@supatype/cli 0.1.6 → 0.1.7

package/tests/field-masking-tier.test.ts

@@ -0,0 +1,184 @@
+import { describe, it, expect } from "vitest"
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import {
+  fieldMaskingTier,
+  imageShipsMaskExtension,
+  nativeMaskLibraryPresent,
+  schemaHasFieldRules,
+} from "../src/field-masking-tier.js"
+import { apiSchemaList, validateProjectConfig, type SupatypeProjectConfig } from "../src/project-config.js"
+
+/**
+ * Which mechanism will enforce per-column rules, decided without touching the database.
+ *
+ * The engine decides the same thing at push time by asking Postgres whether `supatype_mask` is
+ * installed. The CLI has to answer earlier, because it writes `PGRST_DB_SCHEMA` when it generates
+ * compose. It can, because the extension needs `shared_preload_libraries` and a compiled library on
+ * the host: exactly one path ships it.
+ *
+ * The rule is deliberately **not** "is the database external". A native `supatype dev` has no
+ * extension either, and calling that tier 1 would point PostgREST at a schema whose tables the API
+ * roles no longer hold privileges on — every request denied.
+ */
+const project = (database: unknown, rest: Record<string, unknown> = {}): SupatypeProjectConfig =>
+  validateProjectConfig(
+    {
+      project: { name: "acme" },
+      database,
+      server: { mode: "dev" },
+      app: { mode: "none" },
+      ...rest,
+    },
+    "supatype.config.ts",
+  )
+
+const withRules = {
+  models: [
+    {
+      annotations: {
+        db: { tableName: "employee" },
+        platform: { access: { fields: { salary: { read: { type: "private" } } } } },
+      },
+    },
+  ],
+}
+const withoutRules = {
+  models: [{ annotations: { db: { tableName: "employee" }, platform: { access: {} } } }],
+}
+
+describe("imageShipsMaskExtension", () => {
+  it("is true only for the Supatype Postgres image", () => {
+    expect(imageShipsMaskExtension(project({ provider: "docker" }))).toBe(true)
+  })
+
+  it("is false for native, which is the default `supatype dev`", () => {
+    // The case that makes "is it external" the wrong rule.
+    expect(imageShipsMaskExtension(project({ provider: "native" }))).toBe(false)
+  })
+
+  it("is false for an external database", () => {
+    expect(
+      imageShipsMaskExtension(project({ external: { url: "postgres://u@h:5432/d" } })),
+    ).toBe(false)
+  })
+
+  it("is false when the Postgres image is overridden", () => {
+    // Someone running plain `postgres:17` under `provider: docker` has no extension, whatever the
+    // provider says.
+    expect(imageShipsMaskExtension(project({ provider: "docker", image: "postgres:17" }))).toBe(
+      false,
+    )
+    expect(
+      imageShipsMaskExtension(project({ provider: "docker", image: "supatype/postgres:17-latest" })),
+    ).toBe(true)
+  })
+})
+
+describe("schemaHasFieldRules", () => {
+  it("sees a masked column", () => {
+    expect(schemaHasFieldRules(withRules)).toBe(true)
+  })
+
+  it("is false without one, and for anything unexpected", () => {
+    expect(schemaHasFieldRules(withoutRules)).toBe(false)
+    expect(schemaHasFieldRules({ models: [] })).toBe(false)
+    expect(schemaHasFieldRules(null)).toBe(false)
+    expect(schemaHasFieldRules({})).toBe(false)
+  })
+
+  it("is false for an empty fields map", () => {
+    // Present but empty means no column is masked, so nothing needs a view.
+    const empty = {
+      models: [{ annotations: { platform: { access: { fields: {} } } } }],
+    }
+    expect(schemaHasFieldRules(empty)).toBe(false)
+  })
+})
+
+describe("fieldMaskingTier", () => {
+  it("is none when nothing is masked, whatever the database", () => {
+    // With no field rules the engine generates no views, so pointing the API at `api` would serve
+    // nothing at all.
+    expect(fieldMaskingTier(project({ provider: "native" }), withoutRules)).toBe("none")
+    expect(fieldMaskingTier(project({ provider: "docker" }), withoutRules)).toBe("none")
+  })
+
+  it("is extension on the image and views everywhere else", () => {
+    expect(fieldMaskingTier(project({ provider: "docker" }), withRules)).toBe("extension")
+    expect(fieldMaskingTier(project({ provider: "native" }), withRules)).toBe("views")
+    expect(
+      fieldMaskingTier(project({ external: { url: "postgres://u@h:5432/d" } }), withRules),
+    ).toBe("views")
+  })
+})
+
+describe("the exposed schema list", () => {
+  it("serves from api under tier 2, and drops the managed schema", () => {
+    // Both halves matter. A client picks its schema per request with `Accept-Profile`, so leaving the
+    // managed schema exposed would let any caller read the unmasked table.
+    const list = apiSchemaList(project({ provider: "native" }), "views")
+    expect(list).toBe("api, supatype, graphql_public, auth")
+    // Entries, not substrings: `graphql_public` legitimately contains "public".
+    expect(list.split(", ")).not.toContain("public")
+  })
+
+  it("is unchanged for tier 1 and for a schema with no field rules", () => {
+    for (const tier of ["extension", "none", undefined] as const) {
+      expect(apiSchemaList(project({ provider: "docker" }), tier)).toBe(
+        "public, supatype, graphql_public, auth",
+      )
+    }
+  })
+
+  it("still lets an explicit api_schemas win", () => {
+    // The escape hatch for the one case the offline rule cannot call: a self-managed Postgres where
+    // the operator installed the extension themselves.
+    const cfg = project({ external: { url: "postgres://u@h:5432/d" } }, {
+      schema: { api_schemas: ["public", "supatype"] },
+    })
+    expect(apiSchemaList(cfg, "views")).toBe("public, supatype")
+  })
+})
+
+describe("nativeMaskLibraryPresent", () => {
+  it("is false for an install without the library", () => {
+    // The case that must not be assumed away: an archive downloaded before the library was bundled.
+    // Claiming tier 1 for it would select the planner rewrite and the push would be refused.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-pg-"))
+    mkdirSync(join(dir, "bin"), { recursive: true })
+    mkdirSync(join(dir, "lib", "postgresql"), { recursive: true })
+    expect(nativeMaskLibraryPresent(join(dir, "bin"))).toBe(false)
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it("finds the library in either archive layout", () => {
+    // Linux and macOS put extension libraries in `lib/`; the Windows archive uses `lib/postgresql/`.
+    for (const [subdir, lib] of [
+      [["lib"], "supatype_mask.so"],
+      [["lib"], "supatype_mask.dylib"],
+      [["lib", "postgresql"], "supatype_mask.dll"],
+    ] as const) {
+      const dir = mkdtempSync(join(tmpdir(), "supatype-pg-"))
+      mkdirSync(join(dir, "bin"), { recursive: true })
+      mkdirSync(join(dir, ...subdir), { recursive: true })
+      writeFileSync(join(dir, ...subdir, lib), "")
+      expect(nativeMaskLibraryPresent(join(dir, "bin")), lib).toBe(true)
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it("is false without an install directory at all", () => {
+    expect(nativeMaskLibraryPresent(null)).toBe(false)
+    expect(nativeMaskLibraryPresent(undefined)).toBe(false)
+  })
+
+  it("selects the extension tier when the library is installed", () => {
+    // The point of the whole change: native dev enforces field rules the same way the image does.
+    expect(fieldMaskingTier(project({ provider: "native" }), withRules, true)).toBe("extension")
+    expect(fieldMaskingTier(project({ provider: "native" }), withRules, false)).toBe("views")
+    // Still nothing to enforce when no column is masked.
+    expect(fieldMaskingTier(project({ provider: "native" }), withoutRules, true)).toBe("none")
+  })
+})

package/tests/functions-deno-types.test.ts

@@ -0,0 +1,197 @@
+import { spawnSync } from "node:child_process"
+import { createRequire } from "node:module"
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync, existsSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { dirname, join } from "node:path"
+import { afterEach, describe, expect, it } from "vitest"
+import {
+  ensureFunctionsDenoTypes,
+  functionsDenoAmbientSource,
+  functionsTsConfigSource,
+} from "../src/functions-deno-types.js"
+
+const require = createRequire(import.meta.url)
+
+function resolveTscBin(): string {
+  const typescriptEntry = require.resolve("typescript/package.json")
+  return join(dirname(typescriptEntry), "bin", "tsc")
+}
+
+function runTsc(projectDir: string): { status: number | null; stdout: string; stderr: string } {
+  const result = spawnSync(process.execPath, [resolveTscBin(), "-p", "tsconfig.json", "--pretty", "false"], {
+    cwd: projectDir,
+    encoding: "utf8",
+  })
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+  }
+}
+
+const HANDLER_WITH_DENO = `export default async function handler(req: Request): Promise<Response> {
+  const url = Deno.env.get("SUPATYPE_URL")
+  return new Response(JSON.stringify({ url, method: req.method }), {
+    headers: { "Content-Type": "application/json" },
+  })
+}
+`
+
+describe("ensureFunctionsDenoTypes", () => {
+  let tmpRoot = ""
+
+  afterEach(() => {
+    if (tmpRoot) rmSync(tmpRoot, { recursive: true, force: true })
+    tmpRoot = ""
+  })
+
+  it("writes deno.d.ts and tsconfig.json under functions/", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-types-"))
+    const functionsDir = join(tmpRoot, "functions")
+
+    const result = ensureFunctionsDenoTypes(tmpRoot, functionsDir)
+
+    expect(result.wroteDenoDts).toBe(true)
+    expect(result.wroteTsconfig).toBe(true)
+    expect(existsSync(join(functionsDir, "deno.d.ts"))).toBe(true)
+    expect(existsSync(join(functionsDir, "tsconfig.json"))).toBe(true)
+    expect(readFileSync(join(functionsDir, "deno.d.ts"), "utf8")).toContain("declare namespace Deno")
+    expect(readFileSync(join(functionsDir, "tsconfig.json"), "utf8")).toContain('"types": []')
+  })
+
+  it("is idempotent when files already exist", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-types-"))
+    const functionsDir = join(tmpRoot, "functions")
+    mkdirSync(functionsDir, { recursive: true })
+    writeFileSync(join(functionsDir, "deno.d.ts"), "// custom\n", "utf8")
+    writeFileSync(join(functionsDir, "tsconfig.json"), "{}\n", "utf8")
+
+    const result = ensureFunctionsDenoTypes(tmpRoot, functionsDir)
+
+    expect(result.wroteDenoDts).toBe(false)
+    expect(result.wroteTsconfig).toBe(false)
+    expect(readFileSync(join(functionsDir, "deno.d.ts"), "utf8")).toBe("// custom\n")
+  })
+
+  it("adds functions to root tsconfig exclude when possible", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-types-"))
+    writeFileSync(
+      join(tmpRoot, "tsconfig.json"),
+      JSON.stringify({
+        compilerOptions: { strict: true },
+        include: ["**/*.ts"],
+        exclude: ["node_modules"],
+      }, null, 2),
+      "utf8",
+    )
+    const functionsDir = join(tmpRoot, "functions")
+
+    const result = ensureFunctionsDenoTypes(tmpRoot, functionsDir)
+
+    expect(result.rootExclude).toBe("updated")
+    const root = JSON.parse(readFileSync(join(tmpRoot, "tsconfig.json"), "utf8")) as {
+      exclude: string[]
+    }
+    expect(root.exclude).toContain("functions")
+    expect(root.exclude).toContain("node_modules")
+  })
+
+  it("reports already when functions is already excluded", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-types-"))
+    writeFileSync(
+      join(tmpRoot, "tsconfig.json"),
+      JSON.stringify({ exclude: ["node_modules", "functions"] }, null, 2),
+      "utf8",
+    )
+
+    const result = ensureFunctionsDenoTypes(tmpRoot, join(tmpRoot, "functions"))
+    expect(result.rootExclude).toBe("already")
+  })
+
+  it("templates include Deno.env", () => {
+    expect(functionsDenoAmbientSource()).toContain("const env: DenoEnv")
+    expect(functionsTsConfigSource()).toContain("deno.d.ts")
+  })
+})
+
+/**
+ * Manual / end-to-end check: real `tsc` against a scaffolded functions dir.
+ * Proves Deno.env is typed (no TS2304) once deno.d.ts + functions/tsconfig exist.
+ */
+describe("functions Deno types (tsc manual check)", () => {
+  let tmpRoot = ""
+
+  afterEach(() => {
+    if (tmpRoot) rmSync(tmpRoot, { recursive: true, force: true })
+    tmpRoot = ""
+  })
+
+  it("tsc fails with Cannot find name Deno without ambient types", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-tsc-baseline-"))
+    const fnDir = join(tmpRoot, "hello")
+    mkdirSync(fnDir, { recursive: true })
+    writeFileSync(join(fnDir, "index.ts"), HANDLER_WITH_DENO, "utf8")
+    writeFileSync(
+      join(tmpRoot, "tsconfig.json"),
+      JSON.stringify(
+        {
+          compilerOptions: {
+            target: "ES2022",
+            lib: ["ES2022", "DOM"],
+            strict: true,
+            noEmit: true,
+            module: "ESNext",
+            moduleResolution: "bundler",
+            types: [],
+          },
+          include: ["./**/*.ts"],
+        },
+        null,
+        2,
+      ),
+      "utf8",
+    )
+
+    const { status, stdout, stderr } = runTsc(tmpRoot)
+    const out = `${stdout}\n${stderr}`
+    expect(status).not.toBe(0)
+    expect(out).toMatch(/Cannot find name 'Deno'|TS2304/)
+  })
+
+  it("tsc passes for Deno.env after ensureFunctionsDenoTypes", () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), "supatype-deno-tsc-ok-"))
+    const functionsDir = join(tmpRoot, "functions")
+    mkdirSync(join(functionsDir, "hello"), { recursive: true })
+    writeFileSync(join(functionsDir, "hello", "index.ts"), HANDLER_WITH_DENO, "utf8")
+    writeFileSync(
+      join(tmpRoot, "tsconfig.json"),
+      JSON.stringify(
+        {
+          compilerOptions: {
+            target: "ES2022",
+            lib: ["ES2022", "DOM"],
+            strict: true,
+            noEmit: true,
+            module: "ESNext",
+            moduleResolution: "bundler",
+          },
+          include: ["**/*.ts"],
+          exclude: ["node_modules"],
+        },
+        null,
+        2,
+      ),
+      "utf8",
+    )
+
+    const ensured = ensureFunctionsDenoTypes(tmpRoot, functionsDir)
+    expect(ensured.wroteDenoDts).toBe(true)
+    expect(ensured.wroteTsconfig).toBe(true)
+    expect(ensured.rootExclude).toBe("updated")
+
+    const { status, stdout, stderr } = runTsc(functionsDir)
+    const out = `${stdout}\n${stderr}`
+    expect(out, `tsc stderr/stdout:\n${out}`).not.toMatch(/Cannot find name 'Deno'|TS2304/)
+    expect(status, `tsc failed:\n${out}`).toBe(0)
+  })
+})

package/tests/homebrew-formula.test.ts

@@ -0,0 +1,58 @@
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { spawnSync } from "node:child_process"
+import { afterEach, beforeEach, describe, expect, it } from "vitest"
+
+let counter = 0
+let tmpDir: string
+
+const PLATFORMS = [
+  "supatype-cli-darwin-arm64",
+  "supatype-cli-darwin-amd64",
+  "supatype-cli-linux-arm64",
+  "supatype-cli-linux-amd64",
+]
+
+beforeEach(() => {
+  tmpDir = join(tmpdir(), `homebrew-formula-${Date.now()}-${++counter}`)
+  mkdirSync(tmpDir, { recursive: true })
+  for (const name of PLATFORMS) {
+    writeFileSync(join(tmpDir, name), `stub-${name}\n`, "utf8")
+  }
+})
+
+afterEach(() => {
+  rmSync(tmpDir, { recursive: true, force: true })
+})
+
+describe("generate-homebrew-formula.mjs", () => {
+  it("writes a Formula with versioned CDN URLs and sha256 blocks", () => {
+    const outPath = join(tmpDir, "supatype.rb")
+    const script = join(import.meta.dirname, "../scripts/generate-homebrew-formula.mjs")
+    const result = spawnSync(
+      process.execPath,
+      [script, "9.9.9", tmpDir],
+      {
+        encoding: "utf8",
+        env: { ...process.env, HOMEBREW_FORMULA_OUT: outPath },
+      },
+    )
+
+    expect(result.status, result.stderr).toBe(0)
+    const formula = readFileSync(outPath, "utf8")
+    expect(formula).toContain('version "9.9.9"')
+    expect(formula).toContain("https://releases.supatype.com/cli/v9.9.9/supatype-cli-darwin-arm64")
+    expect(formula).toMatch(/sha256 "[a-f0-9]{64}"/)
+    expect(formula).toContain('system bin/"supatype", "_postinstall"')
+    expect(formula).toContain('bin.install "supatype-cli-#{arch}" => "supatype"')
+  })
+
+  it("fails when an artifact is missing", () => {
+    rmSync(join(tmpDir, "supatype-cli-linux-amd64"))
+    const script = join(import.meta.dirname, "../scripts/generate-homebrew-formula.mjs")
+    const result = spawnSync(process.execPath, [script, "1.0.0", tmpDir], { encoding: "utf8" })
+    expect(result.status).not.toBe(0)
+    expect(result.stderr).toContain("Missing artifact")
+  })
+})

package/tests/hook-upload.test.ts

@@ -0,0 +1,125 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { describe, expect, it } from "vitest"
+
+import { ADAPTER_KEY, readHookUpload } from "../src/hook-upload.js"
+
+function project(): { cwd: string; hooks: string } {
+  const cwd = mkdtempSync(join(tmpdir(), "supatype-hook-upload-"))
+  const hooks = join(cwd, "hooks")
+  mkdirSync(hooks, { recursive: true })
+  return { cwd, hooks }
+}
+
+function writeHook(hooks: string, name: string, source: string, extra?: Record<string, string>): void {
+  const dir = join(hooks, name)
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(join(dir, "index.ts"), source, "utf8")
+  for (const [file, contents] of Object.entries(extra ?? {})) {
+    writeFileSync(join(dir, file), contents, "utf8")
+  }
+}
+
+/** An AST shaped as the extractor produces, carrying one hooked model. */
+function astWith(hooks: Record<string, string>): unknown {
+  return {
+    models: [
+      {
+        name: "Post",
+        fields: [],
+        annotations: {
+          db: { tableName: "posts" },
+          platform: {
+            hooks: Object.fromEntries(
+              Object.entries(hooks).map(([event, fn]) => [event, { function: fn }]),
+            ),
+          },
+        },
+      },
+    ],
+  }
+}
+
+const HANDLER = `import { hook, type BeforeChange } from "../_supatype/hooks.ts"
+
+const moderate: BeforeChange<"posts"> = async () => ({})
+export default hook(moderate)
+`
+
+describe("readHookUpload", () => {
+  it("is null when the schema names no hooks", () => {
+    const { cwd, hooks } = project()
+    expect(readHookUpload(cwd, hooks, astWith({}))).toBeNull()
+  })
+
+  it("rewrites the generated adapter import to the flattened name", () => {
+    // The nested path cannot survive flattening, and this is the specifier our own scaffold writes.
+    const { cwd, hooks } = project()
+    writeHook(hooks, "moderate-post", HANDLER)
+
+    const upload = readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" }))
+    expect(upload?.handlers).toHaveLength(1)
+    expect(upload?.handlers[0]?.source).toContain(`./${ADAPTER_KEY}`)
+    expect(upload?.handlers[0]?.source).not.toContain("../_supatype/hooks.ts")
+  })
+
+  it("uploads only the handlers the schema names", () => {
+    // An unnamed handler would sit on the worker holding the service-role key with nothing able to
+    // call it. Uploading it buys nothing and widens what runs with that credential.
+    const { cwd, hooks } = project()
+    writeHook(hooks, "moderate-post", HANDLER)
+    writeHook(hooks, "abandoned", HANDLER)
+
+    const upload = readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" }))
+    expect(upload?.handlers.map((h) => h.name)).toEqual(["moderate-post"])
+  })
+
+  it("carries the hook map alongside the sources", () => {
+    // Both halves in one payload: a map naming a handler whose source has not arrived is the failure
+    // this whole feature is meant to avoid.
+    const { cwd, hooks } = project()
+    writeHook(hooks, "moderate-post", HANDLER)
+
+    const upload = readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" }))
+    expect(upload?.map["posts"]?.["beforeChange"]?.function).toBe("moderate-post")
+  })
+
+  it("refuses a hook with a second file rather than dropping it", () => {
+    // Silent truncation would deploy successfully and fail at import — which reads to the caller as
+    // that table's writes being broken for no visible reason.
+    const { cwd, hooks } = project()
+    writeHook(hooks, "moderate-post", HANDLER, { "helpers.ts": "export const x = 1\n" })
+
+    expect(() => readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" })))
+      .toThrow(/more than one file \(helpers\.ts\)/)
+  })
+
+  it("refuses a relative import it cannot resolve after flattening", () => {
+    const { cwd, hooks } = project()
+    writeHook(hooks, "moderate-post", `import { x } from "./helpers.ts"\nexport default () => x\n`)
+
+    expect(() => readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" })))
+      .toThrow(/imports \.\/helpers\.ts/)
+  })
+
+  it("leaves bare specifiers and URLs alone", () => {
+    // Only relative paths depend on the layout. A hook is expected to import from npm: or https:.
+    const { cwd, hooks } = project()
+    writeHook(
+      hooks,
+      "moderate-post",
+      `import { z } from "npm:zod"\nimport { j } from "https://esm.sh/joi"\n` + HANDLER,
+    )
+
+    const upload = readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" }))
+    expect(upload?.handlers).toHaveLength(1)
+  })
+
+  it("names the missing handler when a declared hook has no source", () => {
+    const { cwd, hooks } = project()
+
+    expect(() => readHookUpload(cwd, hooks, astWith({ beforeChange: "moderate-post" })))
+      .toThrow(/moderate-post/)
+  })
+})