@supatype/cli 0.1.5 → 0.1.7

package/tests/admin-studio-membership.test.ts

@@ -0,0 +1,121 @@
+import { describe, expect, it } from "vitest"
+import { mkdirSync, rmSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import type { QueryResult } from "pg"
+import { ensureFirstAdminWithQuery, STUDIO_ROLES } from "../src/commands/admin.js"
+
+function result(rows: Record<string, unknown>[]): QueryResult {
+  return {
+    rows,
+    rowCount: rows.length,
+    command: "SELECT",
+    oid: 0,
+    fields: [],
+  } as unknown as QueryResult
+}
+
+interface Recorded {
+  sql: string
+  params: unknown[]
+}
+
+/**
+ * Answers the probes `ensureFirstAdminWithQuery` makes and records every
+ * statement, so the assertions can inspect what would reach Postgres.
+ */
+function stubDb(): { query: (sql: string, params?: unknown[]) => Promise<QueryResult>; log: Recorded[] } {
+  const log: Recorded[] = []
+  const query = async (sql: string, params: unknown[] = []): Promise<QueryResult> => {
+    log.push({ sql, params })
+
+    if (sql.includes("information_schema.tables") && sql.includes("'auth'")) {
+      return result([{ exists: true }])
+    }
+    if (sql.includes("to_regclass")) {
+      return result([{ exists: false }]) // no membership table yet → no admins
+    }
+    if (sql.includes("information_schema.columns")) {
+      return result([{ column_name: "email_confirmed_at" }])
+    }
+    if (sql.includes("SELECT id FROM auth.users")) {
+      return result([]) // email not taken
+    }
+    if (sql.includes("INSERT INTO auth.users")) {
+      return result([{ id: "11111111-2222-3333-4444-555555555555", email: "admin@example.com" }])
+    }
+    return result([])
+  }
+  return { query, log }
+}
+
+async function seedFirstAdmin(): Promise<Recorded[]> {
+  const dir = join(tmpdir(), `supatype-admin-membership-${process.pid}-${Math.random()}`)
+  mkdirSync(dir, { recursive: true })
+  const { query, log } = stubDb()
+  try {
+    await ensureFirstAdminWithQuery(query, {
+      cwd: dir,
+      email: "admin@example.com",
+      password: "password123",
+      role: "admin",
+    })
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+  return log
+}
+
+// Capability checks refuse a role they do not recognise, so the CLI's set has to
+// match the server's (`studioRolePermissions`) and the control plane's
+// (`STUDIO_ROLE_PERMISSIONS`) exactly — a role only this side knows about creates
+// a user who is locked out of the panel they were made for.
+describe("STUDIO_ROLES", () => {
+  it("matches the roles the servers understand", () => {
+    expect([...STUDIO_ROLES]).toEqual(["admin", "developer", "editor"])
+  })
+})
+
+describe("first admin user creation", () => {
+  // Regression: Studio access used to be granted by writing `role` into
+  // `app_metadata`. That is the developer's namespace for their own application
+  // roles, so anything that assigned an app role could hand out admin UI access.
+  it("does not write a role into app_metadata", async () => {
+    const log = await seedFirstAdmin()
+    const insert = log.find((entry) => entry.sql.includes("INSERT INTO auth.users"))
+    expect(insert).toBeDefined()
+
+    const appMetadata = insert!.params.find(
+      (p): p is string => typeof p === "string" && p.trimStart().startsWith("{"),
+    )
+    expect(appMetadata).toBeDefined()
+    expect(JSON.parse(appMetadata!)).not.toHaveProperty("role")
+  })
+
+  it("grants Studio access through _supatype.studio_members", async () => {
+    const log = await seedFirstAdmin()
+    const grant = log.find((entry) =>
+      entry.sql.includes("INSERT INTO _supatype.studio_members"),
+    )
+    expect(grant).toBeDefined()
+    expect(grant!.params).toEqual(["11111111-2222-3333-4444-555555555555", "admin"])
+  })
+
+  // The membership table is the only grant, so `admin create-user` has to work
+  // on a project whose engine predates it or that has never been pushed.
+  it("creates the membership table when it is absent", async () => {
+    const log = await seedFirstAdmin()
+    expect(
+      log.some((entry) => entry.sql.includes("CREATE TABLE IF NOT EXISTS _supatype.studio_members")),
+    ).toBe(true)
+  })
+
+  // Counting `app_metadata` claims would report an admin exists while nobody
+  // can actually log in, so the "do I need a first admin?" check must read
+  // membership.
+  it("decides whether an admin exists from membership, not claims", async () => {
+    const log = await seedFirstAdmin()
+    const probe = log.find((entry) => entry.sql.includes("COUNT(*)"))
+    expect(probe?.sql ?? "").not.toContain("raw_app_meta_data")
+  })
+})

package/tests/api-schemas.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect } from "vitest"
+import {
+  apiSchemaList,
+  apiSchemas,
+  pgSchema,
+  type SupatypeProjectConfig,
+} from "../src/project-config.js"
+
+/**
+ * `PGRST_DB_SCHEMA` used to be a literal in two places, so `schema.pg_schema` was honoured by the
+ * engine and ignored by the API: a project pushed into its own schema and then answered PGRST106 on
+ * every request, with nothing in the output naming the setting responsible.
+ */
+const project = (schema?: SupatypeProjectConfig["schema"]): SupatypeProjectConfig => ({
+  project: { name: "acme" },
+  database: { provider: "docker" },
+  server: { mode: "dev" },
+  app: { mode: "none" },
+  ...(schema !== undefined && { schema }),
+})
+
+describe("pgSchema", () => {
+  it("defaults to public", () => {
+    expect(pgSchema(project())).toBe("public")
+    expect(pgSchema(project({}))).toBe("public")
+  })
+
+  it("ignores a blank pg_schema rather than emitting an empty identifier", () => {
+    expect(pgSchema(project({ pg_schema: "   " }))).toBe("public")
+  })
+})
+
+describe("apiSchemas", () => {
+  it("reproduces the list self-host shipped before it was configurable", () => {
+    expect(apiSchemaList(project())).toBe("public, supatype, graphql_public, auth")
+  })
+
+  it("is the same list for dev and self-host", () => {
+    // Dev used to omit `auth`, so a request that worked against a self-hosted stack 404ed locally.
+    expect(apiSchemas(project())).toContain("auth")
+  })
+
+  it("leads with the managed schema when pg_schema moves", () => {
+    // First entry is what PostgREST serves as the default profile, so the managed schema has to
+    // lead — otherwise unprefixed requests would resolve against `supatype`.
+    expect(apiSchemaList(project({ pg_schema: "app" }))).toBe(
+      "app, supatype, graphql_public, auth",
+    )
+  })
+
+  it("does not repeat a stack schema the project has chosen to manage", () => {
+    expect(apiSchemas(project({ pg_schema: "supatype" }))).toEqual([
+      "supatype",
+      "graphql_public",
+      "auth",
+    ])
+  })
+
+  it("lets an explicit list replace the whole thing, stack schemas included", () => {
+    // The point of making the entire list configurable: dropping `supatype` is a supported way to
+    // stop exposing Studio's views over REST.
+    expect(apiSchemas(project({ pg_schema: "app", api_schemas: ["app"] }))).toEqual(["app"])
+  })
+
+  it("preserves the order given, since order selects the default profile", () => {
+    expect(apiSchemaList(project({ api_schemas: ["reporting", "app"] }))).toBe("reporting, app")
+  })
+
+  it("falls back to the derived list when api_schemas is present but empty", () => {
+    // An empty PGRST_DB_SCHEMA makes PostgREST refuse to start; a truncated config should not be
+    // the reason the API is down.
+    expect(apiSchemaList(project({ pg_schema: "app", api_schemas: [] }))).toBe(
+      "app, supatype, graphql_public, auth",
+    )
+  })
+
+  it("drops blank and duplicate entries", () => {
+    expect(apiSchemas(project({ api_schemas: ["app", " ", "app", " reporting "] }))).toEqual([
+      "app",
+      "reporting",
+    ])
+  })
+})

package/tests/archive-name-alias.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest"
+
+import { archiveNameCandidates } from "../src/binary-cache.js"
+
+/**
+ * `supatype-postgres` published the Intel macOS archive as `darwin-x86_64` while the CLI asks for
+ * `darwin-amd64` — the spelling it derives from `process.arch === "x64"` on every platform. So
+ * `supatype dev` on an Intel Mac failed with "Checksum not found", and had done for as long as both
+ * sides existed: CI could not run Docker on a macOS runner, so the path was never exercised.
+ *
+ * Accepting both names means releases already on the CDN work untouched, rather than needing a fresh
+ * one cut purely to rename a file.
+ */
+describe("archiveNameCandidates", () => {
+  it("asks for the canonical amd64 name first on Intel macOS", () => {
+    const names = archiveNameCandidates("postgres", "17.2", { os: "darwin", arch: "amd64" })
+    expect(names[0]).toBe("supatype-pg-17-darwin-amd64.tar.gz")
+  })
+
+  it("falls back to the legacy x86_64 spelling", () => {
+    const names = archiveNameCandidates("postgres", "17.2", { os: "darwin", arch: "amd64" })
+    expect(names).toContain("supatype-pg-17-darwin-x86_64.tar.gz")
+  })
+
+  it("offers one name everywhere else, since only darwin ever disagreed", () => {
+    // linux-amd64 and windows-amd64 always matched, so widening them would invite a wrong archive to
+    // be accepted for a platform that never had a second name.
+    expect(archiveNameCandidates("postgres", "17.2", { os: "linux", arch: "amd64" })).toEqual([
+      "supatype-pg-17-linux-amd64.tar.gz",
+    ])
+    expect(archiveNameCandidates("postgres", "17.2", { os: "darwin", arch: "arm64" })).toEqual([
+      "supatype-pg-17-darwin-arm64.tar.gz",
+    ])
+  })
+
+  it("does not widen other components", () => {
+    // Only the postgres archives were ever published under two names.
+    expect(archiveNameCandidates("engine", "0.4.2", { os: "darwin", arch: "amd64" })).toEqual([
+      "supatype-engine-darwin-amd64",
+    ])
+  })
+})

package/tests/augmentation-generator.test.ts

@@ -5,18 +5,58 @@ describe("generateClientAugmentation", () => {
   it("emits deterministic output independent of model order", () => {
     const astA = {
       models: [
-        { tableName: "post", fields: { title: { kind: "text", required: true } } },
-        { tableName: "comment", fields: { body: { kind: "text", required: true } } },
+        {
+          name: "Post",
+          fields: { title: { kind: "text", required: true } },
+          annotations: { db: { tableName: "post", indexes: [] } },
+        },
+        {
+          name: "Comment",
+          fields: { body: { kind: "text", required: true } },
+          annotations: { db: { tableName: "comment", indexes: [] } },
+        },
       ],
     }
     const astB = {
       models: [
-        { tableName: "comment", fields: { body: { kind: "text", required: true } } },
-        { tableName: "post", fields: { title: { kind: "text", required: true } } },
+        {
+          name: "Comment",
+          fields: { body: { kind: "text", required: true } },
+          annotations: { db: { tableName: "comment", indexes: [] } },
+        },
+        {
+          name: "Post",
+          fields: { title: { kind: "text", required: true } },
+          annotations: { db: { tableName: "post", indexes: [] } },
+        },
       ],
     }
 
     expect(generateClientAugmentation(astA)).toEqual(generateClientAugmentation(astB))
+    expect(generateClientAugmentation(astA)).toContain("post:")
+    expect(generateClientAugmentation(astA)).toContain("comment:")
+  })
+
+  it("resolves tableName from AST v2 annotations.db.tableName", () => {
+    const ast = {
+      models: [
+        {
+          name: "Profile",
+          fields: { id: { kind: "uuid", required: true } },
+          annotations: { db: { tableName: "profile", indexes: [] } },
+        },
+      ],
+    }
+    const out = generateClientAugmentation(ast)
+    expect(out).toContain("profile:")
+    expect(out).not.toContain("undefined:")
+  })
+
+  it("falls back to snake_case model name when tableName is missing", () => {
+    const ast = {
+      models: [{ name: "Profile", fields: { id: { kind: "uuid", required: true } } }],
+    }
+    expect(generateClientAugmentation(ast)).toContain("profile:")
   })
 
   it("marks Insert fields optional when serverGenerated or default is set", () => {
@@ -56,4 +96,32 @@ describe("generateClientAugmentation", () => {
     expect(out).toContain('import("@supatype/types/lexical").SerializedEditorState')
     expect(out).not.toMatch(/body: Record<string, unknown>/)
   })
+
+  it("uses a field's declared tsType instead of collapsing JSONB to an opaque object", () => {
+    // `Currency<"USD">` and `Code<"sql">` are stored as JSONB because each carries two values. If
+    // the generated row typed them as `Record<string, unknown>`, a caller reading `price.amount`
+    // would get no help from the schema that already knows the shape.
+    const ast = {
+      models: [
+        {
+          name: "Snippet",
+          annotations: { db: { tableName: "snippet", indexes: [] } },
+          fields: {
+            price: {
+              kind: "json",
+              pgType: "JSONB",
+              required: true,
+              tsType: '{ amount: string; code: "USD" }',
+            },
+            notes: { kind: "json", pgType: "JSONB", required: false },
+          },
+        },
+      ],
+    }
+
+    const out = generateClientAugmentation(ast)
+    expect(out).toContain('price: { amount: string; code: "USD" }')
+    // A field with no declared shape still falls back, and optional fields still admit null.
+    expect(out).toContain("notes: Record<string, unknown> | null")
+  })
 })

package/tests/cache-clean.test.ts

@@ -0,0 +1,206 @@
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"
+
+let fakeHome = ""
+
+vi.mock("node:os", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("node:os")>()
+  return {
+    ...actual,
+    homedir: () => (fakeHome.length > 0 ? fakeHome : actual.homedir()),
+  }
+})
+
+import {
+  cleanCachedBinaries,
+  findSupatypeProjectDirs,
+  pinnedVersionsFromConfigs,
+} from "../src/cache-pins.js"
+import { cachePath } from "../src/binary-cache.js"
+import type { SupatypeProjectConfig } from "../src/project-config.js"
+
+let counter = 0
+let tmpDir: string
+
+function minimalConfig(name: string, versions?: Partial<Record<string, string>>): SupatypeProjectConfig {
+  return {
+    project: { name },
+    database: { provider: "docker" },
+    server: { mode: "dev" },
+    app: { mode: "none" },
+    ...(versions !== undefined ? { versions } : {}),
+  }
+}
+
+function writeProjectConfig(projectDir: string, config: SupatypeProjectConfig): void {
+  mkdirSync(projectDir, { recursive: true })
+  writeFileSync(
+    join(projectDir, "supatype.config.ts"),
+    `export default ${JSON.stringify(config)}
+`,
+  )
+}
+
+function seedCache(component: "engine" | "server" | "postgres" | "deno" | "realtime", version: string, bytes = 8): string {
+  const dir = cachePath(component, version)
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(join(dir, "artifact.bin"), "x".repeat(bytes))
+  return dir
+}
+
+beforeEach(() => {
+  tmpDir = join(tmpdir(), `supatype-cache-clean-${Date.now()}-${++counter}`)
+  fakeHome = join(tmpDir, "home")
+  mkdirSync(join(fakeHome, ".supatype", "cache"), { recursive: true })
+})
+
+afterEach(() => {
+  fakeHome = ""
+  rmSync(tmpDir, { recursive: true, force: true })
+})
+
+describe("pinnedVersionsFromConfigs", () => {
+  it("collects semver pins and ignores local", () => {
+    const { protectedVersions, sources } = pinnedVersionsFromConfigs([
+      {
+        projectDir: "/proj/a",
+        config: minimalConfig("alpha", { engine: "0.4.2", server: "local" }),
+      },
+      {
+        projectDir: "/proj/b",
+        config: minimalConfig("beta", { engine: "0.4.1", postgres: "17.2" }),
+      },
+    ])
+
+    expect([...protectedVersions.get("engine")!].sort()).toEqual(["0.4.1", "0.4.2"])
+    expect(protectedVersions.get("postgres")).toEqual(new Set(["17.2"]))
+    expect(protectedVersions.has("server")).toBe(false)
+    expect(sources).toHaveLength(3)
+  })
+
+  it("does not protect anything when versions block is absent", () => {
+    const { protectedVersions } = pinnedVersionsFromConfigs([
+      { projectDir: "/proj/x", config: minimalConfig("bare") },
+    ])
+    expect(protectedVersions.size).toBe(0)
+  })
+})
+
+describe("cleanCachedBinaries", () => {
+  it("removes all versions when nothing is pinned", () => {
+    const v1 = `c13-a-${counter}`
+    const v2 = `c13-b-${counter}`
+    const v3 = `c13-c-${counter}`
+    seedCache("engine", v1)
+    seedCache("engine", v2)
+    seedCache("engine", v3)
+
+    const result = cleanCachedBinaries({
+      components: ["engine"],
+      projectDirs: [],
+    })
+
+    expect(result.removed.map((e) => e.version).sort()).toEqual([v1, v2, v3].sort())
+    expect(result.skipped).toHaveLength(0)
+    for (const v of [v1, v2, v3]) {
+      expect(existsSync(cachePath("engine", v))).toBe(false)
+    }
+  })
+
+  it("keeps pinned versions and removes the rest", () => {
+    const pinned = `c13-pin-${counter}`
+    const stale = `c13-stale-${counter}`
+    seedCache("engine", pinned)
+    seedCache("engine", stale)
+    seedCache("server", "c13-srv-old")
+    seedCache("server", "c13-srv-pin")
+
+    const projectDir = join(tmpDir, "my-app")
+    writeProjectConfig(
+      projectDir,
+      minimalConfig("my-app", { engine: pinned, server: "c13-srv-pin" }),
+    )
+
+    const result = cleanCachedBinaries({
+      components: ["engine", "server"],
+      projectDirs: [projectDir],
+    })
+
+    expect(result.removed.map((e) => `${e.component}@${e.version}`).sort()).toEqual([
+      `engine@${stale}`,
+      "server@c13-srv-old",
+    ])
+    expect(result.skipped.map((e) => `${e.component}@${e.version}`).sort()).toEqual([
+      `engine@${pinned}`,
+      "server@c13-srv-pin",
+    ])
+    expect(existsSync(cachePath("engine", pinned))).toBe(true)
+    expect(existsSync(cachePath("engine", stale))).toBe(false)
+  })
+
+  it("--force removes pinned versions", () => {
+    const pinned = `c13-force-${counter}`
+    seedCache("engine", pinned)
+
+    const projectDir = join(tmpDir, "forced")
+    writeProjectConfig(projectDir, minimalConfig("forced", { engine: pinned }))
+
+    const result = cleanCachedBinaries({
+      components: ["engine"],
+      force: true,
+      projectDirs: [projectDir],
+    })
+
+    expect(result.removed).toHaveLength(1)
+    expect(result.skipped).toHaveLength(0)
+    expect(existsSync(cachePath("engine", pinned))).toBe(false)
+  })
+
+  it("explicit version removes even when pinned (with warning)", () => {
+    const pinned = `c13-explicit-${counter}`
+    seedCache("engine", pinned)
+
+    const projectDir = join(tmpDir, "explicit")
+    writeProjectConfig(projectDir, minimalConfig("explicit", { engine: pinned }))
+
+    const result = cleanCachedBinaries({
+      components: ["engine"],
+      version: pinned,
+      projectDirs: [projectDir],
+    })
+
+    expect(result.removed).toHaveLength(1)
+    expect(result.warned.some((w) => w.includes("pinned"))).toBe(true)
+    expect(existsSync(cachePath("engine", pinned))).toBe(false)
+  })
+
+  it("dry-run does not delete files", () => {
+    const version = `c13-dry-${counter}`
+    seedCache("engine", version)
+
+    const result = cleanCachedBinaries({
+      components: ["engine"],
+      dryRun: true,
+      projectDirs: [],
+    })
+
+    expect(result.removed).toHaveLength(1)
+    expect(existsSync(cachePath("engine", version))).toBe(true)
+  })
+})
+
+describe("findSupatypeProjectDirs", () => {
+  it("finds nested projects up to max depth", () => {
+    const root = join(tmpDir, "mono")
+    const nested = join(root, "apps", "blog")
+    mkdirSync(nested, { recursive: true })
+    writeFileSync(join(nested, "supatype.config.ts"), "export default {}")
+    mkdirSync(join(root, "node_modules", "fake"), { recursive: true })
+    writeFileSync(join(root, "node_modules", "fake", "supatype.config.ts"), "export default {}")
+
+    const found = findSupatypeProjectDirs(root, 4)
+    expect(found).toEqual([nested])
+  })
+})

package/tests/cli-help.test.ts

@@ -48,6 +48,9 @@ describe("CLI binary (requires built dist/)", () => {
       "app",
       "self-host",
       "self-update",
+      "login",
+      "logout",
+      "whoami",
     ]
     for (const cmd of commands) {
       expect(stdout, `Expected '${cmd}' in --help output`).toContain(cmd)

package/tests/cli-install-method.test.ts

@@ -0,0 +1,66 @@
+import { afterEach, describe, expect, it, vi } from "vitest"
+import {
+  detectCliInstallMethod,
+  looksLikeHomebrewCLI,
+  looksLikeNpmOrWorkspaceCLI,
+} from "../src/cli-install-method.js"
+
+const originalArgv = process.argv
+
+afterEach(() => {
+  process.argv = originalArgv
+  vi.unstubAllEnvs()
+})
+
+describe("looksLikeNpmOrWorkspaceCLI", () => {
+  it("detects node_modules install path", () => {
+    process.argv = ["node", "/usr/lib/node_modules/@supatype/cli/bin/supatype.js"]
+    expect(looksLikeNpmOrWorkspaceCLI()).toBe(true)
+  })
+
+  it("detects workspace dist/cli path", () => {
+    process.argv = ["node", "/repo/packages/cli/dist/cli.js"]
+    expect(looksLikeNpmOrWorkspaceCLI()).toBe(true)
+  })
+})
+
+describe("looksLikeHomebrewCLI", () => {
+  it("detects macOS Cellar layout", () => {
+    process.argv = [
+      "node",
+      "/opt/homebrew/Cellar/supatype/0.1.5/bin/supatype",
+    ]
+    expect(looksLikeHomebrewCLI()).toBe(true)
+  })
+
+  it("detects Linuxbrew via HOMEBREW_CELLAR", () => {
+    vi.stubEnv("HOMEBREW_CELLAR", "/home/linuxbrew/.linuxbrew/Cellar")
+    process.argv = [
+      "node",
+      "/home/linuxbrew/.linuxbrew/Cellar/supatype/0.1.5/bin/supatype",
+    ]
+    expect(looksLikeHomebrewCLI()).toBe(true)
+  })
+
+  it("does not flag standalone ~/.supatype/bin", () => {
+    process.argv = ["node", "/Users/me/.supatype/bin/supatype"]
+    expect(looksLikeHomebrewCLI()).toBe(false)
+  })
+})
+
+describe("detectCliInstallMethod", () => {
+  it("prefers npm over homebrew when both match", () => {
+    process.argv = ["node", "/repo/packages/cli/dist/cli.js"]
+    expect(detectCliInstallMethod()).toBe("npm")
+  })
+
+  it("returns standalone for curl|sh install path", () => {
+    process.argv = ["node", "/Users/me/.supatype/bin/supatype"]
+    expect(detectCliInstallMethod()).toBe("standalone")
+  })
+
+  it("returns homebrew for Cellar binary", () => {
+    process.argv = ["node", "/opt/homebrew/Cellar/supatype/0.1.5/bin/supatype"]
+    expect(detectCliInstallMethod()).toBe("homebrew")
+  })
+})