@lanes-sh/link 0.7.2 → 0.9.0

package/src/cli/commands/operate/inspect.ts

@@ -1,4 +1,5 @@
 import { formatPlan, planIsNoop, planReconcile } from '#registry';
+import type { ConnectionConfig, SelectedConnection } from '#profile';
 import { DEFAULT_SURFACES } from '../../config-repair.ts';
 import { announce, announceProfile, emit, fail, ok, print, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
@@ -16,6 +17,18 @@ import { migratedContract, migratedRenamedProviders } from './migrate.ts';
  */
 
 /** Static validation only. No external calls, no database, no credentials. */
+/**
+ * The accounts this profile actually reaches, as reconcile wants them.
+ *
+ * A profile grants a subset of the workspace's connections (ADR-057), and
+ * reconcile is about the ones it reaches: an account granted to nobody has no
+ * state to keep in step, and marking it `disabled` here would fight with the
+ * profile next door that does grant it.
+ */
+function grantedConnections(runtime: { connections: readonly SelectedConnection[] }): ConnectionConfig[] {
+  return runtime.connections.map(({ connection }) => connection);
+}
+
 export async function check(flags: GlobalFlags): Promise<void> {
   const { selection, config } = await resolveProfileOnly(flags);
   announceProfile(selection);
@@ -25,8 +38,10 @@ export async function check(flags: GlobalFlags): Promise<void> {
   // validates a file, and the file is the same whichever target reads it.
   print(ok(`${selection.profilePath} is valid`));
   print(
-    `      ${config.connections.length} connection(s), ` +
-      `${config.policy.allow.length} allow rule(s), ${config.policy.deny.length} deny rule(s)`,
+    `      ${config.grants.length} grant(s), ` +
+      `${config.grants.reduce((n, g) => n + g.allow.length, 0)} allow rule(s), ` +
+      `${config.grants.reduce((n, g) => n + g.deny.length, 0)} deny rule(s), ` +
+      `${config.members.length} member(s)`,
   );
 }
 
@@ -35,7 +50,7 @@ export async function plan(flags: GlobalFlags): Promise<void> {
   const runtime = await openRuntime(flags);
   try {
     announce(runtime.resolution);
-    const result = await planReconcile(runtime.config, runtime.state, runtime.credentials, runtime.manifestFor);
+    const result = await planReconcile(grantedConnections(runtime), runtime.state, runtime.credentials, runtime.manifestFor);
     print(formatPlan(result));
   } finally {
     await runtime.close();
@@ -100,7 +115,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
 
   try {
     const forSelection = (command: string) =>
-      `${command} --profile ${runtime.resolution.profile} --target ${runtime.resolution.target}`;
+      `${command} --profile ${runtime.resolution.profile} --workspace ${runtime.resolution.target}`;
 
     checks.push('config is valid');
     checks.push('state store is reachable');
@@ -134,7 +149,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
     // `probeConnections` answers it by attempting the renewal, which is the only
     // thing that actually knows. Same classifier as `lanes link auth`, so the two
     // cannot drift apart again.
-    const probed = await probeConnections(runtime, runtime.config.connections, forSelection);
+    const probed = await probeConnections(runtime, grantedConnections(runtime), forSelection);
 
     for (const result of probed) {
       switch (result.verdict) {
@@ -209,7 +224,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       }
     }
 
-    for (const name of new Set(runtime.config.connections.map((c) => c.provider))) {
+    for (const name of new Set(grantedConnections(runtime).map((one) => one.provider))) {
       if (!runtime.registry.has(name)) {
         problems.push({
           kind: 'unknown_provider',
@@ -236,22 +251,25 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
     // covering it is not reported. That is the same rule the repair follows, and
     // reading it here from `policy.deny` rather than asking the repair keeps
     // `doctor` a read.
-    const denied = (rule: string): boolean =>
-      runtime.config.policy.deny.some(
-        (entry) => entry.capability === '*' || entry.capability === rule,
-      );
+    // A grant row *is* the connection and the rule together now (ADR-058), so
+    // "has a row but no rule" is a state that stopped existing — which removes
+    // the half-repaired case this check was originally written for. What is left
+    // is one question per surface: does this profile grant one, and is the grant
+    // more than a deny.
+    const grantFor = (provider: string) =>
+      runtime.config.grants.find((grant) => grant.connection.startsWith(`${provider}.`));
 
     const missing = DEFAULT_SURFACES.filter((provider) => {
-      const rule = `${provider}.*`;
-      if (denied(rule)) return false;
+      const grant = grantFor(provider);
+      if (grant === undefined) return true;
 
-      const hasRow = runtime.config.connections.some(
-        (connection) => connection.provider === provider,
-      );
-      const granted = runtime.config.policy.allow.some(
+      const rule = `${provider}.*`;
+      const denied = grant.deny.some(
         (entry) => entry.capability === '*' || entry.capability === rule,
       );
-      return !hasRow || !granted;
+      if (denied) return false;
+
+      return !grant.allow.some((entry) => entry.capability === '*' || entry.capability === rule);
     });
 
     if (missing.length > 0) {
@@ -287,7 +305,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       warnings.push({ kind: 'capability_drift', message }),
     );
 
-    const drift = await planReconcile(runtime.config, runtime.state, runtime.credentials, runtime.manifestFor);
+    const drift = await planReconcile(grantedConnections(runtime), runtime.state, runtime.credentials, runtime.manifestFor);
     if (!planIsNoop(drift)) {
       warnings.push({
         kind: 'reconcile_drift',
@@ -309,7 +327,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
     const rotation = await unboundRotatableRefs({
       deploy: runtime.declared.deploy,
       target: runtime.target,
-      connections: runtime.config.connections,
+      connections: grantedConnections(runtime),
       manifestFor: runtime.manifestFor,
     });
     if (rotation.unbound.length > 0) {

package/src/cli/commands/operate/migrate.ts

@@ -1,7 +1,10 @@
-import { ConfigError, resolveSelection, resolveTargetWorkspace, resolveWorkspaceRoot } from '#profile';
+import {
+  CONNECTIONS_FILE,
+  listProfiles, ConfigError, resolveSelection, resolveTargetWorkspace, resolveWorkspaceRoot,
+  SUPPORTED_CONTRACT } from '#profile';
 import { ConfigDocument } from '../../config-edit.ts';
 import { migrateRenamedProviders, pendingRenames, shapeOf } from '../../config-migrate.ts';
-import { migrateWorkspace, needsMigration } from '../../workspace-migrate.ts';
+import { migrateToCurrentContract } from '../../workspace-migrate.ts';
 import { emit, fail, ok, print, style, warn } from '../../output.ts';
 import { openSecretStoreFor, type GlobalFlags } from '../../runtime.ts';
 
@@ -52,16 +55,25 @@ export async function migratedRenamedProviders(
   const root = await resolveTargetWorkspace(localRoot, target).catch(() => localRoot);
 
   const selection = await resolveSelection({ profileFlag: flags.profile, root });
-  const document = await ConfigDocument.open(root, selection.profile);
+
+  // The rename is a property of the *connection*, so it is found in the
+  // workspace's file (ADR-057) — and applied across every profile, because any
+  // of them may grant the row being renamed.
+  const document = await ConfigDocument.openKey(root, CONNECTIONS_FILE);
   if (pendingRenames(document).length === 0) return false;
 
+  const profiles: ConfigDocument[] = [];
+  for (const name of await listProfiles(root)) {
+    profiles.push(await ConfigDocument.open(root, name));
+  }
+
   // Shape-only, because the check this document fails runs after the schema.
   // Throws when it is malformed beyond a rename, which is a better sentence
   // than the referential one it would otherwise be reported under.
-  const config = shapeOf(document);
-  const credentials = await openSecretStoreFor(config, root, target);
+  const config = shapeOf(await ConfigDocument.open(root, selection.profile));
+  const credentials = await openSecretStoreFor(root, target);
 
-  const migration = await migrateRenamedProviders(document, credentials, {
+  const migration = await migrateRenamedProviders(document, profiles, credentials, {
     apply: flags.fix === true,
   });
 
@@ -141,9 +153,17 @@ export async function migratedContract(flags: RenameFlags, refusal: unknown): Pr
   const where = await resolveTargetWorkspace(root, target).catch(() => null);
   if (where === null) return false;
 
-  if (!(await needsMigration(where))) return false;
+  // Running the migration is how "is there anything to do" is answered, rather
+  // than a predicate beside it. The predicate was `needsMigration`, which asks
+  // only about contract 1 — so a contract-2 bucket, the exact thing this
+  // function exists to rescue, returned false here and fell through to the
+  // refusal it was supposed to fix. With `--fix` absent this writes nothing.
+  const migration = await migrateToCurrentContract(where, {
+    apply: flags.fix === true,
+    target,
+  });
+  if (migration.alreadyCurrent) return false;
 
-  const migration = await migrateWorkspace(where, { apply: flags.fix === true });
   const applied = flags.fix === true;
   const remote = where !== root;
 
@@ -166,8 +186,8 @@ export async function migratedContract(flags: RenameFlags, refusal: unknown): Pr
       print();
       print(
         applied
-          ? ok('migrated to contract 2 — a target is declared by the workspace, not by each profile')
-          : warn('this workspace is contract 1, and nothing here reads that any more'),
+          ? ok(`migrated to contract ${SUPPORTED_CONTRACT} — a workspace declares its own adapters, and holds the connections a profile grants`)
+          : warn(`this workspace is behind contract ${SUPPORTED_CONTRACT}, and nothing here reads that any more`),
       );
       for (const change of migration.changes) print(`  ${change}`);
 
@@ -177,15 +197,15 @@ export async function migratedContract(flags: RenameFlags, refusal: unknown): Pr
           style.dim(
             applied
               ? '  The endpoint serving this bucket is running an older image and cannot read\n' +
-                `  what was just written. Roll a new one: lanes link deploy --target ${target}`
-              : `  lanes link deploy --target ${target} migrates it and ships the image that\n` +
+                `  what was just written. Roll a new one: lanes link deploy --workspace ${target}`
+              : `  lanes link deploy --workspace ${target} migrates it and ships the image that\n` +
                 '  understands it, in one step. Prefer that to --fix here.',
           ),
         );
         return;
       }
 
-      if (!applied) print(style.dim(`  Fix it with: lanes link doctor --fix --target ${target}`));
+      if (!applied) print(style.dim(`  Fix it with: lanes link doctor --fix --workspace ${target}`));
     },
   );
 

package/src/cli/commands/operate/outputs.ts

@@ -151,14 +151,14 @@ export async function tokenInvocation(
   target: string,
 ): Promise<{ command: string; onPath: boolean }> {
   // Both, always, and from the *resolved* selection rather than the flags. A
-  // token is per-target, so `outputs --target cloud` printing a bare
+  // token is per-target, so `outputs --workspace cloud` printing a bare
   // `token show --raw` hands over the local one beside a deployed URL — a
   // credential that looks like an answer and fails as a wrong password. Naming
   // the profile as well makes the line pasteable into any shell rather than
   // only into one where the same default happens to resolve.
-  const selection = ` --profile ${profile} --target ${target}`;
+  const selection = ` --profile ${profile} --workspace ${target}`;
   const short = `lanes link token show --raw${selection}`;
-  const argv = ['link', 'token', 'show', '--raw', '--profile', profile, '--target', target];
+  const argv = ['link', 'token', 'show', '--raw', '--profile', profile, '--workspace', target];
 
   const resolved = Bun.which('lanes');
   if (resolved) {

package/src/cli/commands/operate/pair-certificate.ts

@@ -0,0 +1,141 @@
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { ConfigError, PAIR_CERT_REF, PAIR_KEY_REF } from '#profile';
+import type { SecretStore } from '#secrets';
+import { print, style, warn } from '../../output.ts';
+import { confirm, isInteractive } from '../../prompt.ts';
+import type { PairDeps, PairFlags } from './pair.ts';
+
+/**
+ * Making a loopback address one this machine's browsers will trust.
+ *
+ * Split from `./pair.ts` because it is the half of pairing that only loopback
+ * has. A deployed endpoint terminates TLS with a certificate a browser already
+ * trusts, so none of this runs for one — and keeping it beside the command made
+ * a file most of which did not apply to half its callers.
+ *
+ * It is also the largest side effect any command in this CLI has: a persistent
+ * change to the machine's trust store, made by a CLI. That is why everything
+ * here asks first, and why a run with nobody at the terminal is refused rather
+ * than assumed.
+ */
+
+/** The names the certificate has to cover. All three are this machine. */
+const HOSTS = ['127.0.0.1', 'localhost', '::1'];
+
+/**
+ * A certificate a browser on this machine will accept.
+ *
+ * mkcert and nothing else, deliberately. It is the one tool that installs into
+ * the system trust store *and* Firefox's separate NSS store, across macOS,
+ * Linux and Windows — and a self-signed certificate this command generated
+ * itself would fail in the browser with an error the page cannot read, which is
+ * the worst of both: the work is done and the feature does not work.
+ */
+export async function ensureCertificate(
+  credentials: SecretStore,
+  flags: PairFlags,
+  deps: PairDeps,
+): Promise<'reused' | 'installed'> {
+  const held =
+    (await credentials.get(PAIR_CERT_REF)) !== null &&
+    (await credentials.get(PAIR_KEY_REF)) !== null;
+
+  if (held && flags.rotate !== true) return 'reused';
+
+  const which = deps.which ?? ((binary: string) => Bun.which(binary));
+  const run = deps.run ?? runCommand;
+
+  let mkcert = which('mkcert');
+  if (!mkcert) mkcert = await installMkcert(flags, deps, which, run);
+
+  // Installs the local CA if it is not already there, and says nothing if it
+  // is. This is the step that touches the trust store, and it has already been
+  // consented to by the time it runs.
+  const installed = await run([mkcert, '-install']);
+  if (installed !== null) {
+    throw new ConfigError(`mkcert -install failed.\n${installed || '  It said nothing.'}`);
+  }
+
+  const scratch = await mkdtemp(join(tmpdir(), 'lanes-pair-'));
+  try {
+    const certPath = join(scratch, 'cert.pem');
+    const keyPath = join(scratch, 'key.pem');
+
+    const failed = await run([mkcert, '-cert-file', certPath, '-key-file', keyPath, ...HOSTS]);
+    if (failed !== null) {
+      throw new ConfigError(`mkcert failed to issue a certificate.\n${failed || '  It said nothing.'}`);
+    }
+
+    // Into the credential store rather than left on disk. The private key is a
+    // secret by any reading, and the store is the one place in a workspace that
+    // is encrypted at rest.
+    await credentials.set(PAIR_CERT_REF, await readFile(certPath, 'utf8'));
+    await credentials.set(PAIR_KEY_REF, await readFile(keyPath, 'utf8'));
+  } finally {
+    await rm(scratch, { recursive: true, force: true });
+  }
+
+  return 'installed';
+}
+
+async function installMkcert(
+  flags: PairFlags,
+  deps: PairDeps,
+  which: (binary: string) => string | null,
+  run: (command: readonly string[]) => Promise<string | null>,
+): Promise<string> {
+  const line = 'brew install mkcert';
+  const brew = which('brew');
+
+  if (!brew) {
+    // The one path where this command cannot finish the job, so it hands over
+    // the whole of it rather than half.
+    throw new ConfigError(
+      'Pairing needs mkcert, which issues a certificate this machine\'s browsers trust.\n' +
+        `  With Homebrew: ${line}\n` +
+        '  Otherwise: https://github.com/FiloSottile/mkcert#installation\n' +
+        '  Then run "lanes link pair" again.',
+    );
+  }
+
+  print(warn('pairing needs mkcert, and it is not installed'));
+  print(
+    style.dim(
+      '  It issues a certificate for 127.0.0.1 that this machine trusts, which is what\n' +
+        '  lets a page on lanes.sh read your endpoint at all. Safari will not fetch\n' +
+        '  http://127.0.0.1 from an https page, and offers no way to allow it.\n' +
+        '\n' +
+        '  This installs a local certificate authority into your system trust store.\n' +
+        `  ${line}`,
+    ),
+  );
+
+  if (flags.yes !== true) {
+    if (!(deps.interactive ?? isInteractive())) {
+      throw new ConfigError(
+        'Nothing here can answer a prompt, and installing a certificate authority because\n' +
+          '  nobody was there to say no is the wrong way to resolve that.\n' +
+          `  Run "${line}" yourself, or pass --yes.`,
+      );
+    }
+    if (!(await (deps.confirm ?? ((question: string) => confirm(question)))('Install it now?'))) {
+      throw new ConfigError(`Not paired. When you want it: ${line}`);
+    }
+  }
+
+  const failed = await run([brew, 'install', 'mkcert']);
+  if (failed !== null) throw new ConfigError(`${line} failed.\n${failed || '  It said nothing.'}`);
+
+  const found = which('mkcert');
+  if (!found) throw new ConfigError(`${line} reported success but mkcert is still not on PATH.`);
+  return found;
+}
+
+/** Runs it. Null on success; whatever it said on failure. */
+async function runCommand(command: readonly string[]): Promise<string | null> {
+  const spawned = Bun.spawn([...command], { stdout: 'pipe', stderr: 'pipe' });
+  const [code, stderr] = await Promise.all([spawned.exited, new Response(spawned.stderr).text()]);
+  return code === 0 ? null : stderr.trim();
+}