@geekmidas/cloud 10.0.0-alpha.34 → 10.0.0-alpha.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekmidas/cloud",
-  "version": "10.0.0-alpha.34",
+  "version": "10.0.0-alpha.36",
   "type": "module",
   "files": [
     "dist",
@@ -41,8 +41,8 @@
   },
   "dependencies": {
     "lodash.snakecase": "~4.1.1",
-    "@geekmidas/envkit": "10.0.0-alpha.34",
-    "@geekmidas/manifest": "10.0.0-alpha.34"
+    "@geekmidas/envkit": "10.0.0-alpha.36",
+    "@geekmidas/manifest": "10.0.0-alpha.36"
   },
   "devDependencies": {
     "@types/lodash.get": "~4.4.9",
@@ -58,10 +58,10 @@
     "@pulumi/aws": ">=7.47.0",
     "@pulumi/random": ">=4.21.2",
     "@pulumi/pulumi": ">=3.263.0",
-    "@geekmidas/manifest": "^10.0.0-alpha.34",
-    "@geekmidas/storage": "^10.0.0-alpha.34",
-    "@geekmidas/events": "^10.0.0-alpha.34",
-    "@geekmidas/db": "^10.0.0-alpha.34"
+    "@geekmidas/manifest": "^10.0.0-alpha.36",
+    "@geekmidas/storage": "^10.0.0-alpha.36",
+    "@geekmidas/events": "^10.0.0-alpha.36",
+    "@geekmidas/db": "^10.0.0-alpha.36"
   },
   "peerDependenciesMeta": {
     "@geekmidas/manifest": {

package/src/sst/__tests__/fromManifest.integration.spec.ts

@@ -3,6 +3,7 @@ import {
 	PUBLIC,
 	PUBLIC_PREFIX,
 	providedKeyFor,
+	schemeBase,
 } from '@geekmidas/manifest';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { DatabaseNeedsVpc } from '../aws/Database';
@@ -217,6 +218,37 @@ describe('fromManifest', () => {
 		);
 	});
 
+	it('builds nothing for a mobile app, and has the surfaces it calls trust its scheme', async () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		const provisioned = fromManifest(
+			stack,
+			{
+				...manifest(),
+				App: {
+					kind: 'mobile-app',
+					id: 'App',
+					variant: 'expo',
+					app: { path: 'apps/app' },
+					dependencies: [{ target: 'Auth', kind: 'rest-api' }],
+					provides: ['APP_SCHEME'],
+				},
+			} as ConstructManifest,
+			overrides,
+			{ cache: 'db' },
+		);
+
+		// EAS and the stores ship it — this stack has nothing to create for it.
+		expect(provisioned.App).toBeUndefined();
+		const origins = String(
+			await settle(provisioned.Auth!.provides().trustedOrigins),
+		).split(',');
+		// The bare scheme deployed: the one the store build registers.
+		const scheme = `${schemeBase($app.name)}://`;
+		expect(origins).toContain(scheme);
+		expect(origins).toContain(`${scheme}*`);
+	});
+
 	it('prints every route and exactly what it can reach', () => {
 		const log = vi.spyOn(console, 'log').mockImplementation(() => {});
 

package/src/sst/fromManifest.ts

@@ -26,10 +26,12 @@ import {
 	cookieDomain,
 	DEFAULT_POSTGRES_VERSION,
 	dependentsOf,
+	mobileOrigins,
 	PUBLIC,
 	PUBLIC_PREFIX,
 	providedKeyFor,
 	provisionOrder,
+	schemeBase,
 } from '@geekmidas/manifest';
 import {
 	Cache,
@@ -648,6 +650,8 @@ async function callersOf(
 	id: string,
 	manifest: ConstructManifest,
 	provisioned: ProvisionedManifest,
+	/** The app's name — a mobile caller's scheme base when it gives none. */
+	project: string,
 ): Promise<{ trustedOrigins: string; cookieDomain?: string }> {
 	// Every address here is a Pulumi output, not a string — a CloudFront domain
 	// and an API Gateway endpoint are both known only after their resource
@@ -672,8 +676,17 @@ async function callersOf(
 	const own = await resolved(provisioned[id]?.provides().url);
 	const domain = cookieDomain([...(own ? [own] : []), ...origins]);
 
+	// A mobile caller is reached by its scheme — the bare one, deployed: what
+	// the store build registers.
+	const schemes = dependentsOf(manifest, id).flatMap((caller) => {
+		const app = manifest[caller];
+		return app?.kind === 'mobile-app'
+			? mobileOrigins(schemeBase(project, app.scheme))
+			: [];
+	});
+
 	return {
-		trustedOrigins: origins.join(','),
+		trustedOrigins: [...origins, ...schemes].join(','),
 		...(domain ? { cookieDomain: domain } : {}),
 	};
 }
@@ -811,6 +824,10 @@ export function fromManifest(
 	for (const id of [...rest, ...sites]) {
 		const declaration = manifest[id];
 		if (!declaration) continue;
+		// A mobile app ships through EAS and the stores, not this stack. It is
+		// in the manifest for what it makes the surfaces trust, which
+		// `callersOf` reads off the graph.
+		if (declaration.kind === 'mobile-app') continue;
 
 		const component = provisionerFor(declaration.kind)(
 			stack,
@@ -841,7 +858,7 @@ export function fromManifest(
 	for (const [id, deferred] of callers) {
 		// Resolved with the promise itself: the addresses it needs are Pulumi
 		// outputs, so the answer arrives when they do.
-		deferred.resolve(callersOf(id, manifest, provisioned));
+		deferred.resolve(callersOf(id, manifest, provisioned, $app.name));
 	}
 
 	// Last, and only now: the roles exist as passwords and secrets from the