@canner-ca/cli 0.5.2 → 0.5.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canner-ca/cli",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Canner deploy CLI — git push from any terminal, no GitHub required",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -28,7 +28,7 @@ import { randomUUID } from 'node:crypto';
 import { stdin as input, stdout as output } from 'node:process';
 import { create as tarCreate } from 'tar';
 
-const VERSION = '0.5.2';
+const VERSION = '0.5.3';
 const DEFAULT_API_BASE = 'https://api.canner.ca';
 const CONFIG_DIR = join(homedir(), '.canner');
 const CREDENTIALS_PATH = join(CONFIG_DIR, 'credentials');
@@ -1179,6 +1179,8 @@ function parseArgs(argv) {
 //   canner db ops [<id>]                                 recent operations / one operation
 //   canner db roles [<name>] [create|member-of|audit|rotate|rm|write-exclusions …]   roles, groups and logins
 //   canner db inject [<name>] [<login>|owner|off|on]     which credential the app receives
+//   canner db least-privilege [<name>] [--label app] --yes   run the app as a limited role; the owner goes to the build only
+//   canner db check [<name>] [--category security|performance] [--strict] [--json]   security and performance check
 //
 // Long operations (export, import, migrate, copy) run on the platform: the CLI
 // starts one, then waits and shows progress. Pass --no-wait to return the
@@ -2020,6 +2022,34 @@ async function cmdDb(args) {
     return;
   }
 
+  if (sub === 'check') {
+    // A read-only security and performance check of one database (catalog only, never data). Works on every plan.
+    const label = args._[1] ?? 'primary';
+    if (args.category !== undefined && args.category !== 'security' && args.category !== 'performance') die('--category must be security or performance.', 2);
+    const r = await apiJSON(creds, 'GET', `${base}/databases/${encodeURIComponent(label)}/security-check`);
+    const findings = typeof args.category === 'string' ? r.check.findings.filter((f) => f.category === args.category) : r.check.findings;
+    const warn = findings.filter((f) => f.severity === 'warn').length;
+    const note = findings.length - warn;
+    if (JSON_MODE) emitJSON({ ...r.check, findings, summary: { warn, info: note } });
+    else {
+      info(`${bold(label)}  ${warn > 0 ? yellow(`${warn} warning${warn === 1 ? '' : 's'}`) : green('no warnings')}  ${dim(`· ${note} note${note === 1 ? '' : 's'}`)}`);
+      for (const category of ['security', 'performance']) {
+        const group = findings.filter((f) => f.category === category);
+        if (group.length === 0) continue;
+        info('');
+        info(bold(category.toUpperCase()));
+        for (const f of group) {
+          const objs = f.objects.length > 0 ? `  ${dim(`[${f.objects.join(', ')}${f.more ? ', …' : ''}]`)}` : '';
+          info(`  ${f.severity === 'warn' ? yellow('warn') : dim('info')}  ${f.message}${objs}`);
+        }
+      }
+      if (findings.length === 0) info(green('nothing to report'));
+    }
+    // For CI: --strict fails the run when anything is a warning.
+    if (args.strict === true && warn > 0) process.exitCode = 1;
+    return;
+  }
+
   if (sub === 'inject') {
     // Which credential the app receives as DATABASE_URL (or DATABASE_URL_<NAME>): the owner's (the default) or one of your logins.
     const label = args._[1] ?? 'primary';
@@ -2043,6 +2073,26 @@ async function cmdDb(args) {
     return;
   }
 
+  if (sub === 'least-privilege') {
+    // One step to the usual safe arrangement: the app logs in as a limited role, the owner (which can change the schema) is
+    // given to the BUILD only, as DATABASE_URL_MIGRATE, and every migration ledger stays read-only for the app's role.
+    const label = args._[1] ?? 'primary';
+    requireYes(args, 'The app will run as a limited role (it can read and write data but cannot change the schema) from its next deploy, and the database owner will be given to the build only, as DATABASE_URL_MIGRATE: run your migrations there.');
+    const r = await apiJSON(creds, 'POST', `${base}/databases/${encodeURIComponent(label)}/least-privilege`, {
+      confirm: true,
+      ...(typeof args.label === 'string' ? { label: args.label } : {}),
+    });
+    if (JSON_MODE) return emitJSON(r.least_privilege);
+    const lp = r.least_privilege;
+    const envVar = label === 'primary' ? 'DATABASE_URL' : `DATABASE_URL_${label.toUpperCase()}`;
+    info(`${green(lp.role.created ? 'created' : 'using')} the role ${bold(lp.role.label)}; ${bold(envVar)} will carry it from the next deploy`);
+    if (lp.protected_tables.length) info(`  kept read-only for it: ${lp.protected_tables.join(', ')}`);
+    for (const t of lp.suggestions ?? []) info(`  ${yellow('look at')} ${t} ${dim(`(looks like a ledger; keep it read-only with: canner db roles ${label} write-exclusions ${lp.role.label} ${t})`)}`);
+    info(`  ${bold(lp.migration_var)} is available to the build only: run your migrations with it (for example ${dim(`DATABASE_URL=$${lp.migration_var} npx prisma migrate deploy`)}).`);
+    muted('Run it again after your first migration: a ledger created later is also kept read-only for the app, within minutes, without this.');
+    return;
+  }
+
   if (sub === 'roles') {
     const label = args._[1] ?? 'primary';
     const action = args._[2];
@@ -2341,7 +2391,46 @@ async function cmdDb(args) {
       return;
     }
 
-    die('usage: canner db instance [show] | create [--pg 17|18] [--pitr] [--window DAYS] | start | stop --yes | destroy --yes', 2);
+    if (action === 'upgrade') {
+      const what = args._[2];
+      const up = `${path}/upgrade`;
+      if (!what || what === 'check') {
+        const body = await apiJSON(creds, 'GET', up);
+        if (JSON_MODE) return emitJSON(body);
+        info(`${bold('Postgres')} ${body.current}${body.targets.length ? dim(`  can be upgraded to ${body.targets.join(', ')}`) : dim('  (already on the newest version offered)')}`);
+        for (const b of body.blockers ?? []) info(`  ${yellow('blocked')} ${b.message}`);
+        if (body.targets.length && !(body.blockers ?? []).length) muted('Upgrade with `canner db instance upgrade run --yes` (every database on the instance goes offline for a few minutes).');
+        if (body.rollback) info(`  ${dim(`the previous version (Postgres ${body.rollback.to_version}) is kept until ${body.rollback.until}: \`canner db instance upgrade rollback --yes\` goes back, \`... finish --yes\` discards it`)}`);
+        return;
+      }
+      if (what === 'run') {
+        requireYes(args, 'Upgrading restarts every database on the instance on a newer Postgres: they are offline for a few minutes. Roles, grants, policies and extensions carry over and the connection strings do not change. Point-in-time recovery starts a fresh window. If it fails, the instance is left as it was.');
+        const done = await startAndWait(creds, base, args, 'POST', up, { ...(args.pg ? { target: String(args.pg) } : {}), confirm: true }, 'upgrading');
+        if (!done) return;
+        if (JSON_MODE) return emitJSON(done);
+        info(`${green('upgraded')} the instance from Postgres ${done.result?.from_pg_version} to ${done.result?.to_pg_version}`);
+        muted('The previous version is kept for 7 days in case you need to roll back: `canner db instance upgrade rollback --yes`.');
+        return;
+      }
+      if (what === 'rollback') {
+        requireYes(args, 'A rollback goes back to the version before the upgrade and LOSES everything written since. Point-in-time recovery starts a fresh window.');
+        const done = await startAndWait(creds, base, args, 'POST', `${up}/rollback`, { confirm: true }, 'rolling back');
+        if (!done) return;
+        if (JSON_MODE) return emitJSON(done);
+        info(`${green('rolled back')} the instance to Postgres ${done.result?.to_pg_version}`);
+        return;
+      }
+      if (what === 'finish') {
+        requireYes(args, 'This discards the previous version, so a rollback is no longer possible.');
+        const body = await apiJSON(creds, 'POST', `${up}/finish`, { confirm: true });
+        if (JSON_MODE) return emitJSON(body);
+        info(`${green('done')}: the previous version was removed`);
+        return;
+      }
+      die('usage: canner db instance upgrade [check] | run [--pg 18] --yes | rollback --yes | finish --yes', 2);
+    }
+
+    die('usage: canner db instance [show] | create [--pg 17|18] [--pitr] [--window DAYS] | start | stop --yes | upgrade [check|run|rollback|finish] | destroy --yes', 2);
   }
 
   if (sub === 'pitr') {
@@ -2439,7 +2528,7 @@ async function cmdDb(args) {
     return;
   }
 
-  die(`unknown db subcommand "${sub}". Use: list | init | create | info | url | rm | pg-version | export | import | migrate-in | migrate-out | copy | ops | external | rotate | backup-policy | backup | backups | diff | inspect | alerts | roles | offsite | metrics | monitoring | insights | logs | resources | extensions | tuning | restart | replication | subscriptions | instance | pitr | pitr-restore | move.`, 2);
+  die(`unknown db subcommand "${sub}". Use: list | init | create | info | url | rm | pg-version | export | import | migrate-in | migrate-out | copy | ops | external | rotate | backup-policy | backup | backups | diff | inspect | alerts | roles | least-privilege | offsite | metrics | monitoring | insights | logs | resources | extensions | tuning | restart | replication | subscriptions | instance | pitr | pitr-restore | move.`, 2);
 }
 
 function printHelp() {
@@ -2567,6 +2656,10 @@ ${bold('Databases:')}
   ${bold('db')} roles <name> rm <role> --yes
   ${bold('db')} roles <name> write-exclusions <role> <table>
                        Keep one more table SELECT-only for a read-write role, live — no recreation.
+  ${bold('db')} check [<name>] [--category security|performance] [--strict] [--json]
+                       A read-only security and performance check of a database (every plan): policies that allow every
+                       row, functions anyone can run as their owner, views that bypass row-level security, missing primary
+                       keys and indexes, duplicate indexes. --strict fails the run on any warning, for CI.
   ${bold('db')} inject [<name>] [<login> | owner | off | on]
                        Which credential the app receives as DATABASE_URL: the owner's (default) or one of your
                        logins. Takes effect on the next deploy.