@supatype/cli 0.1.0-alpha.6

package/tests/engine-distribution.test.ts

@@ -0,0 +1,418 @@
+/**
+ * Integration tests for engine binary distribution (Phase 0.5).
+ *
+ * Tests cover:
+ * - Platform detection
+ * - Cache management
+ * - Download, checksum, and signature verification
+ * - Version compatibility
+ * - Offline mode
+ * - Error handling
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest"
+import { mkdirSync, writeFileSync, readFileSync, existsSync, rmSync, chmodSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir, homedir } from "node:os"
+import { createHash } from "node:crypto"
+
+// ── Platform detection ───────────────────────────────────────────────
+
+describe("Platform detection", () => {
+  it("detects supported platforms", async () => {
+    const { detectPlatform } = await import("../src/engine/platform.js")
+    // This test runs on the current platform — just verify it doesn't throw
+    const platform = detectPlatform()
+    expect(platform.os).toMatch(/^(linux|darwin|win)$/)
+    expect(platform.arch).toMatch(/^(x64|arm64)$/)
+    expect(platform.binaryName).toContain("supatype-engine")
+  })
+
+  it("builds correct artifact names", async () => {
+    const { getArtifactName } = await import("../src/engine/platform.js")
+
+    expect(
+      getArtifactName("0.1.0-alpha.1", { os: "linux", arch: "x64", binaryName: "supatype-engine", ext: "" }),
+    ).toBe("supatype-engine-0.1.0-alpha.1-linux-x64")
+
+    expect(
+      getArtifactName("0.1.0-alpha.1", { os: "darwin", arch: "arm64", binaryName: "supatype-engine", ext: "" }),
+    ).toBe("supatype-engine-0.1.0-alpha.1-darwin-arm64")
+
+    expect(
+      getArtifactName("0.1.0-alpha.1", { os: "win", arch: "x64", binaryName: "supatype-engine.exe", ext: ".exe" }),
+    ).toBe("supatype-engine-0.1.0-alpha.1-win-x64.exe")
+  })
+
+  it("rejects unsupported platforms", async () => {
+    const platformModule = await import("../src/engine/platform.js")
+    // We can't easily test this without mocking process.platform/arch
+    // but the logic is covered by the PLATFORM_MAP check
+    expect(typeof platformModule.detectPlatform).toBe("function")
+  })
+})
+
+// ── CDN URL construction ─────────────────────────────────────────────
+
+describe("CDN URL construction", () => {
+  it("builds correct CDN URLs", async () => {
+    const { getCdnUrl } = await import("../src/engine/platform.js")
+
+    const url = getCdnUrl(
+      "https://releases.supatype.io/engine",
+      "0.1.0-alpha.1",
+      "supatype-engine-0.1.0-alpha.1-linux-x64",
+    )
+    expect(url).toBe(
+      "https://releases.supatype.io/engine/v0.1.0-alpha.1/supatype-engine-0.1.0-alpha.1-linux-x64",
+    )
+  })
+})
+
+// ── Cache management ─────────────────────────────────────────────────
+
+describe("Cache management", () => {
+  const testCacheDir = join(tmpdir(), `supatype-test-cache-${Date.now()}`)
+
+  // We test the pure functions, not the ones using homedir()
+  afterEach(() => {
+    if (existsSync(testCacheDir)) {
+      rmSync(testCacheDir, { recursive: true, force: true })
+    }
+  })
+
+  it("lists cached versions from empty cache", async () => {
+    const { listCachedVersions } = await import("../src/engine/cache.js")
+    // May or may not have cached versions on this machine
+    const versions = listCachedVersions()
+    expect(Array.isArray(versions)).toBe(true)
+  })
+
+  it("pruneCacheExcept keeps specified version", async () => {
+    const { pruneCacheExcept, getCacheDir } = await import("../src/engine/cache.js")
+    const cacheDir = getCacheDir()
+
+    // Create test versions
+    const v1Dir = join(cacheDir, "test-0.0.1")
+    const v2Dir = join(cacheDir, "test-0.0.2")
+    mkdirSync(v1Dir, { recursive: true })
+    mkdirSync(v2Dir, { recursive: true })
+    writeFileSync(join(v1Dir, "supatype-engine"), "binary1")
+    writeFileSync(join(v2Dir, "supatype-engine"), "binary2")
+
+    const result = pruneCacheExcept("test-0.0.2")
+    expect(result.removed).toContain("test-0.0.1")
+    expect(result.removed).not.toContain("test-0.0.2")
+
+    // Cleanup
+    if (existsSync(v2Dir)) rmSync(v2Dir, { recursive: true, force: true })
+  })
+})
+
+// ── Checksum verification ────────────────────────────────────────────
+
+describe("Checksum verification", () => {
+  const testDir = join(tmpdir(), `supatype-test-checksum-${Date.now()}`)
+
+  beforeEach(() => {
+    mkdirSync(testDir, { recursive: true })
+  })
+
+  afterEach(() => {
+    if (existsSync(testDir)) {
+      rmSync(testDir, { recursive: true, force: true })
+    }
+  })
+
+  it("verifies correct checksum", async () => {
+    const { verifyChecksum } = await import("../src/engine/verify.js")
+
+    const binaryContent = Buffer.from("test binary content")
+    const binaryPath = join(testDir, "supatype-engine")
+    writeFileSync(binaryPath, binaryContent)
+
+    const hash = createHash("sha256").update(binaryContent).digest("hex")
+    const checksumPath = join(testDir, "checksums.sha256")
+    writeFileSync(checksumPath, `${hash}  supatype-engine-0.1.0-linux-x64\n`)
+
+    const result = await verifyChecksum(
+      binaryPath,
+      checksumPath,
+      "supatype-engine-0.1.0-linux-x64",
+    )
+    expect(result).toBe(true)
+  })
+
+  it("rejects mismatched checksum", async () => {
+    const { verifyChecksum } = await import("../src/engine/verify.js")
+
+    const binaryPath = join(testDir, "supatype-engine")
+    writeFileSync(binaryPath, "actual content")
+
+    const checksumPath = join(testDir, "checksums.sha256")
+    writeFileSync(checksumPath, `${"a".repeat(64)}  supatype-engine-0.1.0-linux-x64\n`)
+
+    const result = await verifyChecksum(
+      binaryPath,
+      checksumPath,
+      "supatype-engine-0.1.0-linux-x64",
+    )
+    expect(result).toBe(false)
+  })
+
+  it("rejects corrupt cached binary (flipped byte)", async () => {
+    const { verifyChecksum } = await import("../src/engine/verify.js")
+
+    const originalContent = Buffer.from("original binary content here")
+    const hash = createHash("sha256").update(originalContent).digest("hex")
+
+    // Corrupt the binary (flip a byte)
+    const corruptContent = Buffer.from(originalContent)
+    corruptContent[0] = corruptContent[0]! ^ 0xff
+
+    const binaryPath = join(testDir, "supatype-engine")
+    writeFileSync(binaryPath, corruptContent)
+
+    const checksumPath = join(testDir, "checksums.sha256")
+    writeFileSync(checksumPath, `${hash}  supatype-engine-0.1.0-linux-x64\n`)
+
+    const result = await verifyChecksum(
+      binaryPath,
+      checksumPath,
+      "supatype-engine-0.1.0-linux-x64",
+    )
+    expect(result).toBe(false)
+  })
+
+  it("throws when filename not found in checksum file", async () => {
+    const { verifyChecksum } = await import("../src/engine/verify.js")
+
+    const binaryPath = join(testDir, "supatype-engine")
+    writeFileSync(binaryPath, "content")
+
+    const checksumPath = join(testDir, "checksums.sha256")
+    writeFileSync(checksumPath, `${"a".repeat(64)}  other-file\n`)
+
+    await expect(
+      verifyChecksum(binaryPath, checksumPath, "supatype-engine-0.1.0-linux-x64"),
+    ).rejects.toThrow("No checksum found")
+  })
+})
+
+// ── Signature verification ───────────────────────────────────────────
+
+describe("Signature verification", () => {
+  const testDir = join(tmpdir(), `supatype-test-sig-${Date.now()}`)
+
+  beforeEach(() => {
+    mkdirSync(testDir, { recursive: true })
+  })
+
+  afterEach(() => {
+    if (existsSync(testDir)) {
+      rmSync(testDir, { recursive: true, force: true })
+    }
+  })
+
+  it("rejects tampered checksum file (invalid signature)", async () => {
+    const { verifySignature } = await import("../src/engine/verify.js")
+
+    const checksumPath = join(testDir, "checksums.sha256")
+    writeFileSync(checksumPath, `${"a".repeat(64)}  supatype-engine-0.1.0-linux-x64\n`)
+
+    // Create a fake .minisig with garbage signature
+    const sigPath = join(testDir, "checksums.sha256.minisig")
+    writeFileSync(
+      sigPath,
+      `untrusted comment: fake\n${Buffer.alloc(74).toString("base64")}\n`,
+    )
+
+    const result = await verifySignature(checksumPath, sigPath)
+    expect(result).toBe(false)
+  })
+
+  it("rejects missing .minisig file", async () => {
+    const { verifySignature } = await import("../src/engine/verify.js")
+
+    const checksumPath = join(testDir, "checksums.sha256")
+    writeFileSync(checksumPath, "some content")
+
+    const result = await verifySignature(checksumPath, join(testDir, "nonexistent.minisig"))
+    expect(result).toBe(false)
+  })
+
+  it("rejects forged signature with wrong key", async () => {
+    const { verifySignature } = await import("../src/engine/verify.js")
+
+    const checksumPath = join(testDir, "checksums.sha256")
+    writeFileSync(checksumPath, `${"a".repeat(64)}  supatype-engine\n`)
+
+    // Forged signature (valid format but wrong key)
+    const sigPath = join(testDir, "checksums.sha256.minisig")
+    const fakeSignature = Buffer.alloc(74)
+    fakeSignature.writeUInt16LE(0x4564, 0) // Ed algorithm bytes
+    writeFileSync(
+      sigPath,
+      `untrusted comment: forged\n${fakeSignature.toString("base64")}\n`,
+    )
+
+    const result = await verifySignature(checksumPath, sigPath)
+    expect(result).toBe(false)
+  })
+})
+
+// ── Version compatibility ────────────────────────────────────────────
+
+describe("Version compatibility", () => {
+  it("accepts same major version", async () => {
+    const { checkVersionCompatibility } = await import("../src/engine/resolve.js")
+
+    expect(checkVersionCompatibility("1.2.3", "1.0.0").compatible).toBe(true)
+    expect(checkVersionCompatibility("0.1.0", "0.2.0").compatible).toBe(true)
+  })
+
+  it("rejects different major versions", async () => {
+    const { checkVersionCompatibility } = await import("../src/engine/resolve.js")
+
+    const result = checkVersionCompatibility("2.1.0", "1.3.0")
+    expect(result.compatible).toBe(false)
+    expect(result.message).toContain("not compatible")
+    expect(result.message).toContain("npm update @supatype/cli")
+  })
+})
+
+// ── Update check throttling ─────────────────────────────────────────
+
+describe("Update check throttling", () => {
+  it("returns true when no check file exists", async () => {
+    const { shouldCheckForUpdates } = await import("../src/engine/cache.js")
+    // On fresh machine, should want to check
+    const result = await shouldCheckForUpdates()
+    expect(typeof result).toBe("boolean")
+  })
+
+  it("skips check in CI environments", async () => {
+    const origCI = process.env.CI
+    process.env.CI = "true"
+
+    const { shouldCheckForUpdates } = await import("../src/engine/cache.js")
+    const result = await shouldCheckForUpdates()
+    expect(result).toBe(false)
+
+    if (origCI !== undefined) {
+      process.env.CI = origCI
+    } else {
+      delete process.env.CI
+    }
+  })
+})
+
+// ── Download retry ──────────────────────────────────────────────────
+
+describe("Download retry", () => {
+  it("fetchJson returns undefined on network error", async () => {
+    const { fetchJson } = await import("../src/engine/download.js")
+    const result = await fetchJson("http://localhost:1/nonexistent")
+    expect(result).toBeUndefined()
+  })
+})
+
+// ── Engine version constants ─────────────────────────────────────────
+
+describe("Engine version constants", () => {
+  it("exports valid version and URLs", async () => {
+    const {
+      ENGINE_VERSION,
+      CDN_BASE_URL,
+      ENGINE_RELEASES_REPO,
+      GITHUB_RELEASES_FALLBACK_URL,
+    } = await import("../src/engine-version.js")
+
+    expect(ENGINE_VERSION).toMatch(/^\d+\.\d+\.\d+/)
+    expect(CDN_BASE_URL).toBe("https://releases.supatype.io/engine")
+    expect(ENGINE_RELEASES_REPO).toBe("supatype/engine-releases")
+    expect(GITHUB_RELEASES_FALLBACK_URL).toContain("github.com")
+  })
+})
+
+// ── Full binary verification pipeline ────────────────────────────────
+
+describe("Binary verification pipeline", () => {
+  const testDir = join(tmpdir(), `supatype-test-pipeline-${Date.now()}`)
+
+  beforeEach(() => {
+    mkdirSync(testDir, { recursive: true })
+  })
+
+  afterEach(() => {
+    if (existsSync(testDir)) {
+      rmSync(testDir, { recursive: true, force: true })
+    }
+  })
+
+  it("verifyChecksumOnly passes with valid checksum", async () => {
+    const { verifyChecksumOnly } = await import("../src/engine/verify.js")
+
+    const content = Buffer.from("valid engine binary")
+    const hash = createHash("sha256").update(content).digest("hex")
+
+    const binaryPath = join(testDir, "engine")
+    writeFileSync(binaryPath, content)
+
+    const checksumPath = join(testDir, "checksums.sha256")
+    writeFileSync(checksumPath, `${hash}  engine-0.1.0-linux-x64\n`)
+
+    // Should not throw
+    await verifyChecksumOnly(binaryPath, checksumPath, "engine-0.1.0-linux-x64")
+  })
+
+  it("verifyChecksumOnly rejects and deletes corrupt binary", async () => {
+    const { verifyChecksumOnly } = await import("../src/engine/verify.js")
+
+    const binaryPath = join(testDir, "engine")
+    writeFileSync(binaryPath, "corrupt content")
+
+    const checksumPath = join(testDir, "checksums.sha256")
+    writeFileSync(checksumPath, `${"f".repeat(64)}  engine-0.1.0-linux-x64\n`)
+
+    await expect(
+      verifyChecksumOnly(binaryPath, checksumPath, "engine-0.1.0-linux-x64"),
+    ).rejects.toThrow("checksum mismatch")
+
+    // Binary should be deleted
+    expect(existsSync(binaryPath)).toBe(false)
+  })
+
+  it("verifyBinary rejects when signature is invalid", async () => {
+    const { verifyBinary } = await import("../src/engine/verify.js")
+
+    const content = Buffer.from("binary content")
+    const hash = createHash("sha256").update(content).digest("hex")
+
+    const binaryPath = join(testDir, "engine")
+    writeFileSync(binaryPath, content)
+
+    const checksumPath = join(testDir, "checksums.sha256")
+    writeFileSync(checksumPath, `${hash}  engine-artifact\n`)
+
+    const sigPath = join(testDir, "checksums.sha256.minisig")
+    writeFileSync(sigPath, `untrusted comment: bad\n${Buffer.alloc(74).toString("base64")}\n`)
+
+    await expect(
+      verifyBinary(binaryPath, checksumPath, sigPath, "engine-artifact"),
+    ).rejects.toThrow("signature verification failed")
+
+    // Binary should be deleted
+    expect(existsSync(binaryPath)).toBe(false)
+  })
+})
+
+// ── Binary size check (placeholder for CI) ───────────────────────────
+
+describe("Binary size", () => {
+  it("has a 20MB size target documented", () => {
+    // This is a CI-level check. Here we just verify the constant is defined.
+    const MAX_BINARY_SIZE_MB = 20
+    expect(MAX_BINARY_SIZE_MB).toBe(20)
+  })
+})

package/tests/init.test.ts

@@ -0,0 +1,184 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest"
+import { mkdirSync, rmSync, existsSync, readFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { scaffold } from "../src/commands/init.js"
+
+let tmpRoot: string
+
+beforeEach(() => {
+  tmpRoot = join(tmpdir(), `dt-init-test-${Date.now()}`)
+  mkdirSync(tmpRoot, { recursive: true })
+})
+
+afterEach(() => {
+  rmSync(tmpRoot, { recursive: true, force: true })
+})
+
+describe("scaffold()", () => {
+  it("creates all expected files", () => {
+    scaffold(tmpRoot, "my-app")
+
+    const expected = [
+      "supatype.config.ts",
+      "schema/index.ts",
+      ".env",
+      "docker-compose.yml",
+      ".supatype/kong.yml",
+      ".supatype/pgbouncer.ini",
+      ".supatype/userlist.txt",
+      "seed.ts",
+      ".gitignore",
+    ]
+    for (const rel of expected) {
+      expect(existsSync(join(tmpRoot, rel)), `${rel} should exist`).toBe(true)
+    }
+  })
+
+  it("supatype.config.ts embeds the project name and exports defineConfig", () => {
+    scaffold(tmpRoot, "blog-app")
+    const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(content).toContain("blog-app")
+    expect(content).toContain("defineConfig")
+    expect(content).toContain("schema:")
+    expect(content).toContain("output:")
+  })
+
+  it("supatype.config.ts contains commented selfHost section", () => {
+    scaffold(tmpRoot, "my-app")
+    const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(content).toContain("selfHost")
+    expect(content).toContain("domain")
+  })
+
+  it("docker-compose.yml references project name, correct images, and health check", () => {
+    scaffold(tmpRoot, "shop")
+    const content = readFileSync(join(tmpRoot, "docker-compose.yml"), "utf8")
+    expect(content).toContain("shop")
+    expect(content).toContain("supatype/postgres")
+    expect(content).toContain("postgrest/postgrest")
+    expect(content).toContain("kong:")
+    expect(content).toContain("service_healthy")
+  })
+
+  it("docker-compose.yml includes GoTrue auth service", () => {
+    scaffold(tmpRoot, "shop")
+    const content = readFileSync(join(tmpRoot, "docker-compose.yml"), "utf8")
+    expect(content).toContain("gotrue:")
+    expect(content).toContain("supatype/auth")
+    expect(content).toContain("GOTRUE_JWT_SECRET")
+    expect(content).toContain("9999")
+  })
+
+  it("docker-compose.yml includes PgBouncer service connecting services via port 6432", () => {
+    scaffold(tmpRoot, "shop")
+    const content = readFileSync(join(tmpRoot, "docker-compose.yml"), "utf8")
+    expect(content).toContain("pgbouncer:")
+    expect(content).toContain("pgbouncer/pgbouncer")
+    expect(content).toContain("pgbouncer:6432")
+    expect(content).toContain("PGRST_DB_POOL")
+  })
+
+  it("docker-compose.yml includes studio service (merged admin + studio)", () => {
+    scaffold(tmpRoot, "shop")
+    const content = readFileSync(join(tmpRoot, "docker-compose.yml"), "utf8")
+    expect(content).toContain("studio:")
+    expect(content).toContain("ghcr.io/supatype/studio")
+    expect(content).toContain("3002:3002")
+    // Admin was merged into studio — no separate admin service
+    expect(content).not.toContain("ghcr.io/supatype/admin")
+  })
+
+  it("docker-compose.yml includes commented app service slot", () => {
+    scaffold(tmpRoot, "shop")
+    const content = readFileSync(join(tmpRoot, "docker-compose.yml"), "utf8")
+    expect(content).toContain("supatype app add")
+    expect(content).toContain("SUPATYPE_URL")
+    expect(content).toContain("SUPATYPE_ANON_KEY")
+  })
+
+  it(".supatype/pgbouncer.ini has correct pool settings", () => {
+    scaffold(tmpRoot, "my-app")
+    const content = readFileSync(join(tmpRoot, ".supatype/pgbouncer.ini"), "utf8")
+    expect(content).toContain("pool_mode = transaction")
+    expect(content).toContain("default_pool_size = 20")
+    expect(content).toContain("max_db_connections = 60")
+    expect(content).toContain("listen_port = 6432")
+  })
+
+  it(".env contains DATABASE_URL, JWT_SECRET, POSTGRES_PASSWORD, POSTGRES_DB", () => {
+    scaffold(tmpRoot, "my-app")
+    const content = readFileSync(join(tmpRoot, ".env"), "utf8")
+    expect(content).toContain("DATABASE_URL=")
+    expect(content).toContain("JWT_SECRET=")
+    expect(content).toContain("POSTGRES_PASSWORD=")
+    expect(content).toContain("POSTGRES_DB=")
+  })
+
+  it(".env contains ANON_KEY, SERVICE_ROLE_KEY, and SITE_URL placeholders", () => {
+    scaffold(tmpRoot, "my-app")
+    const content = readFileSync(join(tmpRoot, ".env"), "utf8")
+    expect(content).toContain("ANON_KEY=")
+    expect(content).toContain("SERVICE_ROLE_KEY=")
+    expect(content).toContain("SITE_URL=")
+  })
+
+  it("schema/index.ts exports a User model with field builders and access rules", () => {
+    scaffold(tmpRoot, "my-app")
+    const content = readFileSync(join(tmpRoot, "schema/index.ts"), "utf8")
+    expect(content).toContain("export const User")
+    expect(content).toContain("model(")
+    expect(content).toContain("field.")
+    expect(content).toContain("access.")
+    expect(content).toContain("options: { timestamps: true }")
+  })
+
+  it(".supatype/kong.yml declares REST, GraphQL, and auth routes", () => {
+    scaffold(tmpRoot, "my-app")
+    const content = readFileSync(join(tmpRoot, ".supatype/kong.yml"), "utf8")
+    expect(content).toContain("/rest/v1/")
+    expect(content).toContain("/graphql/v1")
+    expect(content).toContain("/auth/v1/")
+    expect(content).toContain("postgrest")
+    expect(content).toContain("gotrue")
+  })
+
+  it(".supatype/kong.yml contains commented app fallback route", () => {
+    scaffold(tmpRoot, "my-app")
+    const content = readFileSync(join(tmpRoot, ".supatype/kong.yml"), "utf8")
+    expect(content).toContain("supatype app add")
+    expect(content).toContain("app-root")
+  })
+
+  it(".gitignore excludes .env, node_modules, and engine binary", () => {
+    scaffold(tmpRoot, "my-app")
+    const content = readFileSync(join(tmpRoot, ".gitignore"), "utf8")
+    expect(content).toContain(".env")
+    expect(content).toContain("node_modules/")
+    expect(content).toContain(".supatype/engine/")
+  })
+
+  it("seed.ts references the project name", () => {
+    scaffold(tmpRoot, "acme")
+    const content = readFileSync(join(tmpRoot, "seed.ts"), "utf8")
+    expect(content).toContain("acme")
+  })
+
+  it("different project names produce different connection strings", () => {
+    scaffold(tmpRoot, "alpha")
+    const alpha = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+
+    const tmp2 = join(tmpdir(), `dt-init-test2-${Date.now()}`)
+    mkdirSync(tmp2, { recursive: true })
+    try {
+      scaffold(tmp2, "beta")
+      const beta = readFileSync(join(tmp2, "supatype.config.ts"), "utf8")
+      expect(alpha).toContain("alpha")
+      expect(beta).toContain("beta")
+      expect(alpha).not.toContain("beta")
+      expect(beta).not.toContain("alpha")
+    } finally {
+      rmSync(tmp2, { recursive: true, force: true })
+    }
+  })
+})