@supatype/cli 0.1.5 → 0.1.7

package/tests/hook-upload.test.ts

@@ -0,0 +1,125 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { describe, expect, it } from "vitest"
+
+import { ADAPTER_KEY, readHookUpload } from "../src/hook-upload.js"
+
+function project(): { cwd: string; hooks: string } {
+  const cwd = mkdtempSync(join(tmpdir(), "supatype-hook-upload-"))
+  const hooks = join(cwd, "hooks")
+  mkdirSync(hooks, { recursive: true })
+  return { cwd, hooks }
+}
+
+function writeHook(hooks: string, name: string, source: string, extra?: Record<string, string>): void {
+  const dir = join(hooks, name)
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(join(dir, "index.ts"), source, "utf8")
+  for (const [file, contents] of Object.entries(extra ?? {})) {
+    writeFileSync(join(dir, file), contents, "utf8")
+  }
+}
+
+/** An AST shaped as the extractor produces, carrying one hooked model. */
+function astWith(hooks: Record<string, string>): unknown {
+  return {
+    models: [
+      {
+        name: "Post",
+        fields: [],
+        annotations: {
+          db: { tableName: "posts" },
+          platform: {
+            hooks: Object.fromEntries(
+              Object.entries(hooks).map(([event, fn]) => [event, { function: fn }]),
+            ),
+          },
+        },
+      },
+    ],
+  }
+}
+
+const HANDLER = `import { hook, type BeforeChange } from "../_supatype/hooks.ts"
+
+const moderate: BeforeChange<"posts"> = async () => ({})
+export default hook(moderate)
+`
+
+describe("readHookUpload", () => {
+  it("is null when the schema names no hooks", () => {
+    const { cwd, hooks } = project()
+    expect(readHookUpload(cwd, hooks, astWith({}))).toBeNull()
+  })
+
+  it("rewrites the generated adapter import to the flattened name", () => {
+    // The nested path cannot survive flattening, and this is the specifier our own scaffold writes.
+    const { cwd, hooks } = project()
+    writeHook(hooks, "moderate-post", HANDLER)
+
+    const upload = readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" }))
+    expect(upload?.handlers).toHaveLength(1)
+    expect(upload?.handlers[0]?.source).toContain(`./${ADAPTER_KEY}`)
+    expect(upload?.handlers[0]?.source).not.toContain("../_supatype/hooks.ts")
+  })
+
+  it("uploads only the handlers the schema names", () => {
+    // An unnamed handler would sit on the worker holding the service-role key with nothing able to
+    // call it. Uploading it buys nothing and widens what runs with that credential.
+    const { cwd, hooks } = project()
+    writeHook(hooks, "moderate-post", HANDLER)
+    writeHook(hooks, "abandoned", HANDLER)
+
+    const upload = readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" }))
+    expect(upload?.handlers.map((h) => h.name)).toEqual(["moderate-post"])
+  })
+
+  it("carries the hook map alongside the sources", () => {
+    // Both halves in one payload: a map naming a handler whose source has not arrived is the failure
+    // this whole feature is meant to avoid.
+    const { cwd, hooks } = project()
+    writeHook(hooks, "moderate-post", HANDLER)
+
+    const upload = readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" }))
+    expect(upload?.map["posts"]?.["beforeChange"]?.function).toBe("moderate-post")
+  })
+
+  it("refuses a hook with a second file rather than dropping it", () => {
+    // Silent truncation would deploy successfully and fail at import — which reads to the caller as
+    // that table's writes being broken for no visible reason.
+    const { cwd, hooks } = project()
+    writeHook(hooks, "moderate-post", HANDLER, { "helpers.ts": "export const x = 1\n" })
+
+    expect(() => readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" })))
+      .toThrow(/more than one file \(helpers\.ts\)/)
+  })
+
+  it("refuses a relative import it cannot resolve after flattening", () => {
+    const { cwd, hooks } = project()
+    writeHook(hooks, "moderate-post", `import { x } from "./helpers.ts"\nexport default () => x\n`)
+
+    expect(() => readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" })))
+      .toThrow(/imports \.\/helpers\.ts/)
+  })
+
+  it("leaves bare specifiers and URLs alone", () => {
+    // Only relative paths depend on the layout. A hook is expected to import from npm: or https:.
+    const { cwd, hooks } = project()
+    writeHook(
+      hooks,
+      "moderate-post",
+      `import { z } from "npm:zod"\nimport { j } from "https://esm.sh/joi"\n` + HANDLER,
+    )
+
+    const upload = readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" }))
+    expect(upload?.handlers).toHaveLength(1)
+  })
+
+  it("names the missing handler when a declared hook has no source", () => {
+    const { cwd, hooks } = project()
+
+    expect(() => readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" })))
+      .toThrow(/moderate-post/)
+  })
+})

package/tests/hooks-generator.test.ts

@@ -0,0 +1,212 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { execFileSync } from "node:child_process"
+import { afterEach, describe, expect, it } from "vitest"
+import { generateHooksModule } from "../src/hooks-generator.js"
+import { extractSchemaAstFromTypes } from "../src/type-extractor.js"
+
+const dirs: string[] = []
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true })
+})
+
+function astFor(schema: string): unknown {
+  const dir = mkdtempSync(join(tmpdir(), "supatype-hooksgen-"))
+  dirs.push(dir)
+  const schemaPath = join(dir, "schema.ts")
+  writeFileSync(schemaPath, schema, "utf8")
+  return extractSchemaAstFromTypes(schemaPath, dir)
+}
+
+const HOOKED_SCHEMA = `
+import type { Model, Optional, RichText, Timestamp, UUID } from "@supatype/types"
+
+export type Post = Model<{
+  id: UUID
+  title: string
+  body: RichText
+  views: Optional<number>
+  created_at: Timestamp
+}, {
+  tableName: "posts"
+  hooks: { beforeChange: "moderate-post"; afterDelete: "purge-post" }
+}>
+
+export type Comment = Model<{ id: UUID; body: string }, { tableName: "comments" }>
+`
+
+describe("generateHooksModule", () => {
+  it("returns null when nothing declares a hook", () => {
+    const ast = astFor(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    // A generated file nobody imports is a file somebody eventually edits.
+    expect(generateHooksModule(ast)).toBeNull()
+  })
+
+  it("includes only the tables that declare a hook", () => {
+    const module = generateHooksModule(astFor(HOOKED_SCHEMA))
+    expect(module).not.toBeNull()
+    expect(module).toContain('"posts": {')
+    // `HookedTable` is what makes `BeforeChange<"comments">` a compile error, so an unhooked table
+    // must not appear at all.
+    expect(module).not.toContain('"comments": {')
+  })
+
+  it("carries the model's real columns into Row, Insert and Update", () => {
+    const module = generateHooksModule(astFor(HOOKED_SCHEMA)) ?? ""
+    expect(module).toContain("title: string")
+    // `created_at` is server-generated, so it is optional on insert but present on a row.
+    expect(module).toMatch(/Insert: \{[\s\S]*created_at\?:/)
+    expect(module).toMatch(/Row: \{[\s\S]*created_at: string/)
+    // Every column is optional on a patch.
+    expect(module).toMatch(/Update: \{[\s\S]*title\?: string/)
+  })
+})
+
+describe("the generated module compiles", () => {
+  /**
+   * The generator emits TypeScript, so the only test that really proves it works is a compiler.
+   * A missing brace or a type that does not resolve would otherwise reach a user's editor — and this
+   * file is imported by their hook, so a broken emit breaks their function rather than our build.
+   */
+  it("typechecks under strict mode, together with a handler that uses it", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-hookscompile-"))
+    dirs.push(dir)
+
+    const module = generateHooksModule(astFor(HOOKED_SCHEMA))
+    expect(module).not.toBeNull()
+    writeFileSync(join(dir, "hooks.ts"), module ?? "", "utf8")
+
+    // `supatype functions new` writes a `functions/deno.d.ts`, which is where a real project gets
+    // this. The generated module uses `Deno.env` to find the API, so the fixture needs it too.
+    writeFileSync(
+      join(dir, "deno.d.ts"),
+      `declare namespace Deno {
+  const env: { get(key: string): string | undefined }
+}
+`,
+      "utf8",
+    )
+
+    // A handler written the way the docs will show it, including the narrowing that the
+    // discriminated union is there to provide.
+    writeFileSync(
+      join(dir, "handler.ts"),
+      `import { hook, type AfterDelete, type BeforeChange } from "./hooks.ts"
+
+const moderate: BeforeChange<"posts"> = async (ctx) => {
+  if (ctx.operation === "insert") {
+    if (ctx.rows.some((r) => r.title.trim() === "")) return { reject: "A post needs a title" }
+    return { rows: ctx.rows.map((r) => ({ ...r, title: r.title.trim() })) }
+  }
+  const { rows, truncated } = await ctx.previous()
+  if (truncated) return { reject: { message: "Too many rows", status: 409 } }
+  if (rows.length === 0) return {}
+  return { patch: { ...ctx.patch, title: ctx.patch.title ?? rows[0]!.title } }
+}
+
+const purge: AfterDelete<"posts"> = async (ctx) => {
+  void ctx.filter
+}
+
+export default hook(moderate)
+export const alsoPurge = hook(purge)
+`,
+      "utf8",
+    )
+
+    writeFileSync(
+      join(dir, "tsconfig.json"),
+      JSON.stringify({
+        compilerOptions: {
+          strict: true,
+          exactOptionalPropertyTypes: true,
+          noEmit: true,
+          target: "ES2022",
+          module: "Preserve",
+          moduleResolution: "bundler",
+          allowImportingTsExtensions: true,
+          lib: ["ES2022", "DOM"],
+          types: [],
+        },
+        include: ["*.ts"],
+      }),
+      "utf8",
+    )
+
+    const tsc = join(__dirname, "..", "..", "..", "node_modules", "typescript", "bin", "tsc")
+    let output = ""
+    try {
+      execFileSync(process.execPath, [tsc, "-p", join(dir, "tsconfig.json")], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+      })
+    } catch (err) {
+      const failure = err as { stdout?: string; stderr?: string }
+      output = `${failure.stdout ?? ""}${failure.stderr ?? ""}`
+    }
+    expect(output).toBe("")
+  })
+
+  it("rejects a handler for a table that declares no hook", () => {
+    // The point of `HookedTable`: naming an unhooked table must not silently produce a handler that
+    // never runs.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-hooksneg-"))
+    dirs.push(dir)
+    writeFileSync(join(dir, "hooks.ts"), generateHooksModule(astFor(HOOKED_SCHEMA)) ?? "", "utf8")
+    // `supatype functions new` writes a `functions/deno.d.ts`, which is where a real project gets
+    // this. The generated module uses `Deno.env` to find the API, so the fixture needs it too.
+    writeFileSync(
+      join(dir, "deno.d.ts"),
+      `declare namespace Deno {
+  const env: { get(key: string): string | undefined }
+}
+`,
+      "utf8",
+    )
+
+    writeFileSync(
+      join(dir, "handler.ts"),
+      `import type { BeforeChange } from "./hooks.ts"
+const nope: BeforeChange<"comments"> = async () => ({})
+export default nope
+`,
+      "utf8",
+    )
+    writeFileSync(
+      join(dir, "tsconfig.json"),
+      JSON.stringify({
+        compilerOptions: {
+          strict: true,
+          noEmit: true,
+          target: "ES2022",
+          module: "Preserve",
+          moduleResolution: "bundler",
+          allowImportingTsExtensions: true,
+          lib: ["ES2022", "DOM"],
+          types: [],
+        },
+        include: ["*.ts"],
+      }),
+      "utf8",
+    )
+
+    const tsc = join(__dirname, "..", "..", "..", "node_modules", "typescript", "bin", "tsc")
+    let output = ""
+    try {
+      execFileSync(process.execPath, [tsc, "-p", join(dir, "tsconfig.json")], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+      })
+    } catch (err) {
+      const failure = err as { stdout?: string; stderr?: string }
+      output = `${failure.stdout ?? ""}${failure.stderr ?? ""}`
+    }
+    expect(output).toContain("comments")
+  })
+})

package/tests/init.test.ts

@@ -289,6 +289,9 @@ describe("scaffold()", () => {
     expect(existsSync(join(tmpRoot, "functions/hello/index.ts"))).toBe(true)
     expect(existsSync(join(tmpRoot, "functions/_shared/README.md"))).toBe(true)
     expect(existsSync(join(tmpRoot, "functions/.env.local"))).toBe(true)
+    expect(existsSync(join(tmpRoot, "functions/deno.d.ts"))).toBe(true)
+    expect(existsSync(join(tmpRoot, "functions/tsconfig.json"))).toBe(true)
+    expect(readFileSync(join(tmpRoot, "functions/hello/index.ts"), "utf8")).toContain("Deno.env.get")
     const pkg = readFileSync(join(tmpRoot, "package.json"), "utf8")
     expect(pkg).toContain("supatype functions serve")
   })

package/tests/local-secrets.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, it } from "vitest"
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import {
+  FALLBACK_AUTHENTICATOR_PASSWORD,
+  FALLBACK_JWT_SECRET,
+  FALLBACK_POSTGRES_PASSWORD,
+  devAuthenticatorPassword,
+  devJwtSecret,
+  devPostgresPassword,
+  secretFingerprint,
+} from "../src/local-secrets.js"
+import { upsertEnvFile } from "../src/env-file.js"
+
+// The bug these exist to prevent: `supatype dev` used to pin POSTGRES_PASSWORD and JWT_SECRET
+// to published constants in `.env` on every run — the same `.env` a self-host deployment reads.
+// A generated secret survived until the developer's next `dev`, then reverted silently, and the
+// deployment went out with a secret anyone can look up.
+
+function project(env?: string): string {
+  const dir = mkdtempSync(join(tmpdir(), "supatype-secrets-"))
+  if (env !== undefined) writeFileSync(join(dir, ".env"), env, "utf8")
+  return dir
+}
+
+describe("resolving local secrets", () => {
+  it("prefers the project's own values", () => {
+    const dir = project("JWT_SECRET=mine\nPOSTGRES_PASSWORD=pg-mine\nAUTHENTICATOR_PASSWORD=auth-mine\n")
+    expect(devJwtSecret(dir)).toBe("mine")
+    expect(devPostgresPassword(dir)).toBe("pg-mine")
+    expect(devAuthenticatorPassword(dir)).toBe("auth-mine")
+  })
+
+  // A project with no `.env` still has to start, so the constants remain — as fallbacks only.
+  it("falls back when the project has none", () => {
+    const dir = project()
+    expect(devJwtSecret(dir)).toBe(FALLBACK_JWT_SECRET)
+    expect(devPostgresPassword(dir)).toBe(FALLBACK_POSTGRES_PASSWORD)
+    expect(devAuthenticatorPassword(dir)).toBe(FALLBACK_AUTHENTICATOR_PASSWORD)
+  })
+})
+
+describe("the dev env write does not clobber secrets", () => {
+  // This is the regression. `upsertEnvFile` replaces any key handed to it, so the guarantee has
+  // to be that the dev path never hands it these — asserted here at the level that matters:
+  // write what dev writes, then check the secrets are byte-identical.
+  it("leaves generated secrets untouched across repeated writes", () => {
+    const dir = project(
+      "JWT_SECRET=generated-secret-value\nPOSTGRES_PASSWORD=generated-pg-value\nAUTHENTICATOR_PASSWORD=generated-auth-value\n",
+    )
+    const before = readFileSync(join(dir, ".env"), "utf8")
+
+    // The keys `upsertDevComposeEnv` legitimately owns: derived values and local ports.
+    for (let run = 0; run < 2; run++) {
+      upsertEnvFile(dir, {
+        POSTGRES_USER: "supatype_admin",
+        POSTGRES_DB: "supatype",
+        AUTHENTICATOR_PASSWORD: devAuthenticatorPassword(dir),
+        ANON_KEY: `anon-${run}`,
+        SERVICE_ROLE_KEY: `service-${run}`,
+        SUPATYPE_KONG_PORT: "18473",
+      })
+    }
+
+    const after = readFileSync(join(dir, ".env"), "utf8")
+    const value = (content: string, key: string): string | undefined =>
+      content.match(new RegExp(`^${key}=(.*)$`, "m"))?.[1]
+
+    for (const key of ["JWT_SECRET", "POSTGRES_PASSWORD", "AUTHENTICATOR_PASSWORD"]) {
+      expect(value(after, key), `${key} must survive a dev run`).toBe(value(before, key))
+    }
+    // Derived keys are still expected to move.
+    expect(value(after, "ANON_KEY")).toBe("anon-1")
+  })
+})
+
+describe("secretFingerprint", () => {
+  // The ready panel used to echo the JWT secret in full. Harmless for a published constant,
+  // wrong once it is the project's own.
+  it("does not reveal the secret", () => {
+    const secret = "super-secret-value-that-must-not-be-printed"
+    const tag = secretFingerprint(secret)
+    expect(secret).not.toContain(tag)
+    expect(tag).toMatch(/^[0-9a-f]{8}$/)
+  })
+
+  it("is stable and distinguishes secrets", () => {
+    expect(secretFingerprint("a")).toBe(secretFingerprint("a"))
+    expect(secretFingerprint("a")).not.toBe(secretFingerprint("b"))
+  })
+})