@mesh-tech/mesh-cli 0.36.0 → 0.37.0

package/dist/src/commands/local/local-spicedb.js

@@ -0,0 +1,304 @@
+import { LOCAL_ENV } from "./seed.js";
+import { isAwsErrorCode } from "../../utils/aws-errors.js";
+import { LOCAL_STACK_NAME } from "./dev-local.js";
+export const LOCAL_SPICEDB_INSTANCE_ID = "mesh-local";
+export const LOCAL_SPICEDB_KEY = "local-dev-key";
+export const LOCAL_SPICEDB_KEY_SECRET = "mesh/local/dev/spicedb/preshared-key";
+const HOST_HTTP = "http://localhost:8443";
+export function localSpicedbInstancePath(tenant) {
+    return `/mesh-platform/${tenant}/${LOCAL_ENV}/authz/spicedb-instances/${LOCAL_SPICEDB_INSTANCE_ID}`;
+}
+export function localSpicedbInstanceValue() {
+    return {
+        grpcEndpoint: "spicedb:50051",
+        httpEndpoint: "spicedb:8443",
+        namespace: "mesh-local",
+        presharedKeySecretName: LOCAL_SPICEDB_KEY_SECRET,
+        configSecretName: "",
+        owner: { kind: "shared-stack", name: "mesh-local" },
+    };
+}
+export function localSpicedbRef(tenant) {
+    return { tenant, env: LOCAL_ENV, instanceId: LOCAL_SPICEDB_INSTANCE_ID };
+}
+export function localAuthzServiceEnv(tenant, app) {
+    return {
+        SPICEDB_ENDPOINT: "localhost:50051",
+        SPICEDB_TOKEN: LOCAL_SPICEDB_KEY,
+        AUTHZ_METADATA_SSM_PATH: `/mesh-platform/${tenant}/${LOCAL_ENV}/apps/${app}/stacks/${LOCAL_STACK_NAME}/authz/metadata`,
+    };
+}
+function skipTrivia(schema, i) {
+    if (schema.startsWith("//", i)) {
+        const nl = schema.indexOf("\n", i);
+        return nl < 0 ? schema.length : nl + 1;
+    }
+    if (schema.startsWith("/*", i)) {
+        const close = schema.indexOf("*/", i + 2);
+        return close < 0 ? schema.length : close + 2;
+    }
+    const quote = schema[i];
+    if (quote === '"' || quote === "'" || quote === "`") {
+        let j = i + 1;
+        while (j < schema.length && schema[j] !== quote)
+            j += schema[j] === "\\" ? 2 : 1;
+        return Math.min(j + 1, schema.length);
+    }
+    return i;
+}
+export function parseZed(schema) {
+    const uses = [];
+    const blocks = [];
+    const word = /[A-Za-z_][A-Za-z0-9_]*/y;
+    const header = /\s+([A-Za-z0-9_/]+)/y;
+    let i = 0;
+    while (i < schema.length) {
+        const skipped = skipTrivia(schema, i);
+        if (skipped !== i) {
+            i = skipped;
+            continue;
+        }
+        word.lastIndex = i;
+        const keyword = /[A-Za-z0-9_]/.test(schema[i - 1] ?? "") ? null : word.exec(schema);
+        if (!keyword) {
+            i++;
+            continue;
+        }
+        const start = i;
+        i = word.lastIndex;
+        if (keyword[0] === "use") {
+            const nl = schema.indexOf("\n", i);
+            const line = schema.slice(start, nl < 0 ? schema.length : nl).replace(/\/\/.*$|\/\*.*$/, "").trim().replace(/\s+/g, " ");
+            if (/^use \S+$/.test(line) && !uses.includes(line))
+                uses.push(line);
+            i = nl < 0 ? schema.length : nl + 1;
+            continue;
+        }
+        if (keyword[0] !== "definition" && keyword[0] !== "caveat")
+            continue;
+        header.lastIndex = i;
+        const name = header.exec(schema);
+        if (!name)
+            continue;
+        let j = header.lastIndex;
+        let depth = 0;
+        let end = -1;
+        while (j < schema.length) {
+            const past = skipTrivia(schema, j);
+            if (past !== j) {
+                j = past;
+                continue;
+            }
+            if (schema[j] === "{")
+                depth++;
+            else if (schema[j] === "}" && depth > 0 && --depth === 0) {
+                end = j;
+                break;
+            }
+            j++;
+        }
+        if (end < 0)
+            break;
+        blocks.push({ name: name[1], text: schema.slice(start, end + 1).trim() });
+        i = end + 1;
+    }
+    return { uses, blocks };
+}
+export function zedBlocks(schema) {
+    return parseZed(schema).blocks;
+}
+export function mergeZedSchemas(existing, incoming) {
+    const before = parseZed(existing);
+    const after = parseZed(incoming);
+    const merged = new Map();
+    for (const block of before.blocks)
+        merged.set(block.name, block.text);
+    for (const block of after.blocks)
+        merged.set(block.name, block.text);
+    const uses = [...new Set([...before.uses, ...after.uses])];
+    return [...(uses.length ? [uses.join("\n")] : []), ...merged.values()].join("\n\n");
+}
+export const LOCAL_SPICEDB_OWNERS_SECRET = "mesh/local/dev/spicedb/schema-owners";
+export function planLocalSpicedbSchema(input) {
+    const present = new Map(zedBlocks(input.existing).map((b) => [b.name, b.text]));
+    const incoming = zedBlocks(input.incoming);
+    const conflicts = [];
+    const shared = new Set();
+    for (const { name, text } of incoming) {
+        const owner = input.owners[name];
+        if (!owner || owner === input.app || !present.has(name))
+            continue;
+        if (sameDefinition(present.get(name), text) && !/\bops_/.test(text))
+            shared.add(name);
+        else
+            conflicts.push({ type: name, owner });
+    }
+    if (conflicts.length > 0)
+        return { ok: false, conflicts };
+    const owners = {};
+    for (const [name, owner] of Object.entries(input.owners))
+        if (present.has(name))
+            owners[name] = owner;
+    for (const { name } of incoming)
+        if (!shared.has(name))
+            owners[name] = input.app;
+    const schema = mergeZedSchemas(input.existing, input.incoming);
+    const changed = !input.existing || mergeZedSchemas("", input.existing) !== schema;
+    return { ok: true, schema, owners, changed };
+}
+function sameDefinition(a, b) {
+    return a.replace(/\s+/g, "") === b.replace(/\s+/g, "");
+}
+export class LocalSpicedbConflictError extends Error {
+    app;
+    conflicts;
+    constructor(app, conflicts) {
+        const types = conflicts.map((c) => `'${c.type}' (owned by ${c.owner})`).join(", ");
+        super(`${app}'s SpiceDB schema declares ${conflicts.length === 1 ? "a type" : "types"} another local app already owns on the local SpiceDB: ${types}. ` +
+            `It was not written, so ${app} keeps its own local fallback and local keys' bundle assignments do not reach it. ` +
+            `Rename the type in ${app}'s schema, or run one of these apps at a time (mesh stop --destroy clears the local SpiceDB).`);
+        this.app = app;
+        this.conflicts = conflicts;
+        this.name = "LocalSpicedbConflictError";
+    }
+}
+export function zedOf(value) {
+    const zed = typeof value === "string" ? value : value?.zed;
+    if (typeof zed !== "string" || !zed.trim())
+        throw new Error("the spicedbSchema export returned no zed schema");
+    return zed;
+}
+async function spicedbHttp(path, body) {
+    const res = await fetch(`${HOST_HTTP}${path}`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${LOCAL_SPICEDB_KEY}`, "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    const parsed = (await res.json().catch(() => ({})));
+    if (!res.ok)
+        throw Object.assign(new Error(`SpiceDB ${path}: ${res.status} ${parsed.message ?? ""}`.trim()), { status: res.status });
+    return parsed;
+}
+async function readLocalSpicedbSchema() {
+    try {
+        return (await spicedbHttp("/v1/schema/read", {})).schemaText ?? "";
+    }
+    catch (err) {
+        if (err.status !== 404)
+            throw err;
+        return "";
+    }
+}
+async function readLocalSpicedbOwners(awsConfig) {
+    const { SecretsManagerClient, GetSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
+    try {
+        const out = await new SecretsManagerClient(awsConfig).send(new GetSecretValueCommand({ SecretId: LOCAL_SPICEDB_OWNERS_SECRET }));
+        const parsed = JSON.parse(out.SecretString ?? "{}");
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        return Object.fromEntries(Object.entries(parsed).filter((e) => typeof e[1] === "string"));
+    }
+    catch (err) {
+        if (isAwsErrorCode(err, "ResourceNotFoundException"))
+            return {};
+        throw err;
+    }
+}
+async function writeLocalSpicedbOwners(awsConfig, owners) {
+    const { SecretsManagerClient, CreateSecretCommand, PutSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
+    const sm = new SecretsManagerClient(awsConfig);
+    const secret = JSON.stringify(owners);
+    await sm
+        .send(new CreateSecretCommand({ Name: LOCAL_SPICEDB_OWNERS_SECRET, SecretString: secret }))
+        .catch(() => sm.send(new PutSecretValueCommand({ SecretId: LOCAL_SPICEDB_OWNERS_SECRET, SecretString: secret })));
+}
+export function localSpicedbIo(tenant, awsConfig) {
+    return {
+        readSchema: readLocalSpicedbSchema,
+        writeSchema: async (schema) => {
+            await spicedbHttp("/v1/schema/write", { schema });
+        },
+        readOwners: () => readLocalSpicedbOwners(awsConfig),
+        writeOwners: (owners) => writeLocalSpicedbOwners(awsConfig, owners),
+        writeSeed: writeLocalSpicedbSeed,
+        register: () => registerLocalSpicedb(tenant, awsConfig),
+    };
+}
+export async function writeLocalSpicedbSchema(app, zed, io) {
+    const [existing, owners] = await Promise.all([io.readSchema(), io.readOwners()]);
+    const plan = planLocalSpicedbSchema({ existing, incoming: zed, owners, app });
+    if (!plan.ok)
+        throw new LocalSpicedbConflictError(app, plan.conflicts);
+    if (plan.changed)
+        await io.writeSchema(plan.schema);
+    await io.writeOwners(plan.owners);
+    return plan.changed;
+}
+export async function connectLocalSpicedb(input) {
+    const { app, tenant, io } = input;
+    const notes = [];
+    try {
+        await writeLocalSpicedbSchema(app, zedOf(await input.schema()), io);
+        if (input.seed) {
+            const seed = seedUpdates(await input.seed());
+            notes.push(...seed.problems);
+            await io.writeSeed(seed.updates);
+        }
+        await io.register();
+        return { instanceRefs: [localSpicedbRef(tenant)], env: localAuthzServiceEnv(tenant, app), notes };
+    }
+    catch (err) {
+        notes.push(err instanceof LocalSpicedbConflictError
+            ? err.message
+            : `the app's SpiceDB schema was not written to the local SpiceDB (${err instanceof Error ? err.message : String(err)}), so local keys' bundle assignments do not reach the app`);
+        return { instanceRefs: [], env: {}, notes };
+    }
+}
+export async function registerLocalSpicedb(tenant, awsConfig) {
+    const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+    const { SecretsManagerClient, CreateSecretCommand, PutSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
+    const sm = new SecretsManagerClient(awsConfig);
+    const secret = JSON.stringify({ PRESHARED_KEY: LOCAL_SPICEDB_KEY });
+    await sm
+        .send(new CreateSecretCommand({ Name: LOCAL_SPICEDB_KEY_SECRET, SecretString: secret }))
+        .catch(() => sm.send(new PutSecretValueCommand({ SecretId: LOCAL_SPICEDB_KEY_SECRET, SecretString: secret })));
+    await new SSMClient(awsConfig).send(new PutParameterCommand({
+        Name: localSpicedbInstancePath(tenant),
+        Type: "String",
+        Overwrite: true,
+        Value: JSON.stringify(localSpicedbInstanceValue()),
+    }));
+}
+const OBJECT = /^([a-z][a-z0-9_/]*):([a-zA-Z0-9/_|\-=+*]+)$/;
+export function seedUpdates(value) {
+    const problems = [];
+    const updates = [];
+    if (!Array.isArray(value))
+        return { updates, problems: ["the spicedbSeed export did not return a list of relationships"] };
+    for (const [i, entry] of value.entries()) {
+        const { resource, relation, subject } = (entry ?? {});
+        const [subjectObject, subjectRelation] = typeof subject === "string" ? subject.split("#") : [];
+        const res = typeof resource === "string" ? OBJECT.exec(resource) : null;
+        const sub = typeof subjectObject === "string" ? OBJECT.exec(subjectObject) : null;
+        if (!res || !sub || typeof relation !== "string" || !/^[a-z][a-z0-9_]*$/.test(relation)) {
+            problems.push(`spicedbSeed[${i}] is not { resource: "type:id", relation, subject: "type:id[#relation]" }`);
+            continue;
+        }
+        updates.push({
+            operation: "OPERATION_TOUCH",
+            relationship: {
+                resource: { objectType: res[1], objectId: res[2] },
+                relation,
+                subject: {
+                    object: { objectType: sub[1], objectId: sub[2] },
+                    ...(subjectRelation ? { optionalRelation: subjectRelation } : {}),
+                },
+            },
+        });
+    }
+    return { updates, problems };
+}
+export async function writeLocalSpicedbSeed(updates) {
+    if (updates.length > 0)
+        await spicedbHttp("/v1/relationships/write", { updates });
+}

package/dist/src/commands/local/publish-docs.d.ts

@@ -0,0 +1,81 @@
+import { type ApiRegistryEntry, type DocsEventsCatalog, type OperationAvailability, type SandboxMode } from "@mesh-tech/api-registry";
+export interface LocalDocsDeclaration {
+    config: string;
+    actAs: boolean;
+    sandbox?: SandboxMode;
+    local?: string;
+    service?: string;
+    integrationTryIt?: string[];
+}
+export interface LocalPublishDeclaration {
+    docs?: LocalDocsDeclaration;
+    authzMetadata?: string;
+    authzSpicedbSchema?: string;
+    authzSpicedbSeed?: string;
+    problems: string[];
+}
+export declare function readLocalPublishDeclaration(pkg: unknown, appRoot: string): LocalPublishDeclaration;
+export declare function callExport(appRoot: string, spec: string, arg?: unknown): Promise<unknown>;
+export declare function localDocsEntry(input: {
+    name: string;
+    title: string;
+    description?: string;
+    docs: {
+        url: string;
+        contentHash: string;
+        sourceUrl: string;
+        sourceContentHash: string;
+    };
+    httpPort: number;
+    namespace: string;
+    actAs: boolean;
+    integrations?: readonly string[];
+    sandbox?: SandboxMode;
+    eventsEntry?: string;
+}): ApiRegistryEntry;
+export declare const LOCAL_PLATFORM_NETWORK = "mesh-local_mesh_network";
+export declare function aliasContainerArgs(input: {
+    name: string;
+    namespace: string;
+    port: number;
+}): string[];
+export declare function aliasContainerName(namespace: string): string;
+export declare function removeAllAliasContainers(): string[];
+export interface LocalDocsExport {
+    availability?: Record<string, OperationAvailability>;
+    events?: DocsEventsCatalog;
+    sandbox?: unknown;
+    env?: Record<string, string>;
+}
+export declare function resolveLocalSandbox(local: LocalDocsExport, declared: SandboxMode | undefined): {
+    sandbox: SandboxMode;
+    pins: Record<string, string>;
+    notes: string[];
+};
+export interface PublishLocalDocsInput {
+    appRoot: string;
+    tenant: string;
+    app: string;
+    httpPort: number;
+    serviceEnv: Record<string, string>;
+    zitadel?: {
+        projectId: string;
+        orgId: string;
+        issuer: string;
+    };
+    awsConfig: object;
+    declaration: LocalPublishDeclaration;
+}
+export interface PublishLocalDocsResult {
+    problems: string[];
+    notes: string[];
+    pins: Record<string, string>;
+    authzPublished: boolean;
+    authzEnv: Record<string, string>;
+    docsPublished: boolean;
+    sandbox?: SandboxMode;
+    actAs: boolean;
+}
+export declare function publishLocalDocs(input: PublishLocalDocsInput): Promise<PublishLocalDocsResult>;
+export declare function localAuthzPointerPath(tenant: string, app: string): string;
+export declare function unpublishLocalDocs(tenant: string, app: string, awsConfig: object): Promise<string[]>;