@dooer/dooer-test-env 1.0.0

package/lib/compose/generate.js

@@ -0,0 +1,375 @@
+// Generate a docker-compose spec that runs the whole Dooer backend locally,
+// wired together, from the s-e032 (staging) k8s manifests.
+//
+// Design notes live in ./README.md. In short: images are taken VERBATIM from the
+// manifests (two registries, each service pulls from the right one); every
+// cluster-specific env var (DB host, Consul, Redis, Kafka, S3, secrets) is
+// overridden to point at the local infra containers this file also defines.
+
+const fs = require('fs')
+const path = require('path')
+const yaml = require('js-yaml')
+const { listServices, listFrontends } = require('./manifests')
+const { AUTH_PUBLIC_KEY_B64, AUTH_PRIVATE_KEY_B64 } = require('../auth-dev-keys')
+const { mint } = require('../service-token')
+
+// PEM of the local dev private key, decoded once, to sign fresh per-service tokens (see below).
+const AUTH_PRIVATE_KEY_PEM = Buffer.from(AUTH_PRIVATE_KEY_B64, 'base64').toString('utf8')
+
+// The narrower `booking` profile — the minimum set to drive a booking end to end.
+const BOOKING_PROFILE_SERVICES = [
+  'service-graphql',
+  'service-core-objects',
+  'service-accounts',
+  'service-authorization',
+  'service-ledger',
+  'service-task-engine',
+  'service-file-storage',
+  'service-ai-agents',
+  'service-booking-engine',
+  'service-report-generator',
+]
+
+// Dev credentials for the local stack. Throwaway — this env never holds real
+// customer data or real secrets.
+const DEV = {
+  sqlUser: 'dooer',
+  sqlPassword: 'dooer',
+  minioUser: 'minioadmin',
+  minioPassword: 'minioadmin',
+}
+
+// Applied to EVERY dooer service, last, so they win over the manifest values.
+// These repoint the service at the local infra containers.
+const GLOBAL_OVERRIDES = {
+  // Database → local postgres container, static-password mode.
+  DOOER_SQL_HOST: 'postgres',
+  DOOER_SQL_PORT: '5432',
+  DOOER_SQL_DATABASE: 'dooer',
+  // NOTE: we do NOT override DOOER_SQL_APPLICATION_USER — each service keeps its OWN manifest user (e.g.
+  // "service-notifications"). @dooer/database stores a service's schema as a ROLE-LEVEL default search_path
+  // (ALTER USER <appUser> SET search_path TO <schema>,public — see lib/db/roles.js), so collapsing every
+  // service onto one shared user breaks every UNqualified query (background/doode tasks) with 42P01. The
+  // matching roles are created locally by `db roles` (run automatically after `db pull`). Only the password
+  // is forced to the shared dev secret; a service with no manifest user falls back to `dooer` (below).
+  DOOER_SQL_APPLICATION_PASSWORD: DEV.sqlPassword,
+  DOOER_SQL_MIGRATION_USER: DEV.sqlUser, // migrations run as the dooer superuser; db-migrate sets the schema itself
+  DOOER_SQL_MIGRATION_PASSWORD: DEV.sqlPassword,
+  DOOER_IS_ONEPLATFORMER: 'false',
+  // clear the RDS CA baked into the image, and disable node TLS verification: @dooer/database always
+  // connects with SSL and verifies against a baked CA, which rejects the local postgres self-signed cert
+  // (DEPTH_ZERO_SELF_SIGNED_CERT). Safe locally — everything is on the loopback compose network.
+  DOOER_SQL_SSL_CA: '',
+  NODE_TLS_REJECT_UNAUTHORIZED: '0',
+  // Discovery → the local mutable router (speaks the Consul health API).
+  CONSUL_HTTP_ADDR: 'discovery-router:8500',
+  DOOER_CONSUL_HOST: 'discovery-router',
+  // Redis → a plain single-node container (no sentinel, no auth locally).
+  DOOER_HOST_REDIS: 'redis:6379',
+  DOOER_REDIS_USE_TLS: 'false',
+  // Kafka / event-stream → the local single-node broker.
+  DOOER_KAFKA_BOOTSTRAP_BROKER: 'kafka:9092',
+  DOOER_STREAM_NAME: 'local-s01',
+  // S3 → local MinIO.
+  AWS_ENDPOINT_URL_S3: 'http://minio:9000',
+  // Boot / identity.
+  // NOTE: never set DOOER_MICROSERVICE_PORT — no staging manifest sets it, so every image defaults to 3000
+  // on its own. service-ai (python) reads it as a raw string and does `bind(('', port))`, which throws
+  // "an integer is required (got type str)" the moment we inject it. Let the images default.
+  NODE_ENV: 'development',
+  DOOER_ENVIRONMENT_NAME: 'local',
+  DOOER_LOG_LEVEL: 'informational',
+  // Auth: force the shared @dooer LOCAL dev PUBLIC key on every verifier. The manifests carry the STAGING
+  // public key as a plain value (which would win over config's `local` default), but the only signer —
+  // service-accounts — signs with the LOCAL private key, so verifiers must trust the matching LOCAL public
+  // key or every authenticated call 401s "invalid signature". service-accounts gets the matching private key
+  // via SERVICE_ENV_OVERRIDES. (authIssuer is https://example.com/ everywhere already.)
+  DOOER_AUTH_PUBLIC_KEY: AUTH_PUBLIC_KEY_B64,
+}
+
+// Manifest env vars that are meaningless (or actively wrong) locally and are
+// removed rather than overridden.
+const DROP_ENV_KEYS = [
+  'DOOER_REDIS_SENTINEL_MASTER', // no sentinel with a plain redis container
+]
+
+// Per-service env we add on top of the manifest. Values written as compose ${VAR} interpolation are filled
+// in at `up` time from the child env (never stored in the yaml).
+const SERVICE_ENV_OVERRIDES = {
+  // BankID: `dooer-test-env bankid pull` copies the staging PFX/passphrase into the keychain and `up`
+  // injects them here. Absent → the vars resolve empty and service-accounts falls back to the bankid
+  // library's built-in TEST cert (appapi2.test.bankid.com). Present → `up` also sets IS_PRODUCTION=true, so
+  // local login uses PRODUCTION BankID exactly like staging (@dooer/config env override beats the
+  // per-environment `local:false`). See lib/bankid.js.
+  'service-accounts': {
+    // service-accounts is the only token SIGNER — give it the LOCAL dev private key matching the public key
+    // forced on every verifier (GLOBAL_OVERRIDES.DOOER_AUTH_PUBLIC_KEY). Non-secret dev material.
+    SECRET_DOOER_AUTH_PRIVATE_KEY: AUTH_PRIVATE_KEY_B64,
+    // NB: the ${...} strings below are docker-compose interpolation refs, not JS template literals.
+    /* eslint-disable no-template-curly-in-string */
+    SECRET_DOOER_BANK_ID_PFX: '${SECRET_DOOER_BANK_ID_PFX:-}',
+    SECRET_DOOER_BANK_ID_PFX_PASSPHRASE: '${SECRET_DOOER_BANK_ID_PFX_PASSPHRASE:-}',
+    SECRET_DOOER_BANK_ID_CA_CERTIFICATE: '${SECRET_DOOER_BANK_ID_CA_CERTIFICATE:-}',
+    DOOER_BANK_ID_IS_PRODUCTION: '${DOOER_BANK_ID_IS_PRODUCTION:-false}',
+    /* eslint-enable no-template-curly-in-string */
+  },
+}
+
+// Marker: this secret-backed env var must NOT be emitted at all (see below).
+const OMIT = Symbol('omit-env')
+
+// Dev value for a secret-backed (valueFrom) env var.
+//
+// Anything we can't map to a local infra credential is OMITTED entirely rather than emitted as an empty
+// string. This matters: many services read a secret through @dooer/config, which supplies its OWN local
+// default when the env var is UNSET (e.g. service-notifications' twilioAuthToken defaults to "notset"), but
+// an empty-string env var COUNTS as set and CLOBBERS that default — so injecting `SECRET_...=""` turns a
+// harmless "notset" into `new Twilio(sid, "")` → "password is required" at boot. Omitting lets the image's
+// own default stand (Jimmy's rule 2026-09-01: a required var with no default gets a value; a var WITH a
+// default is left alone). A dev who needs a real value exports it and we pass it through (`${NAME:-}` only
+// when the host actually has it — handled in buildServiceEnv).
+function secretDefault(name) {
+  if (name === 'DOOER_SQL_APPLICATION_PASSWORD') return DEV.sqlPassword
+  if (name === 'DOOER_SQL_MIGRATION_PASSWORD') return DEV.sqlPassword
+  if (name === 'SECRET_DOOER_REDIS_PASSWORD') return '' // local redis has no auth; empty is the correct value
+  if (/ACCESS_KEY_ID$/.test(name)) return DEV.minioUser
+  if (/SECRET_ACCESS_KEY$/.test(name)) return DEV.minioPassword
+  return OMIT
+}
+
+// Build the final env map for one dooer service.
+function buildServiceEnv(svc) {
+  const env = {}
+  // 1. plain manifest values (verbatim).
+  Object.assign(env, svc.env)
+  // 2. secret-backed vars → dev substitutions (or OMIT to leave the image's own default in place).
+  svc.secretEnv.forEach((name) => {
+    const v = secretDefault(name)
+    if (v === OMIT) return
+    env[name] = v
+  })
+  // 3. global local overrides win.
+  Object.assign(env, GLOBAL_OVERRIDES)
+  // 3b. stateless services (service-graphql, service-pdf, …) declare no application user; keep the shared
+  // dooer superuser for them so they still connect. Services WITH a manifest user keep it (see GLOBAL_OVERRIDES).
+  if (!env.DOOER_SQL_APPLICATION_USER) env.DOOER_SQL_APPLICATION_USER = DEV.sqlUser
+  // 3c. services that use a service token get a FRESH one signed with the local dev key (the baked config
+  // default expired in 2019). service_id = the service's own name, so authz that keys on the caller works.
+  if (svc.secretEnv && svc.secretEnv.includes('SECRET_DOOER_SERVICE_TOKEN')) {
+    env.SECRET_DOOER_SERVICE_TOKEN = mint({
+      serviceId: env.DOOER_SERVICE_NAME || svc.name,
+      privateKeyPem: AUTH_PRIVATE_KEY_PEM,
+    })
+  }
+  // 4. drop the cluster-only leftovers.
+  DROP_ENV_KEYS.forEach((key) => {
+    delete env[key]
+  })
+  return env
+}
+
+// Which profiles a dooer service belongs to. Everything is in `full` (the
+// default set the CLI's `up` activates); the booking subset is additionally in
+// `booking`. See README for why bare `docker compose up` is not the "all" path.
+function profilesFor(name) {
+  // the `hq` profile = the booking backend core (which service-graphql + HQ need) so HQ is functional
+  // without starting all ~85 images. frontend-hq adds itself to `hq` in buildCompose.
+  return BOOKING_PROFILE_SERVICES.includes(name) ? ['full', 'booking', 'hq'] : ['full']
+}
+
+// The infra containers every profile needs (no `profiles:` → always started).
+function infraServices() {
+  return {
+    postgres: {
+      // built from ../local-postgres — postgres:14 + a baked self-signed cert, started with ssl=on, because
+      // @dooer/database always connects with SSL (a plain postgres image → "server does not support SSL").
+      build: path.resolve(__dirname, '..', '..', 'local-postgres'),
+      command: [
+        'postgres',
+        '-c',
+        'ssl=on',
+        '-c',
+        'ssl_cert_file=/etc/postgresql/server.crt',
+        '-c',
+        'ssl_key_file=/etc/postgresql/server.key',
+      ],
+      environment: {
+        POSTGRES_DB: 'dooer',
+        POSTGRES_USER: DEV.sqlUser,
+        POSTGRES_PASSWORD: DEV.sqlPassword,
+      },
+      // publish on 55432 to avoid a dev's local (brew) postgres squatting host 5432. Services still reach
+      // it as `postgres:5432` on the compose network; only host-side tools (db pull/shred) use 55432.
+      ports: ['55432:5432'],
+      volumes: ['postgres_data:/var/lib/postgresql/data'],
+      healthcheck: {
+        test: ['CMD-SHELL', `pg_isready -U ${DEV.sqlUser} -d dooer`],
+        interval: '5s',
+        timeout: '5s',
+        retries: 20,
+      },
+      restart: 'unless-stopped',
+    },
+    redis: {
+      image: 'redis:7-alpine',
+      ports: ['6379:6379'],
+      restart: 'unless-stopped',
+    },
+    // Single-node Redpanda: Kafka-API compatible, no ZooKeeper needed — much
+    // lighter than a Strimzi/Kafka + ZK pair on a laptop. Advertises as
+    // `kafka:9092` so services reach it under the overridden bootstrap broker.
+    kafka: {
+      image: 'docker.redpanda.com/redpandadata/redpanda:v24.1.7',
+      platform: 'linux/amd64',
+      command: [
+        'redpanda',
+        'start',
+        '--overprovisioned',
+        '--smp',
+        '1',
+        '--memory',
+        '1G',
+        '--reserve-memory',
+        '0M',
+        '--node-id',
+        '0',
+        '--check=false',
+        '--kafka-addr',
+        'PLAINTEXT://0.0.0.0:9092',
+        '--advertise-kafka-addr',
+        'PLAINTEXT://kafka:9092',
+      ],
+      ports: ['9092:9092'],
+      volumes: ['kafka_data:/var/lib/redpanda/data'],
+      restart: 'unless-stopped',
+    },
+    minio: {
+      image: 'minio/minio:latest',
+      platform: 'linux/amd64',
+      command: ['server', '/data', '--console-address', ':9001'],
+      environment: {
+        MINIO_ROOT_USER: DEV.minioUser,
+        MINIO_ROOT_PASSWORD: DEV.minioPassword,
+      },
+      ports: ['9000:9000', '9001:9001'],
+      volumes: ['minio_data:/data'],
+      restart: 'unless-stopped',
+    },
+    // Mutable name→endpoint registry that speaks the Consul health API. Build context is an ABSOLUTE
+    // path to the repo's discovery-router, so it resolves no matter where the compose file is written
+    // (it lives in ~/.dooer-test-env, not the repo).
+    'discovery-router': {
+      build: path.resolve(__dirname, '..', '..', 'discovery-router'),
+      ports: ['8500:8500'],
+      restart: 'unless-stopped',
+    },
+  }
+}
+
+// Host ports published so the BROWSER (and dev) can reach things on localhost.
+const GATEWAY_HOST_PORT = 4000 // service-graphql (the public GraphQL facade the frontends' browsers call)
+const HQ_HOST_PORT = 8080 // frontend-hq
+
+// host port for a frontend: HQ is pinned to 8080; the rest get 8081+ in sorted order.
+function frontendPort(name, index) {
+  return name === 'frontend-hq' ? HQ_HOST_PORT : 8081 + index
+}
+
+// Turn the parsed manifests into the compose object.
+function buildCompose(services, frontends, { profile } = {}) {
+  const wantedSvc = profile ? services.filter((s) => profilesFor(s.name).includes(profile)) : services
+
+  const composeServices = infraServices()
+  wantedSvc.forEach((svc) => {
+    composeServices[svc.name] = {
+      image: svc.image, // VERBATIM — registry preserved.
+      platform: 'linux/amd64', // cluster images are amd64-only; run under emulation on arm64 (Apple Silicon)
+      // Use each service's OWN manifest command (most are the OnePlatformer ./CMD-OPF.sh entrypoint —
+      // no Consul/Vault, runs db-migrate then starts; a few differ, e.g. service-ai=python, service-pdf=node).
+      // Fall back to ./CMD-OPF.sh when a manifest sets none, so we never hit the image default ./CMD.sh
+      // (Consul path) which hangs on consul-template.
+      command: svc.command || ['./CMD-OPF.sh'],
+      environment: { ...buildServiceEnv(svc), ...(SERVICE_ENV_OVERRIDES[svc.name] || {}) },
+      // publish the GraphQL gateway on the host so the frontends' browsers can reach it at localhost
+      ...(svc.name === 'service-graphql' ? { ports: [`${GATEWAY_HOST_PORT}:3000`] } : {}),
+      depends_on: ['postgres', 'redis', 'discovery-router'],
+      profiles: profilesFor(svc.name),
+      restart: 'unless-stopped',
+    }
+  })
+
+  // frontends: served (SSR/static) on :3000, published to a host port. The BROWSER loads them from
+  // localhost and calls the GraphQL facade — repointed to the local gateway. Cross-frontend base URLs are
+  // repointed to each frontend's own localhost port where we run it (others stay as-is).
+  ;(frontends || []).forEach((fe, i) => {
+    const hostPort = frontendPort(fe.name, i)
+    const env = buildServiceEnv(fe)
+    env.DOOER_PUBLIC_FACADE_HOST = `http://localhost:${GATEWAY_HOST_PORT}`
+    // dooer-frontend's config validation rejects an EMPTY sentryEndpoint for the `local` environment
+    // ("No value specified for [sentryEndpoint] ... (ENV: 'DOOER_SENTRY_ENDPOINT')"), even though staging
+    // ships it as "". We don't use Sentry (Jimmy 2026-09-01) — inject a well-formed but inert DSN so the
+    // client SDK initialises and any error POST just fails silently against the loopback host.
+    env.DOOER_SENTRY_ENDPOINT = 'https://local@localhost/0'
+    if (env.DOOER_PUBLIC_FRONTEND_BASE_URL) env.DOOER_PUBLIC_FRONTEND_BASE_URL = `http://localhost:${hostPort}`
+    composeServices[fe.name] = {
+      image: fe.image,
+      platform: 'linux/amd64',
+      ...(fe.command ? { command: fe.command } : {}),
+      environment: env,
+      ports: [`${hostPort}:3000`],
+      depends_on: ['discovery-router'],
+      profiles: ['full', 'frontend', ...(fe.name === 'frontend-hq' ? ['hq'] : [])],
+      restart: 'unless-stopped',
+    }
+  })
+
+  return {
+    // no top-level `version:` — obsolete in Compose v2 and it prints a warning on every command
+    volumes: {
+      postgres_data: {},
+      minio_data: {},
+      kafka_data: {},
+    },
+    services: composeServices,
+  }
+}
+
+// Public entry point. Reads every `service-*.yaml` + `frontend-*.yaml` in `servicesDir`, builds the
+// compose object, writes it as YAML to `out`, and returns a small summary.
+function generateCompose({ profile, servicesDir, out } = {}) {
+  const services = listServices(servicesDir)
+  const frontends = listFrontends(servicesDir)
+  const compose = buildCompose(services, frontends, { profile })
+
+  const yamlText = yaml.safeDump(compose, {
+    lineWidth: -1, // never wrap (long base64 public keys must stay one line)
+    noRefs: true,
+    sortKeys: false,
+  })
+
+  if (out) {
+    fs.mkdirSync(path.dirname(out), { recursive: true })
+    fs.writeFileSync(out, yamlText, 'utf8')
+  }
+
+  const dooerServiceCount = Object.keys(compose.services).length - Object.keys(infraServices()).length
+  return {
+    compose,
+    yaml: yamlText,
+    out: out || null,
+    dooerServiceCount,
+    infraServiceCount: Object.keys(infraServices()).length,
+    bookingProfileServices: BOOKING_PROFILE_SERVICES,
+  }
+}
+
+module.exports = {
+  BOOKING_PROFILE_SERVICES,
+  GLOBAL_OVERRIDES,
+  secretDefault,
+  buildServiceEnv,
+  profilesFor,
+  infraServices,
+  buildCompose,
+  generateCompose,
+}

package/lib/compose/manifests.js

@@ -0,0 +1,108 @@
+// Read the staging k8s Deployment manifests and expose the bits the compose
+// generator needs. Pure/deterministic: given a directory of `service-*.yaml`
+// files it returns a stable, sorted list of { name, image, env, secretEnv, port }.
+//
+// A `service-*.yaml` file is a multi-document manifest (Deployment + Service, and
+// sometimes an ObjectBucketClaim / CronJob / RBAC). We only care about the
+// Deployment's single application container.
+
+const fs = require('fs')
+const path = require('path')
+const yaml = require('js-yaml')
+
+// Where the s-e032 (staging) manifests live by default. Callers should pass an
+// explicit `servicesDir`; this is only the fallback for `imageFor(name)`.
+const DEFAULT_SERVICES_DIR = path.resolve(
+  process.env.HOME || '',
+  'dooer/new-infrastructure/kubernetes/environments/s-e032-onprem'
+)
+
+const SERVICE_FILE_RE = /^service-.*\.yaml$/
+const FRONTEND_FILE_RE = /^frontend-.*\.yaml$/
+
+// Pull the application container out of a Deployment doc. Containers are named
+// `node` across the fleet; fall back to the first container defensively.
+function applicationContainer(deployment) {
+  const podSpec = deployment && deployment.spec && deployment.spec.template && deployment.spec.template.spec
+  const containers = (podSpec && podSpec.containers) || []
+  return containers.find((c) => c && c.name === 'node') || containers[0] || null
+}
+
+// Parse one `service-*.yaml`. Returns null for files that carry no Deployment
+// (e.g. the e2e-nightly and token CronJobs) — they are not runnable services.
+function parseManifestFile(filePath) {
+  const raw = fs.readFileSync(filePath, 'utf8')
+  const docs = yaml.safeLoadAll(raw).filter(Boolean)
+  const deployment = docs.find((doc) => doc && doc.kind === 'Deployment')
+  if (!deployment) return null
+
+  const container = applicationContainer(deployment)
+  if (!container || !container.image) return null
+
+  const name = (deployment.metadata && deployment.metadata.name) || path.basename(filePath, '.yaml')
+
+  // Split the env block into plain values (reproduced verbatim) and
+  // secret-backed vars (valueFrom → the generator substitutes dev values).
+  const env = {}
+  const secretEnv = []
+  const envEntries = container.env || []
+  envEntries.forEach((entry) => {
+    if (!entry || !entry.name) return
+    if (Object.prototype.hasOwnProperty.call(entry, 'value')) {
+      env[entry.name] = entry.value === null ? '' : String(entry.value)
+    } else if (entry.valueFrom) {
+      secretEnv.push(entry.name)
+    }
+  })
+
+  const ports = container.ports || []
+  const port = (ports[0] && Number(ports[0].containerPort)) || 3000
+
+  return { name, image: container.image, env, secretEnv, port, command: container.command || null }
+}
+
+// List every dooer service defined by a `service-*.yaml` Deployment in `dir`,
+// sorted by filename for deterministic output.
+function listServices(servicesDir) {
+  const dir = servicesDir || DEFAULT_SERVICES_DIR
+  return fs
+    .readdirSync(dir)
+    .filter((f) => SERVICE_FILE_RE.test(f))
+    .sort()
+    .map((f) => parseManifestFile(path.join(dir, f)))
+    .filter(Boolean)
+}
+
+// List every frontend defined by a `frontend-*.yaml` Deployment in `dir`.
+function listFrontends(servicesDir) {
+  const dir = servicesDir || DEFAULT_SERVICES_DIR
+  return fs
+    .readdirSync(dir)
+    .filter((f) => FRONTEND_FILE_RE.test(f))
+    .sort()
+    .map((f) => parseManifestFile(path.join(dir, f)))
+    .filter(Boolean)
+}
+
+// Return the verbatim image ref for one service name (registry preserved — there
+// are two registries in the fleet). Reads the single matching file when present,
+// otherwise scans the directory.
+function imageFor(name, servicesDir) {
+  const dir = servicesDir || DEFAULT_SERVICES_DIR
+  const direct = path.join(dir, `${name}.yaml`)
+  if (fs.existsSync(direct)) {
+    const parsed = parseManifestFile(direct)
+    if (parsed) return parsed.image
+  }
+  const match = listServices(dir).find((s) => s.name === name)
+  return match ? match.image : null
+}
+
+module.exports = {
+  DEFAULT_SERVICES_DIR,
+  SERVICE_FILE_RE,
+  parseManifestFile,
+  listServices,
+  listFrontends,
+  imageFor,
+}

package/lib/db/roles.js

@@ -0,0 +1,118 @@
+// Per-service Postgres roles + schema grants for the local env — a faithful copy of how the fleet is
+// provisioned on staging (cli-cowboy's lib/service-db/setup-db-schema.js).
+//
+// Why this is needed: @dooer/database stores a service's schema as a ROLE-LEVEL default search_path
+//   ALTER USER <applicationUser> SET search_path TO <schema>,"public"
+// (schema = DOOER_SERVICE_NAME with dashes→underscores). Staging runs the setup per service so each app
+// user carries that default and the right per-schema GRANTs. The base dump we restore locally is a single
+// database dump; roles are cluster-global and are NOT in it. If every service shares the throwaway `dooer`
+// superuser (search_path `dooer,public`), unqualified queries (background/doode tasks, raw postgres-lib
+// pools) fail with 42P01. So we recreate the fleet's role model here.
+//
+// The model (from cli-cowboy): a NOLOGIN group role `<schema>_access` owns the privileges; a shared
+// `read-only` group gets SELECT; the service's LOGIN user gets the schema as its default search_path and
+// membership in `<schema>_access`. We deliberately mirror this rather than granting SUPERUSER, so the local
+// env exercises the same privilege boundaries as staging.
+
+const { Client } = require('pg')
+const { listServices, DEFAULT_SERVICES_DIR } = require('../compose/manifests')
+
+const pgFriendly = (serviceName) => serviceName.replace(/-/g, '_')
+const ident = (name) => `"${String(name).replace(/"/g, '""')}"`
+const literal = (val) => `'${String(val).replace(/'/g, "''")}'`
+
+// Derive [{ user, schema }] from the manifests: every service that declares an application user. Stateless
+// services (service-graphql, service-pdf, …) declare none and keep the shared dooer user.
+function roleSpecs(servicesDir) {
+  const seen = new Map()
+  listServices(servicesDir || DEFAULT_SERVICES_DIR).forEach((svc) => {
+    const user = svc.env.DOOER_SQL_APPLICATION_USER
+    if (!user || user === 'dooer') return
+    seen.set(user, pgFriendly(svc.env.DOOER_SERVICE_NAME || svc.name))
+  })
+  return [...seen].map(([user, schema]) => ({ user, schema }))
+}
+
+// The schema + group-role setup, byte-for-byte the shape cli-cowboy applies (idempotent). Creates the
+// schema (+_history), the `<schema>_access` and `read-only` group roles, and all the USAGE/DML/sequence
+// grants + default privileges. Runs as the connecting superuser (dooer), which also owns the migrated
+// tables, so the ALTER DEFAULT PRIVILEGES cover future dooer-run migrations too.
+function schemaSetupSql(schema) {
+  return `
+    BEGIN TRANSACTION;
+    CREATE SCHEMA IF NOT EXISTS ${ident(schema)};
+    CREATE SCHEMA IF NOT EXISTS ${ident(`${schema}_history`)};
+    DO $body$ BEGIN
+      IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = ${literal(`${schema}_access`)}) THEN
+        CREATE ROLE ${ident(`${schema}_access`)};
+      END IF;
+      IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'read-only') THEN
+        CREATE ROLE "read-only";
+      END IF;
+    END $body$;
+    GRANT USAGE ON SCHEMA ${ident(schema)} TO "read-only";
+    GRANT USAGE ON SCHEMA ${ident(`${schema}_history`)} TO "read-only";
+    ALTER DEFAULT PRIVILEGES IN SCHEMA ${ident(schema)} GRANT SELECT ON TABLES TO "read-only";
+    ALTER DEFAULT PRIVILEGES IN SCHEMA ${ident(`${schema}_history`)} GRANT SELECT ON TABLES TO "read-only";
+    GRANT SELECT ON ALL TABLES IN SCHEMA ${ident(schema)} TO "read-only";
+    GRANT SELECT ON ALL TABLES IN SCHEMA ${ident(`${schema}_history`)} TO "read-only";
+    GRANT USAGE ON SCHEMA ${ident(schema)} TO ${ident(`${schema}_access`)};
+    GRANT USAGE ON SCHEMA ${ident(`${schema}_history`)} TO ${ident(`${schema}_access`)};
+    ALTER DEFAULT PRIVILEGES IN SCHEMA ${ident(schema)} GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${ident(
+    `${schema}_access`
+  )};
+    ALTER DEFAULT PRIVILEGES IN SCHEMA ${ident(
+      `${schema}_history`
+    )} GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${ident(`${schema}_access`)};
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA ${ident(schema)} TO ${ident(`${schema}_access`)};
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA ${ident(`${schema}_history`)} TO ${ident(
+    `${schema}_access`
+  )};
+    ALTER DEFAULT PRIVILEGES IN SCHEMA ${ident(schema)} GRANT USAGE, SELECT ON SEQUENCES TO ${ident(
+    `${schema}_access`
+  )};
+    GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${ident(schema)} TO ${ident(`${schema}_access`)};
+    COMMIT TRANSACTION;
+  `
+}
+
+// The LOGIN user, mirroring cli-cowboy's Vault creation_statements — but with a static name/password (the
+// local env runs @dooer/database with isOneplatformer=false, i.e. plain user+password, not IAM tokens).
+function loginUserSql(user, schema, password) {
+  return `
+    DO $body$ BEGIN
+      IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = ${literal(user)}) THEN
+        CREATE ROLE ${ident(user)} WITH LOGIN PASSWORD ${literal(password)};
+      END IF;
+    END $body$;
+    ALTER ROLE ${ident(user)} WITH LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE PASSWORD ${literal(password)};
+    ALTER USER ${ident(user)} SET "search_path" TO ${ident(schema)},"public";
+    GRANT ${ident(`${schema}_access`)} TO ${ident(user)};
+  `
+}
+
+// Create/repair every service's schema grants + login role on a connected client. Idempotent.
+async function applyRoles(client, specs, { password = 'dooer' } = {}) {
+  const applied = []
+  for (const { user, schema } of specs) {
+    await client.query(schemaSetupSql(schema))
+    await client.query(loginUserSql(user, schema, password))
+    applied.push(user)
+  }
+  return { applied }
+}
+
+// Connect to the local Postgres and apply all derived roles. Used by `db pull` (post-restore) and `db roles`.
+async function ensureRoles({ local, servicesDir, password } = {}) {
+  const specs = roleSpecs(servicesDir)
+  const client = new Client({ ...local, ssl: local.ssl === false ? undefined : { rejectUnauthorized: false } })
+  await client.connect()
+  try {
+    const res = await applyRoles(client, specs, { password: password || local.password || 'dooer' })
+    return { total: specs.length, ...res }
+  } finally {
+    await client.end()
+  }
+}
+
+module.exports = { pgFriendly, roleSpecs, schemaSetupSql, loginUserSql, applyRoles, ensureRoles }

package/lib/discovery/client.js

@@ -0,0 +1,40 @@
+// Thin client for the local discovery-router admin API (see discovery-router/). The CLI uses this to
+// repoint a service name as it starts / stops / goes local / switches version. Uses global fetch
+// (Node 18+). `routerUrl` is the router base, e.g. 'http://localhost:8500'.
+/* global fetch */
+
+function base(routerUrl) {
+  return String(routerUrl).replace(/\/+$/, '')
+}
+
+async function asJson(response, action) {
+  if (!response.ok) {
+    const text = await response.text().catch(() => '')
+    throw new Error(`discovery-router ${action} failed: ${response.status} ${response.statusText} ${text}`.trim())
+  }
+  return response.json()
+}
+
+// Set an override so peers resolve `name` to { address, port }.
+async function setTarget(routerUrl, name, { address, port }) {
+  const response = await fetch(`${base(routerUrl)}/registry/${encodeURIComponent(name)}`, {
+    method: 'PUT',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ address, port }),
+  })
+  return asJson(response, `setTarget(${name})`)
+}
+
+// Remove an override, reverting `name` to the router's default template.
+async function clearTarget(routerUrl, name) {
+  const response = await fetch(`${base(routerUrl)}/registry/${encodeURIComponent(name)}`, { method: 'DELETE' })
+  return asJson(response, `clearTarget(${name})`)
+}
+
+// List the current registry: { overrides, effective, defaults }.
+async function list(routerUrl) {
+  const response = await fetch(`${base(routerUrl)}/registry`)
+  return asJson(response, 'list')
+}
+
+module.exports = { setTarget, clearTarget, list }