@geekmidas/cli 9.0.2 → 10.0.0-alpha.0

package/src/secrets/__tests__/generator.spec.ts

@@ -1,575 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import {
-	createStageSecrets,
-	generateConnectionUrls,
-	generateEventConnectionStrings,
-	generateLocalStackAccessKeyId,
-	generateLocalStackCredentials,
-	generateMinioEndpoint,
-	generatePgBossUrl,
-	generatePostgresUrl,
-	generateRabbitmqUrl,
-	generateRedisUrl,
-	generateSecurePassword,
-	generateServiceCredentials,
-	generateServicesCredentials,
-	rotateServicePassword,
-} from '../generator';
-import type { ServiceCredentials, StageSecrets } from '../types';
-
-describe('generateSecurePassword', () => {
-	it('should generate password of default length (32)', () => {
-		const password = generateSecurePassword();
-		expect(password).toHaveLength(32);
-	});
-
-	it('should generate password of custom length', () => {
-		const password = generateSecurePassword(16);
-		expect(password).toHaveLength(16);
-	});
-
-	it('should generate different passwords each call', () => {
-		const password1 = generateSecurePassword();
-		const password2 = generateSecurePassword();
-		expect(password1).not.toBe(password2);
-	});
-
-	it('should only contain URL-safe base64 characters', () => {
-		const password = generateSecurePassword(64);
-		// base64url uses A-Z, a-z, 0-9, -, _
-		expect(password).toMatch(/^[A-Za-z0-9_-]+$/);
-	});
-});
-
-describe('generateServiceCredentials', () => {
-	it('should generate postgres credentials with defaults', () => {
-		const creds = generateServiceCredentials('postgres');
-
-		expect(creds.host).toBe('localhost');
-		expect(creds.port).toBe(5432);
-		expect(creds.username).toBe('app');
-		expect(creds.database).toBe('app');
-		expect(creds.password).toHaveLength(32);
-	});
-
-	it('should generate redis credentials with defaults', () => {
-		const creds = generateServiceCredentials('redis');
-
-		expect(creds.host).toBe('localhost');
-		expect(creds.port).toBe(6379);
-		expect(creds.username).toBe('default');
-		expect(creds.password).toHaveLength(32);
-	});
-
-	it('should generate rabbitmq credentials with defaults', () => {
-		const creds = generateServiceCredentials('rabbitmq');
-
-		expect(creds.host).toBe('localhost');
-		expect(creds.port).toBe(5672);
-		expect(creds.username).toBe('app');
-		expect(creds.vhost).toBe('/');
-		expect(creds.password).toHaveLength(32);
-	});
-
-	it('should generate minio credentials with defaults', () => {
-		const creds = generateServiceCredentials('minio');
-
-		expect(creds.host).toBe('localhost');
-		expect(creds.port).toBe(9000);
-		expect(creds.username).toBe('app');
-		expect(creds.bucket).toBe('app');
-		expect(creds.password).toHaveLength(32);
-	});
-});
-
-describe('generateServicesCredentials', () => {
-	it('should generate credentials for multiple services', () => {
-		const creds = generateServicesCredentials(['postgres', 'redis']);
-
-		expect(creds.postgres).toBeDefined();
-		expect(creds.redis).toBeDefined();
-		expect(creds.rabbitmq).toBeUndefined();
-	});
-
-	it('should generate unique passwords for each service', () => {
-		const creds = generateServicesCredentials([
-			'postgres',
-			'redis',
-			'rabbitmq',
-		]);
-
-		expect(creds.postgres!.password).not.toBe(creds.redis!.password);
-		expect(creds.redis!.password).not.toBe(creds.rabbitmq!.password);
-	});
-});
-
-describe('generatePostgresUrl', () => {
-	it('should generate valid postgres URL', () => {
-		const creds: ServiceCredentials = {
-			host: 'postgres',
-			port: 5432,
-			username: 'app',
-			password: 'secret123',
-			database: 'mydb',
-		};
-
-		const url = generatePostgresUrl(creds);
-		expect(url).toBe('postgresql://app:secret123@postgres:5432/mydb');
-	});
-
-	it('should encode special characters in password', () => {
-		const creds: ServiceCredentials = {
-			host: 'postgres',
-			port: 5432,
-			username: 'app',
-			password: 'pass@word/test',
-			database: 'mydb',
-		};
-
-		const url = generatePostgresUrl(creds);
-		expect(url).toBe('postgresql://app:pass%40word%2Ftest@postgres:5432/mydb');
-	});
-});
-
-describe('generateRedisUrl', () => {
-	it('should generate valid redis URL', () => {
-		const creds: ServiceCredentials = {
-			host: 'redis',
-			port: 6379,
-			username: 'default',
-			password: 'secret123',
-		};
-
-		const url = generateRedisUrl(creds);
-		expect(url).toBe('redis://:secret123@redis:6379');
-	});
-
-	it('should encode special characters in password', () => {
-		const creds: ServiceCredentials = {
-			host: 'redis',
-			port: 6379,
-			username: 'default',
-			password: 'pass@word/test',
-		};
-
-		const url = generateRedisUrl(creds);
-		expect(url).toBe('redis://:pass%40word%2Ftest@redis:6379');
-	});
-});
-
-describe('generateMinioEndpoint', () => {
-	it('should generate valid minio endpoint URL', () => {
-		const creds: ServiceCredentials = {
-			host: 'localhost',
-			port: 9000,
-			username: 'app',
-			password: 'secret123',
-			bucket: 'my-bucket',
-		};
-
-		const url = generateMinioEndpoint(creds);
-		expect(url).toBe('http://localhost:9000');
-	});
-
-	it('should use custom host and port', () => {
-		const creds: ServiceCredentials = {
-			host: 'minio.example.com',
-			port: 9090,
-			username: 'app',
-			password: 'secret',
-		};
-
-		const url = generateMinioEndpoint(creds);
-		expect(url).toBe('http://minio.example.com:9090');
-	});
-});
-
-describe('generateRabbitmqUrl', () => {
-	it('should generate valid rabbitmq URL with default vhost', () => {
-		const creds: ServiceCredentials = {
-			host: 'rabbitmq',
-			port: 5672,
-			username: 'app',
-			password: 'secret123',
-			vhost: '/',
-		};
-
-		const url = generateRabbitmqUrl(creds);
-		expect(url).toBe('amqp://app:secret123@rabbitmq:5672/%2F');
-	});
-
-	it('should handle custom vhost', () => {
-		const creds: ServiceCredentials = {
-			host: 'rabbitmq',
-			port: 5672,
-			username: 'app',
-			password: 'secret123',
-			vhost: '/myapp',
-		};
-
-		const url = generateRabbitmqUrl(creds);
-		expect(url).toBe('amqp://app:secret123@rabbitmq:5672/%2Fmyapp');
-	});
-});
-
-describe('generateConnectionUrls', () => {
-	it('should generate DATABASE_URL for postgres', () => {
-		const urls = generateConnectionUrls({
-			postgres: {
-				host: 'postgres',
-				port: 5432,
-				username: 'app',
-				password: 'secret',
-				database: 'app',
-			},
-		});
-
-		expect(urls.DATABASE_URL).toBe('postgresql://app:secret@postgres:5432/app');
-		expect(urls.REDIS_URL).toBeUndefined();
-		expect(urls.RABBITMQ_URL).toBeUndefined();
-	});
-
-	it('should generate all URLs when all services present', () => {
-		const urls = generateConnectionUrls({
-			postgres: {
-				host: 'postgres',
-				port: 5432,
-				username: 'app',
-				password: 'pg-pass',
-				database: 'app',
-			},
-			redis: {
-				host: 'redis',
-				port: 6379,
-				username: 'default',
-				password: 'redis-pass',
-			},
-			rabbitmq: {
-				host: 'rabbitmq',
-				port: 5672,
-				username: 'app',
-				password: 'rmq-pass',
-				vhost: '/',
-			},
-			minio: {
-				host: 'minio',
-				port: 9000,
-				username: 'app',
-				password: 'minio-pass',
-				bucket: 'app',
-			},
-		});
-
-		expect(urls.DATABASE_URL).toBeDefined();
-		expect(urls.REDIS_URL).toBeDefined();
-		expect(urls.RABBITMQ_URL).toBeDefined();
-		expect(urls.STORAGE_ENDPOINT).toBe('http://minio:9000');
-	});
-
-	it('should generate STORAGE_ENDPOINT for minio', () => {
-		const urls = generateConnectionUrls({
-			minio: {
-				host: 'localhost',
-				port: 9000,
-				username: 'app',
-				password: 'secret',
-				bucket: 'my-bucket',
-			},
-		});
-
-		expect(urls.STORAGE_ENDPOINT).toBe('http://localhost:9000');
-		expect(urls.DATABASE_URL).toBeUndefined();
-	});
-});
-
-describe('createStageSecrets', () => {
-	it('should create stage secrets with stage name', () => {
-		const secrets = createStageSecrets('production', ['postgres']);
-
-		expect(secrets.stage).toBe('production');
-		expect(secrets.createdAt).toBeDefined();
-		expect(secrets.updatedAt).toBeDefined();
-		expect(secrets.custom).toEqual({});
-	});
-
-	it('should include service credentials', () => {
-		const secrets = createStageSecrets('staging', ['postgres', 'redis']);
-
-		expect(secrets.services.postgres).toBeDefined();
-		expect(secrets.services.redis).toBeDefined();
-		expect(secrets.services.rabbitmq).toBeUndefined();
-	});
-
-	it('should generate connection URLs', () => {
-		const secrets = createStageSecrets('production', [
-			'postgres',
-			'redis',
-			'rabbitmq',
-		]);
-
-		expect(secrets.urls.DATABASE_URL).toBeDefined();
-		expect(secrets.urls.REDIS_URL).toBeDefined();
-		expect(secrets.urls.RABBITMQ_URL).toBeDefined();
-	});
-
-	it('should generate STORAGE_ENDPOINT for minio', () => {
-		const secrets = createStageSecrets('production', ['minio']);
-
-		expect(secrets.services.minio).toBeDefined();
-		expect(secrets.urls.STORAGE_ENDPOINT).toBe('http://localhost:9000');
-	});
-});
-
-describe('rotateServicePassword', () => {
-	it('should rotate password for specified service', () => {
-		const original = createStageSecrets('production', ['postgres', 'redis']);
-		const originalPassword = original.services.postgres!.password;
-
-		const rotated = rotateServicePassword(original, 'postgres');
-
-		expect(rotated.services.postgres!.password).not.toBe(originalPassword);
-		expect(rotated.services.redis!.password).toBe(
-			original.services.redis!.password,
-		);
-	});
-
-	it('should update updatedAt timestamp', () => {
-		// Create with a fixed past timestamp
-		const original: StageSecrets = {
-			stage: 'production',
-			createdAt: '2024-01-01T00:00:00.000Z',
-			updatedAt: '2024-01-01T00:00:00.000Z',
-			services: {
-				postgres: {
-					host: 'postgres',
-					port: 5432,
-					username: 'app',
-					password: 'original-pass',
-					database: 'app',
-				},
-			},
-			urls: {
-				DATABASE_URL: 'postgresql://app:original-pass@postgres:5432/app',
-			},
-			custom: {},
-		};
-
-		const rotated = rotateServicePassword(original, 'postgres');
-
-		expect(rotated.updatedAt).not.toBe(original.updatedAt);
-	});
-
-	it('should regenerate connection URL', () => {
-		const original = createStageSecrets('production', ['postgres']);
-		const originalUrl = original.urls.DATABASE_URL;
-
-		const rotated = rotateServicePassword(original, 'postgres');
-
-		expect(rotated.urls.DATABASE_URL).not.toBe(originalUrl);
-	});
-
-	it('should throw for unconfigured service', () => {
-		const secrets = createStageSecrets('production', ['postgres']);
-
-		expect(() => rotateServicePassword(secrets, 'redis')).toThrow(
-			'Service "redis" not configured in secrets',
-		);
-	});
-
-	it('should preserve other service credentials', () => {
-		const original = createStageSecrets('production', [
-			'postgres',
-			'redis',
-			'rabbitmq',
-		]);
-
-		const rotated = rotateServicePassword(original, 'postgres');
-
-		expect(rotated.services.redis).toEqual(original.services.redis);
-		expect(rotated.services.rabbitmq).toEqual(original.services.rabbitmq);
-	});
-});
-
-describe('generateLocalStackAccessKeyId', () => {
-	it('should start with LSIA prefix', () => {
-		const keyId = generateLocalStackAccessKeyId();
-		expect(keyId).toMatch(/^LSIA/);
-	});
-
-	it('should be at least 20 characters', () => {
-		const keyId = generateLocalStackAccessKeyId();
-		expect(keyId.length).toBeGreaterThanOrEqual(20);
-	});
-
-	it('should generate unique keys', () => {
-		const key1 = generateLocalStackAccessKeyId();
-		const key2 = generateLocalStackAccessKeyId();
-		expect(key1).not.toBe(key2);
-	});
-});
-
-describe('generatePgBossUrl', () => {
-	it('should generate pgboss connection URL', () => {
-		const creds: ServiceCredentials = {
-			host: 'localhost',
-			port: 5432,
-			username: 'pgboss',
-			password: 'secret',
-			database: 'myapp_dev',
-		};
-
-		const url = generatePgBossUrl(creds);
-		expect(url).toBe(
-			'pgboss://pgboss:secret@localhost:5432/myapp_dev?schema=pgboss',
-		);
-	});
-
-	it('should encode special characters in password', () => {
-		const creds: ServiceCredentials = {
-			host: 'localhost',
-			port: 5432,
-			username: 'pgboss',
-			password: 'p@ss/word',
-			database: 'app',
-		};
-
-		const url = generatePgBossUrl(creds);
-		expect(url).toContain('p%40ss%2Fword');
-	});
-});
-
-describe('generateLocalStackCredentials', () => {
-	it('should generate credentials with LSIA-prefixed access key', () => {
-		const creds = generateLocalStackCredentials();
-		expect(creds.accessKeyId).toMatch(/^LSIA/);
-		expect(creds.host).toBe('localhost');
-		expect(creds.port).toBe(4566);
-		expect(creds.region).toBe('us-east-1');
-		expect(creds.password).toHaveLength(32);
-	});
-});
-
-describe('generateEventConnectionStrings', () => {
-	it('should generate pgboss connection strings', () => {
-		const services: StageSecrets['services'] = {
-			pgboss: {
-				host: 'localhost',
-				port: 5432,
-				username: 'pgboss',
-				password: 'secret',
-				database: 'myapp_dev',
-			},
-		};
-
-		const result = generateEventConnectionStrings('pgboss', services);
-		expect(result.publisher).toContain('pgboss://');
-		expect(result.subscriber).toContain('pgboss://');
-		expect(result.publisher).toBe(result.subscriber);
-	});
-
-	it('should generate sns/sqs connection strings', () => {
-		const services: StageSecrets['services'] = {
-			localstack: {
-				host: 'localhost',
-				port: 4566,
-				username: 'localstack',
-				password: 'secret',
-				accessKeyId: 'LSIAtest1234567890xx',
-				region: 'us-east-1',
-			},
-		};
-
-		const result = generateEventConnectionStrings('sns', services);
-		expect(result.publisher).toContain('sns://');
-		expect(result.subscriber).toContain('sqs://');
-		expect(result.publisher).toContain('LSIAtest1234567890xx');
-	});
-
-	it('should generate rabbitmq connection strings', () => {
-		const services: StageSecrets['services'] = {
-			rabbitmq: {
-				host: 'localhost',
-				port: 5672,
-				username: 'app',
-				password: 'secret',
-				vhost: '/',
-			},
-		};
-
-		const result = generateEventConnectionStrings('rabbitmq', services);
-		expect(result.publisher).toContain('amqp://');
-		expect(result.subscriber).toContain('amqp://');
-		expect(result.publisher).toBe(result.subscriber);
-	});
-
-	it('should throw if pgboss credentials missing', () => {
-		expect(() => generateEventConnectionStrings('pgboss', {})).toThrow(
-			'pgboss credentials required',
-		);
-	});
-
-	it('should throw if localstack credentials missing', () => {
-		expect(() => generateEventConnectionStrings('sns', {})).toThrow(
-			'localstack credentials required',
-		);
-	});
-});
-
-describe('createStageSecrets with events', () => {
-	it('should create pgboss credentials when eventsBackend is pgboss', () => {
-		const secrets = createStageSecrets('development', ['postgres'], {
-			eventsBackend: 'pgboss',
-		});
-
-		expect(secrets.eventsBackend).toBe('pgboss');
-		expect(secrets.services.pgboss).toBeDefined();
-		expect(secrets.services.pgboss!.username).toBe('pgboss');
-		expect(secrets.services.pgboss!.host).toBe(secrets.services.postgres!.host);
-		expect(secrets.services.pgboss!.database).toBe(
-			secrets.services.postgres!.database,
-		);
-		expect(secrets.urls.EVENT_PUBLISHER_CONNECTION_STRING).toContain(
-			'pgboss://',
-		);
-		expect(secrets.urls.EVENT_SUBSCRIBER_CONNECTION_STRING).toContain(
-			'pgboss://',
-		);
-	});
-
-	it('should create localstack credentials when eventsBackend is sns', () => {
-		const secrets = createStageSecrets('development', [], {
-			eventsBackend: 'sns',
-		});
-
-		expect(secrets.eventsBackend).toBe('sns');
-		expect(secrets.services.localstack).toBeDefined();
-		expect(secrets.services.localstack!.accessKeyId).toMatch(/^LSIA/);
-		expect(secrets.urls.EVENT_PUBLISHER_CONNECTION_STRING).toContain('sns://');
-		expect(secrets.urls.EVENT_SUBSCRIBER_CONNECTION_STRING).toContain('sqs://');
-	});
-
-	it('should use rabbitmq credentials when eventsBackend is rabbitmq', () => {
-		const secrets = createStageSecrets('development', ['rabbitmq'], {
-			eventsBackend: 'rabbitmq',
-		});
-
-		expect(secrets.eventsBackend).toBe('rabbitmq');
-		expect(secrets.urls.EVENT_PUBLISHER_CONNECTION_STRING).toContain('amqp://');
-		expect(secrets.urls.EVENT_SUBSCRIBER_CONNECTION_STRING).toContain(
-			'amqp://',
-		);
-	});
-
-	it('should default event URLs to pgboss when postgres is present without explicit eventsBackend', () => {
-		const secrets = createStageSecrets('development', ['postgres']);
-
-		expect(secrets.eventsBackend).toBeUndefined();
-		expect(secrets.services.pgboss).toBeDefined();
-		expect(secrets.urls.EVENT_PUBLISHER_CONNECTION_STRING).toContain(
-			'pgboss://',
-		);
-		expect(secrets.urls.EVENT_SUBSCRIBER_CONNECTION_STRING).toContain(
-			'pgboss://',
-		);
-	});
-});

package/src/secrets/__tests__/index.spec.ts

@@ -1,91 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { getServicesFromConfig, maskUrl } from '../index';
-
-describe('getServicesFromConfig', () => {
-	it('should return empty array when services is undefined', () => {
-		const result = getServicesFromConfig(undefined);
-		expect(result).toEqual([]);
-	});
-
-	it('should return array as-is when services is an array', () => {
-		const services = ['postgres', 'redis'] as const;
-		const result = getServicesFromConfig([...services]);
-		expect(result).toEqual(['postgres', 'redis']);
-	});
-
-	it('should extract service names from object config', () => {
-		const services = {
-			postgres: true,
-			redis: { port: 6379 },
-			rabbitmq: false,
-		};
-		const result = getServicesFromConfig(services);
-		expect(result).toContain('postgres');
-		expect(result).toContain('redis');
-		expect(result).not.toContain('rabbitmq');
-	});
-
-	it('should handle empty object', () => {
-		const result = getServicesFromConfig({});
-		expect(result).toEqual([]);
-	});
-
-	it('should handle all falsy values in object', () => {
-		const services = {
-			postgres: false,
-			redis: null,
-			rabbitmq: undefined,
-		};
-		const result = getServicesFromConfig(services as Record<string, unknown>);
-		expect(result).toEqual([]);
-	});
-});
-
-describe('maskUrl', () => {
-	it('should mask password in URL', () => {
-		const url = 'postgres://user:secretpassword@localhost:5432/db';
-		const masked = maskUrl(url);
-		expect(masked).not.toContain('secretpassword');
-		expect(masked).toContain('user');
-		expect(masked).toContain('localhost');
-		expect(masked).toContain('5432');
-		expect(masked).toContain('db');
-	});
-
-	it('should handle URL without password', () => {
-		const url = 'redis://localhost:6379';
-		const masked = maskUrl(url);
-		// URL object normalizes the format
-		expect(masked).toContain('redis://');
-		expect(masked).toContain('localhost:6379');
-	});
-
-	it('should handle URL with username only', () => {
-		const url = 'postgres://user@localhost:5432/db';
-		const masked = maskUrl(url);
-		expect(masked).toContain('user');
-		expect(masked).toContain('localhost');
-	});
-
-	it('should return original string for invalid URL', () => {
-		const invalid = 'not-a-url';
-		const result = maskUrl(invalid);
-		expect(result).toBe('not-a-url');
-	});
-
-	it('should handle amqp URLs', () => {
-		const url = 'amqp://guest:guestpass@localhost:5672/vhost';
-		const masked = maskUrl(url);
-		expect(masked).not.toContain('guestpass');
-		expect(masked).toContain('guest');
-		expect(masked).toContain('vhost');
-	});
-
-	it('should handle https URLs with credentials', () => {
-		const url = 'https://user:apikey123@api.example.com/v1';
-		const masked = maskUrl(url);
-		expect(masked).not.toContain('apikey123');
-		expect(masked).toContain('user');
-		expect(masked).toContain('api.example.com');
-	});
-});