@open-mercato/cli 0.6.5-develop.5116.1.f0af9e5080 → 0.6.5-develop.5155.1.148d10a46d

package/src/lib/deploy/railway/__tests__/token.test.ts

@@ -0,0 +1,39 @@
+import { chmodSync, mkdtempSync, readFileSync, statSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  readCachedRailwayToken,
+  resolveRailwayToken,
+  writeCachedRailwayToken,
+} from '../token'
+
+describe('Railway token resolution', () => {
+  it('uses flag, environment, then cache precedence', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-token-'))
+    const configPath = join(cwd, 'railway.json')
+    writeCachedRailwayToken(configPath, 'cached-token')
+
+    expect(resolveRailwayToken({
+      flagToken: 'flag-token',
+      environment: { RAILWAY_API_TOKEN: 'environment-token' },
+      configPath,
+    })).toEqual({ token: 'flag-token', source: 'flag' })
+    expect(resolveRailwayToken({
+      environment: { RAILWAY_API_TOKEN: 'environment-token' },
+      configPath,
+    })).toEqual({ token: 'environment-token', source: 'environment' })
+    expect(resolveRailwayToken({ environment: {}, configPath }))
+      .toEqual({ token: 'cached-token', source: 'cache' })
+  })
+
+  it('writes a private cache file and rejects broad permissions', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-token-'))
+    const configPath = join(cwd, 'railway.json')
+    writeCachedRailwayToken(configPath, 'cached-token')
+
+    expect(statSync(configPath).mode & 0o777).toBe(0o600)
+    expect(readFileSync(configPath, 'utf8')).toContain('cached-token')
+    chmodSync(configPath, 0o644)
+    expect(() => readCachedRailwayToken(configPath, 'linux')).toThrow('permissions must be 0600')
+  })
+})

package/src/lib/deploy/railway/env.ts

@@ -0,0 +1,112 @@
+import { randomBytes } from 'node:crypto'
+import { spawnSync } from 'node:child_process'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { assertSafeVariables, formatVariableValue } from './redaction'
+
+export type RailwayServiceRole = 'app' | 'worker'
+
+export function resolveEnvFile(cwd: string, requested?: string): string {
+  const candidates = requested ? [requested] : ['.env.production', '.env']
+  for (const candidate of candidates) {
+    const path = resolve(cwd, candidate)
+    if (existsSync(path)) return path
+  }
+  throw new Error(`Environment file not found. Checked: ${candidates.join(', ')}.`)
+}
+
+export function parseEnvFile(contents: string): Record<string, string> {
+  const result: Record<string, string> = {}
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim()
+    if (!line || line.startsWith('#')) continue
+    const normalized = line.startsWith('export ') ? line.slice(7).trim() : line
+    const separator = normalized.indexOf('=')
+    if (separator <= 0) continue
+    const key = normalized.slice(0, separator).trim()
+    let value = normalized.slice(separator + 1).trim()
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1)
+    }
+    result[key] = value.replace(/\\n/g, '\n')
+  }
+  return result
+}
+
+export function generateProtectedSecrets(existing: Record<string, string>): Record<string, string> {
+  return {
+    AUTH_SECRET: existing.AUTH_SECRET || randomBytes(64).toString('hex'),
+    JWT_SECRET: existing.JWT_SECRET || randomBytes(64).toString('hex'),
+    TENANT_DATA_ENCRYPTION_FALLBACK_KEY:
+      existing.TENANT_DATA_ENCRYPTION_FALLBACK_KEY || randomBytes(32).toString('base64url'),
+  }
+}
+
+export function computeRailwayVariables(input: {
+  env: Record<string, string>
+  role: RailwayServiceRole
+  workerEnabled: boolean
+  appUrl?: string
+  protectedSecrets: Record<string, string>
+  railwayToken?: string
+  allowedSecretKeys?: string[]
+}): Record<string, string> {
+  const variables: Record<string, string> = {
+    ...input.env,
+    ...input.protectedSecrets,
+    DATABASE_URL: '${{Postgres.DATABASE_URL}}',
+    REDIS_URL: '${{Redis.REDIS_URL}}',
+    CACHE_STRATEGY: 'redis',
+    NODE_ENV: 'production',
+    NEXT_TELEMETRY_DISABLED: '1',
+    PORT: '3000',
+    OM_AI_PROVIDER: input.env.OM_AI_PROVIDER || 'openai',
+    OM_AI_MODEL: input.env.OM_AI_MODEL || 'gpt-5-mini',
+    QUEUE_STRATEGY: 'async',
+    NEXT_PUBLIC_QUEUE_STRATEGY: 'async',
+    AUTO_SPAWN_WORKERS: input.role === 'app' && !input.workerEnabled ? 'true' : 'false',
+    OM_AUTO_SPAWN_WORKERS: input.role === 'app' && !input.workerEnabled ? 'true' : 'false',
+  }
+
+  if (input.appUrl) {
+    variables.APP_URL = input.appUrl
+    variables.NEXT_PUBLIC_APP_URL = input.appUrl
+  }
+
+  delete variables.RAILWAY_API_TOKEN
+  delete variables.RAILWAY_TOKEN
+  assertSafeVariables(variables, {
+    railwayToken: input.railwayToken,
+    allowedKeys: input.allowedSecretKeys,
+  })
+  return variables
+}
+
+export function formatVariablePlan(
+  variables: Record<string, string>,
+  railwayToken?: string,
+): string[] {
+  return Object.keys(variables)
+    .sort()
+    .map((key) => `+ ADD ${key}=${formatVariableValue(key, variables[key] ?? '', railwayToken)}`)
+}
+
+export function writeGeneratedSecrets(envFile: string, secrets: Record<string, string>): void {
+  const ignoreCheck = spawnSync('git', ['check-ignore', '--quiet', envFile], {
+    cwd: dirname(envFile),
+    stdio: 'ignore',
+  })
+  if (ignoreCheck.status !== 0) {
+    throw new Error(`Refusing --write-env because ${envFile} is not ignored by Git.`)
+  }
+  const existing = readFileSync(envFile, 'utf8')
+  const missing = Object.entries(secrets).filter(([key]) => !new RegExp(`^${key}=`, 'm').test(existing))
+  if (missing.length === 0) return
+  const suffix = missing.map(([key, value]) => `${key}=${value}`).join('\n')
+  writeFileSync(envFile, `${existing.trimEnd()}\n\n# DO NOT COMMIT: generated for Railway deployment\n${suffix}\n`, {
+    mode: 0o600,
+  })
+}

package/src/lib/deploy/railway/graphql-client.ts

@@ -0,0 +1,128 @@
+import {
+  collectSensitiveStructuredValues,
+  redactStructuredValue,
+  redactText,
+} from './redaction'
+import type { RailwayGraphqlClient, RailwayGraphqlOperation } from './types'
+
+type FetchLike = typeof fetch
+
+type GraphqlResponse<T> = {
+  data?: T
+  errors?: Array<{
+    message?: string
+    extensions?: { code?: string }
+  }>
+}
+
+export class RailwayGraphqlError extends Error {
+  constructor(
+    message: string,
+    public readonly status?: number,
+    public readonly code?: string,
+  ) {
+    super(message)
+    this.name = 'RailwayGraphqlError'
+  }
+}
+
+function shouldRetry(error: unknown): boolean {
+  return (
+    error instanceof RailwayGraphqlError &&
+    ((error.status !== undefined && error.status >= 500) || error.code === 'INTERNAL_ERROR')
+  )
+}
+
+function wait(milliseconds: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds))
+}
+
+export function createRailwayGraphqlClient(input: {
+  token: string
+  verbose?: boolean
+  endpoint?: string
+  fetchImpl?: FetchLike
+  logger?: Pick<Console, 'log'>
+}): RailwayGraphqlClient {
+  const endpoint = input.endpoint ?? 'https://backboard.railway.com/graphql/v2'
+  if (!endpoint.startsWith('https://')) {
+    throw new Error('Railway GraphQL endpoint must use HTTPS.')
+  }
+  const fetchImpl = input.fetchImpl ?? fetch
+  const logger = input.logger ?? console
+
+  async function execute<T>(
+    operation: RailwayGraphqlOperation,
+    variables: Record<string, unknown>,
+  ): Promise<T> {
+    const requestSecrets = [input.token, ...collectSensitiveStructuredValues(variables)]
+    if (input.verbose) {
+      logger.log(
+        `[railway:gql] ${operation.name} ${JSON.stringify(redactStructuredValue(variables, requestSecrets))}`,
+      )
+    }
+    const response = await fetchImpl(endpoint, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${input.token}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        operationName: operation.name,
+        query: operation.query,
+        variables,
+      }),
+      signal: AbortSignal.timeout(operation.mutation ? 30_000 : 10_000),
+    })
+    const bodyText = await response.text()
+    let body: GraphqlResponse<T>
+    try {
+      body = JSON.parse(bodyText) as GraphqlResponse<T>
+    } catch {
+      throw new RailwayGraphqlError(
+        `Railway returned a non-JSON response (${response.status}).`,
+        response.status,
+      )
+    }
+    const firstError = body.errors?.[0]
+    if (!response.ok || firstError) {
+      throw new RailwayGraphqlError(
+        redactText(
+          firstError?.message || `Railway request failed (${response.status}).`,
+          requestSecrets,
+        ),
+        response.status,
+        firstError?.extensions?.code,
+      )
+    }
+    if (body.data === undefined) {
+      throw new RailwayGraphqlError('Railway response did not include data.', response.status)
+    }
+    if (input.verbose) {
+      logger.log(
+        `[railway:gql] ${operation.name} response ${JSON.stringify(redactStructuredValue(body.data, requestSecrets))}`,
+      )
+    }
+    return body.data
+  }
+
+  return {
+    async request<T>(
+      operation: RailwayGraphqlOperation,
+      variables: Record<string, unknown> = {},
+    ): Promise<T> {
+      const attempts = operation.mutation ? 1 : 2
+      let lastError: unknown
+      for (let attempt = 0; attempt < attempts; attempt += 1) {
+        try {
+          return await execute<T>(operation, variables)
+        } catch (error) {
+          lastError = error
+          if (attempt + 1 >= attempts || !shouldRetry(error)) throw error
+          await wait(250 * (2 ** attempt))
+        }
+      }
+      throw lastError
+    },
+  }
+}