@ankhorage/infra 4.1.12 → 5.1.0

package/src/adapters/minikube/auth/supabase/profile.ts

@@ -1,526 +0,0 @@
-import { createHash } from 'node:crypto';
-
-import type { InfraManifestInput } from '../../../../types';
-
-const DEFAULT_PROFILE_FIELDS = ['email', 'firstName', 'lastName'];
-const DEFAULT_PROFILE_PRIMARY_KEY = 'authUserId';
-const DEFAULT_PROFILE_CREATE_STRATEGY = 'trigger';
-const DEFAULT_PROFILE_UPDATE_STRATEGY = 'api';
-const PROFILE_POLICY_VERSION = 1;
-const PROFILE_RECONCILER_VERSION = 1;
-const PROFILE_ARTIFACT_KEY = 'auth.profile';
-
-const MANAGED_PROFILE_COLUMNS = [
-  'email',
-  'display_name',
-  'first_name',
-  'last_name',
-  'avatar_url',
-  'username',
-  'phone',
-] as const;
-
-interface ProfileColumnSpec {
-  readonly field: string;
-  readonly column: string;
-  readonly sqlType: string;
-  readonly fromNewUser: string;
-}
-
-export interface ResolvedProfileModel {
-  readonly enabled: boolean;
-  readonly table: string;
-  readonly primaryKey: string;
-  readonly createStrategy: string;
-  readonly updateStrategy: string;
-  readonly columns: readonly ProfileColumnSpec[];
-  readonly desiredStateHash: string;
-}
-
-export function resolveSupabaseProfileModel(manifest: InfraManifestInput): ResolvedProfileModel {
-  const table = normalizeIdentifier(manifest.auth?.profile?.table ?? '');
-  const fields = normalizeFieldList(manifest.auth?.profile?.fields);
-  const primaryKey = manifest.auth?.profile?.primaryKey ?? DEFAULT_PROFILE_PRIMARY_KEY;
-  const createStrategy = manifest.auth?.profile?.createStrategy ?? DEFAULT_PROFILE_CREATE_STRATEGY;
-  const updateStrategy = manifest.auth?.profile?.updateStrategy ?? DEFAULT_PROFILE_UPDATE_STRATEGY;
-  const columns = resolveProfileColumns(fields);
-
-  const hash = table
-    ? getProfileDesiredStateHash({
-        table,
-        primaryKey,
-        createStrategy,
-        updateStrategy,
-        columns,
-      })
-    : '';
-
-  return {
-    enabled: table.length > 0,
-    table,
-    primaryKey,
-    createStrategy,
-    updateStrategy,
-    columns,
-    desiredStateHash: hash,
-  };
-}
-
-export function getSupabaseProfileReconciliation(profileModel: ResolvedProfileModel): string {
-  const table = quoteIdentifier(profileModel.table);
-  const functionName = quoteIdentifier(`handle_new_${profileModel.table}_user`);
-  const triggerName = quoteIdentifier(`on_auth_user_created_${profileModel.table}`);
-  const configuredColumns = new Set(profileModel.columns.map((column) => column.column));
-  const addColumnSql = profileModel.columns
-    .map(
-      (column) =>
-        `alter table public.${table} add column if not exists ${quoteIdentifier(column.column)} ${column.sqlType};`,
-    )
-    .join('\n');
-  const dropStaleManagedColumnSql = MANAGED_PROFILE_COLUMNS.filter(
-    (column) => !configuredColumns.has(column),
-  )
-    .map(
-      (column) => `alter table public.${table} drop column if exists ${quoteIdentifier(column)};`,
-    )
-    .join('\n');
-  const insertColumns = ['id', ...profileModel.columns.map((column) => column.column)]
-    .map(quoteIdentifier)
-    .join(', ');
-  const insertValues = ['new.id', ...profileModel.columns.map((column) => column.fromNewUser)].join(
-    ', ',
-  );
-  const updateAssignments = profileModel.columns
-    .filter((column) => column.field === 'email')
-    .map(
-      (column) => `${quoteIdentifier(column.column)} = excluded.${quoteIdentifier(column.column)}`,
-    );
-  const conflictUpdate = [...updateAssignments, 'updated_at = now()'].join(',\n    ');
-  const updateGrantColumns = profileModel.columns.map((column) => quoteIdentifier(column.column));
-  const updateGrantSql =
-    updateGrantColumns.length > 0
-      ? `grant update (${updateGrantColumns.join(', ')}) on table public.${table} to authenticated;`
-      : '';
-  const triggerSql =
-    profileModel.createStrategy === 'trigger'
-      ? `
-create or replace function public.${functionName}()
-returns trigger
-language plpgsql
-security definer
-set search_path = pg_catalog, pg_temp
-as $$
-begin
-  insert into public.${table} (${insertColumns})
-  values (${insertValues})
-  on conflict (id) do update set
-    ${conflictUpdate};
-
-  return new;
-end;
-$$;
-
-revoke execute on function public.${functionName}() from PUBLIC;
-revoke execute on function public.${functionName}() from anon;
-revoke execute on function public.${functionName}() from authenticated;
-
-drop trigger if exists ${triggerName} on auth.users;
-create trigger ${triggerName}
-  after insert on auth.users
-  for each row execute function public.${functionName}();
-`
-      : `
-drop trigger if exists ${triggerName} on auth.users;
-drop function if exists public.${functionName}();
-`;
-
-  return `-- Generated by @ankhorage/infra from manifest.auth.profile.
--- Desired-state reconciliation for local Supabase; not a migration-history entry.
-
-begin;
-
-create schema if not exists ankhorage_internal;
-
-create table if not exists ankhorage_internal.generated_schema_state (
-  artifact_key text primary key,
-  table_name text,
-  content_hash text not null,
-  applied_at timestamptz not null
-);
-
-alter table ankhorage_internal.generated_schema_state
-  add column if not exists table_name text;
-
-do $$
-declare
-  previous_table_name text;
-  has_previous_state boolean;
-begin
-  select table_name, true
-    into previous_table_name, has_previous_state
-    from ankhorage_internal.generated_schema_state
-    where artifact_key = '${PROFILE_ARTIFACT_KEY}';
-
-  if has_previous_state and previous_table_name is null then
-    raise exception 'existing auth.profile generated state is missing table identity; reset local Supabase or add an explicit cleanup migration before applying generated profile reconciliation';
-  end if;
-
-  if has_previous_state and previous_table_name <> '${escapeSqlLiteral(profileModel.table)}' then
-    raise exception 'profile.table changed from % to %; reset local Supabase or add an explicit cleanup migration before applying generated profile reconciliation', previous_table_name, '${escapeSqlLiteral(profileModel.table)}';
-  end if;
-end;
-$$;
-
-create table if not exists public.${table} (
-  id uuid primary key references auth.users(id) on delete cascade,
-  created_at timestamptz not null default now(),
-  updated_at timestamptz not null default now()
-);
-
-alter table public.${table} add column if not exists id uuid;
-alter table public.${table} add column if not exists created_at timestamptz not null default now();
-alter table public.${table} add column if not exists updated_at timestamptz not null default now();
-${addColumnSql}
-alter table public.${table} drop column if exists role;
-${dropStaleManagedColumnSql}
-
-do $$
-begin
-  if exists (
-    select 1
-    from pg_constraint c
-    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-      and c.contype = 'p'
-      and c.conkey <> array[
-        (
-          select a.attnum
-          from pg_attribute a
-          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-            and a.attname = 'id'
-            and not a.attisdropped
-        )
-      ]::smallint[]
-  ) then
-    raise exception 'profile table public.${escapeSqlLiteral(profileModel.table)} has a primary key that is not exactly id';
-  end if;
-
-  if not exists (
-    select 1
-    from pg_constraint
-    where conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-      and contype = 'p'
-  ) then
-    alter table public.${table}
-      add constraint ${quoteIdentifier(`${profileModel.table}_pkey`)} primary key (id);
-  end if;
-end;
-$$;
-
-do $$
-begin
-  if exists (
-    select 1
-    from pg_constraint c
-    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-      and c.contype = 'f'
-      and c.confrelid = 'auth.users'::regclass
-      and c.conkey && array[
-        (
-          select a.attnum
-          from pg_attribute a
-          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-            and a.attname = 'id'
-            and not a.attisdropped
-        )
-      ]::smallint[]
-      and (
-        c.confdeltype <> 'c'
-        or c.conkey <> array[
-          (
-            select a.attnum
-            from pg_attribute a
-            where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-              and a.attname = 'id'
-              and not a.attisdropped
-          )
-        ]::smallint[]
-        or c.confkey <> array[
-          (
-            select a.attnum
-            from pg_attribute a
-            where a.attrelid = 'auth.users'::regclass
-              and a.attname = 'id'
-              and not a.attisdropped
-          )
-        ]::smallint[]
-      )
-  ) then
-    raise exception 'profile table public.${escapeSqlLiteral(profileModel.table)} has an auth.users foreign key that is not exactly id -> auth.users(id) on delete cascade';
-  end if;
-
-  if not exists (
-    select 1
-    from pg_constraint c
-    where c.conrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-      and c.confrelid = 'auth.users'::regclass
-      and c.contype = 'f'
-      and c.confdeltype = 'c'
-      and c.conkey = array[
-        (
-          select a.attnum
-          from pg_attribute a
-          where a.attrelid = 'public.${escapeSqlLiteral(profileModel.table)}'::regclass
-            and a.attname = 'id'
-            and not a.attisdropped
-        )
-      ]::smallint[]
-      and c.confkey = array[
-        (
-          select a.attnum
-          from pg_attribute a
-          where a.attrelid = 'auth.users'::regclass
-            and a.attname = 'id'
-            and not a.attisdropped
-        )
-      ]::smallint[]
-  ) then
-    alter table public.${table}
-      add constraint ${quoteIdentifier(`${profileModel.table}_id_auth_users_fkey`)}
-      foreign key (id) references auth.users(id) on delete cascade;
-  end if;
-end;
-$$;
-
-do $$
-begin
-  if not exists (
-    select 1
-    from information_schema.columns c
-    where c.table_schema = 'public'
-      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'
-      and c.column_name = 'id'
-      and c.udt_name = 'uuid'
-      and c.is_nullable = 'NO'
-  ) then
-    raise exception 'profile id column must be uuid not null';
-  end if;
-
-  if not exists (
-    select 1
-    from information_schema.columns c
-    where c.table_schema = 'public'
-      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'
-      and c.column_name = 'created_at'
-      and c.data_type = 'timestamp with time zone'
-      and c.is_nullable = 'NO'
-      and c.column_default = 'now()'
-  ) then
-    raise exception 'profile created_at column must be timestamptz not null default now()';
-  end if;
-
-  if not exists (
-    select 1
-    from information_schema.columns c
-    where c.table_schema = 'public'
-      and c.table_name = '${escapeSqlLiteral(profileModel.table)}'
-      and c.column_name = 'updated_at'
-      and c.data_type = 'timestamp with time zone'
-      and c.is_nullable = 'NO'
-      and c.column_default = 'now()'
-  ) then
-    raise exception 'profile updated_at column must be timestamptz not null default now()';
-  end if;
-end;
-$$;
-
-alter table public.${table} enable row level security;
-
-revoke all on table public.${table} from anon, authenticated;
-grant select on table public.${table} to authenticated;
-${updateGrantSql}
-
-drop policy if exists ${quoteIdentifier(`${profileModel.table}_select_own`)} on public.${table};
-create policy ${quoteIdentifier(`${profileModel.table}_select_own`)}
-  on public.${table}
-  for select
-  to authenticated
-  using ((select auth.uid()) = id);
-
-drop policy if exists ${quoteIdentifier(`${profileModel.table}_update_own`)} on public.${table};
-create policy ${quoteIdentifier(`${profileModel.table}_update_own`)}
-  on public.${table}
-  for update
-  to authenticated
-  using ((select auth.uid()) = id)
-  with check ((select auth.uid()) = id);
-${triggerSql}
-insert into ankhorage_internal.generated_schema_state (
-  artifact_key,
-  table_name,
-  content_hash,
-  applied_at
-)
-values (
-  '${PROFILE_ARTIFACT_KEY}',
-  '${escapeSqlLiteral(profileModel.table)}',
-  '${profileModel.desiredStateHash}',
-  now()
-)
-on conflict (artifact_key)
-do update set
-  table_name = excluded.table_name,
-  content_hash = excluded.content_hash,
-  applied_at = excluded.applied_at;
-
-commit;
-`;
-}
-
-function mapProfileFieldToColumn(field: string): ProfileColumnSpec | null {
-  switch (field) {
-    case 'email':
-      return { field, column: 'email', sqlType: 'text', fromNewUser: 'new.email' };
-    case 'displayName':
-      return {
-        field,
-        column: 'display_name',
-        sqlType: 'text',
-        fromNewUser:
-          "coalesce(new.raw_user_meta_data->>'displayName', new.raw_user_meta_data->>'display_name', split_part(new.email, '@', 1))",
-      };
-    case 'firstName':
-      return {
-        field,
-        column: 'first_name',
-        sqlType: 'text',
-        fromNewUser:
-          "coalesce(new.raw_user_meta_data->>'firstName', new.raw_user_meta_data->>'first_name')",
-      };
-    case 'lastName':
-      return {
-        field,
-        column: 'last_name',
-        sqlType: 'text',
-        fromNewUser:
-          "coalesce(new.raw_user_meta_data->>'lastName', new.raw_user_meta_data->>'last_name')",
-      };
-    case 'avatarUrl':
-      return {
-        field,
-        column: 'avatar_url',
-        sqlType: 'text',
-        fromNewUser:
-          "coalesce(new.raw_user_meta_data->>'avatarUrl', new.raw_user_meta_data->>'avatar_url')",
-      };
-    case 'username':
-      return {
-        field,
-        column: 'username',
-        sqlType: 'text',
-        fromNewUser: "new.raw_user_meta_data->>'username'",
-      };
-    case 'phone':
-      return { field, column: 'phone', sqlType: 'text', fromNewUser: 'new.phone' };
-    default:
-      return null;
-  }
-}
-
-function quoteIdentifier(value: string): string {
-  return `"${value.replaceAll('"', '""')}"`;
-}
-
-function getProfileDesiredStateHash(args: {
-  readonly table: string;
-  readonly primaryKey: string;
-  readonly createStrategy: string;
-  readonly updateStrategy: string;
-  readonly columns: readonly ProfileColumnSpec[];
-}): string {
-  const state = {
-    artifactKey: PROFILE_ARTIFACT_KEY,
-    table: args.table,
-    primaryKey: args.primaryKey,
-    createStrategy: args.createStrategy,
-    updateStrategy: args.updateStrategy,
-    managedColumns: args.columns.map((column) => ({
-      field: column.field,
-      column: column.column,
-      sqlType: column.sqlType,
-    })),
-    policyVersion: PROFILE_POLICY_VERSION,
-    reconcilerVersion: PROFILE_RECONCILER_VERSION,
-  };
-
-  return createHash('sha256').update(JSON.stringify(state)).digest('hex');
-}
-
-function resolveProfileColumns(fields: readonly string[]): ProfileColumnSpec[] {
-  const columns = new Map<string, ProfileColumnSpec>();
-
-  for (const field of fields) {
-    const column = mapProfileFieldToColumn(field);
-    if (!column) {
-      throw new Error(
-        `Unsupported Supabase profile field "${field}". Supported fields: ${getSupportedProfileFields().join(', ')}.`,
-      );
-    }
-
-    if (columns.has(column.column)) {
-      continue;
-    }
-    columns.set(column.column, column);
-  }
-
-  return [...columns.values()].sort(
-    (left, right) =>
-      MANAGED_PROFILE_COLUMNS.indexOf(left.column as (typeof MANAGED_PROFILE_COLUMNS)[number]) -
-      MANAGED_PROFILE_COLUMNS.indexOf(right.column as (typeof MANAGED_PROFILE_COLUMNS)[number]),
-  );
-}
-
-function normalizeFieldList(values: readonly string[] | undefined): string[] {
-  const source = values ?? DEFAULT_PROFILE_FIELDS;
-  const next: string[] = [];
-
-  for (const value of source) {
-    const normalized = value.trim();
-    if (!normalized) {
-      throw new Error('Invalid Supabase profile field "". Profile fields must be non-empty.');
-    }
-
-    if (next.includes(normalized)) {
-      continue;
-    }
-    next.push(normalized);
-  }
-
-  return next;
-}
-
-function getSupportedProfileFields(): string[] {
-  return ['email', 'displayName', 'firstName', 'lastName', 'avatarUrl', 'username', 'phone'];
-}
-
-function normalizeIdentifier(value: string): string {
-  const trimmed = value.trim();
-  if (!trimmed) return '';
-
-  if (trimmed === 'users') {
-    throw new Error(
-      'Invalid Supabase profile table identifier "users". public.users is reserved for identity conflict detection; use a dedicated profile table such as "profiles".',
-    );
-  }
-
-  if (!/^[a-z_][a-z0-9_]*$/.test(trimmed)) {
-    throw new Error(
-      `Invalid Supabase profile table identifier "${trimmed}". Use snake_case letters, numbers, and underscores.`,
-    );
-  }
-
-  return trimmed;
-}
-
-function escapeSqlLiteral(value: string): string {
-  return value.replaceAll("'", "''");
-}

package/src/adapters/minikube/auth/supabase/providerAssignments.test.ts

@@ -1,36 +0,0 @@
-import type { InfraManifest } from '@ankhorage/contracts';
-import { expect, test } from 'bun:test';
-
-import { generateInfrastructure } from '../../../../index';
-import { createAppManifest } from '../../../../testSupport';
-
-test('keeps multiple provider redirect assignments as separate shell arguments', () => {
-  const manifest: InfraManifest = {
-    deployment: { target: 'minikube', monitoring: false },
-    auth: {
-      scope: 'global',
-      provider: 'supabase',
-      oauth: {
-        enabled: true,
-        callbackRoute: '/auth/callback',
-        providers: [
-          { id: 'google', enabled: true, credentialsRef: 'auth/oauth/google' },
-          { id: 'apple', enabled: true, credentialsRef: 'auth/oauth/apple' },
-        ],
-      },
-    },
-    database: { provider: 'supabase', tier: 'dev' },
-    secretStore: { provider: 'supabase-vault' },
-    modules: [],
-  };
-  const result = generateInfrastructure(manifest, {
-    appManifest: createAppManifest('multi-oauth'),
-  });
-  const upScript = result.files.find(
-    (file) => file.path === 'infra/minikube/scripts/up.sh',
-  )?.content;
-
-  expect(upScript).toContain('GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI="${oauth_provider_callback}"');
-  expect(upScript).toContain('GOTRUE_EXTERNAL_APPLE_REDIRECT_URI="${oauth_provider_callback}"');
-  expect(upScript).not.toContain('\\  GOTRUE_EXTERNAL_APPLE_REDIRECT_URI');
-});

package/src/adapters/minikube/auth/targetAwareOAuthRuntime.test.ts

@@ -1,83 +0,0 @@
-import type { InfraManifest } from '@ankhorage/contracts';
-import { describe, expect, test } from 'bun:test';
-
-import { createAppManifest } from '../../../testSupport';
-import { generateTargetAwareSupabaseOAuthRuntimeArtifacts } from './targetAwareOAuthRuntime';
-
-describe('target-aware Supabase OAuth runtime', () => {
-  test('removes the legacy native redirect environment source', () => {
-    const artifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({
-      appManifest: undefined,
-      manifest: createOAuthManifest(),
-    });
-    const [lifecycle] = artifacts.providerLifecycle;
-    const command = lifecycle?.reconciliationCommands[0]?.command ?? '';
-
-    expect(command).toContain('http://127.0.0.1:*/auth/callback');
-    expect(command).toContain('http://localhost:*/auth/callback');
-    expect(command).not.toContain('OAUTH_NATIVE_REDIRECT_URLS');
-    expect(artifacts.warnings).toEqual([
-      'OAuth deploy.targets is missing; Infra keeps Web-local redirects only until canonical targets are persisted.',
-    ]);
-  });
-
-  test('emits only the enabled native callback for a native-only app', () => {
-    const appManifest = {
-      ...createAppManifest('native-oauth'),
-      deploy: {
-        targets: {
-          web: { enabled: false },
-          android: {
-            enabled: true,
-            package: 'com.ankh.native',
-            scheme: 'ankh-native',
-          },
-          ios: {
-            enabled: false,
-            bundleIdentifier: 'com.ankh.native',
-          },
-        },
-      },
-    };
-    const artifacts = generateTargetAwareSupabaseOAuthRuntimeArtifacts({
-      appManifest,
-      manifest: createOAuthManifest(),
-    });
-    const [lifecycle] = artifacts.providerLifecycle;
-    const command = lifecycle?.reconciliationCommands[0]?.command ?? '';
-    const status = lifecycle?.statusChecks[0]?.command ?? '';
-
-    expect(command).toContain("oauth_redirect_allow_list='ankh-native://auth/callback'");
-    expect(command).not.toContain('oauth_site_url');
-    expect(command).not.toContain('localhost:*');
-    expect(command).not.toContain('127.0.0.1:*');
-    expect(command).not.toContain('OAUTH_NATIVE_REDIRECT_URLS');
-    expect(status).toContain('app-callback: disabled (web target)');
-    expect(status).toContain('native-callbacks: ankh-native://auth/callback');
-    expect(artifacts.warnings).toEqual([]);
-  });
-});
-
-function createOAuthManifest(): InfraManifest {
-  return {
-    deployment: { target: 'minikube', monitoring: false },
-    auth: {
-      scope: 'global',
-      provider: 'supabase',
-      oauth: {
-        enabled: true,
-        callbackRoute: '/auth/callback',
-        providers: [
-          {
-            id: 'google',
-            enabled: true,
-            credentialsRef: 'auth/oauth/google',
-          },
-        ],
-      },
-    },
-    database: { provider: 'supabase', tier: 'dev' },
-    secretStore: { provider: 'supabase-vault' },
-    modules: [],
-  };
-}