@ankhorage/infra 0.3.7 → 0.4.0

package/src/adapters/minikube/secrets/supabase-vault/index.ts

@@ -0,0 +1,91 @@
+import {
+  SUPABASE_VAULT_MIGRATION_SQL,
+  SUPABASE_VAULT_SECRET_STORE_PROVIDER,
+} from '@ankhorage/supabase-vault';
+
+import type { InfraManifestInput } from '../../../../types';
+import type { MinikubeAdapterArtifacts } from '../../contracts';
+
+export const SUPABASE_VAULT_MIGRATION_PATH =
+  'infra/minikube/supabase/migrations/202607120001_ankhorage_supabase_vault.sql';
+
+export function generateSupabaseVaultSecretStoreArtifacts(args: {
+  readonly manifest: InfraManifestInput;
+  readonly namespace: string;
+}): MinikubeAdapterArtifacts {
+  validateOAuthSecretReferences(args.manifest);
+
+  return {
+    files: [
+      {
+        path: SUPABASE_VAULT_MIGRATION_PATH,
+        content: `${SUPABASE_VAULT_MIGRATION_SQL.trim()}\n`,
+      },
+      {
+        path: 'infra/minikube/secrets/supabase-vault.md',
+        content: getRuntimeGuide(args.namespace),
+      },
+    ],
+    resources: [],
+    envEntries: [
+      `SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`,
+      'SUPABASE_LOCAL_ENABLED=true',
+    ],
+    warnings: [],
+  };
+}
+
+function validateOAuthSecretReferences(manifest: InfraManifestInput): void {
+  const oauth = manifest.auth?.oauth;
+  if (!oauth?.enabled) return;
+
+  const enabledProviders = oauth.providers.filter((provider) => provider.enabled !== false);
+  if (enabledProviders.length === 0) {
+    throw new Error('OAuth is enabled but no OAuth provider is enabled.');
+  }
+
+  for (const provider of enabledProviders) {
+    if (!provider.credentialsRef?.trim()) {
+      throw new Error(
+        `OAuth provider "${provider.id}" is enabled but does not define credentialsRef.`,
+      );
+    }
+  }
+}
+
+function getRuntimeGuide(namespace: string): string {
+  return `# Supabase Vault secret store
+
+This project selects the provider-neutral secret-store backend through:
+
+\`\`\`text
+infra.secretStore.provider = ${SUPABASE_VAULT_SECRET_STORE_PROVIDER}
+\`\`\`
+
+The immutable migration at:
+
+\`\`\`text
+${SUPABASE_VAULT_MIGRATION_PATH}
+\`\`\`
+
+is applied by the existing local Supabase migration lifecycle during \`scripts/up.sh\`.
+
+## Security boundary
+
+- Secret values are stored only through Supabase Vault.
+- Public manifests contain logical references such as \`auth/oauth/google\`, never values.
+- Project and environment scope are supplied by trusted server code.
+- The browser may receive secret metadata, but must never receive resolved values or Vault IDs.
+- Bootstrap database access must come from trusted process environment or workload identity.
+- Do not expose service-role keys, provider secrets, or resolved payloads through
+  \`NEXT_PUBLIC_*\`, \`EXPO_PUBLIC_*\`, generated YAML, tracked JSON, or app bundles.
+
+## Trusted adapter composition
+
+Use \`createInfraSecretStoreAdapter\` from \`@ankhorage/infra\` in server-only code and pass
+a trusted Supabase Vault SQL client. The app manifest chooses the provider; privileged connection
+configuration does not belong in the manifest.
+
+Generated Kubernetes namespace: \`${namespace}\`.
+`;
+}

package/src/index.ts

@@ -8,6 +8,11 @@ import type {
 
 export type { ApiInfrastructureArtifacts } from './apiArtifacts';
 export { generateApiInfrastructureArtifacts } from './apiArtifacts';
+export {
+  createInfraSecretStoreAdapter,
+  type CreateInfraSecretStoreAdapterInput,
+  type InfraSecretStoreProviders,
+} from './secretStore';
 export type {
   GeneratedFile,
   GeneratedInfrastructureFile,

package/src/package.test.ts

@@ -8,7 +8,14 @@ describe('package metadata', () => {
     const expectedAnkhMetadata = {
       category: 'infra',
       provider: './dist/cli/index.js',
-      capabilities: ['infra.validate', 'infra.generate', 'infra.status', 'infra.up', 'infra.down'],
+      capabilities: [
+        'infra.validate',
+        'infra.generate',
+        'infra.status',
+        'infra.up',
+        'infra.down',
+        'infra.secret-store',
+      ],
     } as const satisfies AnkhPackageMetadata;
 
     expect(packageJson.name).toBe('@ankhorage/infra');

package/src/secretStore.test.ts

@@ -0,0 +1,76 @@
+import type {
+  SupabaseVaultQueryResult,
+  SupabaseVaultSqlClient,
+  SupabaseVaultSqlExecutor,
+} from '@ankhorage/supabase-vault';
+import { describe, expect, test } from 'bun:test';
+
+import { createInfraSecretStoreAdapter } from './secretStore';
+
+class FakeSupabaseVaultClient implements SupabaseVaultSqlClient {
+  query<TRow extends Record<string, unknown>>(): Promise<SupabaseVaultQueryResult<TRow>> {
+    return Promise.resolve({ rows: [] });
+  }
+
+  transaction<TResult>(
+    operation: (executor: SupabaseVaultSqlExecutor) => Promise<TResult>,
+  ): Promise<TResult> {
+    return operation(this);
+  }
+}
+
+describe('createInfraSecretStoreAdapter', () => {
+  test('returns null when the manifest does not select a secret store', () => {
+    expect(
+      createInfraSecretStoreAdapter({
+        manifest: {},
+        providers: {},
+      }),
+    ).toBeNull();
+  });
+
+  test('creates the released Supabase Vault adapter from trusted options', () => {
+    const adapter = createInfraSecretStoreAdapter({
+      manifest: {
+        secretStore: {
+          provider: 'supabase-vault',
+        },
+      },
+      providers: {
+        supabaseVault: {
+          client: new FakeSupabaseVaultClient(),
+        },
+      },
+    });
+
+    expect(adapter).not.toBeNull();
+    expect(typeof adapter?.list).toBe('function');
+    expect(typeof adapter?.resolve).toBe('function');
+  });
+
+  test('requires trusted provider bootstrap options', () => {
+    expect(() =>
+      createInfraSecretStoreAdapter({
+        manifest: {
+          secretStore: {
+            provider: 'supabase-vault',
+          },
+        },
+        providers: {},
+      }),
+    ).toThrow('requires trusted Supabase Vault adapter options');
+  });
+
+  test('rejects unknown providers instead of silently falling back', () => {
+    expect(() =>
+      createInfraSecretStoreAdapter({
+        manifest: {
+          secretStore: {
+            provider: 'aws-secrets-manager',
+          },
+        },
+        providers: {},
+      }),
+    ).toThrow('Unsupported secret-store provider');
+  });
+});

package/src/secretStore.ts

@@ -0,0 +1,44 @@
+import type { SecretStoreAdapter } from '@ankhorage/contracts/secrets';
+import {
+  createSupabaseVaultAdapter,
+  SUPABASE_VAULT_SECRET_STORE_PROVIDER,
+  type SupabaseVaultAdapterOptions,
+} from '@ankhorage/supabase-vault';
+
+import type { InfraManifestInput } from './types';
+
+export interface InfraSecretStoreProviders {
+  readonly supabaseVault?: SupabaseVaultAdapterOptions;
+}
+
+export interface CreateInfraSecretStoreAdapterInput {
+  readonly manifest: Pick<InfraManifestInput, 'secretStore'>;
+  readonly providers: InfraSecretStoreProviders;
+}
+
+/**
+ * Creates the configured server-only secret-store adapter.
+ *
+ * Bootstrap credentials and trusted clients belong in `providers`; they must never be read from
+ * the public app manifest. A missing `infra.secretStore` returns `null` because apps without
+ * secret-backed features do not require a secret store.
+ */
+export function createInfraSecretStoreAdapter(
+  input: CreateInfraSecretStoreAdapterInput,
+): SecretStoreAdapter | null {
+  const provider = input.manifest.secretStore?.provider;
+  if (!provider) return null;
+
+  if (provider === SUPABASE_VAULT_SECRET_STORE_PROVIDER) {
+    const options = input.providers.supabaseVault;
+    if (!options) {
+      throw new Error(
+        'Secret-store provider "supabase-vault" requires trusted Supabase Vault adapter options.',
+      );
+    }
+
+    return createSupabaseVaultAdapter(options);
+  }
+
+  throw new Error(`Unsupported secret-store provider: "${provider}".`);
+}