@ankhorage/infra 0.4.0 → 0.4.2

package/src/adapters/minikube/base/index.test.ts

@@ -1,3 +1,8 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
 import { describe, expect, test } from 'bun:test';
 
 import type { InfraManifestInput } from '../../../types';
@@ -43,6 +48,159 @@ describe('generateMinikubeBaseArtifacts Supabase local ports', () => {
     );
   });
 
+  test('uses app project identity for Supabase ports independently from namespace', () => {
+    const scannerEnv = getGeneratedFileContent(
+      'local-example-test',
+      'infra/minikube/.env.example',
+      {},
+      'scanner',
+    );
+    const scannerNamespace = getGeneratedFileContent(
+      'local-example-test',
+      'infra/minikube/k8s/namespace.yaml',
+      {},
+      'scanner',
+    );
+    const chessEnv = getGeneratedFileContent(
+      'local-example-test',
+      'infra/minikube/.env.example',
+      {},
+      'chess',
+    );
+
+    expect(scannerNamespace).toContain('name: local-example-test');
+    expect(scannerEnv).toContain('SUPABASE_LOCAL_PORT_BASE=64020');
+    expect(chessEnv).toContain('SUPABASE_LOCAL_PORT_BASE=62200');
+    expect(scannerEnv).not.toContain('SUPABASE_LOCAL_PORT_BASE=62200');
+  });
+
+  test('generates canonical Supabase project identity checks', () => {
+    const script = getGeneratedFileContent(
+      'scanner',
+      'infra/minikube/scripts/supabase-local-env.sh',
+    );
+    const status = getGeneratedFileContent('scanner', 'infra/minikube/scripts/status.sh');
+
+    expect(script).toContain('EXPECTED_SUPABASE_PROJECT_ID="scanner"');
+    expect(script).toContain('write_supabase_project_identity_for_new_config');
+    expect(script).toContain('validate_supabase_project_identity');
+    expect(script).toContain('project_id = "{expected}"');
+    expect(script).toContain(
+      'The existing local Supabase project belongs to a different identity.',
+    );
+    expect(script).toContain(
+      'Destroy the invalid local stack and its project-owned resources, then run Infra Up again.',
+    );
+    expect(script).toContain(
+      'supabase --workdir "${SUPABASE_PROJECT_DIR}" init --yes >/dev/null\n  write_supabase_project_identity_for_new_config',
+    );
+    expect(script).toContain('validate_supabase_project_identity\nconfigure_supabase_local_ports');
+    expect(script).toContain(
+      'validate_supabase_project_identity\n  assert_supabase_local_ports_available',
+    );
+    expect(script).toContain('validate_supabase_project_identity\nrun_checked_command');
+    expect(script).not.toContain('basename "${APP_SOURCE_DIR}"');
+    expect(script).not.toContain('_minikube');
+
+    expect(status).toContain('EXPECTED_SUPABASE_PROJECT_ID="scanner"');
+    expect(status).toContain('reject_supabase_project_id_override');
+    expect(status).toContain('validate_supabase_project_identity');
+    expect(status).toContain('Supabase project identity mismatch.');
+    expect(status).toContain('Destroy the invalid local stack and run Infra Up again.');
+    expect(status).not.toContain('write_supabase_project_identity_for_new_config');
+    expect(status).not.toContain('configure_supabase_local_ports');
+    expect(status).not.toContain('_minikube');
+  });
+
+  test('patches only a newly initialized Supabase config to the canonical project identity', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'scanner',
+      existingConfig: null,
+    });
+
+    expect(run.status).toBe(0);
+    expect(readFileSync(run.configPath, 'utf-8')).toContain('project_id = "scanner"');
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).toContain(
+      '--workdir ' + run.root + ' init --yes',
+    );
+  });
+
+  test('rejects an existing Supabase config with a different project identity before lifecycle work', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'scanner',
+      existingConfig: 'project_id = "minikube"\n[api]\nport = 54321\n',
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain('Supabase project identity mismatch.');
+    expect(run.combinedOutput).toContain('Expected "scanner", found "minikube".');
+    expect(run.combinedOutput).toContain(
+      'Destroy the invalid local stack and its project-owned resources, then run Infra Up again.',
+    );
+    expect(readFileSync(run.configPath, 'utf-8')).toContain('project_id = "minikube"');
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('--workdir');
+  });
+
+  test('rejects an existing Supabase config with missing top-level project identity', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'scanner',
+      existingConfig: '[api]\nport = 54321\n',
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain('Expected "scanner", found missing.');
+    expect(readFileSync(run.configPath, 'utf-8')).not.toContain('project_id = "scanner"');
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('--workdir');
+  });
+
+  test('rejects ambient SUPABASE_PROJECT_ID before Supabase CLI operations', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'scanner',
+      existingConfig: 'project_id = "scanner"\n[api]\nport = 54321\n',
+      env: {
+        SUPABASE_PROJECT_ID: 'minikube',
+      },
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain(
+      'SUPABASE_PROJECT_ID must not be set for generated local Infra scripts.',
+    );
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('--workdir');
+  });
+
+  test('rejects empty Supabase project identity before Supabase CLI operations', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'plain',
+      supabaseProjectId: null,
+      existingConfig: null,
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain(
+      'Cannot run local Supabase infrastructure: expected Supabase project identity is empty.',
+    );
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('--workdir');
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('init --yes');
+    expect(() => readFileSync(run.configPath, 'utf-8')).toThrow();
+  });
+
+  test('requires python before Supabase init mutates the workdir', () => {
+    const run = runGeneratedSupabaseScript({
+      projectId: 'scanner',
+      existingConfig: null,
+      withoutPython: true,
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain(
+      'python3 is required to reconcile supabase/config.toml before local Supabase startup.',
+    );
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('--workdir');
+    expect(readFileSync(run.supabaseLogPath, 'utf-8')).not.toContain('init --yes');
+    expect(() => readFileSync(run.configPath, 'utf-8')).toThrow();
+  });
+
   test('generates bootstrap logic that retries unhealthy local Supabase startup once', () => {
     const script = getGeneratedFileContent('chess', 'infra/minikube/scripts/supabase-local-env.sh');
 
@@ -67,9 +225,16 @@ describe('generateMinikubeBaseArtifacts Supabase local ports', () => {
     const script = getGeneratedFileContent('chess', 'infra/minikube/scripts/supabase-local-env.sh');
 
     expect(script).toContain('SUPABASE_PROJECT_DIR="${SUPABASE_PROJECT_DIR:-${ROOT_DIR}}"');
+    expect(script).toContain('require_expected_supabase_project_identity');
+    expect(script).toContain(
+      'require_expected_supabase_project_identity\nreject_supabase_project_id_override\nrequire_supabase_cli_capabilities',
+    );
     expect(script).toContain('supabase CLI >= 2.106.0 is required');
     expect(script).toContain('supabase CLI does not support required global --workdir flag');
     expect(script).toContain('supabase CLI does not support required migration up --local command');
+    expect(script).toContain(
+      'python3 is required to reconcile supabase/config.toml before local Supabase startup.',
+    );
     expect(script).toContain('psql is required but not installed');
     expect(script).toContain('supabase --workdir "${SUPABASE_PROJECT_DIR}" init --yes');
     expect(script).toContain('supabase --workdir "${SUPABASE_PROJECT_DIR}" migration up --local');
@@ -136,16 +301,113 @@ describe('generateMinikubeBaseArtifacts Supabase local ports', () => {
     );
     expect(status).toContain('generated trigger function execute privilege must be revoked');
   });
+
+  test('generates relation-safe disabled profile verification for local env and status', () => {
+    const script = getGeneratedFileContent('chess', 'infra/minikube/scripts/supabase-local-env.sh');
+    const status = getGeneratedFileContent('chess', 'infra/minikube/scripts/status.sh');
+    const expectedDynamicLookup = `execute
+      'select exists (
+         select 1
+         from ankhorage_internal.generated_schema_state
+         where artifact_key = $1
+       )'
+      into has_profile_state
+      using 'auth.profile';`;
+
+    for (const generated of [script, status]) {
+      expect(generated).toContain('has_profile_state boolean := false;');
+      expect(generated).toContain(expectedDynamicLookup);
+      expect(generated).toContain(
+        'manifest auth.profile.table was removed but local generated auth.profile state still exists; reset local Supabase or add an explicit cleanup migration',
+      );
+      expect(generated).not.toContain(
+        `if to_regclass('ankhorage_internal.generated_schema_state') is not null
+    and exists (`,
+      );
+      expect(generated.replace(expectedDynamicLookup, '')).not.toContain(
+        `from ankhorage_internal.generated_schema_state
+      where artifact_key = 'auth.profile'`,
+      );
+    }
+
+    expect(script).toContain('Generated profile disabled-state verification');
+    expect(status).toContain('- profile reconciliation: skipped (no profile table configured)');
+    expect(status).toContain('- profile schema: skipped (no profile table configured)');
+  });
+
+  test('status succeeds for a clean disabled profile local Supabase stack', () => {
+    const run = runGeneratedStatusScript({
+      manifest: createInfraManifest(),
+      supabaseProjectId: 'plain',
+      env: {
+        AUTH_RUNTIME_MODE: 'local',
+      },
+    });
+
+    expect(run.status).toBe(0);
+    expect(run.combinedOutput).toContain('- immutable migrations: applied');
+    expect(run.combinedOutput).toContain(
+      '- profile reconciliation: skipped (no profile table configured)',
+    );
+    expect(run.combinedOutput).toContain('- profile schema: skipped (no profile table configured)');
+    expect(run.supabaseLog).toContain('--workdir');
+  });
+
+  test('does not reject SUPABASE_PROJECT_ID for non-Supabase status checks', () => {
+    const run = runGeneratedStatusScript({
+      manifest: {
+        deployment: {
+          target: 'minikube',
+          monitoring: false,
+        },
+        plugins: [],
+      },
+      supabaseProjectId: null,
+      env: {
+        SUPABASE_PROJECT_ID: 'ambient-project',
+      },
+    });
+
+    expect(run.status).toBe(0);
+    expect(run.combinedOutput).not.toContain(
+      'SUPABASE_PROJECT_ID must not be set for generated local Infra scripts.',
+    );
+    expect(run.kubectlLog).toContain('get all -n plain');
+  });
+
+  test('rejects empty Supabase project identity before local Supabase status checks', () => {
+    const run = runGeneratedStatusScript({
+      manifest: {
+        deployment: {
+          target: 'minikube',
+          monitoring: false,
+        },
+        plugins: [],
+      },
+      supabaseProjectId: null,
+      env: {
+        SUPABASE_LOCAL_ENABLED: 'true',
+      },
+    });
+
+    expect(run.status).not.toBe(0);
+    expect(run.combinedOutput).toContain(
+      'Cannot run local Supabase infrastructure: expected Supabase project identity is empty.',
+    );
+    expect(run.supabaseLog).toBe('');
+  });
 });
 
 function getGeneratedFileContent(
   namespace: string,
   filePath: string,
   overrides: Partial<InfraManifestInput> = {},
+  supabaseProjectId = namespace,
 ): string {
   const artifact = generateMinikubeBaseArtifacts({
     manifest: createInfraManifest(overrides),
     namespace,
+    supabaseProjectId,
     extraResources: [],
     extraEnvEntries: [],
   }).find((file) => file.path === filePath);
@@ -195,3 +457,293 @@ function createInfraManifest(overrides: Partial<InfraManifestInput> = {}): Infra
     },
   };
 }
+
+function runGeneratedSupabaseScript(args: {
+  projectId: string;
+  supabaseProjectId?: string | null;
+  existingConfig: string | null;
+  env?: Record<string, string>;
+  withoutPython?: boolean;
+}): {
+  status: number | null;
+  combinedOutput: string;
+  root: string;
+  configPath: string;
+  supabaseLogPath: string;
+} {
+  const tempRoot = mkdtempSync(join(tmpdir(), 'infra-supabase-identity-'));
+  const root = join(tempRoot, 'infra', 'minikube');
+  const scriptsDir = join(root, 'scripts');
+  const supabaseDir = join(root, 'supabase');
+  const binDir = join(tempRoot, 'bin');
+  const appSourceDir = join(tempRoot, 'app');
+  const scriptPath = join(scriptsDir, 'supabase-local-env.sh');
+  const configPath = join(supabaseDir, 'config.toml');
+  const supabaseLogPath = join(tempRoot, 'supabase.log');
+
+  mkdirSync(scriptsDir, { recursive: true });
+  mkdirSync(binDir, { recursive: true });
+  mkdirSync(appSourceDir, { recursive: true });
+  writeFileSync(join(root, '.env.example'), '');
+  writeFileSync(supabaseLogPath, '');
+
+  if (args.existingConfig !== null) {
+    mkdirSync(supabaseDir, { recursive: true });
+    writeFileSync(configPath, args.existingConfig);
+  }
+
+  const script = getGeneratedFileContent(
+    args.projectId,
+    'infra/minikube/scripts/supabase-local-env.sh',
+    {},
+    args.supabaseProjectId === undefined ? args.projectId : args.supabaseProjectId,
+  );
+  writeFileSync(scriptPath, script);
+  chmodSync(scriptPath, 0o755);
+
+  const supabaseStubPath = join(binDir, 'supabase');
+  writeFileSync(
+    supabaseStubPath,
+    `#!/bin/bash
+set -euo pipefail
+printf '%s\\n' "$*" >> "\${SUPABASE_STUB_LOG}"
+
+if [[ "\${1:-}" == "--version" ]]; then
+  echo "supabase 2.106.0"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "status" && "\${2:-}" == "--help" ]]; then
+  echo "--workdir"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "migration" && "\${2:-}" == "up" && "\${3:-}" == "--help" ]]; then
+  echo "--local"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "--workdir" && "\${3:-}" == "init" && "\${4:-}" == "--yes" ]]; then
+  mkdir -p "\${2}/supabase"
+  printf '%s\\n' 'project_id = "minikube"' '[api]' 'port = 54321' > "\${2}/supabase/config.toml"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "--workdir" && "\${3:-}" == "status" && "\${4:-}" == "-o" && "\${5:-}" == "env" ]]; then
+  cat <<'ENV'
+DB_URL=postgresql://postgres:postgres@127.0.0.1:54322/postgres
+API_URL=http://127.0.0.1:54321
+ANON_KEY=anon
+SERVICE_ROLE_KEY=service
+JWT_SECRET=secret
+ENV
+  exit 0
+fi
+
+if [[ "\${1:-}" == "--workdir" && "\${3:-}" == "status" ]]; then
+  exit 0
+fi
+
+if [[ "\${1:-}" == "--workdir" && "\${3:-}" == "migration" && "\${4:-}" == "up" && "\${5:-}" == "--local" ]]; then
+  exit 0
+fi
+
+echo "unexpected supabase call: $*" >&2
+exit 1
+`,
+  );
+  chmodSync(supabaseStubPath, 0o755);
+
+  const psqlStubPath = join(binDir, 'psql');
+  writeFileSync(
+    psqlStubPath,
+    `#!/bin/bash
+exit 0
+`,
+  );
+  chmodSync(psqlStubPath, 0o755);
+
+  const result = spawnSync('/bin/bash', [scriptPath], {
+    cwd: tempRoot,
+    env: {
+      ...(args.withoutPython ? {} : process.env),
+      PATH: args.withoutPython ? binDir : `${binDir}:${process.env.PATH ?? ''}`,
+      APP_SOURCE_DIR: appSourceDir,
+      SUPABASE_STUB_LOG: supabaseLogPath,
+      ...args.env,
+    },
+    encoding: 'utf-8',
+  });
+
+  return {
+    status: result.status,
+    combinedOutput: `${result.stdout}${result.stderr}`,
+    root,
+    configPath,
+    supabaseLogPath,
+  };
+}
+
+function runGeneratedStatusScript(args: {
+  manifest: InfraManifestInput;
+  supabaseProjectId: string | null;
+  env?: Record<string, string>;
+}): {
+  status: number | null;
+  combinedOutput: string;
+  kubectlLog: string;
+  supabaseLog: string;
+} {
+  const tempRoot = mkdtempSync(join(tmpdir(), 'infra-status-'));
+  const root = join(tempRoot, 'infra', 'minikube');
+  const scriptsDir = join(root, 'scripts');
+  const supabaseDir = join(root, 'supabase');
+  const binDir = join(tempRoot, 'bin');
+  const scriptPath = join(scriptsDir, 'status.sh');
+  const kubectlLogPath = join(tempRoot, 'kubectl.log');
+  const supabaseLogPath = join(tempRoot, 'supabase.log');
+  const psqlLogPath = join(tempRoot, 'psql.log');
+
+  mkdirSync(scriptsDir, { recursive: true });
+  mkdirSync(binDir, { recursive: true });
+  writeFileSync(join(root, '.env.example'), '');
+  writeFileSync(kubectlLogPath, '');
+  writeFileSync(supabaseLogPath, '');
+  writeFileSync(psqlLogPath, '');
+
+  if (args.supabaseProjectId !== null) {
+    mkdirSync(supabaseDir, { recursive: true });
+    writeFileSync(join(supabaseDir, 'config.toml'), `project_id = "${args.supabaseProjectId}"\n`);
+  }
+
+  const artifact = generateMinikubeBaseArtifacts({
+    manifest: args.manifest,
+    namespace: 'plain',
+    supabaseProjectId: args.supabaseProjectId,
+    extraResources: [],
+    extraEnvEntries: [],
+  }).find((file) => file.path === 'infra/minikube/scripts/status.sh');
+
+  if (!artifact) {
+    throw new Error('Expected generated status.sh artifact');
+  }
+
+  writeFileSync(scriptPath, artifact.content);
+  chmodSync(scriptPath, 0o755);
+
+  const kubectlStubPath = join(binDir, 'kubectl');
+  writeFileSync(
+    kubectlStubPath,
+    `#!/bin/bash
+set -euo pipefail
+printf '%s\\n' "$*" >> "\${KUBECTL_STUB_LOG}"
+
+if [[ "\${1:-}" == "config" && "\${2:-}" == "current-context" ]]; then
+  echo "minikube"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "cluster-info" ]]; then
+  echo "Kubernetes control plane is running"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "get" && "\${2:-}" == "namespace" ]]; then
+  exit 0
+fi
+
+if [[ "\${1:-}" == "get" && "\${2:-}" == "all" ]]; then
+  echo "No resources found"
+  exit 0
+fi
+
+echo "unexpected kubectl call: $*" >&2
+exit 1
+`,
+  );
+  chmodSync(kubectlStubPath, 0o755);
+
+  const supabaseStubPath = join(binDir, 'supabase');
+  writeFileSync(
+    supabaseStubPath,
+    `#!/bin/bash
+set -euo pipefail
+printf '%s\\n' "$*" >> "\${SUPABASE_STUB_LOG}"
+
+if [[ "\${1:-}" == "--version" ]]; then
+  echo "supabase 2.106.0"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "status" && "\${2:-}" == "--help" ]]; then
+  echo "--workdir"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "migration" && "\${2:-}" == "up" && "\${3:-}" == "--help" ]]; then
+  echo "--local"
+  exit 0
+fi
+
+if [[ "\${1:-}" == "--workdir" && "\${3:-}" == "status" && "\${4:-}" == "-o" && "\${5:-}" == "env" ]]; then
+  cat <<'ENV'
+DB_URL=postgresql://postgres:postgres@127.0.0.1:54322/postgres
+API_URL=http://127.0.0.1:54321
+ANON_KEY=anon
+SERVICE_ROLE_KEY=service
+JWT_SECRET=secret
+ENV
+  exit 0
+fi
+
+if [[ "\${1:-}" == "--workdir" && "\${3:-}" == "status" ]]; then
+  exit 0
+fi
+
+echo "unexpected supabase call: $*" >&2
+exit 1
+`,
+  );
+  chmodSync(supabaseStubPath, 0o755);
+
+  const psqlStubPath = join(binDir, 'psql');
+  writeFileSync(
+    psqlStubPath,
+    `#!/bin/bash
+set -euo pipefail
+printf '%s\\n' "$*" >> "\${PSQL_STUB_LOG}"
+
+if [[ "$*" == *"select version from supabase_migrations.schema_migrations"* ]]; then
+  exit 0
+fi
+
+if [[ "$*" == *"-f"* ]]; then
+  exit 0
+fi
+
+echo "unexpected psql call: $*" >&2
+exit 1
+`,
+  );
+  chmodSync(psqlStubPath, 0o755);
+
+  const result = spawnSync('/bin/bash', [scriptPath], {
+    cwd: tempRoot,
+    env: {
+      ...process.env,
+      PATH: `${binDir}:${process.env.PATH ?? ''}`,
+      KUBECTL_STUB_LOG: kubectlLogPath,
+      SUPABASE_STUB_LOG: supabaseLogPath,
+      PSQL_STUB_LOG: psqlLogPath,
+      ...args.env,
+    },
+    encoding: 'utf-8',
+  });
+
+  return {
+    status: result.status,
+    combinedOutput: `${result.stdout}${result.stderr}`,
+    kubectlLog: readFileSync(kubectlLogPath, 'utf-8'),
+    supabaseLog: readFileSync(supabaseLogPath, 'utf-8'),
+  };
+}