@specific.dev/spectest 0.82.0 → 0.85.0

package/dist/components/index.d.ts

@@ -1,3 +1,4 @@
+export { temporal, temporalClient, type TemporalOptions, type TemporalClient, type TemporalNamespace, type TemporalWorkerOptions, type TemporalPoller, type TemporalSearchAttributeType, type TemporalTaskType } from "./temporal.js";
 export { postgres, type PostgresOptions, type PostgresHelpers, } from "./postgres.js";
 export { s3, type S3Options, type S3Helpers, } from "./s3.js";
 export { SQL, type SqlClient, type SqlOptions } from "../sql.js";

package/dist/components/index.js

@@ -1,4 +1,5 @@
 // Reusable, pre-built service definitions for common dependencies.
+export { temporal, temporalClient } from "./temporal.js";
 //
 // Each component returns a fully-formed `ServiceDefinition` ready to
 // drop into an environment's `services` map. Beyond the container

package/dist/components/postgres-tls.d.ts

@@ -0,0 +1,10 @@
+/** Postgres terminates its own TLS; HTTP ingress cannot proxy its wire protocol. */
+export declare function postgresTls(hostnames?: string[]): {
+    args: string[];
+    certificates: {
+        hostnames: string[];
+        certPath: string;
+        keyPath: string;
+        user: string;
+    }[];
+};

package/dist/components/postgres-tls.js

@@ -0,0 +1,9 @@
+/** Postgres terminates its own TLS; HTTP ingress cannot proxy its wire protocol. */
+export function postgresTls(hostnames = ["{{SPECTEST_SERVICE}}", "{{SPECTEST_SERVICE}}.internal"]) {
+    return {
+        args: ["-c", "ssl=on", "-c", "ssl_cert_file=/tls/postgres.crt", "-c", "ssl_key_file=/tls/postgres.key"],
+        certificates: [{
+                hostnames, certPath: "/tls/postgres.crt", keyPath: "/tls/postgres.key", user: "postgres",
+            }],
+    };
+}

package/dist/components/postgres.d.ts

@@ -25,6 +25,9 @@ export interface PostgresOptions {
     persistent?: boolean;
     /** TCP port the container listens on. Default `5432`. */
     port?: number;
+    /** Native TLS is available by default using the environment CA; plaintext
+     *  connections remain accepted. Set false to disable TLS for a custom image. */
+    tls?: boolean;
     /**
      * CMD args appended after the image entrypoint (keeps the entrypoint, unlike
      * `command`). For extension tuning, e.g.
@@ -109,7 +112,62 @@ export declare function postgres(opts: PostgresOptions): {
     helpers: ({ name }: {
         name: string;
     }) => PostgresHelpers;
-    args?: string[] | undefined;
+    args: string[];
+    certificates: {
+        hostnames: string[];
+        certPath: string;
+        keyPath: string;
+        user: string;
+    }[];
+    image: {
+        type: "registry";
+        reference: string;
+    };
+} | {
+    setup?: ((args: ServiceSetupContext<PostgresHelpers>) => void | Promise<void>) | undefined;
+    env: {
+        POSTGRES_DB: string;
+        POSTGRES_USER: string;
+        POSTGRES_PASSWORD: string;
+        PGDATA: string;
+    };
+    volumes: {
+        target: string;
+    }[];
+    ports: number[];
+    readyCheck: {
+        type: "tcp";
+        port: number;
+        timeoutSecs: number;
+    };
+    helpers: ({ name }: {
+        name: string;
+    }) => PostgresHelpers;
+    args: string[];
+    image: {
+        type: "registry";
+        reference: string;
+    };
+} | {
+    setup?: ((args: ServiceSetupContext<PostgresHelpers>) => void | Promise<void>) | undefined;
+    env: {
+        POSTGRES_DB: string;
+        POSTGRES_USER: string;
+        POSTGRES_PASSWORD: string;
+        PGDATA: string;
+    };
+    volumes: {
+        target: string;
+    }[];
+    ports: number[];
+    readyCheck: {
+        type: "tcp";
+        port: number;
+        timeoutSecs: number;
+    };
+    helpers: ({ name }: {
+        name: string;
+    }) => PostgresHelpers;
     image: {
         type: "registry";
         reference: string;

package/dist/components/postgres.js

@@ -1,4 +1,5 @@
 import { SQL } from "../sql.js";
+import { postgresTls } from "./postgres-tls.js";
 /**
  * A ready-to-use Postgres service. Drop into `environment.services`:
  *
@@ -29,13 +30,15 @@ export function postgres(opts) {
     const reference = opts.image ?? `postgres:${version}`;
     const port = opts.port ?? 5432;
     const persistent = opts.persistent ?? true;
+    const tls = opts.tls !== false ? postgresTls() : undefined;
     // `satisfies` (instead of a return-type annotation) preserves the
     // literal type — in particular, the `helpers` factory's return shape.
     // The mapped type in `ServiceHandlesFor<S>` reads that to type
     // `ctx.svc.<name>` as `{ client: SqlClient }`.
     return {
         image: { type: "registry", reference },
-        ...(opts.args ? { args: opts.args } : {}),
+        ...(tls ? { args: [...(opts.args ?? ["postgres"]), ...tls.args], certificates: tls.certificates }
+            : opts.args ? { args: opts.args } : {}),
         env: {
             POSTGRES_DB: opts.database,
             POSTGRES_USER: opts.user,
@@ -51,7 +54,7 @@ export function postgres(opts) {
         helpers: ({ name }) => {
             const url = `postgres://${encodeURIComponent(opts.user)}` +
                 `:${encodeURIComponent(opts.password)}` +
-                `@${name}:${port}/${encodeURIComponent(opts.database)}`;
+                `@${name}:${port}/${encodeURIComponent(opts.database)}` + (tls ? "?sslmode=verify-full" : "");
             return { client: new SQL(url, { label: name }) };
         },
         // The user's hook, forwarded verbatim — postgres() declares none of

package/dist/components/supabase-config.d.ts

@@ -15,6 +15,11 @@ export interface MailTemplateSpec {
 export interface MappedSupabaseConfig {
     /** GoTrue (`<name>-auth`) environment. */
     auth: Record<string, string>;
+    /** GoTrue variables whose values come from the component's env option. */
+    deferredAuth: Record<string, {
+        from: string;
+        key: string;
+    }>;
     /** PostgREST (`<name>-rest`) environment. */
     rest: Record<string, string>;
     /** Per-function JWT verification, by function name (`functions.<name>.verify_jwt`). */

package/dist/components/supabase-config.js

@@ -210,10 +210,17 @@ const RULES = [
             const field = path[3];
             if (field === "enabled")
                 out.auth[`GOTRUE_HOOK_${prefix}_ENABLED`] = bool(v);
-            else if (field === "uri")
-                out.auth[`GOTRUE_HOOK_${prefix}_URI`] = str(v);
-            else if (field === "secrets")
-                out.auth[`GOTRUE_HOOK_${prefix}_SECRETS`] = str(v);
+            else if (field === "uri" || field === "secrets") {
+                const target = `GOTRUE_HOOK_${prefix}_${field.toUpperCase()}`;
+                const value = configValue(v);
+                if (value.literal !== undefined)
+                    out.auth[target] = value.literal;
+                else if (value.from !== undefined) {
+                    out.deferredAuth[target] = { from: value.from, key: path.join(".") };
+                }
+                else if (value.encrypted)
+                    out.encryptedValues.push(path.join("."));
+            }
         },
     },
     // ── auth: OAuth server (cli gotrue.service.ts:641-646) ──────────────────
@@ -386,6 +393,7 @@ function isOff(v) {
 export function mapSupabaseConfig(doc) {
     const out = {
         auth: {},
+        deferredAuth: {},
         rest: {},
         functionVerifyJwt: {},
         functionSecrets: {},

package/dist/components/supabase-webhooks.d.ts

@@ -0,0 +1 @@
+export declare const SUPABASE_WEBHOOKS_SQL: string;

package/dist/components/supabase-webhooks.js

@@ -0,0 +1,262 @@
+// Supabase CLI database-webhook bootstrap, pinned at 9266dce406db8266d3c6f82839619330aab773c2.
+// https://github.com/supabase/cli/blob/9266dce406db8266d3c6f82839619330aab773c2/apps/cli-go/internal/db/start/templates/webhook.sql
+/*
+MIT License
+
+Copyright (c) 2021 Supabase, Inc. and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+export const SUPABASE_WEBHOOKS_SQL = String.raw `
+SELECT to_regprocedure('supabase_functions.http_request()') IS NULL AS install_webhooks \gset
+\if :install_webhooks
+BEGIN;
+
+-- Create pg_net extension
+CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
+
+-- Create supabase_functions schema
+CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;
+
+GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+
+-- supabase_functions.migrations definition
+CREATE TABLE supabase_functions.migrations (
+  version text PRIMARY KEY,
+  inserted_at timestamptz NOT NULL DEFAULT NOW()
+);
+
+-- Initial supabase_functions migration
+INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
+
+-- supabase_functions.hooks definition
+CREATE TABLE supabase_functions.hooks (
+  id bigserial PRIMARY KEY,
+  hook_table_id integer NOT NULL,
+  hook_name text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT NOW(),
+  request_id bigint
+);
+CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
+
+CREATE FUNCTION supabase_functions.http_request()
+  RETURNS trigger
+  LANGUAGE plpgsql
+  AS $function$
+  DECLARE
+    request_id bigint;
+    payload jsonb;
+    url text := TG_ARGV[0]::text;
+    method text := TG_ARGV[1]::text;
+    headers jsonb DEFAULT '{}'::jsonb;
+    params jsonb DEFAULT '{}'::jsonb;
+    timeout_ms integer DEFAULT 1000;
+  BEGIN
+    IF url IS NULL OR url = 'null' THEN
+      RAISE EXCEPTION 'url argument is missing';
+    END IF;
+
+    IF method IS NULL OR method = 'null' THEN
+      RAISE EXCEPTION 'method argument is missing';
+    END IF;
+
+    IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
+      headers = '{"Content-Type": "application/json"}'::jsonb;
+    ELSE
+      headers = TG_ARGV[2]::jsonb;
+    END IF;
+
+    IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
+      params = '{}'::jsonb;
+    ELSE
+      params = TG_ARGV[3]::jsonb;
+    END IF;
+
+    IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
+      timeout_ms = 1000;
+    ELSE
+      timeout_ms = TG_ARGV[4]::integer;
+    END IF;
+
+    CASE
+      WHEN method = 'GET' THEN
+        SELECT http_get INTO request_id FROM net.http_get(
+          url,
+          params,
+          headers,
+          timeout_ms
+        );
+      WHEN method = 'POST' THEN
+        payload = jsonb_build_object(
+          'old_record', OLD,
+          'record', NEW,
+          'type', TG_OP,
+          'table', TG_TABLE_NAME,
+          'schema', TG_TABLE_SCHEMA
+        );
+
+        SELECT http_post INTO request_id FROM net.http_post(
+          url,
+          payload,
+          params,
+          headers,
+          timeout_ms
+        );
+      ELSE
+        RAISE EXCEPTION 'method argument % is invalid', method;
+    END CASE;
+
+    INSERT INTO supabase_functions.hooks
+      (hook_table_id, hook_name, request_id)
+    VALUES
+      (TG_RELID, TG_NAME, request_id);
+
+    RETURN NEW;
+  END
+$function$;
+
+-- Supabase super admin
+DO
+$$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_roles
+    WHERE rolname = 'supabase_functions_admin'
+  )
+  THEN
+    CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
+  END IF;
+END
+$$;
+
+GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
+ALTER USER supabase_functions_admin SET search_path = "supabase_functions";
+ALTER table "supabase_functions".migrations OWNER TO supabase_functions_admin;
+ALTER table "supabase_functions".hooks OWNER TO supabase_functions_admin;
+ALTER function "supabase_functions".http_request() OWNER TO supabase_functions_admin;
+GRANT supabase_functions_admin TO postgres;
+
+-- Remove unused supabase_pg_net_admin role
+DO
+$$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_roles
+    WHERE rolname = 'supabase_pg_net_admin'
+  )
+  THEN
+    REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;
+    DROP OWNED BY supabase_pg_net_admin;
+    DROP ROLE supabase_pg_net_admin;
+  END IF;
+END
+$$;
+
+-- pg_net grants when extension is already enabled
+DO
+$$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_extension
+    WHERE extname = 'pg_net'
+  )
+  THEN
+    GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+
+    REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+    REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+
+    GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+  END IF;
+END
+$$;
+
+-- Event trigger for pg_net
+CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()
+RETURNS event_trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_event_trigger_ddl_commands() AS ev
+    JOIN pg_extension AS ext
+    ON ev.objid = ext.oid
+    WHERE ext.extname = 'pg_net'
+  )
+  THEN
+    GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+
+    REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+    REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+
+    GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+  END IF;
+END;
+$$;
+COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';
+
+DO
+$$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_event_trigger
+    WHERE evtname = 'issue_pg_net_access'
+  ) THEN
+    CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')
+    EXECUTE PROCEDURE extensions.grant_pg_net_access();
+  END IF;
+END
+$$;
+
+INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');
+
+ALTER function supabase_functions.http_request() SECURITY DEFINER;
+ALTER function supabase_functions.http_request() SET search_path = supabase_functions;
+REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;
+
+COMMIT;
+\endif
+`;

package/dist/components/supabase.d.ts

@@ -3,6 +3,25 @@ import { type SqlClient } from "../sql.js";
 import { type EmailHelpers } from "./email.js";
 export type { MailTemplateId, MailTemplateSpec } from "./supabase-config.js";
 export interface SupabaseOptions {
+    /** Database image and extensions installed before project migrations. */
+    db?: {
+        /** Native database TLS, enabled by default using the environment CA. */
+        tls?: boolean;
+        /** Full Supabase-compatible Postgres image reference. Defaults to the pinned SDK image. */
+        image?: string;
+        /**
+         * Explicit extension overrides for projects whose migrations pin versions
+         * absent from the image. Omit version to use the image's default, or use
+         * db.image to supply an image containing the exact required version.
+         * Existing extensions must match the requested schema/version.
+         * Example: `{ vector: { schema: "public" } }` opts into the image's vector
+         * version before a historical CREATE EXTENSION IF NOT EXISTS migration.
+         */
+        extensions?: Record<string, {
+            schema?: string;
+            version?: string;
+        }>;
+    };
     /**
      * Key of the API-gateway service and the prefix for every other piece.
      * Default `"supabase"`. The gateway is reachable at `http://<name>:8000`
@@ -36,7 +55,7 @@ export interface SupabaseOptions {
     /**
      * Also serve the gateway over **HTTPS** at `https://<hostname>` via the
      * daemon's CA-trusted TLS reverse proxy (in addition to the plain
-     * `http://<name>:8000`). `sb.url` and `sb.appEnv` then point at the HTTPS
+     * `http://<name>:8000`). `sb.url` then points at the HTTPS
      * address. Use TLS wherever you can: set this when a browser reaches the
      * gateway, because a page that is open over `https://` cannot call an
      * `http://` origin (Chromium blocks the request before it leaves the
@@ -95,13 +114,19 @@ export interface SupabaseOptions {
      * written one. Nothing is derived unless you name the folder, and each piece
      * is optional inside it — a folder with only a `config.toml` is fine.
      *
-     * There is deliberately no per-piece path option and no way to configure
-     * mail, OTP, redirect or JWT behaviour here: those live in `config.toml`,
-     * where your project already declares them and where the Supabase CLI reads
-     * them too. One source of truth, and the environment matches the one you run
-     * locally.
+     * Use `configOverrides` for environment-specific config values without
+     * moving this folder's migrations, seed, templates or functions.
      */
     dir?: string;
+    /**
+     * Values recursively merged into the project's parsed Supabase config.
+     * Tables merge; arrays and scalar values replace their originals. Uses the
+     * same nested keys as config.toml, e.g.:
+     * `{ auth: { hook: { before_user_created: { uri: "https://app.test/hook" } } } }`.
+     * `env(...)` in overrides resolves through `env` just as it does in the file.
+     * Also works without `dir` for a stack with no project SQL or functions.
+     */
+    configOverrides?: Record<string, unknown>;
     /**
      * The `.env` of this environment — the values your `config.toml` reads with
      * `env(...)`.
@@ -279,18 +304,18 @@ export interface SupabaseStack {
         host: string;
         port: number;
     };
-    /** Ready-to-spread env for the app under test: `SUPABASE_URL`,
-     *  `SUPABASE_ANON_KEY`, `SUPABASE_SERVICE_ROLE_KEY`, `DATABASE_URL`. */
-    appEnv: Record<string, string>;
 }
 /**
  * A ready-to-use self-hosted Supabase stack. Mount `.group` at the key
  * matching the `name` option (default `"supabase"`) and wire the app with
- * `.appEnv` / `.ready`:
+ * its connection values and `.ready`:
  *
  * ```ts
  * const sb = supabase({ dbPassword: "postgres" });
- * services: { supabase: sb.group, app: { image, env: sb.appEnv, dependsOn: [sb.ready] } }
+ * services: { supabase: sb.group, app: {
+ *   image, env: { SUPABASE_URL: sb.url, SUPABASE_ANON_KEY: sb.anonKey },
+ *   dependsOn: [sb.ready],
+ * } }
  * ```
  *
  * See the file header for the full picture. Tests get an instrumented DB client