@rehearsal-db/core 0.1.0-beta.3 → 0.1.0-beta.5

package/scripts/lib/rehearsal/policy_review.mjs

@@ -0,0 +1,92 @@
+/**
+ * Purpose: Complete and safely apply a generated REVIEW REQUIRED policy draft.
+ * The caller owns the interactive presentation; this module owns validation and
+ * concurrent-change refusal.
+ */
+
+import { readFile, writeFile } from "node:fs/promises";
+import { validateRuntimeSanitizationPolicy } from "./sanitization_policy.mjs";
+
+export const SAFE_COLUMN_PRESET = Object.freeze({
+  action: "REPLACE WITH SYNTHETIC",
+  generated: "NEVER",
+  identity: "NO",
+  foreignKey: null,
+});
+
+export const createSafeTablePreset = (columns) =>
+  Object.fromEntries(
+    columns.map((column) => [
+      typeof column === "string" ? column : column.name,
+      { ...SAFE_COLUMN_PRESET },
+    ]),
+  );
+
+export const suggestPolicyExceptionColumns = (columns) =>
+  columns
+    .map((column) => (typeof column === "string" ? column : column.name))
+    .filter(
+      (column) =>
+        column === "id" ||
+        column.endsWith("_id") ||
+        ["created_at", "updated_at", "deleted_at"].includes(column),
+    );
+
+export const readReviewablePolicyDraft = async (path) => {
+  const source = await readFile(path, "utf8");
+  const draft = JSON.parse(source);
+  if (draft?.draft !== true || !Array.isArray(draft.tables)) {
+    throw new Error(
+      "Interactive review requires a generated sanitization policy with draft: true.",
+    );
+  }
+  return { source, draft };
+};
+
+export const completePolicyDraft = async ({
+  draft,
+  reviewColumn,
+  reviewTable,
+}) => {
+  if (draft?.draft !== true || !Array.isArray(draft.tables)) {
+    throw new Error("A generated REVIEW REQUIRED policy draft is required.");
+  }
+  const tables = [];
+  for (const table of draft.tables) {
+    const columnNames = (table.columns ?? []).map((column) => column.name);
+    const tableDecisions = reviewTable
+      ? await reviewTable({ table: table.name, columns: columnNames })
+      : {};
+    const columns = [];
+    for (const column of table.columns ?? []) {
+      const reviewed =
+        tableDecisions?.[column.name] ??
+        (await reviewColumn?.({
+          table: table.name,
+          column: column.name,
+        }));
+      if (!reviewed) {
+        throw new Error(
+          `Policy review did not classify ${table.name}.${column.name}.`,
+        );
+      }
+      columns.push({ name: column.name, ...reviewed });
+    }
+    tables.push({ ...table, columns });
+  }
+  const reviewed = { ...draft, tables };
+  delete reviewed.draft;
+  return validateRuntimeSanitizationPolicy(reviewed);
+};
+
+export const applyReviewedPolicy = async ({ path, originalSource, policy }) => {
+  validateRuntimeSanitizationPolicy(policy);
+  if ((await readFile(path, "utf8")) !== originalSource) {
+    throw new Error(
+      "The sanitization policy changed during review; no reviewed policy was written.",
+    );
+  }
+  await writeFile(path, `${JSON.stringify(policy, null, 2)}\n`, {
+    mode: 0o600,
+  });
+};

package/scripts/lib/rehearsal/support_report.mjs

@@ -0,0 +1,102 @@
+/**
+ * Build a copy-ready, data-free support report. The report intentionally omits
+ * project names, paths, command output, environment-variable names, row data,
+ * migration contents, and baseline identifiers.
+ */
+
+import { spawnSync } from "node:child_process";
+import { arch, platform, release } from "node:os";
+import { REHEARSAL_VERSION, redactDiagnosticValue } from "./diagnostics.mjs";
+import { runRehearsalDoctor } from "./plan.mjs";
+
+export const REHEARSAL_SUPPORT_URL =
+  "https://github.com/Ddupasquier/rehearsal-db/issues/new?template=bug.yml";
+
+const safeEnvironment = () =>
+  Object.fromEntries(
+    ["HOME", "LANG", "LC_ALL", "PATH", "SHELL", "TMPDIR"].flatMap((key) =>
+      process.env[key] === undefined ? [] : [[key, process.env[key]]],
+    ),
+  );
+
+const runVersionCommand = (command, args) =>
+  spawnSync(command, args, {
+    encoding: "utf8",
+    env: safeEnvironment(),
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 5_000,
+  });
+
+const inspectTool = ({ command, args, runCommand }) => {
+  const result = runCommand(command, args);
+  if (result.error?.code === "ENOENT") return { status: "not_installed" };
+  if (result.status !== 0) return { status: "unavailable" };
+  const version = String(result.stdout || result.stderr)
+    .trim()
+    .split(/\r?\n/u)[0]
+    .slice(0, 200);
+  return {
+    status: "available",
+    version: redactDiagnosticValue(version || "version not reported"),
+  };
+};
+
+export const collectRehearsalSupportReport = async (
+  options = {},
+  {
+    runDoctor = runRehearsalDoctor,
+    runCommand = runVersionCommand,
+    system = {
+      platform: platform(),
+      release: release(),
+      architecture: arch(),
+      node: process.versions.node,
+    },
+  } = {},
+) => {
+  const doctor = await runDoctor(options);
+  return {
+    rehearsalVersion: REHEARSAL_VERSION,
+    system,
+    tools: {
+      npm: inspectTool({ command: "npm", args: ["--version"], runCommand }),
+      supabase: inspectTool({
+        command: "supabase",
+        args: ["--version"],
+        runCommand,
+      }),
+      dockerClient: inspectTool({
+        command: "docker",
+        args: ["--version"],
+        runCommand,
+      }),
+      dockerServer: inspectTool({
+        command: "docker",
+        args: ["info", "--format", "{{.ServerVersion}}"],
+        runCommand,
+      }),
+    },
+    readiness: {
+      state: doctor.state,
+      checks: doctor.checks.map(({ id, label, status, remediation }) => ({
+        id,
+        label,
+        status,
+        ...(status === "fail" && remediation ? { remediation } : {}),
+      })),
+      quarantinedHostedVariableCount:
+        doctor.ambientHostedVariables?.presentButQuarantined.length ?? 0,
+    },
+    privacy: {
+      omits: [
+        "row values",
+        "credentials",
+        "project paths",
+        "migration SQL",
+        "baseline identifiers",
+      ],
+      reviewBeforeSharing: true,
+    },
+    supportUrl: REHEARSAL_SUPPORT_URL,
+  };
+};