@smoothbricks/cli 0.11.19 → 0.11.20

package/src/monorepo/setup-environment.test.ts

@@ -0,0 +1,181 @@
+import { describe, expect, it } from 'bun:test';
+import { existsSync, readFileSync } from 'node:fs';
+import { copyFile, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * The measurement THE RULE exists for, taken against the real script.
+ *
+ * `tooling/direnv/setup-environment.ts` is what a direnv reload runs, and the
+ * cost the grouped rule removes is one provider invocation per shell entry
+ * per credential. Counting that needs the whole script — the resolver alone
+ * cannot show what shell entry does with it — so this builds a repository the
+ * way smoo manages one and runs the script in it, three times, with the
+ * declared provider commands pointed at a counter.
+ */
+
+const MANAGED = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', 'managed', 'raw', 'tooling');
+
+interface ShellEntry {
+  readonly exitCode: number;
+  readonly stderr: string;
+}
+
+interface Repository {
+  readonly root: string;
+  /** Runs the real setup-environment.ts exactly as the managed devenv shell does. */
+  readonly enterShell: () => Promise<ShellEntry>;
+  /** Provider invocations recorded so far, per declared variable. */
+  readonly invocations: (name: string) => number;
+}
+
+/**
+ * A managed repository on disk: the two managed direnv scripts, the git hooks
+ * they link, a `.npmrc` that interpolates one declared variable, and a fake
+ * TypeScript API package so the script's post-install pin check finds what it
+ * looks for. Nothing here is a stub of the code under test — only of the
+ * repository it runs in.
+ */
+async function withManagedRepository(
+  options: { prepare?: string },
+  run: (repository: Repository) => Promise<void>,
+): Promise<void> {
+  const root = await mkdtemp(join(tmpdir(), 'smoo-shell-entry-'));
+  const ledgers = await mkdtemp(join(tmpdir(), 'smoo-shell-entry-ledger-'));
+  try {
+    // `.devenv/` is devenv's own state directory, and the setup lock is
+    // created inside it: a managed repository always has one by the time
+    // this script runs.
+    await mkdir(join(root, 'tooling', 'direnv', '.devenv'), { recursive: true });
+    await mkdir(join(root, 'tooling', 'git-hooks'), { recursive: true });
+    for (const name of ['setup-environment.ts', 'secret-references.ts']) {
+      await copyFile(join(MANAGED, 'direnv', name), join(root, 'tooling', 'direnv', name));
+    }
+    for (const hook of ['pre-commit', 'commit-msg', 'pre-push']) {
+      await writeFile(join(root, 'tooling', 'git-hooks', `${hook}.sh`), '#!/usr/bin/env bash\nexit 0\n');
+    }
+    await writeFile(
+      join(root, 'package.json'),
+      JSON.stringify({
+        name: 'fixture',
+        version: '0.0.0',
+        private: true,
+        ...(options.prepare === undefined ? {} : { scripts: { prepare: options.prepare } }),
+        smoo: {
+          secrets: {
+            SMOO_NPM_TOKEN: { command: counter('SMOO_NPM_TOKEN', ledgers) },
+            SMOO_TOKEN: { command: counter('SMOO_TOKEN', ledgers) },
+          },
+        },
+      }),
+    );
+    await writeFile(
+      join(root, '.npmrc'),
+      '@acme:registry=https://npm.example.net\n//npm.example.net/:_authToken=${SMOO_NPM_TOKEN}\n',
+    );
+    // The post-install TypeScript pin is not what this measures, and an
+    // install with no dependencies leaves nothing for it to find.
+    const api = join(root, 'node_modules', '.bun', 'typescript@6.0.3', 'node_modules', 'typescript');
+    await mkdir(api, { recursive: true });
+    await writeFile(
+      join(api, 'package.json'),
+      JSON.stringify({ name: 'typescript', version: '6.0.3', main: 'index.js' }),
+    );
+    await writeFile(join(api, 'index.js'), "module.exports = { version: '6.0.3', readConfigFile: () => ({}) };\n");
+    await git(root, ['init', '--quiet']);
+    await run({
+      root,
+      enterShell: async () => enterShell(root),
+      invocations: (name) => {
+        const path = join(ledgers, name);
+        return existsSync(path)
+          ? readFileSync(path, 'utf8')
+              .split('\n')
+              .filter((line) => line.length > 0).length
+          : 0;
+      },
+    });
+  } finally {
+    await rm(root, { recursive: true, force: true });
+    await rm(ledgers, { recursive: true, force: true });
+  }
+}
+
+/** A declared provider command that records each run and prints a value. */
+function counter(name: string, ledgers: string): [string, ...string[]] {
+  return [
+    process.execPath,
+    '-e',
+    `const fs = require('node:fs');fs.appendFileSync(${JSON.stringify(join(ledgers, name))}, '1\\n');` +
+      `process.stdout.write(${JSON.stringify(`${name}-value`)})`,
+  ];
+}
+
+async function git(cwd: string, args: readonly string[]): Promise<void> {
+  const proc = Bun.spawn({ cmd: ['git', ...args], cwd, stdout: 'ignore', stderr: 'pipe', stdin: 'ignore' });
+  const [stderr, exitCode] = await Promise.all([new Response(proc.stderr).text(), proc.exited]);
+  if (exitCode !== 0) throw new Error(`git ${args.join(' ')} failed: ${stderr}`);
+}
+
+/**
+ * One shell entry: `bun "$DEVENV_ROOT/setup-environment.ts"`, which is
+ * verbatim what the managed devenv `enterShell` runs. The environment carries
+ * only what a developer machine has, so neither the CI branch nor the cowshed
+ * branch can decide this run.
+ */
+async function enterShell(root: string): Promise<ShellEntry> {
+  const proc = Bun.spawn({
+    cmd: ['bun', join(root, 'tooling', 'direnv', 'setup-environment.ts')],
+    cwd: root,
+    env: {
+      PATH: process.env['PATH'],
+      HOME: process.env['HOME'],
+      DEVENV_ROOT: join(root, 'tooling', 'direnv'),
+    },
+    stdout: 'pipe',
+    stderr: 'pipe',
+    stdin: 'ignore',
+  });
+  const [stderr, exitCode] = await Promise.all([
+    new Response(proc.stderr).text(),
+    (async () => {
+      await new Response(proc.stdout).text();
+      return proc.exited;
+    })(),
+  ]);
+  return { exitCode, stderr };
+}
+
+describe('what shell entry costs, in provider invocations', () => {
+  it('runs no provider for a registry credential across three shell entries, and one per entry for a shell secret', async () => {
+    await withManagedRepository({}, async ({ enterShell: enter, invocations }) => {
+      for (let entry = 0; entry < 3; entry += 1) {
+        const { exitCode, stderr } = await enter();
+        expect({ entry, exitCode, stderr }).toEqual({ entry, exitCode: 0, stderr: '' });
+      }
+
+      // The whole point, as a count: the registry credential's provider is
+      // never asked, so there is no credential prompt on any reload.
+      expect(invocations('SMOO_NPM_TOKEN')).toBe(0);
+      // And nothing else changed: a shell secret still resolves once per
+      // shell entry, exactly as it did before groups existed.
+      expect(invocations('SMOO_TOKEN')).toBe(3);
+    });
+  });
+
+  it('names the exact grouped command when the install it ran fails', async () => {
+    // A failing root prepare script fails `bun install` locally without
+    // needing a registry: the degraded path is what prints the deferrals.
+    await withManagedRepository({ prepare: 'exit 1' }, async ({ enterShell: enter, invocations }) => {
+      const { exitCode, stderr } = await enter();
+
+      // A local failure must not take the shell down with it.
+      expect(exitCode).toBe(0);
+      expect(stderr).toContain('SMOO_NPM_TOKEN (registry)');
+      expect(stderr).toContain('smoo secrets run registry bun install');
+      expect(invocations('SMOO_NPM_TOKEN')).toBe(0);
+    });
+  });
+});

package/src/nx/index.test.ts

@@ -109,7 +109,9 @@ describe('Nx helper output formatting', () => {
         targets: {
           test: {
             executor: '@smoothbricks/nx-plugin:bounded-exec',
+            cache: true,
             dependsOn: ['build'],
+            inputs: ['default', { runtime: 'echo version' }],
             options: { command: 'bun test', timeoutMs: 120_000 },
           },
           build: { outputs: ['{projectRoot}/dist'] },
@@ -125,8 +127,10 @@ describe('Nx helper output formatting', () => {
         root: 'packages/cli',
         targets: ['lint'],
         buildDependsOn: undefined,
+        targetCache: new Map(),
         targetDependencies: new Map(),
         targetExecutors: new Map(),
+        targetInputs: new Map(),
         targetOptions: new Map(),
         targetOutputs: new Map(),
         targetScripts: new Map(),
@@ -136,8 +140,12 @@ describe('Nx helper output formatting', () => {
         root: 'packages/web',
         targets: ['build', 'test'],
         buildDependsOn: undefined,
+        targetCache: new Map([['test', true]]),
         targetDependencies: new Map([['test', ['build']]]),
         targetExecutors: new Map([['test', '@smoothbricks/nx-plugin:bounded-exec']]),
+        // Object inputs carry no fileset a policy can read, so only the
+        // strings survive the projection.
+        targetInputs: new Map([['test', ['default']]]),
         targetOptions: new Map([['test', { command: 'bun test', timeoutMs: 120_000 }]]),
         targetOutputs: new Map([['build', ['{projectRoot}/dist']]]),
         targetScripts: new Map(),

package/src/nx/index.ts

@@ -13,8 +13,12 @@ export interface ProjectTargets {
   root?: string;
   targets: string[];
   buildDependsOn?: string[];
+  /** Per-target `cache`, for policies that only govern what Nx can restore. */
+  targetCache?: Map<string, boolean>;
   targetDependencies?: Map<string, string[]>;
   targetExecutors?: Map<string, string>;
+  /** Per-target string inputs; object inputs (`runtime`, `json`, …) are dropped. */
+  targetInputs?: Map<string, string[]>;
   targetOptions?: Map<string, NxTargetOptions>;
   targetOutputs?: Map<string, string[]>;
   targetScripts?: Map<string, string>;
@@ -120,6 +124,20 @@ export function targetOutputsFromNxProjectJson(value: NxProjectJson | null | und
   return targetStringArraysFromNxProjectJson(value, 'outputs');
 }
 
+export function targetInputsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string[]> {
+  return targetStringArraysFromNxProjectJson(value, 'inputs');
+}
+
+export function targetCacheFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, boolean> {
+  const cache = new Map<string, boolean>();
+  for (const [targetName, target] of Object.entries(value?.targets ?? {})) {
+    if (typeof target.cache === 'boolean') {
+      cache.set(targetName, target.cache);
+    }
+  }
+  return cache;
+}
+
 export function targetScriptsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string> {
   const targets = value?.targets;
   const scripts = new Map<string, string>();
@@ -307,7 +325,9 @@ export function projectTargetsFromNxProjects(projects: NxProjects): ProjectTarge
         root: projectRootFromNxProjectJson(metadata),
         targets: targetNamesFromNxProjectJson(metadata),
         buildDependsOn: targetDependencies.get('build'),
+        targetCache: targetCacheFromNxProjectJson(metadata),
         targetDependencies,
+        targetInputs: targetInputsFromNxProjectJson(metadata),
         targetExecutors: targetExecutorsFromNxProjectJson(metadata),
         targetOptions: targetOptionsFromNxProjectJson(metadata),
         targetOutputs: targetOutputsFromNxProjectJson(metadata),

package/src/secrets/commands.test.ts

@@ -1,11 +1,14 @@
-import { describe, expect, it } from 'bun:test';
-import { secretsMissingInEnvironment } from './commands.js';
-import { reconcileSecrets } from './index.js';
+import { afterAll, beforeAll, describe, expect, it } from 'bun:test';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { secretsMissingInEnvironment, secretsStatus } from './commands.js';
+import { parseSecretsStatusDocument, reconcileSecrets } from './status.js';
 
 const sources = {
   workerSecrets: { 'targets/billing': ['PAYMENTS_PUBLISHABLE_KEY', 'PAYMENTS_SECRET_KEY'] },
   workflowSecrets: ['PAYMENTS_PUBLISHABLE_KEY', 'PAYMENTS_SECRET_KEY'],
-  localCommands: [],
+  localSecrets: [],
   secretNames: {
     PAYMENTS_PUBLISHABLE_KEY: 'PAYMENTS_PUBLISHABLE_KEY',
     PAYMENTS_SECRET_KEY: 'PAYMENTS_SECRET_KEY',
@@ -26,3 +29,182 @@ describe('what `smoo secrets set --env` walks', () => {
     expect(walked.map((row) => row.name)).toEqual(['PAYMENTS_SECRET_KEY']);
   });
 });
+
+/**
+ * A whole `smoo secrets status` run against a checkout on disk and a `gh` that
+ * answers from a script rather than the network. Anything less would test the
+ * projection twice and the command not at all: whether `--json` writes one
+ * document and nothing else, and whether it still refuses, are properties of
+ * this function's own output.
+ */
+describe('a real `smoo secrets status` run', () => {
+  let root = '';
+  let path = '';
+
+  beforeAll(async () => {
+    root = await mkdtemp(join(tmpdir(), 'smoo-secrets-status-'));
+    await writeFile(
+      join(root, 'package.json'),
+      `${JSON.stringify(
+        {
+          name: 'acme-app',
+          private: true,
+          workspaces: ['targets/*'],
+          repository: { type: 'git', url: 'https://github.com/acme/app.git' },
+          smoo: {
+            github: {
+              deploySecrets: {
+                MAIL_CAPTURE_CONTROL_TOKEN: 'MAIL_CAPTURE_CONTROL_TOKEN',
+                STRIPE_PUBLISHABLE_KEY: 'STRIPE_PUBLISHABLE_KEY',
+                STRIPE_SECRET_KEY: 'STRIPE_SECRET_KEY',
+              },
+            },
+            secrets: { NPM_READ_TOKEN: { command: ['printf', 'unused'] } },
+          },
+        },
+        null,
+        2,
+      )}\n`,
+    );
+    await mkdir(join(root, '.github', 'workflows'), { recursive: true });
+    await writeFile(
+      join(root, '.github', 'workflows', 'ci.yml'),
+      `name: CI
+on: push
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - run: echo build
+  release:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - run: echo deploy
+`,
+    );
+    await mkdir(join(root, 'targets', 'billing'), { recursive: true });
+    await writeFile(
+      join(root, 'targets', 'billing', 'package.json'),
+      `${JSON.stringify(
+        {
+          name: '@acme/billing',
+          version: '0.0.0',
+          private: true,
+          smoo: { wrangler: { secretStages: { STRIPE_SECRET_KEY: ['production'], E2E_CONTROL_TOKEN: [] } } },
+        },
+        null,
+        2,
+      )}\n`,
+    );
+    await writeFile(
+      join(root, 'targets', 'billing', '.dev.vars.example'),
+      'STRIPE_SECRET_KEY=""\nSTRIPE_PUBLISHABLE_KEY=""\nE2E_CONTROL_TOKEN=""\n',
+    );
+    // `gh` from a script: the repository holds two secrets, staging holds one,
+    // and production refuses - the three answers the command has to tell apart.
+    const bin = join(root, 'bin');
+    await mkdir(bin, { recursive: true });
+    await writeFile(
+      join(bin, 'gh'),
+      `#!/bin/sh
+case "$*" in
+  *"--env production"*) echo "HTTP 403: Resource not accessible" >&2; exit 1 ;;
+  *"--env staging"*) echo '[{"name":"MAIL_CAPTURE_CONTROL_TOKEN"}]' ;;
+  *) echo '[{"name":"NPM_READ_TOKEN"},{"name":"RETIRED_TOKEN"}]' ;;
+esac
+`,
+      { mode: 0o755 },
+    );
+    path = process.env.PATH ?? '';
+    process.env.PATH = `${bin}:${path}`;
+  });
+
+  afterAll(async () => {
+    process.env.PATH = path;
+    await rm(root, { recursive: true, force: true });
+  });
+
+  async function run(options: { repo?: string; env?: string; json?: boolean }): Promise<{
+    code: number;
+    out: string[];
+    errors: string[];
+  }> {
+    const out: string[] = [];
+    const errors: string[] = [];
+    const [log, error] = [console.log, console.error];
+    console.log = (...args: unknown[]) => out.push(args.map(String).join(' '));
+    console.error = (...args: unknown[]) => errors.push(args.map(String).join(' '));
+    try {
+      return { code: await secretsStatus(root, options), out, errors };
+    } finally {
+      [console.log, console.error] = [log, error];
+    }
+  }
+
+  it('writes one document to stdout and nothing else, and still refuses', async () => {
+    const { code, out } = await run({ repo: 'acme/app', json: true });
+
+    expect(out).toHaveLength(1);
+    const validated = parseSecretsStatusDocument(out[0] ?? '');
+    expect(validated.success).toBe(true);
+    if (!validated.success) throw new Error('`--json` wrote a document its own validator rejects');
+    expect(validated.data.repository).toEqual({ repo: 'acme/app', source: 'requested', secretCount: 2 });
+    expect(validated.data.environments).toEqual([
+      {
+        name: 'production',
+        bound: true,
+        readable: false,
+        reason:
+          'gh secret list --json name --repo acme/app --env production exited 1: HTTP 403: Resource not accessible',
+      },
+      { name: 'staging', bound: true, readable: true, secretCount: 1 },
+    ]);
+    expect(validated.data.unsatisfied).toEqual([
+      { name: 'STRIPE_PUBLISHABLE_KEY', repositorySecret: 'STRIPE_PUBLISHABLE_KEY', missingIn: ['staging'] },
+      { name: 'STRIPE_SECRET_KEY', repositorySecret: 'STRIPE_SECRET_KEY', missingIn: ['staging'] },
+    ]);
+    // A machine-readable status nobody can gate on would be worse than none.
+    expect(code).toBe(1);
+  });
+
+  it('carries the stages `smoo.wrangler.secretStages` declares, per name', async () => {
+    const { out } = await run({ repo: 'acme/app', json: true });
+    const validated = parseSecretsStatusDocument(out[0] ?? '');
+    if (!validated.success) throw new Error('`--json` wrote a document its own validator rejects');
+    const stages = Object.fromEntries(validated.data.secrets.map((row) => [row.name, row.requiredByStages]));
+
+    expect(stages).toEqual({
+      // Scoped to production by the wrangler project.
+      STRIPE_SECRET_KEY: ['production'],
+      // Declared and absent from the map, so every stage requires it.
+      STRIPE_PUBLISHABLE_KEY: ['preview', 'production', 'staging'],
+      // Declared and mapped to []: a local-only value no stage requires.
+      E2E_CONTROL_TOKEN: [],
+      // Names no wrangler project declares have no stages to require them.
+      MAIL_CAPTURE_CONTROL_TOKEN: [],
+      NPM_READ_TOKEN: [],
+      RETIRED_TOKEN: [],
+    });
+  });
+
+  it('prints the same facts as a table without the flag', async () => {
+    const { code, out, errors } = await run({ repo: 'acme/app' });
+
+    expect(out[0]).toBe('repository acme/app (requested), holding 2 secrets');
+    expect(out[1]).toBe('environment staging, holding 1 secrets');
+    expect(out[2]).toBe(
+      'environment production could not be read, so nothing below claims what it holds: ' +
+        'gh secret list --json name --repo acme/app --env production exited 1: HTTP 403: Resource not accessible',
+    );
+    expect(out.find((line) => line.startsWith('ABSENT') && line.includes('STRIPE_SECRET_KEY'))).toMatch(
+      /^ABSENT +STRIPE_SECRET_KEY +workflow +targets\/billing$/,
+    );
+    expect(errors).toContain(
+      'missing: STRIPE_SECRET_KEY — a workflow passes secrets.STRIPE_SECRET_KEY and no value exists in staging.',
+    );
+    expect(errors).toContain('  smoo secrets set STRIPE_SECRET_KEY -R acme/app --env staging');
+    expect(code).toBe(1);
+  });
+});