@geekmidas/cloud 10.0.0-alpha.2 → 10.0.0-alpha.21

package/src/dokploy/__tests__/Application.provider.spec.ts

@@ -0,0 +1,206 @@
+import { runInNewContext } from 'node:vm';
+import { runtime } from '@pulumi/pulumi';
+import { HttpResponse, http } from 'msw';
+import { setupServer } from 'msw/node';
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest';
+import {
+	DokployCallFailed,
+	applicationProvider as provider,
+} from '../Application';
+
+/**
+ * The provider against Dokploy's tRPC API, served by MSW: what each lifecycle
+ * call sends, and how it reads what comes back — including "already gone".
+ */
+
+const endpoint = 'https://dokploy.test';
+const inputs = {
+	endpoint,
+	apiToken: 'token-1',
+	name: 'My API',
+	projectId: 'proj-1',
+	environmentId: 'env-1',
+};
+/** What state holds once the application exists: every later call gets it. */
+const outs = { ...inputs, applicationId: 'app-1', appName: 'my-api' };
+
+const server = setupServer();
+beforeAll(() => server.listen({ onUnhandledRequest: 'error' }));
+afterEach(() => server.resetHandlers());
+afterAll(() => server.close());
+
+/** Records the one request a call makes, and answers it. */
+function answer(
+	method: 'get' | 'post',
+	path: string,
+	respond: () => Response,
+): { request: () => Promise<{ body: unknown; headers: Headers }> } {
+	let seen: Request | undefined;
+	server.use(
+		http[method](`${endpoint}/api/trpc/${path}`, ({ request }) => {
+			seen = request.clone();
+			return respond();
+		}),
+	);
+	return {
+		request: async () => ({
+			body: seen && method === 'post' ? await seen.json() : undefined,
+			headers: seen!.headers,
+		}),
+	};
+}
+
+describe('Dokploy application provider', () => {
+	it('creates the application under the name Dokploy derives', async () => {
+		const call = answer('post', 'application.create', () =>
+			HttpResponse.json({ applicationId: 'app-1', appName: 'my-api' }),
+		);
+
+		const result = await provider.create!(inputs);
+
+		const { body, headers } = await call.request();
+		expect(headers.get('x-api-key')).toBe('token-1');
+		expect(body).toEqual({
+			name: 'My API',
+			projectId: 'proj-1',
+			environmentId: 'env-1',
+			appName: 'my-api',
+		});
+		// Pulumi's id is Dokploy's, so state and the Dokploy UI name the same thing.
+		expect(result).toEqual({
+			id: 'app-1',
+			outs: { ...inputs, applicationId: 'app-1', appName: 'my-api' },
+		});
+	});
+
+	it('refreshes from the server, and reports one deleted by hand as gone', async () => {
+		answer('get', 'application.one', () =>
+			HttpResponse.json({ applicationId: 'app-1', appName: 'my-api-2' }),
+		);
+		expect(await provider.read!('app-1', outs)).toEqual({
+			id: 'app-1',
+			props: { ...inputs, applicationId: 'app-1', appName: 'my-api-2' },
+		});
+
+		server.resetHandlers();
+		answer('get', 'application.one', () => HttpResponse.json(null));
+		expect(await provider.read!('app-1', outs)).toEqual({ id: undefined });
+	});
+
+	it('diffs through the same rule preview uses', async () => {
+		expect(
+			await provider.diff!('app-1', outs, { ...inputs, name: 'Gateway' }),
+		).toMatchObject({ changes: true, replaces: ['name'] });
+	});
+
+	it('renames in place, and reports the app name that follows', async () => {
+		const call = answer('post', 'application.update', () =>
+			HttpResponse.json({}),
+		);
+
+		const result = await provider.update!('app-1', outs, {
+			...inputs,
+			name: 'My Api',
+		});
+
+		expect((await call.request()).body).toEqual({
+			applicationId: 'app-1',
+			name: 'My Api',
+		});
+		expect(result).toEqual({
+			outs: {
+				...inputs,
+				name: 'My Api',
+				applicationId: 'app-1',
+				appName: 'my-api',
+			},
+		});
+	});
+
+	it('treats an application that is already gone as deleted', async () => {
+		const call = answer('post', 'application.remove', () =>
+			HttpResponse.text('no such application', {
+				status: 404,
+				statusText: 'Not Found',
+			}),
+		);
+
+		await expect(provider.delete!('app-1', outs)).resolves.toBeUndefined();
+		expect((await call.request()).body).toEqual({ applicationId: 'app-1' });
+	});
+
+	it('fails a delete, or any call, that Dokploy refused for another reason', async () => {
+		answer('post', 'application.remove', () =>
+			HttpResponse.text('database is locked', {
+				status: 500,
+				statusText: 'Internal Server Error',
+			}),
+		);
+		await expect(provider.delete!('app-1', outs)).rejects.toThrow(
+			DokployCallFailed,
+		);
+		await expect(provider.delete!('app-1', outs)).rejects.toMatchObject({
+			path: 'application.remove',
+			status: 500,
+			detail: 'database is locked',
+		});
+
+		server.resetHandlers();
+		answer(
+			'post',
+			'application.create',
+			() => new HttpResponse(null, { status: 401, statusText: 'Unauthorized' }),
+		);
+		await expect(provider.create!(inputs)).rejects.toMatchObject({
+			name: 'DokployCallFailed',
+			status: 401,
+		});
+	});
+
+	/**
+	 * What actually runs: Pulumi serialises the provider into state and the
+	 * deploy runs that text, not this module. Serialisation rewrites
+	 * `DokployCallFailed` into a plain function that drops `Error.prototype` and
+	 * never initialises `message` — which the provider host reports — so this
+	 * runs the serialised provider and checks the error still says something.
+	 */
+	it('still recognises a 404, and reports a failure, once serialised', async () => {
+		const serialised = await runtime.serializeFunction(() => provider, {
+			isFactoryFunction: true,
+		});
+		const module = { exports: {} as Record<string, typeof provider> };
+		runInNewContext(serialised.text, {
+			module,
+			exports: module.exports,
+			require,
+			global: globalThis,
+			fetch: (...args: Parameters<typeof fetch>) => fetch(...args),
+			Error,
+		});
+		const deployed = module.exports[serialised.exportName]!;
+
+		answer('post', 'application.remove', () =>
+			HttpResponse.json({}, { status: 404, statusText: 'Not Found' }),
+		);
+		await expect(deployed.delete!('app-1', outs)).resolves.toBeUndefined();
+
+		server.resetHandlers();
+		answer('post', 'application.remove', () =>
+			HttpResponse.text('database is locked', {
+				status: 500,
+				statusText: 'Internal Server Error',
+			}),
+		);
+		const failure = await deployed.delete!('app-1', outs).catch(
+			(error: unknown) => error as Error & { status: number },
+		);
+		expect(failure).toMatchObject({ name: 'DokployCallFailed', status: 500 });
+		expect(failure?.message).toContain(
+			'Dokploy application.remove failed: 500 Internal Server Error — database is locked',
+		);
+		expect(failure?.stack).toBeTruthy();
+		expect(`${failure}`).toMatch(
+			/^DokployCallFailed: Dokploy application\.remove failed/,
+		);
+	});
+});

package/src/sst/__tests__/api.spec.ts

@@ -0,0 +1,231 @@
+import { describe, expect, it } from 'vitest';
+import { App } from '../App';
+import { Api, RoutesMissingEnvironment } from '../aws/Api';
+import { type GkmLinkable, ResourceType } from '../Linkable';
+
+/**
+ * The HTTP API as data: what it asks SST to route, with which authorizer, and
+ * which links each route gets. SST's `ApiGatewayV2` is a recording stub
+ * (`test/sst-globals.ts`), so no resource is created.
+ */
+
+const stack = new App({
+	name: 'shop',
+	stage: 'prod',
+	domain: 'shop.test',
+	hostedZoneId: 'Z1',
+	region: 'eu-west-1',
+}).stack('api');
+
+const db: GkmLinkable = { _id: 'db', _type: ResourceType.Postgres };
+
+type Recorded = {
+	args: Record<string, unknown>;
+	routes: { key: string; handler: Record<string, unknown>; args: unknown }[];
+	authorizers: Record<string, unknown>[];
+};
+const recorded = (api: Api) => api as unknown as Recorded;
+
+describe('Api', () => {
+	it('routes each entry to its handler, with only the links it needs', () => {
+		const api = new Api(stack, 'Http', {
+			root: 'apps/api',
+			links: [db],
+			environment: { FEATURE: 'on' },
+			cors: { allowOrigins: ['https://shop.test'] },
+			routes: [
+				{
+					method: 'GET',
+					path: '/orders',
+					handler: 'handlers/orders.handler',
+					environment: ['DB_URL', 'FEATURE'],
+				},
+				{
+					method: 'GET',
+					path: '/health',
+					handler: 'handlers/health.handler',
+					runtime: 'nodejs22.x',
+					timeout: '5 seconds',
+					memory: '256 MB',
+				},
+			],
+		});
+		const { args, routes } = recorded(api);
+
+		expect(api._type).toBe(ResourceType.ApiGatewayV2);
+		// Native args pass straight through.
+		expect(args).toEqual({ cors: { allowOrigins: ['https://shop.test'] } });
+		expect(routes.map((r) => r.key)).toEqual(['GET /orders', 'GET /health']);
+
+		const [orders, health] = routes;
+		expect(orders!.handler).toMatchObject({
+			handler: 'apps/api/handlers/orders.handler',
+			runtime: 'nodejs24.x',
+			link: [db],
+			environment: expect.objectContaining({ STAGE: 'prod', FEATURE: 'on' }),
+		});
+		expect(orders!.args).toBeUndefined();
+		// Least privilege: a route that names no link var gets no link.
+		expect(health!.handler).toMatchObject({
+			link: [],
+			runtime: 'nodejs22.x',
+			timeout: '5 seconds',
+			memory: '256 MB',
+		});
+	});
+
+	it('wires each route to the authorizer it names', () => {
+		const lambda = { arn: 'arn:aws:lambda:eu-west-1:1:function:authz' };
+		const api = new Api(stack, 'Http', {
+			authorizers: {
+				jwt: {
+					issuer: 'https://id.shop.test',
+					audiences: ['shop'],
+					scopes: ['read'],
+				},
+				tenant: { handler: lambda as never, payload: '2.0' },
+				key: { handler: 'handlers/key.handler' },
+			},
+			routes: [
+				{ method: 'GET', path: '/a', handler: 'a.h', authorizer: 'jwt' },
+				{
+					method: 'GET',
+					path: '/b',
+					handler: 'b.h',
+					authorizer: 'jwt',
+					scopes: ['write'],
+				},
+				{ method: 'GET', path: '/c', handler: 'c.h', authorizer: 'tenant' },
+				{ method: 'GET', path: '/d', handler: 'd.h', authorizer: 'iam' },
+				{ method: 'GET', path: '/e', handler: 'e.h', authorizer: 'none' },
+				{ method: 'GET', path: '/f', handler: 'f.h' },
+			],
+		} as never);
+		const { routes, authorizers } = recorded(api);
+
+		expect(authorizers).toEqual([
+			{
+				name: 'jwt',
+				jwt: {
+					issuer: 'https://id.shop.test',
+					audiences: ['shop'],
+					identitySource: undefined,
+				},
+			},
+			{
+				name: 'tenant',
+				// A `Function` construct is passed as its ARN.
+				lambda: {
+					function: lambda.arn,
+					identitySources: undefined,
+					payload: '2.0',
+				},
+			},
+			{
+				name: 'key',
+				lambda: {
+					function: 'handlers/key.handler',
+					identitySources: undefined,
+					payload: undefined,
+				},
+			},
+		]);
+		expect(routes.map((r) => r.args)).toEqual([
+			{ auth: { jwt: { authorizer: 'jwt-authorizer-id', scopes: ['read'] } } },
+			// A route's own scopes override the authorizer's defaults.
+			{ auth: { jwt: { authorizer: 'jwt-authorizer-id', scopes: ['write'] } } },
+			{ auth: { lambda: 'tenant-authorizer-id' } },
+			{ auth: { iam: true } },
+			undefined,
+			undefined,
+		]);
+	});
+
+	it('fails the synth, naming every route whose variables no link provides', () => {
+		const build = () =>
+			new Api(stack, 'Http', {
+				links: [db],
+				routes: [
+					{
+						method: 'GET',
+						path: '/ok',
+						handler: 'ok.h',
+						environment: ['DB_URL'],
+					},
+					{
+						method: 'POST',
+						path: '/pay',
+						handler: 'pay.h',
+						environment: ['STRIPE_KEY'],
+					},
+					{
+						method: 'GET',
+						path: '/mail',
+						handler: 'mail.h',
+						environment: ['SMTP_URL'],
+					},
+				],
+			});
+
+		expect(build).toThrow(RoutesMissingEnvironment);
+		expect(build).toThrow(/Http POST \/pay[\s\S]*STRIPE_KEY/);
+		expect(build).toThrow(/Http GET \/mail[\s\S]*SMTP_URL/);
+	});
+
+	it('leaves a route public rather than half-wired when its authorizer was never declared', () => {
+		const api = new Api(stack, 'Http', {
+			routes: [
+				{ method: 'GET', path: '/ghost', handler: 'g.h', authorizer: 'ghost' },
+			],
+		} as never);
+
+		expect(recorded(api).routes[0]!.args).toBeUndefined();
+		expect(recorded(api).authorizers).toEqual([]);
+	});
+});
+
+describe('Api.fromManifest', () => {
+	it('turns built routes, flat or partitioned, into the route table', () => {
+		const routes = {
+			public: [
+				{
+					method: 'GET',
+					path: '/orders',
+					handler: '.gkm/aws-lambda/routes/orders.handler',
+					environment: ['DB_URL'],
+					authorizer: 'iam',
+					timeout: 30,
+					memorySize: 1024,
+				},
+			],
+			internal: [
+				{
+					method: 'POST',
+					path: '/jobs',
+					handler: '.gkm/aws-lambda/routes/jobs.handler',
+					environment: [],
+				},
+			],
+		};
+
+		const api = Api.fromManifest(stack, 'Http', routes as never, {
+			links: [db],
+		});
+		const { routes: recordedRoutes } = recorded(api);
+
+		expect(recordedRoutes.map((r) => r.key)).toEqual([
+			'GET /orders',
+			'POST /jobs',
+		]);
+		expect(recordedRoutes[0]!.handler).toMatchObject({
+			timeout: '30 seconds',
+			memory: '1024 MB',
+			link: [db],
+		});
+		expect(recordedRoutes[0]!.args).toEqual({ auth: { iam: true } });
+		expect(recordedRoutes[1]!.handler).toMatchObject({
+			timeout: undefined,
+			memory: undefined,
+		});
+	});
+});