@supatype/cli 0.1.5 → 0.1.7

package/tests/model-hooks.test.ts

@@ -0,0 +1,322 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { afterEach, describe, expect, it } from "vitest"
+import {
+  DEFAULT_HOOK_TIMEOUT_MS,
+  declaredHooks,
+  manifestHooks,
+  syncManifestHooks,
+  hooksReport,
+  validateModelHooks,
+  writeHooksModule,
+} from "../src/model-hooks.js"
+import { extractSchemaAstFromTypes } from "../src/type-extractor.js"
+
+const dirs: string[] = []
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true })
+})
+
+function project(schema: string): { dir: string; ast: unknown } {
+  const dir = mkdtempSync(join(tmpdir(), "supatype-hooks-"))
+  dirs.push(dir)
+  const schemaPath = join(dir, "schema.ts")
+  writeFileSync(schemaPath, schema, "utf8")
+  return { dir, ast: extractSchemaAstFromTypes(schemaPath, dir) }
+}
+
+/** A function the worker would discover: a directory with an index.ts. */
+function addFunction(dir: string, name: string): void {
+  mkdirSync(join(dir, "functions", name), { recursive: true })
+  writeFileSync(join(dir, "functions", name, "index.ts"), "export default () => new Response()", "utf8")
+}
+
+describe("model hooks — declaration", () => {
+  it("extracts both the shorthand and the options form", () => {
+    const { ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID; title: string }, {
+  tableName: "posts"
+  hooks: {
+    beforeChange: "moderate-post"
+    afterChange: { function: "index-post"; timeout: 5000; onUnavailable: "log" }
+  }
+}>
+`)
+    expect(declaredHooks(ast)).toEqual([
+      { model: "Post", event: "afterChange", function: "index-post" },
+      { model: "Post", event: "beforeChange", function: "moderate-post" },
+    ])
+
+    const models = (ast as { models: { annotations: { platform: { hooks?: Record<string, unknown> } } }[] }).models
+    expect(models[0]?.annotations.platform.hooks).toEqual({
+      beforeChange: { function: "moderate-post" },
+      afterChange: { function: "index-post", timeout: 5000, onUnavailable: "log" },
+    })
+  })
+
+  it("carries no hooks annotation when a model declares none", () => {
+    const { ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    const models = (ast as { models: { annotations: { platform: Record<string, unknown> } }[] }).models
+    expect(models[0]?.annotations.platform["hooks"]).toBeUndefined()
+    expect(declaredHooks(ast)).toEqual([])
+  })
+
+  it("ignores an event name that is not a lifecycle hook", () => {
+    // `beforeRead` was dropped from the design. Extracting it would put a hook in the manifest that
+    // the server has no point at which to call, which reads as "declared and silently ignored".
+    const { ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, {
+  tableName: "posts"
+  hooks: { beforeRead: "nope"; beforeChange: "yes" }
+}>
+`)
+    expect(declaredHooks(ast).map((h) => h.event)).toEqual(["beforeChange"])
+  })
+})
+
+describe("model hooks — push-time validation", () => {
+  const schema = `
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, {
+  tableName: "posts"
+  hooks: { beforeChange: "moderate-post" }
+}>
+`
+
+  it("passes when the named function exists", () => {
+    const { dir, ast } = project(schema)
+    addFunction(dir, "moderate-post")
+    expect(validateModelHooks(ast, join(dir, "functions"), dir)).toEqual([])
+  })
+
+  it("reports the hook, the path searched, and what is available", () => {
+    // The failure this prevents: a typo'd name extracts cleanly, reaches the manifest, never fires,
+    // and the write it was meant to validate succeeds looking perfectly normal.
+    const { dir, ast } = project(schema)
+    addFunction(dir, "moderate-posts") // note the plural
+    const problems = validateModelHooks(ast, join(dir, "functions"), dir)
+
+    expect(problems.join("\n")).toContain("Post.beforeChange")
+    expect(problems.join("\n")).toContain('"moderate-post"')
+    expect(problems.join("\n")).toContain("moderate-posts")
+  })
+
+  it("says how to create one when the hooks directory is empty", () => {
+    const { dir, ast } = project(schema)
+    mkdirSync(join(dir, "hooks"), { recursive: true })
+    expect(validateModelHooks(ast, join(dir, "hooks"), dir).join("\n")).toContain(
+      "supatype hooks new",
+    )
+  })
+
+  it("does not require a functions directory when no hooks are declared", () => {
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    expect(validateModelHooks(ast, join(dir, "functions"), dir)).toEqual([])
+  })
+
+  it("ignores a file and an underscore directory when listing functions", () => {
+    // Matches how the worker discovers handlers: `_shared` is shared code, not a function.
+    const { dir, ast } = project(schema)
+    mkdirSync(join(dir, "functions", "_shared"), { recursive: true })
+    writeFileSync(join(dir, "functions", "_shared", "index.ts"), "export const x = 1", "utf8")
+    writeFileSync(join(dir, "functions", "readme.md"), "notes", "utf8")
+
+    const problems = validateModelHooks(ast, join(dir, "functions"), dir).join("\n")
+    expect(problems).toContain("No hooks found")
+    expect(problems).not.toContain("_shared")
+  })
+})
+
+describe("model hooks — manifest map", () => {
+  const schema = `
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, {
+  tableName: "posts"
+  hooks: { beforeChange: "moderate-post"; afterChange: { function: "index-post"; timeout: 9000 } }
+}>
+`
+
+  it("keys by table name and fills the safe default per phase", () => {
+    const { ast } = project(schema)
+    // Keyed by table, not model: the server matches a request path.
+    expect(manifestHooks(ast)).toEqual({
+      posts: {
+        beforeChange: {
+          function: "moderate-post",
+          timeout: DEFAULT_HOOK_TIMEOUT_MS,
+          // Unreachable before a write must not let the write through...
+          onUnavailable: "reject",
+        },
+        afterChange: {
+          function: "index-post",
+          timeout: 9000,
+          // ...but after one there is nothing left to fail.
+          onUnavailable: "log",
+        },
+      },
+    })
+  })
+
+  it("merges into an existing manifest and leaves its other keys alone", () => {
+    const { dir, ast } = project(schema)
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ schema: "tenant_7", functions_enabled: true }),
+      "utf8",
+    )
+
+    expect(syncManifestHooks(dir, ast)).toBe(true)
+    const manifest = JSON.parse(
+      readFileSync(join(dir, ".supatype", "manifest.json"), "utf8"),
+    ) as Record<string, unknown>
+    expect(manifest["schema"]).toBe("tenant_7")
+    expect(manifest["functions_enabled"]).toBe(true)
+    expect(Object.keys(manifest["hooks"] as object)).toEqual(["posts"])
+  })
+
+  it("never creates a manifest from scratch", () => {
+    // `functions_enabled` is a plain bool on the server's side, so a manifest carrying only hooks
+    // would read as functions *disabled* — the defect fixed one commit earlier, by another door.
+    const { dir, ast } = project(schema)
+    expect(syncManifestHooks(dir, ast)).toBe(false)
+    expect(existsSync(join(dir, ".supatype", "manifest.json"))).toBe(false)
+  })
+
+  it("removes the hook map when the last hook goes away", () => {
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ functions_enabled: true, hooks: { posts: { beforeChange: { function: "gone" } } } }),
+      "utf8",
+    )
+
+    expect(syncManifestHooks(dir, ast)).toBe(true)
+    const manifest = JSON.parse(
+      readFileSync(join(dir, ".supatype", "manifest.json"), "utf8"),
+    ) as Record<string, unknown>
+    expect(manifest["hooks"]).toBeUndefined()
+  })
+})
+
+describe("model hooks — generated module on disk", () => {
+  it("removes a stale module when the last hook is deleted", () => {
+    // Otherwise a typed module sits there claiming tables are hooked, and a handler importing it
+    // keeps compiling while never running.
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    const functionsDir = join(dir, "functions")
+    mkdirSync(join(functionsDir, "_supatype"), { recursive: true })
+    writeFileSync(join(functionsDir, "_supatype", "hooks.ts"), "export type Stale = true", "utf8")
+
+    expect(writeHooksModule(dir, functionsDir, ast)).toBeNull()
+    expect(existsSync(join(functionsDir, "_supatype", "hooks.ts"))).toBe(false)
+  })
+
+  it("writes the module beside the functions that import it", () => {
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts"; hooks: { beforeChange: "x" } }>
+`)
+    const functionsDir = join(dir, "functions")
+    const written = writeHooksModule(dir, functionsDir, ast)
+    expect(written).toContain(join("functions", "_supatype", "hooks.ts"))
+    expect(readFileSync(join(functionsDir, "_supatype", "hooks.ts"), "utf8")).toContain("HookedTable")
+  })
+})
+
+describe("model hooks — doctor report", () => {
+  const schema = `
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, {
+  tableName: "posts"
+  hooks: { beforeChange: "moderate-post" }
+}>
+`
+
+  it("reports nothing for a schema with no hooks", () => {
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    expect(hooksReport(dir, join(dir, "functions"), ast).declared).toEqual([])
+  })
+
+  it("marks a hook whose function is absent", () => {
+    const { dir, ast } = project(schema)
+    const report = hooksReport(dir, join(dir, "functions"), ast)
+    expect(report.declared).toHaveLength(1)
+    expect(report.missing).toHaveLength(1)
+  })
+
+  it("catches functions being switched off, which makes every hook inert silently", () => {
+    const { dir, ast } = project(schema)
+    addFunction(dir, "moderate-post")
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ functions_enabled: false, hooks: { posts: {} } }),
+      "utf8",
+    )
+
+    const report = hooksReport(dir, join(dir, "functions"), ast)
+    expect(report.missing).toEqual([])
+    expect(report.functionsDisabled).toBe(true)
+  })
+
+  it("catches a manifest with no hook map, so the server has nothing to call", () => {
+    const { dir, ast } = project(schema)
+    addFunction(dir, "moderate-post")
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ functions_enabled: true }),
+      "utf8",
+    )
+
+    const report = hooksReport(dir, join(dir, "functions"), ast)
+    expect(report.mapMissing).toBe(true)
+    expect(report.functionsDisabled).toBe(false)
+  })
+
+  it("is clean when the function exists and the manifest agrees", () => {
+    const { dir, ast } = project(schema)
+    addFunction(dir, "moderate-post")
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ functions_enabled: true, hooks: { posts: { beforeChange: { function: "moderate-post" } } } }),
+      "utf8",
+    )
+
+    const report = hooksReport(dir, join(dir, "functions"), ast)
+    expect(report).toMatchObject({ missing: [], functionsDisabled: false, mapMissing: false })
+  })
+})

package/tests/runtime-contract.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest"
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
 import { join } from "node:path"
 import { tmpdir } from "node:os"
 import { runtimeRouteSpec } from "../src/runtime-routes.js"
@@ -89,6 +89,25 @@ describe("runtime contract", () => {
     expect(first).toBe(second)
   })
 
+  it("self-host compose exposes the managed schema over REST, not a hardcoded public", () => {
+    // The literal here was the reason a non-default pg_schema pushed correctly and then answered
+    // PGRST106 on every request: the engine had moved and PostgREST was never told.
+    const compose = renderSelfHostCompose({
+      ...baseConfig,
+      schema: { pg_schema: "app" },
+    })
+    expect(compose).toContain('PGRST_DB_SCHEMA: "app, supatype, graphql_public, auth"')
+    expect(compose).not.toContain('PGRST_DB_SCHEMA: "public,')
+  })
+
+  it("self-host compose honours an explicit api_schemas list verbatim", () => {
+    const compose = renderSelfHostCompose({
+      ...baseConfig,
+      schema: { pg_schema: "app", api_schemas: ["app", "reporting"] },
+    })
+    expect(compose).toContain('PGRST_DB_SCHEMA: "app, reporting"')
+  })
+
   it("self-host compose does not inject a synthetic app-proxy service", () => {
     const compose = renderSelfHostCompose({ ...baseConfig, app: { mode: "proxy", upstream: "http://app:3000" } })
     expect(compose).not.toContain("ghcr.io/supatype/app-proxy")
@@ -109,6 +128,49 @@ describe("runtime contract", () => {
     expect(compose).toContain("supatype/schema-engine:latest")
   })
 
+  // PostgREST must connect as `authenticator`, never as POSTGRES_USER. POSTGRES_USER is
+  // `supatype_admin`, a superuser, and a superuser session may SET ROLE to any role in the
+  // cluster — so a request whose JWT named one got it. Verified against a live stack: a
+  // token with `role: "supatype_admin"` returned every row of an RLS-protected table.
+  it("self-host compose connects PostgREST as authenticator, not the superuser", () => {
+    const compose = renderSelfHostCompose(baseConfig)
+    expect(compose).toContain("PGRST_DB_URI: postgresql://authenticator:")
+    expect(compose).not.toMatch(/PGRST_DB_URI:.*POSTGRES_USER/)
+    expect(compose).not.toMatch(/PGRST_DB_URI:.*supatype_admin/)
+  })
+
+  // A separate credential, so rotating the operator's POSTGRES_PASSWORD cannot take the REST
+  // API down with it. Unset is a hard compose error rather than an empty password.
+  it("gives PostgREST its own credential, not POSTGRES_PASSWORD", () => {
+    const compose = renderSelfHostCompose(baseConfig)
+    expect(compose).toMatch(/PGRST_DB_URI:.*\$\{AUTHENTICATOR_PASSWORD:\?/)
+    expect(compose).not.toMatch(/PGRST_DB_URI:.*POSTGRES_PASSWORD/)
+    expect(compose).toMatch(/AUTHENTICATOR_PASSWORD: \$\{AUTHENTICATOR_PASSWORD:\?/)
+  })
+
+  // `supatype dev --provider docker` renders *this* file, so a `${VAR:?}` with no default
+  // takes local dev down before anything starts — `docker compose` refuses to interpolate and
+  // exits 1. Adding one therefore means wiring it into `upsertDevComposeEnv` as well. This
+  // list is the reminder; if it fails, do that rather than just updating the list.
+  it("requires only variables the dev path also sets", () => {
+    const compose = renderSelfHostCompose(baseConfig)
+    const required = [...compose.matchAll(/\$\{([A-Z0-9_]+):\?/g)].map((m) => m[1])
+    expect([...new Set(required)].sort()).toEqual([
+      "AUTHENTICATOR_PASSWORD",
+      "JWT_SECRET",
+      "POSTGRES_PASSWORD",
+    ])
+  })
+
+  // The whole point of requiring them: a service must never fall back to a secret published in
+  // this repository. That default used to reach PostgREST, storage and GoTrue.
+  it("never defaults a secret to a published constant", () => {
+    const compose = renderSelfHostCompose(baseConfig)
+    expect(compose).not.toContain("super-secret-jwt-token")
+    expect(compose).not.toMatch(/\$\{JWT_SECRET:-/)
+    expect(compose).not.toMatch(/\$\{POSTGRES_PASSWORD:-/)
+  })
+
   it("composeDockerImageEnv maps pinned versions to SUPATYPE_*_IMAGE", () => {
     expect(composeDockerImageEnv(baseConfig)).toEqual({
       SUPATYPE_ENGINE_IMAGE: "supatype/schema-engine:v0.4.2",
@@ -251,6 +313,55 @@ describe("runtime contract", () => {
     }
   })
 
+  it("manifest switches functions on, because the compose file always runs a worker", () => {
+    // The generated compose file starts a `functions-worker` and hands the server
+    // SUPATYPE_FUNCTIONS_WORKER_URL, while the manifest beside it said functions were disabled. The
+    // server reads the manifest, so every function 404'd in a stack that was running a worker for
+    // them. Docker `supatype dev` renders this same file, so one flag broke both paths.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-fn-manifest-"))
+    try {
+      writeSelfHostCompose(dir, baseConfig)
+      const compose = readFileSync(join(dir, ".supatype", "self-host", "docker-compose.yml"), "utf8")
+      expect(compose).toContain("  functions-worker:")
+      expect(compose).toContain("SUPATYPE_FUNCTIONS_WORKER_URL: http://functions-worker:8001")
+
+      const manifest = JSON.parse(
+        readFileSync(join(dir, ".supatype", "manifest.json"), "utf8"),
+      ) as Record<string, unknown>
+      expect(manifest["functions_enabled"]).toBe(true)
+      expect(manifest["functions_worker_url"]).toBe("http://functions-worker:8001")
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it("repairs a manifest written by an older CLI without touching its other keys", () => {
+    // Regenerating the compose file is the obvious fix to try, so it has to work: without the
+    // repair, only brand-new projects get functions and an existing stack stays broken.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-fn-repair-"))
+    try {
+      mkdirSync(join(dir, ".supatype"), { recursive: true })
+      writeFileSync(
+        join(dir, ".supatype", "manifest.json"),
+        JSON.stringify({ schema: "tenant_7", postgrest_url: "http://pg:3000", functions_enabled: false }),
+        "utf8",
+      )
+
+      writeSelfHostCompose(dir, baseConfig)
+
+      const manifest = JSON.parse(
+        readFileSync(join(dir, ".supatype", "manifest.json"), "utf8"),
+      ) as Record<string, unknown>
+      expect(manifest["functions_enabled"]).toBe(true)
+      expect(manifest["functions_worker_url"]).toBe("http://functions-worker:8001")
+      // Values `push` put there survive: the schema is not "public" and must stay as found.
+      expect(manifest["schema"]).toBe("tenant_7")
+      expect(manifest["postgrest_url"]).toBe("http://pg:3000")
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
   it("devLocal compose enables STUDIO_OPEN_DEV on supatype-server", () => {
     const compose = renderSelfHostCompose(baseConfig, process.cwd(), { devLocal: true })
     expect(compose).toContain('STUDIO_OPEN_DEV: "1"')
@@ -276,6 +387,7 @@ describe("runtime contract", () => {
     expect(compose).toContain("\n  functions-worker:\n")
     expect(compose).toContain("SUPATYPE_FUNCTIONS_WORKER_URL: http://functions-worker:8001")
     expect(compose).toContain("SUPATYPE_FUNCTIONS_ROOT: /project/functions")
+    expect(compose).toContain("SUPATYPE_URL: http://kong:8000")
     expect(compose).not.toContain("deploy/functions")
     expect(compose).not.toContain("supatype-functions")
   })

package/tests/service-role-check.test.ts

@@ -0,0 +1,109 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { describe, expect, it } from "vitest"
+
+import { checkServiceRoleRoutes, serviceRoleProblemLines } from "../src/service-role-check.js"
+import type { SupatypeProjectConfig } from "../src/project-config.js"
+import { DENO_RELEASE_PIN } from "../src/release-pins.js"
+
+function config(serviceRole?: string[]): SupatypeProjectConfig {
+  return {
+    project: { name: "p" },
+    database: { provider: "docker" },
+    server: { mode: "dev" },
+    app: { mode: "none" },
+    versions: { engine: "0.4.2", server: "0.1.0", postgres: "17.2", deno: DENO_RELEASE_PIN },
+    ...(serviceRole !== undefined && { functions: { serviceRole } }),
+  } as SupatypeProjectConfig
+}
+
+/** A project whose functions/ holds the named directories, each with an index.ts. */
+function projectWith(names: string[], bareFiles: string[] = []): string {
+  const cwd = mkdtempSync(join(tmpdir(), "supatype-svcrole-check-"))
+  const dir = join(cwd, "functions")
+  mkdirSync(dir, { recursive: true })
+  for (const name of names) {
+    mkdirSync(join(dir, name), { recursive: true })
+    writeFileSync(join(dir, name, "index.ts"), "export default () => new Response()\n", "utf8")
+  }
+  for (const file of bareFiles) {
+    writeFileSync(join(dir, `${file}.ts`), "export default () => new Response()\n", "utf8")
+  }
+  return cwd
+}
+
+describe("checkServiceRoleRoutes", () => {
+  it("says nothing when a project grants nothing", () => {
+    const problems = checkServiceRoleRoutes(config(), projectWith([]))
+    expect(problems.errors).toEqual([])
+    expect(problems.warnings).toEqual([])
+  })
+
+  it("accepts a name that matches a function directory", () => {
+    const problems = checkServiceRoleRoutes(config(["send-email"]), projectWith(["send-email"]))
+    expect(problems.errors).toEqual([])
+  })
+
+  it("accepts a bare <name>.ts function, which the worker also serves", () => {
+    const problems = checkServiceRoleRoutes(config(["audit"]), projectWith([], ["audit"]))
+    expect(problems.errors).toEqual([])
+  })
+
+  it("reports a typo, which would otherwise grant nothing in silence", () => {
+    // The failure this exists for: the grant fails closed, so the function reads no key at runtime in a
+    // deploy that reported success.
+    const problems = checkServiceRoleRoutes(config(["send-emial"]), projectWith(["send-email"]))
+    expect(problems.errors).toHaveLength(1)
+    expect(problems.errors[0]).toContain("send-emial")
+    // Structural too, so `doctor` can mark the entry without parsing the printed line back apart.
+    expect(problems.missing).toEqual(["send-emial"])
+  })
+
+  it("reports a name whose function was renamed away", () => {
+    const problems = checkServiceRoleRoutes(config(["send-email"]), projectWith(["mailer"]))
+    expect(problems.errors).toHaveLength(1)
+  })
+
+  it("warns rather than fails on a hook entry", () => {
+    // It was the documented form once, and the worker grants hooks whatever the list says — so it is
+    // harmless, and worth saying because a reader would assume the line is what grants.
+    const problems = checkServiceRoleRoutes(config(["hooks/moderate-post"]), projectWith([]))
+    expect(problems.errors).toEqual([])
+    expect(problems.warnings).toHaveLength(1)
+    expect(problems.warnings[0]).toContain("not needed")
+  })
+
+  it("ignores an index-less directory, matching how the worker discovers routes", () => {
+    const cwd = projectWith([])
+    mkdirSync(join(cwd, "functions", "half-written"), { recursive: true })
+    const problems = checkServiceRoleRoutes(config(["half-written"]), cwd)
+    expect(problems.errors).toHaveLength(1)
+  })
+})
+
+describe("serviceRoleProblemLines", () => {
+  it("is empty when nothing is wrong", () => {
+    expect(serviceRoleProblemLines({ errors: [], missing: [], warnings: [], available: ["a"] })).toEqual([])
+  })
+
+  it("lists what could have been named instead", () => {
+    const lines = serviceRoleProblemLines({
+      errors: ['  "x" — no functions/x/index.ts'],
+      missing: ["x"],
+      warnings: [],
+      available: ["audit", "send-email"],
+    })
+    expect(lines.join("\n")).toContain("Functions found: audit, send-email")
+  })
+
+  it("says so when there are no functions at all", () => {
+    const lines = serviceRoleProblemLines({
+      errors: ['  "x" — nope'],
+      missing: ["x"],
+      warnings: [],
+      available: [],
+    })
+    expect(lines.join("\n")).toContain("No functions found")
+  })
+})

package/tests/service-role-routes.test.ts

@@ -0,0 +1,51 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { describe, expect, it } from "vitest"
+
+import { serviceRoleRoutesFor } from "../src/commands/functions.js"
+import { DENO_RELEASE_PIN } from "../src/release-pins.js"
+
+/** A config the loader accepts, plus whatever the test is actually about. */
+function projectWith(extra: Record<string, unknown>): string {
+  const cwd = mkdtempSync(join(tmpdir(), "supatype-svcrole-"))
+  mkdirSync(cwd, { recursive: true })
+  const body = {
+    project: { name: "p" },
+    database: { provider: "docker" },
+    server: { mode: "dev" },
+    app: { mode: "none" },
+    versions: { engine: "0.4.2", server: "0.1.0", postgres: "17.2", deno: DENO_RELEASE_PIN },
+    schema: { path: "./schema/index.ts" },
+    ...extra,
+  }
+  writeFileSync(join(cwd, "supatype.config.ts"), `export default ${JSON.stringify(body)}\n`, "utf8")
+  return cwd
+}
+
+describe("serviceRoleRoutesFor", () => {
+  it("reads the declared list", () => {
+    const cwd = projectWith({ functions: { serviceRole: ["send-email"] } })
+    expect(serviceRoleRoutesFor(cwd)).toEqual(["send-email"])
+  })
+
+  it("is an empty list when a project declares none", () => {
+    // Distinct from the case below: this project *has* said something, and it said nobody. The platform
+    // stores that as a real revocation.
+    expect(serviceRoleRoutesFor(projectWith({}))).toEqual([])
+  })
+
+  it("is undefined when the config cannot be read at all", () => {
+    // Not []: the platform replaces its stored list wholesale whenever the field is present, so an
+    // unreadable config sending [] would revoke every grant the project has.
+    expect(serviceRoleRoutesFor(mkdtempSync(join(tmpdir(), "supatype-svcrole-none-")))).toBeUndefined()
+  })
+
+  it("sends what the project declared, hook entries included", () => {
+    // Filtering hook routes out is the platform's job, not this one's: a hook is granted the key by the
+    // worker anyway, and dropping the entry here would hide a mistake in the config rather than making
+    // it harmless. Sorted, so an unchanged config produces an unchanged request.
+    const cwd = projectWith({ functions: { serviceRole: ["send-email", "hooks/moderate-post"] } })
+    expect(serviceRoleRoutesFor(cwd)).toEqual(["hooks/moderate-post", "send-email"])
+  })
+})