@monster-orange/den 0.0.0-stage → 0.1.0

package/src/shared/environment/env-selector.ts

@@ -0,0 +1,161 @@
+/**
+ * Environment Selector
+ * Loads and validates environment configurations
+ */
+
+import { readFile } from "fs/promises";
+import { resolve, join } from "path";
+import type { Environment, EnvironmentConfig } from "../types/index.js";
+
+export class EnvironmentSelector {
+  private configDir: string;
+  private cache: Map<string, EnvironmentConfig> = new Map();
+
+  constructor(configDir: string = "./config/environments") {
+    this.configDir = resolve(configDir);
+  }
+
+  /**
+   * Load environment configuration
+   */
+  async loadEnvironment(env: Environment): Promise<EnvironmentConfig> {
+    // Check cache first
+    if (this.cache.has(env)) {
+      return this.cache.get(env)!;
+    }
+
+    const configPath = join(this.configDir, `${env}.json`);
+
+    try {
+      const content = await readFile(configPath, "utf-8");
+      const config: EnvironmentConfig = JSON.parse(content);
+
+      // Validate config
+      this.validateConfig(config, env);
+
+      // Cache and return
+      this.cache.set(env, config);
+      return config;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+        throw new Error(
+          `Environment configuration not found: ${env}\n` +
+            `Expected file: ${configPath}\n` +
+            `Available environments: ${(await this.getAvailableEnvironments()).join(", ")}`,
+        );
+      }
+      throw new Error(
+        `Failed to load environment config for "${env}": ${(error as Error).message}`,
+      );
+    }
+  }
+
+  /**
+   * Get list of available environments
+   */
+  async getAvailableEnvironments(): Promise<Environment[]> {
+    const { readdir } = await import("fs/promises");
+    const preferredOrder: Environment[] = [
+      "local",
+      "dev",
+      "sandbox",
+      "staging",
+      "beta",
+      "prod",
+      "production",
+    ];
+
+    try {
+      const files = await readdir(this.configDir);
+      const available = files
+        .filter((f) => f.endsWith(".json"))
+        .map((f) => f.replace(".json", "") as Environment)
+        .filter((e) => preferredOrder.includes(e));
+
+      // Sort by preferred order
+      return available.sort(
+        (a, b) => preferredOrder.indexOf(a) - preferredOrder.indexOf(b),
+      );
+    } catch {
+      return preferredOrder;
+    }
+  }
+
+  /**
+   * Check if environment exists
+   */
+  async environmentExists(env: Environment): Promise<boolean> {
+    const { access } = await import("fs/promises");
+    const configPath = join(this.configDir, `${env}.json`);
+    try {
+      await access(configPath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Validate environment configuration
+   */
+  private validateConfig(config: EnvironmentConfig, env: Environment): void {
+    if (!config.name) {
+      throw new Error(`Invalid config for ${env}: missing "name" field`);
+    }
+
+    if (config.name !== env) {
+      throw new Error(
+        `Invalid config for ${env}: "name" field is "${config.name}" but should be "${env}"`,
+      );
+    }
+
+    if (!config.baseUrls) {
+      throw new Error(`Invalid config for ${env}: missing "baseUrls" field`);
+    }
+
+    if (!config.baseUrls.web || !config.baseUrls.api) {
+      throw new Error(
+        `Invalid config for ${env}: "baseUrls" must contain "web" and "api"`,
+      );
+    }
+
+    const provider = config.auth?.provider ?? (config.auth0 ? "auth0" : "none");
+    if (
+      provider === "auth0" &&
+      (!config.auth0 || !config.auth0.domain || !config.auth0.clientId)
+    ) {
+      throw new Error(
+        `Invalid config for ${env}: missing or incomplete "auth0" field`,
+      );
+    }
+    if (
+      provider === "cognito" &&
+      (!config.auth?.cognito?.region || !config.auth.cognito.clientId)
+    ) {
+      throw new Error(
+        `Invalid config for ${env}: auth.provider "cognito" needs auth.cognito.region and auth.cognito.clientId`,
+      );
+    }
+    if (provider === "local-jwt" && !config.auth?.localJwt?.secretKey) {
+      throw new Error(
+        `Invalid config for ${env}: auth.provider "local-jwt" needs auth.localJwt.secretKey`,
+      );
+    }
+
+    if (!config.timeouts || typeof config.timeouts.api !== "number") {
+      throw new Error(
+        `Invalid config for ${env}: missing or invalid "timeouts" field`,
+      );
+    }
+  }
+
+  /**
+   * Clear cache
+   */
+  clearCache(): void {
+    this.cache.clear();
+  }
+}
+
+// Export singleton instance
+export const envSelector = new EnvironmentSelector();

package/src/shared/environment/playwright-env.ts

@@ -0,0 +1,82 @@
+/**
+ * Playwright Config Helpers — environment resolution for sync `defineConfig` callers.
+ *
+ * The async `envSelector` (see env-selector.ts) is the canonical loader at
+ * runtime, but Playwright's `defineConfig` is synchronous and runs before
+ * any test fixtures, so it cannot await. These helpers centralize the small
+ * amount of env-resolution logic Playwright configs need at config-load
+ * time:
+ *
+ *   - resolveEnv      → which `Environment` is this run targeting?
+ *   - resolveAuthPath → where is the saved browser storageState for {role,env}?
+ *   - resolveBrowserBaseUrl → canonical web URL from config/environments/<env>.json
+ *
+ * `resolveBrowserBaseUrl` reads the env JSON synchronously (readFileSync)
+ * because it runs at module-eval time inside the Playwright config. This is
+ * the same source of truth `envSelector.loadEnvironment` consumes — just the
+ * sync flavour.
+ */
+import { readFileSync } from "fs";
+import { resolve } from "path";
+import type { Environment, EnvironmentConfig } from "../types/index.js";
+import { getDistRoot } from "../paths.js";
+
+export type Role = "admin" | "user" | "beta";
+
+/**
+ * Resolve the target environment from `E2E_ENVIRONMENT`, falling back to
+ * `defaultEnv` (typically "local").
+ */
+export function resolveEnv(defaultEnv: Environment = "local"): Environment {
+  const fromEnv = process.env.E2E_ENVIRONMENT;
+  return (fromEnv && fromEnv.length > 0 ? fromEnv : defaultEnv) as Environment;
+}
+
+/**
+ * Absolute path to the saved browser storageState file for a given role+env.
+ *
+ * Convention: `<repoRoot>/playwright/.auth/<role>-<env>.json`. Mirrors the
+ * pattern used in `pillars/browser/global-setup.ts` when sessions are minted.
+ */
+export function resolveAuthPath(
+  role: Role,
+  env: Environment,
+  repoRoot: string,
+): string {
+  return resolve(repoRoot, `playwright/.auth/${role}-${env}.json`);
+}
+
+/**
+ * Canonical browser-facing base URL for `env`, read synchronously from
+ * `config/environments/<env>.json`. Same source of truth as the async
+ * `envSelector.loadEnvironment(env).baseUrls.web`.
+ *
+ * Throws if the env config is missing/malformed — fail fast at config-load
+ * rather than letting Playwright proceed with a bogus baseURL.
+ */
+export function resolveBrowserBaseUrl(env: Environment): string {
+  // read-only fail-fast lookup, den-root anchored for determinism
+  const configPath = resolve(getDistRoot(), `config/environments/${env}.json`);
+  let raw: string;
+  try {
+    raw = readFileSync(configPath, "utf-8");
+  } catch (error) {
+    throw new Error(
+      `[playwright-env] Cannot read environment config for "${env}" at ${configPath}: ${(error as Error).message}`,
+    );
+  }
+  let cfg: EnvironmentConfig;
+  try {
+    cfg = JSON.parse(raw) as EnvironmentConfig;
+  } catch (error) {
+    throw new Error(
+      `[playwright-env] Invalid JSON in ${configPath}: ${(error as Error).message}`,
+    );
+  }
+  if (!cfg.baseUrls || !cfg.baseUrls.web) {
+    throw new Error(
+      `[playwright-env] Env config ${configPath} is missing baseUrls.web`,
+    );
+  }
+  return cfg.baseUrls.web;
+}

package/src/shared/environment-manager/catalog.ts

@@ -0,0 +1,77 @@
+/**
+ * Service Catalog
+ *
+ * Manages config/local/service-catalog.yml — the per-engineer registry of
+ * repos known to den, whether linked (developer's own checkout) or managed
+ * (den clones and updates them).
+ *
+ * Gracefully returns an empty catalog when the file does not exist so that
+ * all callers work on a fresh machine without requiring setup first.
+ */
+
+import * as fs from "fs";
+import * as path from "path";
+import * as yaml from "yaml";
+import type { ServiceCatalog, ServiceCatalogEntry } from "../types/index.js";
+import { getDistRoot } from "../paths.js";
+import { requireGithubOrg } from "../den-config.js";
+
+/** Fallback GitHub org when `config/den.yml` doesn't set `github_org`. */
+
+const ROOT = getDistRoot();
+const CATALOG_PATH = path.join(ROOT, "config", "local", "service-catalog.yml");
+
+export function readCatalog(): ServiceCatalog {
+  try {
+    const raw = fs.readFileSync(CATALOG_PATH, "utf-8");
+    const parsed = yaml.parse(raw) as unknown;
+    if (parsed == null) return {}; // empty file
+    if (typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error(
+        `Malformed service catalog at ${CATALOG_PATH}: expected a mapping`,
+      );
+    }
+    return parsed as ServiceCatalog;
+  } catch (err: unknown) {
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") return {};
+    throw err;
+  }
+}
+
+export function writeCatalog(catalog: ServiceCatalog): void {
+  fs.mkdirSync(path.dirname(CATALOG_PATH), { recursive: true });
+  fs.writeFileSync(CATALOG_PATH, yaml.stringify(catalog), "utf-8");
+}
+
+export function upsertCatalogEntry(
+  repoName: string,
+  entry: ServiceCatalogEntry,
+): void {
+  const catalog = readCatalog();
+  catalog[repoName] = entry;
+  writeCatalog(catalog);
+}
+
+/**
+ * GitHub slug to clone `repoName` from.
+ *
+ * The catalog's `gh` when set, else the conventional `<github_org>/<repo>` —
+ * the same rule `seedDefaultWorkspace` uses. Entries written by the
+ * dev-managed add flow carry `gh: ""`, so a repo can be IN the catalog and
+ * still have no slug; deriving it (rather than refusing to clone) is what lets
+ * a repo switched to managed actually be cloned.
+ */
+export function resolveRepoGhSlug(
+  repoName: string,
+  catalog: ServiceCatalog = readCatalog(),
+): string {
+  const gh = catalog[repoName]?.gh?.trim();
+  if (gh) return gh;
+  return `${requireGithubOrg()}/${repoName}`;
+}
+
+export function removeCatalogEntry(repoName: string): void {
+  const catalog = readCatalog();
+  delete catalog[repoName];
+  writeCatalog(catalog);
+}

package/src/shared/environment-manager/clone-guard.ts

@@ -0,0 +1,163 @@
+/**
+ * Clone-destination preflight (defense in depth for the Jun 29 incident).
+ *
+ * Path anchoring (getDistRoot) is the first line of defense; this guard is
+ * the second: even if some entry point regresses and computes a destination
+ * from the wrong anchor, refuse to clone anywhere that could damage another
+ * repo. Refusal conditions:
+ *
+ *  1. OUTSIDE DEN-OWNED LOCATIONS — destinations must live under the
+ *     repos root, den-workspaces, .den-services, or .smoke-clones.
+ *
+ *  2. SELF-NESTING — the destination is inside a checkout of the same repo
+ *     being cloned (e.g. ~/projects/infra-stack/infra-stack).
+ *
+ *  3. FOREIGN WORKING TREE — the destination sits inside an existing git
+ *     working tree that den does not own. (Den's own tree is expected:
+ *     .den-services/ and .smoke-clones/ live inside the den checkout.
+ *     A tree that already enclosed the allowed root itself — e.g. a
+ *     home-directory dotfiles repo above ~/projects — is the user's chosen
+ *     layout and is allowed.)
+ *
+ * Refusals throw with the computed destination, cwd, and resolved den root
+ * so a misconfiguration is diagnosable in one glance.
+ */
+
+import { execFileSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import { getDistRoot } from "../paths.js";
+import { getReposRoot } from "../den-config.js";
+import { DEN_SERVICES_DIR, DEN_WORKSPACES_DIR } from "./workspaces.js";
+
+import { envKey, product } from "../product.js";
+export class CloneDestinationError extends Error {}
+
+/**
+ * Split `p` into the realpath of its nearest EXISTING ancestor plus the
+ * not-yet-existing suffix. Never collapses the suffix — a collapsed path
+ * compared against the allowlist would over- or under-permit.
+ */
+function splitExisting(p: string): { real: string; suffix: string } {
+  let probe = path.resolve(p);
+  let suffix = "";
+  for (;;) {
+    if (fs.existsSync(probe)) {
+      let real = probe;
+      try {
+        real = fs.realpathSync(probe);
+      } catch {
+        /* keep unresolved */
+      }
+      return { real, suffix };
+    }
+    suffix = suffix
+      ? path.join(path.basename(probe), suffix)
+      : path.basename(probe);
+    const parent = path.dirname(probe);
+    if (parent === probe) return { real: probe, suffix };
+    probe = parent;
+  }
+}
+
+/** `p` with symlinks resolved on its existing prefix (macOS /tmp → /private/tmp). */
+function realFull(p: string): string {
+  const { real, suffix } = splitExisting(p);
+  return suffix ? path.join(real, suffix) : real;
+}
+
+/** Toplevel of the git working tree containing existing dir `dir`, or null. */
+function gitToplevelOf(dir: string): string | null {
+  try {
+    const out = execFileSync(
+      "git",
+      ["-C", dir, "rev-parse", "--show-toplevel"],
+      {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "ignore"],
+      },
+    ).trim();
+    return out ? realFull(out) : null;
+  } catch {
+    return null; // not inside a git working tree (or git unavailable)
+  }
+}
+
+function isWithin(child: string, parent: string): boolean {
+  const rel = path.relative(parent, child);
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
+function refuse(
+  reason: string,
+  dest: string,
+  extra: Record<string, string> = {},
+): never {
+  const lines = [
+    `${product().cli}: REFUSING to clone — ${reason}`,
+    `  destination:  ${dest}`,
+    `  process cwd:  ${process.cwd()}`,
+    `  ${product().cli} root:  ${getDistRoot()}`,
+  ];
+  for (const [k, v] of Object.entries(extra)) lines.push(`  ${k}:  ${v}`);
+  lines.push(
+    `  If the destination is wrong, fix the anchor (${envKey("ROOT")} / ` +
+      `repos_root in ${product().configFile}) rather than cloning by hand.`,
+  );
+  throw new CloneDestinationError(lines.join("\n"));
+}
+
+/**
+ * Throw (CloneDestinationError) unless `dest` is a safe place to create a
+ * fresh clone of `repoName`. Call BEFORE any mkdir/clone side effect.
+ */
+export function assertSafeCloneDestination(
+  dest: string,
+  repoName: string,
+): void {
+  const absDest = path.resolve(dest);
+  const distRoot = realFull(getDistRoot());
+
+  const allowedRoots = [
+    realFull(getReposRoot()),
+    realFull(DEN_WORKSPACES_DIR),
+    realFull(DEN_SERVICES_DIR),
+    realFull(path.join(distRoot, ".smoke-clones")),
+  ];
+
+  const destReal = realFull(absDest);
+  const containingRoot = allowedRoots.find((r) => isWithin(destReal, r));
+  if (!containingRoot) {
+    refuse(
+      `destination is outside every ${product().cli}-owned location`,
+      absDest,
+      {
+        "allowed under": allowedRoots.join(" | "),
+      },
+    );
+  }
+
+  const enclosingTree = gitToplevelOf(
+    splitExisting(path.dirname(absDest)).real,
+  );
+  if (enclosingTree) {
+    if (path.basename(enclosingTree) === repoName) {
+      refuse(
+        `destination would nest ${repoName} inside a checkout of itself`,
+        absDest,
+        { "enclosing git working tree": enclosingTree },
+      );
+    }
+    const isDenTree = enclosingTree === distRoot;
+    // A tree that encloses the allowed root itself (repos root under a
+    // dotfiles-home repo, etc.) predates den's write — user's layout.
+    const enclosesAllowedRoot = isWithin(containingRoot, enclosingTree);
+    if (!isDenTree && !enclosesAllowedRoot) {
+      refuse(
+        `destination is inside a git working tree ${product().cli} does not own`,
+        absDest,
+        { "enclosing git working tree": enclosingTree },
+      );
+    }
+  }
+}