@geekmidas/cli 10.0.0-alpha.121 → 10.0.0-alpha.123

package/dist/{dns-agf2VCdV.mjs → dns-DFvO5a53.mjs}

@@ -1,13 +1,15 @@
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { dt as checkStageBackups, ft as SERVER_IPV4_KEY, mt as cnameTarget, pt as SERVER_IPV6_KEY } from "./workspace-D1QbNd55.mjs";
-import { D as DnsRecordsUnreadable, Kn as postgresImage, O as createDnsProvider, d as extractSubdomain, f as findRootDomain, kn as localRolePassword, ln as quoteIdentifier, p as normalizeDnsConfig, pn as postgresRoleSlug } from "./seeds-Cwtv-U9-.mjs";
+import { dt as checkStageBackups, ft as SERVER_IPV4_KEY, mt as cnameTarget, pt as SERVER_IPV6_KEY } from "./workspace-DUnnVjqC.mjs";
+import { An as localRolePassword, O as DnsRecordsUnreadable, f as extractSubdomain, k as createDnsProvider, m as normalizeDnsConfig, mn as postgresRoleSlug, p as findRootDomain, qn as postgresImage, un as quoteIdentifier } from "./seeds-Dv78P9LS.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import { isIPv4, isIPv6 } from "node:net";
-import { createHash } from "node:crypto";
-import { DEFAULT_POSTGRES_VERSION, kebabCase } from "@geekmidas/manifest";
+import { createHash, randomBytes } from "node:crypto";
+import { DEFAULT_POSTGRES_VERSION, environmentCase, kebabCase } from "@geekmidas/manifest";
 import { fileURLToPath } from "node:url";
+import bcrypt from "bcryptjs";
 import { lookup } from "node:dns/promises";
 //#region src/providers/dns.ts
 /** Whether the workspace deploys through the compose target. */
@@ -319,6 +321,153 @@ function backupsRoleStatements(backups) {
 	];
 }
 //#endregion
+//#region src/compose/sitePassword.ts
+/**
+* A deployed stage's sites behind a password — `deploy.sitePassword` — so a
+* staging build is not public while it is being tried.
+*
+* The edge asks for it with HTTP basic auth, before a request reaches the
+* site: the browser prompts, and nothing of the site loads until the stage's
+* login is given. The user is the stage's name; the password is generated
+* once per site and kept in the stage's secrets, where one set by hand wins.
+* Only its bcrypt hash reaches the edge's config.
+*
+* Pure.
+*/
+/** `deploy.sitePassword` names something that is not one of the stage's sites. */
+var UnknownPasswordSite = class extends GkmError {
+	stage;
+	site;
+	sites;
+	constructor(stage, site, sites) {
+		super(`deploy.sitePassword.${stage} names '${site}', which is not a site of this workspace. ${sites.length > 0 ? `Its sites: ${sites.map((s) => `'${s}'`).join(", ")}.` : "It declares no site."} Name one of them, or set ${stage}: true for every site.`);
+		this.stage = stage;
+		this.site = site;
+		this.sites = sites;
+		this.name = "UnknownPasswordSite";
+	}
+};
+/** A site the stage puts behind a password, with none in the stage's secrets. */
+var SitePasswordMissing = class extends GkmError {
+	stage;
+	key;
+	constructor(stage, key) {
+		super(`deploy.sitePassword puts a site of '${stage}' behind a password, and the stage has no ${key} in its secrets. Run gkm compose --stage ${stage} once to generate it, or set one: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.key = key;
+		this.name = "SitePasswordMissing";
+	}
+};
+/**
+* `deploy.sitePassword` names a stage that deploys through a target that
+* cannot ask for a login. Refused rather than ignored: ignored, the stage
+* would be public while its config says it is not.
+*/
+var SitePasswordNeedsCompose = class extends GkmError {
+	stage;
+	target;
+	constructor(stage, target) {
+		super(`deploy.sitePassword puts '${stage}' behind a password, and it deploys through '${target}', which cannot ask for one yet — only compose does. Remove ${stage} from deploy.sitePassword, or deploy it with compose.`);
+		this.stage = stage;
+		this.target = target;
+		this.name = "SitePasswordNeedsCompose";
+	}
+};
+/**
+* @throws {SitePasswordNeedsCompose} where `stage` asks for a site password
+* and `target` is not compose
+*/
+function assertSitePasswordTarget(workspace, stage, target) {
+	if (workspace.deploy?.sitePassword?.[stage] && target !== "compose") throw new SitePasswordNeedsCompose(stage, target);
+}
+/** The stage secret a site's password is kept in: `WEB_SITE_PASSWORD`. */
+function sitePasswordKey(site) {
+	return `${environmentCase(site)}_SITE_PASSWORD`;
+}
+/** Every site the manifest declares, by app name. */
+function siteNames(manifest) {
+	return Object.values(manifest).filter((declaration) => declaration.kind === "site").map((declaration) => appKey(declaration.id));
+}
+/**
+* The sites `deploy.sitePassword` puts behind a password on `stage`, by app
+* name: every one for `true`, the ones it names otherwise.
+*
+* @throws {UnknownPasswordSite} for a name that is not one of `sites`
+*/
+function passwordSites(workspace, stage, sites) {
+	const choice = workspace.deploy?.sitePassword?.[stage];
+	if (!choice) return [];
+	if (choice === true) return [...sites];
+	const chosen = /* @__PURE__ */ new Set();
+	for (const name of choice) {
+		const site = appKey(name);
+		if (!sites.includes(site)) throw new UnknownPasswordSite(stage, name, sites);
+		chosen.add(site);
+	}
+	return [...chosen];
+}
+/** A password: 192 random bits, URL-safe, so it is typed or pasted as is. */
+function generateSitePassword() {
+	return randomBytes(24).toString("base64url");
+}
+/**
+* The stage's secrets with a generated password for each site, where it has
+* none. Pure, like `withGeneratedSecrets`: the caller keeps the result once
+* the run goes ahead.
+*/
+function withSitePasswords(secrets, sites) {
+	const missing = sites.map(sitePasswordKey).filter((key) => !secrets.custom?.[key]);
+	if (missing.length === 0) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				...Object.fromEntries(missing.map((key) => [key, generateSitePassword()]))
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: missing
+	};
+}
+/**
+* The login a site is served behind on `stage`.
+*
+* The hash's salt is derived from the password, so the same password always
+* renders the same edge config: a deploy that changed nothing rewrites
+* nothing, and the proxy is not reloaded for it. A per-hash random salt
+* guards against a precomputed table of common passwords; a generated one is
+* 192 random bits, which no table holds.
+*
+* @throws {SitePasswordMissing} where the stage's secrets hold none
+*/
+function siteAuth(stage, site, custom) {
+	const key = sitePasswordKey(site);
+	const password = custom[key];
+	if (!password) throw new SitePasswordMissing(stage, key);
+	return {
+		user: stage,
+		password,
+		hash: bcrypt.hashSync(password, saltFor(password)),
+		key
+	};
+}
+/** bcrypt's own base-64 alphabet, in which a salt is written. */
+const BCRYPT_ALPHABET = "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+/**
+* A bcrypt salt — `$2a$`, which Caddy and Traefik both read, at cost 10 —
+* derived from the password.
+*/
+function saltFor(password) {
+	const digest = createHash("sha256").update(password).digest();
+	let salt = "";
+	for (let i = 0; i < 22; i++) salt += BCRYPT_ALPHABET[digest[i] % 64];
+	return `$2a$10$${salt}`;
+}
+//#endregion
 //#region src/compose/dns.ts
 /**
 * A compose stage's DNS: the records its public hosts need, and the check that
@@ -341,10 +490,17 @@ function backupsRoleStatements(backups) {
 *   resolver. One that is not the server stops the deploy with
 *   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
 *   for a certificate it cannot get — and use up the rate limit trying.
-* - **The step** (`stageDns`): all three, as every deploy runs them — the plan applied through each provider,
-*   what was written read back from the provider, and only the hosts no
-*   provider wrote resolved publicly. A brand-new name is never looked up
-*   before its record exists, so no resolver caches it as missing.
+* - **What gkm wrote before** (`diffRecordedDns`, pure): the plan against the
+*   records the stage's state says gkm wrote — added, kept, and stale: a
+*   host the stage no longer serves, after a domain or an app changed.
+* - **The prune** (`pruneStackDns`): each stale record deleted through its
+*   domain's provider, if it still holds the value gkm wrote. One someone
+*   pointed elsewhere is left alone; one no provider can delete is printed.
+* - **The step** (`stageDns`): all of it, as every deploy runs it — the plan applied through each provider,
+*   what was written read back from the provider, the stale records pruned,
+*   and only the hosts no provider wrote resolved publicly. A brand-new name
+*   is never looked up before its record exists, so no resolver caches it as
+*   missing.
 */
 /** The line that says how to set the server's address. */
 function serverAddressHint(stage) {
@@ -536,12 +692,23 @@ function printManual(plan, log, why) {
 /** The existing records of every planned name, for the types gkm manages. */
 async function existingRecords(provider, plan) {
 	const names = [...new Set(plan.records.map((r) => r.name))];
-	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
+	return readRecords(provider, plan.domain, names.flatMap((name) => MANAGED.map((type) => ({
 		name,
 		type
-	})));
-	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
-	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
+	}))));
+}
+/** Exactly these names and types, as the provider holds them. */
+async function readRecords(provider, domain, wanted) {
+	if (provider.readRecords) return provider.readRecords(domain, wanted);
+	return (await provider.getRecords(domain)).filter((r) => wanted.some((w) => w.name === r.name && w.type === r.type));
+}
+/** The provider for a domain's config: `providerFor`, or the real one. */
+function providerResolver(options) {
+	return options.providerFor ?? ((config) => createDnsProvider({
+		config,
+		...options.credentials ? { godaddy: options.credentials } : {},
+		...options.hostinger ? { hostinger: options.hostinger } : {}
+	}));
 }
 const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
 /**
@@ -631,11 +798,7 @@ function printChange(change, dryRun, log) {
 async function settleStackDns(plan, options = {}) {
 	const dryRun = options.dryRun === true;
 	const log = options.log ?? ((line) => console.log(line));
-	const providerFor = options.providerFor ?? ((config) => createDnsProvider({
-		config,
-		...options.credentials ? { godaddy: options.credentials } : {},
-		...options.hostinger ? { hostinger: options.hostinger } : {}
-	}));
+	const providerFor = providerResolver(options);
 	const changes = [];
 	const confirmed = /* @__PURE__ */ new Set();
 	const unconfirmed = /* @__PURE__ */ new Set();
@@ -725,6 +888,110 @@ async function settleStackDns(plan, options = {}) {
 		unconfirmed: [...unconfirmed].filter((h) => !confirmed.has(h)).sort()
 	};
 }
+/** `api.example.com A` — a record's identity, whatever its value. */
+const recordKey = (fqdn, type) => `${fqdn.trim().replace(/\.$/, "").toLowerCase()} ${type.toUpperCase()}`;
+/**
+* The plan against the records gkm wrote for the stage — pure. A record is
+* its full name and its type: one the plan has at another value is kept (the
+* apply updates it), and one whose name or type the plan no longer has is
+* stale — a host the stage stopped serving when its domain or an app changed,
+* or an AAAA once its server has no IPv6 address.
+*/
+function diffRecordedDns(plan, recorded) {
+	const planned = plan.domains.flatMap((domain) => domain.records);
+	const wanted = new Set(planned.map((r) => recordKey(r.host, r.type)));
+	const written = new Set(recorded.map((r) => recordKey(r.fqdn, r.type)));
+	return {
+		added: planned.filter((r) => !written.has(recordKey(r.host, r.type))),
+		kept: planned.filter((r) => written.has(recordKey(r.host, r.type))),
+		stale: recorded.filter((r) => !wanted.has(recordKey(r.fqdn, r.type)))
+	};
+}
+/**
+* Each stale record deleted through its domain's provider — only where the
+* provider still holds exactly the value gkm wrote, so a name someone has
+* since pointed elsewhere is never taken from them. Where no provider can
+* read and delete it — a `manual` domain, one gone from `dns`, a key that
+* can only write — it is printed for a person to remove. A dry run reads
+* and prints, and deletes nothing.
+*/
+async function pruneStackDns(stale, options) {
+	if (stale.length === 0) return [];
+	const dryRun = options.dryRun === true;
+	const log = options.log ?? ((line) => console.log(line));
+	const providerFor = providerResolver(options);
+	const dns = options.dns ? normalizeDnsConfig(options.dns) : {};
+	const byDomain = /* @__PURE__ */ new Map();
+	for (const record of stale) byDomain.set(record.domain, [...byDomain.get(record.domain) ?? [], record]);
+	log(`   No longer served by '${options.stage}':`);
+	const pruned = [];
+	const byHand = (domain, records, why) => {
+		log(`   ${domain}: ${why} — remove these records at its DNS host:`);
+		for (const record of records) {
+			log(`     ${record.fqdn.padEnd(32)} ${record.type.padEnd(5)} ${record.value}`);
+			pruned.push({
+				record,
+				action: "manual"
+			});
+		}
+	};
+	for (const [domain, records] of byDomain) {
+		const config = dns[domain];
+		if (!config) {
+			byHand(domain, records, "no longer in dns");
+			continue;
+		}
+		const provider = providerName(config) === "manual" ? null : await providerFor(config);
+		if (!provider) {
+			byHand(domain, records, "manual");
+			continue;
+		}
+		let existing;
+		try {
+			existing = await readRecords(provider, domain, records.map((r) => ({
+				name: r.name,
+				type: r.type
+			})));
+		} catch (error) {
+			if (!(error instanceof DnsRecordsUnreadable)) throw error;
+			byHand(domain, records, `the ${provider.name} key cannot read its records, so none is deleted unchecked`);
+			continue;
+		}
+		const would = dryRun ? "would " : "";
+		const deletes = [];
+		for (const record of records) {
+			const host = record.fqdn.padEnd(32);
+			const type = record.type.padEnd(5);
+			const found = existing.find((r) => r.name === record.name && r.type === record.type)?.values ?? [];
+			if (found.length === 0) {
+				log(`   · ${host} ${type} already gone`);
+				pruned.push({
+					record,
+					action: "gone"
+				});
+			} else if (found.length === 1 && same(found[0], record.value)) {
+				log(`   - ${host} ${type} ${record.value} — ${would}delete`);
+				deletes.push({
+					record,
+					action: "delete"
+				});
+			} else {
+				log(`   ⚠ ${host} ${type} ${found.join(", ")} — pointed elsewhere since gkm wrote ${record.value}; left as it is`);
+				pruned.push({
+					record,
+					action: "changed",
+					found
+				});
+			}
+		}
+		if (!dryRun && deletes.length > 0) await provider.deleteRecords(domain, deletes.map(({ record }) => ({
+			name: record.name,
+			type: record.type
+		})));
+		pruned.push(...deletes);
+	}
+	return pruned;
+}
 /** The system resolver: what the server's own clients would be told. */
 const systemLookup = async (host) => {
 	return (await lookup(host, { all: true })).map((a) => a.address);
@@ -867,8 +1134,9 @@ async function dnsCredentials(stage, domains, credentials) {
 /**
 * A stage's DNS, as every deploy runs it: the
 * stage's own hosts planned, written through each domain's provider where
-* they differ, and read back from it. Only A, AAAA and CNAME records of
-* those names are touched; nothing is a wildcard, and no other name is read,
+* they differ, and read back from it — and each record gkm wrote for a host
+* the stage no longer serves found, for `prune` to delete. Only A, AAAA and CNAME records of those
+* names are touched; nothing is a wildcard, and no other name is read,
 * written or deleted. What no provider confirms — a `manual` domain, a host
 * under no domain in `dns`, a key that cannot read — is resolved publicly.
 * A dry run prints the plan and writes nothing.
@@ -886,16 +1154,17 @@ async function stageDns(input) {
 		server,
 		dns: input.dns
 	});
-	const tokens = await dnsCredentials(stage, plan.domains.map(({ domain, config }) => ({
+	const recorded = diffRecordedDns(plan, input.recorded ?? []);
+	const dns = input.dns ? normalizeDnsConfig(input.dns) : {};
+	const staleDomains = [...new Set(recorded.stale.map((r) => r.domain))].filter((domain) => dns[domain] && !plan.domains.some((d) => d.domain === domain)).map((domain) => ({
+		domain,
+		config: dns[domain]
+	}));
+	const tokens = await dnsCredentials(stage, [...plan.domains.map(({ domain, config }) => ({
 		domain,
 		config
-	})), input.credentials);
-	const applied = !input.dns ? {
-		changes: [],
-		confirmed: [],
-		unconfirmed: [...plan.uncovered]
-	} : await settleStackDns(plan, {
-		...input.dryRun ? { dryRun: true } : { confirm: true },
+	})), ...staleDomains], input.credentials);
+	const providers = {
 		log,
 		credentials: {
 			...input.godaddy ?? {},
@@ -904,6 +1173,22 @@ async function stageDns(input) {
 		},
 		...tokens.hostinger ? { hostinger: tokens.hostinger } : {},
 		...input.providerFor ? { providerFor: input.providerFor } : {}
+	};
+	const applied = !input.dns ? {
+		changes: [],
+		confirmed: [],
+		unconfirmed: [...plan.uncovered]
+	} : await settleStackDns(plan, {
+		...input.dryRun ? { dryRun: true } : { confirm: true },
+		...providers
+	});
+	const deleted = new Set(applied.changes.filter((c) => c.action === "delete").map((c) => recordKey(fullName(c.domain, c.name), c.type)));
+	const stale = recorded.stale.filter((r) => !deleted.has(recordKey(r.fqdn, r.type)));
+	const prune = () => pruneStackDns(stale, {
+		stage,
+		dns: input.dns,
+		...input.dryRun ? { dryRun: true } : {},
+		...providers
 	});
 	let resolved = [];
 	if (applied.unconfirmed.length > 0) resolved = await checkStackDns({
@@ -917,10 +1202,12 @@ async function stageDns(input) {
 		plan,
 		changes: applied.changes,
 		confirmed: applied.confirmed,
-		resolved
+		resolved,
+		recorded,
+		prune
 	};
 }
 //#endregion
-export { deploysWithCompose as S, backupExpiries as _, serverAddressHint as a, runTime as b, stageDnsDomains as c, BACKUPS_URL_KEY as d, RUNNER_PATH as f, backupDatabases as g, stackBackups as h, requiredServerAddress as i, systemLookup as l, backupsService as m, dnsCredentials as n, stackHosts as o, backupsRoleStatements as p, isLocalHost as r, stageDns as s, HostNotPointingAtServer as t, BACKUPS_SERVICE as u, backupFile as v, stageBackups as x, backupsPrefix as y };
+export { backupFile as C, deploysWithCompose as D, stageBackups as E, backupExpiries as S, runTime as T, RUNNER_PATH as _, serverAddressHint as a, stackBackups as b, stageDnsDomains as c, passwordSites as d, siteAuth as f, BACKUPS_URL_KEY as g, BACKUPS_SERVICE as h, requiredServerAddress as i, systemLookup as l, withSitePasswords as m, dnsCredentials as n, stackHosts as o, siteNames as p, isLocalHost as r, stageDns as s, HostNotPointingAtServer as t, assertSitePasswordTarget as u, backupsRoleStatements as v, backupsPrefix as w, backupDatabases as x, backupsService as y };
 
-//# sourceMappingURL=dns-agf2VCdV.mjs.map
+//# sourceMappingURL=dns-DFvO5a53.mjs.map