@geekmidas/cloud 10.0.0-alpha.33 → 10.0.0-alpha.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekmidas/cloud",
-  "version": "10.0.0-alpha.33",
+  "version": "10.0.0-alpha.35",
   "type": "module",
   "files": [
     "dist",
@@ -41,8 +41,8 @@
   },
   "dependencies": {
     "lodash.snakecase": "~4.1.1",
-    "@geekmidas/envkit": "10.0.0-alpha.33",
-    "@geekmidas/manifest": "10.0.0-alpha.33"
+    "@geekmidas/envkit": "10.0.0-alpha.35",
+    "@geekmidas/manifest": "10.0.0-alpha.35"
   },
   "devDependencies": {
     "@types/lodash.get": "~4.4.9",
@@ -58,10 +58,10 @@
     "@pulumi/aws": ">=7.47.0",
     "@pulumi/random": ">=4.21.2",
     "@pulumi/pulumi": ">=3.263.0",
-    "@geekmidas/manifest": "^10.0.0-alpha.33",
-    "@geekmidas/storage": "^10.0.0-alpha.33",
-    "@geekmidas/events": "^10.0.0-alpha.33",
-    "@geekmidas/db": "^10.0.0-alpha.33"
+    "@geekmidas/manifest": "^10.0.0-alpha.35",
+    "@geekmidas/storage": "^10.0.0-alpha.35",
+    "@geekmidas/events": "^10.0.0-alpha.35",
+    "@geekmidas/db": "^10.0.0-alpha.35"
   },
   "peerDependenciesMeta": {
     "@geekmidas/manifest": {

package/src/sst/__tests__/fromManifest.integration.spec.ts

@@ -3,6 +3,7 @@ import {
 	PUBLIC,
 	PUBLIC_PREFIX,
 	providedKeyFor,
+	schemeBase,
 } from '@geekmidas/manifest';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { DatabaseNeedsVpc } from '../aws/Database';
@@ -217,6 +218,37 @@ describe('fromManifest', () => {
 		);
 	});
 
+	it('builds nothing for a mobile app, and has the surfaces it calls trust its scheme', async () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		const provisioned = fromManifest(
+			stack,
+			{
+				...manifest(),
+				App: {
+					kind: 'mobile-app',
+					id: 'App',
+					variant: 'expo',
+					app: { path: 'apps/app' },
+					dependencies: [{ target: 'Auth', kind: 'rest-api' }],
+					provides: ['APP_SCHEME'],
+				},
+			} as ConstructManifest,
+			overrides,
+			{ cache: 'db' },
+		);
+
+		// EAS and the stores ship it — this stack has nothing to create for it.
+		expect(provisioned.App).toBeUndefined();
+		const origins = String(
+			await settle(provisioned.Auth!.provides().trustedOrigins),
+		).split(',');
+		// The bare scheme deployed: the one the store build registers.
+		const scheme = `${schemeBase($app.name)}://`;
+		expect(origins).toContain(scheme);
+		expect(origins).toContain(`${scheme}*`);
+	});
+
 	it('prints every route and exactly what it can reach', () => {
 		const log = vi.spyOn(console, 'log').mockImplementation(() => {});
 

package/src/sst/aws/DatabaseBootstrap.ts

@@ -65,6 +65,8 @@ export class DatabaseBootstrap {
 		runtime: string;
 		owner: string;
 		reader?: string;
+		/** The database's own roles, whose owner may create in it. */
+		ownsDatabase?: boolean;
 	}): { runtime: $util.Output<string>; reader?: $util.Output<string> } {
 		const runtime = this.password(tenant.runtime);
 		const reader = tenant.reader ? this.password(tenant.reader) : undefined;
@@ -75,6 +77,7 @@ export class DatabaseBootstrap {
 			runtime: tenant.runtime,
 			owner: tenant.owner,
 			...(tenant.reader ? { reader: tenant.reader } : {}),
+			...(tenant.ownsDatabase ? { ownsDatabase: true } : {}),
 			// Filled in by `bootstrapEvent` once the outputs resolve. The function
 			// reads them straight out of its input and never fetches a secret, so
 			// it needs no IAM to read one.

package/src/sst/aws/bootstrap/handler.ts

@@ -28,6 +28,11 @@ export interface BootstrapTenant {
 	runtime: string;
 	owner: string;
 	reader?: string;
+	/**
+	 * The database's own roles rather than a tenant's: its owner may create in
+	 * the database, for trusted extensions.
+	 */
+	ownsDatabase?: boolean;
 	passwords: { runtime: string; owner: string; reader?: string };
 }
 
@@ -75,7 +80,11 @@ export async function handler(event: BootstrapEvent): Promise<BootstrapResult> {
 
 	try {
 		for (const tenant of event.tenants) {
-			for (const statement of roleStatements(tenant)) {
+			const spec = {
+				...tenant,
+				...(tenant.ownsDatabase ? { database: event.master.database } : {}),
+			};
+			for (const statement of roleStatements(spec)) {
 				if (statement.exists) {
 					const { rows } = await client.query(
 						statement.exists.sql,

package/src/sst/fromManifest.ts

@@ -26,10 +26,12 @@ import {
 	cookieDomain,
 	DEFAULT_POSTGRES_VERSION,
 	dependentsOf,
+	mobileOrigins,
 	PUBLIC,
 	PUBLIC_PREFIX,
 	providedKeyFor,
 	provisionOrder,
+	schemeBase,
 } from '@geekmidas/manifest';
 import {
 	Cache,
@@ -241,6 +243,7 @@ const PROVISIONERS: Partial<Record<DeclarationKind, Provisioner>> = {
 				schema: d.schema,
 				runtime,
 				owner: ownerRole(runtime),
+				ownsDatabase: true,
 				...(hasReader(d.id, context) ? { reader: readerRole(runtime) } : {}),
 			});
 
@@ -647,6 +650,8 @@ async function callersOf(
 	id: string,
 	manifest: ConstructManifest,
 	provisioned: ProvisionedManifest,
+	/** The app's name — a mobile caller's scheme base when it gives none. */
+	project: string,
 ): Promise<{ trustedOrigins: string; cookieDomain?: string }> {
 	// Every address here is a Pulumi output, not a string — a CloudFront domain
 	// and an API Gateway endpoint are both known only after their resource
@@ -671,8 +676,17 @@ async function callersOf(
 	const own = await resolved(provisioned[id]?.provides().url);
 	const domain = cookieDomain([...(own ? [own] : []), ...origins]);
 
+	// A mobile caller is reached by its scheme — the bare one, deployed: what
+	// the store build registers.
+	const schemes = dependentsOf(manifest, id).flatMap((caller) => {
+		const app = manifest[caller];
+		return app?.kind === 'mobile-app'
+			? mobileOrigins(schemeBase(project, app.scheme))
+			: [];
+	});
+
 	return {
-		trustedOrigins: origins.join(','),
+		trustedOrigins: [...origins, ...schemes].join(','),
 		...(domain ? { cookieDomain: domain } : {}),
 	};
 }
@@ -810,6 +824,10 @@ export function fromManifest(
 	for (const id of [...rest, ...sites]) {
 		const declaration = manifest[id];
 		if (!declaration) continue;
+		// A mobile app ships through EAS and the stores, not this stack. It is
+		// in the manifest for what it makes the surfaces trust, which
+		// `callersOf` reads off the graph.
+		if (declaration.kind === 'mobile-app') continue;
 
 		const component = provisionerFor(declaration.kind)(
 			stack,
@@ -840,7 +858,7 @@ export function fromManifest(
 	for (const [id, deferred] of callers) {
 		// Resolved with the promise itself: the addresses it needs are Pulumi
 		// outputs, so the answer arrives when they do.
-		deferred.resolve(callersOf(id, manifest, provisioned));
+		deferred.resolve(callersOf(id, manifest, provisioned, $app.name));
 	}
 
 	// Last, and only now: the roles exist as passwords and secrets from the