@geekmidas/cloud 10.0.0-alpha.103 → 10.0.0-alpha.105

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekmidas/cloud",
-  "version": "10.0.0-alpha.103",
+  "version": "10.0.0-alpha.105",
   "type": "module",
   "files": [
     "dist",
@@ -41,8 +41,8 @@
   },
   "dependencies": {
     "lodash.snakecase": "~4.1.1",
-    "@geekmidas/envkit": "10.0.0-alpha.103",
-    "@geekmidas/manifest": "10.0.0-alpha.103"
+    "@geekmidas/envkit": "10.0.0-alpha.105",
+    "@geekmidas/manifest": "10.0.0-alpha.105"
   },
   "devDependencies": {
     "@types/lodash.get": "~4.4.9",
@@ -58,10 +58,10 @@
     "@pulumi/aws": ">=7.47.0",
     "@pulumi/random": ">=4.21.2",
     "@pulumi/pulumi": ">=3.263.0",
-    "@geekmidas/manifest": "^10.0.0-alpha.103",
-    "@geekmidas/storage": "^10.0.0-alpha.103",
-    "@geekmidas/events": "^10.0.0-alpha.103",
-    "@geekmidas/db": "^10.0.0-alpha.103"
+    "@geekmidas/manifest": "^10.0.0-alpha.105",
+    "@geekmidas/storage": "^10.0.0-alpha.105",
+    "@geekmidas/events": "^10.0.0-alpha.105",
+    "@geekmidas/db": "^10.0.0-alpha.105"
   },
   "peerDependenciesMeta": {
     "@geekmidas/manifest": {

package/src/sst/__tests__/fromManifest.integration.spec.ts

@@ -355,6 +355,31 @@ describe('fromManifest', () => {
 		});
 	});
 
+	it('generates a secret rather than waiting for one to be set', () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+		const provisioned = fromManifest(stack, manifest(), overrides, {
+			cache: 'db',
+			email: 'smtp',
+		});
+
+		// Without a placeholder, the stub stands in for `SecretMissingError`.
+		expect(provisioned.AuthSecret!.provides().value).not.toBe(
+			'stub-secret-AuthSecret',
+		);
+	});
+
+	it('keeps a secret’s placeholder over the generated one', () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+		const provisioned = fromManifest(
+			stack,
+			manifest(),
+			{ ...overrides, AuthSecret: { placeholder: 'chosen' } },
+			{ cache: 'db', email: 'smtp' },
+		);
+
+		expect(provisioned.AuthSecret!.provides().value).toBe('chosen');
+	});
+
 	it('takes an existing cache and mailer rather than creating them', async () => {
 		vi.spyOn(console, 'log').mockImplementation(() => {});
 		const provisioned = fromManifest(

package/src/sst/__tests__/fromManifest.secret.spec.ts

@@ -0,0 +1,79 @@
+import type { ConstructManifest } from '@geekmidas/manifest';
+import { describe, expect, it, vi } from 'vitest';
+import { fromManifest } from '../fromManifest';
+
+/** What each `RandomPassword` was asked for, by name. */
+const drawn = vi.hoisted(() => new Map<string, unknown[]>());
+
+vi.mock('@pulumi/random', () => ({
+	RandomPassword: class {
+		readonly result: string;
+		constructor(name: string, ...rest: unknown[]) {
+			drawn.set(name, rest);
+			this.result = `generated-${name}`;
+		}
+	},
+}));
+
+const provision = (manifest: ConstructManifest) => {
+	vi.spyOn(console, 'log').mockImplementation(() => {});
+	return fromManifest({} as never, manifest, {}, {});
+};
+
+describe('a secret on AWS', () => {
+	it('is generated in the format it declares, kept when the format changes', () => {
+		const provisioned = provision({
+			RouterPassword: {
+				kind: 'secret',
+				id: 'RouterPassword',
+				provides: ['ROUTER_PASSWORD'],
+				length: 24,
+				symbols: '!@#',
+			},
+		} as unknown as ConstructManifest);
+
+		expect(provisioned.RouterPassword!.provides().value).toBe(
+			'generated-RouterPasswordGenerated',
+		);
+		expect(drawn.get('RouterPasswordGenerated')).toEqual([
+			{ length: 24, special: true, overrideSpecial: '!@#', minSpecial: 1 },
+			{
+				ignoreChanges: ['length', 'special', 'overrideSpecial', 'minSpecial'],
+			},
+		]);
+	});
+
+	it('is 43 letters, digits, - and _ by default', () => {
+		provision({
+			AuthSecret: {
+				kind: 'secret',
+				id: 'AuthSecret',
+				provides: ['AUTH_SECRET'],
+			},
+		} as unknown as ConstructManifest);
+
+		expect(drawn.get('AuthSecretGenerated')?.[0]).toEqual({
+			length: 43,
+			special: true,
+			overrideSpecial: '-_',
+			minSpecial: 1,
+		});
+	});
+
+	it('draws no symbols when told none', () => {
+		provision({
+			Token: {
+				kind: 'secret',
+				id: 'Token',
+				provides: ['TOKEN'],
+				length: 6,
+				symbols: '',
+			},
+		} as unknown as ConstructManifest);
+
+		expect(drawn.get('TokenGenerated')?.[0]).toEqual({
+			length: 6,
+			special: false,
+		});
+	});
+});

package/src/sst/aws/Secret.ts

@@ -15,8 +15,10 @@ import type { StackType } from '../Stack';
  * signing key, the thing that stores it, and the thing that reads it are three
  * different systems deployed, and one derived string locally.
  *
- * Usable on its own. `Stack.fromManifest` translates a manifest into these, but
- * the component takes an ordinary placeholder so it works in a hand-written
+ * Usable on its own. `Stack.fromManifest` translates a manifest into these, and
+ * hands each a generated placeholder, so a manifest's secret is generated on
+ * its first deploy rather than set by hand; the component on its own takes
+ * whatever placeholder it is given, so it works in a hand-written
  * `sst.config.ts` with no manifest anywhere.
  */
 export class Secret<
@@ -72,5 +74,5 @@ export interface SecretProps {
 	 * letting the deploy fail — is the correct handling for a real secret. It
 	 * exists for the values that are secrets by habit rather than by need.
 	 */
-	placeholder?: string;
+	placeholder?: $util.Input<string>;
 }

package/src/sst/fromManifest.ts

@@ -19,6 +19,8 @@ import type {
 	Declaration,
 	DeclarationKind,
 	Dependency,
+	SecretDeclaration,
+	SecretFormat,
 	SiteDeclaration,
 } from '@geekmidas/manifest';
 import {
@@ -31,8 +33,11 @@ import {
 	PUBLIC_PREFIX,
 	providedKeyFor,
 	provisionOrder,
+	SECRET_LENGTH,
+	SECRET_SYMBOLS,
 	schemeBase,
 } from '@geekmidas/manifest';
+import { RandomPassword } from '@pulumi/random';
 import {
 	Cache,
 	CacheIsAmbiguous,
@@ -53,7 +58,7 @@ import { Function } from './aws/Function';
 import { ObjectStorage } from './aws/ObjectStorage';
 import { Queue } from './aws/Queue';
 import { RestApiSurface } from './aws/RestApiSurface';
-import { Secret } from './aws/Secret';
+import { Secret, type SecretProps } from './aws/Secret';
 import { StaticSite } from './aws/StaticSite';
 import { Topic } from './aws/Topic';
 import {
@@ -380,7 +385,14 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 			callers: context.callers?.get(d.id)?.promise,
 		}),
 
-	secret: (stack, d, props) => new Secret(stack, d.id, props),
+	// Generated on the first deploy and kept in the stage's state, as a server
+	// stage keeps it in its secrets: every later deploy reads the same value
+	// back. One set with `sst secret set` wins over it.
+	secret: (stack, d, props) =>
+		new Secret(stack, d.id, {
+			placeholder: generatedSecret(d.id, d as SecretDeclaration),
+			...(props as SecretProps),
+		}),
 
 	// The same storage as a secret, under a different role — see the component.
 	credential: (stack, d, props) => new Credential(stack, d.id, props),
@@ -1061,6 +1073,30 @@ export function fromManifest<
 	return provisioned;
 }
 
+/**
+ * A secret in its declared format — the alphabet `drawSecret` draws from on
+ * every other stage, with one symbol guaranteed as it guarantees one.
+ *
+ * The format is fixed at the first deploy, as a server stage's is: changing it
+ * would replace the password, and every later deploy is meant to read back the
+ * one it had.
+ */
+function generatedSecret(id: string, format: SecretFormat) {
+	const symbols = [...new Set(format.symbols ?? SECRET_SYMBOLS)].join('');
+
+	return new RandomPassword(
+		`${id}Generated`,
+		{
+			length: format.length ?? SECRET_LENGTH,
+			special: symbols.length > 0,
+			...(symbols ? { overrideSpecial: symbols, minSpecial: 1 } : {}),
+		},
+		{
+			ignoreChanges: ['length', 'special', 'overrideSpecial', 'minSpecial'],
+		},
+	).result;
+}
+
 /** What one function receives from its edges. */
 export interface ResolvedEdges {
 	/** The components it may reach. SST turns these into IAM *and* injects their