@hyperfixation/cli 0.1.4 → 0.1.6

package/dist/restore-check.js

@@ -1,7 +1,7 @@
 import { quoteIdent } from "@hyperfixation/db";
 import { createLocalDirectoryBackupSource, createS3BackupSource, } from "./backup-source.js";
-import { loadOperatorConfig, pgAdminUser, postgresContainers, requireOperatorConfig, } from "./config.js";
-import { openDatabase, openDatabaseUrl, redactPasswords, DEFAULT_POSTGRES_PORT, } from "./database.js";
+import { loadOperatorConfig, pgAdminUser, postgresContainers, requireOperatorConfig, DEFAULT_PG_ADMIN_USER, } from "./config.js";
+import { findPostgresContainer, openDatabase, openDatabaseUrl, redactPasswords, } from "./database.js";
 import { deriveNames } from "./names.js";
 import { REQUIRED_EXTENSIONS } from "./provision-database.js";
 import { createSshRunner } from "./runner.js";
@@ -12,7 +12,6 @@ export const SCRATCH_SUFFIX = "_restore_check";
 const MAX_IDENTIFIER_BYTES = 63;
 /** Older than this and the dump gets a warning line; it never changes the exit code. */
 export const STALE_DUMP_HOURS = 36;
-const CLUSTER_ADMIN_DATABASE = "postgres";
 export class RestoreCheckError extends Error {
     constructor(message) {
         super(message);
@@ -45,11 +44,10 @@ export async function restoreCheck(options) {
     const db = typeof options.database === "string" ? openDatabaseUrl(options.database) : options.database;
     const clusterUrl = db.adminUrl();
     if (clusterUrl === undefined) {
-        throw new RestoreCheckError(`a restore cannot be run over the ${db.kind} transport: pg_restore needs an address. ` +
-            "Name the Postgres container — HF_DB_CONTAINER, or HF_COOLIFY_POSTGRES_UUID — so the " +
-            "tunnel can discover one.");
+        throw new RestoreCheckError(`a restore cannot be checked over the ${db.kind} transport: counting the restored side ` +
+            "needs an address a client library can dial. Name the Postgres container — " +
+            "HF_DB_CONTAINER, or HF_COOLIFY_POSTGRES_UUID — so the tunnel can discover one.");
     }
-    const restoreTarget = urlOnto(options.restoreAdminUrl ?? clusterUrl, scratchDatabase);
     const now = options.now ?? new Date();
     const dumpAgeHours = (now.getTime() - dump.takenAt.getTime()) / 3_600_000;
     try {
@@ -73,7 +71,7 @@ export async function restoreCheck(options) {
                 await db.query(`GRANT CONNECT, CREATE ON DATABASE ${quoteIdent(scratchDatabase)} ` +
                     `TO ${quoteIdent(names.migratorRole)}`);
                 await scratch.query(`GRANT CREATE, USAGE ON SCHEMA public TO ${quoteIdent(names.migratorRole)}`);
-                await runRestore(options, restoreTarget, names.migratorRole, dump.path);
+                await runRestore(options, scratchDatabase, names.migratorRole, dump.path);
                 rows = compare(await countTables(db, names.databaseName), await countTables(scratch));
             }
             finally {
@@ -101,14 +99,16 @@ export async function restoreCheck(options) {
             await db.close();
     }
 }
-/** The argv `restoreCheck` runs — the array the test asserts against. */
+/**
+ * The argv `restoreCheck` runs — the array the test asserts against.
+ *
+ * @deprecated The box host has no `pg_restore`; the restore runs inside the Postgres container.
+ * Use `pgRestoreInContainerArgv`. Removed in 0.2.0.
+ */
 export function pgRestoreArgv(options) {
     return [
         options.pgRestorePath ?? "pg_restore",
         "--no-owner",
-        // Every object comes out owned by the migrator, as in the live database. `--no-comments`
-        // because a dump's `COMMENT ON EXTENSION` belongs to the admin that created the extension,
-        // and a comment nobody may set is not a restore failure.
         "--no-comments",
         `--role=${options.role}`,
         "--dbname",
@@ -116,15 +116,56 @@ export function pgRestoreArgv(options) {
         options.file,
     ];
 }
-async function runRestore(options, url, role, file) {
-    const argv = pgRestoreArgv({ url, role, file, pgRestorePath: options.pgRestorePath });
-    const result = await options.runner.exec(argv);
-    if (result.code !== 0) {
-        // `url` carries the cluster's admin password, and so does anything pg_restore echoed of it.
-        throw new RestoreCheckError(`pg_restore exited ${String(result.code)} restoring ${file}: ` +
-            redactPasswords(result.stderr.trim()));
-    }
+/**
+ * The argv `restoreCheck` runs — the array the test asserts against.
+ *
+ * No `--dbname` URL: inside the container the server is on the local socket, so the admin user
+ * and the database name are all it takes and no password crosses an argv. The dump arrives on
+ * stdin, which is why there is no file argument either.
+ */
+export function pgRestoreInContainerArgv(options) {
+    return [
+        "docker",
+        "exec",
+        "-i",
+        options.container,
+        options.pgRestorePath ?? "pg_restore",
+        "--no-owner",
+        // Every object comes out owned by the migrator, as in the live database. `--no-comments`
+        // because a dump's `COMMENT ON EXTENSION` belongs to the admin that created the extension,
+        // and a comment nobody may set is not a restore failure.
+        "--no-comments",
+        `--role=${options.role}`,
+        "-U",
+        options.adminUser,
+        "-d",
+        options.database,
+    ];
+}
+async function runRestore(options, database, role, file) {
+    const { container } = options;
+    const argv = pgRestoreInContainerArgv({
+        container,
+        adminUser: options.adminUser ?? DEFAULT_PG_ADMIN_USER,
+        database,
+        role,
+        pgRestorePath: options.pgRestorePath,
+    });
+    const result = await options.runner.exec(argv, { inputFile: file });
+    if (result.code === 0)
+        return;
+    // Anything `pg_restore` echoed of a connection string carries the cluster's admin password.
+    const stderr = redactPasswords(result.stderr.trim());
+    throw new RestoreCheckError(`pg_restore exited ${String(result.code)} restoring ${file} in ${container}: ${stderr}` +
+        (result.code === NOT_FOUND_EXIT
+            ? ` — exit ${String(NOT_FOUND_EXIT)} means "command not found". The box host has no ` +
+                "Postgres client tools; only the container does. Check that docker is on the box's " +
+                `PATH and that ${container} is the Postgres container (HF_DB_CONTAINER, or ` +
+                "HF_COOLIFY_POSTGRES_UUID)."
+            : ""));
 }
+/** A shell's, and `docker exec`'s, "command not found". */
+const NOT_FOUND_EXIT = 127;
 /**
  * Row counts for every table the app's data lives in: `hf_*`, plus every table carrying
  * `normalized_name`, which is how `@hyperfixation/db` spells a record table the app declared.
@@ -219,7 +260,8 @@ export async function restoreCheckApp(options) {
     const { HF_SSH_HOST } = requireOperatorConfig(config, ["HF_SSH_HOST"], { env });
     const runner = createSshRunner({ host: HF_SSH_HOST });
     const admin = { user: pgAdminUser(config), password: env.PGPASSWORD };
-    const db = await openDatabase(runner, { admin, containers: postgresContainers(config) });
+    const containers = postgresContainers(config);
+    const db = await openDatabase(runner, { admin, containers });
     try {
         return await restoreCheck({
             app: options.app,
@@ -229,7 +271,8 @@ export async function restoreCheckApp(options) {
                 : createLocalDirectoryBackupSource({ runner, directory: options.backupDir }),
             runner,
             database: db,
-            restoreAdminUrl: boxAdminUrl(admin, db.boxAddress),
+            container: await restoreContainer(runner, db, containers),
+            adminUser: admin.user,
         });
     }
     finally {
@@ -237,20 +280,21 @@ export async function restoreCheckApp(options) {
     }
 }
 /**
- * The cluster as the box itself sees it, where `pg_restore` runs.
+ * The container `pg_restore` runs inside.
  *
- * `address` is whatever the tunnel settled on: with 5432 unpublished the box's loopback is no more
- * a listener for `pg_restore` than for the forward, and the container's address on the docker
- * network is what both have to dial.
+ * `openDatabase` already knows it whenever the box's loopback had no listener, which is the box
+ * Coolify builds; a box that does publish 5432 answers on the loopback and never looks, so the
+ * discovery runs here instead of leaving the check with nowhere to restore.
  */
-function boxAdminUrl(admin, address) {
-    const url = new URL(`postgresql://${address?.host ?? "127.0.0.1"}`);
-    url.port = String(address?.port ?? DEFAULT_POSTGRES_PORT);
-    url.username = encodeURIComponent(admin.user);
-    if (admin.password !== undefined)
-        url.password = encodeURIComponent(admin.password);
-    url.pathname = `/${CLUSTER_ADMIN_DATABASE}`;
-    return url.toString();
+async function restoreContainer(runner, db, containers) {
+    if (db.container !== undefined)
+        return db.container;
+    if (containers.length === 0) {
+        throw new RestoreCheckError("pg_restore has to run inside the Postgres container — the box host has no Postgres " +
+            "client tools — and no container was named. Set HF_DB_CONTAINER, or " +
+            "HF_COOLIFY_POSTGRES_UUID, in the operator config.");
+    }
+    return (await findPostgresContainer(runner, containers)).container;
 }
 function urlOnto(connectionString, database) {
     const url = new URL(connectionString);

package/dist/runner.d.ts

@@ -1,6 +1,14 @@
 export interface ExecOptions {
     /** Written to the command's stdin and then closed. SQL goes here, never into argv. */
     input?: string;
+    /**
+     * A file **on the far side**, streamed into the command's stdin instead of `input`.
+     *
+     * How a dump on the box reaches a `pg_restore` that runs inside the Postgres container: the
+     * file is the host's and the process is the container's, so nothing but stdin spans the two.
+     * Takes precedence over `input`.
+     */
+    inputFile?: string;
 }
 export interface ExecResult {
     /** `null` when the command was killed by a signal or by `timeoutMs`. */
@@ -36,7 +44,7 @@ export declare class RunnerError extends Error {
     });
 }
 /** The argv `exec` runs, `ssh` excluded — the array the test asserts against. */
-export declare function sshExecArgv(host: string, command: readonly string[]): string[];
+export declare function sshExecArgv(host: string, command: readonly string[], options?: ExecOptions): string[];
 export declare function sshTunnelArgv(host: string, localPort: number, remotePort: number, remoteHost?: string): string[];
 /** Where a forward lands when the caller names no host: the far side's own loopback. */
 export declare const TUNNEL_LOOPBACK = "127.0.0.1";

package/dist/runner.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { createReadStream } from "node:fs";
 import { createServer, connect as connectTcp } from "node:net";
 export class RunnerError extends Error {
     constructor(message, options) {
@@ -31,11 +32,16 @@ const SSH_OPTIONS = [
     "ControlPath=none",
 ];
 /** The argv `exec` runs, `ssh` excluded — the array the test asserts against. */
-export function sshExecArgv(host, command) {
+export function sshExecArgv(host, command, options = {}) {
     assertHost(host);
     // `ssh` hands the remote end one string and the login shell splits it, so the array has to be
-    // re-quoted for that shell; nothing else in this file ever builds a shell word.
-    return ["-T", ...SSH_OPTIONS, host, shellQuote(command)];
+    // re-quoted for that shell; nothing else in this file ever builds a shell word. `inputFile`
+    // becomes that shell's own `<` redirection, which is the only way a far-side file reaches the
+    // stdin of a far-side command without being pulled across the link first.
+    const remote = options.inputFile === undefined
+        ? shellQuote(command)
+        : `${shellQuote(command)} < ${shellQuote([options.inputFile])}`;
+    return ["-T", ...SSH_OPTIONS, host, remote];
 }
 export function sshTunnelArgv(host, localPort, remotePort, remoteHost = TUNNEL_LOOPBACK) {
     assertHost(host);
@@ -61,7 +67,13 @@ export function createSshRunner(options) {
     const ssh = options.sshPath ?? "ssh";
     assertHost(options.host);
     return {
-        exec: async (command, execOptions) => await spawnCollecting(ssh, sshExecArgv(options.host, command), execOptions),
+        exec: async (command, execOptions) => 
+        // The redirection is the remote shell's, so `inputFile` is spent building the remote word
+        // and must not also be opened on this machine.
+        await spawnCollecting(ssh, sshExecArgv(options.host, command, execOptions), {
+            ...execOptions,
+            inputFile: undefined,
+        }),
         tunnel: async (remotePort, remoteHost = TUNNEL_LOOPBACK) => {
             const localPort = await freeLocalPort();
             const child = spawn(ssh, sshTunnelArgv(options.host, localPort, remotePort, remoteHost), {
@@ -134,19 +146,28 @@ async function spawnCollecting(bin, args, options = {}) {
     child.stderr?.on("data", (chunk) => {
         stderr += chunk.toString("utf8");
     });
+    const file = options.inputFile === undefined ? undefined : createReadStream(options.inputFile);
     const closed = new Promise((resolve, reject) => {
         // A child that exits before reading its stdin (`true`, a refused ssh) makes the write fail with
         // EPIPE; the exit code already says what happened. Any other stdin error is a real failure.
         child.stdin?.on("error", (error) => {
+            file?.destroy();
             if (error.code === "EPIPE")
                 return;
             child.kill();
             reject(error);
         });
+        file?.once("error", (cause) => {
+            child.kill();
+            reject(new RunnerError(`could not read ${String(options.inputFile)} into stdin`, { cause }));
+        });
         child.once("error", reject);
         child.once("close", (exitCode) => resolve(exitCode));
     });
-    child.stdin?.end(options.input ?? "");
+    if (file === undefined)
+        child.stdin?.end(options.input ?? "");
+    else if (child.stdin !== null)
+        file.pipe(child.stdin);
     const code = await closed;
     return { code, stdout, stderr };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperfixation/cli",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "license": "MIT",
   "description": "The hf binary and its Turborepo generator templates",
   "repository": {
@@ -29,15 +29,15 @@
     "!dist/test-support/**"
   ],
   "dependencies": {
-    "@hyperfixation/auth": "0.1.4",
-    "@hyperfixation/core": "0.1.4",
-    "@hyperfixation/db": "0.1.4",
+    "@hyperfixation/auth": "0.1.6",
+    "@hyperfixation/core": "0.1.6",
+    "@hyperfixation/db": "0.1.6",
     "giget": "3.3.1",
     "pg": "^8.23.0"
   },
   "devDependencies": {
-    "@hyperfixation/eslint-config": "0.1.4",
-    "@hyperfixation/testing": "0.1.4",
+    "@hyperfixation/eslint-config": "0.1.6",
+    "@hyperfixation/testing": "0.1.6",
     "@microsoft/api-extractor": "^7.59.1",
     "@types/pg": "^8.23.1",
     "eslint": "^10.10.0",