@caelo-cms/provisioning 0.10.47 → 0.10.48

package/src/state-pulumi.ts

@@ -0,0 +1,289 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The real {@link StatePulumiOps} for `state migrate` (#696): the Pulumi CLI
+ * (state operations) and the Automation API (previews), always in the
+ * install's stack dir and with exactly the backend's environment. The
+ * operator never runs `pulumi` by hand (CLAUDE.md §11.C).
+ *
+ * Secrets: outputs are read with `--show-secrets` only to hash them; the
+ * values never leave {@link outputsDigest}. The export/import fallback
+ * writes the deployment without `--show-secrets` (ciphertext only) to a
+ * mode-600 file in the install dir and deletes it afterwards.
+ */
+
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import * as automation from "@pulumi/pulumi/automation";
+import { redactCredentials } from "./checkpoint-secrets.js";
+import { GCP_STACK_ENV } from "./gcp-names.js";
+import type { ResolvedBackend } from "./state-backend.js";
+import type { StatePulumiOps } from "./state-migrate.js";
+import {
+  alignStackSettingsFile,
+  applyStackConfig,
+  gcpStackWorkDir,
+  pulumiGcpEnv,
+  type StackConfigInputs,
+  type StateResource,
+  stateOnlyEnv,
+} from "./wizards/gcp-pulumi.js";
+
+/** Every file below `dir`. */
+function listFilesRecursive(dir: string): string[] {
+  return readdirSync(dir, { recursive: true, withFileTypes: true })
+    .filter((e) => e.isFile())
+    .map((e) => e.name);
+}
+
+/** Canonical JSON (sorted keys) so equal outputs hash equally. */
+export function canonicalJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value as Record<string, unknown>).sort(([a], [b]) =>
+      a < b ? -1 : a > b ? 1 : 0,
+    );
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+/** Steps of a preview's change summary other than "same". */
+export function changeCount(summary: Readonly<Record<string, number | undefined>>): number {
+  return Object.entries(summary)
+    .filter(([op]) => op !== "same")
+    .reduce((n, [, c]) => n + (c ?? 0), 0);
+}
+
+interface Deployment {
+  pending_operations?: unknown[];
+  secrets_providers?: {
+    type?: string;
+    state?: { salt?: string; url?: string; encryptedkey?: string };
+  };
+  resources?: StateResource[];
+}
+
+export interface RealPulumiOpsInputs {
+  readonly provider: "gcp" | "gcp-firebase";
+  readonly installRoot: string;
+  /** The service account the GCP provider impersonates during previews. */
+  readonly impersonateServiceAccount: string;
+  /** The config a wizard run sets, so a preview shows real drift only. */
+  readonly stackConfig: StackConfigInputs;
+}
+
+/** {@link StatePulumiOps} backed by the `pulumi` CLI + Automation API. */
+export function realStatePulumiOps(inputs: RealPulumiOpsInputs): StatePulumiOps {
+  const workDir = gcpStackWorkDir(inputs.provider);
+
+  const cli = async (
+    args: string[],
+    env: Record<string, string>,
+  ): Promise<{ stdout: string; stderr: string }> => {
+    const p = Bun.spawn(["pulumi", ...args, "--cwd", workDir, "--non-interactive"], {
+      env: { ...process.env, ...env, PULUMI_SKIP_UPDATE_CHECK: "true" },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr] = await Promise.all([
+      new Response(p.stdout).text(),
+      new Response(p.stderr).text(),
+    ]);
+    if ((await p.exited) !== 0) {
+      throw new Error(
+        `pulumi ${args[0]} ${args[1] ?? ""} failed: ${redactCredentials(stderr.trim().split("\n").slice(-3).join(" "))}`,
+      );
+    }
+    return { stdout, stderr };
+  };
+
+  // The read-only steps (preflight, verification) align the package's
+  // stack settings file and may set config to run a preview; the file is
+  // put back exactly as it was afterwards, so a refused migration or a dry
+  // run leaves it untouched.
+  const settingsFile = join(workDir, `Pulumi.${GCP_STACK_ENV}.yaml`);
+  const preserved = async <T>(fn: () => Promise<T>): Promise<T> => {
+    // Read without a separate existence check (no check-then-use race), and
+    // put the file back atomically (temp file + rename).
+    let before: Buffer | null;
+    try {
+      before = readFileSync(settingsFile);
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
+      before = null;
+    }
+    try {
+      return await fn();
+    } finally {
+      if (before === null) rmSync(settingsFile, { force: true });
+      else {
+        const tmp = `${settingsFile}.restore-${process.pid}`;
+        writeFileSync(tmp, before, { flag: "w" });
+        renameSync(tmp, settingsFile);
+      }
+    }
+  };
+
+  const exportDeployment = async (b: ResolvedBackend): Promise<Deployment> => {
+    await alignStackSettingsFile(b, inputs.provider);
+    const { stdout } = await cli(["stack", "export", "--stack", GCP_STACK_ENV], stateOnlyEnv(b));
+    return ((JSON.parse(stdout) as { deployment?: Deployment }).deployment ?? {}) as Deployment;
+  };
+
+  /** Env for an operation that reads one backend and writes another. */
+  const bothEnv = (from: ResolvedBackend, to: ResolvedBackend): Record<string, string> => ({
+    ...stateOnlyEnv(from),
+    ...stateOnlyEnv(to),
+  });
+
+  const ops: StatePulumiOps = {
+    async cliVersion() {
+      const p = Bun.spawnSync(["pulumi", "version"], { stdout: "pipe", stderr: "pipe" });
+      if (p.exitCode !== 0) return null;
+      return new TextDecoder().decode(p.stdout).trim().replace(/^v/, "") || null;
+    },
+
+    async stackExists(b) {
+      const { stdout } = await cli(["stack", "ls", "--json"], stateOnlyEnv(b));
+      const stacks = JSON.parse(stdout || "[]") as { name?: string }[];
+      return stacks.some((s) => s.name === GCP_STACK_ENV || s.name?.endsWith(`/${GCP_STACK_ENV}`));
+    },
+
+    async locked(b) {
+      // Pulumi's DIY backends keep one lock file per running operation under
+      // .pulumi/locks/ (file:// and gs:// alike).
+      if (b.url.startsWith("file://")) {
+        const dir = join(b.url.slice("file://".length), ".pulumi", "locks");
+        return existsSync(dir) && listFilesRecursive(dir).length > 0;
+      }
+      const r = Bun.spawnSync(["gcloud", "storage", "ls", `${b.url}/.pulumi/locks/**`], {
+        stdout: "pipe",
+        stderr: "pipe",
+        env: { ...process.env, CLOUDSDK_CORE_DISABLE_PROMPTS: "1" },
+      });
+      if (r.exitCode === 0) return new TextDecoder().decode(r.stdout).trim().length > 0;
+      const err = new TextDecoder().decode(r.stderr);
+      if (/matched no objects|No URLs matched|NotFound|404/i.test(err)) return false;
+      throw new Error(`Could not check the stack lock in ${b.url}: ${err.trim()}`);
+    },
+
+    async stateDigest(b) {
+      const deployment = await exportDeployment(b);
+      return createHash("sha256").update(canonicalJson(deployment)).digest("hex");
+    },
+
+    async pendingOperations(b) {
+      return (await exportDeployment(b)).pending_operations?.length ?? 0;
+    },
+
+    async previewChanges(b) {
+      await alignStackSettingsFile(b, inputs.provider);
+      const stack = await automation.LocalWorkspace.selectStack(
+        { stackName: GCP_STACK_ENV, workDir },
+        {
+          envVars: pulumiGcpEnv(process.env, {
+            backend: b,
+            impersonateServiceAccount: inputs.impersonateServiceAccount,
+          }),
+        },
+      );
+      // The stack's own config wins: an operator may have tuned a knob
+      // (`pulumi config set`), and resetting it would show as drift. Only a
+      // stack dir without the install's config (a fresh `bunx` version)
+      // gets what the wizard sets — as does one holding another install's
+      // config (installs of one provider share the package's stack dir).
+      const config: automation.ConfigMap = await stack.getAllConfig().catch(() => ({}));
+      if (config[`caelo-${inputs.provider}:project`]?.value !== inputs.stackConfig.projectId) {
+        const resources = ((await stack.exportStack()).deployment?.resources ??
+          []) as StateResource[];
+        await applyStackConfig(stack, inputs.stackConfig, resources);
+      }
+      const r = await stack.preview({ refresh: true });
+      return changeCount(r.changeSummary);
+    },
+
+    async outputsDigest(b) {
+      await alignStackSettingsFile(b, inputs.provider);
+      const { stdout } = await cli(
+        ["stack", "output", "--stack", GCP_STACK_ENV, "--json", "--show-secrets"],
+        stateOnlyEnv(b),
+      );
+      return createHash("sha256")
+        .update(canonicalJson(JSON.parse(stdout || "{}")))
+        .digest("hex");
+    },
+
+    async stackMigrate(from, to) {
+      await alignStackSettingsFile(from, inputs.provider);
+      await cli(
+        [
+          "stack",
+          "migrate",
+          from.url,
+          GCP_STACK_ENV,
+          "--secrets-provider",
+          to.secretsProvider,
+          "--yes",
+        ],
+        bothEnv(from, to),
+      );
+    },
+
+    async exportImport(from, to) {
+      const deployment = await exportDeployment(from);
+      const file = join(inputs.installRoot, `.migrate-export-${process.pid}.json`);
+      try {
+        const { stdout } = await cli(
+          ["stack", "export", "--stack", GCP_STACK_ENV],
+          stateOnlyEnv(from),
+        );
+        writeFileSync(file, stdout, { mode: 0o600 });
+        // The target stack starts with the source's secrets manager, so the
+        // imported ciphertext decrypts; change-secrets-provider re-encrypts.
+        const ws = await automation.LocalWorkspace.create({ workDir, envVars: stateOnlyEnv(to) });
+        const settings = await ws.stackSettings(GCP_STACK_ENV).catch(() => ({}));
+        const sp = deployment.secrets_providers;
+        const {
+          secretsProvider: _p,
+          encryptedKey: _k,
+          encryptionSalt: _s,
+          ...rest
+        } = settings as automation.StackSettings;
+        await ws.saveStackSettings(GCP_STACK_ENV, {
+          ...rest,
+          ...(sp?.type === "passphrase" && sp.state?.salt ? { encryptionSalt: sp.state.salt } : {}),
+          ...(sp?.type === "cloud" && sp.state?.url
+            ? { secretsProvider: sp.state.url, encryptedKey: sp.state.encryptedkey }
+            : {}),
+        });
+        await cli(
+          ["stack", "init", GCP_STACK_ENV, "--secrets-provider", from.secretsProvider],
+          bothEnv(from, to),
+        );
+        await cli(["stack", "import", "--stack", GCP_STACK_ENV, "--file", file], bothEnv(from, to));
+        await cli(
+          ["stack", "change-secrets-provider", "--stack", GCP_STACK_ENV, to.secretsProvider],
+          bothEnv(from, to),
+        );
+      } finally {
+        rmSync(file, { force: true });
+      }
+    },
+
+    async removeStack(b) {
+      await cli(
+        ["stack", "rm", GCP_STACK_ENV, "--force", "--yes", "--preserve-config"],
+        stateOnlyEnv(b),
+      );
+    },
+  };
+  return {
+    ...ops,
+    pendingOperations: (b) => preserved(() => ops.pendingOperations(b)),
+    stateDigest: (b) => preserved(() => ops.stateDigest(b)),
+    previewChanges: (b) => preserved(() => ops.previewChanges(b)),
+    outputsDigest: (b) => preserved(() => ops.outputsDigest(b)),
+  };
+}

package/src/state-store.test.ts

@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * install.json / progress.json stores (#696, state-store.ts) against a fake
+ * `gcloud storage`: the bucket is authoritative, the local copy a mirror,
+ * and both stores refuse secret material (#656 / #659) before anything is
+ * written — locally or to the bucket.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import type { GcloudResult } from "./gcloud.js";
+import { GcsStateStore, LocalStateStore, type SyncGcloud } from "./state-store.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+
+/** A bucket as a Map, reached through `gcloud storage cat|cp -`. */
+function fakeBucket() {
+  const objects = new Map<string, string>();
+  const calls: string[] = [];
+  const run: SyncGcloud = (args, input) => {
+    calls.push(args.join(" "));
+    if (args[0] === "storage" && args[1] === "cat") {
+      const v = objects.get(args[2] ?? "");
+      return v === undefined ? fail("ERROR: One or more URLs matched no objects.") : ok(v);
+    }
+    if (args[0] === "storage" && args[1] === "cp" && args[2] === "-") {
+      objects.set(args[3] ?? "", input ?? "");
+      return ok();
+    }
+    return fail(`unexpected gcloud ${args.join(" ")}`);
+  };
+  return { objects, calls, run };
+}
+
+const PASSWORD_URL = "postgres://admin_role:hunter2hunter2@10.0.0.3:5432/cms_admin";
+
+let root = "";
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "caelo-store-"));
+});
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true });
+});
+
+describe("LocalStateStore", () => {
+  it("round-trips a document with mode 0600", () => {
+    const s = new LocalStateStore(root);
+    expect(s.read("install.json")).toBeNull();
+    s.write("install.json", { installId: "gcp-acme" });
+    expect(JSON.parse(s.read("install.json") ?? "")).toEqual({ installId: "gcp-acme" });
+    expect(statSync(join(root, "install.json")).mode & 0o777).toBe(0o600);
+  });
+
+  it("refuses secret material in either document", () => {
+    const s = new LocalStateStore(root);
+    expect(() => s.write("install.json", { db: PASSWORD_URL })).toThrow(/Refusing to write/);
+    expect(() =>
+      s.write("progress.json", { lastCompletedStep: null, steps: { up: { url: PASSWORD_URL } } }),
+    ).toThrow(/Refusing to write/);
+    expect(existsSync(join(root, "install.json"))).toBe(false);
+  });
+});
+
+describe("GcsStateStore", () => {
+  it("writes to the bucket first, then mirrors locally", () => {
+    const b = fakeBucket();
+    const s = new GcsStateStore("acme-caelo-ops", root, b.run);
+    s.write("progress.json", { lastCompletedStep: "x", steps: { x: { done: true } } });
+    const text = b.objects.get("gs://acme-caelo-ops/install/progress.json");
+    expect(JSON.parse(text ?? "")).toMatchObject({ lastCompletedStep: "x" });
+    expect(readFileSync(join(root, "progress.json"), "utf8")).toBe(text ?? "");
+  });
+
+  it("reads from the bucket, not the (possibly stale) local mirror, once per process", () => {
+    const b = fakeBucket();
+    b.objects.set("gs://acme-caelo-ops/install/install.json", '{"installId":"bucket"}\n');
+    writeFileSync(join(root, "install.json"), '{"installId":"stale-mirror"}\n');
+    const s = new GcsStateStore("acme-caelo-ops", root, b.run);
+    expect(JSON.parse(s.read("install.json") ?? "")).toEqual({ installId: "bucket" });
+    expect(JSON.parse(readFileSync(join(root, "install.json"), "utf8"))).toEqual({
+      installId: "bucket",
+    });
+    s.read("install.json");
+    expect(b.calls.filter((c) => c.startsWith("storage cat")).length).toBe(1);
+  });
+
+  it("peek reads the bucket without caching or touching the local mirror", () => {
+    const b = fakeBucket();
+    b.objects.set("gs://acme-caelo-ops/install/install.json", '{"installId":"someone-else"}\n');
+    writeFileSync(join(root, "install.json"), '{"installId":"mine"}\n');
+    const s = new GcsStateStore("acme-caelo-ops", root, b.run);
+    expect(s.peek("install.json")).toContain("someone-else");
+    expect(readFileSync(join(root, "install.json"), "utf8")).toContain("mine");
+  });
+
+  it("a missing object is null; any other bucket error throws (no silent local fallback)", () => {
+    const b = fakeBucket();
+    const s = new GcsStateStore("acme-caelo-ops", root, b.run);
+    expect(s.read("progress.json")).toBeNull();
+    const denied = new GcsStateStore("acme-caelo-ops", root, () =>
+      fail("ERROR: 403 does not have storage.objects.get access"),
+    );
+    expect(() => denied.read("install.json")).toThrow(/Could not read gs:\/\/acme-caelo-ops/);
+  });
+
+  it("refuses secret material before anything reaches the bucket (#659 guard)", () => {
+    const b = fakeBucket();
+    const s = new GcsStateStore("acme-caelo-ops", root, b.run);
+    expect(() =>
+      s.write("progress.json", {
+        lastCompletedStep: "pulumi-up-acme",
+        steps: { "pulumi-up-acme": { outputs: { adminDatabaseUrlOut: PASSWORD_URL } } },
+      }),
+    ).toThrow(/Refusing to write secret material to progress.json/);
+    expect(() => s.write("install.json", { installId: "x", password: "hunter2hunter2" })).toThrow(
+      /Refusing/,
+    );
+    expect(b.calls).toEqual([]);
+    expect(existsSync(join(root, "progress.json"))).toBe(false);
+  });
+
+  it("a failed upload changes nothing locally", () => {
+    const s = new GcsStateStore("acme-caelo-ops", root, () => fail("ERROR: 503 backend error"));
+    expect(() => s.write("install.json", { installId: "x" })).toThrow(/Could not write/);
+    expect(existsSync(join(root, "install.json"))).toBe(false);
+  });
+});
+
+describe("install-state through the stores (child process, own HOME)", () => {
+  it("a gcs install reads/writes the bucket; leaving it updates the bucket's install.json", () => {
+    // installRoot() resolves ~ via os.homedir(), read once at process start —
+    // drive install-state in a child process with its own HOME, and a fake
+    // `gcloud storage` that keeps objects in files under <home>/bucket.
+    const home = mkdtempSync(join(tmpdir(), "caelo-store-home-"));
+    try {
+      const mod = resolve(import.meta.dir, "install-state.ts");
+      const script = `
+        const fs = await import("node:fs");
+        const path = await import("node:path");
+        const m = await import(${JSON.stringify(mod)});
+        const home = ${JSON.stringify(home)};
+        const obj = (url) => path.join(home, "bucket", url.replace("gs://", ""));
+        const calls = [];
+        m.setStateStoreGcloud((args, input) => {
+          calls.push(args.slice(0, 2).join(" "));
+          if (args[1] === "cat") {
+            return fs.existsSync(obj(args[2]))
+              ? { ok: true, stdout: fs.readFileSync(obj(args[2]), "utf8"), stderr: "", exitCode: 0 }
+              : { ok: false, stdout: "", stderr: "matched no objects", exitCode: 1 };
+          }
+          fs.mkdirSync(path.dirname(obj(args[3])), { recursive: true });
+          fs.writeFileSync(obj(args[3]), input);
+          return { ok: true, stdout: "", stderr: "", exitCode: 0 };
+        });
+        const id = "gcp-acme";
+        m.ensureInstallDir(id);
+        m.writeMetadata(id, { installId: id, provider: "gcp", projectId: "acme", domain: "acme.com",
+          ownerEmail: "o@acme.com", region: "europe-west1", createdAt: "2026-01-01T00:00:00.000Z" });
+        m.markStepDone(id, "project-acme", { created: true });
+        const localCalls = calls.length;
+        m.adoptStateBackend(id, { kind: "gcs", bucket: "acme-caelo-ops",
+          kmsKey: "projects/acme/locations/europe-west1/keyRings/caelo/cryptoKeys/pulumi-state" });
+        m.markStepDone(id, "pulumi-up-acme", { outputs: { providerOut: "gcp" } });
+        const bucketProgress = JSON.parse(fs.readFileSync(obj("gs://acme-caelo-ops/install/progress.json"), "utf8"));
+        const bucketMeta = JSON.parse(fs.readFileSync(obj("gs://acme-caelo-ops/install/install.json"), "utf8"));
+        let refused = "";
+        try { m.markStepDone(id, "bad", { url: ${JSON.stringify(PASSWORD_URL)} }); } catch (e) { refused = e.message; }
+        // A caller holding pre-migration metadata can't switch the backend back.
+        m.writeMetadata(id, { ...m.readMetadata(id), stateBackend: { kind: "local" } });
+        const keptBackend = JSON.parse(fs.readFileSync(obj("gs://acme-caelo-ops/install/install.json"), "utf8")).stateBackend.kind;
+        const stateDirAfterAdopt = fs.existsSync(path.join(home, ".caelo-" + id, "state"));
+        m.adoptStateBackend(id, { kind: "local" });
+        const bucketAfterLeave = JSON.parse(fs.readFileSync(obj("gs://acme-caelo-ops/install/install.json"), "utf8"));
+        const callsBefore = calls.length;
+        m.markStepDone(id, "after-leave", { x: 1 });
+        console.log(JSON.stringify({
+          localCalls, bucketSteps: Object.keys(bucketProgress.steps), bucketBackend: bucketMeta.stateBackend.kind,
+          refused, stateDirAfterAdopt, keptBackend, bucketAfterLeave: bucketAfterLeave.stateBackend.kind,
+          callsAfterLeave: calls.length - callsBefore, done: m.isStepDone(id, "after-leave"),
+          listed: m.listInstalls().map((i) => i.installId),
+        }));
+      `;
+      const child = Bun.spawnSync([process.execPath, "-e", script], {
+        env: { ...process.env, HOME: home },
+        stderr: "pipe",
+      });
+      expect(new TextDecoder().decode(child.stderr)).toBe("");
+      expect(child.exitCode).toBe(0);
+      const r = JSON.parse(new TextDecoder().decode(child.stdout));
+      expect(r.localCalls).toBe(0);
+      expect(r.bucketSteps).toEqual(["project-acme", "pulumi-up-acme"]);
+      expect(r.bucketBackend).toBe("gcs");
+      expect(r.keptBackend).toBe("gcs");
+      expect(r.refused).toContain("credential-url");
+      expect(r.bucketAfterLeave).toBe("local");
+      expect(r.callsAfterLeave).toBe(0);
+      expect(r.done).toBe(true);
+      expect(r.listed).toEqual(["gcp-acme"]);
+      const bucketText = readFileSync(
+        join(home, "bucket", "acme-caelo-ops", "install", "progress.json"),
+        "utf8",
+      );
+      expect(bucketText).not.toContain("hunter2");
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  }, 30_000);
+});