@dooer/dooer-test-env 1.0.0

package/readme.md

@@ -0,0 +1,92 @@
+# @dooer/dooer-test-env
+
+One CLI to run the **entire Dooer backend locally** in Docker — every staging service + frontend, wired
+together, backed by a **customer-free copy of the staging database** (reference data + anonymized users, no
+organizations). Copy specific customers in when you need them, spin up empty test accounts, search logs
+across the whole stack, and measure resource usage.
+
+Runs on an Apple-Silicon Mac (images run under emulation) — 32 GB RAM / ~150 GB free disk is comfortable.
+See **[ENVIRONMENT-PLAN.md](./ENVIRONMENT-PLAN.md)** for the full design and rationale.
+
+```bash
+npx @dooer/dooer-test-env <command>
+```
+
+## Quick start
+
+```bash
+# 1. One-time: prereq checks, registry login, compose generation, BankID cert → keychain.
+#    Needs the VPN + kubectl access to dooer-staging.
+npx @dooer/dooer-test-env setup
+
+# 2. Bring the whole stack up (all staging services + frontends)
+npx @dooer/dooer-test-env up
+
+# 3. Load the customer-free base DB (anonymized users + reference data, zero orgs)
+npx @dooer/dooer-test-env db pull --execute
+
+# 4. Status. HQ → http://localhost:8080, GraphQL gateway → http://localhost:4000
+npx @dooer/dooer-test-env status
+```
+
+## Commands
+
+```
+setup                                            prereqs + registry login + compose + BankID cert → keychain
+up [--profile full|booking|hq]                   create + start the stack (default full = everything staging runs)
+stop | start | down [--volumes]                  stop / restart / tear down (optionally wipe the local DB)
+status                                            list services (and which are served from local code)
+db pull --execute                                restore the newest customer-free base DB, then provision roles
+db roles                                          (re)create per-service DB roles + search_path (db pull runs it)
+db snapshot <name> | db rollback <name>          local restore points
+customer new "<name>" --owner <userId> --execute empty functional account: company + Owner + subscriptions + partner dooer
+customer copy | customer purge                    copy / delete one org between environments (emails anonymized)
+shred                                             anonymize the LOCAL db (localhost only)
+bankid pull | status | clear                      BankID cert (staging → keychain), used by service-accounts
+logs <pattern> [--since 5m] [--service x] [-i]    search logs across ALL services (e.g. a transactionId). alias: search
+measure                                           sample docker stats → resource-usage report
+service <start|stop|restart|deploy|local|unlocal|version> <name>   per-service control
+```
+
+Everything that writes is **dry-run by default**; add `--execute`. Run any command with `--help`.
+
+### Examples
+
+```bash
+# an empty test account owned by a user, subscriptions like Ghost Inspector, under partner dooer
+npx @dooer/dooer-test-env customer new "Test Bolag AB" --owner 203b9010-abb9-4f7c-9a5e-8bbf6f75ca7b --execute
+
+# find where a transactionId showed up across the whole stack
+npx @dooer/dooer-test-env logs 1374f61b-5b42-48e6-9b28-ac086b55ea53
+
+# run one service from your checked-out code; peers follow via the discovery router
+npx @dooer/dooer-test-env service local service-ledger
+```
+
+## How it works
+
+- **Compose generator** (`lib/compose/`): translates the s-e032 k8s manifests → a docker-compose spec —
+  images verbatim from the two registries; DB/Redis/Kafka/S3 and secrets repointed at local infra.
+- **Discovery router** (`discovery-router/`): answers the Consul health + session/KV API (single-node leader
+  election), so `@dooer/service` discovery and doode leadership work with no Consul. `service local`/`deploy`
+  repoint entries so peers pick up changes with no restarts.
+- **Auth is self-contained**: the shared local dev keypair is forced on every verifier; service-accounts
+  signs with the matching key; per-service tokens are freshly minted with it (the baked config ones expired).
+- **Per-service DB roles**: `db pull` recreates each service's role + schema `search_path` (mirroring
+  cli-cowboy's setup) so unqualified queries resolve — the base dump carries no cluster-global roles.
+- **BankID**: `setup`/`bankid pull` copy the PFX from the staging secret into the macOS keychain; `up`
+  injects it so local login runs production BankID like staging.
+- **Base DB**: built in-cluster (a k8s Job with its own scratch Postgres) — the 685 GB staging DB never
+  leaves the cluster. It schema-restores, full-copies only non-org reference tables + users, shreds +
+  PII-audits, and uploads the artifact to an OBC bucket; devs only `db pull`. The CronJob + OBC manifests
+  live with the other staging yaml in `new-infrastructure/kubernetes/environments/s-e032-onprem/`.
+
+## Safety
+
+- `shred` from a dev machine is **localhost-only**.
+- `customer copy`/`purge` and `db build` writing to `dooer-production` require `--confirm-production`.
+- Customer emails are always anonymized (`testcustomer+<id>@dooer.com`).
+
+## Prerequisites
+
+Docker (Desktop), `kubectl` with access to the `dooer-staging` namespace (VPN), and Node 18+.