@ankhorage/infra 6.0.0 → 7.1.0

package/src/projectCredentialLifecycle.test.ts

@@ -0,0 +1,161 @@
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import type {
+  InfraControlPlaneCredentialRef,
+  InfraEnvironmentSpec,
+  InfraLedger,
+  InfraResult,
+} from '@ankhorage/contracts/infra';
+import { expect, it, mock } from 'bun:test';
+
+import { createProjectInfraCredentialPort } from './features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort.js';
+import { createProjectInfraLifecycle } from './project/index.js';
+import type { InfraLifecycleOperations } from './types/infraCli.js';
+
+const bootstrap = {
+  source: 'control-plane',
+  name: 'FIXTURE_BOOTSTRAP',
+} as const satisfies InfraControlPlaneCredentialRef;
+const generated = { username: 'fixture', password: 'generated-secret' } as const;
+const previewGenerated = { username: 'preview', password: 'preview-secret' } as const;
+
+const desired = {
+  deployment: {
+    compute: { provider: 'local' },
+    runtime: { provider: 'docker-compose' },
+  },
+} as const satisfies InfraEnvironmentSpec;
+
+const ledger = {
+  schemaVersion: 1,
+  projectId: 'sample',
+  environment: 'local',
+  targets: [],
+  resources: [],
+  outputs: [],
+  artifacts: [],
+} as const satisfies InfraLedger;
+
+it('persists provider-created credentials across up/down and removes only the destroyed environment', async () => {
+  await withTempProjectAsync(async (projectPath) => {
+    const generateCredential = mock(() => generated);
+    const operations = createCredentialOperations(generateCredential);
+    const request = {
+      projectId: 'sample',
+      projectPath,
+      manifest: { environments: { local: desired, preview: desired }, modules: [] },
+      environment: 'local' as const,
+      executionEnvironment: {},
+    };
+
+    const firstLifecycle = createProjectInfraLifecycle({ services: { operations } });
+    const firstUp = await firstLifecycle.upAsync(request);
+    expect(firstUp.ok).toBe(true);
+    expect(generateCredential).toHaveBeenCalledTimes(1);
+    expect(JSON.stringify(firstUp)).not.toContain('generated-secret');
+    expect(await fs.readFile(statePath(projectPath, 'local'), 'utf8')).not.toContain(
+      'generated-secret',
+    );
+
+    const down = await firstLifecycle.downAsync(request);
+    expect(down.ok).toBe(true);
+    expect(await createPort(projectPath, 'local').resolveAsync(bootstrap)).toMatchObject({
+      ok: true,
+      value: generated,
+    });
+
+    const secondLifecycle = createProjectInfraLifecycle({ services: { operations } });
+    const secondUp = await secondLifecycle.upAsync(request);
+    expect(secondUp.ok).toBe(true);
+    expect(generateCredential).toHaveBeenCalledTimes(1);
+    expect(JSON.stringify(secondUp)).not.toContain('generated-secret');
+
+    const previewPort = createPort(projectPath, 'preview');
+    expect(await previewPort.persistAsync(bootstrap, previewGenerated)).toMatchObject({ ok: true });
+
+    const destroyed = await secondLifecycle.destroyAsync({
+      ...request,
+      confirmation: { projectId: 'sample', environment: 'local' },
+      persistence: { policy: 'retain' },
+    });
+    expect(destroyed.ok).toBe(true);
+    expect(await createPort(projectPath, 'local').findAsync(bootstrap)).toEqual({
+      ok: true,
+      value: null,
+      diagnostics: [],
+    });
+    expect(await previewPort.resolveAsync(bootstrap)).toMatchObject({
+      ok: true,
+      value: previewGenerated,
+    });
+  });
+});
+
+/*** Create provider-neutral operation fixtures that generate credentials only when lookup is missing. */
+function createCredentialOperations(
+  generateCredential: () => Readonly<Record<string, string>>,
+): InfraLifecycleOperations {
+  return {
+    validate: () => Promise.resolve(success({ environment: 'local' })),
+    plan: (request) =>
+      Promise.resolve(success({ projectId: request.projectId, environment: 'local', actions: [] })),
+    generate: () => Promise.resolve(success({ environment: 'local', artifacts: [], ledger })),
+    up: async (_request, dependencies) => {
+      const found = await dependencies.credentials.findAsync(bootstrap);
+      if (!found.ok) return { ok: false, diagnostics: found.diagnostics };
+      if (found.value === null) {
+        const persisted = await dependencies.credentials.persistAsync(
+          bootstrap,
+          generateCredential(),
+        );
+        if (!persisted.ok) return { ok: false, diagnostics: persisted.diagnostics };
+      }
+      return success({
+        environment: 'local',
+        targets: [],
+        resources: [],
+        outputs: [],
+        ledger,
+      });
+    },
+    status: (request) =>
+      Promise.resolve(
+        success({
+          projectId: request.projectId,
+          environment: 'local',
+          state: 'ready',
+          resources: [],
+        }),
+      ),
+    outputs: () => success({ environment: 'local', outputs: [] }),
+    down: () => Promise.resolve(success({ environment: 'local', ledger })),
+    destroy: () => Promise.resolve(success({ environment: 'local', ledger: null })),
+  };
+}
+
+/*** Create the real project-local credential adapter for one isolated test environment. */
+function createPort(projectPath: string, environment: 'local' | 'preview') {
+  return createProjectInfraCredentialPort({ projectPath, environment, processEnvironment: {} });
+}
+
+/*** Resolve the canonical Infra ownership-state path without touching credential storage internals. */
+function statePath(projectPath: string, environment: 'local' | 'preview'): string {
+  return path.join(projectPath, '.ankh', 'infra', environment, 'state.json');
+}
+
+/*** Create one successful Infra result for operation fixtures. */
+function success<T>(value: T): InfraResult<T> {
+  return { ok: true, value, diagnostics: [] };
+}
+
+/*** Run one filesystem test against a disposable project root. */
+async function withTempProjectAsync(run: (projectPath: string) => Promise<void>): Promise<void> {
+  const projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'ankh-infra-credential-lifecycle-'));
+  try {
+    await run(projectPath);
+  } finally {
+    await fs.rm(projectPath, { recursive: true, force: true });
+  }
+}

package/src/projectCredentialStore.test.ts

@@ -0,0 +1,151 @@
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import type { InfraControlPlaneCredentialRef } from '@ankhorage/contracts/infra';
+import { expect, it } from 'bun:test';
+
+import { createProjectInfraCredentialPort } from './features/environment-lifecycle/adapters/outbound/createProjectInfraCredentialPort';
+
+const bootstrap = reference('FIXTURE_BOOTSTRAP');
+const secondary = reference('SECONDARY_BOOTSTRAP');
+const generated = { username: 'fixture', password: 'generated-secret' } as const;
+
+it('persists one opaque bundle and resolves it from a fresh host instance', async () => {
+  await withTempProjectAsync(async (projectPath) => {
+    const first = createPort(projectPath);
+    expect(await first.findAsync(bootstrap)).toEqual({ ok: true, value: null, diagnostics: [] });
+    expect(await first.persistAsync(bootstrap, generated)).toEqual({
+      ok: true,
+      value: null,
+      diagnostics: [],
+    });
+
+    const fresh = createPort(projectPath);
+    expect(await fresh.resolveAsync(bootstrap)).toEqual({
+      ok: true,
+      value: generated,
+      diagnostics: [],
+    });
+  });
+});
+
+it('keeps exact and prefixed environment overrides ahead of persisted state', async () => {
+  await withTempProjectAsync(async (projectPath) => {
+    const stored = createPort(projectPath);
+    await stored.persistAsync(bootstrap, generated);
+
+    const exact = createPort(projectPath, {
+      FIXTURE_BOOTSTRAP: JSON.stringify({ username: 'exact', password: 'override' }),
+      ANKH_INFRA_CREDENTIAL_FIXTURE_BOOTSTRAP: JSON.stringify({
+        username: 'prefixed',
+        password: 'override',
+      }),
+    });
+    expect(await exact.resolveAsync(bootstrap)).toMatchObject({
+      ok: true,
+      value: { username: 'exact', password: 'override' },
+    });
+
+    const prefixed = createPort(projectPath, {
+      ANKH_INFRA_CREDENTIAL_FIXTURE_BOOTSTRAP: JSON.stringify({
+        username: 'prefixed',
+        password: 'override',
+      }),
+    });
+    expect(await prefixed.resolveAsync(bootstrap)).toMatchObject({
+      ok: true,
+      value: { username: 'prefixed', password: 'override' },
+    });
+  });
+});
+
+it('fails closed on malformed persisted state instead of treating it as missing', async () => {
+  await withTempProjectAsync(async (projectPath) => {
+    const port = createPort(projectPath);
+    await port.persistAsync(bootstrap, generated);
+    await fs.writeFile(credentialPath(projectPath, 'local', bootstrap.name), '{broken', 'utf8');
+
+    const result = await createPort(projectPath).findAsync(bootstrap);
+    expect(result.ok).toBe(false);
+    expect(result.diagnostics).toEqual([
+      {
+        severity: 'error',
+        code: 'infra-control-plane-credential-store-invalid',
+        message:
+          'Stored control-plane credential FIXTURE_BOOTSTRAP has an invalid project-state shape.',
+      },
+    ]);
+  });
+});
+
+it('uses restrictive permissions and leaves no partial files after concurrent writes', async () => {
+  await withTempProjectAsync(async (projectPath) => {
+    const port = createPort(projectPath);
+    await Promise.all([
+      port.persistAsync(bootstrap, generated),
+      port.persistAsync(secondary, { token: 'another-secret' }),
+    ]);
+
+    const directory = path.dirname(credentialPath(projectPath, 'local', bootstrap.name));
+    const entries = await fs.readdir(directory);
+    expect(entries.filter((entry) => entry.endsWith('.json'))).toHaveLength(2);
+    expect(entries.some((entry) => entry.endsWith('.tmp'))).toBe(false);
+    if (process.platform !== 'win32') {
+      expect((await fs.stat(directory)).mode & 0o777).toBe(0o700);
+      expect(
+        (await fs.stat(credentialPath(projectPath, 'local', bootstrap.name))).mode & 0o777,
+      ).toBe(0o600);
+    }
+  });
+});
+
+it('isolates persisted credentials by project and environment', async () => {
+  await withTempProjectAsync(async (root) => {
+    const projectA = path.join(root, 'a');
+    const projectB = path.join(root, 'b');
+    const local = createPort(projectA);
+    const preview = createPort(projectA, {}, 'preview');
+    const otherProject = createPort(projectB);
+    await local.persistAsync(bootstrap, generated);
+
+    expect(await local.resolveAsync(bootstrap)).toMatchObject({ ok: true, value: generated });
+    expect(await preview.findAsync(bootstrap)).toEqual({ ok: true, value: null, diagnostics: [] });
+    expect(await otherProject.findAsync(bootstrap)).toEqual({
+      ok: true,
+      value: null,
+      diagnostics: [],
+    });
+  });
+});
+
+function createPort(
+  projectPath: string,
+  processEnvironment: Readonly<Record<string, string | undefined>> = {},
+  environment: 'local' | 'preview' = 'local',
+) {
+  return createProjectInfraCredentialPort({ projectPath, environment, processEnvironment });
+}
+
+function reference(name: string): InfraControlPlaneCredentialRef {
+  return { source: 'control-plane', name };
+}
+
+function credentialPath(
+  projectPath: string,
+  environment: 'local' | 'preview',
+  name: string,
+): string {
+  const digest = createHash('sha256').update(name).digest('hex');
+  return path.join(projectPath, '.ankh', 'infra', environment, 'credentials', `${digest}.json`);
+}
+
+async function withTempProjectAsync(run: (projectPath: string) => Promise<void>): Promise<void> {
+  const projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'ankh-infra-credentials-'));
+  try {
+    await run(projectPath);
+  } finally {
+    await fs.rm(projectPath, { recursive: true, force: true });
+  }
+}

package/src/types/infraCli.ts

@@ -3,6 +3,7 @@ import type { AppEnvironmentId } from '@ankhorage/contracts/environments';
 import type { InfraEnvironmentSpec } from '@ankhorage/contracts/infra';
 
 import type { readStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/readStoredInfraStateAsync.js';
+import type { removeStoredInfraCredentialsAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraCredentialsAsync.js';
 import type { removeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/removeStoredInfraStateAsync.js';
 import type { writeInfraGeneratedArtifactsAsync } from '../features/environment-lifecycle/adapters/outbound/writeInfraGeneratedArtifactsAsync.js';
 import type { writeStoredInfraStateAsync } from '../features/environment-lifecycle/adapters/outbound/writeStoredInfraStateAsync.js';
@@ -79,6 +80,11 @@ export interface InfraLifecycleOperations {
   readonly destroy: typeof destroyInfraEnvironmentAsync;
 }
 
+interface InfraDependencyScope {
+  readonly projectPath: string;
+  readonly environment: AppEnvironmentId;
+}
+
 export interface InfraCommandServices {
   readonly resolveProject: (options: {
     readonly cwd: string;
@@ -87,9 +93,13 @@ export interface InfraCommandServices {
   readonly readState: typeof readStoredInfraStateAsync;
   readonly writeState: typeof writeStoredInfraStateAsync;
   readonly removeState: typeof removeStoredInfraStateAsync;
+  readonly removeCredentials: typeof removeStoredInfraCredentialsAsync;
   readonly writeArtifacts: typeof writeInfraGeneratedArtifactsAsync;
   readonly operations: InfraLifecycleOperations;
-  readonly createDependencies: (context: InfraCommandContext) => InfraOrchestrationDependencies;
+  readonly createDependencies: (
+    context: InfraCommandContext,
+    scope: InfraDependencyScope,
+  ) => InfraOrchestrationDependencies;
 }
 
 export interface RunInfraCommandOptions {