@specific.dev/spectest 0.44.0 → 0.46.0

package/src/components/supabase-dir.test.ts

@@ -0,0 +1,287 @@
+// Wiring test for `supabase({ dir })`: a real folder on disk in, container
+// config out. The mapping itself is covered in supabase-config.test.ts — this
+// is the half that decides WHICH SERVICE each setting lands on, which is where
+// a config key quietly goes missing.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { google } from "./google.js";
+import { supabase } from "./supabase.js";
+import type { ServiceConfig, ServicesMap } from "../index.js";
+
+let root: string;
+const prevWorkspace = process.env.SPECTEST_WORKSPACE;
+
+const CONFIG = `
+project_id = "harmony"
+
+[api]
+schemas = ["public", "graphql_public", "billing"]
+port = 54321
+
+[auth]
+site_url = "http://localhost:3000"
+additional_redirect_urls = ["http://localhost:3000/**"]
+
+[auth.email]
+enable_confirmations = true
+
+[auth.email.smtp]
+admin_email = "noreply@harmony.test"
+sender_name = "Harmony"
+
+[auth.email.template.invite]
+subject = "You've been invited"
+content_path = "./supabase/templates/invite.html"
+
+[auth.external.google]
+enabled = true
+client_id = "env(GOOGLE_OAUTH_CLIENT_ID)"
+
+[auth.external.facebook]
+enabled = true
+
+[auth.oauth_server]
+enabled = true
+authorization_url_path = "/oauth/consent"
+allow_dynamic_registration = true
+
+[auth.hook.before_user_created]
+enabled = true
+uri = "pg-functions://postgres/public/hook_restrict_signup"
+
+[edge_runtime.secrets]
+GREETING_STYLE = "friendly"
+STRIPE_KEY = "env(STRIPE_SECRET_KEY)"
+SENDGRID_KEY = "encrypted:c2VjcmV0"
+
+[functions.public-api]
+verify_jwt = false
+`;
+
+beforeAll(() => {
+  root = mkdtempSync(join(tmpdir(), "sb-dir-"));
+  mkdirSync(join(root, "supabase/templates"), { recursive: true });
+  mkdirSync(join(root, "supabase/migrations"), { recursive: true });
+  mkdirSync(join(root, "supabase/functions/public-api"), { recursive: true });
+  writeFileSync(join(root, "supabase/config.toml"), CONFIG);
+  writeFileSync(join(root, "supabase/templates/invite.html"), "<p>{{ .Token }}</p>");
+  writeFileSync(join(root, "supabase/functions/public-api/index.ts"), "Deno.serve(() => new Response());");
+  // A second project whose folder holds only SQL — the pieces are individually
+  // optional inside `dir`.
+  mkdirSync(join(root, "sql-only/migrations"), { recursive: true });
+  process.env.SPECTEST_WORKSPACE = root;
+});
+
+afterAll(() => {
+  if (prevWorkspace === undefined) delete process.env.SPECTEST_WORKSPACE;
+  else process.env.SPECTEST_WORKSPACE = prevWorkspace;
+  rmSync(root, { recursive: true, force: true });
+});
+
+/** Expand the group the way `defineEnvironment` does, to the final service map. */
+function expand(stack: ReturnType<typeof supabase>, name = "supabase"): ServicesMap {
+  return stack.group.services({
+    name,
+    key: (part) => (part === "gateway" ? name : `${name}-${part}`),
+  });
+}
+
+const svc = (parts: ServicesMap, key: string): ServiceConfig => parts[key] as ServiceConfig;
+
+describe("supabase({ dir })", () => {
+  test("sends each config setting to the service that owns it", () => {
+    const parts = expand(supabase({ dir: "supabase" }));
+
+    expect(svc(parts, "auth").env).toMatchObject({
+      GOTRUE_HOOK_BEFORE_USER_CREATED_ENABLED: "true",
+      // The sender identity comes from the file; the transport stays ours.
+      GOTRUE_SMTP_ADMIN_EMAIL: "noreply@harmony.test",
+      GOTRUE_SMTP_SENDER_NAME: "Harmony",
+      GOTRUE_SMTP_HOST: "supabase-mail",
+    });
+    expect(svc(parts, "rest").env).toMatchObject({
+      PGRST_DB_SCHEMAS: "public,graphql_public,billing",
+    });
+    expect(JSON.parse(svc(parts, "functions").env!.VERIFY_JWT_MAP!)).toEqual({
+      "public-api": false,
+    });
+    // `[edge_runtime.secrets]` — where function secrets live now.
+    expect(svc(parts, "functions").env!.GREETING_STYLE).toBe("friendly");
+  });
+
+  // The one that used to be an SDK option (`mail: { autoconfirm: false }`).
+  test("takes the confirmation flow from the config file", () => {
+    const parts = expand(supabase({ dir: "supabase" }));
+    expect(svc(parts, "auth").env!.GOTRUE_MAILER_AUTOCONFIRM).toBe("false");
+  });
+
+  test("serves the custom invite template to GoTrue over HTTP", () => {
+    const parts = expand(supabase({ dir: "supabase" }));
+
+    expect(svc(parts, "templates").files).toEqual([
+      { path: "/srv/email/invite.html", content: "<p>{{ .Token }}</p>" },
+    ]);
+    // A path is not enough — GoTrue fetches the template over HTTP.
+    expect(svc(parts, "auth").env).toMatchObject({
+      GOTRUE_MAILER_TEMPLATES_INVITE: "http://supabase-templates:8088/email/invite.html",
+      GOTRUE_MAILER_SUBJECTS_INVITE: "You've been invited",
+    });
+    expect(svc(parts, "auth").dependsOn).toContain("templates");
+  });
+
+  // The config's URLs name the developer's machine, where nothing is listening
+  // inside a VM — so addresses come from the `auth` option, never the file.
+  test("ignores the config's addresses and defaults to an open allow list", () => {
+    const parts = expand(supabase({ dir: "supabase" }));
+    expect(svc(parts, "auth").env).toMatchObject({
+      GOTRUE_SITE_URL: "http://supabase:8000",
+      GOTRUE_URI_ALLOW_LIST: "*",
+    });
+  });
+
+  test("takes this environment's addresses from the auth option", () => {
+    const parts = expand(
+      supabase({
+        dir: "supabase",
+        auth: { siteUrl: "https://app.test", additionalRedirectUrls: ["https://app.test/**"] },
+      }),
+    );
+    expect(svc(parts, "auth").env).toMatchObject({
+      GOTRUE_SITE_URL: "https://app.test",
+      GOTRUE_URI_ALLOW_LIST: "https://app.test/**",
+    });
+  });
+
+  test("auth: false still drops GoTrue", () => {
+    const parts = expand(supabase({ auth: false }));
+    expect(parts.auth).toBeUndefined();
+  });
+
+  // Supabase Auth acting as an OAuth authorization server. Its endpoints have
+  // to bypass the gateway's key-auth, because the client holding them is a
+  // third-party connector with no Supabase key at all.
+  test("opens the OAuth-server endpoints at the gateway when the config enables it", () => {
+    const parts = expand(supabase({ dir: "supabase" }));
+
+    expect(svc(parts, "auth").env).toMatchObject({
+      GOTRUE_OAUTH_SERVER_ENABLED: "true",
+      // Note the rename: `authorization_url_path` -> `..._AUTHORIZATION_PATH`.
+      GOTRUE_OAUTH_SERVER_AUTHORIZATION_PATH: "/oauth/consent",
+      GOTRUE_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION: "true",
+    });
+
+    const kong = String(svc(parts, "gateway").files?.[0]!.content);
+    expect(kong).toContain("auth-v1-open-oauth");
+    // RFC 8414 discovery: the issuer has a path, so a compliant client asks
+    // with that path inserted.
+    expect(kong).toContain("/.well-known/oauth-authorization-server/auth/v1");
+  });
+
+  test("leaves those routes out when no config asks for them", () => {
+    const kong = String(svc(expand(supabase()), "gateway").files?.[0]!.content);
+    expect(kong).not.toContain("auth-v1-open-oauth");
+  });
+
+  // `env` is the `.env` this environment does not have: keyed by the name
+  // inside `env(...)`, exactly as the real file is.
+  test("resolves what the config reads from the environment", () => {
+    const parts = expand(
+      supabase({ dir: "supabase", env: { STRIPE_SECRET_KEY: "sk_test_123" } }),
+    );
+    expect(svc(parts, "functions").env).toMatchObject({
+      GREETING_STYLE: "friendly",   // a literal in the file
+      STRIPE_KEY: "sk_test_123",    // STRIPE_KEY = env(STRIPE_SECRET_KEY)
+    });
+    // An inline ciphertext names nothing and is never guessed at.
+    expect(svc(parts, "functions").env!.SENDGRID_KEY).toBeUndefined();
+  });
+
+  test("reads a provider's credentials from the same place", () => {
+    const parts = expand(
+      supabase({ dir: "supabase", env: { GOOGLE_OAUTH_CLIENT_ID: "1234.apps.googleusercontent.com" } }),
+    );
+    expect(svc(parts, "auth").env!.GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID).toBe(
+      "1234.apps.googleusercontent.com",
+    );
+    // Nothing supplied the secret, so both sides get the stack's own.
+    expect(svc(parts, "auth").env!.GOTRUE_EXTERNAL_GOOGLE_SECRET).toBe("spectest-google-secret");
+  });
+
+  // What reaches a function is what the config declares. A value supplied
+  // here and referenced nowhere reaches nothing — and says so in the boot log,
+  // since the alternative is a function silently going without.
+  test("passes on only what the config declares", () => {
+    const parts = expand(supabase({ dir: "supabase", env: { UNDECLARED_FLAG: "true" } }));
+    expect(svc(parts, "functions").env!.UNDECLARED_FLAG).toBeUndefined();
+  });
+
+  test("never passes a deferred value through as written", () => {
+    const parts = expand(supabase({ dir: "supabase" }));
+    const env = svc(parts, "functions").env!;
+    expect(env.STRIPE_KEY).toBeUndefined();
+    expect(env.SENDGRID_KEY).toBeUndefined();
+  });
+
+  // Social sign-in: the provider is stood up in-environment at its own real
+  // endpoints, and GoTrue is pointed at it.
+  test("serves a provider the config enables, and tells GoTrue about it", () => {
+    const parts = expand(supabase({ dir: "supabase" }));
+
+    expect(parts.google).toBeDefined();
+    expect(svc(parts, "auth").dependsOn).toContain("google");
+    expect(svc(parts, "auth").env).toMatchObject({
+      GOTRUE_EXTERNAL_GOOGLE_ENABLED: "true",
+      // The file's value is `env(GOOGLE_OAUTH_CLIENT_ID)` — a reference to a
+      // shell this environment does not have — so the stack supplies its own.
+      GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: "spectest-google-client",
+      GOTRUE_EXTERNAL_GOOGLE_SECRET: "spectest-google-secret",
+      GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: "http://supabase:8000/auth/v1/callback",
+    });
+  });
+
+  // A provider with no emulator is reported, not served — there is nothing to
+  // point GoTrue at, and pretending otherwise would fail mid-flow.
+  test("leaves a provider it cannot emulate out of the stack", () => {
+    const parts = expand(supabase({ dir: "supabase" }));
+    expect(parts.facebook).toBeUndefined();
+    expect(svc(parts, "auth").env!.GOTRUE_EXTERNAL_FACEBOOK_ENABLED).toBeUndefined();
+  });
+
+  test("takes a provider component the caller configured instead", () => {
+    const configured = google({ users: [{ email: "carol@corp.test", name: "Carol Corp" }] });
+    const parts = expand(supabase({ dir: "supabase", auth: { providers: { google: configured } } }));
+    expect(parts.google).toBe(configured);
+    // Still wired: the override changes the accounts, not the plumbing.
+    expect(svc(parts, "auth").env!.GOTRUE_EXTERNAL_GOOGLE_ENABLED).toBe("true");
+  });
+
+  test("each piece inside the folder is optional", () => {
+    const parts = expand(supabase({ dir: "sql-only" }));
+    expect(parts.templates).toBeUndefined();
+    expect(parts["supabase-functions"]).toBeUndefined();
+    // Defaults intact where the folder says nothing.
+    expect(svc(parts, "auth").env!.GOTRUE_MAILER_AUTOCONFIRM).toBe("true");
+  });
+
+  test("stands up a bare stack with no folder at all", () => {
+    const parts = expand(supabase());
+    expect(Object.keys(parts).sort()).toEqual([
+      "auth",
+      "db",
+      "gateway",
+      "imgproxy",
+      "mail",
+      "realtime",
+      "rest",
+      "storage",
+    ]);
+  });
+
+  test("names a folder that isn't there instead of failing later", () => {
+    expect(() => supabase({ dir: "nope" })).toThrow(/does not resolve/);
+  });
+});