@specific.dev/spectest 0.45.0 → 0.47.0

package/dist/daemon.js

@@ -933,8 +933,15 @@ async function ensureCaTrustedImage(serviceName, tag) {
     const ctxDir = path.join(WORKSPACE, ".spectest", "ca-trust", serviceName);
     await fs.mkdir(ctxDir, { recursive: true });
     await fs.copyFile(CA_PATH, path.join(ctxDir, "spectest-ca.crt"));
+    // An image that declares a non-root `USER` runs this step as that user,
+    // and writing the trust store then fails ("cannot create
+    // /etc/ssl/certs/ca-certificates.crt.new: Permission denied") — the CA
+    // silently never lands. Take root for the one command, then hand the
+    // image back its own user so containers still run as it.
+    const declaredUser = (await docker(["image", "inspect", "--format", "{{.Config.User}}", tag], 60_000)).stdout.trim();
+    const needsRoot = declaredUser !== "" && declaredUser !== "root" && declaredUser !== "0";
     const dockerfile = `FROM ${tag}
-COPY spectest-ca.crt /usr/local/share/ca-certificates/spectest-ca.crt
+${needsRoot ? "USER root\n" : ""}COPY spectest-ca.crt /usr/local/share/ca-certificates/spectest-ca.crt
 RUN if command -v update-ca-certificates >/dev/null 2>&1; then \\
       update-ca-certificates; \\
     elif command -v update-ca-trust >/dev/null 2>&1; then \\
@@ -942,7 +949,7 @@ RUN if command -v update-ca-certificates >/dev/null 2>&1; then \\
     else \\
       echo "[spectest] no system CA trust tool in image; env-var trust only"; \\
     fi
-`;
+${needsRoot ? `USER ${declaredUser}\n` : ""}`;
     await fs.writeFile(path.join(ctxDir, "Dockerfile"), dockerfile);
     const build = await docker(["build", "-t", tag, ctxDir], 300_000);
     if (build.code !== 0) {

package/dist/harness/container-run.d.ts

@@ -29,6 +29,12 @@
  * showed the problem, which is why it went unnoticed: only the appending
  * variable was in play.
  *
+ * **Deno is a third mechanism.** It reads none of those variables and
+ * trusts only its bundled Mozilla roots, so an edge function calling a
+ * fake fails with `UnknownIssuer` however the image is set up.
+ * `DENO_TLS_CA_STORE=mozilla,system` is what adds the platform store,
+ * and the platform store is `SSL_CERT_FILE` — the combined bundle.
+ *
  * **`command` and `args` are different overrides.** `command` replaces the
  * entrypoint and runs through `sh -c`; `args` keeps the entrypoint and
  * overrides CMD, which is what init-wrapped images like postgres need to

package/dist/harness/container-run.js

@@ -29,6 +29,12 @@
  * showed the problem, which is why it went unnoticed: only the appending
  * variable was in play.
  *
+ * **Deno is a third mechanism.** It reads none of those variables and
+ * trusts only its bundled Mozilla roots, so an edge function calling a
+ * fake fails with `UnknownIssuer` however the image is set up.
+ * `DENO_TLS_CA_STORE=mozilla,system` is what adds the platform store,
+ * and the platform store is `SSL_CERT_FILE` — the combined bundle.
+ *
  * **`command` and `args` are different overrides.** `command` replaces the
  * entrypoint and runs through `sh -c`; `args` keeps the entrypoint and
  * overrides CMD, which is what init-wrapped images like postgres need to
@@ -87,6 +93,13 @@ export function runContainerArgs(input) {
     // replacing ones take the combined bundle.
     args.push(`--volume=${input.caPath}:${input.caPath}:ro`);
     args.push("-e", `NODE_EXTRA_CA_CERTS=${input.caPath}`);
+    // Deno reads none of the above, and its default store is the bundled
+    // Mozilla roots alone — so a Deno runtime (a Supabase edge function is
+    // the usual one) rejects every certificate this environment mints, with
+    // or without the CA layered into the image. `system` adds the platform
+    // store, which resolves through `SSL_CERT_FILE`: the bundle below.
+    // `mozilla` stays first so the public roots survive.
+    args.push("-e", "DENO_TLS_CA_STORE=mozilla,system");
     const bundle = input.caBundle;
     if (bundle) {
         if (bundle !== input.caPath)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.45.0",
+  "version": "0.47.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/supabase-config.test.ts

@@ -0,0 +1,261 @@
+import { describe, expect, test } from "bun:test";
+
+import { mapSupabaseConfig } from "./supabase-config.js";
+
+const toml = (s: string): unknown =>
+  (globalThis as unknown as { Bun: { TOML: { parse(s: string): unknown } } }).Bun.TOML.parse(s);
+
+describe("mapSupabaseConfig", () => {
+  test("maps the auth settings a test can observe", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth]
+jwt_expiry = 7200
+minimum_password_length = 10
+
+[auth.email]
+otp_length = 8
+
+[auth.hook.before_user_created]
+enabled = true
+uri = "pg-functions://postgres/public/hook_restrict_signup"
+`),
+    );
+
+    expect(out.auth).toMatchObject({
+      GOTRUE_JWT_EXP: "7200",
+      GOTRUE_PASSWORD_MIN_LENGTH: "10",
+      GOTRUE_MAILER_OTP_LENGTH: "8",
+      GOTRUE_HOOK_BEFORE_USER_CREATED_ENABLED: "true",
+      GOTRUE_HOOK_BEFORE_USER_CREATED_URI: "pg-functions://postgres/public/hook_restrict_signup",
+    });
+    expect(out.warnings).toEqual([]);
+  });
+
+  // The two mappings a copy-paste gets backwards without anyone noticing.
+  test("negates enable_signup and enable_confirmations", () => {
+    const on = mapSupabaseConfig(
+      toml(`
+[auth]
+enable_signup = true
+[auth.email]
+enable_confirmations = true
+`),
+    );
+    expect(on.auth.GOTRUE_DISABLE_SIGNUP).toBe("false");
+    expect(on.auth.GOTRUE_MAILER_AUTOCONFIRM).toBe("false");
+
+    const off = mapSupabaseConfig(
+      toml(`
+[auth]
+enable_signup = false
+[auth.email]
+enable_confirmations = false
+`),
+    );
+    expect(off.auth.GOTRUE_DISABLE_SIGNUP).toBe("true");
+    expect(off.auth.GOTRUE_MAILER_AUTOCONFIRM).toBe("true");
+  });
+
+  test("collects mail templates by id", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.email.template.invite]
+subject = "You've been invited"
+content_path = "./supabase/templates/invite.html"
+`),
+    );
+    expect(out.templates.invite).toEqual({
+      path: "./supabase/templates/invite.html",
+      subject: "You've been invited",
+    });
+  });
+
+  // A subject with no content_path is how the CLI spells "default body, custom
+  // subject" — it must not invent a template path.
+  test("keeps a subject-only template out of the served set", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.email.template.recovery]
+subject = "Reset it"
+content_path = ""
+`),
+    );
+    expect(out.templates.recovery).toEqual({ path: "", subject: "Reset it" });
+  });
+
+  test("reads per-function verify_jwt and the api schemas", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[api]
+schemas = ["public", "graphql_public"]
+max_rows = 500
+port = 54321
+
+[functions.invoice-api]
+verify_jwt = false
+[functions.account-api]
+verify_jwt = true
+`),
+    );
+    expect(out.functionVerifyJwt).toEqual({ "invoice-api": false, "account-api": true });
+    expect(out.rest).toEqual({ PGRST_DB_SCHEMAS: "public,graphql_public", PGRST_DB_MAX_ROWS: "500" });
+  });
+
+  // Addresses are this environment's, not the file's: its URLs name the
+  // developer's machine, where nothing is listening inside a VM.
+  test("never takes site_url or the redirect allow list from the file", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth]
+site_url = "http://localhost:3000"
+additional_redirect_urls = ["http://localhost:3000/**"]
+`),
+    );
+    expect(out.auth).toEqual({});
+    expect(out.unsupported).toEqual([]);
+    expect(out.warnings).toEqual([]);
+  });
+
+  // Reported, never fatal — the file belongs to the project and describes more
+  // environments than this one.
+  test("reports a setting it cannot apply, with the reason", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.captcha]
+enabled = true
+provider = "hcaptcha"
+secret = "env(HCAPTCHA_SECRET)"
+`),
+    );
+    expect(out.unsupported).toHaveLength(1);
+    expect(out.unsupported[0]!.key).toBe("auth.captcha");
+    expect(out.unsupported[0]!.reason).toMatch(/captcha/);
+  });
+
+  // Social sign-in is collected, not refused: the component serves each
+  // provider it has an emulator for at that provider's real endpoints.
+  test("collects the social providers and where their credentials come from", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.external.google]
+enabled = true
+client_id = "env(GOOGLE_OAUTH_CLIENT_ID)"
+secret = "env(GOOGLE_OAUTH_SECRET)"
+
+[auth.external.azure]
+enabled = true
+client_id = "literal-azure-id"
+url = "https://login.microsoftonline.com/tenant-1/v2.0"
+
+[auth.external.facebook]
+enabled = false
+`),
+    );
+    expect(out.externalProviders.google).toEqual({
+      enabled: true,
+      clientIdFrom: "GOOGLE_OAUTH_CLIENT_ID",
+      secretFrom: "GOOGLE_OAUTH_SECRET",
+    });
+    expect(out.externalProviders.azure).toEqual({
+      enabled: true,
+      clientId: "literal-azure-id",
+      url: "https://login.microsoftonline.com/tenant-1/v2.0",
+    });
+    expect(out.externalProviders.facebook!.enabled).toBe(false);
+    expect(out.unsupported).toEqual([]);
+  });
+
+  // The common shape: a config lists a dozen providers with every one off.
+  // Nothing is lost by not applying them, so nothing is said.
+  test("stays quiet about an unsupported feature that is switched off", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.captcha]
+enabled = false
+provider = "hcaptcha"
+
+[auth.sms]
+enable_signup = false
+template = "code {{ .Code }}"
+`),
+    );
+    expect(out.unsupported).toEqual([]);
+  });
+
+  test("reports a section where only one feature is enabled", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.mfa.phone]
+enroll_enabled = true
+verify_enabled = false
+`),
+    );
+    expect(out.unsupported.map((u) => u.key)).toEqual(["auth.mfa.phone"]);
+  });
+
+  // Both ways the file defers a value to the surrounding environment. Passing
+  // either through would hand a function the string `env(NAME)` or a base64
+  // ciphertext — the latter looking enough like a value to go unnoticed.
+  test("separates literal secrets from the two deferred forms", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[edge_runtime.secrets]
+FEATURE_FLAG = "true"
+STRIPE_KEY = "env(STRIPE_SECRET_KEY)"
+SENDGRID_KEY = "encrypted:c2VjcmV0LXZhbHVl"
+`),
+    );
+    expect(out.functionSecrets).toEqual({ FEATURE_FLAG: "true" });
+    // `env(NAME)` records the name to read it from…
+    expect(out.deferredSecrets).toEqual({ STRIPE_KEY: "STRIPE_SECRET_KEY" });
+    // …while an inline ciphertext names nothing and cannot be supplied here.
+    expect(out.encryptedValues).toEqual(["edge_runtime.secrets.SENDGRID_KEY"]);
+  });
+
+  // A provider credential reads from the same `.env` as everything else — it
+  // is a field on the project's auth settings rather than a named secret, but
+  // the value gets there the same way.
+  test("records where a provider credential is read from", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.external.google]
+enabled = true
+client_id = "env(GOOGLE_OAUTH_CLIENT_ID)"
+secret = "encrypted:c2hoaA=="
+`),
+    );
+    expect(out.externalProviders.google).toEqual({
+      enabled: true,
+      clientIdFrom: "GOOGLE_OAUTH_CLIENT_ID",
+    });
+    // The ciphertext names nothing, so it is reported instead of guessed at.
+    expect(out.encryptedValues).toEqual(["auth.external.google.secret"]);
+  });
+
+  test("warns rather than fails on a key it has never seen", () => {
+    const out = mapSupabaseConfig(toml(`\n[auth]\nfuture_option = true\n`));
+    expect(out.warnings).toEqual(["auth.future_option"]);
+  });
+
+  // Sections spectest owns outright never reach the user as noise.
+  test("drops the topology sections in silence", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+project_id = "test"
+[db]
+port = 54322
+[db.pooler]
+enabled = true
+[studio]
+port = 54323
+[inbucket]
+port = 54324
+[remotes.production.auth]
+site_url = "https://example.com"
+`),
+    );
+    expect(out.warnings).toEqual([]);
+    expect(out.auth).toEqual({});
+  });
+});