@genoacms/adapter-gcp 0.8.2-1 → 0.9.0

package/dist/secrets/runtime.js

@@ -0,0 +1,147 @@
+import { defineRuntime } from '@genoacms/contracts';
+import { assertValidSecretKey } from '@genoacms/contracts/secrets';
+import { SecretManagerServiceClient } from '@google-cloud/secret-manager';
+/**
+ * The GenoaCMS `secrets` service backed by GCP Secret Manager.
+ *
+ * Secret Manager is versioned; this contract is not. Writes add a version and reads always take
+ * `latest`, so version history exists but is never consulted. That is deliberate — building the
+ * contract on a provider-specific behavior would leave the abstraction unimplementable elsewhere.
+ * `setSecret` therefore destroys the versions it supersedes (architecture GD4). Secrets created here
+ * keep a destroyed version disabled for seven days before it is gone, so a bad overwrite can be undone
+ * by hand.
+ */
+export default defineRuntime({
+    create({ projectId, credentials }) {
+        const client = new SecretManagerServiceClient({
+            projectId,
+            ...(credentials === undefined ? {} : { credentials })
+        });
+        const GRPC_NOT_FOUND = 5;
+        const GRPC_ALREADY_EXISTS = 6;
+        const parent = `projects/${projectId}`;
+        const secretName = (key) => `${parent}/secrets/${key}`;
+        const latestVersionName = (key) => `${secretName(key)}/versions/latest`;
+        // SEC-7, GD4
+        const VERSION_DESTROY_TTL = { seconds: 7 * 24 * 60 * 60 };
+        // SEC-7
+        const newSecret = () => ({ replication: { automatic: {} }, versionDestroyTtl: VERSION_DESTROY_TTL });
+        // SEC-8, SEC-9
+        function versionNumber(name) {
+            const number = Number(name.split('/').at(-1));
+            if (!Number.isInteger(number) || number < 1)
+                throw new Error(`secrets/unexpected-version-name: ${name}`);
+            return number;
+        }
+        // SEC-8
+        async function destroySuperseded(key, added) {
+            const addedNumber = versionNumber(added);
+            const [versions] = await client.listSecretVersions({ parent: secretName(key), filter: 'state:ENABLED' });
+            for (const version of versions) {
+                if (typeof version.name === 'string' && versionNumber(version.name) < addedNumber) {
+                    await client.destroySecretVersion({ name: version.name });
+                }
+            }
+        }
+        // SEC-9, GD4
+        async function cleanUp(key, added) {
+            try {
+                await destroySuperseded(key, added);
+            }
+            catch (error) {
+                console.warn(`secrets/cleanup-failed: ${key}: ${error.message}`);
+            }
+        }
+        function hasStatusCode(error, code) {
+            return typeof error === 'object' && error !== null && error.code === code;
+        }
+        // SEC-5
+        async function ensureSecretExists(key) {
+            try {
+                await client.getSecret({ name: secretName(key) });
+            }
+            catch (error) {
+                if (!hasStatusCode(error, GRPC_NOT_FOUND))
+                    throw error;
+                try {
+                    await client.createSecret({
+                        parent,
+                        secretId: key,
+                        secret: newSecret()
+                    });
+                }
+                catch (createError) {
+                    if (!hasStatusCode(createError, GRPC_ALREADY_EXISTS))
+                        throw createError;
+                }
+            }
+        }
+        // SEC-3, SEC-4
+        const getSecret = async (key) => {
+            assertValidSecretKey(key);
+            try {
+                const [version] = await client.accessSecretVersion({ name: latestVersionName(key) });
+                const data = version.payload?.data;
+                if (data === null || data === undefined)
+                    return undefined;
+                return typeof data === 'string' ? data : Buffer.from(data).toString('utf-8');
+            }
+            catch (error) {
+                if (hasStatusCode(error, GRPC_NOT_FOUND))
+                    return undefined;
+                throw error;
+            }
+        };
+        const setSecret = async (key, value) => {
+            assertValidSecretKey(key);
+            await ensureSecretExists(key);
+            const [version] = await client.addSecretVersion({
+                parent: secretName(key),
+                payload: { data: Buffer.from(value, 'utf-8') }
+            });
+            if (typeof version.name === 'string')
+                await cleanUp(key, version.name);
+            return true;
+        };
+        // SEC-6, SEC-10
+        const setSecretIfAbsent = async (key, value) => {
+            assertValidSecretKey(key);
+            try {
+                await client.createSecret({
+                    parent,
+                    secretId: key,
+                    secret: newSecret()
+                });
+            }
+            catch (error) {
+                if (hasStatusCode(error, GRPC_ALREADY_EXISTS))
+                    return false;
+                throw error;
+            }
+            await client.addSecretVersion({
+                parent: secretName(key),
+                payload: { data: Buffer.from(value, 'utf-8') }
+            });
+            return true;
+        };
+        // SEC-11
+        const deleteSecret = async (key) => {
+            assertValidSecretKey(key);
+            try {
+                await client.deleteSecret({ name: secretName(key) });
+                return true;
+            }
+            catch (error) {
+                if (hasStatusCode(error, GRPC_NOT_FOUND))
+                    return false;
+                throw error;
+            }
+        };
+        return {
+            getSecret,
+            setSecret,
+            deleteSecret,
+            setSecretIfAbsent
+        };
+    }
+});

package/dist/shared/serviceAccount.d.ts

@@ -0,0 +1,16 @@
+/** The fields of a Google service-account key file that the client libraries read. */
+export interface ServiceAccount {
+    type: string;
+    project_id: string;
+    private_key_id: string;
+    private_key: string;
+    client_email: string;
+    client_id: string;
+    auth_uri?: string;
+    token_uri?: string;
+    auth_provider_x509_cert_url?: string;
+    client_x509_cert_url?: string;
+    universe_domain?: string;
+}
+export declare function unknownOptions(options: unknown, allowed: readonly string[]): string[];
+export declare function requireString(options: unknown, key: string): string[];

package/dist/shared/serviceAccount.js

@@ -0,0 +1,12 @@
+const asRecord = (options) => typeof options === 'object' && options !== null ? options : {};
+// COM-2
+export function unknownOptions(options, allowed) {
+    return Object.keys(asRecord(options))
+        .filter(key => !allowed.includes(key))
+        .map(key => `unknown option '${key}'`);
+}
+// COM-3
+export function requireString(options, key) {
+    const value = asRecord(options)[key];
+    return typeof value === 'string' && value !== '' ? [] : [`${key} is required and must be a non-empty string`];
+}

package/dist/storage/descriptor.d.ts

@@ -0,0 +1,14 @@
+import { type Secret } from '@genoacms/contracts';
+import { type ServiceAccount } from '../shared/serviceAccount.js';
+export interface GcpStorageOptions {
+    projectId: string;
+    /** Omitted: Application Default Credentials, i.e. the runtime's own identity. */
+    credentials?: Secret<ServiceAccount>;
+}
+declare module '@genoacms/contracts' {
+    interface StorageAdapters {
+        '@genoacms/adapter-gcp/storage': GcpStorageOptions;
+    }
+}
+declare const _default: import("@genoacms/contracts").AdapterDescriptor<"storage", GcpStorageOptions>;
+export default _default;

package/dist/storage/descriptor.js

@@ -0,0 +1,7 @@
+import { defineStorageAdapter } from '@genoacms/contracts';
+import { unknownOptions, requireString } from '../shared/serviceAccount.js';
+export default defineStorageAdapter({
+    runtime: '@genoacms/adapter-gcp/storage/runtime',
+    secretOptions: { credentials: 'json' },
+    validate: options => [...unknownOptions(options, ['projectId', 'credentials']), ...requireString(options, 'projectId')]
+});

package/dist/storage/runtime.d.ts

@@ -0,0 +1,8 @@
+import type { Adapter } from '@genoacms/contracts/storage';
+import type { GcpStorageOptions } from './descriptor.js';
+/**
+ * One GCS provider. Each construction owns its client and its credential, so two providers on this
+ * adapter — two GCP projects — never share either.
+ */
+declare const _default: import("@genoacms/contracts").AdapterRuntime<GcpStorageOptions, Adapter>;
+export default _default;

package/dist/storage/runtime.js

@@ -0,0 +1,178 @@
+import { defineRuntime } from '@genoacms/contracts';
+import { PreconditionFailedError } from '@genoacms/contracts/storage';
+import { Storage } from '@google-cloud/storage';
+const HTTP_PRECONDITION_FAILED = 412;
+const DELETE_CONCURRENCY = 10;
+// STO-9, GF21
+function requestedResults(limit, startAfter) {
+    return limit !== undefined && startAfter !== undefined ? limit + 1 : limit;
+}
+// STO-9
+const byUtf8Bytes = (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b));
+// STO-9
+function firstByName(names, limit) {
+    const sorted = [...names].sort(byUtf8Bytes);
+    return new Set(limit === undefined ? sorted : sorted.slice(0, limit));
+}
+// STO-11, GF29
+async function deleteAtMost(concurrency, files) {
+    let next = 0;
+    let failure;
+    const work = async () => {
+        while (failure === undefined && next < files.length) {
+            const file = files[next++];
+            try {
+                await file.delete();
+            }
+            catch (error) {
+                failure ??= { error };
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, files.length) }, work));
+    if (failure !== undefined)
+        throw failure.error;
+}
+/**
+ * One GCS provider. Each construction owns its client and its credential, so two providers on this
+ * adapter — two GCP projects — never share either.
+ */
+export default defineRuntime({
+    create({ projectId, credentials }, ctx) {
+        const storage = new Storage(credentials === undefined ? { projectId } : { projectId, credentials });
+        const registered = new Set(ctx.resources);
+        const getBucket = (name) => {
+            if (!registered.has(name))
+                throw new Error('bucket-unregistered');
+            return storage.bucket(name);
+        };
+        // STO-4
+        const getObject = async ({ bucket, name }) => {
+            const bucketInstance = getBucket(bucket);
+            const file = bucketInstance.file(name);
+            let version;
+            try {
+                const [metadata] = await file.getMetadata();
+                version = metadata.generation === undefined ? undefined : String(metadata.generation);
+            }
+            catch {
+                version = undefined;
+            }
+            return {
+                data: file.createReadStream(),
+                version
+            };
+        };
+        const getPublicURL = async ({ bucket, name }) => {
+            const bucketInstance = getBucket(bucket);
+            const file = bucketInstance.file(name);
+            return file.publicUrl();
+        };
+        const getSignedURL = async ({ bucket, name }, expires) => {
+            const bucketInstance = getBucket(bucket);
+            const file = bucketInstance.file(name);
+            const [url] = await file.getSignedUrl({
+                action: 'read',
+                expires
+            });
+            return url;
+        };
+        const uploadObject = async ({ bucket, name }, stream, options) => {
+            const bucketInstance = getBucket(bucket);
+            const file = bucketInstance.file(name);
+            const { ifVersion, ifAbsent, ...saveOptions } = options ?? {};
+            // STO-6
+            const generation = ifAbsent === true ? 0 : ifVersion === undefined ? undefined : Number(ifVersion);
+            try {
+                await file.save(stream, generation === undefined
+                    ? saveOptions
+                    : { ...saveOptions, preconditionOpts: { ifGenerationMatch: generation } });
+            }
+            catch (error) {
+                if (error.code === HTTP_PRECONDITION_FAILED) {
+                    throw new PreconditionFailedError({ bucket, name }, ifAbsent === true
+                        ? 'object already exists'
+                        : 'object changed since it was read');
+                }
+                throw error;
+            }
+        };
+        const moveObject = async ({ bucket, name }, newName) => {
+            const bucketInstance = getBucket(bucket);
+            const file = bucketInstance.file(name);
+            await file.move(newName);
+        };
+        const deleteObject = async ({ bucket, name }) => {
+            const bucketInstance = getBucket(bucket);
+            const file = bucketInstance.file(name);
+            await file.delete();
+        };
+        const listDirectory = async ({ bucket, name }, listingParams = {}) => {
+            const bucketInstance = getBucket(bucket);
+            const options = {
+                autoPaginate: false,
+                prefix: name,
+                maxResults: requestedResults(listingParams?.limit, listingParams?.startAfter),
+                startOffset: listingParams?.startAfter,
+                delimiter: '/'
+            };
+            let [files, , apiResponse] = (await bucketInstance.getFiles(options));
+            files = files.filter((file) => !file.name.endsWith('.folderPlaceholder'));
+            // STO-9, GF21
+            const skipped = (itemName) => itemName === name || itemName === listingParams?.startAfter;
+            files = files.filter(f => !skipped(f.name));
+            const prefixes = (apiResponse?.prefixes ?? []).filter((item) => !skipped(item));
+            const kept = firstByName([...files.map(f => f.name), ...prefixes], listingParams?.limit);
+            return {
+                files: files.filter(f => kept.has(f.name)).map((file) => {
+                    return {
+                        name: file.name,
+                        // eslint-disable-next-line @typescript-eslint/strict-boolean-expressions
+                        size: file.metadata.size ? parseInt(file.metadata.size) : 0,
+                        lastModified: new Date(file.metadata.updated)
+                    };
+                }),
+                directories: prefixes.filter((item) => kept.has(item)).map(i => {
+                    const object = {
+                        bucket,
+                        name: i
+                    };
+                    return object;
+                })
+            };
+        };
+        const createDirectory = async ({ bucket, name }) => {
+            const bucketInstance = getBucket(bucket);
+            const file = bucketInstance.file(`${name}/.folderPlaceholder`);
+            await file.save('');
+        };
+        // STO-11, GD7, GF29
+        const deleteDirectory = async ({ bucket, name }) => {
+            const bucketInstance = getBucket(bucket);
+            let query = { prefix: name, autoPaginate: false };
+            while (query !== undefined) {
+                const [files, nextQuery] = await bucketInstance.getFiles(query);
+                await deleteAtMost(DELETE_CONCURRENCY, files);
+                query = nextQuery ?? undefined;
+            }
+        };
+        // STO-12, GD7, GF22
+        const moveDirectory = async ({ bucket, name }, newName) => {
+            const [files] = await getBucket(bucket).getFiles({ prefix: name });
+            for (const file of files)
+                await file.move(newName + file.name.slice(name.length));
+        };
+        return {
+            getObject,
+            getPublicURL,
+            getSignedURL,
+            uploadObject,
+            moveObject,
+            deleteObject,
+            listDirectory,
+            createDirectory,
+            deleteDirectory,
+            moveDirectory
+        };
+    }
+});

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@genoacms/adapter-gcp",
-  "version": "0.8.2-1",
+  "version": "0.9.0",
   "type": "module",
   "description": "Implementation of abstraction layer of GenoaCMS for GCP",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/GenoaCMS/adapter-gcp.git"
+    "url": "git+https://github.com/GenoaCMS/genoacms.git",
+    "directory": "packages/adapter-gcp"
   },
   "author": {
     "name": "Filip Holčík",
@@ -13,19 +14,21 @@
   },
   "license": "ISC",
   "bugs": {
-    "url": "https://github.com/GenoaCMS/adapter-gcp/issues"
+    "url": "https://github.com/GenoaCMS/genoacms/issues"
   },
-  "homepage": "https://github.com/GenoaCMS/adapter-gcp#readme",
+  "homepage": "https://github.com/GenoaCMS/genoacms/tree/main/packages/adapter-gcp#readme",
   "publishConfig": {
     "provenance": true
   },
   "dependencies": {
-    "@genoacms/cloudabstraction": "^0.8.2",
     "@google-cloud/firestore": "^7.1.0",
     "@google-cloud/functions": "^3.4.0",
-    "@google-cloud/resource-manager": "^5.1.0",
+    "@google-cloud/secret-manager": "^7.0.0",
     "@google-cloud/storage": "^7.7.0",
-    "archiver": "^7.0.0"
+    "archiver": "^7.0.0",
+    "google-auth-library": "^9.15.1",
+    "@genoacms/contracts": "^0.0.2",
+    "@genoacms/sveltekit-adapter-cloud-run-functions": "^1.0.1"
   },
   "devDependencies": {
     "@types/archiver": "^6.0.2",
@@ -37,38 +40,54 @@
     "eslint-plugin-promise": "^6.1.1",
     "rimraf": "^5.0.5",
     "typescript": "^5.2.2",
-    "vitest": "^1.0.4"
-  },
-  "peerDependencies": {
-    "@genoacms/sveltekit-adapter-cloud-run-functions": "^1.0.0"
+    "vitest": "^3.2.7",
+    "@genoacms/conformance": "^0.0.2"
   },
   "files": [
-    "src",
-    "deployment",
     "dist"
   ],
   "exports": {
-    "./authorization": {
-      "import": "./dist/services/authorization/index.js",
-      "types": "./dist/services/authorization/index.d.ts"
+    "./storage": {
+      "types": "./dist/storage/descriptor.d.ts",
+      "import": "./dist/storage/descriptor.js"
+    },
+    "./storage/runtime": {
+      "types": "./dist/storage/runtime.d.ts",
+      "import": "./dist/storage/runtime.js"
     },
     "./database": {
-      "import": "./dist/services/database/index.js",
-      "types": "./dist/services/database/index.d.ts"
+      "types": "./dist/database/descriptor.d.ts",
+      "import": "./dist/database/descriptor.js"
     },
-    "./deployment": {
-      "import": "./dist/services/deployment/index.js",
-      "types": "./dist/services/deployment/index.d.ts"
+    "./database/runtime": {
+      "types": "./dist/database/runtime.d.ts",
+      "import": "./dist/database/runtime.js"
     },
-    "./storage": {
-      "import": "./dist/services/storage/index.js",
-      "types": "./dist/services/storage/index.d.ts"
+    "./secrets": {
+      "types": "./dist/secrets/descriptor.d.ts",
+      "import": "./dist/secrets/descriptor.js"
+    },
+    "./secrets/runtime": {
+      "types": "./dist/secrets/runtime.d.ts",
+      "import": "./dist/secrets/runtime.js"
+    },
+    "./authentication/identity-platform": {
+      "types": "./dist/authentication/identity-platform/descriptor.d.ts",
+      "import": "./dist/authentication/identity-platform/descriptor.js"
+    },
+    "./authentication/identity-platform/runtime": {
+      "types": "./dist/authentication/identity-platform/runtime.d.ts",
+      "import": "./dist/authentication/identity-platform/runtime.js"
+    },
+    "./deployment": {
+      "types": "./dist/deployment/descriptor.d.ts",
+      "import": "./dist/deployment/descriptor.js"
     }
   },
   "scripts": {
     "build": "rimraf dist && tsc",
-    "test:all": "npm run build && vitest --silent=false --config node_modules/@genoacms/cloudabstraction/test/vitest.config.js --run node_modules/@genoacms/cloudabstraction/test/all.test.js",
-    "test:database": "npm run build && vitest --silent=false --config node_modules/@genoacms/cloudabstraction/test/vitest.config.js --run node_modules/@genoacms/cloudabstraction/test/database.test.js",
-    "test:storage": "npm run build && vitest --silent=false --config node_modules/@genoacms/cloudabstraction/test/vitest.config.js --run node_modules/@genoacms/cloudabstraction/test/storage.test.js"
+    "test": "vitest run",
+    "test:conformance": "vitest run test/conformance.test.ts",
+    "test:contract": "vitest run test/contract test/conformance.test.ts"
   }
 }

package/deployment/snippets/index.js

@@ -1,8 +0,0 @@
-import { handler } from './node_modules/@genoacms/core/build/index.js'
-
-function genoacms (req, res) {
-  handler(req, res, undefined)
-}
-
-export { genoacms }
-

package/dist/config.d.ts

@@ -1,2 +0,0 @@
-declare const _default: any;
-export default _default;

package/dist/config.js

@@ -1,2 +0,0 @@
-import { config } from '@genoacms/cloudabstraction';
-export default config;

package/dist/services/authorization/index.d.ts

@@ -1,3 +0,0 @@
-import type { Adapter } from '@genoacms/cloudabstraction/authorization';
-declare const isEmailAdmins: Adapter.isEmailAdmins;
-export { isEmailAdmins };

package/dist/services/authorization/index.js

@@ -1,24 +0,0 @@
-import { getProvider } from '@genoacms/cloudabstraction';
-import { ProjectsClient } from '@google-cloud/resource-manager';
-const ADAPTER_PATH = '@genoacms/adapter-gcp/authorization';
-const provider = getProvider('authorization', ADAPTER_PATH);
-const projectId = provider.projectId;
-const resourceManager = new ProjectsClient({
-    projectId,
-    credentials: provider.credentials
-});
-const isEmailAdmins = async (email) => {
-    const resource = `projects/${projectId}`;
-    const role = resource + '/roles/genoacms';
-    const data = await resourceManager.getIamPolicy({ resource });
-    const policy = data[0];
-    if ((policy.bindings) == null)
-        throw new Error('no-bindings');
-    const adminRole = policy.bindings.find(binding => binding.role === role);
-    if (adminRole == null)
-        throw new Error('no-admin-role');
-    if (adminRole.members == null)
-        throw new Error('no-principals');
-    return adminRole.members.includes(`user:${email}`);
-};
-export { isEmailAdmins };

package/dist/services/database/index.d.ts

@@ -1,7 +0,0 @@
-import type { Adapter } from '@genoacms/cloudabstraction/database';
-declare const createDocument: Adapter['createDocument'];
-declare const getCollection: Adapter['getCollection'];
-declare const getDocument: Adapter['getDocument'];
-declare const updateDocument: Adapter['updateDocument'];
-declare const deleteDocument: Adapter['deleteDocument'];
-export { createDocument, getDocument, getCollection, updateDocument, deleteDocument };

package/dist/services/database/index.js

@@ -1,63 +0,0 @@
-import { Firestore } from '@google-cloud/firestore';
-import { getProvider } from '@genoacms/cloudabstraction';
-const ADAPTER_PATH = '@genoacms/adapter-gcp/database';
-const provider = getProvider('database', ADAPTER_PATH);
-const firestore = new Firestore({
-    credentials: provider.credentials,
-    databaseId: provider.databaseId,
-    projectId: provider.projectId
-});
-const createDocument = async (reference, data) => {
-    const document = await firestore.collection(reference.name).add(data);
-    const documentReference = {
-        collection: reference,
-        id: document.id
-    };
-    return {
-        reference: documentReference,
-        data
-    };
-};
-const getCollection = async (reference) => {
-    const collection = await firestore.collection(reference.name).get();
-    const documents = [];
-    collection.forEach(document => {
-        const documentData = {};
-        Object.keys(reference.schema.properties).forEach(key => {
-            documentData[key] = document.get(key);
-        });
-        documents.push({
-            reference: {
-                collection: reference,
-                id: document.id
-            },
-            data: document.data()
-        });
-    });
-    return documents;
-};
-const getDocument = async ({ collection, id }) => {
-    const document = await firestore.collection(collection.name).doc(id).get();
-    if (!document.exists)
-        return undefined;
-    const documentReference = {
-        collection,
-        id
-    };
-    const documentSnapshot = {
-        reference: documentReference,
-        data: document.data()
-    };
-    return documentSnapshot;
-};
-const updateDocument = async (reference, document) => {
-    await firestore.collection(reference.collection.name).doc(reference.id).update(document);
-    return {
-        reference,
-        data: document
-    };
-};
-const deleteDocument = async (reference) => {
-    await firestore.collection(reference.collection.name).doc(reference.id).delete();
-};
-export { createDocument, getDocument, getCollection, updateDocument, deleteDocument };

package/dist/services/deployment/deploy.d.ts

@@ -1,2 +0,0 @@
-declare function deploy(): Promise<void>;
-export default deploy;