@canner-ca/cli 0.5.2 → 0.5.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canner-ca/cli",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Canner deploy CLI — git push from any terminal, no GitHub required",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -28,7 +28,7 @@ import { randomUUID } from 'node:crypto';
 import { stdin as input, stdout as output } from 'node:process';
 import { create as tarCreate } from 'tar';
 
-const VERSION = '0.5.2';
+const VERSION = '0.5.4';
 const DEFAULT_API_BASE = 'https://api.canner.ca';
 const CONFIG_DIR = join(homedir(), '.canner');
 const CREDENTIALS_PATH = join(CONFIG_DIR, 'credentials');
@@ -692,7 +692,7 @@ async function resolveTokenId(creds, ref) {
 // ---------------------------------------------------------------------------
 // canner env [--reveal] [--slug X]                      — list env vars
 //   (sensitive values redacted by default, in text AND --json; --reveal opts out)
-// canner env set KEY=VALUE [--env production|preview] [--sensitive] [--slug X]
+// canner env set KEY=VALUE [--env production|preview|runtime] [--sensitive] [--slug X]
 // canner env rm <KEY|id> [--env ...] [--slug X]         — delete an env var
 // ---------------------------------------------------------------------------
 async function cmdEnv(args) {
@@ -760,10 +760,11 @@ async function cmdEnv(args) {
   die(`unknown env subcommand "${sub}". Use: list | set | rm.`, 2);
 }
 
-// Map a --env flag to the API's environment field. Accepts production/preview;
+// Map a --env flag to the API's environment field. Accepts production / preview / runtime
+// (runtime = the running app on production deploys only: never builds, the release command or previews);
 // anything else (or absent) means "all environments" (null).
 function normalizeEnvScope(flag) {
-  if (flag === 'production' || flag === 'preview') return flag;
+  if (flag === 'production' || flag === 'preview' || flag === 'runtime') return flag;
   return null;
 }
 
@@ -1179,6 +1180,8 @@ function parseArgs(argv) {
 //   canner db ops [<id>]                                 recent operations / one operation
 //   canner db roles [<name>] [create|member-of|audit|rotate|rm|write-exclusions …]   roles, groups and logins
 //   canner db inject [<name>] [<login>|owner|off|on]     which credential the app receives
+//   canner db least-privilege [<name>] [--label app] --yes   run the app as a limited role; the owner goes to the build only
+//   canner db check [<name>] [--category security|performance] [--strict] [--json]   security and performance check
 //
 // Long operations (export, import, migrate, copy) run on the platform: the CLI
 // starts one, then waits and shows progress. Pass --no-wait to return the
@@ -2020,6 +2023,34 @@ async function cmdDb(args) {
     return;
   }
 
+  if (sub === 'check') {
+    // A read-only security and performance check of one database (catalog only, never data). Works on every plan.
+    const label = args._[1] ?? 'primary';
+    if (args.category !== undefined && args.category !== 'security' && args.category !== 'performance') die('--category must be security or performance.', 2);
+    const r = await apiJSON(creds, 'GET', `${base}/databases/${encodeURIComponent(label)}/security-check`);
+    const findings = typeof args.category === 'string' ? r.check.findings.filter((f) => f.category === args.category) : r.check.findings;
+    const warn = findings.filter((f) => f.severity === 'warn').length;
+    const note = findings.length - warn;
+    if (JSON_MODE) emitJSON({ ...r.check, findings, summary: { warn, info: note } });
+    else {
+      info(`${bold(label)}  ${warn > 0 ? yellow(`${warn} warning${warn === 1 ? '' : 's'}`) : green('no warnings')}  ${dim(`· ${note} note${note === 1 ? '' : 's'}`)}`);
+      for (const category of ['security', 'performance']) {
+        const group = findings.filter((f) => f.category === category);
+        if (group.length === 0) continue;
+        info('');
+        info(bold(category.toUpperCase()));
+        for (const f of group) {
+          const objs = f.objects.length > 0 ? `  ${dim(`[${f.objects.join(', ')}${f.more ? ', …' : ''}]`)}` : '';
+          info(`  ${f.severity === 'warn' ? yellow('warn') : dim('info')}  ${f.message}${objs}`);
+        }
+      }
+      if (findings.length === 0) info(green('nothing to report'));
+    }
+    // For CI: --strict fails the run when anything is a warning.
+    if (args.strict === true && warn > 0) process.exitCode = 1;
+    return;
+  }
+
   if (sub === 'inject') {
     // Which credential the app receives as DATABASE_URL (or DATABASE_URL_<NAME>): the owner's (the default) or one of your logins.
     const label = args._[1] ?? 'primary';
@@ -2043,6 +2074,26 @@ async function cmdDb(args) {
     return;
   }
 
+  if (sub === 'least-privilege') {
+    // One step to the usual safe arrangement: the app logs in as a limited role, the owner (which can change the schema) is
+    // given to the release command only, as DATABASE_URL_MIGRATE, and every migration ledger stays read-only for the app's role.
+    const label = args._[1] ?? 'primary';
+    requireYes(args, 'The app will run as a limited role (it can read and write data but cannot change the schema) from its next deploy, and the database owner will be given to the release command only, as DATABASE_URL_MIGRATE: run your migrations there.');
+    const r = await apiJSON(creds, 'POST', `${base}/databases/${encodeURIComponent(label)}/least-privilege`, {
+      confirm: true,
+      ...(typeof args.label === 'string' ? { label: args.label } : {}),
+    });
+    if (JSON_MODE) return emitJSON(r.least_privilege);
+    const lp = r.least_privilege;
+    const envVar = label === 'primary' ? 'DATABASE_URL' : `DATABASE_URL_${label.toUpperCase()}`;
+    info(`${green(lp.role.created ? 'created' : 'using')} the role ${bold(lp.role.label)}; ${bold(envVar)} will carry it from the next deploy`);
+    if (lp.protected_tables.length) info(`  kept read-only for it: ${lp.protected_tables.join(', ')}`);
+    for (const t of lp.suggestions ?? []) info(`  ${yellow('look at')} ${t} ${dim(`(looks like a ledger; keep it read-only with: canner db roles ${label} write-exclusions ${lp.role.label} ${t})`)}`);
+    info(`  ${bold(lp.migration_var)} is available to the build only: run your migrations with it (for example ${dim(`DATABASE_URL=$${lp.migration_var} npx prisma migrate deploy`)}).`);
+    muted('Run it again after your first migration: a ledger created later is also kept read-only for the app, within minutes, without this.');
+    return;
+  }
+
   if (sub === 'roles') {
     const label = args._[1] ?? 'primary';
     const action = args._[2];
@@ -2341,7 +2392,46 @@ async function cmdDb(args) {
       return;
     }
 
-    die('usage: canner db instance [show] | create [--pg 17|18] [--pitr] [--window DAYS] | start | stop --yes | destroy --yes', 2);
+    if (action === 'upgrade') {
+      const what = args._[2];
+      const up = `${path}/upgrade`;
+      if (!what || what === 'check') {
+        const body = await apiJSON(creds, 'GET', up);
+        if (JSON_MODE) return emitJSON(body);
+        info(`${bold('Postgres')} ${body.current}${body.targets.length ? dim(`  can be upgraded to ${body.targets.join(', ')}`) : dim('  (already on the newest version offered)')}`);
+        for (const b of body.blockers ?? []) info(`  ${yellow('blocked')} ${b.message}`);
+        if (body.targets.length && !(body.blockers ?? []).length) muted('Upgrade with `canner db instance upgrade run --yes` (every database on the instance goes offline for a few minutes).');
+        if (body.rollback) info(`  ${dim(`the previous version (Postgres ${body.rollback.to_version}) is kept until ${body.rollback.until}: \`canner db instance upgrade rollback --yes\` goes back, \`... finish --yes\` discards it`)}`);
+        return;
+      }
+      if (what === 'run') {
+        requireYes(args, 'Upgrading restarts every database on the instance on a newer Postgres: they are offline for a few minutes. Roles, grants, policies and extensions carry over and the connection strings do not change. Point-in-time recovery starts a fresh window. If it fails, the instance is left as it was.');
+        const done = await startAndWait(creds, base, args, 'POST', up, { ...(args.pg ? { target: String(args.pg) } : {}), confirm: true }, 'upgrading');
+        if (!done) return;
+        if (JSON_MODE) return emitJSON(done);
+        info(`${green('upgraded')} the instance from Postgres ${done.result?.from_pg_version} to ${done.result?.to_pg_version}`);
+        muted('The previous version is kept for 7 days in case you need to roll back: `canner db instance upgrade rollback --yes`.');
+        return;
+      }
+      if (what === 'rollback') {
+        requireYes(args, 'A rollback goes back to the version before the upgrade and LOSES everything written since. Point-in-time recovery starts a fresh window.');
+        const done = await startAndWait(creds, base, args, 'POST', `${up}/rollback`, { confirm: true }, 'rolling back');
+        if (!done) return;
+        if (JSON_MODE) return emitJSON(done);
+        info(`${green('rolled back')} the instance to Postgres ${done.result?.to_pg_version}`);
+        return;
+      }
+      if (what === 'finish') {
+        requireYes(args, 'This discards the previous version, so a rollback is no longer possible.');
+        const body = await apiJSON(creds, 'POST', `${up}/finish`, { confirm: true });
+        if (JSON_MODE) return emitJSON(body);
+        info(`${green('done')}: the previous version was removed`);
+        return;
+      }
+      die('usage: canner db instance upgrade [check] | run [--pg 18] --yes | rollback --yes | finish --yes', 2);
+    }
+
+    die('usage: canner db instance [show] | create [--pg 17|18] [--pitr] [--window DAYS] | start | stop --yes | upgrade [check|run|rollback|finish] | destroy --yes', 2);
   }
 
   if (sub === 'pitr') {
@@ -2439,7 +2529,7 @@ async function cmdDb(args) {
     return;
   }
 
-  die(`unknown db subcommand "${sub}". Use: list | init | create | info | url | rm | pg-version | export | import | migrate-in | migrate-out | copy | ops | external | rotate | backup-policy | backup | backups | diff | inspect | alerts | roles | offsite | metrics | monitoring | insights | logs | resources | extensions | tuning | restart | replication | subscriptions | instance | pitr | pitr-restore | move.`, 2);
+  die(`unknown db subcommand "${sub}". Use: list | init | create | info | url | rm | pg-version | export | import | migrate-in | migrate-out | copy | ops | external | rotate | backup-policy | backup | backups | diff | inspect | alerts | roles | least-privilege | offsite | metrics | monitoring | insights | logs | resources | extensions | tuning | restart | replication | subscriptions | instance | pitr | pitr-restore | move.`, 2);
 }
 
 function printHelp() {
@@ -2567,6 +2657,10 @@ ${bold('Databases:')}
   ${bold('db')} roles <name> rm <role> --yes
   ${bold('db')} roles <name> write-exclusions <role> <table>
                        Keep one more table SELECT-only for a read-write role, live — no recreation.
+  ${bold('db')} check [<name>] [--category security|performance] [--strict] [--json]
+                       A read-only security and performance check of a database (every plan): policies that allow every
+                       row, functions anyone can run as their owner, views that bypass row-level security, missing primary
+                       keys and indexes, duplicate indexes. --strict fails the run on any warning, for CI.
   ${bold('db')} inject [<name>] [<login> | owner | off | on]
                        Which credential the app receives as DATABASE_URL: the owner's (default) or one of your
                        logins. Takes effect on the next deploy.