@supatype/cli 0.1.5 → 0.1.7

package/tests/external-database-config.test.ts

@@ -0,0 +1,154 @@
+import { describe, it, expect } from "vitest"
+import {
+  connectionString,
+  externalDatabaseUrl,
+  realtimeEnabled,
+  usesExternalDatabase,
+  validateProjectConfig,
+  type SupatypeProjectConfig,
+} from "../src/project-config.js"
+
+/**
+ * `database.external` points the stack at a Postgres Supatype did not create.
+ *
+ * Every rejection here is a case where two settings describe the same fact. Picking a silent winner
+ * is how a push lands somewhere other than where the services read, which presents as data loss and
+ * is not.
+ */
+const EXTERNAL_URL = "postgres://owner:secret@db.example.com:5432/app"
+
+const raw = (database: unknown, rest: Record<string, unknown> = {}): unknown => ({
+  project: { name: "acme" },
+  database,
+  server: { mode: "dev" },
+  app: { mode: "none" },
+  ...rest,
+})
+
+const validate = (database: unknown, rest?: Record<string, unknown>) =>
+  validateProjectConfig(raw(database, rest), "supatype.config.ts")
+
+describe("database.external — accepted", () => {
+  it("accepts a url on its own, with no database.provider", () => {
+    const cfg = validate({ external: { url: EXTERNAL_URL } })
+    expect(externalDatabaseUrl(cfg)).toBe(EXTERNAL_URL)
+    expect(usesExternalDatabase(cfg)).toBe(true)
+  })
+
+  it("leaves a managed project alone", () => {
+    const cfg = validate({ provider: "docker" })
+    expect(usesExternalDatabase(cfg)).toBe(false)
+    expect(externalDatabaseUrl(cfg)).toBeUndefined()
+  })
+
+  it("accepts postgresql:// as well as postgres://", () => {
+    expect(() => validate({ external: { url: "postgresql://u:p@h:5432/d" } })).not.toThrow()
+  })
+
+  it("accepts an identical `connection`, since nothing is ambiguous", () => {
+    expect(() =>
+      validate({ external: { url: EXTERNAL_URL } }, { connection: EXTERNAL_URL }),
+    ).not.toThrow()
+  })
+})
+
+describe("database.external — rejected", () => {
+  it("rejects a missing url", () => {
+    expect(() => validate({ external: {} })).toThrow(/database\.external\.url is required/)
+    expect(() => validate({ external: { url: "   " } })).toThrow(
+      /database\.external\.url is required/,
+    )
+  })
+
+  it("rejects a url that is not Postgres, naming what it got", () => {
+    // A `mysql://` or a bare host is a typo, and the failure it would otherwise cause is six
+    // services failing to connect with no mention of the setting responsible.
+    expect(() => validate({ external: { url: "mysql://u:p@h/d" } })).toThrow(
+      /must be a postgres:\/\/ or postgresql:\/\/ URL \(got "mysql:\/\/u:p@h\/d"\)/,
+    )
+    expect(() => validate({ external: { url: "db.example.com:5432" } })).toThrow(
+      /must be a postgres/,
+    )
+  })
+
+  it("rejects external beside database.provider instead of picking one", () => {
+    expect(() => validate({ provider: "docker", external: { url: EXTERNAL_URL } })).toThrow(
+      /cannot both be set/,
+    )
+    // And says which to remove, since the top-level `provider` still chooses the runtime stack.
+    expect(() => validate({ provider: "native", external: { url: EXTERNAL_URL } })).toThrow(
+      /Remove database\.provider/,
+    )
+  })
+
+  it("rejects external on the cloud path", () => {
+    expect(() =>
+      validateProjectConfig(
+        {
+          project: { name: "acme" },
+          database: { external: { url: EXTERNAL_URL } },
+          server: { mode: "managed" },
+          app: { mode: "none" },
+        },
+        "supatype.config.ts",
+      ),
+    ).toThrow(/not supported with server\.mode "managed"/)
+  })
+
+  it("rejects a `connection` that disagrees with the external url", () => {
+    expect(() =>
+      validate(
+        { external: { url: EXTERNAL_URL } },
+        { connection: "postgres://elsewhere:5432/other" },
+      ),
+    ).toThrow(/both set and disagree/)
+  })
+
+  it("rejects a non-boolean realtime flag", () => {
+    expect(() => validate({ external: { url: EXTERNAL_URL, realtime: "no" } })).toThrow(
+      /realtime must be true or false/,
+    )
+  })
+
+  it("rejects a non-object external block", () => {
+    expect(() => validate({ external: EXTERNAL_URL })).toThrow(/must be an object with a url/)
+    expect(() => validate({ external: [EXTERNAL_URL] })).toThrow(/must be an object with a url/)
+  })
+})
+
+describe("resolution", () => {
+  const external = (realtime?: boolean): SupatypeProjectConfig =>
+    validate({
+      external: { url: EXTERNAL_URL, ...(realtime !== undefined && { realtime }) },
+    })
+
+  it("uses the external url for CLI commands too", () => {
+    // Ahead of DATABASE_URL deliberately: a push that went to the env var's database while the
+    // services read from the external one is indistinguishable from losing the data.
+    const previous = process.env["DATABASE_URL"]
+    process.env["DATABASE_URL"] = "postgres://env:5432/env"
+    try {
+      expect(connectionString(external())).toBe(EXTERNAL_URL)
+    } finally {
+      if (previous === undefined) delete process.env["DATABASE_URL"]
+      else process.env["DATABASE_URL"] = previous
+    }
+  })
+
+  it("leaves DATABASE_URL in charge for a managed project", () => {
+    const previous = process.env["DATABASE_URL"]
+    process.env["DATABASE_URL"] = "postgres://env:5432/env"
+    try {
+      expect(connectionString(validate({ provider: "docker" }))).toBe("postgres://env:5432/env")
+    } finally {
+      if (previous === undefined) delete process.env["DATABASE_URL"]
+      else process.env["DATABASE_URL"] = previous
+    }
+  })
+
+  it("runs realtime unless told not to", () => {
+    expect(realtimeEnabled(external())).toBe(true)
+    expect(realtimeEnabled(external(false))).toBe(false)
+    expect(realtimeEnabled(validate({ provider: "docker" }))).toBe(true)
+  })
+})

package/tests/field-masking-tier.test.ts

@@ -0,0 +1,184 @@
+import { describe, it, expect } from "vitest"
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import {
+  fieldMaskingTier,
+  imageShipsMaskExtension,
+  nativeMaskLibraryPresent,
+  schemaHasFieldRules,
+} from "../src/field-masking-tier.js"
+import { apiSchemaList, validateProjectConfig, type SupatypeProjectConfig } from "../src/project-config.js"
+
+/**
+ * Which mechanism will enforce per-column rules, decided without touching the database.
+ *
+ * The engine decides the same thing at push time by asking Postgres whether `supatype_mask` is
+ * installed. The CLI has to answer earlier, because it writes `PGRST_DB_SCHEMA` when it generates
+ * compose. It can, because the extension needs `shared_preload_libraries` and a compiled library on
+ * the host: exactly one path ships it.
+ *
+ * The rule is deliberately **not** "is the database external". A native `supatype dev` has no
+ * extension either, and calling that tier 1 would point PostgREST at a schema whose tables the API
+ * roles no longer hold privileges on — every request denied.
+ */
+const project = (database: unknown, rest: Record<string, unknown> = {}): SupatypeProjectConfig =>
+  validateProjectConfig(
+    {
+      project: { name: "acme" },
+      database,
+      server: { mode: "dev" },
+      app: { mode: "none" },
+      ...rest,
+    },
+    "supatype.config.ts",
+  )
+
+const withRules = {
+  models: [
+    {
+      annotations: {
+        db: { tableName: "employee" },
+        platform: { access: { fields: { salary: { read: { type: "private" } } } } },
+      },
+    },
+  ],
+}
+const withoutRules = {
+  models: [{ annotations: { db: { tableName: "employee" }, platform: { access: {} } } }],
+}
+
+describe("imageShipsMaskExtension", () => {
+  it("is true only for the Supatype Postgres image", () => {
+    expect(imageShipsMaskExtension(project({ provider: "docker" }))).toBe(true)
+  })
+
+  it("is false for native, which is the default `supatype dev`", () => {
+    // The case that makes "is it external" the wrong rule.
+    expect(imageShipsMaskExtension(project({ provider: "native" }))).toBe(false)
+  })
+
+  it("is false for an external database", () => {
+    expect(
+      imageShipsMaskExtension(project({ external: { url: "postgres://u@h:5432/d" } })),
+    ).toBe(false)
+  })
+
+  it("is false when the Postgres image is overridden", () => {
+    // Someone running plain `postgres:17` under `provider: docker` has no extension, whatever the
+    // provider says.
+    expect(imageShipsMaskExtension(project({ provider: "docker", image: "postgres:17" }))).toBe(
+      false,
+    )
+    expect(
+      imageShipsMaskExtension(project({ provider: "docker", image: "supatype/postgres:17-latest" })),
+    ).toBe(true)
+  })
+})
+
+describe("schemaHasFieldRules", () => {
+  it("sees a masked column", () => {
+    expect(schemaHasFieldRules(withRules)).toBe(true)
+  })
+
+  it("is false without one, and for anything unexpected", () => {
+    expect(schemaHasFieldRules(withoutRules)).toBe(false)
+    expect(schemaHasFieldRules({ models: [] })).toBe(false)
+    expect(schemaHasFieldRules(null)).toBe(false)
+    expect(schemaHasFieldRules({})).toBe(false)
+  })
+
+  it("is false for an empty fields map", () => {
+    // Present but empty means no column is masked, so nothing needs a view.
+    const empty = {
+      models: [{ annotations: { platform: { access: { fields: {} } } } }],
+    }
+    expect(schemaHasFieldRules(empty)).toBe(false)
+  })
+})
+
+describe("fieldMaskingTier", () => {
+  it("is none when nothing is masked, whatever the database", () => {
+    // With no field rules the engine generates no views, so pointing the API at `api` would serve
+    // nothing at all.
+    expect(fieldMaskingTier(project({ provider: "native" }), withoutRules)).toBe("none")
+    expect(fieldMaskingTier(project({ provider: "docker" }), withoutRules)).toBe("none")
+  })
+
+  it("is extension on the image and views everywhere else", () => {
+    expect(fieldMaskingTier(project({ provider: "docker" }), withRules)).toBe("extension")
+    expect(fieldMaskingTier(project({ provider: "native" }), withRules)).toBe("views")
+    expect(
+      fieldMaskingTier(project({ external: { url: "postgres://u@h:5432/d" } }), withRules),
+    ).toBe("views")
+  })
+})
+
+describe("the exposed schema list", () => {
+  it("serves from api under tier 2, and drops the managed schema", () => {
+    // Both halves matter. A client picks its schema per request with `Accept-Profile`, so leaving the
+    // managed schema exposed would let any caller read the unmasked table.
+    const list = apiSchemaList(project({ provider: "native" }), "views")
+    expect(list).toBe("api, supatype, graphql_public, auth")
+    // Entries, not substrings: `graphql_public` legitimately contains "public".
+    expect(list.split(", ")).not.toContain("public")
+  })
+
+  it("is unchanged for tier 1 and for a schema with no field rules", () => {
+    for (const tier of ["extension", "none", undefined] as const) {
+      expect(apiSchemaList(project({ provider: "docker" }), tier)).toBe(
+        "public, supatype, graphql_public, auth",
+      )
+    }
+  })
+
+  it("still lets an explicit api_schemas win", () => {
+    // The escape hatch for the one case the offline rule cannot call: a self-managed Postgres where
+    // the operator installed the extension themselves.
+    const cfg = project({ external: { url: "postgres://u@h:5432/d" } }, {
+      schema: { api_schemas: ["public", "supatype"] },
+    })
+    expect(apiSchemaList(cfg, "views")).toBe("public, supatype")
+  })
+})
+
+describe("nativeMaskLibraryPresent", () => {
+  it("is false for an install without the library", () => {
+    // The case that must not be assumed away: an archive downloaded before the library was bundled.
+    // Claiming tier 1 for it would select the planner rewrite and the push would be refused.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-pg-"))
+    mkdirSync(join(dir, "bin"), { recursive: true })
+    mkdirSync(join(dir, "lib", "postgresql"), { recursive: true })
+    expect(nativeMaskLibraryPresent(join(dir, "bin"))).toBe(false)
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it("finds the library in either archive layout", () => {
+    // Linux and macOS put extension libraries in `lib/`; the Windows archive uses `lib/postgresql/`.
+    for (const [subdir, lib] of [
+      [["lib"], "supatype_mask.so"],
+      [["lib"], "supatype_mask.dylib"],
+      [["lib", "postgresql"], "supatype_mask.dll"],
+    ] as const) {
+      const dir = mkdtempSync(join(tmpdir(), "supatype-pg-"))
+      mkdirSync(join(dir, "bin"), { recursive: true })
+      mkdirSync(join(dir, ...subdir), { recursive: true })
+      writeFileSync(join(dir, ...subdir, lib), "")
+      expect(nativeMaskLibraryPresent(join(dir, "bin")), lib).toBe(true)
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it("is false without an install directory at all", () => {
+    expect(nativeMaskLibraryPresent(null)).toBe(false)
+    expect(nativeMaskLibraryPresent(undefined)).toBe(false)
+  })
+
+  it("selects the extension tier when the library is installed", () => {
+    // The point of the whole change: native dev enforces field rules the same way the image does.
+    expect(fieldMaskingTier(project({ provider: "native" }), withRules, true)).toBe("extension")
+    expect(fieldMaskingTier(project({ provider: "native" }), withRules, false)).toBe("views")
+    // Still nothing to enforce when no column is masked.
+    expect(fieldMaskingTier(project({ provider: "native" }), withoutRules, true)).toBe("none")
+  })
+})

package/tests/functions-deno-types.test.ts

@@ -0,0 +1,197 @@
+import { spawnSync } from "node:child_process"
+import { createRequire } from "node:module"
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync, existsSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { dirname, join } from "node:path"
+import { afterEach, describe, expect, it } from "vitest"
+import {
+  ensureFunctionsDenoTypes,
+  functionsDenoAmbientSource,
+  functionsTsConfigSource,
+} from "../src/functions-deno-types.js"
+
+const require = createRequire(import.meta.url)
+
+function resolveTscBin(): string {
+  const typescriptEntry = require.resolve("typescript/package.json")
+  return join(dirname(typescriptEntry), "bin", "tsc")
+}
+
+function runTsc(projectDir: string): { status: number | null; stdout: string; stderr: string } {
+  const result = spawnSync(process.execPath, [resolveTscBin(), "-p", "tsconfig.json", "--pretty", "false"], {
+    cwd: projectDir,
+    encoding: "utf8",
+  })
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+  }
+}
+
+const HANDLER_WITH_DENO = `export default async function handler(req: Request): Promise<Response> {
+  const url = Deno.env.get("SUPATYPE_URL")
+  return new Response(JSON.stringify({ url, method: req.method }), {
+    headers: { "Content-Type": "application/json" },
+  })
+}
+`
+
+describe("ensureFunctionsDenoTypes", () => {
+  let tmpRoot = ""
+
+  afterEach(() => {
+    if (tmpRoot) rmSync(tmpRoot, { recursive: true, force: true })
+    tmpRoot = ""
+  })
+
+  it("writes deno.d.ts and tsconfig.json under functions/", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-types-"))
+    const functionsDir = join(tmpRoot, "functions")
+
+    const result = ensureFunctionsDenoTypes(tmpRoot, functionsDir)
+
+    expect(result.wroteDenoDts).toBe(true)
+    expect(result.wroteTsconfig).toBe(true)
+    expect(existsSync(join(functionsDir, "deno.d.ts"))).toBe(true)
+    expect(existsSync(join(functionsDir, "tsconfig.json"))).toBe(true)
+    expect(readFileSync(join(functionsDir, "deno.d.ts"), "utf8")).toContain("declare namespace Deno")
+    expect(readFileSync(join(functionsDir, "tsconfig.json"), "utf8")).toContain('"types": []')
+  })
+
+  it("is idempotent when files already exist", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-types-"))
+    const functionsDir = join(tmpRoot, "functions")
+    mkdirSync(functionsDir, { recursive: true })
+    writeFileSync(join(functionsDir, "deno.d.ts"), "// custom\n", "utf8")
+    writeFileSync(join(functionsDir, "tsconfig.json"), "{}\n", "utf8")
+
+    const result = ensureFunctionsDenoTypes(tmpRoot, functionsDir)
+
+    expect(result.wroteDenoDts).toBe(false)
+    expect(result.wroteTsconfig).toBe(false)
+    expect(readFileSync(join(functionsDir, "deno.d.ts"), "utf8")).toBe("// custom\n")
+  })
+
+  it("adds functions to root tsconfig exclude when possible", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-types-"))
+    writeFileSync(
+      join(tmpRoot, "tsconfig.json"),
+      JSON.stringify({
+        compilerOptions: { strict: true },
+        include: ["**/*.ts"],
+        exclude: ["node_modules"],
+      }, null, 2),
+      "utf8",
+    )
+    const functionsDir = join(tmpRoot, "functions")
+
+    const result = ensureFunctionsDenoTypes(tmpRoot, functionsDir)
+
+    expect(result.rootExclude).toBe("updated")
+    const root = JSON.parse(readFileSync(join(tmpRoot, "tsconfig.json"), "utf8")) as {
+      exclude: string[]
+    }
+    expect(root.exclude).toContain("functions")
+    expect(root.exclude).toContain("node_modules")
+  })
+
+  it("reports already when functions is already excluded", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-types-"))
+    writeFileSync(
+      join(tmpRoot, "tsconfig.json"),
+      JSON.stringify({ exclude: ["node_modules", "functions"] }, null, 2),
+      "utf8",
+    )
+
+    const result = ensureFunctionsDenoTypes(tmpRoot, join(tmpRoot, "functions"))
+    expect(result.rootExclude).toBe("already")
+  })
+
+  it("templates include Deno.env", () => {
+    expect(functionsDenoAmbientSource()).toContain("const env: DenoEnv")
+    expect(functionsTsConfigSource()).toContain("deno.d.ts")
+  })
+})
+
+/**
+ * Manual / end-to-end check: real `tsc` against a scaffolded functions dir.
+ * Proves Deno.env is typed (no TS2304) once deno.d.ts + functions/tsconfig exist.
+ */
+describe("functions Deno types (tsc manual check)", () => {
+  let tmpRoot = ""
+
+  afterEach(() => {
+    if (tmpRoot) rmSync(tmpRoot, { recursive: true, force: true })
+    tmpRoot = ""
+  })
+
+  it("tsc fails with Cannot find name Deno without ambient types", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-tsc-baseline-"))
+    const fnDir = join(tmpRoot, "hello")
+    mkdirSync(fnDir, { recursive: true })
+    writeFileSync(join(fnDir, "index.ts"), HANDLER_WITH_DENO, "utf8")
+    writeFileSync(
+      join(tmpRoot, "tsconfig.json"),
+      JSON.stringify(
+        {
+          compilerOptions: {
+            target: "ES2022",
+            lib: ["ES2022", "DOM"],
+            strict: true,
+            noEmit: true,
+            module: "ESNext",
+            moduleResolution: "bundler",
+            types: [],
+          },
+          include: ["./**/*.ts"],
+        },
+        null,
+        2,
+      ),
+      "utf8",
+    )
+
+    const { status, stdout, stderr } = runTsc(tmpRoot)
+    const out = `${stdout}\n${stderr}`
+    expect(status).not.toBe(0)
+    expect(out).toMatch(/Cannot find name 'Deno'|TS2304/)
+  })
+
+  it("tsc passes for Deno.env after ensureFunctionsDenoTypes", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-tsc-ok-"))
+    const functionsDir = join(tmpRoot, "functions")
+    mkdirSync(join(functionsDir, "hello"), { recursive: true })
+    writeFileSync(join(functionsDir, "hello", "index.ts"), HANDLER_WITH_DENO, "utf8")
+    writeFileSync(
+      join(tmpRoot, "tsconfig.json"),
+      JSON.stringify(
+        {
+          compilerOptions: {
+            target: "ES2022",
+            lib: ["ES2022", "DOM"],
+            strict: true,
+            noEmit: true,
+            module: "ESNext",
+            moduleResolution: "bundler",
+          },
+          include: ["**/*.ts"],
+          exclude: ["node_modules"],
+        },
+        null,
+        2,
+      ),
+      "utf8",
+    )
+
+    const ensured = ensureFunctionsDenoTypes(tmpRoot, functionsDir)
+    expect(ensured.wroteDenoDts).toBe(true)
+    expect(ensured.wroteTsconfig).toBe(true)
+    expect(ensured.rootExclude).toBe("updated")
+
+    const { status, stdout, stderr } = runTsc(functionsDir)
+    const out = `${stdout}\n${stderr}`
+    expect(out, `tsc stderr/stdout:\n${out}`).not.toMatch(/Cannot find name 'Deno'|TS2304/)
+    expect(status, `tsc failed:\n${out}`).toBe(0)
+  })
+})

package/tests/homebrew-formula.test.ts

@@ -0,0 +1,58 @@
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { spawnSync } from "node:child_process"
+import { afterEach, beforeEach, describe, expect, it } from "vitest"
+
+let counter = 0
+let tmpDir: string
+
+const PLATFORMS = [
+  "supatype-cli-darwin-arm64",
+  "supatype-cli-darwin-amd64",
+  "supatype-cli-linux-arm64",
+  "supatype-cli-linux-amd64",
+]
+
+beforeEach(() => {
+  tmpDir = join(tmpdir(), `homebrew-formula-${Date.now()}-${++counter}`)
+  mkdirSync(tmpDir, { recursive: true })
+  for (const name of PLATFORMS) {
+    writeFileSync(join(tmpDir, name), `stub-${name}\n`, "utf8")
+  }
+})
+
+afterEach(() => {
+  rmSync(tmpDir, { recursive: true, force: true })
+})
+
+describe("generate-homebrew-formula.mjs", () => {
+  it("writes a Formula with versioned CDN URLs and sha256 blocks", () => {
+    const outPath = join(tmpDir, "supatype.rb")
+    const script = join(import.meta.dirname, "../scripts/generate-homebrew-formula.mjs")
+    const result = spawnSync(
+      process.execPath,
+      [script, "9.9.9", tmpDir],
+      {
+        encoding: "utf8",
+        env: { ...process.env, HOMEBREW_FORMULA_OUT: outPath },
+      },
+    )
+
+    expect(result.status, result.stderr).toBe(0)
+    const formula = readFileSync(outPath, "utf8")
+    expect(formula).toContain('version "9.9.9"')
+    expect(formula).toContain("https://releases.supatype.com/cli/v9.9.9/supatype-cli-darwin-arm64")
+    expect(formula).toMatch(/sha256 "[a-f0-9]{64}"/)
+    expect(formula).toContain('system bin/"supatype", "_postinstall"')
+    expect(formula).toContain('bin.install "supatype-cli-#{arch}" => "supatype"')
+  })
+
+  it("fails when an artifact is missing", () => {
+    rmSync(join(tmpDir, "supatype-cli-linux-amd64"))
+    const script = join(import.meta.dirname, "../scripts/generate-homebrew-formula.mjs")
+    const result = spawnSync(process.execPath, [script, "1.0.0", tmpDir], { encoding: "utf8" })
+    expect(result.status).not.toBe(0)
+    expect(result.stderr).toContain("Missing artifact")
+  })
+})