@rehearsal-db/core 0.1.0-beta.14 → 0.1.0-beta.16

package/src/identity/provider_configuration.mjs

@@ -1,177 +0,0 @@
-/** Render reviewed local OAuth declarations into the disposable Supabase runtime. */
-
-const escapePattern = (value) =>
-  value.replaceAll(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-
-const LEGACY_PROVIDER_KEYS = new Set([
-  "client_id",
-  "email_optional",
-  "enabled",
-  "redirect_uri",
-  "secret",
-  "skip_nonce_check",
-]);
-const SAFE_BOOLEAN_PROVIDER_KEYS = new Set([
-  "email_optional",
-  "skip_nonce_check",
-]);
-
-const readTomlSections = (source) => {
-  const lines = source.split("\n");
-  const sections = [];
-  for (let index = 0; index < lines.length; index += 1) {
-    const match = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/u.exec(lines[index]);
-    if (!match) continue;
-    if (sections.length) sections.at(-1).end = index;
-    sections.push({ name: match[1], start: index, end: lines.length });
-  }
-  return { lines, sections };
-};
-
-const validateLegacyProviderSection = ({ lines, section, provider }) => {
-  const seen = new Set();
-  for (const line of lines.slice(section.start + 1, section.end)) {
-    if (!line.trim() || /^\s*#/u.test(line)) continue;
-    const assignment = /^\s*([A-Za-z0-9_]+)\s*=/u.exec(line);
-    if (!assignment || !LEGACY_PROVIDER_KEYS.has(assignment[1])) {
-      throw new Error(
-        `The local Supabase template auth.external.${provider.name} section contains an unsupported setting. Rehearsal left the tracked template unchanged.`,
-      );
-    }
-    const key = assignment[1];
-    if (seen.has(key)) {
-      throw new Error(
-        `The local Supabase template auth.external.${provider.name} section contains duplicate ${key} settings.`,
-      );
-    }
-    seen.add(key);
-    if (
-      SAFE_BOOLEAN_PROVIDER_KEYS.has(key) &&
-      !new RegExp(
-        `^\\s*${escapePattern(key)}\\s*=\\s*${
-          key === "skip_nonce_check"
-            ? (provider.skipNonceCheck ?? false)
-            : (provider.emailOptional ?? false)
-        }\\s*(?:#.*)?$`,
-        "u",
-      ).test(line)
-    ) {
-      throw new Error(
-        `The local Supabase template auth.external.${provider.name}.${key} setting must match its explicit declarative authentication option before Rehearsal can replace the legacy provider in its disposable runtime copy.`,
-      );
-    }
-  }
-};
-
-export const inspectSupabaseAuthenticationProviderTransition = ({
-  source,
-  authentication,
-}) => {
-  if (!authentication) return Object.freeze({ replacedProviders: [] });
-  const { lines, sections } = readTomlSections(source);
-  const replacementSections = [];
-  for (const provider of authentication.providers) {
-    const sectionName = `auth.external.${provider.name}`;
-    const nested = sections.filter((section) =>
-      section.name.startsWith(`${sectionName}.`),
-    );
-    if (nested.length) {
-      throw new Error(
-        `The local Supabase template contains unsupported nested ${sectionName} configuration. Rehearsal left the tracked template unchanged.`,
-      );
-    }
-    const matching = sections.filter((section) => section.name === sectionName);
-    if (matching.length > 1) {
-      throw new Error(
-        `The local Supabase template declares ${sectionName} more than once.`,
-      );
-    }
-    if (matching.length === 1) {
-      validateLegacyProviderSection({
-        lines,
-        section: matching[0],
-        provider,
-      });
-      replacementSections.push({ ...matching[0], provider: provider.name });
-    }
-  }
-  return Object.freeze({
-    replacedProviders: Object.freeze(
-      replacementSections.map(({ provider }) => provider),
-    ),
-    replacementSections: Object.freeze(replacementSections),
-  });
-};
-
-export const renderSupabaseAuthenticationProviders = ({
-  authentication,
-  apiPort,
-}) => {
-  if (!authentication) return "";
-  return authentication.providers
-    .map(
-      (
-        provider,
-      ) => `# Generated by Rehearsal from config.supabase.authentication.
-[auth.external.${provider.name}]
-enabled = true
-client_id = "env(${provider.clientIdEnvironmentVariable})"
-secret = "env(${provider.clientSecretEnvironmentVariable})"
-redirect_uri = "http://127.0.0.1:${apiPort}/auth/v1/callback"
-${provider.skipNonceCheck ? "skip_nonce_check = true\n" : ""}${provider.emailOptional ? "email_optional = true\n" : ""}
-`,
-    )
-    .join("\n");
-};
-
-const enableLocalSignup = (source) => {
-  const lines = source.split("\n");
-  let inAuth = false;
-  let authSections = 0;
-  let signupSettings = 0;
-  const updated = lines.map((line) => {
-    const section = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/u.exec(line);
-    if (section) {
-      inAuth = section[1] === "auth";
-      if (inAuth) authSections += 1;
-      return line;
-    }
-    if (!inAuth || !/^\s*enable_signup\s*=/u.test(line)) return line;
-    signupSettings += 1;
-    const comment = line.match(/\s+#.*$/u)?.[0] ?? "";
-    return `enable_signup = true${comment}`;
-  });
-  if (authSections !== 1 || signupSettings !== 1) {
-    throw new Error(
-      "The local Supabase template must declare exactly one [auth] section with one enable_signup setting before Rehearsal can configure OAuth.",
-    );
-  }
-  return updated.join("\n");
-};
-
-export const applySupabaseAuthenticationProviders = ({
-  source,
-  authentication,
-  apiPort,
-}) => {
-  if (!authentication) return source;
-  const transition = inspectSupabaseAuthenticationProviderTransition({
-    source,
-    authentication,
-  });
-  const { lines } = readTomlSections(source);
-  const replacedIndexes = new Set(
-    transition.replacementSections.flatMap((section) =>
-      Array.from(
-        { length: section.end - section.start },
-        (_, offset) => section.start + offset,
-      ),
-    ),
-  );
-  const transitionedSource = lines
-    .filter((_, index) => !replacedIndexes.has(index))
-    .join("\n");
-  const runtimeSource = enableLocalSignup(transitionedSource);
-  const separator = runtimeSource.endsWith("\n") ? "\n" : "\n\n";
-  return `${runtimeSource}${separator}${renderSupabaseAuthenticationProviders({ authentication, apiPort })}`;
-};

package/src/identity/storage.mjs

@@ -1,165 +0,0 @@
-/** Copy and verify local Supabase Storage objects during an identity claim. */
-
-import { createHash } from "node:crypto";
-import { assertLoopbackUrl } from "../shared/process_environment.mjs";
-
-const BUCKET = /^[a-z0-9][a-z0-9.-]{0,99}$/u;
-const MAXIMUM_VERIFICATION_BYTES = 100 * 1024 * 1024;
-const REQUEST_TIMEOUT_MS = 30_000;
-
-const objectPath = (value) => {
-  if (
-    typeof value !== "string" ||
-    !value ||
-    value.startsWith("/") ||
-    value.split("/").some((part) => !part || part === "." || part === "..")
-  ) {
-    throw new Error("A Storage identity-claim path is unsafe.");
-  }
-  return value.split("/").map(encodeURIComponent).join("/");
-};
-
-const readVerifiedObject = async ({
-  fetchImpl,
-  baseUrl,
-  headers,
-  bucket,
-  path,
-}) => {
-  const response = await fetchImpl(
-    `${baseUrl}/storage/v1/object/${encodeURIComponent(bucket)}/${objectPath(path)}?rehearsal=${Date.now()}`,
-    {
-      headers,
-      cache: "no-store",
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-    },
-  );
-  if (!response.ok) {
-    throw new Error(
-      `Supabase Storage could not read an identity-claim object (HTTP ${response.status}).`,
-    );
-  }
-  const declaredBytes = Number(response.headers.get("content-length"));
-  if (
-    Number.isFinite(declaredBytes) &&
-    declaredBytes > MAXIMUM_VERIFICATION_BYTES
-  ) {
-    throw new Error(
-      "A Storage identity-claim object exceeds the 100 MiB verification limit.",
-    );
-  }
-  const bytes = Buffer.from(await response.arrayBuffer());
-  if (bytes.length > MAXIMUM_VERIFICATION_BYTES) {
-    throw new Error(
-      "A Storage identity-claim object exceeds the 100 MiB verification limit.",
-    );
-  }
-  return Object.freeze({
-    bytes: bytes.length,
-    sha256: createHash("sha256").update(bytes).digest("hex"),
-  });
-};
-
-export const createSupabaseStorageTransfer = ({
-  url,
-  serviceRoleKey,
-  fetchImpl = globalThis.fetch,
-}) => {
-  assertLoopbackUrl("Rehearsal Supabase Storage", url);
-  if (typeof serviceRoleKey !== "string" || !serviceRoleKey) {
-    throw new Error(
-      "The local runtime environment has no Storage service key.",
-    );
-  }
-  if (typeof fetchImpl !== "function") {
-    throw new Error("A Fetch implementation is required for Storage transfer.");
-  }
-  const baseUrl = url.replace(/\/$/u, "");
-  const headers = Object.freeze({
-    apikey: serviceRoleKey,
-    authorization: `Bearer ${serviceRoleKey}`,
-  });
-  const removePaths = async ({ bucket, paths }) => {
-    if (!BUCKET.test(bucket ?? "") || !Array.isArray(paths) || !paths.length) {
-      throw new Error("A Storage identity-claim removal is invalid.");
-    }
-    paths.forEach(objectPath);
-    const response = await fetchImpl(
-      `${baseUrl}/storage/v1/object/${encodeURIComponent(bucket)}`,
-      {
-        method: "DELETE",
-        headers: { ...headers, "content-type": "application/json" },
-        body: JSON.stringify({ prefixes: paths }),
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-      },
-    );
-    if (!response.ok) {
-      throw new Error(
-        `Supabase Storage could not remove identity-claim objects (HTTP ${response.status}).`,
-      );
-    }
-  };
-  return Object.freeze({
-    async copyAndVerify({ bucket, source, destination }) {
-      if (!BUCKET.test(bucket ?? "")) {
-        throw new Error("A Storage identity-claim bucket is invalid.");
-      }
-      objectPath(source);
-      objectPath(destination);
-      if (source === destination) {
-        throw new Error("A Storage identity-claim copy must change the path.");
-      }
-      const sourceReceipt = await readVerifiedObject({
-        fetchImpl,
-        baseUrl,
-        headers,
-        bucket,
-        path: source,
-      });
-      try {
-        const response = await fetchImpl(`${baseUrl}/storage/v1/object/copy`, {
-          method: "POST",
-          headers: { ...headers, "content-type": "application/json" },
-          body: JSON.stringify({
-            bucketId: bucket,
-            sourceKey: source,
-            destinationKey: destination,
-          }),
-          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-        });
-        if (!response.ok) {
-          throw new Error(
-            `Supabase Storage could not copy an identity-claim object (HTTP ${response.status}).`,
-          );
-        }
-        const destinationReceipt = await readVerifiedObject({
-          fetchImpl,
-          baseUrl,
-          headers,
-          bucket,
-          path: destination,
-        });
-        if (
-          sourceReceipt.bytes !== destinationReceipt.bytes ||
-          sourceReceipt.sha256 !== destinationReceipt.sha256
-        ) {
-          throw new Error(
-            "Supabase Storage copied an identity object with a different byte digest.",
-          );
-        }
-        return destinationReceipt;
-      } catch (error) {
-        try {
-          await removePaths({ bucket, paths: [destination] });
-        } catch (cleanupError) {
-          throw new AggregateError(
-            [error, cleanupError],
-            "Storage identity-copy verification failed and destination cleanup needs attention.",
-          );
-        }
-        throw error;
-      }
-    },
-    remove: removePaths,
-  });
-};

package/src/project/configuration.d.mts

@@ -1,164 +0,0 @@
-export type RehearsalConfigVersion = 1;
-
-export interface RehearsalConfig {
-  schemaVersion: RehearsalConfigVersion;
-  project: { name: string };
-  supabase?: {
-    workdir: string;
-    migrationDirectory: string;
-    rehearsalConfig: string;
-    runtimeWorkdir: string;
-    authentication?: {
-      enableLocalSignup: true;
-      environmentFile: string;
-      providers: Array<{
-        name: "google" | "github";
-        clientIdEnvironmentVariable: string;
-        clientSecretEnvironmentVariable: string;
-        skipNonceCheck?: boolean;
-        emailOptional?: boolean;
-      }>;
-    };
-    serviceEnvironmentFile?: string;
-    serviceEnvironmentVariables?: string[];
-  };
-  postgresql?: {
-    migrationDirectory: string;
-    runtimeWorkdir?: string;
-    image?: string;
-    database?: string;
-    user?: string;
-  };
-  baseline: {
-    artifactDirectory?: string;
-    sanitizationPolicy: string;
-  };
-  containerRuntime?: {
-    autoStartColima?: boolean;
-  };
-  cleanup?: {
-    retainBaselineGenerations?: number;
-  };
-  preparation?: {
-    sourcePolicy: string;
-    privacyKey: string;
-    batchRows?: number;
-    maximumRows?: number;
-    maximumBytes?: number;
-    diskHeadroomBytes?: number;
-  };
-  runtimePolicy?: string;
-  identityPolicy?: string;
-  dependentTargets?: Array<{
-    name: string;
-    configPath: string;
-    prepareCommand?: string;
-  }>;
-  application: {
-    startCommand: string;
-    proofCommand: string;
-    environmentFile?: string;
-    environmentVariables?: Record<string, string>;
-    readiness?: {
-      url: string;
-      expectedStatus: number;
-      timeoutSeconds?: number;
-    };
-    httpProofs?: Array<{
-      name: string;
-      kind: "positive" | "negative";
-      url: string;
-      method?: string;
-      expectedStatus: number;
-      json?: {
-        path: string[];
-        equals?: unknown;
-        notEquals?: unknown;
-        minimumItems?: number;
-      };
-    }>;
-    runtimeAdapter?: string;
-  };
-  runtime: {
-    target?: "supabase" | "postgresql";
-    applicationUrl?: string;
-    projectId?: string;
-    apiPort?: number;
-    databasePort: number;
-    studioPort?: number;
-  };
-  safety?: {
-    allowedHosts?: string[];
-    blockedEnvironmentVariables?: string[];
-    authenticationProviders?: string[];
-    hostedAccess?: "disabled";
-    outboundNetwork?: "deny";
-  };
-  verification?: { commands?: string[] };
-}
-
-export declare const REHEARSAL_CONFIG_VERSION: 1;
-export declare const defineRehearsalConfig: <
-  const Config extends RehearsalConfig,
->(
-  config: Config,
-) => Config;
-export declare const loadRehearsalConfig: (options?: {
-  projectRoot?: string;
-  configPath?: string;
-}) => Promise<unknown>;
-export declare const inspectDetectedProject: (options?: {
-  projectRoot?: string;
-}) => Promise<unknown>;
-export declare const renderDetectedConfig: (
-  detected: unknown,
-  options?: {
-    applicationUrl?: string;
-    ports?: { api: number; database: number; studio: number };
-  },
-) => string;
-export declare const renderDetectedPostgresqlConfig: (
-  detected: unknown,
-  options?: {
-    applicationUrl?: string;
-    databasePort?: number;
-  },
-) => string;
-export declare const SANITIZATION_ACTIONS: Readonly<{
-  KEEP: "KEEP";
-  PSEUDONYMIZE: "PSEUDONYMIZE";
-  REPLACE: "REPLACE";
-  EXCLUDE: "EXCLUDE";
-  DERIVE: "DERIVE";
-}>;
-export declare const EXCLUDED_VALUE: unique symbol;
-export declare const normalizeSanitizationAction: (
-  action: string,
-) => "KEEP" | "PSEUDONYMIZE" | "REPLACE" | "EXCLUDE" | "DERIVE";
-export declare const validateSanitizationCoverage: (options: {
-  policy: { policyVersion?: unknown; tables: Array<Record<string, unknown>> };
-  schemaTables: Array<{
-    name: string;
-    columns: Array<string | { name: string }>;
-  }>;
-}) => Readonly<{
-  policyVersion: unknown;
-  tableCount: number;
-  columnCount: number;
-  tables: ReadonlyArray<Record<string, unknown>>;
-}>;
-export declare const validateRuntimeSanitizationPolicy: (
-  policy: unknown,
-) => unknown;
-export declare const readBoundRuntimeSanitizationPolicy: (options: {
-  bytes: Uint8Array | string;
-  expectedSha256: string;
-}) => unknown;
-export declare const applySanitizationAction: (options: {
-  action: string;
-  value: unknown;
-  replace?: (value: unknown, context: Record<string, unknown>) => unknown;
-  pseudonymize?: (value: unknown, context: Record<string, unknown>) => unknown;
-  derive?: (value: unknown, context: Record<string, unknown>) => unknown;
-  context?: Record<string, unknown>;
-}) => unknown | typeof EXCLUDED_VALUE;