@saastemly/voidcommerce 0.17.0 → 0.19.0

package/src/deploy/link.ts

@@ -1,220 +0,0 @@
-import { rmSync } from "node:fs";
-import { join } from "node:path";
-import color from "picocolors";
-import { writeManifest } from "../manifest";
-import type { Project } from "../project";
-import { cloudflareAccounts, getVariable, ghAuth, repoSlug, secretNames, setSecret, setVariable, variableNames, verifyCloudflareToken } from "./github";
-import { LOCAL_KEY_FILE, keyState, localPrivateKey, provisionKey, publicKeyFor } from "./keys";
-import { PRIVATE_KEY_VAR, SECRETS_FILE, committedPublicKeyInto, declaredSecretNames, initSecrets } from "./secrets";
-
-/**
- * `vc link` — the one manual step, done once, from the terminal.
- *
- * ── What this is for ─────────────────────────────────────────────────────
- *
- * The goal is that publishing to GitHub is the whole deploy. Everything
- * else in voidcommerce gets there: the app is generated from the manifest,
- * the secrets are committed as ciphertext, the workflow builds and deploys.
- * One thing cannot be automated away, and it is worth being exact about
- * why.
- *
- * **GitHub cannot mint a Cloudflare credential.** There is no OIDC or
- * workload identity federation between them — the feature request has sat
- * unanswered since 2025, and Cloudflare's own CI guidance still says to
- * store an API token in your CI provider's secrets. The Cloudflare GitHub
- * App does not help: it grants Cloudflare access to the repository, not the
- * repository access to Cloudflare. Something has to authorise creating a
- * database in someone's account, and only Cloudflare can issue that.
- *
- * So exactly one token is typed, once. This command takes it, checks it
- * against the Cloudflare API before trusting it, and puts it in GitHub's
- * encrypted secrets — never on disk, never in a shell profile, never in
- * `~/.wrangler`. After that, `git push` is the deploy, forever.
- *
- * ── What it deliberately does not do ─────────────────────────────────────
- *
- * It does not create the token. That would need a token. The dashboard is
- * the only place a first one can come from, so this prints exactly which
- * permissions to tick and waits.
- */
-
-const TOKEN_SECRET = "CLOUDFLARE_API_TOKEN";
-const ACCOUNT_VAR = "CLOUDFLARE_ACCOUNT_ID";
-
-/** The scopes the deploy actually uses, and why each one is there. */
-const SCOPES: Array<[string, string]> = [
-	["Account · Workers Scripts: Edit", "deploy the worker"],
-	["Account · D1: Edit", "create the database and apply migrations"],
-	["Account · Queues: Edit", "create the order queue"],
-	["Account · Workers KV Storage: Edit", "sessions and caches"],
-	["Account · Workers R2 Storage: Edit", "product images"],
-	["Account · Account Settings: Read", "confirm which account this is"],
-	["Zone · Workers Routes: Edit", "answer on your domain"],
-	["Zone · Zone: Read", "confirm the domain's zone is on this account"],
-	["Zone · DNS: Read", "notice a hostname that already answers, before taking it over"],
-	["User · User Details: Read", "wrangler asks at startup"],
-];
-
-export async function linkCommand(project: Project, args: string[]): Promise<number> {
-	const p = await import("@clack/prompts");
-	const root = project.root;
-	const relink = args.includes("--force");
-
-	p.intro(color.bgCyan(color.black(" vc link ")));
-
-	// 1. gh, logged in, scoped.
-	const auth = await ghAuth(root);
-	if (!auth.ok) {
-		p.cancel(auth.reason ?? "gh is unavailable");
-		return 1;
-	}
-	const slug = await repoSlug(root);
-	if (!slug) {
-		p.cancel(
-			"this checkout has no GitHub repository, and everything below is stored on one.\n\n" +
-				`    ${color.cyan("gh repo create --source=. --private --push")}\n\n` +
-				"  then run `vc link` again.",
-		);
-		return 1;
-	}
-	p.log.success(`${color.green("✓")} ${slug}, as ${auth.user ?? "you"}`);
-
-	// 2. The encryption key. Generated here, stored on the repository, never on disk.
-	const keys = await keyState(project);
-	if (keys.inGitHub && !relink) {
-		p.log.info(`${PRIVATE_KEY_VAR} is already set — leaving it alone (--force replaces it, which orphans ${SECRETS_FILE})`);
-	} else if (keys.inGitHub && relink) {
-		p.log.warn(`--force: replacing ${PRIVATE_KEY_VAR} makes every value in ${SECRETS_FILE} unreadable. Use \`vc keys --rotate\` to re-encrypt instead.`);
-		return 1;
-	} else {
-		// A key parked by `vc keys --init` before this repository existed is
-		// ADOPTED, not replaced: it may already have encrypted the whole shop.
-		const parked = localPrivateKey(root);
-		if (parked) {
-			const sent = await setVariable(root, PRIVATE_KEY_VAR, parked);
-			if (!sent.ok) {
-				p.cancel(`GitHub refused the variable: ${sent.error ?? "unknown error"}`);
-				return 1;
-			}
-			const publicKey = await publicKeyFor(parked);
-			if (publicKey) committedPublicKeyInto(root, publicKey);
-
-			// READ IT BACK before deleting the only other copy. "The write
-			// returned success" is not the same claim as "the key can be
-			// recovered", and it is the second one this file is about to bet
-			// the shop on. If it cannot be read, the local copy stays.
-			const readBack = await getVariable(root, PRIVATE_KEY_VAR);
-			if (readBack !== parked) {
-				p.log.warn(
-					`${color.yellow("!")} ${PRIVATE_KEY_VAR} was written to ${slug} but could not be read back,\n` +
-						`  so ${LOCAL_KEY_FILE} has been LEFT IN PLACE. It is currently the only copy\n` +
-						"  of the key that opens this shop — do not delete it until `vc keys --restore` works.",
-				);
-			} else {
-				rmSync(join(root, LOCAL_KEY_FILE), { force: true });
-				p.log.success(
-					`${color.green("✓")} the key moved to ${slug} and ${LOCAL_KEY_FILE} deleted — verified readable, so \`vc keys --restore\` can bring it back`,
-				);
-			}
-		} else {
-			const made = await provisionKey(project);
-			if (!made.ok) {
-				p.cancel(made.reason);
-				return 1;
-			}
-			committedPublicKeyInto(root, made.publicKey);
-			p.log.success(`${color.green("✓")} ${PRIVATE_KEY_VAR} generated and stored on GitHub; public half in ${SECRETS_FILE}`);
-		}
-	}
-
-	// 3. The Cloudflare token — the one thing that cannot be derived.
-	const existing = await secretNames(root);
-	if (existing.has(TOKEN_SECRET) && !relink) {
-		p.log.info(`${TOKEN_SECRET} is already set — pass --force to replace it`);
-	} else {
-		p.log.step(`A Cloudflare API token, from ${color.cyan("https://dash.cloudflare.com/profile/api-tokens")} → Create Token → Custom token`);
-		console.log(SCOPES.map(([scope, why]) => `      ${scope.padEnd(38)} ${color.dim(why)}`).join("\n"));
-		console.log(
-			color.dim(
-				`\n      The token Cloudflare generates for its own Workers Builds will NOT do:\n` +
-					`      it has no D1 and no Queues permission, so it cannot create the database.\n`,
-			),
-		);
-
-		const token = await p.password({
-			message: "Paste it (nothing is written to disk)",
-			validate: (input) => (input && input.length >= 20 ? undefined : "that is too short to be a Cloudflare token"),
-		});
-		if (p.isCancel(token)) {
-			p.cancel("nothing was stored.");
-			return 1;
-		}
-
-		const spinner = p.spinner();
-		spinner.start("asking Cloudflare whether that token is real");
-		const verified = await verifyCloudflareToken(String(token));
-		if (!verified.ok) {
-			spinner.stop(`${color.red("✗")} Cloudflare rejected it: ${verified.detail}`);
-			p.cancel("nothing was stored.");
-			return 1;
-		}
-		const accounts = await cloudflareAccounts(String(token));
-		spinner.stop(`${color.green("✓")} the token is active and sees ${accounts.length} account${accounts.length === 1 ? "" : "s"}`);
-
-		let accountId = project.manifest.cloudflare?.accountId ?? "";
-		if (accounts.length === 1) {
-			accountId = accounts[0]!.id;
-			p.log.info(`account "${accounts[0]!.name}"`);
-		} else if (accounts.length > 1) {
-			const picked = await p.select({
-				message: "Which account is this shop in?",
-				options: accounts.map((account) => ({ value: account.id, label: account.name, hint: account.id })),
-			});
-			if (p.isCancel(picked)) {
-				p.cancel("nothing was stored.");
-				return 1;
-			}
-			accountId = String(picked);
-		}
-
-		const stored = await setSecret(root, TOKEN_SECRET, String(token));
-		if (!stored.ok) {
-			p.cancel(`GitHub refused the secret: ${stored.error ?? "unknown error"}`);
-			return 1;
-		}
-		p.log.success(`${color.green("✓")} ${TOKEN_SECRET} stored on ${slug}`);
-
-		if (accountId) {
-			// A VARIABLE, not a secret: an account id is an identifier, and a
-			// readable one is easier to debug in a workflow log.
-			const varred = await setVariable(root, ACCOUNT_VAR, accountId);
-			if (varred.ok) p.log.success(`${color.green("✓")} ${ACCOUNT_VAR} set as a repository variable`);
-			project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId };
-			await writeManifest(root, project.manifest);
-		}
-	}
-
-	// 4. The shop's own secrets, so `vc link` leaves a repository that is
-	// ready rather than one that is half-configured.
-	if (declaredSecretNames(root).size === 0) {
-		p.log.step(`writing ${SECRETS_FILE}`);
-		await initSecrets(project);
-	}
-
-	// 5. What is left.
-	const secrets = await secretNames(root);
-	const vars = await variableNames(root);
-	p.outro(
-		[
-			`${color.bold("Ready.")} From here, ${color.cyan("git push")} is the deploy.`,
-			"",
-			`  ${secrets.has(PRIVATE_KEY_VAR) ? color.green("✓") : color.red("✗")} ${PRIVATE_KEY_VAR}   ${color.dim("reads the shop's secrets")}`,
-			`  ${secrets.has(TOKEN_SECRET) ? color.green("✓") : color.red("✗")} ${TOKEN_SECRET}      ${color.dim("deploys to Cloudflare")}`,
-			`  ${vars.has(ACCOUNT_VAR) ? color.green("✓") : color.dim("·")} ${ACCOUNT_VAR}     ${color.dim("which account")}`,
-			"",
-			`  Set the shop's own secrets with ${color.cyan("vc secrets set KEY")} — that needs no`,
-			`  credential at all, because encryption uses the public key in the repository.`,
-		].join("\n"),
-	);
-	return 0;
-}