@rehearsal-db/core 0.1.0-beta.8 → 0.1.0-beta.9

package/{scripts/lib/runtime/supabase_runtime.mjs → src/targets/supabase.mjs}

@@ -16,11 +16,11 @@ import { pathToFileURL } from "node:url";
 import {
   resolveActiveBaselinePaths,
   verifyActiveBaseline,
-} from "../rehearsal/baseline_artifact.mjs";
+} from "../baseline/artifact.mjs";
 import {
   createCleanProcessEnvironment,
   assertLoopbackUrl,
-} from "../rehearsal/process_environment.mjs";
+} from "../shared/process_environment.mjs";
 import {
   localCommandSucceeds,
   readLocalSupabaseEnvironment,
@@ -28,29 +28,36 @@ import {
   runLocalCommand,
   startLocalSupabase,
   stopLocalSupabase,
-} from "../environment/local_supabase.mjs";
+} from "./supabase_environment.mjs";
 import {
   buildRestoreSqlPrefix,
   buildRestoreSqlSuffix,
   createCandidateMigrationReceipt,
   encodeBaselineRecordForCopy,
   summarizeRestoreError,
-} from "../rehearsal/runtime_restore.mjs";
+} from "../runtime/restore.mjs";
 import {
   buildMigrationLedgerInventory,
   compareSourceToReplay,
   createMigrationReplayReceipt,
   readMigrationFileInventory,
-} from "../rehearsal/migration_history.mjs";
-import { loadRehearsalConfig } from "../rehearsal/configuration.mjs";
-import { readRehearsalServiceEnvironment } from "../rehearsal/service_environment.mjs";
-import { readBoundRuntimeSanitizationPolicy } from "../rehearsal/sanitization_policy.mjs";
+} from "../runtime/migration_history.mjs";
+import { loadRehearsalConfig } from "../project/configuration.mjs";
+import { readRehearsalServiceEnvironment } from "../runtime/service_environment.mjs";
+import { readBoundRuntimeSanitizationPolicy } from "../baseline/sanitization_policy.mjs";
 import {
   captureLocalPublicSchema,
   compareProductionSchemaDumps,
-} from "../rehearsal/schema_snapshot.mjs";
-import { formatCount } from "../rehearsal/human_output.mjs";
-import { parseRuntimeInvocation } from "./runtime_target.mjs";
+} from "../baseline/schema_snapshot.mjs";
+import { formatCount } from "../shared/human_output.mjs";
+import { parseRuntimeInvocation } from "./target.mjs";
+import {
+  buildRuntimeFinalizationSql,
+  buildRuntimePostSchemaSql,
+  buildRuntimePrerequisiteSql,
+  buildRuntimeVerificationSql,
+  validateRuntimePolicy,
+} from "../runtime/policy.mjs";
 
 const repositoryRoot = process.cwd();
 const invocation = parseRuntimeInvocation();
@@ -78,6 +85,11 @@ const projectId = config.runtime.projectId;
 const runtimeAdapter = configuredPaths.runtimeAdapter
   ? await import(pathToFileURL(configuredPaths.runtimeAdapter).href)
   : null;
+const runtimePolicy = configuredPaths.runtimePolicy
+  ? validateRuntimePolicy(
+      JSON.parse(await readFile(configuredPaths.runtimePolicy, "utf8")),
+    )
+  : null;
 const environmentKeyPattern = /^[A-Z][A-Z0-9_]*$/u;
 const action = invocation.action;
 
@@ -334,6 +346,12 @@ const writeRuntimeEnvironment = async ({
   const variables = {
     REHEARSAL_RUNTIME_ENVIRONMENT: "rehearsal",
     REHEARSAL_BASELINE_ID: baseline.generationId,
+    DATABASE_URL: environment.databaseUrl,
+    PGHOST: environment.databaseHost,
+    PGPORT: environment.databasePort,
+    PGDATABASE: environment.databaseName,
+    PGUSER: environment.databaseUser,
+    PGPASSWORD: environment.databasePassword,
     SUPABASE_URL: environment.apiUrl,
     SUPABASE_PUBLISHABLE_KEY: environment.publishableKey,
     SUPABASE_SERVICE_ROLE_KEY: environment.serviceRoleKey,
@@ -375,7 +393,13 @@ const runDatabaseSql = (sql) => {
 
 const restoreProductionSchema = async ({ baseline, paths }) => {
   const receipt = baseline.files?.["production-schema.sql"];
-  if (baseline.formatVersion === 1 && receipt === undefined) return null;
+  if (baseline.formatVersion === 1 && receipt === undefined) {
+    if (runtimePolicy) {
+      runDatabaseSql(buildRuntimePrerequisiteSql(runtimePolicy));
+      runDatabaseSql(buildRuntimePostSchemaSql(runtimePolicy));
+    }
+    return null;
+  }
   if (
     baseline.formatVersion !== 2 ||
     !/^[a-f0-9]{64}$/u.test(receipt?.sha256 ?? "") ||
@@ -386,7 +410,12 @@ const restoreProductionSchema = async ({ baseline, paths }) => {
     );
   }
   const schemaSql = await readFile(paths.schemaPath, "utf8");
-  runDatabaseSql("drop schema if exists public cascade;");
+  runDatabaseSql(`drop schema if exists public cascade;
+create schema public authorization pg_database_owner;
+grant usage on schema public to public;`);
+  if (runtimePolicy) {
+    runDatabaseSql(buildRuntimePrerequisiteSql(runtimePolicy));
+  }
   if (runtimeAdapter?.prepareSchema) {
     const preparation = runtimeAdapter.prepareSchema({
       runSql: runDatabaseSql,
@@ -398,6 +427,9 @@ const restoreProductionSchema = async ({ baseline, paths }) => {
     }
   }
   runDatabaseSql(schemaSql);
+  if (runtimePolicy) {
+    runDatabaseSql(buildRuntimePostSchemaSql(runtimePolicy));
+  }
   const restoredSchema = await captureLocalPublicSchema({
     repositoryRoot,
     artifactRoot,
@@ -480,6 +512,10 @@ const resetRuntime = async () => {
       paths: active.paths,
       environment,
     });
+    if (runtimePolicy && runtimePolicy.localRows.length > 0) {
+      runDatabaseSql(buildRuntimeFinalizationSql(runtimePolicy));
+      console.log("Applied reviewed local-only recipes.");
+    }
     const projectRuntime = configureProjectRuntime({
       environment,
       baseline: active.baseline,
@@ -616,6 +652,7 @@ const verifyRuntime = async () => {
     currentFiles: candidateReceipt.currentFiles,
   });
   let projectVerification;
+  if (runtimePolicy) runDatabaseSql(buildRuntimeVerificationSql(runtimePolicy));
   if (runtimeAdapter?.verifyRuntime) {
     projectVerification = runtimeAdapter.verifyRuntime({
       baseline,

package/{scripts/lib/environment/local_supabase.mjs → src/targets/supabase_environment.mjs}

@@ -4,7 +4,7 @@
  */
 
 import { spawnSync } from "node:child_process";
-import { createCleanProcessEnvironment } from "../rehearsal/process_environment.mjs";
+import { createCleanProcessEnvironment } from "../shared/process_environment.mjs";
 
 export const parseSupabaseStatusEnvironment = (output) => {
   const values = {};
@@ -18,6 +18,56 @@ export const parseSupabaseStatusEnvironment = (output) => {
   return values;
 };
 
+export const parseLocalSupabaseEnvironment = (output) => {
+  const values = parseSupabaseStatusEnvironment(output);
+  const localEnvironment = {
+    apiUrl: values.API_URL,
+    databaseUrl: values.DB_URL,
+    publishableKey: values.PUBLISHABLE_KEY ?? values.ANON_KEY,
+    serviceRoleKey: values.SERVICE_ROLE_KEY ?? values.SECRET_KEY,
+    studioUrl: values.STUDIO_URL,
+  };
+  for (const [label, value] of [
+    ["API URL", localEnvironment.apiUrl],
+    ["database URL", localEnvironment.databaseUrl],
+    ["publishable key", localEnvironment.publishableKey],
+    ["service-role key", localEnvironment.serviceRoleKey],
+  ]) {
+    if (!value) throw new Error(`Local Supabase status omitted its ${label}.`);
+  }
+  const api = new URL(localEnvironment.apiUrl);
+  const database = new URL(localEnvironment.databaseUrl);
+  const loopbackHosts = ["127.0.0.1", "::1", "localhost"];
+  if (
+    !loopbackHosts.includes(api.hostname) ||
+    !loopbackHosts.includes(database.hostname) ||
+    !["postgres:", "postgresql:"].includes(database.protocol)
+  ) {
+    throw new Error("Refusing to use a non-local Supabase status target.");
+  }
+  const databaseName = decodeURIComponent(
+    database.pathname.replace(/^\//u, ""),
+  );
+  if (
+    !database.port ||
+    !databaseName ||
+    !database.username ||
+    !database.password
+  ) {
+    throw new Error(
+      "Local Supabase status returned an incomplete database URL.",
+    );
+  }
+  return {
+    ...localEnvironment,
+    databaseHost: database.hostname,
+    databasePort: database.port,
+    databaseName,
+    databaseUser: decodeURIComponent(database.username),
+    databasePassword: decodeURIComponent(database.password),
+  };
+};
+
 export const runLocalCommand = (
   command,
   args,
@@ -90,25 +140,7 @@ export const readLocalSupabaseEnvironment = ({
     withWorkdir(["status", "-o", "env"], workdir),
     { capture: true, cwd, environment },
   );
-  const values = parseSupabaseStatusEnvironment(output);
-  const localEnvironment = {
-    apiUrl: values.API_URL,
-    publishableKey: values.PUBLISHABLE_KEY ?? values.ANON_KEY,
-    serviceRoleKey: values.SERVICE_ROLE_KEY ?? values.SECRET_KEY,
-    studioUrl: values.STUDIO_URL,
-  };
-  for (const [label, value] of [
-    ["API URL", localEnvironment.apiUrl],
-    ["publishable key", localEnvironment.publishableKey],
-    ["service-role key", localEnvironment.serviceRoleKey],
-  ]) {
-    if (!value) throw new Error(`Local Supabase status omitted its ${label}.`);
-  }
-  const hostname = new URL(localEnvironment.apiUrl).hostname;
-  if (!["127.0.0.1", "::1", "localhost"].includes(hostname)) {
-    throw new Error("Refusing to use a non-loopback Supabase status target.");
-  }
-  return localEnvironment;
+  return parseLocalSupabaseEnvironment(output);
 };
 
 export const startLocalSupabase = ({

package/{scripts/lib/runtime/runtime_target.mjs → src/targets/target.mjs}

@@ -55,10 +55,10 @@ export const runRuntimeTarget = async (target) => {
   const resolved = resolveRuntimeTarget(target);
   switch (resolved.id) {
     case "supabase":
-      await import("./supabase_runtime.mjs");
+      await import("./supabase.mjs");
       return;
     case "postgresql":
-      await import("./postgresql_runtime.mjs");
+      await import("./postgresql.mjs");
       return;
     default:
       throw new Error(`No runtime driver is installed for ${resolved.id}.`);