@rehearsal-db/core 0.1.0-beta.9 → 0.1.0-rc.2

package/src/identity/storage.mjs

@@ -1,165 +0,0 @@
-/** Copy and verify local Supabase Storage objects during an identity claim. */
-
-import { createHash } from "node:crypto";
-import { assertLoopbackUrl } from "../shared/process_environment.mjs";
-
-const BUCKET = /^[a-z0-9][a-z0-9.-]{0,99}$/u;
-const MAXIMUM_VERIFICATION_BYTES = 100 * 1024 * 1024;
-const REQUEST_TIMEOUT_MS = 30_000;
-
-const objectPath = (value) => {
-  if (
-    typeof value !== "string" ||
-    !value ||
-    value.startsWith("/") ||
-    value.split("/").some((part) => !part || part === "." || part === "..")
-  ) {
-    throw new Error("A Storage identity-claim path is unsafe.");
-  }
-  return value.split("/").map(encodeURIComponent).join("/");
-};
-
-const readVerifiedObject = async ({
-  fetchImpl,
-  baseUrl,
-  headers,
-  bucket,
-  path,
-}) => {
-  const response = await fetchImpl(
-    `${baseUrl}/storage/v1/object/${encodeURIComponent(bucket)}/${objectPath(path)}?rehearsal=${Date.now()}`,
-    {
-      headers,
-      cache: "no-store",
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-    },
-  );
-  if (!response.ok) {
-    throw new Error(
-      `Supabase Storage could not read an identity-claim object (HTTP ${response.status}).`,
-    );
-  }
-  const declaredBytes = Number(response.headers.get("content-length"));
-  if (
-    Number.isFinite(declaredBytes) &&
-    declaredBytes > MAXIMUM_VERIFICATION_BYTES
-  ) {
-    throw new Error(
-      "A Storage identity-claim object exceeds the 100 MiB verification limit.",
-    );
-  }
-  const bytes = Buffer.from(await response.arrayBuffer());
-  if (bytes.length > MAXIMUM_VERIFICATION_BYTES) {
-    throw new Error(
-      "A Storage identity-claim object exceeds the 100 MiB verification limit.",
-    );
-  }
-  return Object.freeze({
-    bytes: bytes.length,
-    sha256: createHash("sha256").update(bytes).digest("hex"),
-  });
-};
-
-export const createSupabaseStorageTransfer = ({
-  url,
-  serviceRoleKey,
-  fetchImpl = globalThis.fetch,
-}) => {
-  assertLoopbackUrl("Rehearsal Supabase Storage", url);
-  if (typeof serviceRoleKey !== "string" || !serviceRoleKey) {
-    throw new Error(
-      "The local runtime environment has no Storage service key.",
-    );
-  }
-  if (typeof fetchImpl !== "function") {
-    throw new Error("A Fetch implementation is required for Storage transfer.");
-  }
-  const baseUrl = url.replace(/\/$/u, "");
-  const headers = Object.freeze({
-    apikey: serviceRoleKey,
-    authorization: `Bearer ${serviceRoleKey}`,
-  });
-  const removePaths = async ({ bucket, paths }) => {
-    if (!BUCKET.test(bucket ?? "") || !Array.isArray(paths) || !paths.length) {
-      throw new Error("A Storage identity-claim removal is invalid.");
-    }
-    paths.forEach(objectPath);
-    const response = await fetchImpl(
-      `${baseUrl}/storage/v1/object/${encodeURIComponent(bucket)}`,
-      {
-        method: "DELETE",
-        headers: { ...headers, "content-type": "application/json" },
-        body: JSON.stringify({ prefixes: paths }),
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-      },
-    );
-    if (!response.ok) {
-      throw new Error(
-        `Supabase Storage could not remove identity-claim objects (HTTP ${response.status}).`,
-      );
-    }
-  };
-  return Object.freeze({
-    async copyAndVerify({ bucket, source, destination }) {
-      if (!BUCKET.test(bucket ?? "")) {
-        throw new Error("A Storage identity-claim bucket is invalid.");
-      }
-      objectPath(source);
-      objectPath(destination);
-      if (source === destination) {
-        throw new Error("A Storage identity-claim copy must change the path.");
-      }
-      const sourceReceipt = await readVerifiedObject({
-        fetchImpl,
-        baseUrl,
-        headers,
-        bucket,
-        path: source,
-      });
-      try {
-        const response = await fetchImpl(`${baseUrl}/storage/v1/object/copy`, {
-          method: "POST",
-          headers: { ...headers, "content-type": "application/json" },
-          body: JSON.stringify({
-            bucketId: bucket,
-            sourceKey: source,
-            destinationKey: destination,
-          }),
-          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-        });
-        if (!response.ok) {
-          throw new Error(
-            `Supabase Storage could not copy an identity-claim object (HTTP ${response.status}).`,
-          );
-        }
-        const destinationReceipt = await readVerifiedObject({
-          fetchImpl,
-          baseUrl,
-          headers,
-          bucket,
-          path: destination,
-        });
-        if (
-          sourceReceipt.bytes !== destinationReceipt.bytes ||
-          sourceReceipt.sha256 !== destinationReceipt.sha256
-        ) {
-          throw new Error(
-            "Supabase Storage copied an identity object with a different byte digest.",
-          );
-        }
-        return destinationReceipt;
-      } catch (error) {
-        try {
-          await removePaths({ bucket, paths: [destination] });
-        } catch (cleanupError) {
-          throw new AggregateError(
-            [error, cleanupError],
-            "Storage identity-copy verification failed and destination cleanup needs attention.",
-          );
-        }
-        throw error;
-      }
-    },
-    remove: removePaths,
-  });
-};

package/src/project/configuration.d.mts

@@ -1,153 +0,0 @@
-export type RehearsalConfigVersion = 1;
-
-export interface RehearsalConfig {
-  schemaVersion: RehearsalConfigVersion;
-  project: { name: string };
-  supabase?: {
-    workdir: string;
-    migrationDirectory: string;
-    rehearsalConfig: string;
-    runtimeWorkdir: string;
-    serviceEnvironmentFile?: string;
-    serviceEnvironmentVariables?: string[];
-  };
-  postgresql?: {
-    migrationDirectory: string;
-    runtimeWorkdir?: string;
-    image?: string;
-    database?: string;
-    user?: string;
-  };
-  baseline: {
-    artifactDirectory?: string;
-    sanitizationPolicy: string;
-  };
-  containerRuntime?: {
-    autoStartColima?: boolean;
-  };
-  cleanup?: {
-    retainBaselineGenerations?: number;
-  };
-  preparation?: {
-    sourcePolicy: string;
-    privacyKey: string;
-    batchRows?: number;
-    maximumRows?: number;
-    maximumBytes?: number;
-    diskHeadroomBytes?: number;
-  };
-  runtimePolicy?: string;
-  identityPolicy?: string;
-  dependentTargets?: Array<{
-    name: string;
-    configPath: string;
-    prepareCommand?: string;
-  }>;
-  application: {
-    startCommand: string;
-    proofCommand: string;
-    environmentFile?: string;
-    environmentVariables?: Record<string, string>;
-    readiness?: {
-      url: string;
-      expectedStatus: number;
-      timeoutSeconds?: number;
-    };
-    httpProofs?: Array<{
-      name: string;
-      kind: "positive" | "negative";
-      url: string;
-      method?: string;
-      expectedStatus: number;
-      json?: {
-        path: string[];
-        equals?: unknown;
-        notEquals?: unknown;
-        minimumItems?: number;
-      };
-    }>;
-    runtimeAdapter?: string;
-  };
-  runtime: {
-    target?: "supabase" | "postgresql";
-    applicationUrl?: string;
-    projectId?: string;
-    apiPort?: number;
-    databasePort: number;
-    studioPort?: number;
-  };
-  safety?: {
-    allowedHosts?: string[];
-    blockedEnvironmentVariables?: string[];
-    authenticationProviders?: string[];
-    hostedAccess?: "disabled";
-    outboundNetwork?: "deny";
-  };
-  verification?: { commands?: string[] };
-}
-
-export declare const REHEARSAL_CONFIG_VERSION: 1;
-export declare const defineRehearsalConfig: <
-  const Config extends RehearsalConfig,
->(
-  config: Config,
-) => Config;
-export declare const loadRehearsalConfig: (options?: {
-  projectRoot?: string;
-  configPath?: string;
-}) => Promise<unknown>;
-export declare const inspectDetectedProject: (options?: {
-  projectRoot?: string;
-}) => Promise<unknown>;
-export declare const renderDetectedConfig: (
-  detected: unknown,
-  options?: {
-    applicationUrl?: string;
-    ports?: { api: number; database: number; studio: number };
-  },
-) => string;
-export declare const renderDetectedPostgresqlConfig: (
-  detected: unknown,
-  options?: {
-    applicationUrl?: string;
-    databasePort?: number;
-  },
-) => string;
-export declare const SANITIZATION_ACTIONS: Readonly<{
-  KEEP: "KEEP";
-  PSEUDONYMIZE: "PSEUDONYMIZE";
-  REPLACE: "REPLACE";
-  EXCLUDE: "EXCLUDE";
-  DERIVE: "DERIVE";
-}>;
-export declare const EXCLUDED_VALUE: unique symbol;
-export declare const normalizeSanitizationAction: (
-  action: string,
-) => "KEEP" | "PSEUDONYMIZE" | "REPLACE" | "EXCLUDE" | "DERIVE";
-export declare const validateSanitizationCoverage: (options: {
-  policy: { policyVersion?: unknown; tables: Array<Record<string, unknown>> };
-  schemaTables: Array<{
-    name: string;
-    columns: Array<string | { name: string }>;
-  }>;
-}) => Readonly<{
-  policyVersion: unknown;
-  tableCount: number;
-  columnCount: number;
-  tables: ReadonlyArray<Record<string, unknown>>;
-}>;
-export declare const validateRuntimeSanitizationPolicy: (
-  policy: unknown,
-) => unknown;
-export declare const readBoundRuntimeSanitizationPolicy: (options: {
-  bytes: Uint8Array | string;
-  expectedSha256: string;
-}) => unknown;
-export declare const applySanitizationAction: (options: {
-  action: string;
-  value: unknown;
-  replace?: (value: unknown, context: Record<string, unknown>) => unknown;
-  pseudonymize?: (value: unknown, context: Record<string, unknown>) => unknown;
-  derive?: (value: unknown, context: Record<string, unknown>) => unknown;
-  context?: Record<string, unknown>;
-}) => unknown | typeof EXCLUDED_VALUE;