@supatype/cli 0.1.5 → 0.1.7

package/tests/target-client-refresh.test.ts

@@ -0,0 +1,94 @@
+import { describe, expect, it, vi, afterEach } from "vitest"
+import { targetFetch, TargetApiError } from "../src/target-client.js"
+
+describe("targetFetch cloud auth refresh", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals()
+    vi.restoreAllMocks()
+  })
+
+  it("refreshes once on TOKEN_EXPIRED then retries", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 401,
+        json: async () => ({ message: "Token expired", code: "TOKEN_EXPIRED" }),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        json: async () => ({
+          access_token: "new-access",
+          refresh_token: "new-refresh",
+          expires_in: 3600,
+        }),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        json: async () => ({ data: { ok: true } }),
+      })
+
+    vi.stubGlobal("fetch", fetchMock)
+
+    const onRefreshed = vi.fn()
+    const result = await targetFetch<{ ok: boolean }>("http://api.test", "/api/v1", {
+      method: "GET",
+      path: "/projects/x/status",
+      token: "old-access",
+      authRefresh: {
+        cloudApiUrl: "http://api.test",
+        refreshToken: "old-refresh",
+        onRefreshed,
+      },
+    })
+
+    expect(result).toEqual({ ok: true })
+    expect(onRefreshed).toHaveBeenCalledWith({
+      accessToken: "new-access",
+      refreshToken: "new-refresh",
+    })
+    expect(fetchMock).toHaveBeenCalledTimes(3)
+    const retryAuth = (fetchMock.mock.calls[2]![1] as RequestInit).headers as Record<string, string>
+    expect(retryAuth.Authorization).toBe("Bearer new-access")
+  })
+
+  it("points to supatype login when expired without refresh token", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: false,
+        status: 401,
+        json: async () => ({ message: "Token expired", code: "TOKEN_EXPIRED" }),
+      }),
+    )
+
+    await expect(
+      targetFetch("http://api.test", "/api/v1", {
+        method: "GET",
+        path: "/projects/x/status",
+        token: "old",
+      }),
+    ).rejects.toThrow(/supatype login/)
+  })
+
+  it("throws TargetApiError with status", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: false,
+        status: 500,
+        json: async () => ({ message: "boom" }),
+      }),
+    )
+
+    await expect(
+      targetFetch("http://api.test", "/api/v1", {
+        method: "GET",
+        path: "/x",
+        token: "t",
+      }),
+    ).rejects.toMatchObject({ name: "TargetApiError", status: 500 } satisfies Partial<TargetApiError>)
+  })
+})

package/tests/type-extractor.test.ts

@@ -1135,4 +1135,191 @@ export type User = Model<{ id: UUID; email: NonNullable<string> }>
 
     expect(() => extractSchemaAstFromTypes(schemaPath, dir)).toThrow(/Unknown Supatype type "NonNullable"/)
   })
+  // Regression: access factored into a shared type alias silently produced NO
+  // rules, so every model using the pattern was published without RLS.
+  it("resolves model access from a shared type alias in another file", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-access-alias-"))
+    dirs.push(dir)
+    writeFileSync(
+      join(dir, "shared.ts"),
+      `
+import type { Public, Role } from "@supatype/types"
+
+export type CmsPublicReadAdminWrite = {
+  read: Public
+  create: Role<"admin">
+  update: Role<"admin">
+  delete: Role<"admin">
+}
+`,
+      "utf8",
+    )
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Model, UUID } from "@supatype/types"
+import type { CmsPublicReadAdminWrite } from "./shared.js"
+
+export type Article = Model<{ id: UUID; title: string }, {
+  tableName: "articles"
+  access: CmsPublicReadAdminWrite
+}>
+`,
+      "utf8",
+    )
+
+    const ast = extractSchemaAstFromTypes(schemaPath, dir)
+    const access = modelAccess(ast?.models.find((m) => m.name === "Article"))
+    expect(access).toEqual({
+      read: { type: "public" },
+      create: { type: "role", roles: ["admin"] },
+      update: { type: "role", roles: ["admin"] },
+      delete: { type: "role", roles: ["admin"] },
+    })
+  })
+
+  it("resolves model access from an intersection of aliases", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-access-intersection-"))
+    dirs.push(dir)
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Model, UUID, Public, Role } from "@supatype/types"
+
+type PublicRead = { read: Public }
+type AdminWrite = { create: Role<"admin">; delete: Role<"admin"> }
+
+export type Article = Model<{ id: UUID; title: string }, {
+  access: PublicRead & AdminWrite
+}>
+`,
+      "utf8",
+    )
+
+    const ast = extractSchemaAstFromTypes(schemaPath, dir)
+    const access = modelAccess(ast?.models.find((m) => m.name === "Article"))
+    expect(Object.keys(access).sort()).toEqual(["create", "delete", "read"])
+  })
+
+  // The dangerous case: `const … as const` cannot express access (the rule names
+  // are types), and silently ignoring it published an unprotected table.
+  it("throws when model access cannot be resolved instead of dropping the rules", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-access-unresolvable-"))
+    dirs.push(dir)
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Model, UUID } from "@supatype/types"
+
+export type Article = Model<{ id: UUID; title: string }, {
+  access: typeof someRuntimeValue
+}>
+`,
+      "utf8",
+    )
+
+    expect(() => extractSchemaAstFromTypes(schemaPath, dir)).toThrow(
+      /Model "Article": could not resolve its `access` rules/,
+    )
+  })
+
+  it("carries Decimal precision and scale through to the AST", () => {
+    // `Decimal<10, 2>` used to extract as an unbounded NUMERIC: the engine renders `NUMERIC(p, s)`
+    // from these two facts, and nothing read the type arguments. A money column silently lost its
+    // constraint, which no error surfaced and no test caught.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-decimal-"))
+    dirs.push(dir)
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Decimal, Model, UUID } from "@supatype/types"
+
+export type Invoice = Model<{
+  id: UUID
+  total: Decimal<10, 2>
+  rate: Decimal<5, 4>
+}>
+`,
+      "utf8",
+    )
+
+    const ast = extractSchemaAstFromTypes(schemaPath, dir)
+    const invoice = ast?.models.find((m) => m.name === "Invoice")
+    expect(invoice?.fields["total"]).toMatchObject({ kind: "decimal", precision: 10, scale: 2 })
+    expect(invoice?.fields["rate"]).toMatchObject({ kind: "decimal", precision: 5, scale: 4 })
+  })
+
+  it("extracts Code and Currency as JSONB carrying their declared shape", () => {
+    // Both were exported from `@supatype/types` and rejected by the extractor, so a schema using
+    // either failed the push with "unknown type". Each carries two values — a language with its
+    // source, an amount with its currency — so JSONB is the column that does not drop one.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-code-currency-"))
+    dirs.push(dir)
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Code, Currency, Model, UUID } from "@supatype/types"
+
+export type Snippet = Model<{
+  id: UUID
+  body: Code<"sql">
+  anyLang: Code
+  price: Currency<"USD">
+  anyCurrency: Currency
+}>
+`,
+      "utf8",
+    )
+
+    const ast = extractSchemaAstFromTypes(schemaPath, dir)
+    const snippet = ast?.models.find((m) => m.name === "Snippet")
+
+    expect(snippet?.fields["body"]).toMatchObject({
+      kind: "json",
+      annotations: { db: { pgType: "JSONB" } },
+      tsType: '{ lang: "sql"; source: string }',
+    })
+    expect(snippet?.fields["price"]).toMatchObject({
+      kind: "json",
+      annotations: { db: { pgType: "JSONB" } },
+      tsType: '{ amount: string; code: "USD" }',
+    })
+
+    // Without a literal argument the currency is not known statically, so the row carries it.
+    expect(snippet?.fields["anyLang"]).toMatchObject({ tsType: "{ lang: string; source: string }" })
+    expect(snippet?.fields["anyCurrency"]).toMatchObject({ tsType: "{ amount: string; code: string }" })
+
+    // Both are JSONB, so the column kind cannot tell Studio which editor to show. The `editor`
+    // annotation is what separates a code snippet from a money amount from a raw JSON blob.
+    expect(snippet?.fields["body"]).toMatchObject({ annotations: { platform: { editor: "code" } } })
+    expect(snippet?.fields["price"]).toMatchObject({
+      annotations: { platform: { editor: "currency" } },
+    })
+  })
+
+  it("throws when bucket access cannot be resolved", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-bucket-access-"))
+    dirs.push(dir)
+    const schemaPath = join(dir, "schema.ts")
+    writeFileSync(
+      schemaPath,
+      `
+import type { Bucket } from "@supatype/types"
+
+export type Media = Bucket<"media", {
+  access: typeof someRuntimeValue
+}>
+`,
+      "utf8",
+    )
+
+    expect(() => extractSchemaAstFromTypes(schemaPath, dir)).toThrow(
+      /Bucket "media": could not resolve its `access` rules/,
+    )
+  })
 })