql}`;
+}
+
+function resolveProfileColumns(fields: readonly string[]): ProfileColumnSpec[] {
+  const columns = new Map<string, ProfileColumnSpec>();
+
+  for (const field of fields) {
+    const column = mapProfileFieldToColumn(field);
+    if (!column || columns.has(column.column)) {
+      continue;
+    }
+    columns.set(column.column, column);
+  }
+
+  return [...columns.values()];
+}
+
+function mapProfileFieldToColumn(field: string): ProfileColumnSpec | null {
+  switch (field) {
+    case 'email':
+      return { field, column: 'email', sqlType: 'text', fromNewUser: 'new.email' };
+    case 'displayName':
+      return {
+        field,
+        column: 'display_name',
+        sqlType: 'text',
+        fromNewUser:
+          "coalesce(new.raw_user_meta_data->>'displayName', new.raw_user_meta_data->>'display_name', split_part(new.email, '@', 1))",
+      };
+    case 'firstName':
+      return {
+        field,
+        column: 'first_name',
+        sqlType: 'text',
+        fromNewUser:
+          "coalesce(new.raw_user_meta_data->>'firstName', new.raw_user_meta_data->>'first_name')",
+      };
+    case 'lastName':
+      return {
+        field,
+        column: 'last_name',
+        sqlType: 'text',
+        fromNewUser:
+          "coalesce(new.raw_user_meta_data->>'lastName', new.raw_user_meta_data->>'last_name')",
+      };
+    case 'avatarUrl':
+      return {
+        field,
+        column: 'avatar_url',
+        sqlType: 'text',
+        fromNewUser:
+          "coalesce(new.raw_user_meta_data->>'avatarUrl', new.raw_user_meta_data->>'avatar_url')",
+      };
+    case 'username':
+      return {
+        field,
+        column: 'username',
+        sqlType: 'text',
+        fromNewUser: "new.raw_user_meta_data->>'username'",
+      };
+    case 'phone':
+      return { field, column: 'phone', sqlType: 'text', fromNewUser: 'new.phone' };
+    default:
+      return null;
+  }
+}
+
 function normalizeFieldList(
   values: readonly string[] | undefined,
   fallback: readonly string[],
@@ -264,6 +484,23 @@ function normalizeFieldList(
   return [...fallback];
 }
 
+function normalizeIdentifier(value: string): string {
+  const trimmed = value.trim();
+  if (!trimmed) return '';
+
+  if (!/^[a-z_][a-z0-9_]*$/.test(trimmed)) {
+    throw new Error(
+      `Invalid Supabase profile table identifier "${trimmed}". Use snake_case letters, numbers, and underscores.`,
+    );
+  }
+
+  return trimmed;
+}
+
+function quoteIdentifier(value: string): string {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+
 function escapeYamlDoubleQuoted(value: string): string {
   return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
 }

package/src/adapters/minikube/index.ts

@@ -1,4 +1,4 @@
-import { generateDatasetInfrastructureArtifacts } from '../../datasets';
+import { generateApiInfrastructureArtifacts } from '../../apis';
 import type {
   GeneratedPackageDependency,
   InfraManifestInput,
@@ -37,7 +37,7 @@ export function generateMinikubeInfra(
     appManifest: options.appManifest,
   });
   const storageArtifacts = generateStorageArtifacts({ manifest, namespace });
-  const datasetArtifacts = generateDatasetInfrastructureArtifacts({
+  const apiArtifacts = generateApiInfrastructureArtifacts({
     data: options.appManifest?.data,
     databaseProvider: manifest.database?.provider,
   });
@@ -65,7 +65,7 @@ export function generateMinikubeInfra(
     ...authArtifacts.warnings,
     ...authzArtifacts.warnings,
     ...storageArtifacts.warnings,
-    ...datasetArtifacts.warnings,
+    ...apiArtifacts.warnings,
   ]);
 
   return {
@@ -74,7 +74,7 @@ export function generateMinikubeInfra(
       ...authArtifacts.files,
       ...authzArtifacts.files,
       ...storageArtifacts.files,
-      ...datasetArtifacts.files,
+      ...apiArtifacts.files,
     ],
     warnings,
     meta: {

package/src/apis.test.ts

@@ -0,0 +1,211 @@
+import type { AppManifest } from '@ankhorage/contracts';
+import { describe, expect, test } from 'bun:test';
+
+import { generateInfrastructure } from './index';
+import type { InfraManifestInput } from './types';
+
+describe('API infrastructure generation', () => {
+  test('generates provider-neutral API, seed, handlers, and OpenAPI artifacts', () => {
+    const manifest: InfraManifestInput = {
+      deployment: {
+        target: 'minikube',
+        monitoring: false,
+      },
+      database: {
+        provider: 'supabase',
+        tier: 'dev',
+      },
+      plugins: [],
+    };
+
+    const appManifest: Pick<
+      AppManifest,
+      'data' | 'metadata' | 'navigator' | 'screens' | 'settings'
+    > = {
+      metadata: {
+        name: 'Cards',
+        slug: 'cards',
+        version: '1.0.0',
+        themeId: 'default',
+      },
+      data: {
+        apis: {
+          poker_situations: {
+            id: 'poker_situations',
+            kind: 'generated',
+            label: 'Poker situations',
+            description: 'App-owned poker trainer situations.',
+            basePath: '/api/poker-situations',
+            preset: 'crud',
+            resource: {
+              kind: 'collection',
+              collection: {
+                name: 'poker_situations',
+                primaryKey: 'id',
+                fields: [
+                  { name: 'id', type: 'uuid', required: true, unique: true },
+                  { name: 'title', type: 'text', required: true },
+                  { name: 'description', type: 'text', required: true },
+                  { name: 'availableActions', type: 'json' },
+                  { name: 'correctAction', type: 'text' },
+                ],
+              },
+              seed: [
+                {
+                  title: 'Button faces a raise',
+                  description: 'Choose the best action with position and stack depth in mind.',
+                  availableActions: [
+                    { label: 'Fold', value: 'fold' },
+                    { label: 'Call', value: 'call' },
+                    { label: 'Raise', value: 'raise' },
+                  ],
+                  correctAction: 'raise',
+                },
+              ],
+            },
+            endpoints: [
+              {
+                id: 'poker_situations.list',
+                method: 'GET',
+                path: '/',
+                intent: 'list',
+              },
+              {
+                id: 'poker_situations.read',
+                method: 'GET',
+                path: '/{id}',
+                intent: 'read',
+              },
+              {
+                id: 'poker_situations.create',
+                method: 'POST',
+                path: '/',
+                intent: 'create',
+              },
+              {
+                id: 'poker_situations.leaderboard',
+                method: 'GET',
+                path: '/leaderboard',
+                intent: 'custom',
+              },
+            ],
+          },
+        },
+      },
+      navigator: {
+        type: 'stack',
+        routes: [],
+      },
+      screens: {},
+      settings: {
+        localization: {
+          defaultLocale: 'en',
+          locales: ['en'],
+        },
+        authFlow: {
+          signInRoute: '/sign-in',
+          signUpRoute: '/sign-up',
+          signOutRoute: '/sign-out',
+          unauthorizedRoute: '/sign-in',
+          postSignInRoute: '/',
+        },
+      },
+    };
+
+    const result = generateInfrastructure(manifest, { namespaceHint: 'cards', appManifest });
+    const rerun = generateInfrastructure(manifest, { namespaceHint: 'cards', appManifest });
+    const paths = result.files.map((file) => file.path);
+
+    expect(result.files).toEqual(rerun.files);
+    expect(paths).toContain('infra/minikube/db/apis.json');
+    expect(paths).toContain('infra/minikube/db/api-seed.json');
+    expect(paths).toContain('infra/minikube/db/migrations/001_apis.sql');
+    expect(paths).toContain('infra/minikube/db/seeds/001_api_seed.sql');
+    expect(paths).toContain('infra/minikube/db/README.md');
+    expect(paths).toContain('src/generated/apis/resources.ts');
+    expect(paths).toContain('src/generated/apis/appApi.ts');
+    expect(paths).toContain('src/generated/apis/apiHandlers.ts');
+    expect(paths).toContain('src/generated/apis/openapi.json');
+    expect(paths.some((path) => path.includes('datasets'))).toBe(false);
+
+    const resourcesFile = result.files.find(
+      (file) => file.path === 'src/generated/apis/resources.ts',
+    );
+    expect(resourcesFile?.content).toContain('GENERATED_APIS');
+    expect(resourcesFile?.content).toContain('poker_situations');
+    expect(resourcesFile?.content).toContain('availableActions');
+
+    const apiFile = result.files.find((file) => file.path === 'src/generated/apis/appApi.ts');
+    expect(apiFile?.content).toContain('poker_situations.list');
+    expect(apiFile?.content).toContain('/api/poker-situations');
+    expect(apiFile?.content).toContain('poker_situations.read');
+    expect(apiFile?.content).toContain('/api/poker-situations/{id}');
+    expect(apiFile?.content).toContain('poker_situations.leaderboard');
+    expect(apiFile?.content).toContain('/api/poker-situations/leaderboard');
+
+    const handlersFile = result.files.find(
+      (file) => file.path === 'src/generated/apis/apiHandlers.ts',
+    );
+    expect(handlersFile?.content).toContain('handleGeneratedApiList');
+    expect(handlersFile?.content).toContain('handleGeneratedApiCreate');
+    expect(handlersFile?.content).toContain('createGeneratedApiMemoryStore');
+    expect(handlersFile?.content).toContain('poker_situations');
+    expect(handlersFile?.content).not.toContain('Dataset');
+
+    const openApiFile = result.files.find(
+      (file) => file.path === 'src/generated/apis/openapi.json',
+    );
+    expect(openApiFile?.content).toContain('Generated app API');
+    expect(openApiFile?.content).toContain('poker_situations.create');
+    expect(openApiFile?.content).toContain('poker_situations.leaderboard');
+    expect(openApiFile?.content).toContain('x-ankh-api');
+    expect(openApiFile?.content).not.toContain('x-ankh-dataset');
+
+    const migrationFile = result.files.find(
+      (file) => file.path === 'infra/minikube/db/migrations/001_apis.sql',
+    );
+    expect(migrationFile?.content).toContain('create extension if not exists pgcrypto');
+    expect(migrationFile?.content).toContain(
+      'create table if not exists "public"."poker_situations"',
+    );
+    expect(migrationFile?.content).toContain('"id" uuid default gen_random_uuid() primary key');
+    expect(migrationFile?.content).toContain('"availableActions" jsonb');
+
+    const seedFile = result.files.find((file) => file.path === 'infra/minikube/db/api-seed.json');
+    expect(seedFile?.content).toContain('Button faces a raise');
+    expect(seedFile?.content).toContain('correctAction');
+    expect(seedFile?.content).toContain('"id"');
+
+    const seedSqlFile = result.files.find(
+      (file) => file.path === 'infra/minikube/db/seeds/001_api_seed.sql',
+    );
+    expect(seedSqlFile?.content).toContain('insert into "public"."poker_situations"');
+    expect(seedSqlFile?.content).toContain('Button faces a raise');
+    expect(seedSqlFile?.content).toContain('on conflict ("id") do nothing');
+  });
+
+  test('reports selected state adapter dependencies', () => {
+    const manifest: InfraManifestInput = {
+      deployment: {
+        target: 'minikube',
+        monitoring: false,
+      },
+      state: {
+        provider: 'legend',
+        persistence: 'none',
+      },
+      plugins: [],
+    };
+
+    const result = generateInfrastructure(manifest, { namespaceHint: 'cards' });
+
+    expect(result.meta.providers).toContain('legend');
+    expect(result.dependencies).toEqual([
+      {
+        name: '@ankhorage/state-legend',
+        version: '^0.1.0',
+        reason: 'Selected by infra.state.provider=legend.',
+      },
+    ]);
+  });
+});