@ankhorage/infra 4.1.12 → 5.1.0

package/src/adapters/minikube/base/upgradeReconciliation.test.ts

@@ -1,135 +0,0 @@
-import { afterEach, describe, expect, test } from 'bun:test';
-import { promises as fs } from 'fs';
-import os from 'os';
-import path from 'path';
-
-import { generateInfrastructure } from '../../../index.js';
-import { createAppManifest } from '../../../testSupport.js';
-
-const temporaryPaths = new Set<string>();
-
-afterEach(async () => {
-  await Promise.all(
-    [...temporaryPaths].map((rootPath) => fs.rm(rootPath, { force: true, recursive: true })),
-  );
-  temporaryPaths.clear();
-});
-
-describe('generated native-only Minikube upgrade reconciliation', () => {
-  test('deletes exact stale app resources idempotently after applying desired topology', async () => {
-    const profile = 'native-upgrade-reconcile';
-    const rootPath = await fs.mkdtemp(path.join(os.tmpdir(), 'infra-native-upgrade-'));
-    temporaryPaths.add(rootPath);
-    const generated = generateInfrastructure(
-      { deployment: { target: 'minikube', monitoring: false }, modules: [] },
-      {
-        appManifest: {
-          ...createAppManifest(profile),
-          deploy: {
-            targets: {
-              android: { enabled: true, package: 'com.ankh.nativeupgradereconcile' },
-            },
-          },
-        },
-      },
-    );
-
-    for (const file of generated.files) {
-      const filePath = path.join(rootPath, file.path);
-      await fs.mkdir(path.dirname(filePath), { recursive: true });
-      await fs.writeFile(filePath, file.content, 'utf8');
-      if (file.executable === true) await fs.chmod(filePath, 0o755);
-    }
-
-    const fakeBin = path.join(rootPath, 'fake-bin');
-    const kubectlLog = path.join(rootPath, 'kubectl.log');
-    const resourceState = path.join(rootPath, 'app-runtime-resources');
-    await fs.mkdir(fakeBin, { recursive: true });
-    await fs.writeFile(
-      resourceState,
-      ['deployment/app-runtime', 'service/app-runtime', 'configmap/app-infra-config', ''].join(
-        '\n',
-      ),
-      'utf8',
-    );
-    await writeExecutable(
-      path.join(fakeBin, 'minikube'),
-      `#!/usr/bin/env bash
-set -euo pipefail
-if [[ " $* " == *" status "* ]]; then
-  echo Running
-  exit 0
-fi
-exit 1
-`,
-    );
-    await writeExecutable(
-      path.join(fakeBin, 'kubectl'),
-      `#!/usr/bin/env bash
-set -euo pipefail
-printf '%s\n' "$*" >> "\${FAKE_KUBECTL_LOG}"
-if [[ " $* " == *" apply -k "* ]]; then
-  exit 0
-fi
-if [[ " $* " == *" delete "* ]]; then
-  expected='delete deployment/app-runtime service/app-runtime configmap/app-infra-config --ignore-not-found'
-  if [[ " $* " != *" \${expected} "* ]]; then
-    echo "unexpected cleanup identity: $*" >&2
-    exit 1
-  fi
-  : > "\${FAKE_RESOURCE_STATE}"
-  exit 0
-fi
-exit 1
-`,
-    );
-
-    const upScript = path.join(rootPath, 'infra/minikube/scripts/up.sh');
-    const env = {
-      ...process.env,
-      ANKH_APP_SLUG: profile,
-      FAKE_KUBECTL_LOG: kubectlLog,
-      FAKE_RESOURCE_STATE: resourceState,
-      PATH: `${fakeBin}:${process.env.PATH ?? ''}`,
-    };
-
-    const first = await runScript(upScript, env);
-    const second = await runScript(upScript, env);
-    const commands = (await fs.readFile(kubectlLog, 'utf8')).trim().split('\n');
-    const exactDelete = `--context ${profile} -n app delete deployment/app-runtime service/app-runtime configmap/app-infra-config --ignore-not-found`;
-
-    expect(first.stdout).toContain(`Minikube infrastructure for '${profile}' is running.`);
-    expect(second.stdout).toContain(`Minikube infrastructure for '${profile}' is running.`);
-    expect(commands).toHaveLength(4);
-    expect(commands[0]).toContain(`--context ${profile} apply -k `);
-    expect(commands[1]).toBe(exactDelete);
-    expect(commands[2]).toContain(`--context ${profile} apply -k `);
-    expect(commands[3]).toBe(exactDelete);
-    expect(await fs.readFile(resourceState, 'utf8')).toBe('');
-  });
-});
-
-async function runScript(
-  scriptPath: string,
-  env: Record<string, string | undefined>,
-): Promise<{ readonly stderr: string; readonly stdout: string }> {
-  const process = Bun.spawn(['bash', scriptPath], {
-    env,
-    stderr: 'pipe',
-    stdout: 'pipe',
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    process.exited,
-    new Response(process.stdout).text(),
-    new Response(process.stderr).text(),
-  ]);
-  if (exitCode !== 0) {
-    throw new Error(`Generated up.sh failed (${exitCode}): ${stdout}${stderr}`);
-  }
-  return { stderr, stdout };
-}
-
-async function writeExecutable(filePath: string, content: string): Promise<void> {
-  await fs.writeFile(filePath, content, 'utf8');
-  await fs.chmod(filePath, 0o755);
-}

package/src/adapters/minikube/contracts.ts

@@ -1,46 +0,0 @@
-import type { GeneratedInfrastructureFile } from '../../types';
-
-interface MinikubeProviderEndpoint {
-  name: string;
-  url: string;
-}
-
-interface MinikubeProviderReadinessCheck {
-  label: string;
-  namespace: string;
-  resource: string;
-  timeoutSeconds: number;
-}
-
-interface MinikubeProviderLifecycleCommand {
-  label: string;
-  command: string;
-}
-
-export interface MinikubeProviderLifecycle {
-  id: string;
-  namespace: string;
-  endpoints: MinikubeProviderEndpoint[];
-  readinessChecks: MinikubeProviderReadinessCheck[];
-  migrationCommands: MinikubeProviderLifecycleCommand[];
-  reconciliationCommands: MinikubeProviderLifecycleCommand[];
-  statusChecks: MinikubeProviderLifecycleCommand[];
-}
-
-export interface MinikubeAdapterArtifacts {
-  files: GeneratedInfrastructureFile[];
-  resources: string[];
-  providerLifecycle: MinikubeProviderLifecycle[];
-  envEntries: string[];
-  warnings: string[];
-}
-
-export function emptyMinikubeArtifacts(): MinikubeAdapterArtifacts {
-  return {
-    files: [],
-    resources: [],
-    providerLifecycle: [],
-    envEntries: [],
-    warnings: [],
-  };
-}

package/src/adapters/minikube/index.ts

@@ -1,172 +0,0 @@
-import { validateInfraApiSupport } from '../../infraValidation';
-import type {
-  GeneratedPackageDependency,
-  InfraManifestInput,
-  InfrastructureGenerationOptions,
-  InfrastructureGenerationResult,
-} from '../../types';
-import { generateAuthProviderArtifacts } from './auth';
-import { generateAuthorizationArtifacts } from './authz';
-import { APP_NAMESPACE, generateMinikubeBaseArtifacts } from './base';
-import { generateSecretStoreArtifacts } from './secrets';
-import { generateStorageArtifacts } from './storage';
-
-const CANONICAL_PROJECT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
-const BUILT_IN_NAMESPACES = new Set([APP_NAMESPACE, 'supabase']);
-
-export function generateMinikubeInfra(
-  manifest: InfraManifestInput,
-  options: InfrastructureGenerationOptions = {},
-): InfrastructureGenerationResult {
-  if (manifest.deployment?.target !== 'minikube') {
-    throw new Error(
-      `Minikube adapter only supports deployment target "minikube" (received "${manifest.deployment?.target ?? 'undefined'}").`,
-    );
-  }
-
-  if (manifest.database?.provider && manifest.database.provider !== 'supabase') {
-    throw new Error(
-      `Unsupported database provider for minikube adapter: "${manifest.database.provider}". Only "supabase" is implemented.`,
-    );
-  }
-
-  const appSlug = validateCanonicalAppSlug(options.appManifest?.metadata.slug);
-  const appRuntimeEnabled =
-    options.appManifest?.deploy === undefined ||
-    options.appManifest.deploy.targets.web?.enabled === true;
-  const namespace = APP_NAMESPACE;
-
-  const authArtifacts = generateAuthProviderArtifacts({
-    appManifest: options.appManifest,
-    manifest,
-    namespace,
-  });
-  const authzArtifacts = generateAuthorizationArtifacts({
-    manifest,
-    namespace,
-    appManifest: options.appManifest,
-  });
-  const storageArtifacts = generateStorageArtifacts({ manifest, namespace });
-  const secretStoreArtifacts = generateSecretStoreArtifacts({ manifest, namespace });
-
-  const extraResources = unique([
-    ...authArtifacts.resources,
-    ...authzArtifacts.resources,
-    ...storageArtifacts.resources,
-    ...secretStoreArtifacts.resources,
-  ]);
-  const providerLifecycle = [
-    ...authArtifacts.providerLifecycle,
-    ...authzArtifacts.providerLifecycle,
-    ...storageArtifacts.providerLifecycle,
-    ...secretStoreArtifacts.providerLifecycle,
-  ];
-  const providerNamespaces = unique([
-    ...providerLifecycle.map((contribution) => contribution.namespace),
-  ]).filter((providerNamespace) => !BUILT_IN_NAMESPACES.has(providerNamespace));
-  const extraEnvEntries = unique([
-    ...authArtifacts.envEntries,
-    ...authzArtifacts.envEntries,
-    ...storageArtifacts.envEntries,
-    ...secretStoreArtifacts.envEntries,
-  ]);
-
-  const baseFiles = generateMinikubeBaseArtifacts({
-    manifest,
-    appSlug,
-    extraResources,
-    providerNamespaces,
-    providerLifecycle,
-    extraEnvEntries,
-    appRuntimeEnabled,
-  });
-
-  const warnings = unique([
-    ...collectWarnings(manifest),
-    ...authArtifacts.warnings,
-    ...authzArtifacts.warnings,
-    ...storageArtifacts.warnings,
-    ...secretStoreArtifacts.warnings,
-  ]);
-
-  return {
-    files: [
-      ...baseFiles,
-      ...authArtifacts.files,
-      ...authzArtifacts.files,
-      ...storageArtifacts.files,
-      ...secretStoreArtifacts.files,
-    ],
-    warnings,
-    meta: {
-      target: 'minikube',
-      providers: collectProviders(manifest),
-    },
-    dependencies: collectDependencies(manifest),
-  };
-}
-
-function collectProviders(manifest: InfraManifestInput): string[] {
-  const providers = new Set<string>();
-
-  if (manifest.auth?.provider) providers.add(manifest.auth.provider);
-  if (manifest.auth?.authorization?.engine) {
-    providers.add(manifest.auth.authorization.engine);
-  }
-  if (manifest.database?.provider) providers.add(manifest.database.provider);
-  if (manifest.storage?.provider) providers.add(manifest.storage.provider);
-  if (manifest.secretStore?.provider) providers.add(manifest.secretStore.provider);
-  if (manifest.state?.provider) providers.add(manifest.state.provider);
-
-  return [...providers].sort();
-}
-
-function collectDependencies(manifest: InfraManifestInput): readonly GeneratedPackageDependency[] {
-  if (manifest.state?.provider !== 'legend') {
-    return [];
-  }
-
-  return [
-    {
-      name: '@ankhorage/state-legend',
-      version: '^0.1.0',
-      reason: 'Selected by infra.state.provider=legend.',
-    },
-  ];
-}
-
-function collectWarnings(manifest: InfraManifestInput): string[] {
-  const warnings = [...validateInfraApiSupport(manifest)];
-
-  if (manifest.deployment?.monitoring) {
-    warnings.push(
-      'Monitoring is enabled in manifest, but monitoring stack resources are not generated yet.',
-    );
-  }
-
-  if (manifest.networking?.cdn) {
-    warnings.push('CDN is enabled in manifest, but CDN resources are not generated for minikube.');
-  }
-
-  return warnings;
-}
-
-function validateCanonicalAppSlug(slug: string | undefined): string {
-  if (!slug) {
-    throw new Error(
-      'Cannot generate Minikube infrastructure: appManifest.metadata.slug is required.',
-    );
-  }
-
-  if (slug.trim() !== slug || !CANONICAL_PROJECT_SLUG_RE.test(slug)) {
-    throw new Error(
-      'Cannot generate Minikube infrastructure: appManifest.metadata.slug must be a canonical lowercase slug up to 40 characters using only a-z, 0-9, and hyphens, without leading or trailing hyphens.',
-    );
-  }
-
-  return slug;
-}
-
-function unique(values: string[]): string[] {
-  return [...new Set(values)];
-}

package/src/adapters/minikube/secrets/index.test.ts

@@ -1,147 +0,0 @@
-import type { AppManifest } from '@ankhorage/contracts';
-import { describe, expect, test } from 'bun:test';
-
-import { generateInfrastructure } from '../../../index';
-import type { InfraManifestInput } from '../../../types';
-import { SUPABASE_VAULT_MIGRATION_PATH } from './supabase-vault';
-
-function createManifest(overrides: Partial<InfraManifestInput> = {}): InfraManifestInput {
-  return {
-    deployment: {
-      target: 'minikube',
-      monitoring: false,
-    },
-    secretStore: {
-      provider: 'supabase-vault',
-    },
-    modules: [],
-    ...overrides,
-  };
-}
-
-describe('minikube secret-store generation', () => {
-  test('generates the released Supabase Vault migration through the Kubernetes lifecycle', () => {
-    const result = generateInfrastructure(createManifest(), {
-      appManifest: createAppManifest('vault-app'),
-    });
-    const migration = result.files.find((file) => file.path === SUPABASE_VAULT_MIGRATION_PATH);
-    const envExample = result.files.find((file) => file.path === 'infra/minikube/.env.example');
-    const upScript = result.files.find((file) => file.path === 'infra/minikube/scripts/up.sh');
-
-    expect(migration?.content).toContain('create schema if not exists vault;');
-    expect(migration?.content).toContain(
-      'create extension if not exists supabase_vault with schema vault;',
-    );
-    expect(migration?.content).toContain('when insufficient_privilege then');
-    expect(migration?.content).toContain('create or replace function vault.create_secret');
-    expect(migration?.content).toContain('create or replace view vault.decrypted_secrets');
-    expect(migration?.content).not.toContain('supabase_vault with schema extensions');
-    expect(envExample?.content).toContain('SECRET_STORE_PROVIDER=supabase-vault');
-    expect(envExample?.content).not.toContain('SUPABASE_RUNTIME_ENABLED=');
-    expect(upScript?.content).toContain('SUPABASE_RUNTIME_ENABLED="true"');
-    expect(upScript?.content).not.toContain('SUPABASE_RUNTIME_ENABLED="${SUPABASE_RUNTIME_ENABLED');
-    expect(result.meta.providers).toContain('supabase-vault');
-  });
-
-  test('requires credentialsRef for every enabled OAuth provider', () => {
-    expect(() =>
-      generateInfrastructure(
-        createManifest({
-          auth: {
-            scope: 'global',
-            provider: 'supabase',
-            signIn: {
-              identifiers: ['email'],
-            },
-            oauth: {
-              enabled: true,
-              callbackRoute: '/auth/callback',
-              providers: [
-                {
-                  id: 'google',
-                  enabled: true,
-                },
-              ],
-            },
-          },
-        }),
-        { appManifest: createAppManifest('vault-app') },
-      ),
-    ).toThrow('does not define credentialsRef');
-  });
-
-  test('accepts provider-neutral OAuth secret references without serializing values', () => {
-    const result = generateInfrastructure(
-      createManifest({
-        auth: {
-          scope: 'global',
-          provider: 'supabase',
-          signIn: {
-            identifiers: ['email'],
-          },
-          oauth: {
-            enabled: true,
-            callbackRoute: '/auth/callback',
-            providers: [
-              {
-                id: 'google',
-                enabled: true,
-                credentialsRef: 'auth/oauth/google',
-              },
-            ],
-          },
-        },
-      }),
-      { appManifest: createAppManifest('vault-app') },
-    );
-
-    const serialized = JSON.stringify(result.files);
-    expect(serialized).toContain('auth/oauth/google');
-    expect(serialized).not.toContain('sentinel-client-secret-value');
-    expect(serialized).not.toContain('sentinel-private-key-value');
-  });
-
-  test('rejects unknown secret-store providers', () => {
-    expect(() =>
-      generateInfrastructure(
-        createManifest({
-          secretStore: {
-            provider: 'aws-secrets-manager',
-          },
-        }),
-        { appManifest: createAppManifest('vault-app') },
-      ),
-    ).toThrow('Unsupported secret-store provider for minikube adapter');
-  });
-});
-
-function createAppManifest(
-  slug: string,
-): Pick<AppManifest, 'metadata' | 'navigator' | 'screens' | 'settings'> {
-  return {
-    metadata: {
-      name: slug,
-      slug,
-      version: '1.0.0',
-      themeId: 'default',
-    },
-    navigator: {
-      type: 'stack',
-      routes: [],
-    },
-    screens: {},
-    settings: {
-      localization: {
-        defaultLocale: 'en',
-        locales: ['en'],
-      },
-      authFlow: {
-        signInRoute: '/sign-in',
-        signUpRoute: '/sign-up',
-        signOutRoute: '/sign-out',
-        unauthorizedRoute: '/sign-in',
-        postSignInRoute: '/',
-      },
-    },
-  };
-}

package/src/adapters/minikube/secrets/index.ts

@@ -1,19 +0,0 @@
-import { SUPABASE_VAULT_SECRET_STORE_PROVIDER } from '@ankhorage/supabase-vault';
-
-import type { InfraManifestInput } from '../../../types';
-import { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';
-import { generateSupabaseVaultSecretStoreArtifacts } from './supabase-vault';
-
-export function generateSecretStoreArtifacts(args: {
-  readonly manifest: InfraManifestInput;
-  readonly namespace: string;
-}): MinikubeAdapterArtifacts {
-  const provider = args.manifest.secretStore?.provider;
-  if (!provider) return emptyMinikubeArtifacts();
-
-  if (provider === SUPABASE_VAULT_SECRET_STORE_PROVIDER) {
-    return generateSupabaseVaultSecretStoreArtifacts(args);
-  }
-
-  throw new Error(`Unsupported secret-store provider for minikube adapter: "${provider}".`);
-}

package/src/adapters/minikube/secrets/supabase-vault/index.ts

@@ -1,139 +0,0 @@
-import {
-  SUPABASE_VAULT_MIGRATION_SQL,
-  SUPABASE_VAULT_SECRET_STORE_PROVIDER,
-} from '@ankhorage/supabase-vault';
-
-import type { InfraManifestInput } from '../../../../types';
-import type { MinikubeAdapterArtifacts } from '../../contracts';
-
-export const SUPABASE_VAULT_MIGRATION_PATH =
-  'infra/minikube/supabase/migrations/202607120001_ankhorage_supabase_vault.sql';
-
-export function generateSupabaseVaultSecretStoreArtifacts(args: {
-  readonly manifest: InfraManifestInput;
-  readonly namespace: string;
-}): MinikubeAdapterArtifacts {
-  validateOAuthSecretReferences(args.manifest);
-
-  return {
-    files: [
-      {
-        path: SUPABASE_VAULT_MIGRATION_PATH,
-        content: getCurrentSupabaseVaultMigrationSql(),
-      },
-      {
-        path: 'infra/minikube/secrets/supabase-vault.md',
-        content: getRuntimeGuide(args.namespace),
-      },
-    ],
-    resources: [],
-    providerLifecycle: [],
-    envEntries: [`SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`],
-    warnings: [],
-  };
-}
-
-function getCurrentSupabaseVaultMigrationSql(): string {
-  return `${SUPABASE_VAULT_MIGRATION_SQL.trim()
-    .replace(
-      'create extension if not exists supabase_vault with schema extensions;',
-      () => `create schema if not exists vault;
-do $$
-begin
-  create extension if not exists supabase_vault with schema vault;
-exception
-  when insufficient_privilege then
-    create table if not exists vault.secrets (
-      id uuid primary key default gen_random_uuid(),
-      secret text not null,
-      name text,
-      description text,
-      created_at timestamptz not null default now()
-    );
-
-    create or replace function vault.create_secret(
-      secret text,
-      name text default null,
-      description text default null
-    )
-    returns uuid
-    language plpgsql
-    security definer
-    set search_path = vault, public
-    as $vault$
-    declare
-      secret_id uuid;
-    begin
-      insert into vault.secrets (secret, name, description)
-      values (secret, name, description)
-      returning id into secret_id;
-
-      return secret_id;
-    end;
-    $vault$;
-
-    create or replace view vault.decrypted_secrets as
-      select id, secret as decrypted_secret
-      from vault.secrets;
-end
-$$;`,
-    )
-    .trim()}\n`;
-}
-
-function validateOAuthSecretReferences(manifest: InfraManifestInput): void {
-  const oauth = manifest.auth?.oauth;
-  if (!oauth?.enabled) return;
-
-  const enabledProviders = oauth.providers.filter((provider) => provider.enabled !== false);
-  if (enabledProviders.length === 0) {
-    throw new Error('OAuth is enabled but no OAuth provider is enabled.');
-  }
-
-  for (const provider of enabledProviders) {
-    if (!provider.credentialsRef?.trim()) {
-      throw new Error(
-        `OAuth provider "${provider.id}" is enabled but does not define credentialsRef.`,
-      );
-    }
-  }
-}
-
-function getRuntimeGuide(namespace: string): string {
-  return `# Supabase Vault secret store
-
-This project selects the provider-neutral secret-store backend through:
-
-\`\`\`text
-infra.secretStore.provider = ${SUPABASE_VAULT_SECRET_STORE_PROVIDER}
-\`\`\`
-
-The immutable migration at:
-
-\`\`\`text
-${SUPABASE_VAULT_MIGRATION_PATH}
-\`\`\`
-
-is applied by the Kubernetes-owned Supabase migration lifecycle during \`scripts/up.sh\`
-with command-scoped CLI telemetry disabled around
-\`supabase --yes migration up --db-url "$SUPABASE_DB_URL"\`.
-
-## Security boundary
-
-- Secret values are stored only through Supabase Vault.
-- Public manifests contain logical references such as \`auth/oauth/google\`, never values.
-- Project and environment scope are supplied by trusted server code.
-- The browser may receive secret metadata, but must never receive resolved values or Vault IDs.
-- Bootstrap database access must come from trusted process environment or workload identity.
-- Do not expose service-role keys, provider secrets, or resolved payloads through
-  \`NEXT_PUBLIC_*\`, \`EXPO_PUBLIC_*\`, generated YAML, tracked JSON, or app bundles.
-
-## Trusted adapter composition
-
-Use \`createInfraSecretStoreAdapter\` from \`@ankhorage/infra\` in server-only code and pass
-a trusted Supabase Vault SQL client. The app manifest chooses the provider; privileged connection
-configuration does not belong in the manifest.
-
-Generated Kubernetes namespace: \`${namespace}\`.
-`;
-}