@rehearsal-db/core 0.1.0-beta.1 → 0.1.0-beta.11

package/src/identity/storage.mjs

@@ -0,0 +1,165 @@
+/** Copy and verify local Supabase Storage objects during an identity claim. */
+
+import { createHash } from "node:crypto";
+import { assertLoopbackUrl } from "../shared/process_environment.mjs";
+
+const BUCKET = /^[a-z0-9][a-z0-9.-]{0,99}$/u;
+const MAXIMUM_VERIFICATION_BYTES = 100 * 1024 * 1024;
+const REQUEST_TIMEOUT_MS = 30_000;
+
+const objectPath = (value) => {
+  if (
+    typeof value !== "string" ||
+    !value ||
+    value.startsWith("/") ||
+    value.split("/").some((part) => !part || part === "." || part === "..")
+  ) {
+    throw new Error("A Storage identity-claim path is unsafe.");
+  }
+  return value.split("/").map(encodeURIComponent).join("/");
+};
+
+const readVerifiedObject = async ({
+  fetchImpl,
+  baseUrl,
+  headers,
+  bucket,
+  path,
+}) => {
+  const response = await fetchImpl(
+    `${baseUrl}/storage/v1/object/${encodeURIComponent(bucket)}/${objectPath(path)}?rehearsal=${Date.now()}`,
+    {
+      headers,
+      cache: "no-store",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    },
+  );
+  if (!response.ok) {
+    throw new Error(
+      `Supabase Storage could not read an identity-claim object (HTTP ${response.status}).`,
+    );
+  }
+  const declaredBytes = Number(response.headers.get("content-length"));
+  if (
+    Number.isFinite(declaredBytes) &&
+    declaredBytes > MAXIMUM_VERIFICATION_BYTES
+  ) {
+    throw new Error(
+      "A Storage identity-claim object exceeds the 100 MiB verification limit.",
+    );
+  }
+  const bytes = Buffer.from(await response.arrayBuffer());
+  if (bytes.length > MAXIMUM_VERIFICATION_BYTES) {
+    throw new Error(
+      "A Storage identity-claim object exceeds the 100 MiB verification limit.",
+    );
+  }
+  return Object.freeze({
+    bytes: bytes.length,
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+  });
+};
+
+export const createSupabaseStorageTransfer = ({
+  url,
+  serviceRoleKey,
+  fetchImpl = globalThis.fetch,
+}) => {
+  assertLoopbackUrl("Rehearsal Supabase Storage", url);
+  if (typeof serviceRoleKey !== "string" || !serviceRoleKey) {
+    throw new Error(
+      "The local runtime environment has no Storage service key.",
+    );
+  }
+  if (typeof fetchImpl !== "function") {
+    throw new Error("A Fetch implementation is required for Storage transfer.");
+  }
+  const baseUrl = url.replace(/\/$/u, "");
+  const headers = Object.freeze({
+    apikey: serviceRoleKey,
+    authorization: `Bearer ${serviceRoleKey}`,
+  });
+  const removePaths = async ({ bucket, paths }) => {
+    if (!BUCKET.test(bucket ?? "") || !Array.isArray(paths) || !paths.length) {
+      throw new Error("A Storage identity-claim removal is invalid.");
+    }
+    paths.forEach(objectPath);
+    const response = await fetchImpl(
+      `${baseUrl}/storage/v1/object/${encodeURIComponent(bucket)}`,
+      {
+        method: "DELETE",
+        headers: { ...headers, "content-type": "application/json" },
+        body: JSON.stringify({ prefixes: paths }),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      },
+    );
+    if (!response.ok) {
+      throw new Error(
+        `Supabase Storage could not remove identity-claim objects (HTTP ${response.status}).`,
+      );
+    }
+  };
+  return Object.freeze({
+    async copyAndVerify({ bucket, source, destination }) {
+      if (!BUCKET.test(bucket ?? "")) {
+        throw new Error("A Storage identity-claim bucket is invalid.");
+      }
+      objectPath(source);
+      objectPath(destination);
+      if (source === destination) {
+        throw new Error("A Storage identity-claim copy must change the path.");
+      }
+      const sourceReceipt = await readVerifiedObject({
+        fetchImpl,
+        baseUrl,
+        headers,
+        bucket,
+        path: source,
+      });
+      try {
+        const response = await fetchImpl(`${baseUrl}/storage/v1/object/copy`, {
+          method: "POST",
+          headers: { ...headers, "content-type": "application/json" },
+          body: JSON.stringify({
+            bucketId: bucket,
+            sourceKey: source,
+            destinationKey: destination,
+          }),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+          throw new Error(
+            `Supabase Storage could not copy an identity-claim object (HTTP ${response.status}).`,
+          );
+        }
+        const destinationReceipt = await readVerifiedObject({
+          fetchImpl,
+          baseUrl,
+          headers,
+          bucket,
+          path: destination,
+        });
+        if (
+          sourceReceipt.bytes !== destinationReceipt.bytes ||
+          sourceReceipt.sha256 !== destinationReceipt.sha256
+        ) {
+          throw new Error(
+            "Supabase Storage copied an identity object with a different byte digest.",
+          );
+        }
+        return destinationReceipt;
+      } catch (error) {
+        try {
+          await removePaths({ bucket, paths: [destination] });
+        } catch (cleanupError) {
+          throw new AggregateError(
+            [error, cleanupError],
+            "Storage identity-copy verification failed and destination cleanup needs attention.",
+          );
+        }
+        throw error;
+      }
+    },
+    remove: removePaths,
+  });
+};

package/{scripts/lib/rehearsal → src/project}/configuration.d.mts

@@ -3,7 +3,7 @@ export type RehearsalConfigVersion = 1;
 export interface RehearsalConfig {
   schemaVersion: RehearsalConfigVersion;
   project: { name: string };
-  supabase: {
+  supabase?: {
     workdir: string;
     migrationDirectory: string;
     rehearsalConfig: string;
@@ -11,22 +11,70 @@ export interface RehearsalConfig {
     serviceEnvironmentFile?: string;
     serviceEnvironmentVariables?: string[];
   };
+  postgresql?: {
+    migrationDirectory: string;
+    runtimeWorkdir?: string;
+    image?: string;
+    database?: string;
+    user?: string;
+  };
   baseline: {
     artifactDirectory?: string;
     sanitizationPolicy: string;
   };
+  containerRuntime?: {
+    autoStartColima?: boolean;
+  };
+  cleanup?: {
+    retainBaselineGenerations?: number;
+  };
+  preparation?: {
+    sourcePolicy: string;
+    privacyKey: string;
+    batchRows?: number;
+    maximumRows?: number;
+    maximumBytes?: number;
+    diskHeadroomBytes?: number;
+  };
+  runtimePolicy?: string;
+  identityPolicy?: string;
+  dependentTargets?: Array<{
+    name: string;
+    configPath: string;
+    prepareCommand?: string;
+  }>;
   application: {
     startCommand: string;
     proofCommand: string;
     environmentFile?: string;
+    environmentVariables?: Record<string, string>;
+    readiness?: {
+      url: string;
+      expectedStatus: number;
+      timeoutSeconds?: number;
+    };
+    httpProofs?: Array<{
+      name: string;
+      kind: "positive" | "negative";
+      url: string;
+      method?: string;
+      expectedStatus: number;
+      json?: {
+        path: string[];
+        equals?: unknown;
+        notEquals?: unknown;
+        minimumItems?: number;
+      };
+    }>;
     runtimeAdapter?: string;
   };
   runtime: {
+    target?: "supabase" | "postgresql";
     applicationUrl?: string;
     projectId?: string;
-    apiPort: number;
+    apiPort?: number;
     databasePort: number;
-    studioPort: number;
+    studioPort?: number;
   };
   safety?: {
     allowedHosts?: string[];
@@ -51,7 +99,20 @@ export declare const loadRehearsalConfig: (options?: {
 export declare const inspectDetectedProject: (options?: {
   projectRoot?: string;
 }) => Promise<unknown>;
-export declare const renderDetectedConfig: (detected: unknown) => string;
+export declare const renderDetectedConfig: (
+  detected: unknown,
+  options?: {
+    applicationUrl?: string;
+    ports?: { api: number; database: number; studio: number };
+  },
+) => string;
+export declare const renderDetectedPostgresqlConfig: (
+  detected: unknown,
+  options?: {
+    applicationUrl?: string;
+    databasePort?: number;
+  },
+) => string;
 export declare const SANITIZATION_ACTIONS: Readonly<{
   KEEP: "KEEP";
   PSEUDONYMIZE: "PSEUDONYMIZE";
@@ -75,6 +136,13 @@ export declare const validateSanitizationCoverage: (options: {
   columnCount: number;
   tables: ReadonlyArray<Record<string, unknown>>;
 }>;
+export declare const validateRuntimeSanitizationPolicy: (
+  policy: unknown,
+) => unknown;
+export declare const readBoundRuntimeSanitizationPolicy: (options: {
+  bytes: Uint8Array | string;
+  expectedSha256: string;
+}) => unknown;
 export declare const applySanitizationAction: (options: {
   action: string;
   value: unknown;