@supatype/cli 0.1.10 → 0.1.12

package/src/commands/init.ts

@@ -816,7 +816,22 @@ function packageJsonTemplate(opts: ScaffoldOptions, deps: InitDependencyVersions
   if (opts.helloFunction) {
     scripts.push(`    "functions": "supatype functions serve"`)
   }
-  const devDeps = [`    "tsx": "^4.19.2"`, `    "typescript": "^5"`]
+  // Both are development-time only, so they belong in devDependencies. Validated end to end
+  // against a real database: schema/index.ts imports @supatype/types with `import type`, which is
+  // erased at build; supatype.config.ts imports defineConfig, which only the CLI evaluates; and
+  // seed.ts is run by `tsx seed.ts`. Nothing `supatype push` or `supatype generate` writes refers
+  // to either package: the generated types import nothing, and the client augmentation declares a
+  // module for @supatype/client, which stays a real dependency.
+  //
+  // In dependencies they were installed by `npm install --omit=dev`, so every production install
+  // of a Supatype app pulled the whole CLI toolchain (ink, react, typescript, ts-morph, pg, tsx)
+  // to support three files that never run in production.
+  const devDeps = [
+    `    "@supatype/cli": "^${deps.cli}"`,
+    `    "@supatype/types": "^${deps.types}"`,
+    `    "tsx": "^4.19.2"`,
+    `    "typescript": "^5"`,
+  ]
   if (opts.app.viteDevUrl) {
     devDeps.push(`    "vite": "^6"`)
   }
@@ -827,10 +842,6 @@ function packageJsonTemplate(opts: ScaffoldOptions, deps: InitDependencyVersions
   "scripts": {
 ${scripts.join(",\n")}
   },
-  "dependencies": {
-    "@supatype/cli": "^${deps.cli}",
-    "@supatype/types": "^${deps.types}"
-  },
   "devDependencies": {
 ${devDeps.join(",\n")}
   }

package/src/commands/push.ts

@@ -38,6 +38,7 @@ import {
 import { confirm, logSkippedConfirm } from "../ui/confirm.js"
 import { info, plain } from "../ui/messages.js"
 import { withSpinner } from "../ui/progress.js"
+import { writeGeneratedTypes } from "../type-generation.js"
 import { isInteractive } from "../ui/interactive.js"
 
 const DEV_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long"
@@ -247,14 +248,19 @@ async function generateTypesLocal(ast: unknown, config: SupatypeProjectConfig):
   if (syncManifestHooks(cwd, ast)) info("Hook map written to .supatype/manifest.json")
 
   if (!config.output?.types && !config.output?.client) return
-  await withSpinner("Generating types", async () => {
-    await ensureEngine()
-    const genBody: Record<string, unknown> = { ast, lang: "typescript" }
-    if (config.output?.types) genBody["types_path"] = config.output.types
-    if (config.output?.client) genBody["client_path"] = config.output.client
-    const genResult = await engineRequest<{ message?: string }>("/generate", genBody)
-    return genResult.message ?? "Types generated."
-  }).then((msg) => info(msg))
+  // The CLI writes these, it does not ask the engine to. Passing types_path and client_path and
+  // reading only `message` meant the generated TypeScript was printed to the terminal and no file
+  // was ever created, so `push` reported success and produced nothing.
+  const written = await withSpinner("Generating types", async () => {
+    const messages = await writeGeneratedTypes({
+      cwd,
+      ast,
+      typesPath: config.output?.types,
+      clientPath: config.output?.client,
+    })
+    return messages
+  })
+  for (const message of written) info(message)
 }
 
 async function provisionLocalStorage(ast: unknown, config: SupatypeProjectConfig): Promise<void> {

package/src/db-preflight.ts

@@ -113,6 +113,16 @@ async function probeLogicalDecoding(q: QueryFn): Promise<CheckResult> {
 
 const REQUIRED_ROLES = ["anon", "authenticated", "service_role", "authenticator"] as const
 
+/** The three roles PostgREST switches to per request. `authenticator` only connects and switches. */
+const API_ROLES = ["anon", "authenticated", "service_role"] as const
+
+/** One row per API role that exists, for the schema named in the query. */
+export interface AuthSchemaUsageRow {
+  rolname: string | null
+  has_usage: boolean | null
+  owner: string
+}
+
 /**
  * Stands in for the `authenticator` password when the operator has not supplied one.
  *
@@ -309,7 +319,7 @@ export async function runPreflight(
         WHERE g.rolname = 'authenticator'`,
     )
     const held = new Set(memberships.map((m) => m.rolname))
-    const needed = ["anon", "authenticated", "service_role"].filter((r) => !held.has(r))
+    const needed = API_ROLES.filter((r) => !held.has(r))
     results.push({
       id: "authenticator-memberships",
       title: "authenticator can reach the three API roles",
@@ -322,6 +332,19 @@ export async function runPreflight(
     })
   }
 
+  // USAGE on the auth schema, asked by OID so a role that does not exist cannot raise
+  // `role "x" does not exist` the way the name-taking overload would.
+  const authUsage = await q<AuthSchemaUsageRow>(
+    `SELECT r.rolname,
+            has_schema_privilege(r.oid, n.oid, 'USAGE') AS has_usage,
+            pg_get_userbyid(n.nspowner) AS owner
+       FROM pg_namespace n
+       LEFT JOIN pg_roles r ON r.rolname = ANY($1)
+      WHERE n.nspname = 'auth'`,
+    [API_ROLES as unknown as string[]],
+  )
+  results.push(authSchemaUsageCheck(authUsage, privs))
+
   // ── Extensions ─────────────────────────────────────────────────────────────
   const installed = new Set(
     (await q<{ extname: string }>("SELECT extname FROM pg_extension")).map((r) => r.extname),
@@ -456,6 +479,71 @@ export async function runPreflight(
   return { results, worst: worstOf(results) }
 }
 
+/**
+ * Can the API roles reach the auth helpers when a query calls them?
+ *
+ * Postgres evaluates a policy's `USING` clause with the table owner's privileges, so row-level
+ * security works without this grant and looks like proof the schema is fine. Field masking does
+ * not: `supatype_mask` rewrites a masked column into `CASE WHEN can_read_t__c(t) …` in the target
+ * list, which runs as the caller and reaches `auth.role()` directly. Studio's per-record
+ * `can_<op>_<table>` calls have the same shape.
+ *
+ * `supatype/postgres` grants this at initdb, so a missing grant means a database Supatype did not
+ * bootstrap. Kept a `degrade` rather than a `fail`: two named features stop working and the rest
+ * of the stack is unaffected.
+ */
+export function authSchemaUsageCheck(
+  rows: AuthSchemaUsageRow[],
+  privs: { current_user: string; is_super: boolean },
+): CheckResult {
+  const base = { id: "auth-schema-usage", title: "USAGE on schema auth (API roles)" }
+
+  // No auth schema yet: the first push creates it and grants on it, so there is nothing to fix.
+  if (rows.length === 0) {
+    return {
+      ...base,
+      severity: "pass",
+      detail: "schema auth does not exist yet; the first push creates it and grants usage",
+    }
+  }
+
+  const owner = rows[0]!.owner
+  const present = rows.filter((r) => r.rolname !== null)
+
+  // The roles check above owns this finding; repeating it here as a privilege problem would send
+  // the operator after the wrong fix.
+  if (present.length === 0) {
+    return { ...base, severity: "pass", detail: "no API roles exist on this server yet" }
+  }
+
+  const lacking = present.filter((r) => !r.has_usage).map((r) => r.rolname!)
+  if (lacking.length === 0) {
+    return {
+      ...base,
+      severity: "pass",
+      detail: `granted to ${present.map((r) => r.rolname).join(", ")} (schema owned by "${owner}")`,
+    }
+  }
+
+  // A grant from a role that owns neither the schema nor the server is discarded with a WARNING
+  // rather than an error, so `--fix` would report "Applied" having changed nothing. That is the
+  // same fault as a privilege generated and never applied, so hand it to the operator instead.
+  const canGrant = owner === privs.current_user || privs.is_super
+
+  return {
+    ...base,
+    severity: "degrade",
+    detail: `not granted to ${lacking.join(", ")} (schema owned by "${owner}")`,
+    impact:
+      "Field-level access is unavailable: a push declaring `access.fields` refuses rather than " +
+      "applying, and a masked column read by one of these roles fails with 42501 instead of " +
+      "masking. Studio's per-record permission checks fail the same way. Row-level security is " +
+      "unaffected, because Postgres evaluates policies with the table owner's privileges.",
+    remedy: `GRANT USAGE ON SCHEMA auth TO ${lacking.map(ident).join(", ")};`,
+    ...(!canGrant && { remedyNeedsOperator: true }),
+  }
+}
+
 function extensionCheck(
   name: string,
   installed: Set<string>,

package/src/type-generation.ts

@@ -0,0 +1,60 @@
+/**
+ * Write a project's generated types to disk.
+ *
+ * `push` used to send `types_path` and `client_path` to the engine and read only `message`,
+ * expecting the engine to write the files. It does not write them, so with `output.types`
+ * configured the generated TypeScript was printed to the terminal and nothing reached disk:
+ * `supatype push` claims to generate types and produced none. `supatype generate` had it right
+ * all along, and this is that logic, shared, so the two cannot disagree again.
+ *
+ * Each path is optional and an absent one is skipped, because the two callers differ on purpose:
+ * `generate` falls back to defaults and always writes, while `push` writes only what the project
+ * asked for and must not start creating files in projects that never configured any.
+ */
+
+import { mkdirSync, writeFileSync } from "node:fs"
+import { dirname, resolve } from "node:path"
+import { generateClientAugmentation } from "./augmentation-generator.js"
+import { ensureEngine, engineRequest } from "./engine-client.js"
+
+export interface GenerateTypesRequest {
+  cwd: string
+  ast: unknown
+  /** Relative path for the database types, from `output.types`. */
+  typesPath?: string | undefined
+  /** Relative path for the client augmentation, from `output.client`. */
+  clientPath?: string | undefined
+}
+
+/** Writes what was asked for and returns one message per file, for the caller to report. */
+export async function writeGeneratedTypes(req: GenerateTypesRequest): Promise<string[]> {
+  const written: string[] = []
+
+  if (req.typesPath !== undefined && req.typesPath !== "") {
+    await ensureEngine()
+    const result = await engineRequest<{ code?: string; message?: string }>(
+      "/generate",
+      { ast: req.ast, lang: "typescript" },
+    )
+    // `code` is the field the engine fills; `message` is the older shape. Reading only `message`
+    // and printing it is how the generated file ended up in the terminal.
+    const code = result.code ?? result.message
+    if (code === undefined) {
+      throw new Error("Engine returned no output for type generation.")
+    }
+    const outPath = resolve(req.cwd, req.typesPath)
+    mkdirSync(dirname(outPath), { recursive: true })
+    writeFileSync(outPath, code, "utf8")
+    written.push(`Types written to ${req.typesPath}`)
+  }
+
+  // Generated locally from the AST, so it needs no engine round trip.
+  if (req.clientPath !== undefined && req.clientPath !== "") {
+    const outPath = resolve(req.cwd, req.clientPath)
+    mkdirSync(dirname(outPath), { recursive: true })
+    writeFileSync(outPath, generateClientAugmentation(req.ast), "utf8")
+    written.push(`Client augmentation written to ${req.clientPath}`)
+  }
+
+  return written
+}

package/tests/app-command.test.ts

@@ -12,10 +12,20 @@ const CLI_BIN = resolve(__dirname, "../bin/supatype.js")
 
 function runCli(cwd: string, args: string[]): { stdout: string; stderr: string; exitCode: number } {
   const result = spawnSync(process.execPath, [CLI_BIN, ...args], {
-    encoding: "utf8",
     cwd,
-    timeout: 10_000,
+    encoding: "utf8",
+    // 60s, not 10s: this spawns the built CLI, which imports Ink, React and commander before it
+    // does anything. That is about 1.2s idle, and CI runs `turbo run test` across every package at
+    // once, where it exceeded 10s and the subprocess was killed. The assertion then compared
+    // against empty output and pointed at the CLI rather than at contention.
+    timeout: 60_000,
   })
+  if (result.signal) {
+    throw new Error(
+      `CLI subprocess killed by ${result.signal} after the spawn timeout. `
+        + `Args: ${args.join(" ")}. This is usually machine contention, not a CLI fault.`,
+    )
+  }
   return {
     stdout: String(result.stdout ?? ""),
     stderr: String(result.stderr ?? ""),

package/tests/db-preflight.test.ts

@@ -1,6 +1,8 @@
 import { describe, expect, it } from "vitest"
 import {
   PASSWORD_PLACEHOLDER,
+  authSchemaUsageCheck,
+  type AuthSchemaUsageRow,
   needsOperatorPassword,
   operatorRemedies,
   transactionalRemedies,
@@ -70,3 +72,81 @@ describe("the authenticator password guard", () => {
     expect(PASSWORD_PLACEHOLDER).toMatch(/^<.*>$/)
   })
 })
+
+describe("USAGE on the auth schema", () => {
+  const row = (rolname: string, has_usage: boolean, owner = "supatype_admin"): AuthSchemaUsageRow => ({
+    rolname,
+    has_usage,
+    owner,
+  })
+  const asOwner = { current_user: "supatype_admin", is_super: false }
+  const asStranger = { current_user: "app_migrator", is_super: false }
+
+  // Before the first push there is no auth schema, and the push creates it and grants on it.
+  // Reporting that as a problem would send the operator to fix something that fixes itself.
+  it("says nothing when the schema does not exist", () => {
+    const check = authSchemaUsageCheck([], asOwner)
+    expect(check.severity).toBe("pass")
+    expect(check.remedy).toBeUndefined()
+  })
+
+  it("passes when all three roles hold usage, and names the owner", () => {
+    const check = authSchemaUsageCheck(
+      [row("anon", true), row("authenticated", true), row("service_role", true)],
+      asOwner,
+    )
+    expect(check.severity).toBe("pass")
+    expect(check.detail).toContain("supatype_admin")
+    expect(check.remedy).toBeUndefined()
+  })
+
+  // Degrade, not fail: REST and RLS keep working because policies run with the table owner's
+  // privileges. Calling it a failure would exit non-zero on databases using neither feature.
+  it("degrades when a role lacks usage, and grants exactly that role", () => {
+    const check = authSchemaUsageCheck(
+      [row("anon", true), row("authenticated", false), row("service_role", true)],
+      asOwner,
+    )
+    expect(check.severity).toBe("degrade")
+    expect(check.remedy).toBe('GRANT USAGE ON SCHEMA auth TO "authenticated";')
+    expect(check.impact).toContain("access.fields")
+    expect(check.impact).toContain("42501")
+  })
+
+  it("grants every lacking role in one statement", () => {
+    const check = authSchemaUsageCheck(
+      [row("anon", false), row("authenticated", false), row("service_role", true)],
+      asOwner,
+    )
+    expect(check.remedy).toBe('GRANT USAGE ON SCHEMA auth TO "anon", "authenticated";')
+  })
+
+  // `--fix` applies remedies in a transaction and reports "Applied". Postgres discards a grant
+  // from a non-owner with a WARNING rather than an error, so without this flag `--fix` would
+  // report success having changed nothing.
+  it("hands the remedy to the operator when the caller cannot grant it", () => {
+    const check = authSchemaUsageCheck([row("authenticated", false)], asStranger)
+    expect(check.remedyNeedsOperator).toBe(true)
+  })
+
+  it("applies it itself when the caller owns the schema", () => {
+    const check = authSchemaUsageCheck([row("authenticated", false)], asOwner)
+    expect(check.remedyNeedsOperator).toBeUndefined()
+  })
+
+  it("applies it itself when the caller is a superuser on someone else's schema", () => {
+    const check = authSchemaUsageCheck(
+      [row("authenticated", false, "someone_else")],
+      { current_user: "postgres", is_super: true },
+    )
+    expect(check.remedyNeedsOperator).toBeUndefined()
+  })
+
+  // A LEFT JOIN against a server with none of the API roles yields one all-null row. The roles
+  // check owns that finding; reporting it here as a privilege problem points at the wrong fix.
+  it("defers to the roles check when no API role exists", () => {
+    const check = authSchemaUsageCheck([{ rolname: null, has_usage: null, owner: "postgres" }], asOwner)
+    expect(check.severity).toBe("pass")
+    expect(check.detail).toContain("no API roles")
+  })
+})