@supatype/cli 0.3.1 → 0.3.3

package/tests/fixtures/seed_golden_ir.json

@@ -0,0 +1,186 @@
+{
+  "irVersion": 1,
+  "schemaFingerprint": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+  "operations": [
+    {
+      "op": "upsert",
+      "model": "Profile",
+      "id": "alex",
+      "where": {
+        "id": "a0000000-0000-4000-8000-000000000001"
+      },
+      "data": {
+        "display_name": "Alex Rivera",
+        "full_name": "Alex Rivera"
+      }
+    },
+    {
+      "op": "upsert",
+      "model": "Organiser",
+      "id": "northern",
+      "where": {
+        "slug": "northern-lights-events"
+      },
+      "data": {
+        "name": "Northern Lights Events",
+        "contact_email": "hello@northernlights.test",
+        "owner": {
+          "connect": {
+            "id": {
+              "$ref": "alex.id"
+            }
+          }
+        },
+        "events": {
+          "create": [
+            {
+              "title": "Southwest Dev Conference",
+              "status": "published",
+              "starts_at": {
+                "kind": "after",
+                "base": {
+                  "kind": "startOf",
+                  "unit": "day"
+                },
+                "interval": {
+                  "days": 30,
+                  "hours": 9
+                }
+              },
+              "ends_at": {
+                "kind": "after",
+                "base": {
+                  "kind": "startOf",
+                  "unit": "day"
+                },
+                "interval": {
+                  "days": 30,
+                  "hours": 18
+                }
+              },
+              "created_at": {
+                "kind": "now"
+              },
+              "ticket_types": {
+                "createMany": [
+                  {
+                    "name": "Early Bird",
+                    "price": {
+                      "$numeric": "75.0000"
+                    },
+                    "quantity": 100
+                  },
+                  {
+                    "name": "Standard",
+                    "price": {
+                      "$numeric": "125.0000"
+                    },
+                    "quantity": 250
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "op": "createMany",
+      "model": "Venue",
+      "rows": [
+        {
+          "name": "The Exchange",
+          "city": "Bristol",
+          "capacity": 450,
+          "country": {
+            "$default": true
+          },
+          "organiser": {
+            "connect": {
+              "slug": "northern-lights-events"
+            }
+          }
+        },
+        {
+          "name": "Archway Studios",
+          "city": "London",
+          "capacity": 180,
+          "country": {
+            "$default": true
+          },
+          "organiser": {
+            "connect": {
+              "slug": "northern-lights-events"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "op": "group",
+      "if": {
+        "kind": "notExists",
+        "model": "SiteSettings"
+      },
+      "operations": [
+        {
+          "op": "create",
+          "model": "SiteSettings",
+          "data": {
+            "site_name": "Launch Test Tickets",
+            "default_currency": "GBP"
+          }
+        }
+      ]
+    },
+    {
+      "op": "group",
+      "if": {
+        "kind": "exists",
+        "model": "Event",
+        "where": {
+          "type": "compare",
+          "op": "eq",
+          "left": {
+            "kind": "column",
+            "name": "status"
+          },
+          "right": {
+            "kind": "literal",
+            "value": "published"
+          }
+        }
+      },
+      "operations": [
+        {
+          "op": "create",
+          "model": "PromoCode",
+          "data": {
+            "code": "EARLY20",
+            "discount_kind": "percentage",
+            "discount_value": 20,
+            "valid_until": {
+              "kind": "after",
+              "base": {
+                "kind": "now"
+              },
+              "interval": {
+                "days": 25
+              }
+            },
+            "event": {
+              "connect": {
+                "slug": "southwest-dev-conference"
+              }
+            }
+          }
+        }
+      ]
+    },
+    {
+      "op": "sql",
+      "text": "ANALYZE event",
+      "params": []
+    }
+  ]
+}

package/tests/functions-context-refresh.test.ts

@@ -0,0 +1,86 @@
+/**
+ * `functions/_shared/context.ts` reaches a project that already exists.
+ *
+ * The module was written by `init` and `supatype functions new`, and by nothing else. So it arrived
+ * with new projects and new functions, and never arrived at a project that already had functions
+ * when the two-argument handler contract landed: those keep `(req)` handlers with no
+ * `FunctionContext` to import, while the generated file itself asserts
+ *
+ *   Regenerated by the CLI. Edits are overwritten.
+ *
+ * which was true only if you scaffolded again. `tests/integration` in this repo had four functions
+ * and no context module at all, which is how it was found.
+ */
+import { describe, expect, it, beforeEach, afterEach } from "vitest"
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { refreshFunctionsContext } from "../src/functions-context-refresh.js"
+import type { SupatypeProjectConfig } from "../src/project-config.js"
+
+const config: SupatypeProjectConfig = {
+  project: { name: "ctx" },
+  database: { provider: "docker" },
+} as SupatypeProjectConfig
+
+let dir: string
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "supatype-ctx-"))
+})
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true })
+})
+
+/** A project with functions but no `_shared`, which is what a pre-migration project looks like. */
+function projectWithFunctions(): string {
+  const functions = join(dir, "functions")
+  mkdirSync(functions, { recursive: true })
+  writeFileSync(
+    join(functions, "ping.ts"),
+    "export default function ping(_req: Request) { return new Response('ok') }\n",
+    "utf8",
+  )
+  return functions
+}
+
+describe("a project that already has functions", () => {
+  it("gets the context module written", () => {
+    const functions = projectWithFunctions()
+    expect(existsSync(join(functions, "_shared", "context.ts"))).toBe(false)
+
+    expect(refreshFunctionsContext(dir, config)).toBe(true)
+    expect(existsSync(join(functions, "_shared", "context.ts"))).toBe(true)
+  })
+
+  it("writes a module that actually declares the contract", () => {
+    // Not merely that a file appeared. The point is the type handlers import.
+    projectWithFunctions()
+    refreshFunctionsContext(dir, config)
+    const source = readFileSync(join(dir, "functions", "_shared", "context.ts"), "utf8")
+    expect(source).toContain("FunctionContext")
+    expect(source).toContain("executionId")
+  })
+
+  it("rewrites a stale copy rather than leaving it", () => {
+    // The file says edits are overwritten, so they have to be.
+    const functions = projectWithFunctions()
+    mkdirSync(join(functions, "_shared"), { recursive: true })
+    writeFileSync(join(functions, "_shared", "context.ts"), "// stale\n", "utf8")
+
+    refreshFunctionsContext(dir, config)
+    const source = readFileSync(join(functions, "_shared", "context.ts"), "utf8")
+    expect(source).not.toBe("// stale\n")
+    expect(source).toContain("FunctionContext")
+  })
+})
+
+describe("a project with no functions", () => {
+  it("is left alone", () => {
+    // Writing `_shared/` into a project with no functions would create the thing it describes out
+    // of nothing, and leave a directory nobody asked for in the diff.
+    expect(refreshFunctionsContext(dir, config)).toBe(false)
+    expect(existsSync(join(dir, "functions"))).toBe(false)
+  })
+})

package/tests/gitignore-secrets.test.ts

@@ -0,0 +1,90 @@
+/**
+ * The `.gitignore` we write has to cover the secrets we write.
+ *
+ * `supatype functions new` writes `functions/.env.local` with "These are NOT committed to git" at
+ * the top of it, and nothing made that true: `.env` matches a file named exactly `.env`, and both
+ * `.env.local` and `.env.<function>.local` were tracked.
+ *
+ * Asserted through `git check-ignore` rather than by reading the patterns, because the question is
+ * what git does with them and a pattern that looks right is how this got shipped.
+ */
+
+import { describe, expect, it, beforeEach, afterEach } from "vitest"
+import { execFileSync } from "node:child_process"
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { SUPATYPE_GITIGNORE_BLOCK, SUPATYPE_GITIGNORE_PATHS } from "../src/gitignore.js"
+
+let dir: string
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "supatype-ignore-"))
+  execFileSync("git", ["init", "-q", "."], { cwd: dir })
+})
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true })
+})
+
+/** What git itself says about a path, which is the only answer that counts. */
+function ignored(relPath: string): boolean {
+  try {
+    execFileSync("git", ["check-ignore", "-q", relPath], { cwd: dir })
+    return true
+  } catch {
+    return false
+  }
+}
+
+function writeIgnore(contents: string): void {
+  writeFileSync(join(dir, ".gitignore"), contents, "utf8")
+  mkdirSync(join(dir, "functions"), { recursive: true })
+  mkdirSync(join(dir, "src"), { recursive: true })
+  for (const f of [
+    ".env",
+    ".env.local",
+    "functions/.env.local",
+    "functions/.env.checkout.local",
+    "src/index.ts",
+    "src/env.local.ts",
+  ]) {
+    writeFileSync(join(dir, f), "x", "utf8")
+  }
+}
+
+describe("the block written into an existing .gitignore", () => {
+  beforeEach(() => writeIgnore(SUPATYPE_GITIGNORE_BLOCK))
+
+  it("ignores the plain env file", () => {
+    expect(ignored(".env")).toBe(true)
+  })
+
+  it("ignores the function env files, at the root and nested", () => {
+    // The ones `supatype functions new` writes and the worker reads.
+    expect(ignored(".env.local")).toBe(true)
+    expect(ignored("functions/.env.local")).toBe(true)
+    expect(ignored("functions/.env.checkout.local")).toBe(true)
+  })
+
+  it("does not swallow source files", () => {
+    // `.env.*.local` is a glob, and a careless widening of it catches real code.
+    expect(ignored("src/index.ts")).toBe(false)
+    expect(ignored("src/env.local.ts")).toBe(false)
+  })
+})
+
+describe("the two emitters", () => {
+  it("agree, because they read one list", () => {
+    // They were separate copies and had already drifted. The copy that drifts is the one found
+    // when a key reaches a public repository.
+    for (const path of SUPATYPE_GITIGNORE_PATHS) {
+      expect(SUPATYPE_GITIGNORE_BLOCK).toContain(path)
+    }
+  })
+
+  it("carries the env patterns `.env` alone does not cover", () => {
+    expect(SUPATYPE_GITIGNORE_PATHS).toContain(".env.local")
+    expect(SUPATYPE_GITIGNORE_PATHS).toContain(".env.*.local")
+  })
+})

package/tests/runtime-contract.test.ts

@@ -9,6 +9,22 @@ import { updateAppConfigInProject, updateServerConfigInProject } from "../src/ap
 import type { SupatypeProjectConfig } from "../src/project-config.js"
 import { DENO_RELEASE_PIN } from "../src/release-pins.js"
 
+/**
+ * One service's block from a rendered compose file.
+ *
+ * Compose is asserted as text here rather than parsed, because the CLI ships no YAML parser and a
+ * test is not worth a dependency. Slicing to a single service is what keeps that honest: service
+ * names and `condition: service_healthy` both recur, so a whole-document substring match would
+ * pass on another service's dependency.
+ */
+function serviceBlock(compose: string, name: string): string {
+  const lines = compose.split("\n")
+  const start = lines.indexOf(`  ${name}:`)
+  if (start === -1) return ""
+  const after = lines.slice(start + 1).findIndex((l) => /^ {2}[a-z][a-z0-9-]*:$/.test(l))
+  return lines.slice(start, after === -1 ? lines.length : start + 1 + after).join("\n")
+}
+
 const baseConfig: SupatypeProjectConfig = {
   project: { name: "acme" },
   database: { provider: "docker" },
@@ -260,22 +276,47 @@ describe("runtime contract", () => {
     expect(compose).not.toContain("- ./kong.yml:/etc/kong/kong.yml:ro")
   })
 
-  it("devLocal compose omits host-published db and server ports", () => {
+  it("devLocal compose omits the production ports", () => {
     const compose = renderSelfHostCompose(baseConfig, process.cwd(), { devLocal: true })
     expect(compose).not.toContain('"5432:5432"')
     expect(compose).not.toContain('"9999:9999"')
     expect(compose).toContain("${SUPATYPE_KONG_PORT:-18473}:8000")
-    expect(compose).not.toContain("SUPATYPE_DEV_DB_PORT")
   })
 
-  it("devLocal compose publishes db to host when overrides.engine is set", () => {
-    const compose = renderSelfHostCompose(
+  /**
+   * The database is reachable from this machine, always.
+   *
+   * It used to be published in dev only when something was known to need it, which meant a
+   * fresh project had a database nothing on the host could reach: `supatype seed` resolves a
+   * connection string and the engine connects over TCP, so the first seed got ECONNREFUSED
+   * and the remedy was an environment variable nobody had reason to know about.
+   */
+  it("devLocal compose publishes the database on loopback", () => {
+    const compose = renderSelfHostCompose(baseConfig, process.cwd(), { devLocal: true })
+    expect(compose).toContain("127.0.0.1:${SUPATYPE_DEV_DB_PORT:-54329}:5432")
+  })
+
+  /** Loopback, so it is reachable from here and from nowhere else. */
+  it("devLocal never publishes the database beyond this machine", () => {
+    const compose = renderSelfHostCompose(baseConfig, process.cwd(), { devLocal: true })
+    const dbPorts = compose
+      .split("\n")
+      .filter((line) => line.includes(":5432"))
+      .filter((line) => line.trim().startsWith("-"))
+    expect(dbPorts.length).toBeGreaterThan(0)
+    for (const line of dbPorts) expect(line).toContain("127.0.0.1:")
+  })
+
+  it("an engine override no longer decides whether the database is published", () => {
+    const withOverride = renderSelfHostCompose(
       { ...baseConfig, overrides: { engine: "/tmp/supatype-engine" } },
       process.cwd(),
       { devLocal: true },
     )
-    expect(compose).toContain("127.0.0.1:${SUPATYPE_DEV_DB_PORT:-54329}:5432")
-    expect(compose).not.toContain('"5432:5432"')
+    const without = renderSelfHostCompose(baseConfig, process.cwd(), { devLocal: true })
+    expect(withOverride).toContain("127.0.0.1:${SUPATYPE_DEV_DB_PORT:-54329}:5432")
+    expect(without).toContain("127.0.0.1:${SUPATYPE_DEV_DB_PORT:-54329}:5432")
+    expect(withOverride).not.toContain('"5432:5432"')
   })
 
   it("devLocal proxy upstream rewrites localhost to host.docker.internal", () => {
@@ -375,9 +416,52 @@ describe("runtime contract", () => {
     }
   })
 
-  it("devLocal compose enables STUDIO_OPEN_DEV on supatype-server", () => {
+  it("maps host.docker.internal, so a host proxy works on Linux too", () => {
+    // Docker Desktop resolves this name; Linux does not unless it is mapped. A project proxying
+    // the site or Studio to something on the host therefore worked on macOS and Windows and
+    // failed on Linux, with the gateway reaching nothing and no error naming the cause.
     const compose = renderSelfHostCompose(baseConfig, process.cwd(), { devLocal: true })
-    expect(compose).toContain('STUDIO_OPEN_DEV: "1"')
+    for (const service of ["server", "kong"]) {
+      expect(serviceBlock(compose, service), service).toContain(
+        '- "host.docker.internal:host-gateway"',
+      )
+    }
+  })
+
+  it("publishes the database when a port is asked for", () => {
+    // In dev the port is published only when something on the host needs it, which is normally a
+    // host engine build. Naming a port is the same request: without this the number was honoured
+    // and the port never existed, so anything connecting over TCP got ECONNREFUSED.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-dbport-"))
+    try {
+      writeFileSync(join(dir, ".env"), "SUPATYPE_DEV_DB_PORT=54329\n")
+      const compose = renderSelfHostCompose(baseConfig, dir, { devLocal: true })
+      // The number stays a compose variable so Docker resolves it; what changes is that the
+      // ports block exists at all.
+      expect(serviceBlock(compose, "db")).toContain("ports:")
+      expect(serviceBlock(compose, "db")).toContain("SUPATYPE_DEV_DB_PORT")
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it("leaves the database unpublished when nothing asked for it", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-dbport-"))
+    try {
+      writeFileSync(join(dir, ".env"), "ANON_KEY=x\n")
+      expect(serviceBlock(renderSelfHostCompose(baseConfig, dir, { devLocal: true }), "db"))
+        .not.toContain("5432:5432")
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it("devLocal compose enables STUDIO_OPEN_DEV on supatype-server, and lets it be turned off", () => {
+    const compose = renderSelfHostCompose(baseConfig, process.cwd(), { devLocal: true })
+    // Defaulted rather than hardcoded. `supatype dev` still opens Studio without a sign-in, and
+    // the browser suite can set STUDIO_OPEN_DEV=0 to drive the gate a deployment actually has.
+    // Held as a literal "1" there was no way to test Studio with its authorization on at all.
+    expect(compose).toContain('STUDIO_OPEN_DEV: "${STUDIO_OPEN_DEV:-1}"')
   })
 
   it("production self-host compose does not enable STUDIO_OPEN_DEV", () => {
@@ -597,6 +681,60 @@ export default defineConfig({
     }
   })
 
+  it("offers functions a database URL, off unless the operator sets one", () => {
+    // `ctx.dbUrl` is read from SUPATYPE_DB_URL by the worker, and the generated compose never set
+    // it, so the field was permanently undefined on self-host: a function reaching for it got no
+    // value and nothing to explain why.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-compose-"))
+    try {
+      const compose = readFileSync(
+        writeSelfHostCompose(dir, { ...baseConfig, app: { mode: "none" } }).composePath,
+        "utf8",
+      )
+      const worker = serviceBlock(compose, "functions-worker")
+
+      // Passed through, so the capability is reachable at all.
+      expect(worker).toContain("SUPATYPE_DB_URL:")
+      // Empty by default. The worker treats an empty value as absent, so `ctx.dbUrl` stays
+      // undefined until somebody opts in.
+      expect(worker).toContain("SUPATYPE_DB_URL: ${SUPATYPE_FUNCTIONS_DB_URL:-}")
+      // And its own variable, not the project's owner DSN. Interpolating DATABASE_URL here would
+      // give every function a connection that bypasses access rules, masking and hooks.
+      expect(worker).not.toContain("SUPATYPE_DB_URL: ${DATABASE_URL")
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it("starts storage only once the object store is answering", () => {
+    // seaweedfs had no healthcheck and nothing depended on it, so compose started it alongside
+    // storage. Storage then accepted a bucket creation before seaweedfs was listening, every
+    // bucket in the schema failed with `connect ECONNREFUSED <ip>:8333`, and the metadata row was
+    // written anyway so a later push looked fine. Measured on a live stack: seaweedfs started
+    // twelve minutes after storage with RestartCount 0.
+    //
+    // It lands on the first push after a stack comes up, which is the first push anyone runs.
+    const dir = mkdtempSync(join(tmpdir(), "supatype-compose-"))
+    try {
+      const out = writeSelfHostCompose(dir, { ...baseConfig, app: { mode: "none" } })
+      const compose = readFileSync(out.composePath, "utf8")
+
+      // Sliced to one service, because `seaweedfs` and `service_healthy` both appear elsewhere in
+      // this file and a whole-document substring match would pass on either.
+      const storage = serviceBlock(compose, "storage")
+      expect(storage).toContain("depends_on:")
+      expect(storage).toMatch(/seaweedfs:\s*\n\s*condition: service_healthy/)
+      // Still waits for the database. The fix must not swap one dependency for another.
+      expect(storage).toMatch(/db:\s*\n\s*condition: service_healthy/)
+
+      // `service_healthy` is only meaningful if the service defines health. Without it compose
+      // refuses to start the stack at all, which is a worse failure than the race.
+      expect(serviceBlock(compose, "seaweedfs")).toContain("healthcheck:")
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
   it("renders SeaweedFS with its identities and its own volume", () => {
     const dir = mkdtempSync(join(tmpdir(), "supatype-seaweed-"))
     try {