@supatype/cli 0.1.0-alpha.9 → 0.1.1

package/src/commands/admin.ts

@@ -1,17 +1,42 @@
 // ─── Admin panel CLI commands (Gap Appendices task 48) ──────────────────────
 //
 // `npx supatype admin create-user` — create an admin user in the project's
-// {ref}_auth.users table. Used for initial setup and ongoing admin management.
+// auth.users table. First admin is ensured on `supatype dev` or `supatype push`.
 
 import type { Command } from "commander"
-import { createInterface } from "node:readline"
-import { randomBytes, scrypt } from "node:crypto"
-import { promisify } from "node:util"
+import { spawnSync } from "node:child_process"
+import { existsSync } from "node:fs"
+import { dirname, join, resolve } from "node:path"
+import bcrypt from "bcryptjs"
+import type { Pool, QueryResult } from "pg"
 import { loadConfig } from "../config.js"
-import { connectionString } from "../project-config.js"
-import { signJwt } from "../jwt.js"
+import {
+  connectionString,
+  resolveRuntimeProvider,
+  type SupatypeProjectConfig,
+} from "../project-config.js"
+import { readEnvValue, upsertEnvFile } from "../env-file.js"
+import { hasEngineOverride } from "../binary-cache.js"
+import { confirm as uiConfirm } from "../ui/confirm.js"
+import { error, info, plain } from "../ui/messages.js"
+import { promptText } from "../ui/prompts.js"
+import { isInteractive } from "../ui/interactive.js"
+
+export const ADMIN_EMAIL_ENV = "SUPATYPE_ADMIN_EMAIL"
+export const ADMIN_PASSWORD_ENV = "SUPATYPE_ADMIN_PASSWORD"
+
+const BCRYPT_ROUNDS = 10
+
+export interface EnsureFirstAdminOptions {
+  email?: string
+  password?: string
+  cwd?: string
+  role?: string
+  connection?: string
+  compose?: { project: string; composePath: string }
+}
 
-const scryptAsync = promisify(scrypt)
+type DbQuery = (sql: string, params?: unknown[]) => Promise<QueryResult>
 
 export function registerAdmin(program: Command): void {
   const adminCmd = program
@@ -36,100 +61,34 @@ export function registerAdmin(program: Command): void {
         const config = loadConfig(cwd)
         const connection = opts.connection ?? connectionString(config)
 
-        const email = opts.email ?? (await prompt("Admin email: "))
+        const email = opts.email ?? (await promptText("Admin email"))
         if (!email || !email.includes("@")) {
-          console.error("A valid email address is required.")
+          error("A valid email address is required.")
           process.exit(1)
         }
 
         const password =
-          opts.password ?? (await prompt("Admin password (min 8 chars): "))
+          opts.password ?? (await promptText("Admin password (min 8 chars)"))
         if (!password || password.length < 8) {
-          console.error("Password must be at least 8 characters.")
+          error("Password must be at least 8 characters.")
           process.exit(1)
         }
 
         const role = opts.role
 
-        console.log(`\nCreating admin user: ${email} (role: ${role})...`)
+        info(`Creating admin user: ${email} (role: ${role})...`)
 
-        // We use pg directly to insert into the auth.users table
         const pg = await importPg()
         const pool = new pg.Pool({ connectionString: connection, max: 2 })
 
         try {
-          // Ensure the auth schema and users table exist
-          await pool.query(`
-            CREATE SCHEMA IF NOT EXISTS auth;
-
-            CREATE TABLE IF NOT EXISTS auth.users (
-              id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-              instance_id   UUID,
-              aud           TEXT DEFAULT 'authenticated',
-              role          TEXT DEFAULT 'authenticated',
-              email         TEXT UNIQUE,
-              encrypted_password TEXT,
-              email_confirmed_at TIMESTAMPTZ DEFAULT now(),
-              raw_app_meta_data  JSONB DEFAULT '{}',
-              raw_user_meta_data JSONB DEFAULT '{}',
-              created_at    TIMESTAMPTZ DEFAULT now(),
-              updated_at    TIMESTAMPTZ DEFAULT now(),
-              confirmation_token TEXT DEFAULT '',
-              recovery_token TEXT DEFAULT '',
-              email_change_token_new TEXT DEFAULT '',
-              email_change  TEXT DEFAULT ''
-            );
-          `)
-
-          // Check if user already exists
-          const existing = await pool.query(
-            `SELECT id FROM auth.users WHERE email = $1`,
-            [email.toLowerCase()],
-          )
-
-          if (existing.rows.length > 0) {
-            console.error(
-              `\nUser with email "${email}" already exists.`,
-            )
-            console.log(
-              `To update their role, use: supatype admin set-role --email ${email} --role ${role}`,
-            )
-            process.exit(1)
-          }
-
-          // Hash the password (bcrypt-style for GoTrue compatibility)
-          const passwordHash = await hashPassword(password)
-
-          // Insert the admin user with the admin role in app_metadata
-          const appMetadata = JSON.stringify({ role, provider: "email", providers: ["email"] })
-          const userMetadata = JSON.stringify({})
-
-          const result = await pool.query(
-            `INSERT INTO auth.users (
-              email, encrypted_password, role, aud,
-              raw_app_meta_data, raw_user_meta_data,
-              email_confirmed_at, created_at, updated_at
-            ) VALUES (
-              $1, $2, 'authenticated', 'authenticated',
-              $3::jsonb, $4::jsonb,
-              now(), now(), now()
-            ) RETURNING id, email`,
-            [email.toLowerCase(), passwordHash, appMetadata, userMetadata],
-          )
-
-          const user = result.rows[0] as { id: string; email: string }
-
-          console.log(`\nAdmin user created successfully.`)
-          console.log(`  ID:    ${user.id}`)
-          console.log(`  Email: ${user.email}`)
-          console.log(`  Role:  ${role}`)
-          console.log(
-            `\nThis user can now log in to the admin panel at /admin\n`,
-          )
+          await ensureAuthUsersTable(pool)
+          await createAdminUser(pool, email, password, role)
+          info("This user can now log in to the admin panel at /admin")
         } catch (err) {
           const message =
             err instanceof Error ? err.message : "Unknown error"
-          console.error(`\nFailed to create admin user: ${message}`)
+          error(`Failed to create admin user: ${message}`)
           process.exit(1)
         } finally {
           await pool.end()
@@ -163,7 +122,7 @@ export function registerAdmin(program: Command): void {
           )
 
           if (result.rows.length === 0) {
-            console.error(`\nNo user found with email "${opts.email}".`)
+            error(`No user found with email "${opts.email}".`)
             process.exit(1)
           }
 
@@ -173,14 +132,14 @@ export function registerAdmin(program: Command): void {
             raw_app_meta_data: Record<string, unknown>
           }
 
-          console.log(`\nRole updated successfully.`)
-          console.log(`  ID:    ${user.id}`)
-          console.log(`  Email: ${user.email}`)
-          console.log(`  Role:  ${opts.role}\n`)
+          info("Role updated successfully.")
+          plain(`  ID:    ${user.id}`)
+          plain(`  Email: ${user.email}`)
+          plain(`  Role:  ${opts.role}`)
         } catch (err) {
           const message =
             err instanceof Error ? err.message : "Unknown error"
-          console.error(`\nFailed to update role: ${message}`)
+          error(`Failed to update role: ${message}`)
           process.exit(1)
         } finally {
           await pool.end()
@@ -210,17 +169,15 @@ export function registerAdmin(program: Command): void {
         )
 
         if (result.rows.length === 0) {
-          console.log("\nNo admin users found.")
-          console.log(
-            "Create one with: supatype admin create-user --email admin@example.com --role admin\n",
-          )
+          info("No admin users found.")
+          info("Create one with: supatype admin create-user --email admin@example.com --role admin")
           return
         }
 
-        console.log(
+        plain(
           "\n  ID                                     Email                          Role         Created",
         )
-        console.log("  " + "-".repeat(100))
+        plain("  " + "-".repeat(100))
         for (const row of result.rows) {
           const r = row as {
             id: string
@@ -229,15 +186,15 @@ export function registerAdmin(program: Command): void {
             created_at: string
           }
           const date = new Date(r.created_at).toISOString().slice(0, 10)
-          console.log(
+          plain(
             `  ${r.id}  ${r.email.padEnd(30)} ${r.role.padEnd(12)} ${date}`,
           )
         }
-        console.log()
+        plain()
       } catch (err) {
         const message =
           err instanceof Error ? err.message : "Unknown error"
-        console.error(`\nFailed to list admin users: ${message}`)
+        error(`Failed to list admin users: ${message}`)
         process.exit(1)
       } finally {
         await pool.end()
@@ -245,128 +202,362 @@ export function registerAdmin(program: Command): void {
     })
 }
 
-// ─── First admin user prompt (task 48) ──────────────────────────────────────
-// Called by `supatype push` on initial setup if no admin users exist.
+/** @deprecated Use ensureFirstAdminUser */
+export const promptFirstAdminUser = ensureFirstAdminUser
 
-export async function promptFirstAdminUser(
+/**
+ * Ensure a first admin user exists (idempotent). Called from `dev` and `push`
+ * when auth.users is ready and no admin users exist yet.
+ */
+export async function ensureFirstAdminUser(
   connection: string,
+  options: EnsureFirstAdminOptions = {},
 ): Promise<void> {
   const pg = await importPg()
   const pool = new pg.Pool({ connectionString: connection, max: 2 })
-
   try {
-    // Check if auth.users table exists
-    const tableExists = await pool.query(
-      `SELECT EXISTS (
-        SELECT FROM information_schema.tables
-        WHERE table_schema = 'auth' AND table_name = 'users'
-      ) as exists`,
+    await ensureFirstAdminWithQuery(
+      (sql, params) => pool.query(sql, params),
+      options,
     )
-    if (!tableExists.rows[0]?.exists) return
+  } catch {
+    // Non-fatal — skip when DB is unreachable or auth schema is not ready
+  } finally {
+    await pool.end()
+  }
+}
 
-    // Check if any admin users exist
-    const adminCount = await pool.query(
-      `SELECT COUNT(*) as count FROM auth.users
-       WHERE raw_app_meta_data->>'role' IS NOT NULL
-         AND raw_app_meta_data->>'role' != 'authenticated'`,
-    )
+/**
+ * Resolve DB access for the current project (host URL or compose exec when DB
+ * is not published to the host).
+ */
+export async function ensureFirstAdminUserForProject(
+  cwd: string,
+  config: SupatypeProjectConfig,
+  options: EnsureFirstAdminOptions = {},
+): Promise<void> {
+  const root = resolve(cwd)
+  const merged: EnsureFirstAdminOptions = { cwd: root, ...options }
+
+  if (
+    resolveRuntimeProvider(config) === "docker" &&
+    merged.compose &&
+    !hasEngineOverride(config)
+  ) {
+    try {
+      await ensureFirstAdminWithQuery(
+        (sql, params) => composeExecQuery(root, merged.compose!, sql, params),
+        merged,
+      )
+    } catch {
+      // Non-fatal
+    }
+    return
+  }
 
-    const count = parseInt(
-      (adminCount.rows[0] as { count: string }).count,
-      10,
-    )
-    if (count > 0) return
+  const connection =
+    merged.compose && hasEngineOverride(config)
+      ? hostComposeDbUrlFromEnv(root)
+      : options.connection ?? readEnvValue(root, "DATABASE_URL", connectionString(config))
 
-    // No admin users — prompt to create one
-    console.log("\n  No admin users found for the admin panel.")
-    const createAdmin = await confirm(
-      "  Create an admin user now? [y/N] ",
-    )
-    if (!createAdmin) {
-      console.log(
-        "  Skipped. You can create one later with: supatype admin create-user\n",
+  await ensureFirstAdminUser(connection, merged)
+}
+
+async function ensureFirstAdminWithQuery(
+  query: DbQuery,
+  options: EnsureFirstAdminOptions,
+): Promise<void> {
+  const cwd = options.cwd ? resolve(options.cwd) : process.cwd()
+
+  if (!(await authUsersTableExists(query))) return
+  if (await hasAdminUsers(query)) return
+
+  const credentials = await resolveAdminCredentials(options, cwd)
+  if (!credentials) {
+    if (!isInteractive()) {
+      info(
+        "No admin users found. Set SUPATYPE_ADMIN_EMAIL / SUPATYPE_ADMIN_PASSWORD in .env, " +
+          "or run: supatype admin create-user",
       )
-      return
     }
+    return
+  }
 
-    const email = await prompt("  Admin email: ")
-    if (!email || !email.includes("@")) {
-      console.log("  Invalid email. Skipping admin user creation.\n")
-      return
-    }
+  const role = options.role ?? "admin"
+  await createAdminUser(query, credentials.email, credentials.password, role, { quiet: true })
+  clearAdminSeedPassword(cwd)
+  info(`Admin user "${credentials.email}" created (role: ${role}).`)
+  info("Log in at /admin after starting the dev server.")
+}
 
-    const password = await prompt(
-      "  Admin password (min 8 chars): ",
-    )
-    if (!password || password.length < 8) {
-      console.log(
-        "  Password too short. Skipping admin user creation.\n",
-      )
-      return
+async function resolveAdminCredentials(
+  options: EnsureFirstAdminOptions,
+  cwd: string,
+): Promise<{ email: string; password: string } | null> {
+  const envEmail = options.email ?? readEnvValue(cwd, ADMIN_EMAIL_ENV, "").trim()
+  const envPassword =
+    options.password ?? readEnvValue(cwd, ADMIN_PASSWORD_ENV, "").trim()
+
+  if (envEmail && envPassword) {
+    if (!envEmail.includes("@")) {
+      info("Invalid admin email in .env. Skipping admin user creation.")
+      return null
+    }
+    if (envPassword.length < 8) {
+      info("Admin password in .env is too short (min 8 chars). Skipping.")
+      return null
     }
+    return { email: envEmail, password: envPassword }
+  }
 
-    const passwordHash = await hashPassword(password)
-    const appMetadata = JSON.stringify({
-      role: "admin",
-      provider: "email",
-      providers: ["email"],
-    })
+  if (!isInteractive()) return null
 
-    await pool.query(
-      `INSERT INTO auth.users (
-        email, encrypted_password, role, aud,
-        raw_app_meta_data, raw_user_meta_data,
-        email_confirmed_at, created_at, updated_at
-      ) VALUES (
-        $1, $2, 'authenticated', 'authenticated',
-        $3::jsonb, '{}'::jsonb,
-        now(), now(), now()
-      )`,
-      [email.toLowerCase(), passwordHash, appMetadata],
-    )
+  info("No admin users found for the admin panel.")
+  const createAdmin = await uiConfirm("Create an admin user now?")
+  if (!createAdmin) {
+    info("Skipped. You can create one later with: supatype admin create-user")
+    return null
+  }
 
-    console.log(`\n  Admin user "${email}" created (role: admin).`)
-    console.log(`  Log in at /admin after starting the dev server.\n`)
-  } catch {
-    // Non-fatal — if auth schema doesn't exist yet, skip silently
-  } finally {
-    await pool.end()
+  const email = await promptText("Admin email")
+  if (!email || !email.includes("@")) {
+    info("Invalid email. Skipping admin user creation.")
+    return null
+  }
+
+  const password = await promptText("Admin password (min 8 chars)")
+  if (!password || password.length < 8) {
+    info("Password too short. Skipping admin user creation.")
+    return null
   }
+
+  return { email, password }
 }
 
-// ─── Helpers ────────────────────────────────────────────────────────────────────
+export function clearAdminSeedPassword(cwd: string): void {
+  upsertEnvFile(cwd, {}, [ADMIN_PASSWORD_ENV])
+}
 
-async function importPg(): Promise<typeof import("pg")> {
-  try {
-    return await import("pg")
-  } catch {
-    console.error(
-      "pg package is required for admin commands. Install it with: pnpm add pg",
-    )
-    process.exit(1)
+export async function hashPasswordForAuth(password: string): Promise<string> {
+  return bcrypt.hash(password, BCRYPT_ROUNDS)
+}
+
+async function createAdminUser(
+  db: Pool | DbQuery,
+  email: string,
+  password: string,
+  role: string,
+  opts: { quiet?: boolean } = {},
+): Promise<{ id: string; email: string }> {
+  const query: DbQuery =
+    typeof (db as Pool).query === "function"
+      ? (sql, params) => (db as Pool).query(sql, params)
+      : (db as DbQuery)
+
+  const normalized = email.toLowerCase()
+  const existing = await query(`SELECT id FROM auth.users WHERE email = $1`, [
+    normalized,
+  ])
+  if (existing.rows.length > 0) {
+    throw new Error(`User with email "${email}" already exists.`)
+  }
+
+  const passwordHash = await hashPasswordForAuth(password)
+  const appMetadata = JSON.stringify({
+    role,
+    provider: "email",
+    providers: ["email"],
+  })
+  const userMetadata = JSON.stringify({})
+
+  const result = await query(
+    `INSERT INTO auth.users (
+      email, encrypted_password, role, aud,
+      raw_app_meta_data, raw_user_meta_data,
+      email_confirmed_at, created_at, updated_at
+    ) VALUES (
+      $1, $2, 'authenticated', 'authenticated',
+      $3::jsonb, $4::jsonb,
+      now(), now(), now()
+    ) RETURNING id, email`,
+    [normalized, passwordHash, appMetadata, userMetadata],
+  )
+
+  const user = result.rows[0] as { id: string; email: string }
+  if (!opts.quiet) {
+    info("Admin user created successfully.")
+    plain(`  ID:    ${user.id}`)
+    plain(`  Email: ${user.email}`)
+    plain(`  Role:  ${role}`)
   }
+  return user
 }
 
-async function hashPassword(password: string): Promise<string> {
-  const salt = randomBytes(16).toString("hex")
-  const derived = (await scryptAsync(password, salt, 64)) as Buffer
-  return `${salt}:${derived.toString("hex")}`
+async function ensureAuthUsersTable(pool: Pool): Promise<void> {
+  await pool.query(`
+    CREATE SCHEMA IF NOT EXISTS auth;
+
+    CREATE TABLE IF NOT EXISTS auth.users (
+      id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      instance_id   UUID,
+      aud           TEXT DEFAULT 'authenticated',
+      role          TEXT DEFAULT 'authenticated',
+      email         TEXT UNIQUE,
+      encrypted_password TEXT,
+      email_confirmed_at TIMESTAMPTZ DEFAULT now(),
+      raw_app_meta_data  JSONB DEFAULT '{}',
+      raw_user_meta_data JSONB DEFAULT '{}',
+      created_at    TIMESTAMPTZ DEFAULT now(),
+      updated_at    TIMESTAMPTZ DEFAULT now(),
+      confirmation_token TEXT DEFAULT '',
+      recovery_token TEXT DEFAULT '',
+      email_change_token_new TEXT DEFAULT '',
+      email_change  TEXT DEFAULT ''
+    );
+  `)
 }
 
-function prompt(question: string): Promise<string> {
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  })
-  return new Promise((resolve) => {
-    rl.question(question, (answer) => {
-      rl.close()
-      resolve(answer.trim())
+async function authUsersTableExists(query: DbQuery): Promise<boolean> {
+  const result = await query(
+    `SELECT EXISTS (
+      SELECT FROM information_schema.tables
+      WHERE table_schema = 'auth' AND table_name = 'users'
+    ) as exists`,
+  )
+  return Boolean(result.rows[0]?.exists)
+}
+
+async function hasAdminUsers(query: DbQuery): Promise<boolean> {
+  const adminCount = await query(
+    `SELECT COUNT(*)::int as count FROM auth.users
+     WHERE raw_app_meta_data->>'role' IS NOT NULL
+       AND raw_app_meta_data->>'role' != 'authenticated'`,
+  )
+  const count = (adminCount.rows[0] as { count: number } | undefined)?.count ?? 0
+  return count > 0
+}
+
+function composeExecQuery(
+  cwd: string,
+  compose: { project: string; composePath: string },
+  sql: string,
+  params: unknown[] = [],
+): Promise<QueryResult> {
+  const db = readEnvValue(cwd, "POSTGRES_DB", "supatype")
+  const user = readEnvValue(cwd, "POSTGRES_USER", "supatype_admin")
+  const envFile = join(cwd, ".env")
+  const composeDir = dirname(compose.composePath)
+  const args = [
+    "compose",
+    "-p",
+    compose.project,
+    "--project-directory",
+    cwd,
+    "-f",
+    compose.composePath,
+  ]
+  if (existsSync(envFile)) args.push("--env-file", envFile)
+
+  if (params.length === 0) {
+    args.push("exec", "-T", "db", "psql", "-U", user, "-d", db, "-tAc", sql)
+    const result = spawnSync("docker", args, { cwd: composeDir, encoding: "utf8" })
+    if (result.status !== 0) {
+      throw new Error((result.stderr ?? result.stdout ?? "compose psql failed").trim())
+    }
+    const text = (result.stdout ?? "").trim()
+    if (sql.trim().toUpperCase().startsWith("SELECT")) {
+      return Promise.resolve({
+        rows: parsePsqlScalarRows(sql, text),
+        rowCount: 1,
+        command: "SELECT",
+        oid: 0,
+        fields: [],
+      })
+    }
+    return Promise.resolve({
+      rows: [],
+      rowCount: 0,
+      command: "INSERT",
+      oid: 0,
+      fields: [],
+    })
+  }
+
+  args.push(
+    "exec",
+    "-T",
+    "db",
+    "psql",
+    "-U",
+    user,
+    "-d",
+    db,
+    "-v",
+    "ON_ERROR_STOP=1",
+    "-c",
+    interpolateSql(sql, params),
+  )
+  const result = spawnSync("docker", args, { cwd: composeDir, encoding: "utf8" })
+  if (result.status !== 0) {
+    throw new Error((result.stderr ?? result.stdout ?? "compose psql failed").trim())
+  }
+  const stdout = (result.stdout ?? "").trim()
+  const idMatch = stdout.match(
+    /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\s+\|\s+(.+)/i,
+  )
+  if (idMatch) {
+    return Promise.resolve({
+      rows: [{ id: idMatch[1], email: idMatch[2]?.trim() }],
+      rowCount: 1,
+      command: "INSERT",
+      oid: 0,
+      fields: [],
     })
+  }
+  return Promise.resolve({
+    rows: [],
+    rowCount: 0,
+    command: "INSERT",
+    oid: 0,
+    fields: [],
   })
 }
 
-async function confirm(question: string): Promise<boolean> {
-  const answer = await prompt(question)
-  return answer.toLowerCase() === "y"
+function parsePsqlScalarRows(sql: string, text: string): Record<string, unknown>[] {
+  const upper = sql.toUpperCase()
+  if (upper.includes(" AS EXISTS")) {
+    return [{ exists: text === "t" }]
+  }
+  if (upper.includes(" AS COUNT")) {
+    return [{ count: Number.parseInt(text, 10) || 0 }]
+  }
+  if (text === "") return []
+  return [{ value: text }]
+}
+
+function interpolateSql(sql: string, params: unknown[]): string {
+  return sql.replace(/\$(\d+)/g, (_match, index: string) => {
+    const value = params[Number(index) - 1]
+    if (value === null || value === undefined) return "NULL"
+    if (typeof value === "number" || typeof value === "bigint") return String(value)
+    if (typeof value === "boolean") return value ? "TRUE" : "FALSE"
+    return `'${String(value).replace(/'/g, "''")}'`
+  })
+}
+
+function hostComposeDbUrlFromEnv(cwd: string): string {
+  const port = readEnvValue(cwd, "SUPATYPE_DEV_DB_PORT", "54329")
+  const user = readEnvValue(cwd, "POSTGRES_USER", "supatype_admin")
+  const pass = readEnvValue(cwd, "POSTGRES_PASSWORD", "postgres")
+  const db = readEnvValue(cwd, "POSTGRES_DB", "supatype")
+  return `postgresql://${user}:${pass}@127.0.0.1:${port}/${db}?sslmode=disable`
+}
+
+async function importPg(): Promise<typeof import("pg")> {
+  try {
+    return await import("pg")
+  } catch {
+    error("pg package is required for admin commands. Install it with: pnpm add pg")
+    process.exit(1)
+  }
 }