@geekmidas/cli 10.0.0-alpha.122 → 10.0.0-alpha.124

package/dist/{dns-CfEZHt7r.cjs → snsSubscriptions-CSkteK2J.cjs}

@@ -1,6 +1,9 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_workspace = require("./workspace-BwqQnool.cjs");
-const require_seeds = require("./seeds-CFG-f24B.cjs");
+const require_credentials = require("./credentials-D7XJypNd.cjs");
+const require_workspace = require("./workspace-C82GLPnf.cjs");
+const require_seeds = require("./seeds-DOfxmDRO.cjs");
+const require_derive = require("./derive-DAbo49sm.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_net = require("node:net");
@@ -8,6 +11,8 @@ let node_crypto = require("node:crypto");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_module = require("node:module");
 let node_url = require("node:url");
+let bcryptjs = require("bcryptjs");
+bcryptjs = require_rolldown_runtime.__toESM(bcryptjs, 1);
 let node_dns_promises = require("node:dns/promises");
 //#region src/providers/dns.ts
 /** Whether the workspace deploys through the compose target. */
@@ -319,6 +324,226 @@ function backupsRoleStatements(backups) {
 	];
 }
 //#endregion
+//#region src/compose/sitePassword.ts
+/**
+* A deployed stage's sites behind a password — `deploy.sitePassword` — so a
+* staging build is not public while it is being tried.
+*
+* The edge asks for it with HTTP basic auth, before a request reaches the
+* site: the browser prompts, and nothing of the site loads until the stage's
+* login is given. The user is the stage's name; the password is generated
+* once per site and kept in the stage's secrets, where one set by hand wins.
+* Only its bcrypt hash reaches the edge's config.
+*
+* Pure.
+*/
+/** `deploy.sitePassword` names something that is not one of the stage's sites. */
+var UnknownPasswordSite = class extends require_errors.GkmError {
+	stage;
+	site;
+	sites;
+	constructor(stage, site, sites) {
+		super(`deploy.sitePassword.${stage} names '${site}', which is not a site of this workspace. ${sites.length > 0 ? `Its sites: ${sites.map((s) => `'${s}'`).join(", ")}.` : "It declares no site."} Name one of them, or set ${stage}: true for every site.`);
+		this.stage = stage;
+		this.site = site;
+		this.sites = sites;
+		this.name = "UnknownPasswordSite";
+	}
+};
+/** A site the stage puts behind a password, with none in the stage's secrets. */
+var SitePasswordMissing = class extends require_errors.GkmError {
+	stage;
+	key;
+	constructor(stage, key) {
+		super(`deploy.sitePassword puts a site of '${stage}' behind a password, and the stage has no ${key} in its secrets. Run gkm compose --stage ${stage} once to generate it, or set one: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.key = key;
+		this.name = "SitePasswordMissing";
+	}
+};
+/**
+* `deploy.sitePassword` names a stage that deploys through a target that
+* cannot ask for a login. Refused rather than ignored: ignored, the stage
+* would be public while its config says it is not.
+*/
+var SitePasswordNeedsCompose = class extends require_errors.GkmError {
+	stage;
+	target;
+	constructor(stage, target) {
+		super(`deploy.sitePassword puts '${stage}' behind a password, and it deploys through '${target}', which cannot ask for one yet — only compose does. Remove ${stage} from deploy.sitePassword, or deploy it with compose.`);
+		this.stage = stage;
+		this.target = target;
+		this.name = "SitePasswordNeedsCompose";
+	}
+};
+/**
+* @throws {SitePasswordNeedsCompose} where `stage` asks for a site password
+* and `target` is not compose
+*/
+function assertSitePasswordTarget(workspace, stage, target) {
+	if (workspace.deploy?.sitePassword?.[stage] && target !== "compose") throw new SitePasswordNeedsCompose(stage, target);
+}
+/** The stage secret a site's password is kept in: `WEB_SITE_PASSWORD`. */
+function sitePasswordKey(site) {
+	return `${(0, _geekmidas_manifest.environmentCase)(site)}_SITE_PASSWORD`;
+}
+/** Every site the manifest declares, by app name. */
+function siteNames(manifest) {
+	return Object.values(manifest).filter((declaration) => declaration.kind === "site").map((declaration) => require_derive.appKey(declaration.id));
+}
+/**
+* The sites `deploy.sitePassword` puts behind a password on `stage`, by app
+* name: every one for `true`, the ones it names otherwise.
+*
+* @throws {UnknownPasswordSite} for a name that is not one of `sites`
+*/
+function passwordSites(workspace, stage, sites) {
+	const choice = workspace.deploy?.sitePassword?.[stage];
+	if (!choice) return [];
+	if (choice === true) return [...sites];
+	const chosen = /* @__PURE__ */ new Set();
+	for (const name of choice) {
+		const site = require_derive.appKey(name);
+		if (!sites.includes(site)) throw new UnknownPasswordSite(stage, name, sites);
+		chosen.add(site);
+	}
+	return [...chosen];
+}
+/** A password: 192 random bits, URL-safe, so it is typed or pasted as is. */
+function generateSitePassword() {
+	return (0, node_crypto.randomBytes)(24).toString("base64url");
+}
+/**
+* The stage's secrets with a generated password for each site, where it has
+* none. Pure, like `withGeneratedSecrets`: the caller keeps the result once
+* the run goes ahead.
+*/
+function withSitePasswords(secrets, sites) {
+	const missing = sites.map(sitePasswordKey).filter((key) => !secrets.custom?.[key]);
+	if (missing.length === 0) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				...Object.fromEntries(missing.map((key) => [key, generateSitePassword()]))
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: missing
+	};
+}
+/**
+* The login a site is served behind on `stage`.
+*
+* The hash's salt is derived from the password, so the same password always
+* renders the same edge config: a deploy that changed nothing rewrites
+* nothing, and the proxy is not reloaded for it. A per-hash random salt
+* guards against a precomputed table of common passwords; a generated one is
+* 192 random bits, which no table holds.
+*
+* @throws {SitePasswordMissing} where the stage's secrets hold none
+*/
+function siteAuth(stage, site, custom) {
+	const key = sitePasswordKey(site);
+	const password = custom[key];
+	if (!password) throw new SitePasswordMissing(stage, key);
+	return {
+		user: stage,
+		password,
+		hash: bcryptjs.default.hashSync(password, saltFor(password)),
+		key
+	};
+}
+/** bcrypt's own base-64 alphabet, in which a salt is written. */
+const BCRYPT_ALPHABET = "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+/**
+* A bcrypt salt — `$2a$`, which Caddy and Traefik both read, at cost 10 —
+* derived from the password.
+*/
+function saltFor(password) {
+	const digest = (0, node_crypto.createHash)("sha256").update(password).digest();
+	let salt = "";
+	for (let i = 0; i < 22; i++) salt += BCRYPT_ALPHABET[digest[i] % 64];
+	return `$2a$10$${salt}`;
+}
+//#endregion
+//#region src/providers/aws.ts
+/**
+* The AWS account a provider provisions in — the stage's, found the way the
+* SSM and Secrets Manager stores find it.
+*
+* 1. `--profile`, resolved on its own: exported keys left over from another
+*    account never win over a profile someone named.
+* 2. `AWS_PROFILE`, else `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` — the
+*    deploy's own `aws` credential kind (`storedCredentials`).
+* 3. The SDK's default chain: `~/.aws` default profile, SSO, a role. In CI,
+*    whatever `aws-actions/configure-aws-credentials` exported.
+*
+* None of them: the provider has no provisioning credentials, and the stage
+* is treated as `external`.
+*/
+async function awsProvisioningCredentials(lookup) {
+	const region = lookup.env.AWS_REGION ?? lookup.env.AWS_DEFAULT_REGION;
+	const where = region ? { region } : {};
+	if (lookup.profile) return {
+		profile: lookup.profile,
+		...where
+	};
+	const stored = await require_credentials.storedCredentials({
+		env: lookup.env,
+		...lookup.home ? { home: lookup.home } : {}
+	}).get({
+		kind: "aws",
+		stage: lookup.stage
+	});
+	if (stored) return stored;
+	try {
+		const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
+		await fromNodeProviderChain({
+			timeout: 1e3,
+			maxRetries: 0
+		})();
+		return {
+			chain: true,
+			...where
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* An S3-compatible endpoint the environment points the SDK at — the AWS
+* emulator in tests. The SDK reads it itself; it is read here too, because
+* an emulator takes path-style requests, and a key written for one has to
+* say where it is.
+*/
+function awsEndpoint(env, service) {
+	return env[`AWS_ENDPOINT_URL_${service}`] ?? env.AWS_ENDPOINT_URL;
+}
+/** An SDK client's config for a provisioning credential. */
+async function awsClientConfig(credential, region) {
+	if ("profile" in credential) {
+		const { fromIni } = await import("@aws-sdk/credential-providers");
+		return {
+			region,
+			credentials: fromIni({ profile: credential.profile })
+		};
+	}
+	if ("accessKeyId" in credential) return {
+		region,
+		credentials: {
+			accessKeyId: credential.accessKeyId,
+			secretAccessKey: credential.secretAccessKey,
+			...credential.sessionToken ? { sessionToken: credential.sessionToken } : {}
+		}
+	};
+	return { region };
+}
+//#endregion
 //#region src/compose/dns.ts
 /**
 * A compose stage's DNS: the records its public hosts need, and the check that
@@ -1059,6 +1284,208 @@ async function stageDns(input) {
 	};
 }
 //#endregion
+//#region src/deploy/snsSubscriptions.ts
+/** The type every recorded subscription has in the stage's state. */
+const SUBSCRIPTION_TYPE = "sns-subscription";
+/** The state key a subscriber's SNS subscription is recorded under. */
+const subscriptionKey = (worker, name) => `${SUBSCRIPTION_TYPE}:${worker}/${name}`;
+/** What a recorded subscription is written to the stage's state as. */
+function subscriptionResource(subscription, arn) {
+	const { name, ...data } = subscription;
+	return {
+		key: subscriptionKey(subscription.worker, name),
+		type: SUBSCRIPTION_TYPE,
+		id: arn,
+		status: "ready",
+		data: {
+			...data,
+			...data.events ? { events: [...data.events] } : {}
+		}
+	};
+}
+/** The subscription a record holds, as an endpoint to reconcile. */
+function specOf(record) {
+	const events = record.data?.events;
+	return {
+		name: record.key.split("/").pop(),
+		endpoint: String(record.data?.endpoint),
+		...record.data?.deadLetterQueueArn ? { deadLetterQueueArn: String(record.data.deadLetterQueueArn) } : {},
+		...Array.isArray(events) ? { events: events.map(String) } : {}
+	};
+}
+/**
+* The subscriptions the deploy recorded, by worker and export — what each
+* worker is handed as `GKM_SNS_SUBSCRIPTIONS`.
+*/
+function recordedPushSubscriptions(resources) {
+	const byWorker = {};
+	for (const record of Object.values(resources ?? {})) {
+		if (record.type !== "sns-subscription" || !record.id) continue;
+		const [worker, name] = record.key.slice(`${SUBSCRIPTION_TYPE}:`.length).split("/");
+		if (!worker || !name) continue;
+		byWorker[worker] = {
+			...byWorker[worker],
+			[name]: record.id
+		};
+	}
+	return byWorker;
+}
+/** A topic connection string the deploy cannot sign with. */
+var TopicSubscriptionUnsigned = class extends require_errors.GkmError {
+	connectionKey;
+	constructor(connectionKey) {
+		super(`'${connectionKey}' carries no keys, and the deploy found no AWS credentials of its own to subscribe the worker's routes with. Put accessKeyId and secretAccessKey in it — keys allowed sns:Subscribe, sns:ListSubscriptionsByTopic, sns:GetSubscriptionAttributes, sns:SetSubscriptionAttributes and sns:Unsubscribe on the topic — or sign in with \`gkm login\`.`);
+		this.connectionKey = connectionKey;
+		this.name = "TopicSubscriptionUnsigned";
+	}
+};
+/**
+* A connection to the topic a stage's connection string names, signed with
+* its own keys — or, carrying none, the deploy's.
+*
+* The emulator the environment points the SDK at stands in for SNS, as it
+* does for every provider: a string with no `endpoint` is SNS itself.
+*
+* @throws {TopicSubscriptionUnsigned} with no keys from either
+*/
+async function topicConnection(input) {
+	const { SNSConnection, snsUrl } = await import("@geekmidas/events/sns");
+	const { topicArn, region, endpoint } = snsUrl.parse(input.connectionString);
+	const params = new URL(input.connectionString).searchParams;
+	const accessKeyId = params.get("accessKeyId");
+	const secretAccessKey = params.get("secretAccessKey");
+	const where = region ?? topicArn.split(":")[3];
+	let credentials;
+	if (accessKeyId && secretAccessKey) {
+		const sessionToken = params.get("sessionToken");
+		credentials = {
+			accessKeyId,
+			secretAccessKey,
+			...sessionToken ? { sessionToken } : {}
+		};
+	} else {
+		const provisioning = await awsProvisioningCredentials({
+			stage: input.stage,
+			env: input.env,
+			...input.home ? { home: input.home } : {}
+		});
+		if (!provisioning) throw new TopicSubscriptionUnsigned(input.connectionKey);
+		credentials = (await awsClientConfig(provisioning, where ?? "us-east-1")).credentials;
+	}
+	const override = endpoint ?? awsEndpoint(input.env, "SNS");
+	return new SNSConnection({
+		topicArn,
+		...where ? { region: where } : {},
+		...override ? { endpoint: override } : {},
+		...credentials ? { credentials } : {}
+	});
+}
+/** A subscription still waiting to be confirmed once its worker is up. */
+var PushSubscriptionsUnconfirmed = class extends require_errors.GkmError {
+	endpoints;
+	constructor(endpoints) {
+		super(`SNS still waits for ${endpoints.join(", ")} to confirm ${endpoints.length === 1 ? "its subscription" : "their subscriptions"}, so nothing is pushed there yet. Check the worker's logs for the confirmation it refused, and that its host answers from the internet; the next deploy sends the confirmation again.`);
+		this.endpoints = endpoints;
+		this.name = "PushSubscriptionsUnconfirmed";
+	}
+};
+/**
+* Once the workers are up: every subscription recorded as pending is
+* subscribed again — SNS resends its confirmation to a worker now there to
+* answer it — and waited on until confirmed.
+*
+* The first deploy needs it: the subscription is made before the worker
+* starts, so SNS's first confirmation finds nobody.
+*
+* A bucket's subscriptions are reached with the deploy's provisioning
+* credentials; a hand-set topic's with the connection string they were made
+* with, read from the stage's secrets.
+*
+* @returns what is still pending when the wait ran out — none, normally.
+*/
+async function confirmPendingSubscriptions(input) {
+	const env = input.env ?? process.env;
+	const records = Object.values(input.resources ?? {}).filter((r) => r.type === "sns-subscription" && r.id);
+	if (!records.some((r) => r.data?.pending === true)) return [];
+	const { SNSConnection, reconcileHttpSubscriptions } = await import("@geekmidas/events/sns");
+	const { GetSubscriptionAttributesCommand } = await import("@aws-sdk/client-sns");
+	const endpoint = awsEndpoint(env, "SNS");
+	let provisioning = null;
+	const groups = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const host = new URL(String(record.data?.endpoint)).host;
+		const group = `${record.data?.topicArn}|${host}`;
+		groups.set(group, [...groups.get(group) ?? [], record]);
+	}
+	const left = [];
+	for (const [group, members] of groups) {
+		const pending = members.filter((r) => r.data?.pending === true);
+		if (pending.length === 0) continue;
+		const [topicArn, host] = group.split("|");
+		const unreachable = () => left.push(...pending.map((r) => String(r.data?.endpoint)));
+		let connection;
+		const connectionKey = members[0].data?.connectionKey;
+		if (typeof connectionKey === "string") {
+			const connectionString = input.secrets?.[connectionKey];
+			if (!connectionString?.startsWith("sns:")) {
+				unreachable();
+				continue;
+			}
+			connection = await topicConnection({
+				connectionKey,
+				connectionString,
+				stage: input.stage,
+				env,
+				...input.home ? { home: input.home } : {}
+			});
+		} else {
+			if (provisioning === null) provisioning = await awsProvisioningCredentials({
+				stage: input.stage,
+				env,
+				...input.home ? { home: input.home } : {}
+			});
+			if (!provisioning) {
+				unreachable();
+				continue;
+			}
+			const region = topicArn.split(":")[3];
+			const { credentials } = await awsClientConfig(provisioning, region);
+			connection = new SNSConnection({
+				topicArn,
+				region,
+				...endpoint ? { endpoint } : {},
+				...credentials ? { credentials } : {}
+			});
+		}
+		await reconcileHttpSubscriptions(connection, {
+			endpoints: members.map(specOf),
+			ownedHost: host
+		});
+		const deadline = Date.now() + (input.timeoutMs ?? 6e4);
+		for (const record of pending) {
+			let confirmed = false;
+			while (!confirmed) {
+				const { Attributes = {} } = await connection.snsClient.send(new GetSubscriptionAttributesCommand({ SubscriptionArn: record.id }));
+				confirmed = Attributes.PendingConfirmation !== "true";
+				if (confirmed || Date.now() > deadline) break;
+				await new Promise((resolve) => setTimeout(resolve, 1e3));
+			}
+			if (confirmed) {
+				input.log?.(`   ✓ ${record.data?.endpoint} confirmed its subscription`);
+				await input.record?.({
+					...record,
+					data: {
+						...record.data,
+						pending: false
+					}
+				});
+			} else left.push(String(record.data?.endpoint));
+		}
+		await connection.close();
+	}
+	return left;
+}
+//#endregion
 Object.defineProperty(exports, "BACKUPS_SERVICE", {
 	enumerable: true,
 	get: function() {
@@ -1077,12 +1504,48 @@ Object.defineProperty(exports, "HostNotPointingAtServer", {
 		return HostNotPointingAtServer;
 	}
 });
+Object.defineProperty(exports, "PushSubscriptionsUnconfirmed", {
+	enumerable: true,
+	get: function() {
+		return PushSubscriptionsUnconfirmed;
+	}
+});
 Object.defineProperty(exports, "RUNNER_PATH", {
 	enumerable: true,
 	get: function() {
 		return RUNNER_PATH;
 	}
 });
+Object.defineProperty(exports, "SUBSCRIPTION_TYPE", {
+	enumerable: true,
+	get: function() {
+		return SUBSCRIPTION_TYPE;
+	}
+});
+Object.defineProperty(exports, "assertSitePasswordTarget", {
+	enumerable: true,
+	get: function() {
+		return assertSitePasswordTarget;
+	}
+});
+Object.defineProperty(exports, "awsClientConfig", {
+	enumerable: true,
+	get: function() {
+		return awsClientConfig;
+	}
+});
+Object.defineProperty(exports, "awsEndpoint", {
+	enumerable: true,
+	get: function() {
+		return awsEndpoint;
+	}
+});
+Object.defineProperty(exports, "awsProvisioningCredentials", {
+	enumerable: true,
+	get: function() {
+		return awsProvisioningCredentials;
+	}
+});
 Object.defineProperty(exports, "backupDatabases", {
 	enumerable: true,
 	get: function() {
@@ -1119,6 +1582,12 @@ Object.defineProperty(exports, "backupsService", {
 		return backupsService;
 	}
 });
+Object.defineProperty(exports, "confirmPendingSubscriptions", {
+	enumerable: true,
+	get: function() {
+		return confirmPendingSubscriptions;
+	}
+});
 Object.defineProperty(exports, "deploysWithCompose", {
 	enumerable: true,
 	get: function() {
@@ -1137,6 +1606,18 @@ Object.defineProperty(exports, "isLocalHost", {
 		return isLocalHost;
 	}
 });
+Object.defineProperty(exports, "passwordSites", {
+	enumerable: true,
+	get: function() {
+		return passwordSites;
+	}
+});
+Object.defineProperty(exports, "recordedPushSubscriptions", {
+	enumerable: true,
+	get: function() {
+		return recordedPushSubscriptions;
+	}
+});
 Object.defineProperty(exports, "requiredServerAddress", {
 	enumerable: true,
 	get: function() {
@@ -1155,6 +1636,18 @@ Object.defineProperty(exports, "serverAddressHint", {
 		return serverAddressHint;
 	}
 });
+Object.defineProperty(exports, "siteAuth", {
+	enumerable: true,
+	get: function() {
+		return siteAuth;
+	}
+});
+Object.defineProperty(exports, "siteNames", {
+	enumerable: true,
+	get: function() {
+		return siteNames;
+	}
+});
 Object.defineProperty(exports, "stackBackups", {
 	enumerable: true,
 	get: function() {
@@ -1185,11 +1678,35 @@ Object.defineProperty(exports, "stageDnsDomains", {
 		return stageDnsDomains;
 	}
 });
+Object.defineProperty(exports, "subscriptionKey", {
+	enumerable: true,
+	get: function() {
+		return subscriptionKey;
+	}
+});
+Object.defineProperty(exports, "subscriptionResource", {
+	enumerable: true,
+	get: function() {
+		return subscriptionResource;
+	}
+});
 Object.defineProperty(exports, "systemLookup", {
 	enumerable: true,
 	get: function() {
 		return systemLookup;
 	}
 });
+Object.defineProperty(exports, "topicConnection", {
+	enumerable: true,
+	get: function() {
+		return topicConnection;
+	}
+});
+Object.defineProperty(exports, "withSitePasswords", {
+	enumerable: true,
+	get: function() {
+		return withSitePasswords;
+	}
+});
 
-//# sourceMappingURL=dns-CfEZHt7r.cjs.map
+//# sourceMappingURL=snsSubscriptions-CSkteK2J.cjs.map