@ankhorage/infra 4.1.12 → 5.0.0

package/src/adapters/minikube/storage/index.ts

@@ -1,91 +0,0 @@
-import type { InfraManifestInput } from '../../../types';
-import { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';
-import { generateSupabaseStorageArtifacts } from './supabase';
-
-export function generateStorageArtifacts(args: {
-  manifest: InfraManifestInput;
-  namespace: string;
-}): MinikubeAdapterArtifacts {
-  const { manifest, namespace } = args;
-  const spec = manifest.storage;
-
-  if (!spec) {
-    return emptyMinikubeArtifacts();
-  }
-
-  const buckets = normalizeBuckets(spec.buckets);
-  const { provider } = spec;
-  const includeSupabaseConnectionEnvEntries = manifest.auth?.provider !== 'supabase';
-  const emptyBucketsWarning =
-    'Storage buckets are empty after normalization; no storage artifacts generated.';
-
-  switch (provider) {
-    case 'auto': {
-      const shouldResolveToSupabase =
-        manifest.database?.provider === 'supabase' || manifest.auth?.provider === 'supabase';
-
-      if (!shouldResolveToSupabase) {
-        return {
-          ...emptyMinikubeArtifacts(),
-          warnings: [
-            'Storage provider "auto" could not be resolved for minikube; no storage artifacts generated.',
-          ],
-        };
-      }
-
-      if (buckets.length === 0) {
-        return {
-          ...emptyMinikubeArtifacts(),
-          warnings: [emptyBucketsWarning],
-        };
-      }
-
-      return generateSupabaseStorageArtifacts({
-        namespace,
-        buckets,
-        includeSupabaseConnectionEnvEntries,
-      });
-    }
-    case 'supabase': {
-      if (buckets.length === 0) {
-        return {
-          ...emptyMinikubeArtifacts(),
-          warnings: [emptyBucketsWarning],
-        };
-      }
-
-      return generateSupabaseStorageArtifacts({
-        namespace,
-        buckets,
-        includeSupabaseConnectionEnvEntries,
-      });
-    }
-    case 's3':
-    case 'r2':
-      return {
-        ...emptyMinikubeArtifacts(),
-        warnings: [
-          `Storage provider "${provider}" is not implemented for minikube yet; no storage artifacts generated.`,
-        ],
-      };
-    default: {
-      const exhaustiveCheck: never = provider;
-      return exhaustiveCheck;
-    }
-  }
-}
-
-function normalizeBuckets(rawBuckets: readonly string[]): string[] {
-  const normalized: string[] = [];
-  const seen = new Set<string>();
-
-  for (const raw of rawBuckets) {
-    const bucket = raw.trim();
-    if (!bucket) continue;
-    if (seen.has(bucket)) continue;
-    seen.add(bucket);
-    normalized.push(bucket);
-  }
-
-  return normalized;
-}

package/src/adapters/minikube/storage/supabase/index.ts

@@ -1,108 +0,0 @@
-import type { MinikubeAdapterArtifacts } from '../../contracts';
-
-export function generateSupabaseStorageArtifacts(args: {
-  namespace: string;
-  buckets: string[];
-  includeSupabaseConnectionEnvEntries: boolean;
-}): MinikubeAdapterArtifacts {
-  const { namespace, buckets, includeSupabaseConnectionEnvEntries } = args;
-  const root = 'infra/minikube/k8s/storage/supabase';
-  const resourceRoot = 'storage/supabase';
-  const bucketsCsv = buckets.join(',');
-  const defaultBucket = buckets[0] ?? '';
-
-  const envEntries = [
-    'STORAGE_PROVIDER=supabase',
-    'STORAGE_RUNTIME_MODE=local',
-    `STORAGE_BUCKETS=${bucketsCsv}`,
-    `STORAGE_DEFAULT_BUCKET=${defaultBucket}`,
-    'EXPO_PUBLIC_STORAGE_PROVIDER=supabase',
-    `EXPO_PUBLIC_STORAGE_BUCKETS=${bucketsCsv}`,
-    `EXPO_PUBLIC_STORAGE_DEFAULT_BUCKET=${defaultBucket}`,
-  ];
-
-  if (includeSupabaseConnectionEnvEntries) {
-    envEntries.push(
-      '',
-      '# Supabase provider connection details',
-      'EXPO_PUBLIC_SUPABASE_URL=',
-      'EXPO_PUBLIC_SUPABASE_ANON_KEY=',
-    );
-  }
-
-  return {
-    files: [
-      {
-        path: `${root}/supabase-storage.configmap.yaml`,
-        content: getSupabaseStorageConfigMap({
-          namespace,
-          bucketsCsv,
-          defaultBucket,
-        }),
-      },
-      {
-        path: `${root}/app-runtime-storage.env.configmap.yaml`,
-        content: getRuntimeStorageEnvConfigMap({
-          namespace,
-          bucketsCsv,
-          defaultBucket,
-        }),
-      },
-    ],
-    resources: [
-      `${resourceRoot}/supabase-storage.configmap.yaml`,
-      `${resourceRoot}/app-runtime-storage.env.configmap.yaml`,
-    ],
-    providerLifecycle: [],
-    envEntries,
-    warnings: [
-      `Storage buckets are configured but not created automatically yet. Ensure buckets exist in Supabase Storage: ${bucketsCsv}.`,
-    ],
-  };
-}
-
-function getSupabaseStorageConfigMap(args: {
-  namespace: string;
-  bucketsCsv: string;
-  defaultBucket: string;
-}) {
-  const { namespace, bucketsCsv, defaultBucket } = args;
-
-  return `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: supabase-storage-config
-  namespace: ${namespace}
-data:
-  STORAGE_PROVIDER: "supabase"
-  STORAGE_BUCKETS: "${escapeYamlDoubleQuoted(bucketsCsv)}"
-  STORAGE_DEFAULT_BUCKET: "${escapeYamlDoubleQuoted(defaultBucket)}"
-`;
-}
-
-function getRuntimeStorageEnvConfigMap(args: {
-  namespace: string;
-  bucketsCsv: string;
-  defaultBucket: string;
-}) {
-  const { namespace, bucketsCsv, defaultBucket } = args;
-
-  return `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: app-runtime-storage-env
-  namespace: ${namespace}
-data:
-  STORAGE_PROVIDER: "supabase"
-  STORAGE_RUNTIME_MODE: "local"
-  STORAGE_BUCKETS: "${escapeYamlDoubleQuoted(bucketsCsv)}"
-  STORAGE_DEFAULT_BUCKET: "${escapeYamlDoubleQuoted(defaultBucket)}"
-  EXPO_PUBLIC_STORAGE_PROVIDER: "supabase"
-  EXPO_PUBLIC_STORAGE_BUCKETS: "${escapeYamlDoubleQuoted(bucketsCsv)}"
-  EXPO_PUBLIC_STORAGE_DEFAULT_BUCKET: "${escapeYamlDoubleQuoted(defaultBucket)}"
-`;
-}
-
-function escapeYamlDoubleQuoted(value: string): string {
-  return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
-}

package/src/apiInfrastructure.test.ts

@@ -1,69 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-
-import { generateInfrastructure } from './index';
-import { createAppManifest } from './testSupport';
-import type { InfraManifestInput } from './types';
-
-const DEPLOYMENT = { target: 'minikube', monitoring: false } as const;
-
-describe('canonical API infrastructure', () => {
-  test('treats external APIs as infrastructure no-ops', () => {
-    const manifest: InfraManifestInput = {
-      deployment: DEPLOYMENT,
-      modules: [],
-      apis: [
-        {
-          id: 'nutrition',
-          origin: 'external',
-          protocol: 'rest',
-          baseUrl: 'https://api.ankhorage.com/v1/nutrition',
-          endpoints: {},
-        },
-      ],
-    };
-
-    const result = generateInfrastructure(manifest, {
-      appManifest: createAppManifest('nutrition', manifest),
-    });
-
-    expect(result.warnings).not.toContainEqual(expect.stringContaining('infra.apis.nutrition'));
-    expect(listApiArtifactPaths(result.files)).toEqual([]);
-  });
-
-  test('warns for internal APIs without generating partial API infrastructure', () => {
-    const manifest: InfraManifestInput = {
-      deployment: DEPLOYMENT,
-      modules: [],
-      apis: [
-        {
-          id: 'orders',
-          origin: 'internal',
-          protocol: 'rest',
-          basePath: '/api/orders',
-          endpoints: {},
-        },
-      ],
-    };
-
-    const result = generateInfrastructure(manifest, {
-      appManifest: createAppManifest('orders', manifest),
-    });
-
-    expect(result.warnings).toContain(
-      'infra.apis.orders has origin "internal", but internal API provisioning is not supported in Phase 1; no API infrastructure will be generated.',
-    );
-    expect(listApiArtifactPaths(result.files)).toEqual([]);
-  });
-});
-
-function listApiArtifactPaths(files: readonly { readonly path: string }[]): readonly string[] {
-  return files
-    .map((file) => file.path)
-    .filter(
-      (path) =>
-        path.includes('generated-api') ||
-        path.includes('generated_api') ||
-        path.includes('/api/deployment') ||
-        path.includes('/api/service'),
-    );
-}

package/src/authRedirects.test.ts

@@ -1,63 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-
-import { getLocalAuthRedirectPatterns, resolveAuthRedirectConfiguration } from './authRedirects';
-
-describe('resolveAuthRedirectConfiguration', () => {
-  test('derives an exact provider callback and local browser callback policy', () => {
-    const config = resolveAuthRedirectConfiguration({
-      environment: 'local',
-      gatewayOrigin: 'http://127.0.0.1:18081/',
-      siteOrigin: 'http://127.0.0.1:18080/',
-      callbackRoute: 'auth/callback',
-      webOrigins: ['http://localhost:8081'],
-      nativeRedirectUris: ['ankh-demo://auth/callback'],
-    });
-
-    expect(config.providerCallbackUrl).toBe('http://127.0.0.1:18081/auth/v1/callback');
-    expect(config.siteUrl).toBe('http://127.0.0.1:18080');
-    expect(config.redirectAllowList).toEqual([
-      'http://127.0.0.1:18080',
-      'http://localhost:8081',
-      'http://127.0.0.1:18080/auth/callback',
-      'http://localhost:8081/auth/callback',
-      'http://127.0.0.1:*/auth/callback',
-      'http://localhost:*/auth/callback',
-      'ankh-demo://auth/callback',
-    ]);
-  });
-
-  test('never leaks local wildcard policy into preview or production', () => {
-    for (const environment of ['preview', 'production'] as const) {
-      const config = resolveAuthRedirectConfiguration({
-        environment,
-        gatewayOrigin: 'https://api.example.test',
-        siteOrigin: 'https://app.example.test',
-        callbackRoute: '/auth/callback',
-      });
-
-      expect(config.redirectAllowList).toEqual([
-        'https://app.example.test',
-        'https://app.example.test/auth/callback',
-      ]);
-      expect(config.serializedRedirectAllowList).not.toContain('localhost');
-      expect(config.serializedRedirectAllowList).not.toContain('127.0.0.1');
-      expect(config.serializedRedirectAllowList).not.toContain('*');
-    }
-  });
-
-  test('normalizes callback routes and rejects unsafe origins', () => {
-    expect(getLocalAuthRedirectPatterns('//auth//callback')).toEqual([
-      'http://127.0.0.1:*/auth/callback',
-      'http://localhost:*/auth/callback',
-    ]);
-
-    expect(() =>
-      resolveAuthRedirectConfiguration({
-        environment: 'production',
-        gatewayOrigin: 'https://user:secret@example.test',
-        siteOrigin: 'https://app.example.test',
-        callbackRoute: '/auth/callback',
-      }),
-    ).toThrow('gatewayOrigin must be a canonical origin');
-  });
-});

package/src/authRedirects.ts

@@ -1,113 +0,0 @@
-export type AuthRedirectEnvironment = 'local' | 'preview' | 'production';
-
-export interface ResolveAuthRedirectConfigurationInput {
-  environment: AuthRedirectEnvironment;
-  gatewayOrigin: string;
-  siteOrigin: string;
-  callbackRoute: string;
-  webOrigins?: readonly string[];
-  nativeRedirectUris?: readonly string[];
-}
-
-export interface AuthRedirectConfiguration {
-  providerCallbackUrl: string;
-  siteUrl: string;
-  redirectAllowList: readonly string[];
-  serializedRedirectAllowList: string;
-}
-
-export function resolveAuthRedirectConfiguration(
-  input: ResolveAuthRedirectConfigurationInput,
-): AuthRedirectConfiguration {
-  const gatewayOrigin = normalizeWebOrigin(input.gatewayOrigin, 'gatewayOrigin');
-  const siteUrl = normalizeWebOrigin(input.siteOrigin, 'siteOrigin');
-  const callbackRoute = normalizeCallbackRoute(input.callbackRoute);
-  const webOrigins = unique([
-    siteUrl,
-    ...(input.webOrigins ?? []).map((origin) => normalizeWebOrigin(origin, 'webOrigins')),
-  ]);
-  const nativeRedirectUris = unique(
-    (input.nativeRedirectUris ?? []).map((uri) => normalizeNativeRedirectUri(uri)),
-  );
-
-  const redirectAllowList = unique([
-    ...webOrigins,
-    ...webOrigins.map((origin) => `${origin}${callbackRoute}`),
-    ...(input.environment === 'local' ? getLocalAuthRedirectPatterns(callbackRoute) : []),
-    ...nativeRedirectUris,
-  ]);
-
-  return {
-    providerCallbackUrl: `${gatewayOrigin}/auth/v1/callback`,
-    siteUrl,
-    redirectAllowList,
-    serializedRedirectAllowList: redirectAllowList.join(','),
-  };
-}
-
-export function getLocalAuthRedirectPatterns(callbackRoute: string): readonly string[] {
-  const normalizedRoute = normalizeCallbackRoute(callbackRoute);
-  return [`http://127.0.0.1:*${normalizedRoute}`, `http://localhost:*${normalizedRoute}`];
-}
-
-export function normalizeAuthCallbackRoute(callbackRoute: string): string {
-  return normalizeCallbackRoute(callbackRoute);
-}
-
-function normalizeCallbackRoute(callbackRoute: string): string {
-  const trimmed = callbackRoute.trim();
-  if (!trimmed) {
-    throw new Error('Auth callback route must not be empty.');
-  }
-
-  const withLeadingSlash = trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
-  const normalized = withLeadingSlash.replace(/\/{2,}/gu, '/');
-  if (normalized.includes('?') || normalized.includes('#')) {
-    throw new Error('Auth callback route must not include a query string or fragment.');
-  }
-  return normalized;
-}
-
-function normalizeWebOrigin(value: string, field: string): string {
-  const parsed = parseUrl(value, field);
-  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-    throw new Error(`${field} must use http or https.`);
-  }
-  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
-    throw new Error(`${field} must be a canonical origin without credentials, query, or fragment.`);
-  }
-  if (parsed.pathname !== '/' && parsed.pathname !== '') {
-    throw new Error(`${field} must not include a path.`);
-  }
-  return parsed.origin;
-}
-
-function normalizeNativeRedirectUri(value: string): string {
-  const parsed = parseUrl(value, 'nativeRedirectUris');
-  if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
-    throw new Error('nativeRedirectUris must use a non-HTTP application scheme.');
-  }
-  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
-    throw new Error(
-      'nativeRedirectUris must not include credentials, query strings, or fragments.',
-    );
-  }
-  return parsed.toString();
-}
-
-function parseUrl(value: string, field: string): URL {
-  const trimmed = value.trim();
-  if (!trimmed) {
-    throw new Error(`${field} must not contain empty values.`);
-  }
-
-  try {
-    return new URL(trimmed);
-  } catch {
-    throw new Error(`${field} contains an invalid URL.`);
-  }
-}
-
-function unique(values: readonly string[]): string[] {
-  return [...new Set(values)];
-}

package/src/authTargetRedirects.test.ts

@@ -1,62 +0,0 @@
-import type { AppDeployTargets } from '@ankhorage/contracts/deploy';
-import { describe, expect, test } from 'bun:test';
-
-import { resolveAuthTargetRedirectModel } from './authTargetRedirects';
-
-describe('resolveAuthTargetRedirectModel', () => {
-  test('derives enabled native callbacks and deduplicates shared schemes', () => {
-    const targets: AppDeployTargets = {
-      web: { enabled: true },
-      android: {
-        enabled: true,
-        package: 'com.ankh.demo',
-        scheme: 'ankh-demo',
-      },
-      ios: {
-        enabled: true,
-        bundleIdentifier: 'com.ankh.demo',
-        scheme: 'ankh-demo',
-      },
-    };
-
-    expect(resolveAuthTargetRedirectModel({ callbackRoute: '/auth/callback', targets })).toEqual({
-      nativeRedirectUris: ['ankh-demo://auth/callback'],
-      warnings: [],
-      webEnabled: true,
-    });
-  });
-
-  test('omits disabled targets and warns instead of guessing missing native schemes', () => {
-    const targets: AppDeployTargets = {
-      web: { enabled: false },
-      android: {
-        enabled: false,
-        package: 'com.ankh.demo',
-      },
-      ios: {
-        enabled: true,
-        bundleIdentifier: 'com.ankh.demo',
-      },
-    };
-
-    const result = resolveAuthTargetRedirectModel({ callbackRoute: '/auth/callback', targets });
-
-    expect(result.nativeRedirectUris).toEqual([]);
-    expect(result.webEnabled).toBe(false);
-    expect(result.warnings).toEqual([
-      'OAuth ios target is enabled but deploy.targets.ios.scheme is missing; native callback omitted.',
-    ]);
-  });
-
-  test('keeps the pre-target manifest path Web-only and explicit', () => {
-    expect(
-      resolveAuthTargetRedirectModel({ callbackRoute: '/auth/callback', targets: undefined }),
-    ).toEqual({
-      nativeRedirectUris: [],
-      warnings: [
-        'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
-      ],
-      webEnabled: true,
-    });
-  });
-});

package/src/authTargetRedirects.ts

@@ -1,46 +0,0 @@
-import type { AppDeployTargets } from '@ankhorage/contracts/deploy';
-
-interface AuthTargetRedirectModel {
-  readonly nativeRedirectUris: readonly string[];
-  readonly warnings: readonly string[];
-  readonly webEnabled: boolean;
-}
-
-export function resolveAuthTargetRedirectModel(args: {
-  readonly callbackRoute: string;
-  readonly targets: AppDeployTargets | undefined;
-}): AuthTargetRedirectModel {
-  if (args.targets === undefined) {
-    return {
-      nativeRedirectUris: [],
-      warnings: [
-        'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
-      ],
-      webEnabled: true,
-    };
-  }
-
-  const callbackPath = args.callbackRoute.replace(/^\/+/u, '');
-  const nativeRedirectUris: string[] = [];
-  const warnings: string[] = [];
-
-  for (const [targetId, target] of [
-    ['android', args.targets.android],
-    ['ios', args.targets.ios],
-  ] as const) {
-    if (target?.enabled !== true) continue;
-    if (target.scheme === undefined) {
-      warnings.push(
-        `OAuth ${targetId} target is enabled but deploy.targets.${targetId}.scheme is missing; native callback omitted.`,
-      );
-      continue;
-    }
-    nativeRedirectUris.push(`${target.scheme}://${callbackPath}`);
-  }
-
-  return {
-    nativeRedirectUris: [...new Set(nativeRedirectUris)],
-    warnings,
-    webEnabled: args.targets.web?.enabled === true,
-  };
-}

package/src/commandContext.ts

@@ -1,27 +0,0 @@
-import { INFRA_PACKAGE_VERSION } from './packageMetadata.js';
-
-export interface InfraCommandContext {
-  readonly cwd: string;
-  readonly env: Readonly<Record<string, string | undefined>>;
-  readonly version: string;
-  writeStdout(text: string): void;
-  writeStderr(text: string): void;
-}
-
-export interface InfraCommandRunResult {
-  readonly exitCode: number;
-}
-
-export function createDefaultCommandContext(): InfraCommandContext {
-  return {
-    cwd: process.cwd(),
-    env: process.env,
-    version: INFRA_PACKAGE_VERSION,
-    writeStdout(text: string) {
-      process.stdout.write(text);
-    },
-    writeStderr(text: string) {
-      process.stderr.write(text);
-    },
-  };
-}