@geekmidas/cli 10.0.0-alpha.122 → 10.0.0-alpha.124

package/dist/{dns-BgxvvcQa.mjs → snsSubscriptions-CvBIGGp0.mjs}

@@ -1,13 +1,16 @@
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { dt as checkStageBackups, ft as SERVER_IPV4_KEY, mt as cnameTarget, pt as SERVER_IPV6_KEY } from "./workspace-D1QbNd55.mjs";
-import { An as localRolePassword, O as DnsRecordsUnreadable, f as extractSubdomain, k as createDnsProvider, m as normalizeDnsConfig, mn as postgresRoleSlug, p as findRootDomain, qn as postgresImage, un as quoteIdentifier } from "./seeds-oY0qDqui.mjs";
+import { r as storedCredentials } from "./credentials-DpfnUvIR.mjs";
+import { dt as checkStageBackups, ft as SERVER_IPV4_KEY, mt as cnameTarget, pt as SERVER_IPV6_KEY } from "./workspace-DUnnVjqC.mjs";
+import { O as DnsRecordsUnreadable, Xn as postgresImage, dn as quoteIdentifier, f as extractSubdomain, hn as postgresRoleSlug, jn as localRolePassword, k as createDnsProvider, m as normalizeDnsConfig, p as findRootDomain } from "./seeds-rG-Evfz9.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import { isIPv4, isIPv6 } from "node:net";
-import { createHash } from "node:crypto";
-import { DEFAULT_POSTGRES_VERSION, kebabCase } from "@geekmidas/manifest";
+import { createHash, randomBytes } from "node:crypto";
+import { DEFAULT_POSTGRES_VERSION, environmentCase, kebabCase } from "@geekmidas/manifest";
 import { fileURLToPath } from "node:url";
+import bcrypt from "bcryptjs";
 import { lookup } from "node:dns/promises";
 //#region src/providers/dns.ts
 /** Whether the workspace deploys through the compose target. */
@@ -319,6 +322,226 @@ function backupsRoleStatements(backups) {
 	];
 }
 //#endregion
+//#region src/compose/sitePassword.ts
+/**
+* A deployed stage's sites behind a password — `deploy.sitePassword` — so a
+* staging build is not public while it is being tried.
+*
+* The edge asks for it with HTTP basic auth, before a request reaches the
+* site: the browser prompts, and nothing of the site loads until the stage's
+* login is given. The user is the stage's name; the password is generated
+* once per site and kept in the stage's secrets, where one set by hand wins.
+* Only its bcrypt hash reaches the edge's config.
+*
+* Pure.
+*/
+/** `deploy.sitePassword` names something that is not one of the stage's sites. */
+var UnknownPasswordSite = class extends GkmError {
+	stage;
+	site;
+	sites;
+	constructor(stage, site, sites) {
+		super(`deploy.sitePassword.${stage} names '${site}', which is not a site of this workspace. ${sites.length > 0 ? `Its sites: ${sites.map((s) => `'${s}'`).join(", ")}.` : "It declares no site."} Name one of them, or set ${stage}: true for every site.`);
+		this.stage = stage;
+		this.site = site;
+		this.sites = sites;
+		this.name = "UnknownPasswordSite";
+	}
+};
+/** A site the stage puts behind a password, with none in the stage's secrets. */
+var SitePasswordMissing = class extends GkmError {
+	stage;
+	key;
+	constructor(stage, key) {
+		super(`deploy.sitePassword puts a site of '${stage}' behind a password, and the stage has no ${key} in its secrets. Run gkm compose --stage ${stage} once to generate it, or set one: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.key = key;
+		this.name = "SitePasswordMissing";
+	}
+};
+/**
+* `deploy.sitePassword` names a stage that deploys through a target that
+* cannot ask for a login. Refused rather than ignored: ignored, the stage
+* would be public while its config says it is not.
+*/
+var SitePasswordNeedsCompose = class extends GkmError {
+	stage;
+	target;
+	constructor(stage, target) {
+		super(`deploy.sitePassword puts '${stage}' behind a password, and it deploys through '${target}', which cannot ask for one yet — only compose does. Remove ${stage} from deploy.sitePassword, or deploy it with compose.`);
+		this.stage = stage;
+		this.target = target;
+		this.name = "SitePasswordNeedsCompose";
+	}
+};
+/**
+* @throws {SitePasswordNeedsCompose} where `stage` asks for a site password
+* and `target` is not compose
+*/
+function assertSitePasswordTarget(workspace, stage, target) {
+	if (workspace.deploy?.sitePassword?.[stage] && target !== "compose") throw new SitePasswordNeedsCompose(stage, target);
+}
+/** The stage secret a site's password is kept in: `WEB_SITE_PASSWORD`. */
+function sitePasswordKey(site) {
+	return `${environmentCase(site)}_SITE_PASSWORD`;
+}
+/** Every site the manifest declares, by app name. */
+function siteNames(manifest) {
+	return Object.values(manifest).filter((declaration) => declaration.kind === "site").map((declaration) => appKey(declaration.id));
+}
+/**
+* The sites `deploy.sitePassword` puts behind a password on `stage`, by app
+* name: every one for `true`, the ones it names otherwise.
+*
+* @throws {UnknownPasswordSite} for a name that is not one of `sites`
+*/
+function passwordSites(workspace, stage, sites) {
+	const choice = workspace.deploy?.sitePassword?.[stage];
+	if (!choice) return [];
+	if (choice === true) return [...sites];
+	const chosen = /* @__PURE__ */ new Set();
+	for (const name of choice) {
+		const site = appKey(name);
+		if (!sites.includes(site)) throw new UnknownPasswordSite(stage, name, sites);
+		chosen.add(site);
+	}
+	return [...chosen];
+}
+/** A password: 192 random bits, URL-safe, so it is typed or pasted as is. */
+function generateSitePassword() {
+	return randomBytes(24).toString("base64url");
+}
+/**
+* The stage's secrets with a generated password for each site, where it has
+* none. Pure, like `withGeneratedSecrets`: the caller keeps the result once
+* the run goes ahead.
+*/
+function withSitePasswords(secrets, sites) {
+	const missing = sites.map(sitePasswordKey).filter((key) => !secrets.custom?.[key]);
+	if (missing.length === 0) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				...Object.fromEntries(missing.map((key) => [key, generateSitePassword()]))
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: missing
+	};
+}
+/**
+* The login a site is served behind on `stage`.
+*
+* The hash's salt is derived from the password, so the same password always
+* renders the same edge config: a deploy that changed nothing rewrites
+* nothing, and the proxy is not reloaded for it. A per-hash random salt
+* guards against a precomputed table of common passwords; a generated one is
+* 192 random bits, which no table holds.
+*
+* @throws {SitePasswordMissing} where the stage's secrets hold none
+*/
+function siteAuth(stage, site, custom) {
+	const key = sitePasswordKey(site);
+	const password = custom[key];
+	if (!password) throw new SitePasswordMissing(stage, key);
+	return {
+		user: stage,
+		password,
+		hash: bcrypt.hashSync(password, saltFor(password)),
+		key
+	};
+}
+/** bcrypt's own base-64 alphabet, in which a salt is written. */
+const BCRYPT_ALPHABET = "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+/**
+* A bcrypt salt — `$2a$`, which Caddy and Traefik both read, at cost 10 —
+* derived from the password.
+*/
+function saltFor(password) {
+	const digest = createHash("sha256").update(password).digest();
+	let salt = "";
+	for (let i = 0; i < 22; i++) salt += BCRYPT_ALPHABET[digest[i] % 64];
+	return `$2a$10$${salt}`;
+}
+//#endregion
+//#region src/providers/aws.ts
+/**
+* The AWS account a provider provisions in — the stage's, found the way the
+* SSM and Secrets Manager stores find it.
+*
+* 1. `--profile`, resolved on its own: exported keys left over from another
+*    account never win over a profile someone named.
+* 2. `AWS_PROFILE`, else `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` — the
+*    deploy's own `aws` credential kind (`storedCredentials`).
+* 3. The SDK's default chain: `~/.aws` default profile, SSO, a role. In CI,
+*    whatever `aws-actions/configure-aws-credentials` exported.
+*
+* None of them: the provider has no provisioning credentials, and the stage
+* is treated as `external`.
+*/
+async function awsProvisioningCredentials(lookup) {
+	const region = lookup.env.AWS_REGION ?? lookup.env.AWS_DEFAULT_REGION;
+	const where = region ? { region } : {};
+	if (lookup.profile) return {
+		profile: lookup.profile,
+		...where
+	};
+	const stored = await storedCredentials({
+		env: lookup.env,
+		...lookup.home ? { home: lookup.home } : {}
+	}).get({
+		kind: "aws",
+		stage: lookup.stage
+	});
+	if (stored) return stored;
+	try {
+		const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
+		await fromNodeProviderChain({
+			timeout: 1e3,
+			maxRetries: 0
+		})();
+		return {
+			chain: true,
+			...where
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* An S3-compatible endpoint the environment points the SDK at — the AWS
+* emulator in tests. The SDK reads it itself; it is read here too, because
+* an emulator takes path-style requests, and a key written for one has to
+* say where it is.
+*/
+function awsEndpoint(env, service) {
+	return env[`AWS_ENDPOINT_URL_${service}`] ?? env.AWS_ENDPOINT_URL;
+}
+/** An SDK client's config for a provisioning credential. */
+async function awsClientConfig(credential, region) {
+	if ("profile" in credential) {
+		const { fromIni } = await import("@aws-sdk/credential-providers");
+		return {
+			region,
+			credentials: fromIni({ profile: credential.profile })
+		};
+	}
+	if ("accessKeyId" in credential) return {
+		region,
+		credentials: {
+			accessKeyId: credential.accessKeyId,
+			secretAccessKey: credential.secretAccessKey,
+			...credential.sessionToken ? { sessionToken: credential.sessionToken } : {}
+		}
+	};
+	return { region };
+}
+//#endregion
 //#region src/compose/dns.ts
 /**
 * A compose stage's DNS: the records its public hosts need, and the check that
@@ -1059,6 +1282,208 @@ async function stageDns(input) {
 	};
 }
 //#endregion
-export { deploysWithCompose as S, backupExpiries as _, serverAddressHint as a, runTime as b, stageDnsDomains as c, BACKUPS_URL_KEY as d, RUNNER_PATH as f, backupDatabases as g, stackBackups as h, requiredServerAddress as i, systemLookup as l, backupsService as m, dnsCredentials as n, stackHosts as o, backupsRoleStatements as p, isLocalHost as r, stageDns as s, HostNotPointingAtServer as t, BACKUPS_SERVICE as u, backupFile as v, stageBackups as x, backupsPrefix as y };
+//#region src/deploy/snsSubscriptions.ts
+/** The type every recorded subscription has in the stage's state. */
+const SUBSCRIPTION_TYPE = "sns-subscription";
+/** The state key a subscriber's SNS subscription is recorded under. */
+const subscriptionKey = (worker, name) => `${SUBSCRIPTION_TYPE}:${worker}/${name}`;
+/** What a recorded subscription is written to the stage's state as. */
+function subscriptionResource(subscription, arn) {
+	const { name, ...data } = subscription;
+	return {
+		key: subscriptionKey(subscription.worker, name),
+		type: SUBSCRIPTION_TYPE,
+		id: arn,
+		status: "ready",
+		data: {
+			...data,
+			...data.events ? { events: [...data.events] } : {}
+		}
+	};
+}
+/** The subscription a record holds, as an endpoint to reconcile. */
+function specOf(record) {
+	const events = record.data?.events;
+	return {
+		name: record.key.split("/").pop(),
+		endpoint: String(record.data?.endpoint),
+		...record.data?.deadLetterQueueArn ? { deadLetterQueueArn: String(record.data.deadLetterQueueArn) } : {},
+		...Array.isArray(events) ? { events: events.map(String) } : {}
+	};
+}
+/**
+* The subscriptions the deploy recorded, by worker and export — what each
+* worker is handed as `GKM_SNS_SUBSCRIPTIONS`.
+*/
+function recordedPushSubscriptions(resources) {
+	const byWorker = {};
+	for (const record of Object.values(resources ?? {})) {
+		if (record.type !== "sns-subscription" || !record.id) continue;
+		const [worker, name] = record.key.slice(`${SUBSCRIPTION_TYPE}:`.length).split("/");
+		if (!worker || !name) continue;
+		byWorker[worker] = {
+			...byWorker[worker],
+			[name]: record.id
+		};
+	}
+	return byWorker;
+}
+/** A topic connection string the deploy cannot sign with. */
+var TopicSubscriptionUnsigned = class extends GkmError {
+	connectionKey;
+	constructor(connectionKey) {
+		super(`'${connectionKey}' carries no keys, and the deploy found no AWS credentials of its own to subscribe the worker's routes with. Put accessKeyId and secretAccessKey in it — keys allowed sns:Subscribe, sns:ListSubscriptionsByTopic, sns:GetSubscriptionAttributes, sns:SetSubscriptionAttributes and sns:Unsubscribe on the topic — or sign in with \`gkm login\`.`);
+		this.connectionKey = connectionKey;
+		this.name = "TopicSubscriptionUnsigned";
+	}
+};
+/**
+* A connection to the topic a stage's connection string names, signed with
+* its own keys — or, carrying none, the deploy's.
+*
+* The emulator the environment points the SDK at stands in for SNS, as it
+* does for every provider: a string with no `endpoint` is SNS itself.
+*
+* @throws {TopicSubscriptionUnsigned} with no keys from either
+*/
+async function topicConnection(input) {
+	const { SNSConnection, snsUrl } = await import("@geekmidas/events/sns");
+	const { topicArn, region, endpoint } = snsUrl.parse(input.connectionString);
+	const params = new URL(input.connectionString).searchParams;
+	const accessKeyId = params.get("accessKeyId");
+	const secretAccessKey = params.get("secretAccessKey");
+	const where = region ?? topicArn.split(":")[3];
+	let credentials;
+	if (accessKeyId && secretAccessKey) {
+		const sessionToken = params.get("sessionToken");
+		credentials = {
+			accessKeyId,
+			secretAccessKey,
+			...sessionToken ? { sessionToken } : {}
+		};
+	} else {
+		const provisioning = await awsProvisioningCredentials({
+			stage: input.stage,
+			env: input.env,
+			...input.home ? { home: input.home } : {}
+		});
+		if (!provisioning) throw new TopicSubscriptionUnsigned(input.connectionKey);
+		credentials = (await awsClientConfig(provisioning, where ?? "us-east-1")).credentials;
+	}
+	const override = endpoint ?? awsEndpoint(input.env, "SNS");
+	return new SNSConnection({
+		topicArn,
+		...where ? { region: where } : {},
+		...override ? { endpoint: override } : {},
+		...credentials ? { credentials } : {}
+	});
+}
+/** A subscription still waiting to be confirmed once its worker is up. */
+var PushSubscriptionsUnconfirmed = class extends GkmError {
+	endpoints;
+	constructor(endpoints) {
+		super(`SNS still waits for ${endpoints.join(", ")} to confirm ${endpoints.length === 1 ? "its subscription" : "their subscriptions"}, so nothing is pushed there yet. Check the worker's logs for the confirmation it refused, and that its host answers from the internet; the next deploy sends the confirmation again.`);
+		this.endpoints = endpoints;
+		this.name = "PushSubscriptionsUnconfirmed";
+	}
+};
+/**
+* Once the workers are up: every subscription recorded as pending is
+* subscribed again — SNS resends its confirmation to a worker now there to
+* answer it — and waited on until confirmed.
+*
+* The first deploy needs it: the subscription is made before the worker
+* starts, so SNS's first confirmation finds nobody.
+*
+* A bucket's subscriptions are reached with the deploy's provisioning
+* credentials; a hand-set topic's with the connection string they were made
+* with, read from the stage's secrets.
+*
+* @returns what is still pending when the wait ran out — none, normally.
+*/
+async function confirmPendingSubscriptions(input) {
+	const env = input.env ?? process.env;
+	const records = Object.values(input.resources ?? {}).filter((r) => r.type === "sns-subscription" && r.id);
+	if (!records.some((r) => r.data?.pending === true)) return [];
+	const { SNSConnection, reconcileHttpSubscriptions } = await import("@geekmidas/events/sns");
+	const { GetSubscriptionAttributesCommand } = await import("@aws-sdk/client-sns");
+	const endpoint = awsEndpoint(env, "SNS");
+	let provisioning = null;
+	const groups = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const host = new URL(String(record.data?.endpoint)).host;
+		const group = `${record.data?.topicArn}|${host}`;
+		groups.set(group, [...groups.get(group) ?? [], record]);
+	}
+	const left = [];
+	for (const [group, members] of groups) {
+		const pending = members.filter((r) => r.data?.pending === true);
+		if (pending.length === 0) continue;
+		const [topicArn, host] = group.split("|");
+		const unreachable = () => left.push(...pending.map((r) => String(r.data?.endpoint)));
+		let connection;
+		const connectionKey = members[0].data?.connectionKey;
+		if (typeof connectionKey === "string") {
+			const connectionString = input.secrets?.[connectionKey];
+			if (!connectionString?.startsWith("sns:")) {
+				unreachable();
+				continue;
+			}
+			connection = await topicConnection({
+				connectionKey,
+				connectionString,
+				stage: input.stage,
+				env,
+				...input.home ? { home: input.home } : {}
+			});
+		} else {
+			if (provisioning === null) provisioning = await awsProvisioningCredentials({
+				stage: input.stage,
+				env,
+				...input.home ? { home: input.home } : {}
+			});
+			if (!provisioning) {
+				unreachable();
+				continue;
+			}
+			const region = topicArn.split(":")[3];
+			const { credentials } = await awsClientConfig(provisioning, region);
+			connection = new SNSConnection({
+				topicArn,
+				region,
+				...endpoint ? { endpoint } : {},
+				...credentials ? { credentials } : {}
+			});
+		}
+		await reconcileHttpSubscriptions(connection, {
+			endpoints: members.map(specOf),
+			ownedHost: host
+		});
+		const deadline = Date.now() + (input.timeoutMs ?? 6e4);
+		for (const record of pending) {
+			let confirmed = false;
+			while (!confirmed) {
+				const { Attributes = {} } = await connection.snsClient.send(new GetSubscriptionAttributesCommand({ SubscriptionArn: record.id }));
+				confirmed = Attributes.PendingConfirmation !== "true";
+				if (confirmed || Date.now() > deadline) break;
+				await new Promise((resolve) => setTimeout(resolve, 1e3));
+			}
+			if (confirmed) {
+				input.log?.(`   ✓ ${record.data?.endpoint} confirmed its subscription`);
+				await input.record?.({
+					...record,
+					data: {
+						...record.data,
+						pending: false
+					}
+				});
+			} else left.push(String(record.data?.endpoint));
+		}
+		await connection.close();
+	}
+	return left;
+}
+//#endregion
+export { stackBackups as A, siteNames as C, RUNNER_PATH as D, BACKUPS_URL_KEY as E, runTime as F, stageBackups as I, deploysWithCompose as L, backupExpiries as M, backupFile as N, backupsRoleStatements as O, backupsPrefix as P, siteAuth as S, BACKUPS_SERVICE as T, awsClientConfig as _, subscriptionKey as a, assertSitePasswordTarget as b, HostNotPointingAtServer as c, requiredServerAddress as d, serverAddressHint as f, systemLookup as g, stageDnsDomains as h, recordedPushSubscriptions as i, backupDatabases as j, backupsService as k, dnsCredentials as l, stageDns as m, SUBSCRIPTION_TYPE as n, subscriptionResource as o, stackHosts as p, confirmPendingSubscriptions as r, topicConnection as s, PushSubscriptionsUnconfirmed as t, isLocalHost as u, awsEndpoint as v, withSitePasswords as w, passwordSites as x, awsProvisioningCredentials as y };
 
-//# sourceMappingURL=dns-BgxvvcQa.mjs.map
+//# sourceMappingURL=snsSubscriptions-CvBIGGp0.mjs.map