@ankhorage/infra 0.3.7 → 0.4.1

package/src/adapters/minikube/secrets/index.test.ts

@@ -0,0 +1,139 @@
+import type { AppManifest } from '@ankhorage/contracts';
+import { SUPABASE_VAULT_MIGRATION_SQL } from '@ankhorage/supabase-vault';
+import { describe, expect, test } from 'bun:test';
+
+import { generateInfrastructure } from '../../../index';
+import type { InfraManifestInput } from '../../../types';
+import { SUPABASE_VAULT_MIGRATION_PATH } from './supabase-vault';
+
+function createManifest(overrides: Partial<InfraManifestInput> = {}): InfraManifestInput {
+  return {
+    deployment: {
+      target: 'minikube',
+      monitoring: false,
+    },
+    secretStore: {
+      provider: 'supabase-vault',
+    },
+    plugins: [],
+    ...overrides,
+  };
+}
+
+describe('minikube secret-store generation', () => {
+  test('generates the released Supabase Vault migration through the existing lifecycle', () => {
+    const result = generateInfrastructure(createManifest(), {
+      appManifest: createAppManifest('vault-app'),
+    });
+    const migration = result.files.find((file) => file.path === SUPABASE_VAULT_MIGRATION_PATH);
+    const envExample = result.files.find((file) => file.path === 'infra/minikube/.env.example');
+    const upScript = result.files.find((file) => file.path === 'infra/minikube/scripts/up.sh');
+
+    expect(migration?.content).toBe(`${SUPABASE_VAULT_MIGRATION_SQL.trim()}\n`);
+    expect(envExample?.content).toContain('SECRET_STORE_PROVIDER=supabase-vault');
+    expect(envExample?.content).toContain('SUPABASE_LOCAL_ENABLED=true');
+    expect(upScript?.content).toContain('SUPABASE_LOCAL_ENABLED="${SUPABASE_LOCAL_ENABLED:-true}"');
+    expect(result.meta.providers).toContain('supabase-vault');
+  });
+
+  test('requires credentialsRef for every enabled OAuth provider', () => {
+    expect(() =>
+      generateInfrastructure(
+        createManifest({
+          auth: {
+            scope: 'global',
+            provider: 'supabase',
+            signIn: {
+              identifiers: ['email'],
+            },
+            oauth: {
+              enabled: true,
+              callbackRoute: '/auth/callback',
+              providers: [
+                {
+                  id: 'google',
+                  enabled: true,
+                },
+              ],
+            },
+          },
+        }),
+        { appManifest: createAppManifest('vault-app') },
+      ),
+    ).toThrow('does not define credentialsRef');
+  });
+
+  test('accepts provider-neutral OAuth secret references without serializing values', () => {
+    const result = generateInfrastructure(
+      createManifest({
+        auth: {
+          scope: 'global',
+          provider: 'supabase',
+          signIn: {
+            identifiers: ['email'],
+          },
+          oauth: {
+            enabled: true,
+            callbackRoute: '/auth/callback',
+            providers: [
+              {
+                id: 'google',
+                enabled: true,
+                credentialsRef: 'auth/oauth/google',
+              },
+            ],
+          },
+        },
+      }),
+      { appManifest: createAppManifest('vault-app') },
+    );
+
+    const serialized = JSON.stringify(result.files);
+    expect(serialized).toContain('auth/oauth/google');
+    expect(serialized).not.toContain('clientSecret');
+    expect(serialized).not.toContain('privateKey');
+  });
+
+  test('rejects unknown secret-store providers', () => {
+    expect(() =>
+      generateInfrastructure(
+        createManifest({
+          secretStore: {
+            provider: 'aws-secrets-manager',
+          },
+        }),
+      ),
+    ).toThrow('Unsupported secret-store provider for minikube adapter');
+  });
+});
+
+function createAppManifest(
+  slug: string,
+): Pick<AppManifest, 'metadata' | 'navigator' | 'screens' | 'settings'> {
+  return {
+    metadata: {
+      name: slug,
+      slug,
+      version: '1.0.0',
+      themeId: 'default',
+    },
+    navigator: {
+      type: 'stack',
+      routes: [],
+    },
+    screens: {},
+    settings: {
+      localization: {
+        defaultLocale: 'en',
+        locales: ['en'],
+      },
+      authFlow: {
+        signInRoute: '/sign-in',
+        signUpRoute: '/sign-up',
+        signOutRoute: '/sign-out',
+        unauthorizedRoute: '/sign-in',
+        postSignInRoute: '/',
+      },
+    },
+  };
+}

package/src/adapters/minikube/secrets/index.ts

@@ -0,0 +1,19 @@
+import { SUPABASE_VAULT_SECRET_STORE_PROVIDER } from '@ankhorage/supabase-vault';
+
+import type { InfraManifestInput } from '../../../types';
+import { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';
+import { generateSupabaseVaultSecretStoreArtifacts } from './supabase-vault';
+
+export function generateSecretStoreArtifacts(args: {
+  readonly manifest: InfraManifestInput;
+  readonly namespace: string;
+}): MinikubeAdapterArtifacts {
+  const provider = args.manifest.secretStore?.provider;
+  if (!provider) return emptyMinikubeArtifacts();
+
+  if (provider === SUPABASE_VAULT_SECRET_STORE_PROVIDER) {
+    return generateSupabaseVaultSecretStoreArtifacts(args);
+  }
+
+  throw new Error(`Unsupported secret-store provider for minikube adapter: "${provider}".`);
+}

package/src/adapters/minikube/secrets/supabase-vault/index.ts

@@ -0,0 +1,91 @@
+import {
+  SUPABASE_VAULT_MIGRATION_SQL,
+  SUPABASE_VAULT_SECRET_STORE_PROVIDER,
+} from '@ankhorage/supabase-vault';
+
+import type { InfraManifestInput } from '../../../../types';
+import type { MinikubeAdapterArtifacts } from '../../contracts';
+
+export const SUPABASE_VAULT_MIGRATION_PATH =
+  'infra/minikube/supabase/migrations/202607120001_ankhorage_supabase_vault.sql';
+
+export function generateSupabaseVaultSecretStoreArtifacts(args: {
+  readonly manifest: InfraManifestInput;
+  readonly namespace: string;
+}): MinikubeAdapterArtifacts {
+  validateOAuthSecretReferences(args.manifest);
+
+  return {
+    files: [
+      {
+        path: SUPABASE_VAULT_MIGRATION_PATH,
+        content: `${SUPABASE_VAULT_MIGRATION_SQL.trim()}\n`,
+      },
+      {
+        path: 'infra/minikube/secrets/supabase-vault.md',
+        content: getRuntimeGuide(args.namespace),
+      },
+    ],
+    resources: [],
+    envEntries: [
+      `SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`,
+      'SUPABASE_LOCAL_ENABLED=true',
+    ],
+    warnings: [],
+  };
+}
+
+function validateOAuthSecretReferences(manifest: InfraManifestInput): void {
+  const oauth = manifest.auth?.oauth;
+  if (!oauth?.enabled) return;
+
+  const enabledProviders = oauth.providers.filter((provider) => provider.enabled !== false);
+  if (enabledProviders.length === 0) {
+    throw new Error('OAuth is enabled but no OAuth provider is enabled.');
+  }
+
+  for (const provider of enabledProviders) {
+    if (!provider.credentialsRef?.trim()) {
+      throw new Error(
+        `OAuth provider "${provider.id}" is enabled but does not define credentialsRef.`,
+      );
+    }
+  }
+}
+
+function getRuntimeGuide(namespace: string): string {
+  return `# Supabase Vault secret store
+
+This project selects the provider-neutral secret-store backend through:
+
+\`\`\`text
+infra.secretStore.provider = ${SUPABASE_VAULT_SECRET_STORE_PROVIDER}
+\`\`\`
+
+The immutable migration at:
+
+\`\`\`text
+${SUPABASE_VAULT_MIGRATION_PATH}
+\`\`\`
+
+is applied by the existing local Supabase migration lifecycle during \`scripts/up.sh\`.
+
+## Security boundary
+
+- Secret values are stored only through Supabase Vault.
+- Public manifests contain logical references such as \`auth/oauth/google\`, never values.
+- Project and environment scope are supplied by trusted server code.
+- The browser may receive secret metadata, but must never receive resolved values or Vault IDs.
+- Bootstrap database access must come from trusted process environment or workload identity.
+- Do not expose service-role keys, provider secrets, or resolved payloads through
+  \`NEXT_PUBLIC_*\`, \`EXPO_PUBLIC_*\`, generated YAML, tracked JSON, or app bundles.
+
+## Trusted adapter composition
+
+Use \`createInfraSecretStoreAdapter\` from \`@ankhorage/infra\` in server-only code and pass
+a trusted Supabase Vault SQL client. The app manifest chooses the provider; privileged connection
+configuration does not belong in the manifest.
+
+Generated Kubernetes namespace: \`${namespace}\`.
+`;
+}

package/src/index.test.ts

@@ -45,7 +45,7 @@ describe('generateInfrastructure', () => {
       plugins: [],
     };
 
-    const result = generateInfrastructure(manifest);
+    const result = generateInfrastructure(manifest, { appManifest: createAppManifest('alpha') });
     const paths = result.files.map((f) => f.path);
 
     expect(result.meta.target).toBe('minikube');
@@ -147,8 +147,8 @@ describe('generateInfrastructure', () => {
     expect(envExample?.content).toContain('APP_SOURCE_DIR=');
     expect(envExample?.content).toContain('APP_WEB_EXPORT_DIR=.ankh/web-export');
     expect(envExample?.content).toContain('SUPABASE_PROJECT_DIR=');
-    expect(envExample?.content).toContain('SUPABASE_LOCAL_PORT_BASE=59120');
-    expect(envExample?.content).toContain('SUPABASE_LOCAL_ANALYTICS_PORT=59125');
+    expect(envExample?.content).toContain('SUPABASE_LOCAL_PORT_BASE=55540');
+    expect(envExample?.content).toContain('SUPABASE_LOCAL_ANALYTICS_PORT=55545');
     expect(envExample?.content).toContain('APP_IMAGE=ankh/alpha-local:dev');
     expect(envExample?.content).toContain('APP_IMAGE_SYNC_STRATEGY=docker-load');
     expect(envExample?.content).toContain('AUTH_RUNTIME_MODE=local');
@@ -168,7 +168,8 @@ describe('generateInfrastructure', () => {
 
     const minikubeReadme = result.files.find((f) => f.path === 'infra/minikube/README.md');
     expect(minikubeReadme?.content).toContain('SUPABASE_LOCAL_ANALYTICS_PORT');
-    expect(minikubeReadme?.content).toContain('59125');
+    expect(minikubeReadme?.content).toContain('55545');
+    expect(minikubeReadme?.content).toContain('Supabase local project identity: `alpha`');
     expect(minikubeReadme?.content).toContain('$APP_SOURCE_DIR/.env.local');
     expect(minikubeReadme?.content).toContain('apps/card/.env.local');
 
@@ -333,7 +334,10 @@ describe('generateInfrastructure', () => {
       plugins: [],
     };
 
-    const result = generateInfrastructure(manifest, { namespaceHint: 'shop' });
+    const result = generateInfrastructure(manifest, {
+      namespaceHint: 'shop',
+      appManifest: createAppManifest('shop'),
+    });
 
     expect(result.warnings).toContain(
       'Storage buckets are configured but not created automatically yet. Ensure buckets exist in Supabase Storage: assets,uploads.',
@@ -380,7 +384,10 @@ describe('generateInfrastructure', () => {
       plugins: [],
     };
 
-    const result = generateInfrastructure(manifest, { namespaceHint: 'shop' });
+    const result = generateInfrastructure(manifest, {
+      namespaceHint: 'shop',
+      appManifest: createAppManifest('shop'),
+    });
 
     expect(result.files.map((f) => f.path)).toContain(
       'infra/minikube/k8s/storage/supabase/app-runtime-storage.env.configmap.yaml',
@@ -425,7 +432,10 @@ describe('generateInfrastructure', () => {
       plugins: [],
     };
 
-    const result = generateInfrastructure(manifest, { namespaceHint: 'shop' });
+    const result = generateInfrastructure(manifest, {
+      namespaceHint: 'shop',
+      appManifest: createAppManifest('shop'),
+    });
     expect(result.warnings).toContain(
       'Storage buckets are empty after normalization; no storage artifacts generated.',
     );
@@ -451,7 +461,10 @@ describe('generateInfrastructure', () => {
       plugins: [],
     };
 
-    const result = generateInfrastructure(manifest, { namespaceHint: 'shop' });
+    const result = generateInfrastructure(manifest, {
+      namespaceHint: 'shop',
+      appManifest: createAppManifest('shop'),
+    });
     expect(result.warnings).toContain(
       'Storage buckets are empty after normalization; no storage artifacts generated.',
     );
@@ -473,7 +486,10 @@ describe('generateInfrastructure', () => {
       plugins: [],
     };
 
-    const result = generateInfrastructure(manifest, { namespaceHint: 'shop' });
+    const result = generateInfrastructure(manifest, {
+      namespaceHint: 'shop',
+      appManifest: createAppManifest('shop'),
+    });
     expect(result.warnings).toContain(
       'Storage provider "auto" could not be resolved for minikube; no storage artifacts generated.',
     );
@@ -645,9 +661,98 @@ describe('generateInfrastructure', () => {
       plugins: [],
     };
 
-    expect(() => generateInfrastructure(manifest)).toThrow(
-      'Unsupported authorization engine for minikube adapter: opa',
+    expect(() =>
+      generateInfrastructure(manifest, { appManifest: createAppManifest('shop') }),
+    ).toThrow('Unsupported authorization engine for minikube adapter: opa');
+  });
+
+  test('requires canonical app slug for local Supabase infrastructure', () => {
+    const manifest: InfraManifestInput = {
+      deployment: {
+        target: 'minikube',
+        monitoring: false,
+      },
+      database: {
+        provider: 'supabase',
+        tier: 'dev',
+      },
+      plugins: [],
+    };
+
+    expect(() => generateInfrastructure(manifest, { namespaceHint: 'shop' })).toThrow(
+      'Cannot generate local Supabase infrastructure: appManifest.metadata.slug is required.',
+    );
+    expect(() =>
+      generateInfrastructure(manifest, {
+        namespaceHint: 'shop',
+        appManifest: createAppManifest('Scanner App'),
+      }),
+    ).toThrow('appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters');
+
+    const fortyCharacterSlug = 'a'.repeat(40);
+    const fortyCharacterResult = generateInfrastructure(manifest, {
+      namespaceHint: 'shop',
+      appManifest: createAppManifest(fortyCharacterSlug),
+    });
+    const fortyCharacterScript = fortyCharacterResult.files.find(
+      (f) => f.path === 'infra/minikube/scripts/supabase-local-env.sh',
     );
+    expect(fortyCharacterScript?.content).toContain(
+      `EXPECTED_SUPABASE_PROJECT_ID="${fortyCharacterSlug}"`,
+    );
+
+    expect(() =>
+      generateInfrastructure(manifest, {
+        namespaceHint: 'shop',
+        appManifest: createAppManifest('a'.repeat(41)),
+      }),
+    ).toThrow('appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters');
+
+    expect(() =>
+      generateInfrastructure(manifest, {
+        namespaceHint: 'shop',
+        appManifest: createAppManifest('very-long-project-name-with-identical-prefix-alpha'),
+      }),
+    ).toThrow('appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters');
+    expect(() =>
+      generateInfrastructure(manifest, {
+        namespaceHint: 'shop',
+        appManifest: createAppManifest('very-long-project-name-with-identical-prefix-beta'),
+      }),
+    ).toThrow('appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters');
+  });
+
+  test('keeps Supabase project identity independent from domain-derived namespace', () => {
+    const manifest: InfraManifestInput = {
+      deployment: {
+        target: 'minikube',
+        monitoring: false,
+      },
+      database: {
+        provider: 'supabase',
+        tier: 'dev',
+      },
+      networking: {
+        domain: 'local.example.test',
+        cdn: false,
+      },
+      plugins: [],
+    };
+
+    const result = generateInfrastructure(manifest, {
+      namespaceHint: 'ignored',
+      appManifest: createAppManifest('scanner'),
+    });
+    const namespaceFile = result.files.find((f) => f.path === 'infra/minikube/k8s/namespace.yaml');
+    const envExample = result.files.find((f) => f.path === 'infra/minikube/.env.example');
+    const script = result.files.find(
+      (f) => f.path === 'infra/minikube/scripts/supabase-local-env.sh',
+    );
+
+    expect(namespaceFile?.content).toContain('name: local-example-test');
+    expect(envExample?.content).toContain('SUPABASE_LOCAL_PORT_BASE=64020');
+    expect(envExample?.content).not.toContain('SUPABASE_LOCAL_PORT_BASE=61550');
+    expect(script?.content).toContain('EXPECTED_SUPABASE_PROJECT_ID="scanner"');
   });
 
   test('uses namespace hint when domain is not provided', () => {
@@ -671,7 +776,10 @@ describe('generateInfrastructure', () => {
       plugins: [],
     };
 
-    const result = generateInfrastructure(manifest, { namespaceHint: 'shop' });
+    const result = generateInfrastructure(manifest, {
+      namespaceHint: 'shop',
+      appManifest: createAppManifest('shop'),
+    });
     const namespaceFile = result.files.find((f) => f.path === 'infra/minikube/k8s/namespace.yaml');
     const upScript = result.files.find((f) => f.path === 'infra/minikube/scripts/up.sh');
     const statusScript = result.files.find((f) => f.path === 'infra/minikube/scripts/status.sh');
@@ -688,3 +796,34 @@ describe('generateInfrastructure', () => {
     expect(statusScript?.content).toContain('- secret/supabase-auth-secrets: present');
   });
 });
+
+function createAppManifest(
+  slug: string,
+): Pick<AppManifest, 'metadata' | 'navigator' | 'screens' | 'settings'> {
+  return {
+    metadata: {
+      name: slug,
+      slug,
+      version: '1.0.0',
+      themeId: 'default',
+    },
+    navigator: {
+      type: 'stack',
+      routes: [],
+    },
+    screens: {},
+    settings: {
+      localization: {
+        defaultLocale: 'en',
+        locales: ['en'],
+      },
+      authFlow: {
+        signInRoute: '/sign-in',
+        signUpRoute: '/sign-up',
+        signOutRoute: '/sign-out',
+        unauthorizedRoute: '/sign-in',
+        postSignInRoute: '/',
+      },
+    },
+  };
+}

package/src/index.ts

@@ -8,6 +8,11 @@ import type {
 
 export type { ApiInfrastructureArtifacts } from './apiArtifacts';
 export { generateApiInfrastructureArtifacts } from './apiArtifacts';
+export {
+  createInfraSecretStoreAdapter,
+  type CreateInfraSecretStoreAdapterInput,
+  type InfraSecretStoreProviders,
+} from './secretStore';
 export type {
   GeneratedFile,
   GeneratedInfrastructureFile,

package/src/package.test.ts

@@ -8,7 +8,14 @@ describe('package metadata', () => {
     const expectedAnkhMetadata = {
       category: 'infra',
       provider: './dist/cli/index.js',
-      capabilities: ['infra.validate', 'infra.generate', 'infra.status', 'infra.up', 'infra.down'],
+      capabilities: [
+        'infra.validate',
+        'infra.generate',
+        'infra.status',
+        'infra.up',
+        'infra.down',
+        'infra.secret-store',
+      ],
     } as const satisfies AnkhPackageMetadata;
 
     expect(packageJson.name).toBe('@ankhorage/infra');

package/src/secretStore.test.ts

@@ -0,0 +1,76 @@
+import type {
+  SupabaseVaultQueryResult,
+  SupabaseVaultSqlClient,
+  SupabaseVaultSqlExecutor,
+} from '@ankhorage/supabase-vault';
+import { describe, expect, test } from 'bun:test';
+
+import { createInfraSecretStoreAdapter } from './secretStore';
+
+class FakeSupabaseVaultClient implements SupabaseVaultSqlClient {
+  query<TRow extends Record<string, unknown>>(): Promise<SupabaseVaultQueryResult<TRow>> {
+    return Promise.resolve({ rows: [] });
+  }
+
+  transaction<TResult>(
+    operation: (executor: SupabaseVaultSqlExecutor) => Promise<TResult>,
+  ): Promise<TResult> {
+    return operation(this);
+  }
+}
+
+describe('createInfraSecretStoreAdapter', () => {
+  test('returns null when the manifest does not select a secret store', () => {
+    expect(
+      createInfraSecretStoreAdapter({
+        manifest: {},
+        providers: {},
+      }),
+    ).toBeNull();
+  });
+
+  test('creates the released Supabase Vault adapter from trusted options', () => {
+    const adapter = createInfraSecretStoreAdapter({
+      manifest: {
+        secretStore: {
+          provider: 'supabase-vault',
+        },
+      },
+      providers: {
+        supabaseVault: {
+          client: new FakeSupabaseVaultClient(),
+        },
+      },
+    });
+
+    expect(adapter).not.toBeNull();
+    expect(typeof adapter?.list).toBe('function');
+    expect(typeof adapter?.resolve).toBe('function');
+  });
+
+  test('requires trusted provider bootstrap options', () => {
+    expect(() =>
+      createInfraSecretStoreAdapter({
+        manifest: {
+          secretStore: {
+            provider: 'supabase-vault',
+          },
+        },
+        providers: {},
+      }),
+    ).toThrow('requires trusted Supabase Vault adapter options');
+  });
+
+  test('rejects unknown providers instead of silently falling back', () => {
+    expect(() =>
+      createInfraSecretStoreAdapter({
+        manifest: {
+          secretStore: {
+            provider: 'aws-secrets-manager',
+          },
+        },
+        providers: {},
+      }),
+    ).toThrow('Unsupported secret-store provider');
+  });
+});

package/src/secretStore.ts

@@ -0,0 +1,44 @@
+import type { SecretStoreAdapter } from '@ankhorage/contracts/secrets';
+import {
+  createSupabaseVaultAdapter,
+  SUPABASE_VAULT_SECRET_STORE_PROVIDER,
+  type SupabaseVaultAdapterOptions,
+} from '@ankhorage/supabase-vault';
+
+import type { InfraManifestInput } from './types';
+
+export interface InfraSecretStoreProviders {
+  readonly supabaseVault?: SupabaseVaultAdapterOptions;
+}
+
+export interface CreateInfraSecretStoreAdapterInput {
+  readonly manifest: Pick<InfraManifestInput, 'secretStore'>;
+  readonly providers: InfraSecretStoreProviders;
+}
+
+/**
+ * Creates the configured server-only secret-store adapter.
+ *
+ * Bootstrap credentials and trusted clients belong in `providers`; they must never be read from
+ * the public app manifest. A missing `infra.secretStore` returns `null` because apps without
+ * secret-backed features do not require a secret store.
+ */
+export function createInfraSecretStoreAdapter(
+  input: CreateInfraSecretStoreAdapterInput,
+): SecretStoreAdapter | null {
+  const provider = input.manifest.secretStore?.provider;
+  if (!provider) return null;
+
+  if (provider === SUPABASE_VAULT_SECRET_STORE_PROVIDER) {
+    const options = input.providers.supabaseVault;
+    if (!options) {
+      throw new Error(
+        'Secret-store provider "supabase-vault" requires trusted Supabase Vault adapter options.',
+      );
+    }
+
+    return createSupabaseVaultAdapter(options);
+  }
+
+  throw new Error(`Unsupported secret-store provider: "${provider}".`);
+}