@everystack/cli 0.4.64 → 0.4.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.64",
+  "version": "0.4.65",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -177,7 +177,7 @@
     "jest": "29.7.0",
     "react": "19.2.0",
     "ts-jest": "29.4.9",
-    "@everystack/server": "0.4.25"
+    "@everystack/server": "0.4.26"
   },
   "scripts": {
     "test": "jest",

package/src/cli/commands/db.ts

@@ -501,41 +501,27 @@ async function rotateCredentials(flags: Record<string, string>): Promise<void> {
     process.exit(1);
   }
 
-  // Resolve the direct connection (the rotate command always runs direct — it needs
-  // to query pg_roles and ALTER ROLE, which the ops action doesn't expose).
-  const adminUrl = stageSecrets.ADMIN_DATABASE_URL ?? stageSecrets.AdminDatabaseUrl;
-  if (!adminUrl) {
-    fail('No ADMIN_DATABASE_URL secret found. Run db:provision first to set up the credential split.');
-    process.exit(1);
-  }
-
-  // Step 0: preflight — verify the master credential works (break-glass path).
-  step('Preflight: verifying master connection...');
+  // Step 0: preflight — verify the operator connection works (break-glass path).
+  step('Preflight: verifying operator connection...');
+  const opsFn = opsFunction(config);
   try {
-    const result = await invokeAction(config.region, opsFunction(config), 'db:query', { sql: 'SELECT current_user' });
+    const result = await invokeAction(config.region, opsFn, 'db:query', { sql: 'SELECT current_user' });
     if ((result as any)?.error) throw new Error((result as any).error);
-    success('Master connection verified.');
+    success('Operator connection verified.');
   } catch (err: any) {
-    fail(`Master connection failed: ${err.message}`);
-    info('The master credential is the break-glass. Fix it before rotating.');
+    fail(`Operator connection failed: ${err.message}`);
+    info('Fix the operator connection before rotating.');
     process.exit(1);
   }
 
-  // Connect directly for role management.
-  const { createUrlRunner } = await import('../db-source');
-  const { runner, end } = await createUrlRunner(adminUrl);
-  const deps = {
-    query: async (sql: string) => runner(sql) as Promise<any[]>,
-    execute: async (sql: string) => { await runner(sql); },
+  // All DB operations run through the ops Lambda (inside the VPC).
+  const rotate = async (action: string, payload?: Record<string, unknown>) => {
+    const result = await invokeAction(config.region, opsFn, 'db:rotate', { action, ...payload });
+    if ((result as any)?.error) throw new Error((result as any).error);
+    return result as any;
   };
 
   try {
-    const {
-      detectActiveRole,
-      provisionInactiveRole,
-      retireRole,
-      drainRole,
-    } = await import('@everystack/server/rotate');
 
     // Detect which slots to rotate.
     const slotFlag = flags.slot || 'both';
@@ -552,8 +538,19 @@ async function rotateCredentials(flags: Record<string, string>): Promise<void> {
     }
 
     const { randomBytes } = await import('node:crypto');
-    const conn = parseUrlConnection(adminUrl);
-    const sourceUrl = adminUrl;
+
+    // Resolve host/port/database from the ops Lambda (same as db:provision does).
+    let conn: { host: string; port: string; database: string } | undefined;
+    try {
+      const psqlInfo = await invokeAction(config.region, opsFn, 'db:psql', {});
+      if ((psqlInfo as any)?.host) conn = psqlInfo as any;
+    } catch { /* handled below */ }
+    if (!conn?.host) {
+      fail('Could not resolve database host from the ops Lambda.');
+      process.exit(1);
+    }
+    const sourceUrl = stageSecrets.ADMIN_DATABASE_URL ?? stageSecrets.AdminDatabaseUrl
+      ?? stageSecrets.DATABASE_URL ?? stageSecrets.DatabaseUrl;
 
     // Track the old active role for each slot so retire uses the RIGHT role (F1 fix).
     const oldActiveRoles: Array<{ base: string; oldRole: string }> = [];
@@ -563,23 +560,22 @@ async function rotateCredentials(flags: Record<string, string>): Promise<void> {
     for (const { base, secretKeys } of slots) {
       step(`Rotating ${base}...`);
 
-      const detected = await detectActiveRole(base, deps);
-      if (!detected) {
+      const detected = await rotate('detect', { baseRole: base });
+      if (!detected || (!detected.activeRole && !detected.inactiveRole)) {
         fail(`No rotation pairs found for ${base}. Run db:provision --rotation-pairs first.`);
         process.exit(1);
       }
       info(`  Active: ${detected.activeRole}, inactive: ${detected.inactiveRole}`);
       oldActiveRoles.push({ base, oldRole: detected.activeRole });
-      const active = detected;
 
-      // Provision the inactive role.
+      // Provision the inactive role via the ops Lambda.
       const password = randomBytes(24).toString('hex');
-      await provisionInactiveRole(active, password, deps);
-      success(`  ${active.inactiveRole} provisioned with new password.`);
+      const provisioned = await rotate('provision', { baseRole: base, password });
+      success(`  ${detected.inactiveRole} provisioned with new password.`);
 
       // Build the new URL.
       const newUrl = preserveConnParams(
-        `postgresql://${active.inactiveRole}:${password}@${conn.host}:${conn.port}/${conn.database}`,
+        `postgresql://${detected.inactiveRole}:${password}@${conn.host}:${conn.port}/${conn.database}`,
         sourceUrl,
       );
 
@@ -658,29 +654,19 @@ async function rotateCredentials(flags: Record<string, string>): Promise<void> {
       process.exit(1);
     }
 
-    // Verify origin with a login probe — prove the new credential works
-    // before revoking the old one.
+    // Verify the new credential can log in — prove it works before revoking
+    // the old one. Runs inside the VPC via the ops Lambda.
     step('Verifying new credential...');
-    let verifyPassed = false;
-    try {
-      const { default: pg } = await import('postgres');
-      const newApiUrl = credEnvOverrides.EVERYSTACK_CRED_DatabaseUrl;
-      if (newApiUrl) {
-        const probe = pg(newApiUrl, { max: 1, connect_timeout: 5, ssl: 'prefer' });
-        try {
-          await probe`SELECT 1`;
-          verifyPassed = true;
-          success('New credential connects to the database.');
-        } finally {
-          await probe.end({ timeout: 1 });
-        }
-      } else {
-        verifyPassed = true;
+    const newApiUrl = credEnvOverrides.EVERYSTACK_CRED_DatabaseUrl;
+    if (newApiUrl) {
+      try {
+        await rotate('probe-login', { url: newApiUrl });
+        success('New credential connects to the database.');
+      } catch (err: any) {
+        fail(`New credential login failed: ${err.message}`);
+        info('Both roles keep LOGIN (safe state). Fix and re-run.');
+        process.exit(1);
       }
-    } catch (err: any) {
-      fail(`New credential login failed: ${err.message}`);
-      info('Both roles keep LOGIN (safe state). Fix and re-run.');
-      process.exit(1);
     }
 
     // Origin HTTP check (non-blocking — the login probe is the real gate).
@@ -700,34 +686,48 @@ async function rotateCredentials(flags: Record<string, string>): Promise<void> {
     // re-detection would pick the wrong one via the tiebreak).
     for (const { base, oldRole } of oldActiveRoles) {
       step(`Retiring ${oldRole}...`);
-      await retireRole(oldRole, deps);
+      await rotate('retire', { role: oldRole });
       success(`  ${oldRole} set to NOLOGIN.`);
 
-      // Also retire the base role if it still has LOGIN (F6 fix: a leaked
-      // pre-rotation credential must not survive rotation).
+      // Also retire the base role if it still has LOGIN (F6 fix).
       try {
-        const baseRows = await deps.query(
-          `SELECT rolcanlogin FROM pg_roles WHERE rolname = '${base}'`,
-        );
-        if (baseRows[0]?.rolcanlogin) {
-          await retireRole(base, deps);
-          success(`  ${base} (base role) set to NOLOGIN.`);
+        const baseDetect = await rotate('detect', { baseRole: base });
+        if (baseDetect === null) {
+          // Base role check — query directly via db:query
+          const baseResult = await invokeAction(config.region, opsFn, 'db:query', {
+            sql: `SELECT rolcanlogin FROM pg_roles WHERE rolname = '${base}'`,
+          });
+          const rows = (baseResult as any)?.rows ?? baseResult;
+          if (Array.isArray(rows) && rows[0]?.rolcanlogin) {
+            await rotate('retire', { role: base });
+            success(`  ${base} (base role) set to NOLOGIN.`);
+          }
         }
       } catch { /* best-effort */ }
 
       step(`Draining ${oldRole} sessions (grace: ${graceMs / 1000}s)...`);
-      const { drained, terminated } = await drainRole(oldRole, graceMs, deps);
-      if (drained && terminated === 0) {
-        success(`  ${oldRole} drained cleanly.`);
-      } else if (drained) {
+      const deadline = Date.now() + graceMs;
+      const POLL_MS = 2000;
+      while (Date.now() < deadline) {
+        const { count } = await rotate('count-sessions', { role: oldRole });
+        if (count === 0) { success(`  ${oldRole} drained cleanly.`); break; }
+        await new Promise((r) => setTimeout(r, POLL_MS));
+      }
+      const { count: remaining } = await rotate('count-sessions', { role: oldRole });
+      if (remaining > 0) {
+        const { terminated } = await rotate('terminate-sessions', { role: oldRole });
         success(`  ${oldRole} drained (${terminated} session(s) terminated after grace period).`);
       }
     }
 
     success('Credential rotation complete.');
 
-  } finally {
-    await end?.();
+  } catch (err: any) {
+    if (err && (err as any).code !== 'EEXIT') {
+      fail(`Rotation error: ${err.message}`);
+      process.exit(1);
+    }
+    throw err;
   }
 }