@open-mercato/cli 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/lib/deploy/railway/__tests__/redaction.test.ts

@@ -0,0 +1,62 @@
+import {
+  assertSafeVariables,
+  collectSensitiveStructuredValues,
+  detectCredentialValue,
+  formatVariableValue,
+  redactStructuredValue,
+  redactText,
+} from '../redaction'
+
+describe('Railway secret redaction', () => {
+  it.each([
+    ['sk-testcredential0123456789'],
+    ['xoxb-1234567890-abcdefghij'],
+    ['ghp_abcdefghijklmnopqrstuvwxyz'],
+    ['-----BEGIN PRIVATE KEY-----\nsecret'],
+  ])('detects credential-like values', (value) => {
+    expect(detectCredentialValue(value)).toBe(true)
+  })
+
+  it('requires an exact per-key passthrough', () => {
+    expect(() => assertSafeVariables({ OPENAI_API_KEY: 'sk-testcredential0123456789' }))
+      .toThrow('--allow-secret-passthrough OPENAI_API_KEY')
+    expect(() => assertSafeVariables(
+      { OPENAI_API_KEY: 'sk-testcredential0123456789' },
+      { allowedKeys: ['OPENAI_API_KEY'] },
+    )).not.toThrow()
+  })
+
+  it('redacts authorization headers and known secrets', () => {
+    expect(redactText('Authorization: Bearer token-value secret-value', ['secret-value']))
+      .toBe('Authorization: Bearer **** ****')
+  })
+
+  it('prints only a fingerprint for sensitive variables', () => {
+    const formatted = formatVariableValue('AUTH_SECRET', 'top-secret')
+    expect(formatted).toMatch(/^<redacted> \(sha256:[a-f0-9]{8}\)$/)
+    expect(formatted).not.toContain('top-secret')
+  })
+
+  it('redacts structured values by sensitive field name', () => {
+    expect(redactStructuredValue({
+      variables: {
+        AUTH_SECRET: 'random-hex-without-a-credential-prefix',
+        SAFE_VALUE: 'visible',
+      },
+    })).toEqual({
+      variables: {
+        AUTH_SECRET: '<redacted>',
+        SAFE_VALUE: 'visible',
+      },
+    })
+  })
+
+  it('collects sensitive values for downstream log redaction', () => {
+    expect(collectSensitiveStructuredValues({
+      variables: {
+        AUTH_SECRET: 'auth-secret',
+        nested: { API_KEY: 'api-key', SAFE_VALUE: 'visible' },
+      },
+    })).toEqual(expect.arrayContaining(['auth-secret', 'api-key']))
+  })
+})

package/src/lib/deploy/railway/__tests__/source.test.ts

@@ -0,0 +1,130 @@
+import {
+  assertGitDeployReady,
+  assertLocalUploadSafe,
+  normalizeGitRepository,
+  resolveRailwaySource,
+} from '../source'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+function runner(responses: Record<string, string | Error>) {
+  return (command: string, args: string[]) => {
+    const key = `${command} ${args.join(' ')}`
+    const response = responses[key]
+    if (response instanceof Error || response === undefined) throw response ?? new Error(key)
+    return response
+  }
+}
+
+describe('Railway source strategy', () => {
+  it.each([
+    ['git@github.com:open-mercato/example.git', 'open-mercato/example'],
+    ['https://github.com/open-mercato/example.git', 'open-mercato/example'],
+    ['https://gitlab.com/open-mercato/example.git', null],
+  ])('normalizes supported remotes', (remote, expected) => {
+    expect(normalizeGitRepository(remote)).toBe(expected)
+  })
+
+  it('prefers a synchronized GitHub remote in auto mode', () => {
+    const run = runner({
+      'git branch --show-current': 'main',
+      'git remote get-url origin': 'git@github.com:open-mercato/example.git',
+      'git rev-parse HEAD': 'abc123',
+      'git status --porcelain': '',
+      'git rev-parse --abbrev-ref --symbolic-full-name @{u}': 'origin/main',
+      'git rev-list --count @{u}..HEAD': '0',
+      'git rev-list --count HEAD..@{u}': '0',
+    })
+
+    expect(resolveRailwaySource('auto', '/tmp/app', run)).toMatchObject({
+      mode: 'git',
+      repo: 'open-mercato/example',
+      branch: 'main',
+      commitSha: 'abc123',
+    })
+  })
+
+  it('falls back to local upload when no supported remote exists', () => {
+    const run = runner({
+      'railway --version': 'railway 4.66.1',
+    })
+    expect(resolveRailwaySource('auto', '/tmp/app', run)).toEqual({
+      mode: 'local',
+      reason: 'No usable GitHub remote found; falling back to railway up',
+    })
+  })
+
+  it('falls back to local upload when Git exists but is not ready for remote deploy', () => {
+    const run = runner({
+      'git branch --show-current': 'main',
+      'git remote get-url origin': 'git@github.com:open-mercato/example.git',
+      'git rev-parse HEAD': 'abc123',
+      'git status --porcelain': ' M package.json',
+      'railway --version': 'railway 5.1.0',
+    })
+    expect(resolveRailwaySource('auto', '/tmp/app', run)).toMatchObject({
+      mode: 'local',
+      reason: expect.stringContaining('clean working tree'),
+    })
+  })
+
+  it('rejects dirty Git-backed deploys', () => {
+    const run = runner({
+      'git status --porcelain': ' M package.json',
+    })
+    expect(() => assertGitDeployReady('/tmp/app', run)).toThrow('clean working tree')
+  })
+
+  it('rejects a Git branch that is behind its upstream', () => {
+    const run = runner({
+      'git status --porcelain': '',
+      'git rev-parse --abbrev-ref --symbolic-full-name @{u}': 'origin/main',
+      'git rev-list --count @{u}..HEAD': '0',
+      'git rev-list --count HEAD..@{u}': '2',
+    })
+    expect(() => assertGitDeployReady('/tmp/app', run)).toThrow('behind its upstream')
+  })
+
+  it('rejects a local upload ignore file without state protection', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-ignore-'))
+    writeFileSync(join(cwd, '.railwayignore'), '.env\n*.pem\n*.key\n.git\nnode_modules\n')
+    expect(() => assertLocalUploadSafe(cwd)).toThrow('.mercato/railway.json')
+  })
+
+  it('accepts the scaffold local upload safety contract', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-ignore-'))
+    writeFileSync(
+      join(cwd, '.railwayignore'),
+      '.env*\n*.pem\n*.key\nid_*\n.git\n.railway\nnode_modules\n.yarn/cache\n.next\n.turbo\n*.db\n*.sqlite\n*.sqlite3\n.mercato/railway.json*\n',
+    )
+    expect(() => assertLocalUploadSafe(cwd)).not.toThrow()
+  })
+
+  it('does not accept required safety entries from comments', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-ignore-'))
+    writeFileSync(
+      join(cwd, '.railwayignore'),
+      '# .env*\n*.pem\n*.key\nid_*\n.git\n.railway\nnode_modules\n.yarn/cache\n.next\n.turbo\n*.db\n*.sqlite\n*.sqlite3\n.mercato/railway.json*\n',
+    )
+    expect(() => assertLocalUploadSafe(cwd)).toThrow('.env')
+  })
+
+  it('does not treat a single env filename as protection for every env file', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-ignore-'))
+    writeFileSync(
+      join(cwd, '.railwayignore'),
+      '.env\n*.pem\n*.key\nid_*\n.git\n.railway\nnode_modules\n.yarn/cache\n.next\n.turbo\n*.db\n*.sqlite\n*.sqlite3\n.mercato/railway.json*\n',
+    )
+    expect(() => assertLocalUploadSafe(cwd)).toThrow('.env.*')
+  })
+
+  it('does not accept an unrelated Railway state filename prefix', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-ignore-'))
+    writeFileSync(
+      join(cwd, '.railwayignore'),
+      '.env*\n*.pem\n*.key\nid_*\n.git\n.railway\nnode_modules\n.yarn/cache\n.next\n.turbo\n*.db\n*.sqlite\n*.sqlite3\n.mercato/railway.json.example\n',
+    )
+    expect(() => assertLocalUploadSafe(cwd)).toThrow('.mercato/railway.json')
+  })
+})

package/src/lib/deploy/railway/__tests__/state.test.ts

@@ -0,0 +1,24 @@
+import { mkdtempSync, readFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  createRailwayState,
+  loadRailwayState,
+  railwayStatePath,
+  saveRailwayState,
+} from '../state'
+
+describe('Railway deployment state', () => {
+  it('round-trips schema version 1 without secrets', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-state-'))
+    const path = railwayStatePath(cwd, true)
+    const state = createRailwayState('my-shop', '0.6.4')
+    state.projectId = 'project-id'
+    state.environments.production = { environmentId: 'environment-id' }
+    saveRailwayState(path, state)
+
+    expect(loadRailwayState(path)).toEqual(state)
+    expect(readFileSync(path, 'utf8')).not.toMatch(/token|password/i)
+    expect(railwayStatePath(cwd, false).endsWith('.mercato/railway.json.local')).toBe(true)
+  })
+})

package/src/lib/deploy/railway/__tests__/token.test.ts

@@ -0,0 +1,39 @@
+import { chmodSync, mkdtempSync, readFileSync, statSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  readCachedRailwayToken,
+  resolveRailwayToken,
+  writeCachedRailwayToken,
+} from '../token'
+
+describe('Railway token resolution', () => {
+  it('uses flag, environment, then cache precedence', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-token-'))
+    const configPath = join(cwd, 'railway.json')
+    writeCachedRailwayToken(configPath, 'cached-token')
+
+    expect(resolveRailwayToken({
+      flagToken: 'flag-token',
+      environment: { RAILWAY_API_TOKEN: 'environment-token' },
+      configPath,
+    })).toEqual({ token: 'flag-token', source: 'flag' })
+    expect(resolveRailwayToken({
+      environment: { RAILWAY_API_TOKEN: 'environment-token' },
+      configPath,
+    })).toEqual({ token: 'environment-token', source: 'environment' })
+    expect(resolveRailwayToken({ environment: {}, configPath }))
+      .toEqual({ token: 'cached-token', source: 'cache' })
+  })
+
+  it('writes a private cache file and rejects broad permissions', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-token-'))
+    const configPath = join(cwd, 'railway.json')
+    writeCachedRailwayToken(configPath, 'cached-token')
+
+    expect(statSync(configPath).mode & 0o777).toBe(0o600)
+    expect(readFileSync(configPath, 'utf8')).toContain('cached-token')
+    chmodSync(configPath, 0o644)
+    expect(() => readCachedRailwayToken(configPath, 'linux')).toThrow('permissions must be 0600')
+  })
+})

package/src/lib/deploy/railway/env.ts

@@ -0,0 +1,112 @@
+import { randomBytes } from 'node:crypto'
+import { spawnSync } from 'node:child_process'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { assertSafeVariables, formatVariableValue } from './redaction'
+
+export type RailwayServiceRole = 'app' | 'worker'
+
+export function resolveEnvFile(cwd: string, requested?: string): string {
+  const candidates = requested ? [requested] : ['.env.production', '.env']
+  for (const candidate of candidates) {
+    const path = resolve(cwd, candidate)
+    if (existsSync(path)) return path
+  }
+  throw new Error(`Environment file not found. Checked: ${candidates.join(', ')}.`)
+}
+
+export function parseEnvFile(contents: string): Record<string, string> {
+  const result: Record<string, string> = {}
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim()
+    if (!line || line.startsWith('#')) continue
+    const normalized = line.startsWith('export ') ? line.slice(7).trim() : line
+    const separator = normalized.indexOf('=')
+    if (separator <= 0) continue
+    const key = normalized.slice(0, separator).trim()
+    let value = normalized.slice(separator + 1).trim()
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1)
+    }
+    result[key] = value.replace(/\\n/g, '\n')
+  }
+  return result
+}
+
+export function generateProtectedSecrets(existing: Record<string, string>): Record<string, string> {
+  return {
+    AUTH_SECRET: existing.AUTH_SECRET || randomBytes(64).toString('hex'),
+    JWT_SECRET: existing.JWT_SECRET || randomBytes(64).toString('hex'),
+    TENANT_DATA_ENCRYPTION_FALLBACK_KEY:
+      existing.TENANT_DATA_ENCRYPTION_FALLBACK_KEY || randomBytes(32).toString('base64url'),
+  }
+}
+
+export function computeRailwayVariables(input: {
+  env: Record<string, string>
+  role: RailwayServiceRole
+  workerEnabled: boolean
+  appUrl?: string
+  protectedSecrets: Record<string, string>
+  railwayToken?: string
+  allowedSecretKeys?: string[]
+}): Record<string, string> {
+  const variables: Record<string, string> = {
+    ...input.env,
+    ...input.protectedSecrets,
+    DATABASE_URL: '${{Postgres.DATABASE_URL}}',
+    REDIS_URL: '${{Redis.REDIS_URL}}',
+    CACHE_STRATEGY: 'redis',
+    NODE_ENV: 'production',
+    NEXT_TELEMETRY_DISABLED: '1',
+    PORT: '3000',
+    OM_AI_PROVIDER: input.env.OM_AI_PROVIDER || 'openai',
+    OM_AI_MODEL: input.env.OM_AI_MODEL || 'gpt-5-mini',
+    QUEUE_STRATEGY: 'async',
+    NEXT_PUBLIC_QUEUE_STRATEGY: 'async',
+    AUTO_SPAWN_WORKERS: input.role === 'app' && !input.workerEnabled ? 'true' : 'false',
+    OM_AUTO_SPAWN_WORKERS: input.role === 'app' && !input.workerEnabled ? 'true' : 'false',
+  }
+
+  if (input.appUrl) {
+    variables.APP_URL = input.appUrl
+    variables.NEXT_PUBLIC_APP_URL = input.appUrl
+  }
+
+  delete variables.RAILWAY_API_TOKEN
+  delete variables.RAILWAY_TOKEN
+  assertSafeVariables(variables, {
+    railwayToken: input.railwayToken,
+    allowedKeys: input.allowedSecretKeys,
+  })
+  return variables
+}
+
+export function formatVariablePlan(
+  variables: Record<string, string>,
+  railwayToken?: string,
+): string[] {
+  return Object.keys(variables)
+    .sort()
+    .map((key) => `+ ADD ${key}=${formatVariableValue(key, variables[key] ?? '', railwayToken)}`)
+}
+
+export function writeGeneratedSecrets(envFile: string, secrets: Record<string, string>): void {
+  const ignoreCheck = spawnSync('git', ['check-ignore', '--quiet', envFile], {
+    cwd: dirname(envFile),
+    stdio: 'ignore',
+  })
+  if (ignoreCheck.status !== 0) {
+    throw new Error(`Refusing --write-env because ${envFile} is not ignored by Git.`)
+  }
+  const existing = readFileSync(envFile, 'utf8')
+  const missing = Object.entries(secrets).filter(([key]) => !new RegExp(`^${key}=`, 'm').test(existing))
+  if (missing.length === 0) return
+  const suffix = missing.map(([key, value]) => `${key}=${value}`).join('\n')
+  writeFileSync(envFile, `${existing.trimEnd()}\n\n# DO NOT COMMIT: generated for Railway deployment\n${suffix}\n`, {
+    mode: 0o600,
+  })
+}

package/src/lib/deploy/railway/graphql-client.ts

@@ -0,0 +1,128 @@
+import {
+  collectSensitiveStructuredValues,
+  redactStructuredValue,
+  redactText,
+} from './redaction'
+import type { RailwayGraphqlClient, RailwayGraphqlOperation } from './types'
+
+type FetchLike = typeof fetch
+
+type GraphqlResponse<T> = {
+  data?: T
+  errors?: Array<{
+    message?: string
+    extensions?: { code?: string }
+  }>
+}
+
+export class RailwayGraphqlError extends Error {
+  constructor(
+    message: string,
+    public readonly status?: number,
+    public readonly code?: string,
+  ) {
+    super(message)
+    this.name = 'RailwayGraphqlError'
+  }
+}
+
+function shouldRetry(error: unknown): boolean {
+  return (
+    error instanceof RailwayGraphqlError &&
+    ((error.status !== undefined && error.status >= 500) || error.code === 'INTERNAL_ERROR')
+  )
+}
+
+function wait(milliseconds: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds))
+}
+
+export function createRailwayGraphqlClient(input: {
+  token: string
+  verbose?: boolean
+  endpoint?: string
+  fetchImpl?: FetchLike
+  logger?: Pick<Console, 'log'>
+}): RailwayGraphqlClient {
+  const endpoint = input.endpoint ?? 'https://backboard.railway.com/graphql/v2'
+  if (!endpoint.startsWith('https://')) {
+    throw new Error('Railway GraphQL endpoint must use HTTPS.')
+  }
+  const fetchImpl = input.fetchImpl ?? fetch
+  const logger = input.logger ?? console
+
+  async function execute<T>(
+    operation: RailwayGraphqlOperation,
+    variables: Record<string, unknown>,
+  ): Promise<T> {
+    const requestSecrets = [input.token, ...collectSensitiveStructuredValues(variables)]
+    if (input.verbose) {
+      logger.log(
+        `[railway:gql] ${operation.name} ${JSON.stringify(redactStructuredValue(variables, requestSecrets))}`,
+      )
+    }
+    const response = await fetchImpl(endpoint, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${input.token}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        operationName: operation.name,
+        query: operation.query,
+        variables,
+      }),
+      signal: AbortSignal.timeout(operation.mutation ? 30_000 : 10_000),
+    })
+    const bodyText = await response.text()
+    let body: GraphqlResponse<T>
+    try {
+      body = JSON.parse(bodyText) as GraphqlResponse<T>
+    } catch {
+      throw new RailwayGraphqlError(
+        `Railway returned a non-JSON response (${response.status}).`,
+        response.status,
+      )
+    }
+    const firstError = body.errors?.[0]
+    if (!response.ok || firstError) {
+      throw new RailwayGraphqlError(
+        redactText(
+          firstError?.message || `Railway request failed (${response.status}).`,
+          requestSecrets,
+        ),
+        response.status,
+        firstError?.extensions?.code,
+      )
+    }
+    if (body.data === undefined) {
+      throw new RailwayGraphqlError('Railway response did not include data.', response.status)
+    }
+    if (input.verbose) {
+      logger.log(
+        `[railway:gql] ${operation.name} response ${JSON.stringify(redactStructuredValue(body.data, requestSecrets))}`,
+      )
+    }
+    return body.data
+  }
+
+  return {
+    async request<T>(
+      operation: RailwayGraphqlOperation,
+      variables: Record<string, unknown> = {},
+    ): Promise<T> {
+      const attempts = operation.mutation ? 1 : 2
+      let lastError: unknown
+      for (let attempt = 0; attempt < attempts; attempt += 1) {
+        try {
+          return await execute<T>(operation, variables)
+        } catch (error) {
+          lastError = error
+          if (attempt + 1 >= attempts || !shouldRetry(error)) throw error
+          await wait(250 * (2 ** attempt))
+        }
+      }
+      throw lastError
+    },
+  }
+}