@geekmidas/cloud 10.0.0-alpha.117 → 10.0.0-alpha.118

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekmidas/cloud",
-  "version": "10.0.0-alpha.117",
+  "version": "10.0.0-alpha.118",
   "type": "module",
   "files": [
     "dist",
@@ -41,8 +41,8 @@
   },
   "dependencies": {
     "lodash.snakecase": "~4.1.1",
-    "@geekmidas/envkit": "10.0.0-alpha.117",
-    "@geekmidas/manifest": "10.0.0-alpha.117"
+    "@geekmidas/envkit": "10.0.0-alpha.118",
+    "@geekmidas/manifest": "10.0.0-alpha.118"
   },
   "devDependencies": {
     "@types/lodash.get": "~4.4.9",
@@ -58,10 +58,10 @@
     "@pulumi/aws": ">=7.47.0",
     "@pulumi/random": ">=4.21.2",
     "@pulumi/pulumi": ">=3.263.0",
-    "@geekmidas/manifest": "^10.0.0-alpha.117",
-    "@geekmidas/storage": "^10.0.0-alpha.117",
-    "@geekmidas/events": "^10.0.0-alpha.117",
-    "@geekmidas/db": "^10.0.0-alpha.117"
+    "@geekmidas/manifest": "^10.0.0-alpha.118",
+    "@geekmidas/storage": "^10.0.0-alpha.118",
+    "@geekmidas/events": "^10.0.0-alpha.118",
+    "@geekmidas/db": "^10.0.0-alpha.118"
   },
   "peerDependenciesMeta": {
     "@geekmidas/manifest": {

package/src/sst/__tests__/bootstrap.spec.ts

@@ -113,6 +113,21 @@ describe('bootstrapEvent', () => {
 		expect(roleStatements(event.tenants[0]).length).toBeGreaterThan(0);
 	});
 
+	it('carries a declared extension through to the DDL the master runs', () => {
+		// RDS ships PostGIS, but only the master may create it.
+		const event = JSON.parse(
+			bootstrapEvent(
+				master,
+				[{ ...tenant, extensions: ['postgis'] }],
+				passwords,
+			),
+		);
+
+		expect(roleStatements(event.tenants[0]).map((s) => s.sql)).toContain(
+			'CREATE EXTENSION IF NOT EXISTS "postgis" SCHEMA public',
+		);
+	});
+
 	it('carries a reader password only where a reader was named', () => {
 		const withReader = { ...tenant, reader: 'authdb_reader' };
 		const event = JSON.parse(

package/src/sst/aws/DatabaseBootstrap.ts

@@ -67,6 +67,8 @@ export class DatabaseBootstrap {
 		reader?: string;
 		/** The database's own roles, whose owner may create in it. */
 		ownsDatabase?: boolean;
+		/** Extensions the database declared, created as the master. */
+		extensions?: readonly string[];
 	}): { runtime: $util.Output<string>; reader?: $util.Output<string> } {
 		const runtime = this.password(tenant.runtime);
 		const reader = tenant.reader ? this.password(tenant.reader) : undefined;
@@ -78,6 +80,7 @@ export class DatabaseBootstrap {
 			owner: tenant.owner,
 			...(tenant.reader ? { reader: tenant.reader } : {}),
 			...(tenant.ownsDatabase ? { ownsDatabase: true } : {}),
+			...(tenant.extensions?.length ? { extensions: tenant.extensions } : {}),
 			// Filled in by `bootstrapEvent` once the outputs resolve. The function
 			// reads them straight out of its input and never fetches a secret, so
 			// it needs no IAM to read one.

package/src/sst/aws/bootstrap/handler.ts

@@ -33,6 +33,8 @@ export interface BootstrapTenant {
 	 * the database, for trusted extensions.
 	 */
 	ownsDatabase?: boolean;
+	/** Extensions the database declared, created as the master. */
+	extensions?: readonly string[];
 	passwords: { runtime: string; owner: string; reader?: string };
 }
 

package/src/sst/fromManifest.ts

@@ -239,6 +239,9 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 				runtime,
 				owner: ownerRole(runtime),
 				ownsDatabase: true,
+				// RDS ships PostGIS, so the image is not a question here — only the
+				// `CREATE EXTENSION`, which the master can run and the owner cannot.
+				...(d.extensions?.length ? { extensions: d.extensions } : {}),
 				...(hasReader(d.id, context) ? { reader: readerRole(runtime) } : {}),
 			});