@geekmidas/cloud 10.0.0-alpha.4 → 10.0.0-alpha.41

package/src/sst/__tests__/fromManifest.integration.spec.ts

@@ -0,0 +1,427 @@
+import {
+	type ConstructManifest,
+	PUBLIC,
+	PUBLIC_PREFIX,
+	providedKeyFor,
+	schemeBase,
+} from '@geekmidas/manifest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { DatabaseNeedsVpc } from '../aws/Database';
+import { EmailNeedsSender } from '../aws/Email';
+import { CacheIsAmbiguous, ProvidesMismatch } from '../errors';
+import { describeRoutes, fromManifest } from '../fromManifest';
+
+/**
+ * A whole manifest through the adapter: every kind provisioned in order,
+ * each checked against the keys it declared, the site built against its API's
+ * address, and each surface told who calls it. SST's components are recording
+ * stubs (`test/sst-globals.ts`), so this runs without a deploy.
+ */
+
+const stack = {} as never;
+const vpc = { subnets: ['subnet-1'], securityGroups: ['sg-1'] } as never;
+
+const keys = (id: string, kind: string, roles: string[]) =>
+	roles.map((role) => providedKeyFor(id, kind as never, role));
+const SURFACE = ['url', 'trustedOrigins', 'cookieDomain'];
+
+function manifest(): ConstructManifest {
+	return {
+		Uploads: {
+			kind: 'objects',
+			id: 'Uploads',
+			versioned: true,
+			provides: keys('Uploads', 'objects', ['url']),
+		},
+		Files: {
+			kind: 'file-server',
+			id: 'Files',
+			of: 'Uploads',
+			provides: keys('Files', 'file-server', ['url']),
+		},
+		Emails: {
+			kind: 'queue',
+			id: 'Emails',
+			fifo: true,
+			provides: keys('Emails', 'queue', ['publisherConnectionString']),
+			// The queue's one consumer, as the build folds it in.
+			worker: {
+				id: 'EmailsWorker',
+				handler: '.gkm/aws-lambda/queues/emails.handler',
+				dependencies: [{ target: 'Uploads', kind: 'objects' }],
+			},
+		},
+		Users: {
+			kind: 'topic',
+			id: 'Users',
+			provides: keys('Users', 'topic', ['publisherConnectionString']),
+		},
+		Orders: {
+			kind: 'database',
+			id: 'Orders',
+			engine: 'postgres',
+			provides: keys('Orders', 'database', ['url']),
+		},
+		OrdersReader: {
+			kind: 'database-reader',
+			id: 'OrdersReader',
+			of: 'Orders',
+			provides: keys('OrdersReader', 'database-reader', ['url']),
+		},
+		Sessions: {
+			kind: 'cache',
+			id: 'Sessions',
+			provides: keys('Sessions', 'cache', ['url']),
+		},
+		Api: {
+			kind: 'rest-api',
+			id: 'Api',
+			path: 'apps/api',
+			endpoints: [
+				{
+					id: 'ListOrders',
+					handler: 'orders.handler',
+					method: 'GET',
+					path: '/orders',
+					dependencies: [{ target: 'Orders', kind: 'database' }],
+				},
+				{
+					id: 'Health',
+					handler: 'health.handler',
+					method: 'GET',
+					path: '/health',
+					dependencies: [],
+				},
+			],
+			calls: [{ target: 'Auth', kind: 'rest-api' }],
+			provides: keys('Api', 'rest-api', SURFACE),
+		},
+		Auth: {
+			kind: 'rest-api',
+			id: 'Auth',
+			path: 'apps/auth',
+			endpoints: [],
+			provides: keys('Auth', 'rest-api', SURFACE),
+		},
+		Web: {
+			kind: 'site',
+			id: 'Web',
+			variant: 'static',
+			app: { path: 'apps/web' },
+			dependencies: [
+				{ target: 'Api', kind: 'rest-api' },
+				{ target: 'Users', kind: 'topic' },
+			],
+			provides: keys('Web', 'site', ['url']),
+		},
+		Mail: {
+			kind: 'email',
+			id: 'Mail',
+			provides: keys('Mail', 'email', ['url', 'from']),
+		},
+		AuthSecret: {
+			kind: 'secret',
+			id: 'AuthSecret',
+			provides: keys('AuthSecret', 'secret', ['value']),
+		},
+	} as unknown as ConstructManifest;
+}
+
+const overrides = {
+	Orders: { vpc },
+	Mail: { from: 'hello@shop.test', url: 'smtp://relay.test:587' },
+};
+
+const argsOf = (component: unknown) =>
+	(component as { args: Record<string, unknown> }).args;
+
+/** A Pulumi-ish input as the value it resolves to. */
+const settle = async (value: unknown): Promise<unknown> =>
+	typeof value === 'object' && value && 'apply' in value
+		? (value as { apply: (fn: (v: unknown) => unknown) => unknown }).apply(
+				(v) => v,
+			)
+		: value;
+
+describe('fromManifest', () => {
+	afterEach(() => vi.restoreAllMocks());
+
+	it('provisions every declaration, each supplying exactly what it declared', () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		const provisioned = fromManifest(stack, manifest(), overrides, {
+			cache: 'db',
+			email: 'smtp',
+		});
+
+		expect(Object.keys(provisioned).sort()).toEqual(
+			Object.keys(manifest()).sort(),
+		);
+	});
+
+	it('maps each declaration’s options onto its component', () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		const provisioned = fromManifest(stack, manifest(), overrides, {
+			cache: 'db',
+			email: 'smtp',
+		});
+
+		// A bucket something serves lets CloudFront read it; its declared
+		// versioning is carried in this provider's word for it.
+		expect(argsOf(provisioned.Uploads)).toMatchObject({
+			versioning: true,
+			access: 'cloudfront',
+		});
+		expect(argsOf(provisioned.Emails)).toMatchObject({ fifo: true });
+		// The declared Postgres major, not whatever the default is that month.
+		expect(argsOf(provisioned.Orders)).toMatchObject({ vpc, version: '18' });
+	});
+
+	it('subscribes each queue’s one consumer, linked to the queue and what it reaches', () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		const provisioned = fromManifest(stack, manifest(), overrides, {
+			cache: 'db',
+			email: 'smtp',
+		});
+		const { subscribed } = provisioned.Emails as unknown as {
+			subscribed: { subscriber: { handler: string; link: unknown[] } }[];
+		};
+
+		expect(subscribed).toHaveLength(1);
+		expect(subscribed[0]?.subscriber.handler).toBe(
+			'.gkm/aws-lambda/queues/emails.handler',
+		);
+		expect(subscribed[0]?.subscriber.link).toEqual([
+			provisioned.Emails,
+			provisioned.Uploads,
+		]);
+	});
+
+	it('builds the site against the addresses its edges resolve to', () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		const provisioned = fromManifest(stack, manifest(), overrides, {
+			cache: 'db',
+		});
+		const env = argsOf(provisioned.Web).environment as Record<string, unknown>;
+
+		const apiKey = `${PUBLIC_PREFIX.static}${providedKeyFor('Api', 'rest-api', 'url')}`;
+		expect(env[apiKey]).toBe(provisioned.Api!.provides().url);
+		// A topic has nothing a browser may see, so the site gets nothing from it.
+		expect(PUBLIC.topic ?? []).toEqual([]);
+		expect(Object.keys(env)).toEqual([apiKey]);
+	});
+
+	it('keeps a db-backed cache in the declared database, in its own table', async () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		const provisioned = fromManifest(stack, manifest(), overrides, {
+			cache: 'db',
+		});
+		const url = String(await settle(provisioned.Sessions!.provides().url));
+
+		expect(url).toContain('db.stub.rds.amazonaws.com');
+		expect(url).toMatch(/sessions/i);
+	});
+
+	it('tells each surface who calls it once everything exists', async () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		const provisioned = fromManifest(stack, manifest(), overrides, {
+			cache: 'db',
+		});
+		const origin = (id: string) =>
+			new URL(String(provisioned[id]!.provides().url)).origin;
+
+		// The site depends on the API, so its origin is on the API's list.
+		expect(await settle(provisioned.Api!.provides().trustedOrigins)).toContain(
+			origin('Web'),
+		);
+		// The API calls the auth server, so it is on the auth server's list.
+		expect(await settle(provisioned.Auth!.provides().trustedOrigins)).toContain(
+			origin('Api'),
+		);
+	});
+
+	it('builds nothing for a mobile app, and has the surfaces it calls trust its scheme', async () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		const provisioned = fromManifest(
+			stack,
+			{
+				...manifest(),
+				App: {
+					kind: 'mobile-app',
+					id: 'App',
+					variant: 'expo',
+					app: { path: 'apps/app' },
+					dependencies: [{ target: 'Auth', kind: 'rest-api' }],
+					provides: ['APP_SCHEME'],
+				},
+			} as ConstructManifest,
+			overrides,
+			{ cache: 'db' },
+		);
+
+		// EAS and the stores ship it — this stack has nothing to create for it.
+		expect(provisioned.App).toBeUndefined();
+		const origins = String(
+			await settle(provisioned.Auth!.provides().trustedOrigins),
+		).split(',');
+		// The bare scheme deployed: the one the store build registers.
+		const scheme = `${schemeBase($app.name)}://`;
+		expect(origins).toContain(scheme);
+		expect(origins).toContain(`${scheme}*`);
+	});
+
+	it('prints every route and exactly what it can reach', () => {
+		const log = vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		fromManifest(stack, manifest(), overrides, { cache: 'db' });
+
+		expect(log.mock.calls.map(([line]) => line)).toEqual(
+			describeRoutes(manifest()),
+		);
+		expect(describeRoutes(manifest())).toEqual([
+			'Api:',
+			'  GET /orders → Orders (database)',
+			'  GET /health → nothing',
+			'  calls Auth (origin only; grants nothing)',
+			'Auth:',
+			'  (no routes)',
+		]);
+	});
+
+	describe('schema tenants', () => {
+		const tenants = (roles?: false) =>
+			({
+				Orders: {
+					kind: 'database',
+					id: 'Orders',
+					engine: 'postgres',
+					schema: 'app',
+					...(roles === false ? { roles: false } : {}),
+					provides: keys('Orders', 'database', ['url']),
+				},
+				OrdersReader: {
+					kind: 'database-reader',
+					id: 'OrdersReader',
+					of: 'Orders',
+					provides: keys('OrdersReader', 'database-reader', ['url']),
+				},
+				AuthDb: {
+					kind: 'database-schema',
+					id: 'AuthDb',
+					of: 'Orders',
+					schema: 'authdb',
+					provides: keys('AuthDb', 'database-schema', ['url']),
+				},
+				// A tenant of a tenant still lives in the one cluster.
+				AuditDb: {
+					kind: 'database-schema',
+					id: 'AuditDb',
+					of: 'AuthDb',
+					schema: 'audit',
+					provides: keys('AuditDb', 'database-schema', ['url']),
+				},
+			}) as unknown as ConstructManifest;
+
+		it('gives each tenant its own role, and the reader the database’s read-only one', async () => {
+			vi.spyOn(console, 'log').mockImplementation(() => {});
+
+			const provisioned = fromManifest(stack, tenants(), { Orders: { vpc } });
+			const url = async (id: string) =>
+				String(await settle(provisioned[id]!.provides().url));
+
+			// Each connects as its own role, never the master.
+			expect(await url('AuthDb')).toContain('authdb:');
+			expect(await url('AuditDb')).toContain('auditdb:');
+			expect(await url('OrdersReader')).toContain('orders_reader:');
+			expect(await url('Orders')).not.toContain('postgres:stub-password');
+		});
+
+		it('falls back to the master everywhere under roles: false', async () => {
+			vi.spyOn(console, 'log').mockImplementation(() => {});
+
+			const provisioned = fromManifest(stack, tenants(false), {
+				Orders: { vpc },
+			});
+
+			expect(
+				String(await settle(provisioned.AuthDb!.provides().url)),
+			).toContain('postgres:stub-password');
+		});
+	});
+
+	it('takes an existing cache and mailer rather than creating them', async () => {
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+		const provisioned = fromManifest(
+			stack,
+			manifest(),
+			{
+				...overrides,
+				Sessions: { url: 'https://:token@cache.upstash.test' },
+				Mail: { ...overrides.Mail, region: 'af-south-1' },
+			},
+			{ cache: 'upstash', email: 'ses' },
+		);
+
+		expect(await settle(provisioned.Sessions!.provides().url)).toBe(
+			'https://:token@cache.upstash.test',
+		);
+		expect(provisioned.Mail!.provides().url).toBe('smtp://relay.test:587');
+	});
+
+	describe('refuses', () => {
+		it('a database with no VPC to live in', () => {
+			expect(() =>
+				fromManifest(
+					stack,
+					manifest(),
+					{ Mail: overrides.Mail },
+					{ cache: 'db' },
+				),
+			).toThrow(DatabaseNeedsVpc);
+		});
+
+		it('a mailer with no sending identity', () => {
+			expect(() =>
+				fromManifest(stack, manifest(), { Orders: { vpc } }, { cache: 'db' }),
+			).toThrow(EmailNeedsSender);
+		});
+
+		it('a db-backed cache when two databases could hold it', () => {
+			const two = {
+				...manifest(),
+				Billing: {
+					kind: 'database',
+					id: 'Billing',
+					engine: 'postgres',
+					provides: keys('Billing', 'database', ['url']),
+				},
+			} as unknown as ConstructManifest;
+
+			expect(() =>
+				fromManifest(
+					stack,
+					two,
+					{ ...overrides, Billing: { vpc } },
+					{ cache: 'db' },
+				),
+			).toThrow(CacheIsAmbiguous);
+		});
+
+		it('a component supplying keys the declaration did not name', () => {
+			const drifted = {
+				...manifest(),
+				Users: { ...manifest().Users, provides: [] },
+			} as unknown as ConstructManifest;
+
+			expect(() =>
+				fromManifest(stack, drifted, overrides, { cache: 'db' }),
+			).toThrow(ProvidesMismatch);
+		});
+	});
+});

package/src/sst/__tests__/fromManifest.spec.ts

@@ -1,13 +1,15 @@
 import { resolveEnvKeys } from '@geekmidas/envkit/sst';
-import { providedKeyFor, provideKey } from '@geekmidas/manifest';
+import { NoUrlForStage, providedKeyFor, provideKey } from '@geekmidas/manifest';
 import { describe, expect, it } from 'vitest';
 import { ObjectStorage } from '../aws/ObjectStorage';
 import { type ProvidesMismatch, UnknownDeclarationKind } from '../errors';
 import {
 	assertProvides,
+	PROVISIONED_ELSEWHERE,
 	type ProvisionedManifest,
 	provisionerFor,
 	resolveEdges,
+	subscribeConsumers,
 } from '../fromManifest';
 
 /**
@@ -249,18 +251,152 @@ describe('the key a provided role becomes', () => {
 describe('Credential', () => {
 	it('provides under the role the declaration named', async () => {
 		// The role *is* the contract: providing `value` against a declared
-		// `STRIPE_CREDENTIAL` supplies `STRIPE_VALUE`, and assertProvides
+		// `STRIPE_CREDENTIALS` supplies `STRIPE_VALUE`, and assertProvides
 		// rejects the stack at synth. Which is the check working.
 		const { Credential } = await import('../aws/Credential');
 
 		expect(
 			Object.keys(new Credential({} as never, 'Stripe').provides()),
-		).toEqual(['credential']);
+		).toEqual(['credentials']);
 	});
 
 	it('agrees with what the construct declares', () => {
-		expect(providedKeyFor('Stripe', 'credential', 'credential')).toBe(
-			'STRIPE_CREDENTIAL',
+		expect(providedKeyFor('Stripe', 'credential', 'credentials')).toBe(
+			'STRIPE_CREDENTIALS',
 		);
 	});
+
+	it('links under the key the construct reads, not the secret’s bare name', async () => {
+		const { Credential } = await import('../aws/Credential');
+		const stripe = new Credential({} as never, 'Stripe');
+
+		expect(resolveEnvKeys({ Stripe: { type: stripe._type } })).toEqual([
+			'STRIPE_CREDENTIALS',
+		]);
+		expect(stripe.getSSTLink().properties).toEqual(stripe.provides());
+	});
+
+	it('is what a function depending on it is linked to', async () => {
+		const { Credential } = await import('../aws/Credential');
+		const stripe = new Credential({} as never, 'Stripe');
+
+		const { link, envKeys } = resolveEdges(
+			[{ target: 'Stripe', kind: 'credential' }],
+			{ Stripe: stripe },
+		);
+
+		expect(link).toEqual([stripe]);
+		expect(envKeys).toEqual(['STRIPE_CREDENTIALS']);
+	});
+});
+
+describe('ExternalApi', () => {
+	const stack = (stage: string) => ({ stage }) as never;
+
+	it('provides the URL for its stage and its credentials, under the declared keys', async () => {
+		const { ExternalApi } = await import('../aws/ExternalApi');
+		const payfast = new ExternalApi(stack('production'), 'PayFast', {
+			url: {
+				production: 'https://www.payfast.co.za',
+				default: 'https://sandbox.payfast.co.za',
+			},
+		});
+
+		expect(payfast.provides().url).toBe('https://www.payfast.co.za');
+		expect(
+			Object.keys(payfast.provides()).map((role) =>
+				providedKeyFor('PayFast', 'external-api', role),
+			),
+		).toEqual(['PAY_FAST_URL', 'PAY_FAST_CREDENTIALS']);
+	});
+
+	it('falls back to the default URL for a stage it does not name', async () => {
+		const { ExternalApi } = await import('../aws/ExternalApi');
+		const payfast = new ExternalApi(stack('staging'), 'PayFast', {
+			url: {
+				production: 'https://www.payfast.co.za',
+				default: 'https://sandbox.payfast.co.za',
+			},
+		});
+
+		expect(payfast.provides().url).toBe('https://sandbox.payfast.co.za');
+	});
+
+	it('fails synth for a stage it has no URL for', async () => {
+		const { ExternalApi } = await import('../aws/ExternalApi');
+
+		expect(
+			() =>
+				new ExternalApi(stack('staging'), 'PayFast', {
+					url: { production: 'https://www.payfast.co.za' },
+				}),
+		).toThrow(NoUrlForStage);
+	});
+
+	it('flattens into the same keys at runtime', () => {
+		expect(
+			resolveEnvKeys({ PayFast: { type: 'gkm:aws:ExternalApi' } }).sort(),
+		).toEqual(['PAY_FAST_CREDENTIALS', 'PAY_FAST_URL']);
+	});
+});
+
+describe('a queue’s one consumer', () => {
+	it('is subscribed from the handler the build wrote, linked to what it depends on', () => {
+		const consumed: { handler: string; link?: unknown[] }[] = [];
+		const uploads = { _id: 'Uploads', _type: 'sst.aws.Bucket' };
+		const provisioned = {
+			Uploads: uploads,
+			Emails: {
+				_id: 'Emails',
+				_type: 'sst.aws.Queue',
+				consume: (consumer: { handler: string; link?: unknown[] }) =>
+					consumed.push(consumer),
+			},
+		} as unknown as ProvisionedManifest;
+
+		subscribeConsumers(
+			{
+				Uploads: { kind: 'objects', id: 'Uploads', provides: ['UPLOADS_URL'] },
+				Emails: {
+					kind: 'queue',
+					id: 'Emails',
+					provides: ['EMAILS_PUBLISHER_CONNECTION_STRING'],
+					worker: {
+						id: 'EmailsWorker',
+						handler: '.gkm/aws-lambda/queues/emails.handler',
+						dependencies: [{ target: 'Uploads', kind: 'objects' }],
+					},
+				},
+			} as never,
+			provisioned,
+		);
+
+		expect(consumed).toEqual([
+			{ handler: '.gkm/aws-lambda/queues/emails.handler', link: [uploads] },
+		]);
+	});
+
+	it('subscribes through SST, with the queue itself linked', async () => {
+		const { Queue } = await import('../aws/Queue');
+		const queue = new Queue({} as never, 'Emails');
+
+		queue.consume({ handler: 'emails.handler', link: [], batchSize: 5 });
+
+		const [{ subscriber, args }] = (
+			queue as unknown as { subscribed: { subscriber: any; args: unknown }[] }
+		).subscribed;
+		expect(subscriber.handler).toBe('emails.handler');
+		expect(subscriber.link).toEqual([queue]);
+		expect(args).toEqual({ batch: { size: 5 } });
+	});
+});
+
+describe('kinds provisioned elsewhere', () => {
+	it('skips a worker, which is a process rather than a resource', () => {
+		// A worker in the manifest used to throw UnknownDeclarationKind at synth,
+		// so any app with background work could not be deployed to AWS at all.
+		expect(PROVISIONED_ELSEWHERE.has('worker')).toBe(true);
+		expect(PROVISIONED_ELSEWHERE.has('mobile-app')).toBe(true);
+		expect(PROVISIONED_ELSEWHERE.has('queue')).toBe(false);
+	});
 });