@samebase/alchemy-convex 0.19.1 → 0.21.0

package/README.md

@@ -308,6 +308,22 @@ call.
   the `Convex.Deployment` writes to the deployment. Another `redirectUri` is a new client, and a
   destroy deletes the client.
 
+- `Convex.SharedHubClient`: `{ app, deployment, deploymentType, softwareVersion? }` gets a client of
+  the central identity hub through samebase.com, for an app that deploys in its own GitHub Actions
+  run. The workflow needs `permissions: id-token: write` and no Samebase key. Outputs `status`,
+  `issuer`, `clientId`, `clientSecret`, `registrationAccessToken`, `registrationClientUri`,
+  `deployment`, `deploymentType`, and `redirectUri`.
+  - Each deploy reads the saved client on the hub with its own token. A client that is gone gets a
+    new one, and a client on another deployment too.
+  - No failure stops a deploy or a destroy. A failed renewal keeps the saved values. Without saved
+    values, `status` is `off`, and `issuer`, `clientId`, and `clientSecret` are the `no-hub` values
+    of a checkout without a hub. A run without a GitHub OIDC token, such as on a laptop, does the
+    same, and logs no warning.
+  - `status` is `suspended` when the hub suspended the client. The client keeps its values.
+  - A destroy deletes a preview client. It does nothing to a production client, because the
+    production deployment can stay.
+  - `SAMEBASE_URL` replaces `https://samebase.com`.
+
 A development deployment has no stack, so the package has a command for it. Run it in the directory
 of the app, before the first push: it registers the deployment of that directory with
 `CONVEX_ACCESS_TOKEN` or the Convex CLI login, and writes `HUB_ISSUER`, `HUB_CLIENT_ID`, and
@@ -317,12 +333,18 @@ of the app, before the first push: it registers the deployment of that directory
 npx alchemy-convex hub-client --team my-team --app scout --callback-path /auth/hub/callback
 ```
 
+For a separate API-connection callback, register another client with
+`--callback-path /oauth/hub/callback --env-prefix RESOURCE_HUB`. This writes `RESOURCE_HUB_ISSUER`,
+`RESOURCE_HUB_CLIENT_ID`, and `RESOURCE_HUB_CLIENT_SECRET`, preserving the sign-in client's
+variables. Each callback remains one exact registered URI.
+
 ## Pull request comment
 
 `alchemy-convex stack-comment` keeps one comment on a pull request. The comment has a card for each
-stack of the repository at the stage `pr-<number>`: the folder, the address, the last run, and the
-Convex deployments, Workers, and R2 buckets. A stack sees only itself, so a comment that a stack
-declares cannot show this.
+stack of the repository at the stage `pr-<number>`: the folder, the address, the last run, the
+Convex deployments, Workers, and R2 buckets, and the Google sign-in status of a
+`Convex.SharedHubClient`. A stack sees only itself, so a comment that a stack declares cannot show
+this.
 
 Run it after every deploy of the workflow. The run record gives the repository and the pull request,
 so the command needs no argument with a team access token:

package/lib/{HubClient-NUvPkolM.js → HubClient-B6hjkbjW.js}

@@ -304,7 +304,7 @@ rootDir: Schema.String }) {
 var CodePushFailed = class extends Schema.TaggedError()("CodePushFailed", {
 	/** Exit code of the CLI. Undefined when it did not start or a signal stopped it. */
 	exitCode: Schema.UndefinedOr(Schema.Number),
-	/** The last lines of the CLI output, with the deploy key removed. */
+	/** The last lines of the CLI output, with the deploy key and the `Redacted` values of `env` removed. */
 	outputTail: Schema.String
 }) {
 	get message() {
@@ -597,7 +597,11 @@ const push = (spawner, key, options) => Effect.gen(function* () {
 const runPush = (spawner, key, options) => Effect.gen(function* () {
 	const { cwd, program } = options;
 	const secret = Redacted.value(key);
-	const secrets = [secret, secret.slice(secret.indexOf("|") + 1)].filter((value) => value.length >= 8);
+	const secrets = [
+		secret,
+		secret.slice(secret.indexOf("|") + 1),
+		...Object.values(options.env).flatMap((value) => Redacted.isRedacted(value) ? [Redacted.value(value)] : [])
+	].filter((value) => value.length >= 8);
 	const result = yield* withKeyFile(secret, ({ envFile, home }) => Effect.gen(function* () {
 		const [command, ...programArgs] = program;
 		const args = options.command === void 0 ? [
@@ -1906,12 +1910,6 @@ const HubClientProvider = () => Provider.effect(HubClient, Effect.gen(function*
 		delete: ({ olds, output }) => unregister(api, olds.team, output.clientId).pipe(Effect.asVoid)
 	};
 }));
-/** The variables that a deployment reads to sign in through the hub. */
-const HUB_VARIABLES = [
-	"HUB_ISSUER",
-	"HUB_CLIENT_ID",
-	"HUB_CLIENT_SECRET"
-];
 /**
 * `alchemy-convex hub-client`: a stack deploys production and previews, and this covers the
 * development deployment, which no stack deploys. A deployment with all three variables keeps
@@ -1920,12 +1918,18 @@ const HUB_VARIABLES = [
 */
 const registerDevelopmentClient = (options) => Effect.gen(function* () {
 	const { convex } = options;
+	const envPrefix = options.envPrefix ?? "HUB";
+	const variables = [
+		`${envPrefix}_ISSUER`,
+		`${envPrefix}_CLIENT_ID`,
+		`${envPrefix}_CLIENT_SECRET`
+	];
 	const names = convex([
 		"env",
 		"list",
 		"--names-only"
 	]).split("\n");
-	if (HUB_VARIABLES.every((name) => names.includes(name))) return void 0;
+	if (variables.every((name) => names.includes(name))) return void 0;
 	const siteUrl = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.String))(convex([
 		"run",
 		"--inline-query",
@@ -1947,10 +1951,10 @@ const registerDevelopmentClient = (options) => Effect.gen(function* () {
 		"env",
 		"set",
 		"--force"
-	], `HUB_ISSUER='${client.issuer}'\nHUB_CLIENT_ID='${client.clientId}'\nHUB_CLIENT_SECRET='${Redacted.value(client.clientSecret)}'\n`);
+	], `${envPrefix}_ISSUER='${client.issuer}'\n${envPrefix}_CLIENT_ID='${client.clientId}'\n${envPrefix}_CLIENT_SECRET='${Redacted.value(client.clientSecret)}'\n`);
 	return callbackUrl;
 });
 //#endregion
 export { PushTargetMismatch as A, DEPLOY_KEY_ENV as B, DeploymentProvider as C, ConvexAppNotFound as D, CodePushFailed as E, ManagementApi as F, fromValues as H, ManagementApiLive as I, ACCESS_TOKEN_ENV as L, installedCli as M, parseDeployOutput as N, ConvexCliNotFound as O, ConvexApiError as P, Credentials as R, DeploymentIdentityChange as S, ProductionDeploymentNotFound as T, fromConfig as V, ProjectProvider as _, registerDevelopmentClient as a, AmbiguousDeployment as b, RUN_RECORD_KEY as c, withRunRecord as d, AmbiguousProject as f, ProjectNotFound as g, ProjectDeploymentChange as h, HubClientProvider as i, VariablesOwnedBySomeoneElse as j, EnvironmentNeedsDeployKey as k, RunRecordError as l, Project as m, HubClient as n, STORE_PROJECT_NAME as o, CreatedProjectNotFound as p, HubClientFailed as r, state as s, HUB_PROJECT_NAME as t, runRecord as u, ProjectTeamChange as v, DeploymentResource as w, Deployment as x, AbsoluteRootDir as y, CredentialsError as z };
 
-//# sourceMappingURL=HubClient-NUvPkolM.js.map
+//# sourceMappingURL=HubClient-B6hjkbjW.js.map