@samebase/alchemy-convex 0.19.0 → 0.20.0

package/README.md

@@ -308,6 +308,22 @@ call.
   the `Convex.Deployment` writes to the deployment. Another `redirectUri` is a new client, and a
   destroy deletes the client.
 
+- `Convex.SharedHubClient`: `{ app, deployment, deploymentType, softwareVersion? }` gets a client of
+  the central identity hub through samebase.com, for an app that deploys in its own GitHub Actions
+  run. The workflow needs `permissions: id-token: write` and no Samebase key. Outputs `status`,
+  `issuer`, `clientId`, `clientSecret`, `registrationAccessToken`, `registrationClientUri`,
+  `deployment`, `deploymentType`, and `redirectUri`.
+  - Each deploy reads the saved client on the hub with its own token. A client that is gone gets a
+    new one, and a client on another deployment too.
+  - No failure stops a deploy or a destroy. A failed renewal keeps the saved values. Without saved
+    values, `status` is `off`, and `issuer`, `clientId`, and `clientSecret` are the `no-hub` values
+    of a checkout without a hub. A run without a GitHub OIDC token, such as on a laptop, does the
+    same, and logs no warning.
+  - `status` is `suspended` when the hub suspended the client. The client keeps its values.
+  - A destroy deletes a preview client. It does nothing to a production client, because the
+    production deployment can stay.
+  - `SAMEBASE_URL` replaces `https://samebase.com`.
+
 A development deployment has no stack, so the package has a command for it. Run it in the directory
 of the app, before the first push: it registers the deployment of that directory with
 `CONVEX_ACCESS_TOKEN` or the Convex CLI login, and writes `HUB_ISSUER`, `HUB_CLIENT_ID`, and
@@ -320,9 +336,10 @@ npx alchemy-convex hub-client --team my-team --app scout --callback-path /auth/h
 ## Pull request comment
 
 `alchemy-convex stack-comment` keeps one comment on a pull request. The comment has a card for each
-stack of the repository at the stage `pr-<number>`: the folder, the address, the last run, and the
-Convex deployments, Workers, and R2 buckets. A stack sees only itself, so a comment that a stack
-declares cannot show this.
+stack of the repository at the stage `pr-<number>`: the folder, the address, the last run, the
+Convex deployments, Workers, and R2 buckets, and the Google sign-in status of a
+`Convex.SharedHubClient`. A stack sees only itself, so a comment that a stack declares cannot show
+this.
 
 Run it after every deploy of the workflow. The run record gives the repository and the pull request,
 so the command needs no argument with a team access token:

package/lib/{HubClient-C0XxgkK3.js → HubClient-Dzw8uZNy.js}

@@ -182,7 +182,11 @@ const TokenDetails = Schema.Union([Schema.Struct({
 	projectId: Schema.Number
 })]);
 /** The service for one way to get the bearer token. */
-const makeService = (credentials) => {
+const makeService = (source) => {
+	const credentials = source.pipe(Effect.map((resolved) => ({
+		...resolved,
+		accessToken: Redacted.make(Redacted.value(resolved.accessToken).trim())
+	})));
 	const client = Effect.cached(credentials.pipe(Effect.map((resolved) => createManagementClient(Redacted.value(resolved.accessToken))))).pipe(Effect.flatten);
 	const request = (operation, run) => client.pipe(Effect.flatMap((c) => settle(operation, () => run(c))));
 	const requestVoid = (operation, run) => client.pipe(Effect.flatMap((c) => settleVoid(operation, () => run(c))));
@@ -240,6 +244,7 @@ const makeService = (credentials) => {
 		return match.id;
 	});
 	const isCredentialToken = (secret) => credentials.pipe(Effect.map((resolved) => tokenPart(Redacted.value(resolved.accessToken)) === tokenPart(secret)));
+	const isOAuthCredential = credentials.pipe(Effect.map((resolved) => /^(team|project):/.test(Redacted.value(resolved.accessToken))));
 	const withToken = (token) => makeService(Effect.succeed({
 		accessToken: token,
 		source: "explicit"
@@ -250,6 +255,7 @@ const makeService = (credentials) => {
 		deploymentRequest,
 		resolveTeamId,
 		isCredentialToken,
+		isOAuthCredential,
 		withToken
 	};
 };
@@ -298,7 +304,7 @@ rootDir: Schema.String }) {
 var CodePushFailed = class extends Schema.TaggedError()("CodePushFailed", {
 	/** Exit code of the CLI. Undefined when it did not start or a signal stopped it. */
 	exitCode: Schema.UndefinedOr(Schema.Number),
-	/** The last lines of the CLI output, with the deploy key removed. */
+	/** The last lines of the CLI output, with the deploy key and the `Redacted` values of `env` removed. */
 	outputTail: Schema.String
 }) {
 	get message() {
@@ -476,13 +482,15 @@ const cliEnvironment = (home) => ({
 /**
 * A deploy key of `deployment` that expires after PUSH_KEY_LIFETIME_MS, with
 * only `allowedActions`, or every action when that is undefined. Delete it
-* with {@link deleteDeployKey} when the work is done.
+* with {@link deleteDeployKey} when the work is done. An OAuth credential sends
+* only the name: Convex refuses both limits and returns the OAuth token.
 */
 const createDeployKey = (api, deployment, name, allowedActions) => Effect.gen(function* () {
 	const now = yield* Clock.currentTimeMillis;
+	const oauth = yield* api.isOAuthCredential;
 	const created = yield* api.request("create deploy key", (client) => client.POST("/deployments/{deployment_name}/create_deploy_key", {
 		params: { path: { deployment_name: deployment } },
-		body: {
+		body: oauth ? { name } : {
 			name,
 			...allowedActions === void 0 ? {} : { allowedActions: [...allowedActions] },
 			expiresAt: now + PUSH_KEY_LIFETIME_MS
@@ -589,7 +597,11 @@ const push = (spawner, key, options) => Effect.gen(function* () {
 const runPush = (spawner, key, options) => Effect.gen(function* () {
 	const { cwd, program } = options;
 	const secret = Redacted.value(key);
-	const secrets = [secret, secret.slice(secret.indexOf("|") + 1)].filter((value) => value.length >= 8);
+	const secrets = [
+		secret,
+		secret.slice(secret.indexOf("|") + 1),
+		...Object.values(options.env).flatMap((value) => Redacted.isRedacted(value) ? [Redacted.value(value)] : [])
+	].filter((value) => value.length >= 8);
 	const result = yield* withKeyFile(secret, ({ envFile, home }) => Effect.gen(function* () {
 		const [command, ...programArgs] = program;
 		const args = options.command === void 0 ? [
@@ -1945,4 +1957,4 @@ const registerDevelopmentClient = (options) => Effect.gen(function* () {
 //#endregion
 export { PushTargetMismatch as A, DEPLOY_KEY_ENV as B, DeploymentProvider as C, ConvexAppNotFound as D, CodePushFailed as E, ManagementApi as F, fromValues as H, ManagementApiLive as I, ACCESS_TOKEN_ENV as L, installedCli as M, parseDeployOutput as N, ConvexCliNotFound as O, ConvexApiError as P, Credentials as R, DeploymentIdentityChange as S, ProductionDeploymentNotFound as T, fromConfig as V, ProjectProvider as _, registerDevelopmentClient as a, AmbiguousDeployment as b, RUN_RECORD_KEY as c, withRunRecord as d, AmbiguousProject as f, ProjectNotFound as g, ProjectDeploymentChange as h, HubClientProvider as i, VariablesOwnedBySomeoneElse as j, EnvironmentNeedsDeployKey as k, RunRecordError as l, Project as m, HubClient as n, STORE_PROJECT_NAME as o, CreatedProjectNotFound as p, HubClientFailed as r, state as s, HUB_PROJECT_NAME as t, runRecord as u, ProjectTeamChange as v, DeploymentResource as w, Deployment as x, AbsoluteRootDir as y, CredentialsError as z };
 
-//# sourceMappingURL=HubClient-C0XxgkK3.js.map
+//# sourceMappingURL=HubClient-Dzw8uZNy.js.map