@specific.dev/spectest 0.83.0 → 0.85.1

package/src/components/postgres-tls.ts

@@ -0,0 +1,11 @@
+import type { CertificateMount } from "../index.js";
+
+/** Postgres terminates its own TLS; HTTP ingress cannot proxy its wire protocol. */
+export function postgresTls(hostnames = ["{{SPECTEST_SERVICE}}", "{{SPECTEST_SERVICE}}.internal"]) {
+  return {
+    args: ["-c", "ssl=on", "-c", "ssl_cert_file=/tls/postgres.crt", "-c", "ssl_key_file=/tls/postgres.key"],
+    certificates: [{
+      hostnames, certPath: "/tls/postgres.crt", keyPath: "/tls/postgres.key", user: "postgres",
+    }] satisfies CertificateMount[],
+  };
+}

package/src/components/postgres.ts

@@ -1,5 +1,6 @@
 import type { ServiceDefinition, ServiceSetupContext } from "../index.js";
 import { SQL, type SqlClient } from "../sql.js";
+import { postgresTls } from "./postgres-tls.js";
 
 export interface PostgresOptions {
   /** Image tag for the official `postgres` image. Default `"18-alpine"`.
@@ -26,6 +27,9 @@ export interface PostgresOptions {
   persistent?: boolean;
   /** TCP port the container listens on. Default `5432`. */
   port?: number;
+  /** Native TLS is available by default using the environment CA; plaintext
+   *  connections remain accepted. Set false to disable TLS for a custom image. */
+  tls?: boolean;
   /**
    * CMD args appended after the image entrypoint (keeps the entrypoint, unlike
    * `command`). For extension tuning, e.g.
@@ -97,13 +101,15 @@ export function postgres(opts: PostgresOptions) {
   const reference = opts.image ?? `postgres:${version}`;
   const port = opts.port ?? 5432;
   const persistent = opts.persistent ?? true;
+  const tls = opts.tls !== false ? postgresTls() : undefined;
   // `satisfies` (instead of a return-type annotation) preserves the
   // literal type — in particular, the `helpers` factory's return shape.
   // The mapped type in `ServiceHandlesFor<S>` reads that to type
   // `ctx.svc.<name>` as `{ client: SqlClient }`.
   return {
     image: { type: "registry", reference },
-    ...(opts.args ? { args: opts.args } : {}),
+    ...(tls ? { args: [...(opts.args ?? ["postgres"]), ...tls.args], certificates: tls.certificates }
+      : opts.args ? { args: opts.args } : {}),
     env: {
       POSTGRES_DB: opts.database,
       POSTGRES_USER: opts.user,
@@ -120,7 +126,7 @@ export function postgres(opts: PostgresOptions) {
       const url =
         `postgres://${encodeURIComponent(opts.user)}` +
         `:${encodeURIComponent(opts.password)}` +
-        `@${name}:${port}/${encodeURIComponent(opts.database)}`;
+        `@${name}:${port}/${encodeURIComponent(opts.database)}` + (tls ? "?sslmode=verify-full" : "");
       return { client: new SQL(url, { label: name }) };
     },
     // The user's hook, forwarded verbatim — postgres() declares none of

package/src/components/supabase-config.ts

@@ -63,6 +63,8 @@ export interface MailTemplateSpec {
 export interface MappedSupabaseConfig {
   /** GoTrue (`<name>-auth`) environment. */
   auth: Record<string, string>;
+  /** GoTrue variables whose values come from the component's env option. */
+  deferredAuth: Record<string, { from: string; key: string }>;
   /** PostgREST (`<name>-rest`) environment. */
   rest: Record<string, string>;
   /** Per-function JWT verification, by function name (`functions.<name>.verify_jwt`). */
@@ -299,8 +301,14 @@ const RULES: Rule[] = [
       const prefix = path[2]!.toUpperCase();
       const field = path[3];
       if (field === "enabled") out.auth[`GOTRUE_HOOK_${prefix}_ENABLED`] = bool(v);
-      else if (field === "uri") out.auth[`GOTRUE_HOOK_${prefix}_URI`] = str(v);
-      else if (field === "secrets") out.auth[`GOTRUE_HOOK_${prefix}_SECRETS`] = str(v);
+      else if (field === "uri" || field === "secrets") {
+        const target = `GOTRUE_HOOK_${prefix}_${field.toUpperCase()}`;
+        const value = configValue(v);
+        if (value.literal !== undefined) out.auth[target] = value.literal;
+        else if (value.from !== undefined) {
+          out.deferredAuth[target] = { from: value.from, key: path.join(".") };
+        } else if (value.encrypted) out.encryptedValues.push(path.join("."));
+      }
     },
   },
 
@@ -480,6 +488,7 @@ function isOff(v: unknown): boolean {
 export function mapSupabaseConfig(doc: unknown): MappedSupabaseConfig {
   const out: MappedSupabaseConfig = {
     auth: {},
+    deferredAuth: {},
     rest: {},
     functionVerifyJwt: {},
     functionSecrets: {},

package/src/components/supabase-db.test.ts

@@ -0,0 +1,64 @@
+// Opt-in against a disposable supabase/postgres container. The setup changes
+// its postgres database; never point SPECTEST_TEST_SUPABASE_CONTAINER at app data.
+import { describe, expect, test } from "bun:test";
+import { supabase, type SupabaseOptions } from "./supabase.js";
+import type { ExecOpts, ServiceDefinition, ServiceSetupContext } from "../index.js";
+
+const container = process.env.SPECTEST_TEST_SUPABASE_CONTAINER;
+
+async function exec(_service: string, command: string[], opts?: ExecOpts) {
+  const child = Bun.spawn(["sudo", "docker", "exec", "-i", container!, ...command], {
+    stdin: new Blob([opts?.stdin ?? ""]), stdout: "pipe", stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited,
+  ]);
+  return { stdout, stderr, exitCode };
+}
+
+async function setup(options: SupabaseOptions = {}) {
+  const stack = supabase(options);
+  const parts = stack.group.services({ name: "supabase", key: (part) => `supabase-${part}` });
+  const db = parts.db as ServiceDefinition;
+  await db.setup!({ name: "supabase-db", exec } as unknown as ServiceSetupContext);
+}
+
+async function sql(text: string) {
+  const result = await exec("supabase-db", ["psql", "-U", "postgres", "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-At", "-f", "-"], { stdin: text });
+  if (result.exitCode !== 0) throw new Error(result.stderr);
+  return result.stdout;
+}
+
+describe.skipIf(!container)("Supabase database compatibility", () => {
+  test("bootstrap is repeatable and creates real webhook objects with working grants", async () => {
+    await setup();
+    await setup();
+    const output = await sql(`
+BEGIN;
+CREATE TABLE public.sdk_webhook_probe (value text);
+CREATE TRIGGER sdk_probe AFTER INSERT ON public.sdk_webhook_probe
+FOR EACH ROW EXECUTE FUNCTION supabase_functions.http_request(
+  'http://127.0.0.1:1/webhook', 'POST', '{"Content-Type":"application/json"}', '{}', '1000');
+INSERT INTO public.sdk_webhook_probe VALUES ('delivered');
+SELECT convert_from(body, 'UTF8')::jsonb->'record'->>'value' FROM net.http_request_queue
+WHERE id = (SELECT request_id FROM supabase_functions.hooks WHERE hook_name = 'sdk_probe');
+SELECT setval('supabase_functions.hooks_id_seq', 42, false);
+ROLLBACK;`);
+    expect(output).toContain("delivered");
+    expect(output).toContain("42");
+  });
+
+  test("explicit image-default vector selection supports a historical IF NOT EXISTS pin", async () => {
+    await setup({ db: { extensions: { vector: { schema: "public" } } } });
+    const output = await sql(`
+CREATE EXTENSION IF NOT EXISTS vector WITH SCHEMA public VERSION '0.7.0';
+SELECT '[1,2,3]'::vector <-> '[1,2,3]'::vector;`);
+    expect(output.trim().split("\n").at(-1)).toBe("0");
+  });
+
+  test("an existing extension cannot silently ignore an explicitly requested version", async () => {
+    await setup({ db: { extensions: { vector: { schema: "public" } } } });
+    await expect(setup({ db: { extensions: { vector: { version: "0.0.0-missing" } } } }))
+      .rejects.toThrow(/does not match the requested schema\/version/);
+  });
+});

package/src/components/supabase-dir.test.ts

@@ -93,6 +93,77 @@ function expand(stack: ReturnType<typeof supabase>, name = "supabase"): Services
 const svc = (parts: ServicesMap, key: string): ServiceConfig => parts[key] as ServiceConfig;
 
 describe("supabase({ dir })", () => {
+  test("overrides hook addresses without moving migrations or leaking env references", () => {
+    const stack = supabase({
+      dir: "supabase",
+      configOverrides: {
+        auth: { hook: { before_user_created: {
+          uri: "https://app.test/api/auth/hooks/before-user-created",
+          secrets: "env(AUTH_HOOK_SECRET)",
+        } } },
+      },
+      env: { AUTH_HOOK_SECRET: "v1,whsec_test" },
+    });
+    const parts = expand(stack);
+    expect(svc(parts, "auth").env).toMatchObject({
+      GOTRUE_HOOK_BEFORE_USER_CREATED_ENABLED: "true",
+      GOTRUE_HOOK_BEFORE_USER_CREATED_URI: "https://app.test/api/auth/hooks/before-user-created",
+      GOTRUE_HOOK_BEFORE_USER_CREATED_SECRETS: "v1,whsec_test",
+      GOTRUE_MAILER_AUTOCONFIRM: "false",
+    });
+    expect(parts.functions).toBeDefined();
+    expect(parts.templates).toBeDefined();
+    expect(stack.group.setup).toBeDefined();
+  });
+
+  test("an unresolved HTTP hook secret fails with its config key and env name", () => {
+    expect(() => supabase({
+      configOverrides: { auth: { hook: { custom_access_token: {
+        enabled: true, uri: "https://app.test/hook", secrets: "env(HOOK_SECRET)",
+      } } } },
+    })).toThrow(/auth.hook.custom_access_token.secrets.*HOOK_SECRET/);
+  });
+
+  test("disabled hooks need no secret and never forward a reference", () => {
+    const parts = expand(supabase({
+      configOverrides: { auth: { hook: { custom_access_token: {
+        enabled: false, secrets: "env(HOOK_SECRET)",
+      } } } },
+    }));
+    expect(svc(parts, "auth").env!.GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_SECRETS).toBeUndefined();
+  });
+
+  test("encrypted hook values fail before GoTrue boots", () => {
+    expect(() => supabase({
+      configOverrides: { auth: { hook: { custom_access_token: {
+        enabled: true, secrets: "encrypted:not-a-test-secret",
+      } } } },
+    })).toThrow(/auth.hook.custom_access_token.secrets is encrypted/);
+  });
+
+  test("auth disabled does not require an unused hook secret", () => {
+    const parts = expand(supabase({
+      auth: false,
+      configOverrides: { auth: { hook: { custom_access_token: {
+        enabled: true, secrets: "env(HOOK_SECRET)",
+      } } } },
+    }));
+    expect(parts.auth).toBeUndefined();
+  });
+
+  test("overrides replace arrays while preserving sibling settings", () => {
+    const parts = expand(supabase({
+      dir: "supabase", configOverrides: { api: { schemas: ["public"] } },
+    }));
+    expect(svc(parts, "rest").env!.PGRST_DB_SCHEMAS).toBe("public");
+    expect(svc(parts, "auth").env!.GOTRUE_MAILER_AUTOCONFIRM).toBe("false");
+  });
+
+  test("can select a database image with the project's extension versions", () => {
+    const parts = expand(supabase({ db: { image: "supabase/postgres:custom" } }));
+    expect(svc(parts, "db").image).toEqual({ type: "registry", reference: "supabase/postgres:custom" });
+  });
+
   test("sends each config setting to the service that owns it", () => {
     const parts = expand(supabase({ dir: "supabase" }));
 

package/src/components/supabase-webhooks.ts

@@ -0,0 +1,263 @@
+// Supabase CLI database-webhook bootstrap, pinned at 9266dce406db8266d3c6f82839619330aab773c2.
+// https://github.com/supabase/cli/blob/9266dce406db8266d3c6f82839619330aab773c2/apps/cli-go/internal/db/start/templates/webhook.sql
+/*
+MIT License
+
+Copyright (c) 2021 Supabase, Inc. and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+
+export const SUPABASE_WEBHOOKS_SQL = String.raw`
+SELECT to_regprocedure('supabase_functions.http_request()') IS NULL AS install_webhooks \gset
+\if :install_webhooks
+BEGIN;
+
+-- Create pg_net extension
+CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
+
+-- Create supabase_functions schema
+CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;
+
+GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+
+-- supabase_functions.migrations definition
+CREATE TABLE supabase_functions.migrations (
+  version text PRIMARY KEY,
+  inserted_at timestamptz NOT NULL DEFAULT NOW()
+);
+
+-- Initial supabase_functions migration
+INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
+
+-- supabase_functions.hooks definition
+CREATE TABLE supabase_functions.hooks (
+  id bigserial PRIMARY KEY,
+  hook_table_id integer NOT NULL,
+  hook_name text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT NOW(),
+  request_id bigint
+);
+CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
+
+CREATE FUNCTION supabase_functions.http_request()
+  RETURNS trigger
+  LANGUAGE plpgsql
+  AS $function$
+  DECLARE
+    request_id bigint;
+    payload jsonb;
+    url text := TG_ARGV[0]::text;
+    method text := TG_ARGV[1]::text;
+    headers jsonb DEFAULT '{}'::jsonb;
+    params jsonb DEFAULT '{}'::jsonb;
+    timeout_ms integer DEFAULT 1000;
+  BEGIN
+    IF url IS NULL OR url = 'null' THEN
+      RAISE EXCEPTION 'url argument is missing';
+    END IF;
+
+    IF method IS NULL OR method = 'null' THEN
+      RAISE EXCEPTION 'method argument is missing';
+    END IF;
+
+    IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
+      headers = '{"Content-Type": "application/json"}'::jsonb;
+    ELSE
+      headers = TG_ARGV[2]::jsonb;
+    END IF;
+
+    IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
+      params = '{}'::jsonb;
+    ELSE
+      params = TG_ARGV[3]::jsonb;
+    END IF;
+
+    IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
+      timeout_ms = 1000;
+    ELSE
+      timeout_ms = TG_ARGV[4]::integer;
+    END IF;
+
+    CASE
+      WHEN method = 'GET' THEN
+        SELECT http_get INTO request_id FROM net.http_get(
+          url,
+          params,
+          headers,
+          timeout_ms
+        );
+      WHEN method = 'POST' THEN
+        payload = jsonb_build_object(
+          'old_record', OLD,
+          'record', NEW,
+          'type', TG_OP,
+          'table', TG_TABLE_NAME,
+          'schema', TG_TABLE_SCHEMA
+        );
+
+        SELECT http_post INTO request_id FROM net.http_post(
+          url,
+          payload,
+          params,
+          headers,
+          timeout_ms
+        );
+      ELSE
+        RAISE EXCEPTION 'method argument % is invalid', method;
+    END CASE;
+
+    INSERT INTO supabase_functions.hooks
+      (hook_table_id, hook_name, request_id)
+    VALUES
+      (TG_RELID, TG_NAME, request_id);
+
+    RETURN NEW;
+  END
+$function$;
+
+-- Supabase super admin
+DO
+$$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_roles
+    WHERE rolname = 'supabase_functions_admin'
+  )
+  THEN
+    CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
+  END IF;
+END
+$$;
+
+GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
+ALTER USER supabase_functions_admin SET search_path = "supabase_functions";
+ALTER table "supabase_functions".migrations OWNER TO supabase_functions_admin;
+ALTER table "supabase_functions".hooks OWNER TO supabase_functions_admin;
+ALTER function "supabase_functions".http_request() OWNER TO supabase_functions_admin;
+GRANT supabase_functions_admin TO postgres;
+
+-- Remove unused supabase_pg_net_admin role
+DO
+$$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_roles
+    WHERE rolname = 'supabase_pg_net_admin'
+  )
+  THEN
+    REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;
+    DROP OWNED BY supabase_pg_net_admin;
+    DROP ROLE supabase_pg_net_admin;
+  END IF;
+END
+$$;
+
+-- pg_net grants when extension is already enabled
+DO
+$$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_extension
+    WHERE extname = 'pg_net'
+  )
+  THEN
+    GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+
+    REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+    REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+
+    GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+  END IF;
+END
+$$;
+
+-- Event trigger for pg_net
+CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()
+RETURNS event_trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM pg_event_trigger_ddl_commands() AS ev
+    JOIN pg_extension AS ext
+    ON ev.objid = ext.oid
+    WHERE ext.extname = 'pg_net'
+  )
+  THEN
+    GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+
+    ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+    ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+
+    REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+    REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+
+    GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+  END IF;
+END;
+$$;
+COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';
+
+DO
+$$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_event_trigger
+    WHERE evtname = 'issue_pg_net_access'
+  ) THEN
+    CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')
+    EXECUTE PROCEDURE extensions.grant_pg_net_access();
+  END IF;
+END
+$$;
+
+INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');
+
+ALTER function supabase_functions.http_request() SECURITY DEFINER;
+ALTER function supabase_functions.http_request() SET search_path = supabase_functions;
+REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;
+
+COMMIT;
+\endif
+`;