@monster-orange/den 0.2.7 → 0.3.0

package/src/shared/secrets/none.ts

@@ -0,0 +1,56 @@
+/**
+ * The `none` strategy: no secrets backend. What a distribution gets when it
+ * sets no `secrets.provider`. It resolves nothing, never spawns a CLI, and
+ * every secret-backed feature reports "not configured" instead of failing.
+ */
+import { product } from "../product.js";
+import type { PreflightResult, SecretRef, SecretsProvider } from "./types.js";
+
+/**
+ * "not configured: set secrets.provider and secrets.refs.<name> in
+ * config/<cli>.yml" — the one message every surface shows for a secret Den
+ * has no configured place for.
+ */
+export function notConfiguredMessage(refName = "<name>"): string {
+  return `not configured: set secrets.provider and secrets.refs.${refName} in ${product().configFile}`;
+}
+
+/** Thrown when a secret is asked of a backend or ref that is not configured. */
+export class SecretsNotConfiguredError extends Error {
+  readonly code = "not-configured";
+  constructor(message = notConfiguredMessage()) {
+    super(message);
+    this.name = "SecretsNotConfiguredError";
+  }
+}
+
+export class NoneProvider implements SecretsProvider {
+  readonly name = "none" as const;
+
+  async isReady(): Promise<boolean> {
+    return false;
+  }
+
+  async get(ref: SecretRef): Promise<string> {
+    throw new SecretsNotConfiguredError(
+      `${ref.field || "secret"}: no secrets backend is configured (${notConfiguredMessage()})`,
+    );
+  }
+
+  async tryGet(): Promise<string | null> {
+    return null;
+  }
+
+  async set(): Promise<void> {
+    throw new SecretsNotConfiguredError();
+  }
+
+  async preflight(): Promise<PreflightResult> {
+    // Nothing to sign in to: `up` and `web` run as they are.
+    return { ok: true, message: "no secrets backend configured" };
+  }
+
+  runPrefix(): string[] {
+    return [];
+  }
+}

package/src/shared/secrets/strategies.ts

@@ -0,0 +1,202 @@
+/**
+ * The built-in secrets strategies, registered through the generic strategy
+ * registry (src/shared/strategies/registry.ts) exactly as a plugin would
+ * register one. Each entry is `{ id, kind: "secrets", detect(), capabilities }`.
+ *
+ * Capabilities:
+ *  - `create(cfg)`: the SecretsProvider for this backend;
+ *  - `label`: the name people see ("Save to 1Password");
+ *  - `cli`: the CLI it needs, for `make setup`'s install step;
+ *  - `refComplete(ref)`: whether a configured `secrets.refs.<name>` gives
+ *    this backend enough to address a secret;
+ *  - `env(cfg, env)`: optional vars this backend gives the processes Den
+ *    starts (only 1password: OP_ACCOUNT, from the distribution's config);
+ *  - `setup(ctx)`: optional interactive setup (`make <cli>-setup-secrets`).
+ */
+import * as path from "path";
+import { OP_CLI_TIMEOUT_MS } from "../constants.js";
+import {
+  getStrategy,
+  onPath,
+  registerStrategy,
+  strategyIds,
+  type DetectResult,
+  type StrategyEntry,
+} from "../strategies/registry.js";
+import { DopplerProvider } from "./doppler.js";
+import { EnvProvider } from "./env.js";
+import { NoneProvider } from "./none.js";
+import { OnePasswordProvider } from "./onepassword.js";
+import type { SecretsConfig } from "./index.js";
+import type { SecretRef, SecretsProvider } from "./types.js";
+
+export const SECRETS_KIND = "secrets";
+
+export interface SecretsSetupContext {
+  cfg: SecretsConfig;
+  provider: SecretsProvider;
+  /** Den's package root (its scripts live there). */
+  engineRoot: string;
+  /** The distribution's CLI name, for remediation lines. */
+  cli: string;
+  /** Run a command with inherited stdio; its exit code. */
+  run(cmd: string, args: string[]): number;
+  log(line: string): void;
+  error(line: string): void;
+}
+
+export interface SecretsCapabilities {
+  label: string;
+  create(cfg: SecretsConfig): SecretsProvider;
+  cli?: { bin: string; formula: string };
+  refComplete(ref: Partial<SecretRef>): boolean;
+  env?(cfg: SecretsConfig, env: NodeJS.ProcessEnv): Record<string, string>;
+  setup?(ctx: SecretsSetupContext): Promise<number>;
+}
+
+export type SecretsStrategy = StrategyEntry<
+  typeof SECRETS_KIND,
+  SecretsCapabilities
+>;
+
+const nonEmpty = (v: unknown): boolean =>
+  typeof v === "string" && v.trim().length > 0;
+
+/** Flat-key backends address a secret by its key, or an env-shaped field. */
+const flatRefComplete = (ref: Partial<SecretRef>): boolean =>
+  nonEmpty(ref.key) || nonEmpty(ref.field);
+
+function cliDetect(bin: string, label: string) {
+  return (env: NodeJS.ProcessEnv = process.env): DetectResult =>
+    onPath(bin, env)
+      ? { available: true }
+      : { available: false, reason: `${label} CLI (${bin}) is not on PATH` };
+}
+
+function otherBackends(): string {
+  return (
+    "Or pick another backend in the org config (secrets.provider: env | doppler | 1password),\n" +
+    "  or for just you in config/local/user.yml."
+  );
+}
+
+const none: SecretsStrategy = {
+  id: "none",
+  kind: SECRETS_KIND,
+  detect: () => ({
+    available: true,
+    reason: "no secrets backend configured",
+  }),
+  capabilities: {
+    label: "none",
+    create: () => new NoneProvider(),
+    refComplete: () => false,
+  },
+};
+
+const env: SecretsStrategy = {
+  id: "env",
+  kind: SECRETS_KIND,
+  detect: () => ({ available: true }),
+  capabilities: {
+    label: "environment",
+    create: (c) => new EnvProvider(c.keys),
+    refComplete: flatRefComplete,
+    async setup(ctx) {
+      ctx.log(
+        "The env backend reads secrets from the process environment.\n" +
+          `Export them yourself (direnv, CI secrets, \`doppler run -- ${ctx.cli} up\`).`,
+      );
+      return 0;
+    },
+  },
+};
+
+const doppler: SecretsStrategy = {
+  id: "doppler",
+  kind: SECRETS_KIND,
+  detect: cliDetect("doppler", "The Doppler"),
+  capabilities: {
+    label: "Doppler",
+    create: (c) => new DopplerProvider({ ...c.doppler, keys: c.keys }),
+    cli: { bin: "doppler", formula: "dopplerhq/cli/doppler" },
+    refComplete: flatRefComplete,
+    async setup(ctx) {
+      if (!doppler.detect().available) {
+        ctx.error(
+          "✗ The Doppler CLI is not installed.\n" +
+            `  Install it:  brew install dopplerhq/cli/doppler\n  then re-run: make ${ctx.cli}-setup-secrets\n\n  ` +
+            otherBackends(),
+        );
+        return 1;
+      }
+      if (!(await ctx.provider.isReady())) {
+        ctx.log("→ doppler login");
+        if (ctx.run("doppler", ["login"]) !== 0) return 1;
+      }
+      const scope: string[] = [];
+      if (ctx.cfg.doppler?.project)
+        scope.push("--project", ctx.cfg.doppler.project);
+      if (ctx.cfg.doppler?.config)
+        scope.push("--config", ctx.cfg.doppler.config);
+      ctx.log(`→ doppler setup ${scope.join(" ")}`.trim());
+      if (
+        ctx.run("doppler", ["setup", "--no-interactive", ...scope]) !== 0 &&
+        scope.length === 0
+      ) {
+        ctx.run("doppler", ["setup"]);
+      }
+      return 0;
+    },
+  },
+};
+
+const onepassword: SecretsStrategy = {
+  id: "1password",
+  kind: SECRETS_KIND,
+  detect: cliDetect("op", "The 1Password"),
+  capabilities: {
+    label: "1Password",
+    create: (c) =>
+      new OnePasswordProvider({
+        // From the distribution's config or the engineer's shell; never a
+        // built-in account.
+        account: c.onepassword?.account,
+        timeoutMs: OP_CLI_TIMEOUT_MS,
+      }),
+    cli: { bin: "op", formula: "1password-cli" },
+    refComplete: (ref) => nonEmpty(ref.item) && nonEmpty(ref.field),
+    env(c, e): Record<string, string> {
+      const account = c.onepassword?.account?.trim() || e.OP_ACCOUNT?.trim();
+      return account ? { OP_ACCOUNT: account } : {};
+    },
+    async setup(ctx) {
+      if (!onepassword.detect().available) {
+        ctx.error(
+          "✗ The 1Password CLI (op) is not installed.\n" +
+            `  Install it:  brew install 1password-cli\n\n  ` +
+            otherBackends(),
+        );
+        return 1;
+      }
+      return ctx.run(path.join(ctx.engineRoot, "node_modules", ".bin", "tsx"), [
+        path.join(ctx.engineRoot, "scripts", "setup-1password.ts"),
+      ]);
+    },
+  },
+};
+
+for (const s of [none, env, doppler, onepassword]) registerStrategy(s);
+
+/** The registered secrets strategy `id`, or undefined. */
+export function secretsStrategy(id: string): SecretsStrategy | undefined {
+  return getStrategy<typeof SECRETS_KIND, SecretsCapabilities>(
+    SECRETS_KIND,
+    id,
+  );
+}
+
+/** Every registered secrets strategy id. */
+export function secretsStrategyIds(): string[] {
+  return strategyIds(SECRETS_KIND);
+}

package/src/shared/secrets/types.ts

@@ -34,7 +34,7 @@ export interface SecretRef {
   scoped?: true;
 }
 
-export type SecretsProviderName = "doppler" | "1password" | "env";
+export type SecretsProviderName = "none" | "doppler" | "1password" | "env";
 
 export interface PreflightResult {
   ok: boolean;

package/src/shared/smoke/git-remote.ts

@@ -12,6 +12,8 @@
  */
 
 import { execSync } from "child_process";
+import * as fs from "fs";
+import { isPlaceholderGithubOrg } from "../den-config.js";
 
 export interface GitHubCoords {
   owner: string;
@@ -68,3 +70,41 @@ export function getGitHubCoords(repoPath: string): GitHubCoords | null {
   if (!origin) return null;
   return parseGitHubOwnerRepo(origin);
 }
+
+/**
+ * The GitHub owner of the distribution's OWN checkout: `distRoot`'s origin,
+ * and only when `distRoot` is the top of its own git repo. A distribution
+ * with no repo of its own (one nested in another checkout, such as Den's)
+ * has no owner here: the engine's (or any parent's) remote is never used to
+ * pick the org whose repos Den lists. Null when there is none.
+ */
+export function distributionGitHubOwner(distRoot: string): string | null {
+  try {
+    const top = execSync("git rev-parse --show-toplevel", {
+      cwd: distRoot,
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf-8",
+    }).trim();
+    if (!top || fs.realpathSync(top) !== fs.realpathSync(distRoot)) return null;
+  } catch {
+    return null;
+  }
+  return getGitHubCoords(distRoot)?.owner ?? null;
+}
+
+/**
+ * The GitHub org whose repos Den lists for "register a managed repo": the
+ * org config's `github_org`, else the distribution's own checkout's owner.
+ * Never the engine's. Null (the caller asks for github_org) when neither
+ * names a valid owner.
+ */
+export function managedReposOrg(
+  githubOrg: string | undefined,
+  distRoot: string,
+): string | null {
+  const set = githubOrg?.trim();
+  // A placeholder (`your-github-org`) is not an org: never list it.
+  const configured = set && !isPlaceholderGithubOrg(set) ? set : "";
+  const org = configured || distributionGitHubOwner(distRoot);
+  return org && /^[A-Za-z0-9][A-Za-z0-9-]*$/.test(org) ? org : null;
+}

package/src/shared/stacks/manifest-commands.ts

@@ -14,7 +14,7 @@ import { product } from "../product.js";
 type CommandDef = string | { cmd: string; detachable?: boolean };
 
 /** Whether `subsystem` is the repo's primary service (the one the stack belongs to). */
-function isPrimary(manifest: RawManifest, subsystem: string): boolean {
+export function isPrimary(manifest: RawManifest, subsystem: string): boolean {
   const keys = Object.keys(manifest.services ?? {});
   if (manifest.entrypoint) return manifest.entrypoint === subsystem;
   return keys.length <= 1;

package/src/shared/stacks/namespace.ts

@@ -0,0 +1,178 @@
+/**
+ * A workspace's stack namespace: the suffix its stacks' Compose projects run
+ * under (`<stack>-<namespace>`), and so the names of their containers,
+ * volumes and networks.
+ *
+ * By default it is the workspace's own name (`default`: `main`, see
+ * stackWorkspace). A workspace can set `stack_namespace` to opt out: several
+ * workspaces may then share one namespace, and a stack keeps its data when
+ * its repo moves between workspaces. First match wins:
+ *
+ *   1. `stack_namespace:` on the workspace in workspaces.yml (per machine)
+ *   2. `stack_namespace:` on the same-named blueprint workspace
+ *   3. stackWorkspace(name)
+ *
+ * Every stack code path turns a den workspace into its suffix through
+ * resolveStackWorkspaces (status.ts), which calls this; DEN_STACK_WORKSPACE
+ * still wins there, for one process.
+ */
+import {
+  checkStackNamespace,
+  readBlueprintStackNamespaces,
+  readDenConfig,
+  type DenConfig,
+} from "../den-config.js";
+import { readWorkspacesFile } from "../environment-manager/workspaces.js";
+import { cachedRead } from "../read-cache.js";
+import type { WorkspacesFile } from "../types/index.js";
+import { stackWorkspace } from "./render.js";
+
+/** Which step gave the namespace. */
+export type StackNamespaceSource = "workspace" | "blueprint" | "default";
+
+export interface StackNamespace {
+  workspace: string;
+  /** The Compose project suffix. */
+  namespace: string;
+  source: StackNamespaceSource;
+  /** What it would be with no `stack_namespace` anywhere. */
+  defaultNamespace: string;
+  /** workspaces.yml overriding a different blueprint value, as a sentence. */
+  warnings: string[];
+}
+
+export interface StackNamespaceContext {
+  file: Pick<WorkspacesFile, "workspaces">;
+  /** Blueprint `stack_namespace` by workspace name. */
+  blueprint: Record<string, string>;
+}
+
+/**
+ * workspaces.yml and the blueprint's namespaces, as they are now. A
+ * workspaces file that cannot be read sets no namespace (its other readers
+ * report it), and so does an unreadable org config; a bad
+ * `stack_namespace` value still throws.
+ */
+export function readStackNamespaceContext(): StackNamespaceContext {
+  return cachedRead("stack-namespace-context", () => {
+    let file: StackNamespaceContext["file"] = { workspaces: {} };
+    try {
+      file = readWorkspacesFile() ?? file;
+    } catch {
+      /* unreadable: no workspace sets one */
+    }
+    let config: DenConfig | null = null;
+    try {
+      config = readDenConfig();
+    } catch {
+      /* unreadable: no blueprint sets one */
+    }
+    return {
+      file,
+      blueprint: config ? readBlueprintStackNamespaces(config) : {},
+    };
+  });
+}
+
+/**
+ * Resolve one workspace's stack namespace. A malformed `stack_namespace`
+ * (workspaces.yml or blueprint) throws, naming the key: falling back to
+ * another name would run the stacks against other volumes.
+ */
+export function resolveStackNamespace(
+  name: string,
+  ctx: StackNamespaceContext = readStackNamespaceContext(),
+): StackNamespace {
+  const defaultNamespace = stackWorkspace(name);
+  const own = checkStackNamespace(
+    `workspaces.${name}.stack_namespace (config/local/workspaces.yml)`,
+    ctx.file.workspaces?.[name]?.stack_namespace,
+  );
+  const bp = ctx.blueprint[name];
+  const warnings: string[] = [];
+  if (own) {
+    if (bp && bp !== own)
+      warnings.push(
+        `workspace ${name}: stack_namespace ${own} in workspaces.yml overrides the blueprint's stack_namespace ${bp}`,
+      );
+    return {
+      workspace: name,
+      namespace: own,
+      source: "workspace",
+      defaultNamespace,
+      warnings,
+    };
+  }
+  if (bp)
+    return {
+      workspace: name,
+      namespace: bp,
+      source: "blueprint",
+      defaultNamespace,
+      warnings,
+    };
+  return {
+    workspace: name,
+    namespace: defaultNamespace,
+    source: "default",
+    defaultNamespace,
+    warnings,
+  };
+}
+
+/** One workspace's namespace as the lists show it: resolved, or the error. */
+export interface StackNamespaceRow {
+  workspace: string;
+  /** The resolved namespace; null when its config is invalid. */
+  stack_namespace: string | null;
+  source: StackNamespaceSource | null;
+  /** The suffix with no `stack_namespace` anywhere. */
+  default: string;
+  /** True when the namespace is not the default suffix. */
+  differs: boolean;
+  warnings: string[];
+  error?: string;
+}
+
+/**
+ * Every named workspace's stack namespace, for `workspace list` and
+ * `/api/workspaces`. A bad value is that row's error, never the list's.
+ */
+export function stackNamespaceRows(
+  names: string[],
+  ctx?: StackNamespaceContext,
+): StackNamespaceRow[] {
+  let c: StackNamespaceContext | null = ctx ?? null;
+  let ctxError: string | null = null;
+  if (!c)
+    try {
+      c = readStackNamespaceContext();
+    } catch (e) {
+      ctxError = (e as Error).message;
+    }
+  return names.map((workspace) => {
+    const fallback = stackWorkspace(workspace);
+    try {
+      if (!c) throw new Error(ctxError ?? "unreadable");
+      const ns = resolveStackNamespace(workspace, c);
+      return {
+        workspace,
+        stack_namespace: ns.namespace,
+        source: ns.source,
+        default: ns.defaultNamespace,
+        differs: ns.namespace !== ns.defaultNamespace,
+        warnings: ns.warnings,
+      };
+    } catch (e) {
+      return {
+        workspace,
+        stack_namespace: null,
+        source: null,
+        default: fallback,
+        differs: false,
+        warnings: [],
+        error: (e as Error).message,
+      };
+    }
+  });
+}