@ankhorage/infra 4.1.12 → 5.1.0

package/src/adapters/minikube/auth/targetAwareOAuthRuntime.ts

@@ -1,136 +0,0 @@
-import { getLocalAuthRedirectPatterns, normalizeAuthCallbackRoute } from '../../../authRedirects';
-import { resolveAuthTargetRedirectModel } from '../../../authTargetRedirects';
-import type { InfraManifestInput, InfrastructureGenerationOptions } from '../../../types';
-import type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../contracts';
-import { generateSupabaseOAuthRuntimeArtifacts } from './oauthRuntime';
-
-interface RedirectPolicy {
-  readonly callbackRoute: string;
-  readonly localPatterns: readonly string[];
-  readonly nativeRedirectUris: readonly string[];
-  readonly webEnabled: boolean;
-}
-
-export function generateTargetAwareSupabaseOAuthRuntimeArtifacts(args: {
-  readonly appManifest: InfrastructureGenerationOptions['appManifest'];
-  readonly manifest: InfraManifestInput;
-}): MinikubeAdapterArtifacts {
-  const baseArtifacts = generateSupabaseOAuthRuntimeArtifacts(args.manifest);
-  if (!baseArtifacts.providerLifecycle.some((lifecycle) => lifecycle.id === 'supabase-auth')) {
-    return baseArtifacts;
-  }
-
-  const callbackRoute = normalizeAuthCallbackRoute(args.manifest.auth?.oauth?.callbackRoute ?? '');
-  const targets = resolveAuthTargetRedirectModel({
-    callbackRoute,
-    targets: args.appManifest?.deploy?.targets,
-  });
-  const policy: RedirectPolicy = {
-    callbackRoute,
-    localPatterns: targets.webEnabled ? getLocalAuthRedirectPatterns(callbackRoute) : [],
-    nativeRedirectUris: targets.nativeRedirectUris,
-    webEnabled: targets.webEnabled,
-  };
-
-  return {
-    ...baseArtifacts,
-    files: baseArtifacts.files.map((file) =>
-      file.path === 'infra/minikube/auth/oauth-runtime.md'
-        ? { ...file, content: getTargetAwareGuide(policy) }
-        : file,
-    ),
-    providerLifecycle: baseArtifacts.providerLifecycle.map((lifecycle) =>
-      lifecycle.id === 'supabase-auth' ? applyRedirectPolicy(lifecycle, policy) : lifecycle,
-    ),
-    warnings: [...baseArtifacts.warnings, ...targets.warnings],
-  };
-}
-
-function applyRedirectPolicy(
-  lifecycle: MinikubeProviderLifecycle,
-  policy: RedirectPolicy,
-): MinikubeProviderLifecycle {
-  return {
-    ...lifecycle,
-    reconciliationCommands: lifecycle.reconciliationCommands.map((entry) => ({
-      ...entry,
-      command: rewriteReconciliationCommand(entry.command, policy),
-    })),
-    statusChecks: lifecycle.statusChecks.map((entry) => ({
-      ...entry,
-      command: getTargetAwareStatusCommand(policy),
-    })),
-  };
-}
-
-function rewriteReconciliationCommand(command: string, policy: RedirectPolicy): string {
-  const legacyPatterns = getLocalAuthRedirectPatterns(policy.callbackRoute).join(',');
-  const legacyPolicy = `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path},${legacyPatterns}"
-if [[ -n "\${OAUTH_NATIVE_REDIRECT_URLS:-}" ]]; then
-  oauth_redirect_allow_list="\${oauth_redirect_allow_list},\${OAUTH_NATIVE_REDIRECT_URLS}"
-fi`;
-  const staticRedirects = [...policy.localPatterns, ...policy.nativeRedirectUris].join(',');
-  const suffix = staticRedirects ? `,${staticRedirects}` : '';
-  const canonicalPolicy = policy.webEnabled
-    ? `oauth_redirect_allow_list="\${oauth_site_url},\${oauth_site_url}/\${oauth_callback_path}${suffix}"`
-    : `oauth_redirect_allow_list='${staticRedirects}'`;
-  let rewritten = replaceOnce(command, legacyPolicy, canonicalPolicy);
-
-  if (!policy.webEnabled) {
-    rewritten = replaceOnce(rewritten, 'oauth_site_url="${SITE_URL%/}"\n', '');
-  }
-
-  return rewritten;
-}
-
-function getTargetAwareStatusCommand(policy: RedirectPolicy): string {
-  const appCallback = policy.webEnabled
-    ? `if [[ -n "\${SITE_URL:-}" ]]; then
-  echo "- provider supabase-auth/app-callback: \${SITE_URL%/}/\${oauth_callback_path}"
-else
-  echo "- provider supabase-auth/app-callback: unavailable"
-fi`
-    : 'echo "- provider supabase-auth/app-callback: disabled (web target)"';
-  const localPatterns = policy.localPatterns.join(',') || 'none';
-  const nativeRedirects = policy.nativeRedirectUris.join(',') || 'none';
-
-  return `oauth_callback_route='${policy.callbackRoute}'
-oauth_callback_path="\${oauth_callback_route#/}"
-if [[ -n "\${API_EXTERNAL_URL:-}" ]]; then
-  echo "- provider supabase-auth/provider-callback: \${API_EXTERNAL_URL%/}/callback"
-else
-  echo "- provider supabase-auth/provider-callback: unavailable"
-fi
-${appCallback}
-echo "- provider supabase-auth/local-callback-patterns: ${localPatterns}"
-echo "- provider supabase-auth/native-callbacks: ${nativeRedirects}"`;
-}
-
-function getTargetAwareGuide(policy: RedirectPolicy): string {
-  const nativeRedirects = policy.nativeRedirectUris.length
-    ? policy.nativeRedirectUris.map((uri) => `- \`${uri}\``).join('\n')
-    : '- none';
-
-  return `# Supabase OAuth Runtime Reconciliation
-
-The provider callback remains project-owned. GoTrue-to-app redirects use the configured callback
-route \`${policy.callbackRoute}\` and are derived from \`AppManifest.deploy.targets\`.
-
-- Web target: ${policy.webEnabled ? 'enabled' : 'disabled'}
-- Native callbacks:
-${nativeRedirects}
-
-Local loopback patterns are emitted only for an enabled Web target. Native callbacks come only
-from enabled Android/iOS target schemes; no environment variable or slug-derived identity can add
-a native callback. Provider credential values remain sourced from trusted secret resolution.
-`;
-}
-
-function replaceOnce(value: string, search: string, replacement: string): string {
-  if (!value.includes(search)) {
-    throw new Error(
-      'Supabase OAuth redirect reconciliation template drifted from its canonical form.',
-    );
-  }
-  return value.replace(search, replacement);
-}

package/src/adapters/minikube/authz/cerbos/index.ts

@@ -1,486 +0,0 @@
-import type { AppManifest, NavigatorNode, RouteDefinition } from '@ankhorage/contracts';
-import { resolveAuthFlow } from '@ankhorage/contracts/auth';
-
-import type { InfraManifestInput } from '../../../../types';
-import type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../../contracts';
-
-const CERBOS_NAMESPACE = 'cerbos';
-
-export function generateCerbosAuthzArtifacts(args: {
-  manifest: InfraManifestInput;
-  namespace: string;
-  appManifest?: CerbosAppManifest;
-}): MinikubeAdapterArtifacts {
-  const { manifest, appManifest } = args;
-  const namespace = CERBOS_NAMESPACE;
-
-  const root = 'infra/minikube/k8s/authz/cerbos';
-  const resourceRoot = 'authz/cerbos';
-  const intent = buildCerbosPolicyIntent({ manifest, appManifest });
-
-  const endpointUrl = `http://cerbos.${namespace}.svc.cluster.local:3592`;
-  const lifecycle: MinikubeProviderLifecycle = {
-    id: 'cerbos',
-    namespace,
-    endpoints: [{ name: 'http', url: endpointUrl }],
-    readinessChecks: [
-      {
-        label: 'cerbos',
-        namespace,
-        resource: 'deployment/cerbos',
-        timeoutSeconds: 180,
-      },
-    ],
-    migrationCommands: [],
-    reconciliationCommands: [],
-    statusChecks: [],
-  };
-
-  return {
-    files: [
-      {
-        path: `${root}/cerbos.configmap.yaml`,
-        content: getCerbosConfigMap(namespace),
-      },
-      {
-        path: `${root}/cerbos.policy.configmap.yaml`,
-        content: getCerbosPolicyConfigMap({ namespace, intent }),
-      },
-      {
-        path: `${root}/cerbos.deployment.yaml`,
-        content: getCerbosDeployment(namespace),
-      },
-      {
-        path: `${root}/cerbos.service.yaml`,
-        content: getCerbosService(namespace),
-      },
-    ],
-    resources: [
-      `${resourceRoot}/cerbos.configmap.yaml`,
-      `${resourceRoot}/cerbos.policy.configmap.yaml`,
-      `${resourceRoot}/cerbos.deployment.yaml`,
-      `${resourceRoot}/cerbos.service.yaml`,
-    ],
-    providerLifecycle: [lifecycle],
-    envEntries: [`CERBOS_URL=${endpointUrl}`],
-    warnings: [],
-  };
-}
-
-function getCerbosConfigMap(namespace: string) {
-  return `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cerbos-config
-  namespace: ${namespace}
-data:
-  config.yaml: |
-    server:
-      httpListenAddr: ":3592"
-    storage:
-      driver: "disk"
-      disk:
-        directory: /policies
-`;
-}
-
-function getCerbosPolicyConfigMap(args: { namespace: string; intent: CerbosPolicyIntent }) {
-  const { namespace, intent } = args;
-  const entries = getCerbosPolicyEntries(intent);
-  const renderedEntries = entries
-    .map((entry) => {
-      const indented = indentLines(entry.content, 4);
-      return `  ${entry.key}: |
-${indented}`;
-    })
-    .join('\n');
-
-  return `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cerbos-policy
-  namespace: ${namespace}
-data:
-${renderedEntries}
-`;
-}
-
-function getCerbosDeployment(namespace: string) {
-  return `apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cerbos
-  namespace: ${namespace}
-  labels:
-    app.kubernetes.io/name: cerbos
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: cerbos
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: cerbos
-    spec:
-      containers:
-        - name: cerbos
-          image: ghcr.io/cerbos/cerbos:0.40.0
-          args:
-            - server
-            - --config=/config/config.yaml
-          ports:
-            - containerPort: 3592
-          volumeMounts:
-            - name: cerbos-config
-              mountPath: /config
-            - name: cerbos-policy
-              mountPath: /policies
-      volumes:
-        - name: cerbos-config
-          configMap:
-            name: cerbos-config
-        - name: cerbos-policy
-          configMap:
-            name: cerbos-policy
-`;
-}
-
-function getCerbosService(namespace: string) {
-  return `apiVersion: v1
-kind: Service
-metadata:
-  name: cerbos
-  namespace: ${namespace}
-spec:
-  selector:
-    app.kubernetes.io/name: cerbos
-  ports:
-    - name: http
-      port: 3592
-      targetPort: 3592
-`;
-}
-
-const PUBLIC_GUARD_HINTS = new Set(['public', 'guest', 'anonymous', 'unauthenticated']);
-const AUTH_GUARD_HINTS = new Set([
-  'auth',
-  'authenticated',
-  'private',
-  'protected',
-  'requiresauth',
-  'requires-auth',
-]);
-
-type CerbosAppManifest = Pick<AppManifest, 'metadata' | 'navigator' | 'screens'> & {
-  infra?: AppManifest['infra'];
-};
-
-type AuthScope = NonNullable<InfraManifestInput['auth']>['scope'] | 'none';
-
-interface CerbosRouteIntent {
-  name: string;
-  guards: string[];
-  screenId?: string;
-}
-
-interface CerbosPolicyIntent {
-  authScope: AuthScope;
-  publicRoutes: string[];
-  protectedRoutes: string[];
-  publicScreens: string[];
-  protectedScreens: string[];
-}
-
-interface CerbosPolicyEntry {
-  key: string;
-  content: string;
-}
-
-function getCerbosPolicyEntries(intent: CerbosPolicyIntent): CerbosPolicyEntry[] {
-  const entries: CerbosPolicyEntry[] = [
-    {
-      key: 'app.resource_policy.yaml',
-      content: getAppPolicy(intent),
-    },
-  ];
-
-  if (intent.publicRoutes.length > 0 || intent.protectedRoutes.length > 0) {
-    entries.push({
-      key: 'route.resource_policy.yaml',
-      content: getRoutePolicy(intent),
-    });
-  }
-
-  if (intent.publicScreens.length > 0 || intent.protectedScreens.length > 0) {
-    entries.push({
-      key: 'screen.resource_policy.yaml',
-      content: getScreenPolicy(intent),
-    });
-  }
-
-  return entries;
-}
-
-function getAppPolicy(intent: CerbosPolicyIntent): string {
-  const roles = intent.authScope === 'global' ? ['authenticated'] : ['anonymous', 'authenticated'];
-
-  return `apiVersion: api.cerbos.dev/v1
-resourcePolicy:
-  version: "default"
-  resource: "app"
-  rules:
-${indentLines(renderRule({ actions: ['*'], roles }), 4)}
-`;
-}
-
-function getRoutePolicy(intent: CerbosPolicyIntent): string {
-  const rules: string[] = [];
-
-  if (intent.publicRoutes.length > 0) {
-    rules.push(
-      renderRule({
-        actions: ['view', 'navigate'],
-        roles: ['anonymous', 'authenticated'],
-        conditionExpr: getInConditionExpr('route', intent.publicRoutes),
-      }),
-    );
-  }
-
-  if (intent.protectedRoutes.length > 0) {
-    rules.push(
-      renderRule({
-        actions: ['view', 'navigate'],
-        roles: ['authenticated'],
-        conditionExpr: getInConditionExpr('route', intent.protectedRoutes),
-      }),
-    );
-  }
-
-  return `apiVersion: api.cerbos.dev/v1
-resourcePolicy:
-  version: "default"
-  resource: "route"
-  rules:
-${indentLines(rules.join('\n'), 4)}
-`;
-}
-
-function getScreenPolicy(intent: CerbosPolicyIntent): string {
-  const rules: string[] = [];
-
-  if (intent.publicScreens.length > 0) {
-    rules.push(
-      renderRule({
-        actions: ['view', 'render'],
-        roles: ['anonymous', 'authenticated'],
-        conditionExpr: getInConditionExpr('screen_id', intent.publicScreens),
-      }),
-    );
-  }
-
-  if (intent.protectedScreens.length > 0) {
-    rules.push(
-      renderRule({
-        actions: ['view', 'render'],
-        roles: ['authenticated'],
-        conditionExpr: getInConditionExpr('screen_id', intent.protectedScreens),
-      }),
-    );
-  }
-
-  return `apiVersion: api.cerbos.dev/v1
-resourcePolicy:
-  version: "default"
-  resource: "screen"
-  rules:
-${indentLines(rules.join('\n'), 4)}
-`;
-}
-
-function renderRule(args: { actions: string[]; roles: string[]; conditionExpr?: string }): string {
-  const { actions, roles, conditionExpr } = args;
-
-  const lines = [
-    `- actions: ${JSON.stringify(actions)}`,
-    '  effect: EFFECT_ALLOW',
-    `  roles: ${JSON.stringify(roles)}`,
-  ];
-
-  if (conditionExpr) {
-    lines.push('  condition:');
-    lines.push('    match:');
-    lines.push(`      expr: ${JSON.stringify(conditionExpr)}`);
-  }
-
-  return lines.join('\n');
-}
-
-function getInConditionExpr(attribute: string, values: string[]): string {
-  return `request.resource.attr.${attribute} in ${JSON.stringify(values)}`;
-}
-
-function indentLines(content: string, spaces: number): string {
-  const prefix = ' '.repeat(spaces);
-  return content
-    .trimEnd()
-    .split('\n')
-    .map((line) => `${prefix}${line}`)
-    .join('\n');
-}
-
-function buildCerbosPolicyIntent(args: {
-  manifest: InfraManifestInput;
-  appManifest?: CerbosAppManifest;
-}): CerbosPolicyIntent {
-  const { manifest, appManifest } = args;
-  const authScope = manifest.auth?.scope ?? 'none';
-
-  const routes = appManifest?.navigator ? flattenNavigatorRoutes(appManifest.navigator) : [];
-  const flow = resolveAuthFlow(appManifest?.infra?.auth?.flow);
-  const { signInRoute } = flow;
-  const { signUpRoute } = flow;
-  const { unauthorizedRoute } = flow;
-
-  const publicRouteSet = new Set<string>();
-  const protectedRouteSet = new Set<string>();
-
-  for (const route of routes) {
-    const isPublic = isPublicRoute({
-      route,
-      authScope,
-      signInRoute,
-      signUpRoute,
-      unauthorizedRoute,
-    });
-
-    if (isPublic) {
-      publicRouteSet.add(route.name);
-    } else {
-      protectedRouteSet.add(route.name);
-    }
-  }
-
-  const screenVisibility = new Map<string, 'public' | 'protected'>();
-  for (const route of routes) {
-    if (!route.screenId) continue;
-    const isPublic = publicRouteSet.has(route.name);
-
-    const current = screenVisibility.get(route.screenId);
-    if (current === 'protected') continue;
-    screenVisibility.set(route.screenId, isPublic ? 'public' : 'protected');
-  }
-
-  if (appManifest?.screens) {
-    const defaultVisibility: 'public' | 'protected' =
-      authScope === 'global' ? 'protected' : 'public';
-
-    for (const screenId of Object.keys(appManifest.screens)) {
-      if (!screenVisibility.has(screenId)) {
-        screenVisibility.set(screenId, defaultVisibility);
-      }
-    }
-  }
-
-  const publicScreens = [...screenVisibility.entries()]
-    .filter(([, visibility]) => visibility === 'public')
-    .map(([screenId]) => screenId)
-    .sort();
-  const protectedScreens = [...screenVisibility.entries()]
-    .filter(([, visibility]) => visibility === 'protected')
-    .map(([screenId]) => screenId)
-    .sort();
-
-  return {
-    authScope,
-    publicRoutes: [...publicRouteSet].sort(),
-    protectedRoutes: [...protectedRouteSet].sort(),
-    publicScreens,
-    protectedScreens,
-  };
-}
-
-function flattenNavigatorRoutes(navigator: NavigatorNode): CerbosRouteIntent[] {
-  const deduped = new Map<string, CerbosRouteIntent>();
-
-  const walk = (current: NavigatorNode) => {
-    for (const route of current.routes) {
-      const normalizedGuards = normalizeGuards(route.guards);
-      const existing = deduped.get(route.name);
-      deduped.set(route.name, {
-        name: route.name,
-        guards: unique([...(existing?.guards ?? []), ...normalizedGuards]),
-        screenId: route.screenId ?? existing?.screenId,
-      });
-
-      if (route.navigator) {
-        walk(route.navigator);
-      }
-    }
-  };
-
-  walk(navigator);
-  return [...deduped.values()];
-}
-
-function normalizeGuards(guards?: RouteDefinition['guards']): string[] {
-  return (guards ?? []).map((guard) => guard.trim().toLowerCase()).filter(Boolean);
-}
-
-function isPublicRoute(args: {
-  route: CerbosRouteIntent;
-  authScope: AuthScope;
-  signInRoute?: string;
-  signUpRoute?: string;
-  unauthorizedRoute?: string;
-}): boolean {
-  const { route, authScope, signInRoute, signUpRoute, unauthorizedRoute } = args;
-  const guardSet = new Set(route.guards);
-  const signInRouteName = authFlowPathToRouteName(signInRoute);
-  const signUpRouteName = authFlowPathToRouteName(signUpRoute);
-  const unauthorizedRouteName = authFlowPathToRouteName(unauthorizedRoute);
-
-  if (
-    route.name === signInRouteName ||
-    route.name === signUpRouteName ||
-    route.name === unauthorizedRouteName
-  ) {
-    return true;
-  }
-
-  if (hasAny(guardSet, PUBLIC_GUARD_HINTS)) {
-    return true;
-  }
-
-  if (hasAny(guardSet, AUTH_GUARD_HINTS)) {
-    return false;
-  }
-
-  switch (authScope) {
-    case 'none':
-      return true;
-    case 'global':
-    default:
-      return false;
-  }
-}
-
-function hasAny(values: Set<string>, candidates: Set<string>): boolean {
-  for (const candidate of candidates) {
-    if (values.has(candidate)) return true;
-  }
-  return false;
-}
-
-function unique(values: string[]): string[] {
-  return [...new Set(values)];
-}
-
-function authFlowPathToRouteName(routePath: string | undefined): string | undefined {
-  if (!routePath) {
-    return undefined;
-  }
-
-  const normalized = routePath.trim().replace(/^\/+/, '').replace(/\/+$/, '');
-  return normalized === '' ? 'index' : normalized;
-}

package/src/adapters/minikube/authz/index.ts

@@ -1,32 +0,0 @@
-import type { AppManifest } from '@ankhorage/contracts';
-
-import type { InfraManifestInput } from '../../../types';
-import { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';
-import { generateCerbosAuthzArtifacts } from './cerbos';
-
-export function generateAuthorizationArtifacts(args: {
-  manifest: InfraManifestInput;
-  namespace: string;
-  appManifest?: Pick<AppManifest, 'infra' | 'metadata' | 'navigator' | 'screens'>;
-}): MinikubeAdapterArtifacts {
-  const { manifest, namespace, appManifest } = args;
-  const engine = manifest.auth?.authorization?.engine;
-
-  if (!engine) {
-    return emptyMinikubeArtifacts();
-  }
-
-  switch (engine) {
-    case 'cerbos':
-      return generateCerbosAuthzArtifacts({ manifest, namespace, appManifest });
-    case 'native':
-      return {
-        ...emptyMinikubeArtifacts(),
-        warnings: [
-          'Authorization engine "native" selected. No dedicated authz infrastructure artifacts were generated.',
-        ],
-      };
-    default:
-      throw new Error(`Unsupported authorization engine for minikube adapter: ${String(engine)}`);
-  }
-}