@everystack/cli 0.4.4 → 0.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/commands/db.ts

@@ -144,6 +144,69 @@ export async function dbResetCommand(flags: Record<string, string>): Promise<voi
   }
 }
 
+/** The username in a postgres URL — the only part of a stored secret we ever display. */
+function roleOfUrl(url: string | undefined): string | null {
+  const match = url?.match(/^postgres(?:ql)?:\/\/([^:@/]+)[:@]/);
+  return match ? match[1] : null;
+}
+
+export interface ProvisionSecretPlan {
+  /** Key → URL updates, merged into the store in ONE write. */
+  updates: Record<string, string>;
+  /** Per-secret before → after role notes (roles only — never a credential). */
+  notes: string[];
+  /** Loud warnings: flipping a live secret, an unverified admin login, an old server. */
+  warnings: string[];
+}
+
+/**
+ * Decide what db:provision writes and what it announces. Both spellings of each secret
+ * are written — PascalCase is the only name an `sst.Secret` component can carry (so the
+ * wiring text and the store finally agree), the raw name keeps env-style consumers and
+ * `secrets export` working. Pure, so the announcement contract is pinned by tests.
+ */
+export function buildProvisionSecretPlan(args: {
+  result: { loginRole: string; adminRole?: string; adminVerified?: boolean | null };
+  authUrl: string;
+  adminUrl?: string;
+  existing: Record<string, string>;
+}): ProvisionSecretPlan {
+  const { result, authUrl, adminUrl, existing } = args;
+  const updates: Record<string, string> = {
+    DATABASE_URL: authUrl,
+    DatabaseUrl: authUrl,
+  };
+  const notes: string[] = [];
+  const warnings: string[] = [];
+
+  const prevAuthRole = roleOfUrl(existing.DATABASE_URL ?? existing.DatabaseUrl);
+  notes.push(`DATABASE_URL / DatabaseUrl: ${prevAuthRole ?? 'unset'} → ${result.loginRole}`);
+  if (prevAuthRole && prevAuthRole !== result.loginRole) {
+    warnings.push(
+      `DATABASE_URL was already set (role '${prevAuthRole}') — any function linked to it connects as '${result.loginRole}' after its next cold start. Ensure grants are in place: everystack db:reconcile && everystack db:doctor.`,
+    );
+  }
+
+  if (result.adminRole && adminUrl) {
+    updates.ADMIN_DATABASE_URL = adminUrl;
+    updates.AdminDatabaseUrl = adminUrl;
+    const prevAdminRole = roleOfUrl(existing.AdminDatabaseUrl ?? existing.ADMIN_DATABASE_URL);
+    const verified = result.adminVerified === true ? 'login verified' : 'login NOT verified';
+    notes.push(`AdminDatabaseUrl / ADMIN_DATABASE_URL: ${prevAdminRole ?? 'unset'} → ${result.adminRole} (${verified})`);
+    if (result.adminVerified !== true) {
+      warnings.push(
+        `The '${result.adminRole}' login could not be verified from the ops function — confirm operator connectivity before relying on it: everystack db:doctor.`,
+      );
+    }
+  } else {
+    warnings.push(
+      'No operator login was created — this @everystack/server predates the both-sides split (<0.3.7). Operator tasks stay on the linked Postgres master; upgrade the server pin and re-run db:provision for the full credential split.',
+    );
+  }
+
+  return { updates, notes, warnings };
+}
+
 export async function dbProvisionCommand(flags: Record<string, string>): Promise<void> {
   if (!flags.stage) {
     fail('--stage is required for db:provision (it writes the DATABASE_URL secret for that stage)');
@@ -163,26 +226,32 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   info('Creating the least-privilege role chain on your EXISTING database (no database is created).');
   step('Provisioning roles...');
 
-  // Generate the login password and keep it in memory only — it is written straight into
-  // the secret store and is NEVER printed, logged, or returned to a human.
+  // Generate BOTH login passwords and keep them in memory only — they are written straight
+  // into the secret store and are NEVER printed, logged, or returned to a human.
   const { randomBytes } = await import('node:crypto');
   const authPassword = randomBytes(24).toString('hex');
+  const adminPassword = randomBytes(24).toString('hex');
 
   let result: any;
   try {
-    result = await invokeAction(config.region, opsFunction(config), 'db:provision', { authPassword });
+    result = await invokeAction(config.region, opsFunction(config), 'db:provision', { authPassword, adminPassword });
   } catch (err: any) {
     fail(`db:provision failed: ${err.message}`);
     for (const line of opsAdviceLines(err, [IAM_ADVICE])) info(line);
     process.exit(1);
   }
   if (result?.error) {
+    // Includes the admin-verification refusal: the action set NO authenticator password,
+    // so nothing here rewrites DATABASE_URL — the working credentials are untouched.
     fail(`db:provision failed: ${result.error}`);
     process.exit(1);
   }
   success(`Role chain ready: ${result.loginRole} (LOGIN, NOINHERIT, no BYPASSRLS) → can SET ROLE to ${result.appRoles.join(', ')}`);
+  if (result.adminRole) {
+    success(`Operator login ready: ${result.adminRole} (LOGIN, INHERIT owner) — ${result.adminVerified === true ? 'connectivity verified' : 'connectivity NOT verified'}`);
+  }
 
-  // Resolve host/port/db (not secret) to build the connection string in memory.
+  // Resolve host/port/db (not secret) to build the connection strings in memory.
   let conn: any;
   try {
     conn = await invokeAction(config.region, opsFunction(config), 'db:psql', {});
@@ -194,28 +263,48 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     info('Provide a db:psql connectionInfo callback, or set the DATABASE_URL secret yourself.');
     process.exit(1);
   }
-  const url = `postgresql://${result.loginRole}:${authPassword}@${conn.host}:${conn.port ?? 5432}/${conn.database}`;
-
-  // Write the secret directly to the SST secret store — never display it.
-  step('Writing the DATABASE_URL secret (not displayed)...');
+  const authUrl = `postgresql://${result.loginRole}:${authPassword}@${conn.host}:${conn.port ?? 5432}/${conn.database}`;
+  const adminUrl = result.adminRole
+    ? `postgresql://${result.adminRole}:${adminPassword}@${conn.host}:${conn.port ?? 5432}/${conn.database}`
+    : undefined;
+
+  // Write the secrets directly to the SST secret store — never display them. One blob
+  // write updates every key together, so there is no window where the API side is the
+  // authenticator but the operator side is still unset.
+  step('Writing the database secrets (not displayed)...');
+  let plan: ProvisionSecretPlan;
   try {
     const { loadSstSecrets, putSstSecrets } = await import('../utils/secrets.js');
     const { parseAppName } = await import('../discover.js');
     const ctx = { appName: await parseAppName(), stage: flags.stage, region: config.region };
     const secrets = await loadSstSecrets(ctx);
-    secrets.DATABASE_URL = url;
+    plan = buildProvisionSecretPlan({ result, authUrl, adminUrl, existing: secrets });
+    Object.assign(secrets, plan.updates);
     await putSstSecrets(ctx, secrets);
   } catch (err: any) {
-    fail(`Failed to write the DATABASE_URL secret: ${err.message}`);
+    fail(`Failed to write the database secrets: ${err.message}`);
     info('Ensure your IAM role can write the SST secret store (s3:PutObject, kms:Encrypt).');
     process.exit(1);
   }
 
-  success(`DATABASE_URL secret set for stage "${flags.stage}" → role ${result.loginRole}. No credential was displayed.`);
+  success(`Secrets written for stage "${flags.stage}". No credential was displayed.`);
+  for (const note of plan.notes) info(`  ${note}`);
+  for (const warning of plan.warnings) info(`  ⚠ ${warning}`);
   console.log('');
-  info('Finish the wiring in sst.config.ts (one-time): declare `new sst.Secret("DatabaseUrl")`,');
-  info('link it to the Api function, and remove the raw Postgres component from the Api link');
-  info('(keep it on the ops/worker functions). Then redeploy.');
+  info('Finish the wiring in sst.config.ts (one-time):');
+  info('  API — PRECONDITION: your handler must escalate per request (pgSettings + SET ROLE /');
+  info('        withRole). The authenticator holds no privileges of its own (NOINHERIT); a handler');
+  info('        that never escalates cannot see the schema — every endpoint fails "relation does');
+  info('        not exist". If unsure, do NOT flip the API yet.');
+  info('        Flip in TWO deploys: (1) declare `new sst.Secret("DatabaseUrl")` and link it to the');
+  info('        Api function, KEEPING the raw Postgres component linked (the explicit secret already');
+  info('        outranks it; the component is your instant rollback). Verify with real requests +');
+  info(`        db:doctor. (2) Then remove the raw Postgres component from the Api link (keep it on`);
+  info('        the ops/worker functions) and redeploy.');
+  if (result.adminRole) {
+    info('  Ops:  declare `new sst.Secret("AdminDatabaseUrl", "")` and link it to the Ops function —');
+    info(`        operator tasks then run as ${result.adminRole}, not the Postgres master.`);
+  }
   info(`Verify:  everystack db:doctor --stage ${flags.stage}`);
 }
 

package/src/cli/deploy-probe.ts

@@ -99,6 +99,104 @@ async function probeFunction(region: string, functionName: string): Promise<Prob
   }
 }
 
+/** A minimal APIGW v2 GET event — what a Function URL delivers for a real request. */
+export function syntheticGetEvent(path: string, queryString = ''): {
+  version: string;
+  routeKey: string;
+  rawPath: string;
+  rawQueryString: string;
+  headers: Record<string, string>;
+  requestContext: { http: { method: string; path: string; protocol: string; sourceIp: string; userAgent: string } };
+  isBase64Encoded: boolean;
+} {
+  return {
+    version: '2.0',
+    routeKey: '$default',
+    rawPath: path,
+    rawQueryString: queryString,
+    headers: { 'user-agent': 'everystack-deploy-probe' },
+    requestContext: {
+      http: { method: 'GET', path, protocol: 'HTTP/1.1', sourceIp: '127.0.0.1', userAgent: 'everystack-deploy-probe' },
+    },
+    isBase64Encoded: false,
+  };
+}
+
+/**
+ * Classify one table GET driven through the api function. `_health` proves BOOT; it
+ * touches no tables — a stage whose API role cannot see the schema (a NOINHERIT
+ * authenticator behind a handler that never escalates) boots fine and 500s on every
+ * real request. A consumer shipped exactly that dark site; this is the check that
+ * catches it at deploy time, with the failure named.
+ */
+export interface ReadProbeVerdict {
+  verdict: 'reads-ok' | 'auth-gated' | 'dark-site' | 'failed' | 'no-surface';
+  detail?: string;
+}
+
+export function classifyReadProbe(response: { statusCode?: number; body?: string }): ReadProbeVerdict {
+  const status = response.statusCode ?? 0;
+  if (status >= 200 && status < 300) return { verdict: 'reads-ok' };
+  if (status === 401 || status === 403) return { verdict: 'auth-gated' };
+  if (status === 404) return { verdict: 'no-surface' };
+  const body = response.body ?? '';
+  if (status >= 500 && /relation .* does not exist/i.test(body)) {
+    return {
+      verdict: 'dark-site',
+      detail:
+        'the API role cannot see the schema — the handler never escalates. The authenticator holds no '
+        + 'privileges of its own (NOINHERIT); the handler must SET ROLE per request (pgSettings + withRole). '
+        + `Raw response: ${body}`,
+    };
+  }
+  return { verdict: 'failed', detail: body || `HTTP ${status}` };
+}
+
+/** Invoke the api function with a synthetic HTTP GET; null when the invoke itself failed. */
+async function invokeHttpGet(
+  region: string,
+  functionName: string,
+  path: string,
+  queryString = '',
+): Promise<{ statusCode?: number; body?: string } | null> {
+  try {
+    const { LambdaClient, InvokeCommand } = await import('@aws-sdk/client-lambda');
+    const client = new LambdaClient({ region });
+    const response = await client.send(new InvokeCommand({
+      FunctionName: functionName,
+      Payload: new TextEncoder().encode(JSON.stringify(syntheticGetEvent(path, queryString))),
+    }));
+    if (response.FunctionError || !response.Payload) return null;
+    const parsed = JSON.parse(new TextDecoder().decode(response.Payload));
+    if (parsed && typeof parsed === 'object' && 'statusCode' in parsed) {
+      return { statusCode: parsed.statusCode, body: parsed.body };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Drive one real table read through the api function: GET / (the public table listing)
+ * names an exposed table, GET /<table>?limit=1 exercises role → schema → RLS. Best-effort:
+ * anything unprobeable stays neutral — only a positively classified failure is fatal.
+ */
+async function probeApiRead(region: string, functionName: string): Promise<ReadProbeVerdict | null> {
+  const listing = await invokeHttpGet(region, functionName, '/');
+  if (!listing || listing.statusCode !== 200 || !listing.body) return null;
+  let tables: string[];
+  try {
+    tables = (JSON.parse(listing.body) as { tables?: string[] }).tables ?? [];
+  } catch {
+    return null;
+  }
+  if (tables.length === 0) return null;
+  const read = await invokeHttpGet(region, functionName, `/${tables[0]}`, 'limit=1');
+  if (!read) return null;
+  return classifyReadProbe(read);
+}
+
 /**
  * Probe the stage's deployed functions and report. Returns whether deploy must fail: a function
  * that cannot boot (or answers unhealthy) is fatal; a probe that couldn't run is a warning.
@@ -137,6 +235,27 @@ export async function probeDeployedFunctions(
         info(`Could not probe ${target.label} function (${target.functionName}): ${result.detail}`);
         break;
     }
+
+    // Boot is necessary, not sufficient: drive one table read through the api function so a
+    // schema-invisible role (the dark-site shape) fails HERE, named, not on the first user.
+    if (target.label === 'api' && (result.verdict === 'healthy' || result.verdict === 'boot-ok')) {
+      const read = await probeApiRead(config.region, target.functionName);
+      if (read === null) {
+        // Nothing conclusive to probe (listing empty/unreadable) — stay neutral.
+      } else if (read.verdict === 'reads-ok') {
+        success('api read path OK (table read through the handler)');
+      } else if (read.verdict === 'auth-gated') {
+        info('api read path is auth-gated — boot verified, deeper read needs credentials');
+      } else if (read.verdict === 'no-surface') {
+        info('api exposes no tables to probe — skipped the read check');
+      } else if (read.verdict === 'dark-site') {
+        fatal = true;
+        fail(`api function is DARK: ${read.detail}`);
+      } else {
+        fatal = true;
+        fail(`api read probe failed: ${read.detail}`);
+      }
+    }
   }
   return { fatal };
 }