@slingr/cli 0.0.2 → 0.0.4

package/src/templates/ops/scripts/setup-gcp.js.template

@@ -0,0 +1,330 @@
+#!/usr/bin/env node
+// setup-gcp.js - One-time GCP infrastructure setup for {{APP_NAME}}.
+// Run this once per GCP project before the first deployment. Idempotent.
+//
+// Prerequisites:
+//   - gcloud init (sets authenticated account + default project)
+//   - Billing enabled on the project
+//   - Owner or Editor role on the project
+//
+// Usage:
+//   node ops/scripts/setup-gcp.js
+//
+//   Override project or region if needed:
+//   PROJECT_ID=my-project REGION=europe-west1 node ops/scripts/setup-gcp.js
+
+const { getProjectIdFromGcloud, prompt, run, runCapture, step } = require('./_utils');
+
+function runIdempotent(args, message) {
+  const result = run('gcloud', args, { allowFailure: true, suppressOutput: true });
+  if ((result.status ?? 1) !== 0) {
+    console.log(`  (${message})`);
+  }
+}
+
+async function main() {
+  const projectId = process.env.PROJECT_ID || getProjectIdFromGcloud();
+  const region = process.env.REGION || 'us-central1';
+
+  if (!projectId || projectId === '(unset)') {
+    throw new Error('No active GCP project. Run gcloud init first, or pass PROJECT_ID as an env var.');
+  }
+
+  const dbInstanceName = '{{APP_NAME}}-db';
+  const dbName = '{{APP_NAME}}';
+  const dbUser = '{{#if_postgres}}postgres{{/if_postgres}}{{#if_mysql}}root{{/if_mysql}}';
+  const arRepoName = 'slingr-apps';
+  const backendSaName = '{{APP_NAME}}-backend';
+  const backendService = '{{APP_NAME}}-backend';
+  const frontendBucket = `${projectId}-{{APP_NAME}}-frontend`;
+  const backendBucketRes = '{{APP_NAME}}-frontend-bucket';
+  const backendServiceRes = '{{APP_NAME}}-backend-service';
+  const negName = '{{APP_NAME}}-backend-neg';
+  const urlMapName = '{{APP_NAME}}-url-map';
+  const httpProxyName = '{{APP_NAME}}-http-proxy';
+  const fwdRuleName = '{{APP_NAME}}-http-rule';
+
+  const backendSa = `${backendSaName}@${projectId}.iam.gserviceaccount.com`;
+  const projectNumber = runCapture('gcloud', ['projects', 'describe', projectId, '--format=value(projectNumber)']);
+  const cloudbuildSa = `${projectNumber}@cloudbuild.gserviceaccount.com`;
+
+  step(`Setting active project to ${projectId}`);
+  run('gcloud', ['config', 'set', 'project', projectId]);
+
+  step('Enabling GCP APIs...');
+  run('gcloud', [
+    'services',
+    'enable',
+    'run.googleapis.com',
+    'sqladmin.googleapis.com',
+    'artifactregistry.googleapis.com',
+    'cloudbuild.googleapis.com',
+    'secretmanager.googleapis.com',
+    'storage.googleapis.com',
+    'compute.googleapis.com',
+  ]);
+
+  step(`Creating Artifact Registry repository '${arRepoName}'...`);
+  runIdempotent(
+    [
+      'artifacts',
+      'repositories',
+      'create',
+      arRepoName,
+      '--repository-format=docker',
+      `--location=${region}`,
+      '--description=Docker images for Slingr apps',
+      '--quiet',
+    ],
+    'already exists'
+  );
+
+  run('gcloud', ['auth', 'configure-docker', `${region}-docker.pkg.dev`, '--quiet']);
+
+  step(`Creating Cloud SQL instance '${dbInstanceName}'...`);
+  runIdempotent(
+    [
+      'sql',
+      'instances',
+      'create',
+      dbInstanceName,
+      '--database-version={{#if_postgres}}POSTGRES_15{{/if_postgres}}{{#if_mysql}}MYSQL_8_0{{/if_mysql}}',
+      '--tier=db-f1-micro',
+      `--region=${region}`,
+      '--storage-auto-increase',
+      '--no-backup',
+      '--quiet',
+    ],
+    'already exists'
+  );
+
+  step(`Creating database '${dbName}'...`);
+  runIdempotent(
+    ['sql', 'databases', 'create', dbName, `--instance=${dbInstanceName}`, '--quiet'],
+    'already exists'
+  );
+
+  step(`Setting password for Cloud SQL user '${dbUser}'...`);
+  console.log('    This password will also be stored in Secret Manager by setup-secrets.js - use the same value.');
+  const setupDbPass = await prompt('  Enter DB password (input hidden): ', { hidden: true });
+  if (!setupDbPass) {
+    throw new Error('DB password cannot be empty.');
+  }
+  run('gcloud', [
+    'sql',
+    'users',
+    'set-password',
+    dbUser,
+    `--instance=${dbInstanceName}`,
+    `--password=${setupDbPass}`,
+    `--project=${projectId}`,
+  ]);
+
+  step(`Creating service account '${backendSaName}'...`);
+  runIdempotent(
+    [
+      'iam',
+      'service-accounts',
+      'create',
+      backendSaName,
+      '--display-name={{APP_NAME}} Backend Cloud Run SA',
+      '--quiet',
+    ],
+    'already exists'
+  );
+
+  for (const role of ['roles/cloudsql.client', 'roles/secretmanager.secretAccessor']) {
+    run('gcloud', [
+      'projects',
+      'add-iam-policy-binding',
+      projectId,
+      `--member=serviceAccount:${backendSa}`,
+      `--role=${role}`,
+      '--quiet',
+    ]);
+  }
+
+  step('Granting Cloud Build service account permissions...');
+  for (const role of [
+    'roles/run.admin',
+    'roles/iam.serviceAccountUser',
+    'roles/secretmanager.secretAccessor',
+    'roles/artifactregistry.writer',
+    'roles/cloudsql.client',
+    'roles/storage.objectAdmin',
+  ]) {
+    run('gcloud', [
+      'projects',
+      'add-iam-policy-binding',
+      projectId,
+      `--member=serviceAccount:${cloudbuildSa}`,
+      `--role=${role}`,
+      '--quiet',
+    ]);
+  }
+
+  run('gcloud', [
+    'iam',
+    'service-accounts',
+    'add-iam-policy-binding',
+    backendSa,
+    `--member=serviceAccount:${cloudbuildSa}`,
+    '--role=roles/iam.serviceAccountUser',
+    '--quiet',
+  ]);
+
+  step(`Creating GCS bucket 'gs://${frontendBucket}'...`);
+  runIdempotent(
+    [
+      'storage',
+      'buckets',
+      'create',
+      `gs://${frontendBucket}`,
+      `--location=${region}`,
+      '--uniform-bucket-level-access',
+      '--quiet',
+    ],
+    'already exists'
+  );
+
+  run('gcloud', [
+    'storage',
+    'buckets',
+    'add-iam-policy-binding',
+    `gs://${frontendBucket}`,
+    '--member=allUsers',
+    '--role=roles/storage.objectViewer',
+    '--quiet',
+  ]);
+
+  run('gcloud', [
+    'storage',
+    'buckets',
+    'update',
+    `gs://${frontendBucket}`,
+    '--web-main-page-suffix=index.html',
+    '--web-error-page=index.html',
+  ]);
+
+  step('Creating Load Balancer...');
+
+  runIdempotent(
+    [
+      'compute',
+      'network-endpoint-groups',
+      'create',
+      negName,
+      `--region=${region}`,
+      '--network-endpoint-type=serverless',
+      `--cloud-run-service=${backendService}`,
+      '--quiet',
+    ],
+    'NEG already exists'
+  );
+
+  runIdempotent(
+    ['compute', 'backend-services', 'create', backendServiceRes, '--load-balancing-scheme=EXTERNAL_MANAGED', '--global', '--quiet'],
+    'backend service already exists'
+  );
+
+  runIdempotent(
+    [
+      'compute',
+      'backend-services',
+      'add-backend',
+      backendServiceRes,
+      `--network-endpoint-group=${negName}`,
+      `--network-endpoint-group-region=${region}`,
+      '--global',
+      '--quiet',
+    ],
+    'backend already added'
+  );
+
+  runIdempotent(
+    [
+      'compute',
+      'backend-buckets',
+      'create',
+      backendBucketRes,
+      `--gcs-bucket-name=${frontendBucket}`,
+      '--enable-cdn',
+      '--quiet',
+    ],
+    'backend bucket already exists'
+  );
+
+  runIdempotent(
+    ['compute', 'url-maps', 'create', urlMapName, `--default-backend-bucket=${backendBucketRes}`, '--quiet'],
+    'URL map already exists'
+  );
+
+  runIdempotent(
+    [
+      'compute',
+      'url-maps',
+      'add-path-matcher',
+      urlMapName,
+      '--path-matcher-name=api-matcher',
+      `--default-backend-bucket=${backendBucketRes}`,
+      `--backend-service-path-rules=/graphql=${backendServiceRes},/auth/*=${backendServiceRes}`,
+      '--new-hosts=*',
+      '--quiet',
+    ],
+    'path matcher already exists'
+  );
+
+  runIdempotent(
+    ['compute', 'target-http-proxies', 'create', httpProxyName, `--url-map=${urlMapName}`, '--quiet'],
+    'HTTP proxy already exists'
+  );
+
+  runIdempotent(
+    [
+      'compute',
+      'forwarding-rules',
+      'create',
+      fwdRuleName,
+      '--load-balancing-scheme=EXTERNAL_MANAGED',
+      '--global',
+      `--target-http-proxy=${httpProxyName}`,
+      '--ports=80',
+      '--quiet',
+    ],
+    'forwarding rule already exists'
+  );
+
+  const instanceConnName = `${projectId}:${region}:${dbInstanceName}`;
+  const lbIp =
+    runCapture(
+      'gcloud',
+      ['compute', 'forwarding-rules', 'describe', fwdRuleName, '--global', '--format=value(IPAddress)', `--project=${projectId}`],
+      { allowFailure: true }
+    ) || '<pending>';
+
+  console.log('');
+  console.log('✓ Setup complete.');
+  console.log('');
+  console.log(`  GCS bucket : gs://${frontendBucket}`);
+  console.log(`  LB IP      : ${lbIp}`);
+  console.log('');
+  console.log('Next steps:');
+  console.log('  1. Run setup-secrets.js to store credentials in Secret Manager.');
+  console.log('  2. Create the Cloud Build trigger:');
+  console.log('');
+  console.log('  gcloud builds triggers create github \\\\');
+  console.log(`    --project=${projectId} \\\\`);
+  console.log('    --name={{APP_NAME}}-deploy-develop \\\\');
+  console.log('    --repo-name=<YOUR_REPO> \\\\');
+  console.log('    --repo-owner=<YOUR_ORG> \\\\');
+  console.log("    --branch-pattern='^develop$' \\\\");
+  console.log('    --build-config=ops/cloudbuild.yaml \\\\');
+  console.log(
+    `    --substitutions=_PROJECT_ID=${projectId},_REGION=${region},_AR_REPO=${arRepoName},_BACKEND_SERVICE={{APP_NAME}}-backend,_BACKEND_SA=${backendSa},_CLOUDSQL_INSTANCE=${instanceConnName},_DB_SECRET_NAME={{APP_NAME}}-db-password,_JWT_SECRET_NAME={{APP_NAME}}-jwt-secret`
+  );
+}
+
+main().catch(error => {
+  console.error(`ERROR: ${error.message}`);
+  process.exit(1);
+});

package/src/templates/ops/scripts/setup-secrets.js.template

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+// setup-secrets.js - Create or rotate Secret Manager secrets for {{APP_NAME}}.
+// Re-run any time you need to rotate credentials.
+//
+// Prerequisites: setup-gcp.js completed, gcloud init run
+//
+// Usage: node ops/scripts/setup-secrets.js
+//   Override project if needed: PROJECT_ID=my-project node ops/scripts/setup-secrets.js
+
+const crypto = require('crypto');
+const { getProjectIdFromGcloud, prompt, run, step } = require('./_utils');
+
+async function createOrUpdateSecret(projectId, backendSa, secretName, secretValue) {
+  const exists = run('gcloud', ['secrets', 'describe', secretName, `--project=${projectId}`], {
+    allowFailure: true,
+    suppressOutput: true,
+  }).status === 0;
+
+  if (exists) {
+    console.log(`  Rotating '${secretName}'...`);
+    run('gcloud', ['secrets', 'versions', 'add', secretName, '--data-file=-', `--project=${projectId}`], {
+      input: secretValue,
+    });
+  } else {
+    console.log(`  Creating '${secretName}'...`);
+    run(
+      'gcloud',
+      ['secrets', 'create', secretName, '--replication-policy=automatic', '--data-file=-', `--project=${projectId}`],
+      { input: secretValue }
+    );
+  }
+
+  run('gcloud', [
+    'secrets',
+    'add-iam-policy-binding',
+    secretName,
+    `--member=serviceAccount:${backendSa}`,
+    '--role=roles/secretmanager.secretAccessor',
+    `--project=${projectId}`,
+    '--quiet',
+  ]);
+}
+
+async function main() {
+  const projectId = process.env.PROJECT_ID || getProjectIdFromGcloud();
+  const backendSaName = '{{APP_NAME}}-backend';
+
+  if (!projectId || projectId === '(unset)') {
+    throw new Error('No active GCP project. Run gcloud init first, or pass PROJECT_ID as an env var.');
+  }
+
+  const backendSa = `${backendSaName}@${projectId}.iam.gserviceaccount.com`;
+
+  step('DB password');
+  const dbPassword = await prompt('  Enter DB password (input hidden): ', { hidden: true });
+  if (!dbPassword) {
+    throw new Error('password cannot be empty.');
+  }
+  await createOrUpdateSecret(projectId, backendSa, '{{APP_NAME}}-db-password', dbPassword);
+
+  step('JWT signing secret');
+  let jwtSecret = await prompt('  Enter JWT secret (Enter to auto-generate): ', { hidden: true });
+  if (!jwtSecret) {
+    jwtSecret = crypto.randomBytes(48).toString('base64');
+    console.log('  Auto-generated.');
+  }
+  await createOrUpdateSecret(projectId, backendSa, '{{APP_NAME}}-jwt-secret', jwtSecret);
+
+  console.log('');
+  console.log(`✓ Secrets stored. View at: https://console.cloud.google.com/security/secret-manager?project=${projectId}`);
+}
+
+main().catch(error => {
+  console.error(`ERROR: ${error.message}`);
+  process.exit(1);
+});

package/src/templates/ops/scripts/test-prod-local.js.template

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+// test-prod-local.js - Build and run the full production stack locally.
+//
+// Usage:
+//   node ops/scripts/test-prod-local.js
+//
+//   To skip rebuilding the framework (monorepo mode only):
+//   SKIP_FRAMEWORK_BUILD=1 node ops/scripts/test-prod-local.js
+
+const path = require('path');
+const { run, runCapture, step } = require('./_utils');
+
+function main() {
+  const appDir = path.resolve(__dirname, '..', '..');
+  const repoRoot = runCapture('git', ['rev-parse', '--show-toplevel'], { cwd: appDir });
+
+  // In a monorepo the app lives inside the framework repo — build the framework
+  // from source. In standalone mode the framework is already installed as an
+  // npm dependency so there is nothing to build.
+  const isMonorepo = repoRoot !== appDir;
+
+  step('[1/4] Building framework and CLI...');
+  if (!isMonorepo) {
+    console.log('    (standalone mode — framework installed as npm dependency, skipping)');
+  } else if (process.env.SKIP_FRAMEWORK_BUILD === '1') {
+    console.log('    (skipped - SKIP_FRAMEWORK_BUILD=1)');
+  } else {
+    run('pnpm', ['run', 'build:all'], { cwd: repoRoot });
+  }
+
+  step('[2/4] Generating view metadata and GraphQL types...');
+  run('npx', ['slingr', 'sync-metadata'], { cwd: appDir });
+
+  step('[3/4] Building frontend production bundle...');
+  run('npm', ['run', 'build'], { cwd: path.join(appDir, 'frontend') });
+
+  step('[4/4] Starting production stack (Ctrl-C to stop)...');
+  run('docker', ['compose', '-f', 'docker-compose.yml', '-f', 'docker-compose.prod-test.yml', 'up', '--build'], { cwd: appDir });
+
+  console.log('');
+  console.log('Stack stopped.');
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`ERROR: ${error.message}`);
+  process.exit(1);
+}

package/src/templates/package.json.template

@@ -1,38 +1,50 @@
-{
-  "name": "{{APP_NAME}}",
-  "version": "1.0.0",
-  "description": "{{DESCRIPTION}}",
-  "main": "dist/index.js",
-  "scripts": {
-    "build": "tsc",
-    "dev": "ts-node src/index.ts",
-    "test": "jest",
-    "test:watch": "jest --watch"
-  },
-  "keywords": [
-    "slingr",
-    "{{APP_KEYWORD}}"
-  ],
-  "author": "",
-  "license": "MIT",
-  "dependencies": {
-    "graphql-request": "^7.3.0",
-    "slingr-framework": "github:slingr-stack/framework"{{DB_DRIVER_DEPENDENCY}}
-  },
-  "devDependencies": {
-    "@graphql-codegen/cli": "^6.0.0",
-    "@graphql-codegen/typescript": "^5.0.2",
-    "@graphql-codegen/typescript-graphql-request": "^6.3.0",
-    "@graphql-codegen/typescript-operations": "^5.0.2",
-    "@types/jest": "^29.5.12",
-    "@types/node": "^24.3.0",
-    "jest": "^30.2.0",
-    "ts-jest": "^29.4.5",
-    "ts-node": "^10.9.2",
-    "typescript": "^5.9.2"
-  },
-  "overrides": {
-    "glob": "^11.0.0",
-    "node-gyp": "^11.0.0"
-  }
-}
+{
+  "name": "{{APP_NAME}}",
+  "version": "1.0.0",
+  "description": "{{DESCRIPTION}}",
+  "scripts": {
+    "build": "tsc && tsc-alias -p tsconfig.json --resolve-full-paths",
+    "dev": "ts-node src/App.ts",
+    "setup": "pnpm install && pnpm dlx slingr gql generate-schema && pnpm dlx slingr gql generate-sdk",
+    "test": "jest",
+    "test:watch": "jest --watch"
+  },
+  "keywords": [
+    "slingr",
+    "{{APP_KEYWORD}}"
+  ],
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "graphql-request": "^7.3.0",
+    "graphql": "^16.12.0",
+    "@slingr/framework-backend": "latest"{{DB_DRIVER_DEPENDENCY}}
+  },
+  "devDependencies": {
+    "@graphql-codegen/cli": "^6.0.0",
+    "@graphql-codegen/typescript": "^5.0.2",
+    "@graphql-codegen/typescript-graphql-request": "^6.3.0",
+    "@graphql-codegen/typescript-operations": "^5.0.2",
+    "@casl/ability": "6.7.3",
+    "@types/bcryptjs": "^2.4.6",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/jest": "^29.5.12",
+    "@types/node": "^24.3.0",
+    "bcryptjs": "^3.0.2",
+    "jest": "^30.2.0",
+    "jsonwebtoken": "^9.0.2",
+    "ts-jest": "^29.4.5",
+    "ts-node": "^10.9.2",
+    "tsconfig-paths": "^4.2.0",
+    "tsc-alias": "^1.8.10",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.2"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "overrides": {
+    "glob": "^11.0.0",
+    "node-gyp": "^11.0.0"
+  }
+}

package/src/templates/pnpm-workspace.yaml.template

@@ -0,0 +1,3 @@
+packages:
+  - backend
+  - frontend