@supatype/cli 0.1.5 → 0.1.7

package/tests/command-chrome-coverage.test.ts

@@ -20,6 +20,7 @@ import { registerApp } from "../src/commands/app.js"
 import { registerAdd } from "../src/commands/add.js"
 import { registerSelfHost } from "../src/commands/self-host.js"
 import { registerCloud } from "../src/commands/cloud.js"
+import { registerLogin } from "../src/commands/login.js"
 import { registerEngine } from "../src/commands/engine.js"
 import { registerDb } from "../src/commands/db.js"
 import { registerDeploy } from "../src/commands/deploy.js"
@@ -80,6 +81,7 @@ function buildProgram(): Command {
   registerApp(program)
   registerAdd(program)
   registerSelfHost(program)
+  registerLogin(program)
   registerCloud(program)
   registerEngine(program)
   registerDb(program)
@@ -118,32 +120,35 @@ describe("CLI command chrome coverage", () => {
       expect(handlerBefore, `${path} should be wrapped`).toBeDefined()
     }
 
-    expect(excluded).toEqual(
-      expect.arrayContaining([
-        "dev",
-        "init",
-        "link",
-        "add domain",
-        "logs",
-        "pg psql",
-        "functions serve",
-        "self-host compose logs",
-      ]),
-    )
+    for (const path of [
+      "dev",
+      "init",
+      "link",
+      "login",
+      "add domain",
+      "logs",
+      "pg psql",
+      "functions serve",
+      "self-host compose logs",
+    ]) {
+      expect(excluded, `${path} should skip chrome`).toContain(path)
+    }
 
-    expect(wrapped).toEqual(
-      expect.arrayContaining([
-        "push",
-        "diff",
-        "doctor",
-        "pull",
-        "cache list",
-        "cache rest list",
-        "deploy",
-        "deploy rollback",
-        "keys",
-        "generate",
-      ]),
-    )
+    for (const path of [
+      "push",
+      "diff",
+      "doctor",
+      "pull",
+      "cache list",
+      "cache rest list",
+      "deploy",
+      "deploy rollback",
+      "keys",
+      "generate",
+      "logout",
+      "whoami",
+    ]) {
+      expect(wrapped, `${path} should use chrome`).toContain(path)
+    }
   })
 })

package/tests/command-chrome-wrap.test.ts

@@ -10,6 +10,7 @@ describe("shouldExcludeCommandChrome", () => {
     expect(shouldExcludeCommandChrome("dev")).toBe(true)
     expect(shouldExcludeCommandChrome("init")).toBe(true)
     expect(shouldExcludeCommandChrome("link")).toBe(true)
+    expect(shouldExcludeCommandChrome("_postinstall")).toBe(true)
     expect(shouldExcludeCommandChrome("add domain")).toBe(true)
     expect(shouldExcludeCommandChrome("logs")).toBe(true)
     expect(shouldExcludeCommandChrome("pg psql")).toBe(true)

package/tests/db-preflight.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, it } from "vitest"
+import {
+  PASSWORD_PLACEHOLDER,
+  needsOperatorPassword,
+  operatorRemedies,
+  transactionalRemedies,
+  type CheckResult,
+  type PreflightReport,
+} from "../src/db-preflight.js"
+
+// The preflight's live behaviour is exercised against a real database; these cover the decisions
+// it makes about its own findings, which is where a mistake would be quiet rather than loud.
+
+const result = (over: Partial<CheckResult>): CheckResult => ({
+  id: "x",
+  title: "x",
+  severity: "pass",
+  detail: "x",
+  ...over,
+})
+
+const report = (results: CheckResult[]): PreflightReport => ({ results, worst: "pass" })
+
+describe("splitting remedies", () => {
+  // `--fix` runs everything it takes in one transaction. Anything that cannot be transactional
+  // must be excluded, or the transaction fails and the fixable work rolls back with it.
+  it("keeps server-setting remedies out of the transaction", () => {
+    const r = report([
+      result({ id: "roles", remedy: "CREATE ROLE anon;" }),
+      result({ id: "wal", remedy: "ALTER SYSTEM SET wal_level = 'logical';", remedyNeedsOperator: true }),
+      result({ id: "clean" }),
+    ])
+
+    expect(transactionalRemedies(r).map((x) => x.id)).toEqual(["roles"])
+    expect(operatorRemedies(r).map((x) => x.id)).toEqual(["wal"])
+  })
+
+  it("ignores findings with nothing to apply", () => {
+    const r = report([result({ id: "a" }), result({ id: "b", impact: "something is off" })])
+    expect(transactionalRemedies(r)).toHaveLength(0)
+    expect(operatorRemedies(r)).toHaveLength(0)
+  })
+})
+
+describe("the authenticator password guard", () => {
+  // The credential is the operator's by decision. Executing the placeholder would create a role
+  // with a password from our source code — worse than refusing, and harder to notice.
+  it("detects a remedy that would execute the placeholder", () => {
+    const remedies = [
+      result({ remedy: `CREATE ROLE authenticator LOGIN NOINHERIT PASSWORD '${PASSWORD_PLACEHOLDER}';` }),
+    ]
+    expect(needsOperatorPassword(remedies)).toBe(true)
+  })
+
+  it("is satisfied once a real password is present", () => {
+    const remedies = [
+      result({ remedy: "CREATE ROLE authenticator LOGIN NOINHERIT PASSWORD 'a-real-one';" }),
+    ]
+    expect(needsOperatorPassword(remedies)).toBe(false)
+  })
+
+  it("does not flag remedies that have no password at all", () => {
+    expect(needsOperatorPassword([result({ remedy: "GRANT anon TO authenticator;" })])).toBe(false)
+    expect(needsOperatorPassword([result({})])).toBe(false)
+  })
+
+  // The placeholder has to be something no operator would plausibly choose *and* invalid-looking,
+  // so that if it ever did reach a database it would be obvious in pg_authid rather than subtle.
+  it("uses an obviously-not-a-password placeholder", () => {
+    expect(PASSWORD_PLACEHOLDER).toMatch(/^<.*>$/)
+  })
+})

package/tests/doctor-render.test.ts

@@ -0,0 +1,62 @@
+import { describe, it, expect, vi, afterEach } from "vitest"
+import { printSection } from "../src/commands/doctor.js"
+
+/**
+ * How a drift item reads to the operator.
+ *
+ * Items are keyed `table` + `name`, which for an index or constraint are different things and for a
+ * *table* are the same — so the natural `table.name` form printed "widget.widget". Tables only
+ * started appearing in this report when the ownership gate got its reporting (E17), and a report an
+ * operator distrusts is worse than no report.
+ */
+const lines = (): string[] => {
+  const captured: string[] = []
+  vi.spyOn(console, "log").mockImplementation((...args: unknown[]) => {
+    captured.push(args.map(String).join(" "))
+  })
+  return captured
+}
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe("printSection", () => {
+  it("prints a table once, not twice", () => {
+    const captured = lines()
+    printSection("Unmanaged drift", [
+      {
+        kind: "table",
+        table: "widget",
+        name: "widget",
+        fields: [],
+        message: "Unmanaged table widget — push will not drop; manual decision required",
+      },
+    ])
+    const text = captured.join("\n")
+    expect(text).toContain("• widget")
+    expect(text).not.toContain("widget.widget")
+    // The message carries the whole point; a bare object name says nothing about consequence.
+    expect(text).toContain("push will not drop; manual decision required")
+  })
+
+  it("keeps the qualified form for objects on a table", () => {
+    const captured = lines()
+    printSection("Unmanaged drift", [
+      {
+        kind: "index",
+        table: "widget",
+        name: "widget_name_idx",
+        fields: ["name"],
+        message: "Unmanaged index widget_name_idx on widget — push will not drop",
+      },
+    ])
+    expect(captured.join("\n")).toContain("• widget.widget_name_idx (name)")
+  })
+
+  it("prints nothing at all for an empty section", () => {
+    const captured = lines()
+    printSection("Unmanaged drift", [])
+    expect(captured).toEqual([])
+  })
+})

package/tests/doctor-service-role.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest"
+
+// `doctor` reaches this section only after talking to the engine, so the printing is exercised here
+// instead: the section is how an operator answers "which of my functions can bypass every access rule?"
+const lines: string[] = []
+vi.mock("../src/ui/messages.js", () => ({
+  plain: (line?: string) => lines.push(line ?? ""),
+  info: () => {},
+}))
+
+const { printServiceRoleGrants } = await import("../src/commands/doctor.js")
+
+beforeEach(() => {
+  lines.length = 0
+})
+afterEach(() => {
+  vi.clearAllMocks()
+})
+
+const empty = { errors: [], missing: [], warnings: [], available: [] }
+
+describe("printServiceRoleGrants", () => {
+  it("prints nothing when a project grants nothing", () => {
+    printServiceRoleGrants(empty, [])
+    expect(lines).toEqual([])
+  })
+
+  it("lists every grant, and says what the list means", () => {
+    printServiceRoleGrants(empty, ["audit", "send-email"])
+    const out = lines.join("\n")
+    expect(out).toContain("Service-role grants (2)")
+    expect(out).toContain("• audit")
+    expect(out).toContain("• send-email")
+    expect(out).toContain("bypass every access rule")
+  })
+
+  it("marks a grant that matches no function", () => {
+    printServiceRoleGrants(
+      { ...empty, errors: ['  "send-emial" — no functions/send-emial/index.ts'], missing: ["send-emial"] },
+      ["send-emial", "audit"],
+    )
+    const out = lines.join("\n")
+    expect(out).toContain("✗ send-emial")
+    expect(out).toContain("• audit")
+    expect(out).toContain("grant nothing")
+  })
+
+  it("passes a redundant-entry warning through", () => {
+    printServiceRoleGrants(
+      { ...empty, warnings: ['  "hooks/x" is not needed — a hook receives the key'] },
+      ["hooks/x"],
+    )
+    expect(lines.join("\n")).toContain("is not needed")
+  })
+})

package/tests/env-file.test.ts

@@ -0,0 +1,121 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest"
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { MANAGED_MARKER, readEnvFile, upsertEnvFile } from "../src/env-file.js"
+
+/**
+ * `.env` is a file operators edit by hand, and the CLI rewrites it on every compose run.
+ *
+ * Two defects motivated this: the rewrite rebuilt the file from its assignments alone, so every
+ * comment and blank line vanished; and the image keys derivable from `versions` were deleted
+ * unconditionally, so `SUPATYPE_REALTIME_IMAGE` could be overridden from `.env` and
+ * `SUPATYPE_SERVER_IMAGE` could not. Same file, same shape, different rules — which is how an hour
+ * goes into wondering why a locally built image is ignored.
+ */
+let dir: string
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "supatype-env-"))
+})
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true })
+})
+
+const write = (body: string) => writeFileSync(join(dir, ".env"), body, "utf8")
+const read = () => readFileSync(join(dir, ".env"), "utf8")
+
+describe("upsertEnvFile", () => {
+  it("keeps comments, blank lines and order", () => {
+    write(`# notes about this project
+DATABASE_URL=postgres://me@host/db
+
+# the image I built by hand
+SUPATYPE_SERVER_IMAGE=my/server:local
+JWT_SECRET=abc
+`)
+    upsertEnvFile(dir, { ANON_KEY: "new" })
+
+    const after = read()
+    expect(after).toContain("# notes about this project")
+    expect(after).toContain("# the image I built by hand")
+    expect(after).toContain("SUPATYPE_SERVER_IMAGE=my/server:local")
+    // Order preserved, new keys appended.
+    expect(after.indexOf("DATABASE_URL")).toBeLessThan(after.indexOf("JWT_SECRET"))
+    expect(after.indexOf("JWT_SECRET")).toBeLessThan(after.indexOf("ANON_KEY"))
+    expect(after).toMatch(/\n\n/)
+  })
+
+  it("updates a value in place rather than moving it to the end", () => {
+    write("A=1\nB=2\nC=3\n")
+    upsertEnvFile(dir, { B: "changed" })
+    expect(read()).toBe("A=1\nB=changed\nC=3\n")
+  })
+
+  it("leaves a hand-written value alone when asked to clean up managed keys", () => {
+    // The reported bug, exactly: an operator's image override survived for realtime and was deleted
+    // for the server.
+    write("SUPATYPE_SERVER_IMAGE=my/server:local\n")
+    upsertEnvFile(dir, {}, { removeManaged: ["SUPATYPE_SERVER_IMAGE"] })
+    expect(readEnvFile(dir)["SUPATYPE_SERVER_IMAGE"]).toBe("my/server:local")
+  })
+
+  it("does clean up a value it wrote itself", () => {
+    // Otherwise removing a pin from config leaves a stale image reference that silently keeps
+    // running the old version — the reason the deletion existed at all.
+    upsertEnvFile(
+      dir,
+      { SUPATYPE_SERVER_IMAGE: "supatype/server:v1.2.3" },
+      { managed: ["SUPATYPE_SERVER_IMAGE"] },
+    )
+    expect(read()).toContain(MANAGED_MARKER)
+
+    upsertEnvFile(dir, {}, { removeManaged: ["SUPATYPE_SERVER_IMAGE"] })
+    expect(readEnvFile(dir)["SUPATYPE_SERVER_IMAGE"]).toBeUndefined()
+    // And no orphaned marker comment left behind.
+    expect(read()).not.toContain(MANAGED_MARKER)
+  })
+
+  it("takes over a hand-written value when config starts pinning it, and marks it", () => {
+    write("SUPATYPE_SERVER_IMAGE=my/server:local\n")
+    upsertEnvFile(
+      dir,
+      { SUPATYPE_SERVER_IMAGE: "supatype/server:v2.0.0" },
+      { managed: ["SUPATYPE_SERVER_IMAGE"] },
+    )
+    const after = read()
+    expect(after).toContain("SUPATYPE_SERVER_IMAGE=supatype/server:v2.0.0")
+    expect(after).toContain(MANAGED_MARKER)
+    // So the next run can clean it up again.
+    upsertEnvFile(dir, {}, { removeManaged: ["SUPATYPE_SERVER_IMAGE"] })
+    expect(readEnvFile(dir)["SUPATYPE_SERVER_IMAGE"]).toBeUndefined()
+  })
+
+  it("removes outright when asked, whoever wrote it", () => {
+    // For a seed secret being retired.
+    write("SUPATYPE_ADMIN_PASSWORD=temporary\nJWT_SECRET=keep\n")
+    upsertEnvFile(dir, {}, { remove: ["SUPATYPE_ADMIN_PASSWORD"] })
+    expect(readEnvFile(dir)["SUPATYPE_ADMIN_PASSWORD"]).toBeUndefined()
+    expect(readEnvFile(dir)["JWT_SECRET"]).toBe("keep")
+  })
+
+  it("still accepts the old array argument as an unconditional removal", () => {
+    write("GONE=1\nSTAYS=2\n")
+    upsertEnvFile(dir, {}, ["GONE"])
+    expect(readEnvFile(dir)).toEqual({ STAYS: "2" })
+  })
+
+  it("creates the file when absent", () => {
+    upsertEnvFile(dir, { A: "1" })
+    expect(read()).toBe("A=1\n")
+  })
+
+  it("does not treat a commented-out assignment as a value", () => {
+    // `# FOO=bar` is a note, not a setting — the old parser kept it as a key called "# FOO".
+    write("# FOO=bar\nREAL=1\n")
+    upsertEnvFile(dir, { REAL: "2" })
+    expect(read()).toContain("# FOO=bar")
+    expect(readEnvFile(dir)).toEqual({ REAL: "2" })
+  })
+})

package/tests/external-database-compose.test.ts

@@ -0,0 +1,184 @@
+import { describe, it, expect } from "vitest"
+import { loopbackExternalHost, renderSelfHostCompose } from "../src/self-host-compose.js"
+import { validateProjectConfig, type SupatypeProjectConfig } from "../src/project-config.js"
+import { DENO_RELEASE_PIN } from "../src/release-pins.js"
+
+/**
+ * Compose for a database Supatype does not manage.
+ *
+ * The cheap test that pins the whole workstream: no `db` service, no `@db:5432` anywhere, and every
+ * service resolving to the operator's URL. A stack that still names `db` starts six containers that
+ * cannot resolve the host, which is a confusing way to learn the config was ignored.
+ */
+const EXTERNAL_URL = "postgres://owner:secret@db.example.com:5432/app"
+
+const base = {
+  project: { name: "acme" },
+  server: { mode: "dev" as const },
+  app: { mode: "none" as const },
+  versions: {
+    engine: "0.4.2",
+    server: "0.1.0",
+    postgres: "17.2",
+    deno: DENO_RELEASE_PIN,
+  },
+}
+
+const project = (database: unknown): SupatypeProjectConfig =>
+  validateProjectConfig({ ...base, database }, "supatype.config.ts")
+
+const external = (url = EXTERNAL_URL) => project({ external: { url } })
+const managed = () => project({ provider: "docker" })
+
+describe("external database — compose", () => {
+  it("omits the db service and says why", () => {
+    const compose = renderSelfHostCompose(external())
+    expect(compose).not.toMatch(/^ {2}db:$/m)
+    expect(compose).toContain("# No `db` service: database.external")
+  })
+
+  it("keeps the db service for a managed database", () => {
+    // The gate must not cost everyone else their database.
+    const compose = renderSelfHostCompose(managed())
+    expect(compose).toMatch(/^ {2}db:$/m)
+    expect(compose).toContain("pg_isready")
+  })
+
+  it("leaves no reference to the db host anywhere", () => {
+    const compose = renderSelfHostCompose(external())
+    expect(compose).not.toContain("@db:5432")
+    expect(compose).not.toContain("db-data")
+    expect(compose).not.toContain("condition: service_healthy")
+  })
+
+  it("points every database consumer at the one URL", () => {
+    const compose = renderSelfHostCompose(external())
+    // storage, realtime, control-plane, server (SUPATYPE_SQL_DATABASE_URL), and GoTrue.
+    const references = compose.match(/\$\{DATABASE_URL:\?/g) ?? []
+    expect(references.length).toBe(5)
+  })
+
+  it("interpolates the URL rather than baking the password into the file", () => {
+    // The compose file is generated into .supatype/, which operators do commit.
+    const compose = renderSelfHostCompose(external())
+    // "secret" alone would match minio's own S3 credentials, so match the userinfo form.
+    expect(compose).not.toContain("owner:secret@")
+    expect(compose).not.toContain("://owner")
+    expect(compose).toContain("${DATABASE_URL:?DATABASE_URL is missing from .env")
+  })
+
+  it("derives PostgREST's authenticator DSN from the URL, password excepted", () => {
+    // A second full URL in .env would be one more thing to keep in step; two that disagree about
+    // which database is a split-brain nobody notices until the API and migrations diverge.
+    const compose = renderSelfHostCompose(external())
+    expect(compose).toContain(
+      "PGRST_DB_URI: postgresql://authenticator:${AUTHENTICATOR_PASSWORD:?AUTHENTICATOR_PASSWORD is missing from .env}@db.example.com:5432/app",
+    )
+  })
+
+  it("carries the URL's query string into the authenticator DSN", () => {
+    // `?sslmode=require` is the default on most managed providers, and dropping it turns a working
+    // owner connection into a PostgREST that cannot connect at all.
+    const compose = renderSelfHostCompose(
+      external("postgres://owner:secret@db.example.com:5432/app?sslmode=require"),
+    )
+    expect(compose).toContain("@db.example.com:5432/app?sslmode=require")
+  })
+
+  it("appends GoTrue's search_path with the right separator", () => {
+    // A URL that already has a query string needs `&`; a second `?` produces a DSN that fails to
+    // parse, and GoTrue would exit rather than run its auth migrations.
+    expect(renderSelfHostCompose(external())).toContain('${DATABASE_URL:?DATABASE_URL is missing from .env — required by database.external}?search_path=auth"')
+    expect(
+      renderSelfHostCompose(
+        external("postgres://owner:secret@db.example.com:5432/app?sslmode=require"),
+      ),
+    ).toContain('${DATABASE_URL:?DATABASE_URL is missing from .env — required by database.external}&search_path=auth"')
+  })
+
+  it("omits realtime entirely when the project turns it off", () => {
+    // For the operator who has read `supatype db check` and knows their database cannot do logical
+    // decoding. The service degrades on its own, so this is about not running a container whose only
+    // job would be to report that.
+    const compose = renderSelfHostCompose(project({ external: { url: EXTERNAL_URL, realtime: false } }))
+    expect(compose).not.toMatch(/^ {2}realtime:$/m)
+    expect(compose).toContain("# No `realtime` service: database.external.realtime is false")
+    // And nothing else may reference the service that is not there.
+    expect(compose).not.toContain("SUPATYPE_REALTIME_URL")
+    expect(compose).not.toContain("      realtime:\n        condition:")
+  })
+
+  it("keeps realtime when the flag is unset", () => {
+    // Unset means "probe it", not "assume it is broken" — the service reports its own capability.
+    const compose = renderSelfHostCompose(external())
+    expect(compose).toMatch(/^ {2}realtime:$/m)
+    expect(compose).toContain("SUPATYPE_REALTIME_URL: http://realtime:4000")
+  })
+
+  it("does not publish a port for a database it does not run", () => {
+    const compose = renderSelfHostCompose(external())
+    expect(compose).not.toContain('"5432:5432"')
+  })
+
+  it("still declares the volumes it does own", () => {
+    const compose = renderSelfHostCompose(external())
+    expect(compose).toContain("  minio-data:")
+    expect(compose).toContain("  valkey-data:")
+  })
+
+  it("keeps the rest of the stack intact", () => {
+    // The db service is the only thing that goes; a missing storage or realtime service would be a
+    // far quieter failure than a missing database.
+    const compose = renderSelfHostCompose(external())
+    for (const service of [
+      "postgrest:",
+      "storage:",
+      "functions-worker:",
+      "realtime:",
+      "control-plane:",
+      "server:",
+      "minio:",
+      "schema-engine:",
+      "studio:",
+      "valkey:",
+      "kong:",
+    ]) {
+      expect(compose).toContain(`  ${service}`)
+    }
+  })
+
+  it("renders valid YAML shape for the server's remaining dependencies", () => {
+    // The server waited on db *and* six others, so removing one entry must not leave a dangling
+    // `depends_on:` or a stray blank mapping key.
+    const compose = renderSelfHostCompose(external())
+    expect(compose).toContain("    depends_on:\n      valkey:\n        condition: service_started")
+  })
+})
+
+describe("a loopback external URL", () => {
+  // Found by rehearsing a push against a real external Postgres: `db check` passed and `push`
+  // applied the schema, because the CLI runs on the host — then storage, realtime and the server all
+  // died with ECONNREFUSED against their own loopback, because inside a container `127.0.0.1` is
+  // that container. A retry loop would only have hidden it.
+  it("is detected, whatever form it takes", () => {
+    for (const host of ["localhost", "127.0.0.1", "127.0.0.53", "[::1]"]) {
+      const url = host.startsWith("[")
+        ? `postgres://u:p@${host}:5432/d`
+        : `postgres://u:p@${host}:5432/d`
+      expect(loopbackExternalHost(project({ external: { url } })), host).toBeDefined()
+    }
+  })
+
+  it("does not fire for a host containers can actually reach", () => {
+    for (const host of ["host.docker.internal", "db.example.com", "172.17.0.1", "10.0.0.5"]) {
+      expect(
+        loopbackExternalHost(project({ external: { url: `postgres://u:p@${host}:5432/d` } })),
+        host,
+      ).toBeUndefined()
+    }
+  })
+
+  it("does not fire for a managed database", () => {
+    expect(loopbackExternalHost(managed())).toBeUndefined()
+  })
+})