@vaharoni/devops 1.2.12 → 1.2.14

package/dist/chunk-N7EX3HJH.js

@@ -0,0 +1,139 @@
+import {
+  getConst
+} from "./chunk-RZ46YYZZ.js";
+
+// src/app-support/crypto/aes.ts
+import crypto from "crypto";
+var ALGORITHM = "aes-256-gcm";
+var IV_LENGTH = 12;
+var AUTH_TAG_LENGTH = 16;
+function getKey() {
+  const keyStr = process.env.MONOREPO_BASE_SECRET;
+  if (!keyStr) throw new Error("MONOREPO_BASE_SECRET not set");
+  return Buffer.from(keyStr, "hex");
+}
+function encryptAes256Gcm(plaintext, key) {
+  key ??= getKey();
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv, {
+    authTagLength: AUTH_TAG_LENGTH
+  });
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final()
+  ]);
+  const authTag = cipher.getAuthTag();
+  return [
+    iv.toString("base64"),
+    authTag.toString("base64"),
+    encrypted.toString("base64")
+  ].join(":");
+}
+function decryptAes256Gcm(ciphertext, key) {
+  key ??= getKey();
+  const [ivB64, authTagB64, encryptedB64] = ciphertext.split(":");
+  const iv = Buffer.from(ivB64, "base64");
+  const authTag = Buffer.from(authTagB64, "base64");
+  const encrypted = Buffer.from(encryptedB64, "base64");
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, {
+    authTagLength: AUTH_TAG_LENGTH
+  });
+  decipher.setAuthTag(authTag);
+  return Buffer.concat([
+    decipher.update(encrypted),
+    decipher.final()
+  ]).toString("utf8");
+}
+
+// src/app-support/crypto/secret.ts
+import { createHmac } from "crypto";
+function sign(data) {
+  const keyStr = process.env.MONOREPO_BASE_SECRET;
+  if (!keyStr) throw new Error("Secret not set");
+  const key = Buffer.from(keyStr, "hex");
+  return createHmac("sha256", key).update(data).digest("hex");
+}
+function verify(data, signature) {
+  const generatedSignature = sign(data);
+  return generatedSignature === signature;
+}
+
+// src/app-support/crypto/internal-token.ts
+var InternalTokenError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InternalTokenError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+function defaultClaims({
+  expiresInSeconds,
+  sub,
+  aud
+}) {
+  return {
+    iss: `${getConst("project-name")}-internal`,
+    iat: Math.floor(Date.now() / 1e3),
+    exp: Math.floor(Date.now() / 1e3) + expiresInSeconds,
+    sub,
+    aud
+  };
+}
+function generateInternalAuthToken({
+  customClaims = {},
+  expiresInSeconds = 60,
+  sub,
+  aud
+} = {}) {
+  const data = {
+    ...customClaims,
+    // This should be after the customClaims so that custom claims cannot override the default claims
+    ...defaultClaims({ expiresInSeconds, sub, aud })
+  };
+  const str = JSON.stringify(data);
+  const encodedData = Buffer.from(str).toString("base64");
+  const signature = sign(encodedData);
+  return `${encodedData}.${signature}`;
+}
+function parseInternalAuthTokenOrThrow(token) {
+  const [encodedData, signature] = token.split(".");
+  const isSignatureOk = verify(encodedData, signature);
+  if (!isSignatureOk) {
+    throw new InternalTokenError("Invalid token");
+  }
+  const dataStr = Buffer.from(encodedData, "base64").toString("utf-8");
+  const data = JSON.parse(dataStr);
+  if (data.exp < Math.floor(Date.now() / 1e3)) {
+    throw new InternalTokenError("Token expired");
+  }
+  return data;
+}
+
+// src/app-support/crypto/index.ts
+var InternalToken = class {
+  constructor(subject) {
+    this.subject = subject;
+  }
+  generate() {
+    return generateInternalAuthToken({ sub: this.subject });
+  }
+  verifyOrThrow(token) {
+    const parsedToken = parseInternalAuthTokenOrThrow(token);
+    if (parsedToken.sub !== this.subject) {
+      throw new Error("Invalid token");
+    }
+  }
+  verifyFromHeaderOrThrow(authorizationHeader) {
+    if (!authorizationHeader) {
+      throw new Error("Authorization header not found");
+    }
+    const token = authorizationHeader.replace("Bearer ", "");
+    this.verifyOrThrow(token);
+  }
+};
+
+export {
+  encryptAes256Gcm,
+  decryptAes256Gcm,
+  InternalToken
+};

package/dist/chunk-RZ46YYZZ.js

@@ -0,0 +1,420 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/types/index.ts
+import { z } from "zod";
+var SUPPORTED_LANGUAGES = ["python", "node"];
+var constFileSchema = z.object({
+  "project-name": z.string(),
+  "infra": z.enum(["hetzner", "digitalocean", "gcloud"]),
+  "image-versions-to-keep": z.number().optional(),
+  "registry-base-url": z.string(),
+  "registry-image-path-prefix": z.string().optional(),
+  "cloudrun-artifact-registry-repo-path": z.string().optional(),
+  "extra-remote-environments": z.array(z.string()),
+  "extra-local-environments": z.array(z.string()),
+  "extensions": z.array(z.string()).optional()
+});
+var singleTemplateSchema = z.object({
+  "copy-common": z.boolean().optional(),
+  "extra-content": z.array(z.string()).optional()
+});
+var singleImageSchema = z.object({
+  "image-template": z.string(),
+  "language": z.enum(SUPPORTED_LANGUAGES),
+  "domains": z.record(z.string()).optional(),
+  "debug-template": z.string().optional(),
+  "cloudrun": z.boolean().optional(),
+  "can-db-migrate": z.boolean().optional(),
+  applications: z.array(z.string())
+});
+var imageFileSchema = z.object({
+  templates: z.record(singleTemplateSchema),
+  images: z.record(singleImageSchema)
+});
+var deploymentSchema = z.object({
+  /** The name of the composite template to build in order to support this deployment */
+  template: z.string(),
+  /** The name used by kubernetes objects. If ommitted, the name field from the enclosing context (e.g. package.json) is used. */
+  app_name: z.string().optional(),
+  /** This will be the name of the internal service used for intra-cluster communication */
+  service_name: z.string().optional(),
+  /** For services, the port to expose */
+  port: z.number().optional(),
+  /** This will be the subdomain of the exposed ingress. If not provided, taken from service_name */
+  subdomain: z.string().optional(),
+  /** For cron jobs */
+  cronJobs: z.array(
+    z.object({
+      /** The name of the cron job. Used to identify in k8s. Should be unique among all cron jobs. */
+      name: z.string().optional(),
+      /** The cron schedule */
+      cron: z.string().optional(),
+      /** The curl command to invoke. Must be an array. */
+      curl: z.array(z.string()).optional()
+    })
+  ).optional(),
+  prefectFlows: z.array(
+    z.object({
+      /** The name of the container inside the prefect pod */
+      flow_name: z.string(),
+      /** The path to the file that runs the flow, relative to the project folder. E.g. src/data_pipeline/main.py */
+      script_path: z.string()
+    })
+  ).optional()
+  /** The catchall below allows any other fields that might be in the package.json file */
+}).catchall(z.any());
+var packageFileNodeSchema = z.object({
+  /** This is considered the project name */
+  name: z.string(),
+  /** Scripts exposed by this project. */
+  scripts: z.record(z.string()).optional(),
+  /** The dependencies of the project */
+  dependencies: z.record(z.string()).optional(),
+  /** When a deployment data is available, a k8s deployment is created */
+  deployment: deploymentSchema.optional()
+});
+var packageFilePythonSchema = z.object({
+  project: z.object({
+    name: z.string(),
+    dependencies: z.string().array().optional()
+  }),
+  tool: z.object({
+    devops: z.object({
+      deployment: deploymentSchema.optional(),
+      scripts: z.record(z.string()).optional()
+    }).optional()
+  }).optional()
+});
+
+// src/libs/config.ts
+import { readFileSync } from "fs";
+import yaml from "yaml";
+import path5 from "path";
+
+// src/libs/discovery/index.ts
+import chalk3 from "chalk";
+import fs4 from "fs";
+import path4 from "path";
+
+// src/libs/discovery/process-package-json.ts
+import chalk from "chalk";
+import fs2 from "fs";
+import { globSync } from "glob";
+import path2 from "path";
+
+// src/libs/discovery/process-common.ts
+import fs from "fs";
+import path from "path";
+var IGNORED_PATHS = ["node_modules/", "venv/"];
+var PackageDataProcessor = class {
+  workspaceNames = /* @__PURE__ */ new Set();
+  loadedFiles = {};
+  language;
+  nameExtractor;
+  constructor(config) {
+    this.language = config.language;
+    this.nameExtractor = config.nameExtractor;
+    this._runFirstPass(config.pathList, config.zodSchema, config.fileParser);
+  }
+  _runFirstPass(pathList, zodSchema, fileParser) {
+    pathList.forEach((packageFilePath) => {
+      if (IGNORED_PATHS.find((path6) => packageFilePath.includes(path6))) return;
+      const unsafeData = fileParser(fs.readFileSync(packageFilePath, "utf8"));
+      const parsedRes = zodSchema.safeParse(unsafeData);
+      if (parsedRes.error) {
+        console.error(`Error parsing ${packageFilePath}: ${parsedRes.error}`);
+        process.exit(1);
+      }
+      const rootDir = path.relative(process.cwd(), path.dirname(packageFilePath));
+      const name = this.nameExtractor(parsedRes.data);
+      this.workspaceNames.add(name);
+      this.loadedFiles[rootDir] = { name, data: parsedRes.data };
+    });
+  }
+  // Should be used by the iterator sent to convert in order to filter out dependencies that are not workspaces
+  filterDependencies(dependencyNames) {
+    return dependencyNames.filter((name) => this.workspaceNames.has(name));
+  }
+  convert(iterator) {
+    return Object.entries(this.loadedFiles).map(([rootPath4, { name, data }]) => {
+      const res = iterator(data);
+      return { rootPath: rootPath4, language: this.language, name, ...res };
+    });
+  }
+};
+
+// src/libs/discovery/process-package-json.ts
+var rootPath = process.env.MONOREPO_ROOT || process.cwd();
+var rootPkgJsonPath = path2.join(rootPath, "package.json");
+var rootPkgJson = JSON.parse(fs2.readFileSync(rootPkgJsonPath, "utf8"));
+var _workspaces = {};
+var _workspacesLoaded = false;
+function nodeWorkspaces() {
+  if (!_workspacesLoaded) {
+    const allPackageJsons = (rootPkgJson.workspaces ?? []).flatMap(
+      (workspaceGlob) => globSync(path2.join(rootPath, workspaceGlob, "package.json"))
+    );
+    const processor = new PackageDataProcessor({
+      language: "node",
+      pathList: allPackageJsons,
+      zodSchema: packageFileNodeSchema,
+      fileParser: JSON.parse,
+      nameExtractor: (data) => data.name
+    });
+    processor.convert((data) => {
+      const { dependencies, ...rest } = data;
+      const dependencyNames = Object.keys(dependencies ?? []);
+      return {
+        ...rest,
+        dependencyNames: processor.filterDependencies(dependencyNames)
+      };
+    }).forEach((pkgData) => {
+      _workspaces[pkgData.name] = pkgData;
+    });
+    console.warn(
+      chalk.yellow(
+        // prettier-ignore
+        `Node workspace discovery initialized. Workspaces found: ${Object.keys(_workspaces).join(", ")}`
+      )
+    );
+    _workspacesLoaded = true;
+  }
+  return _workspaces;
+}
+
+// src/libs/discovery/process-pyproject-toml.ts
+import chalk2 from "chalk";
+import fs3 from "fs";
+import { globSync as globSync2 } from "glob";
+import TOML from "@iarna/toml";
+import path3 from "path";
+var rootPath2 = process.env.MONOREPO_ROOT || process.cwd();
+var rootPyprojectPath = path3.join(rootPath2, "pyproject.toml");
+var _workspaces2 = {};
+var _workspacesLoaded2 = false;
+function pythonWorkspaces() {
+  if (_workspacesLoaded2) return _workspaces2;
+  if (!fs3.existsSync(rootPyprojectPath)) {
+    _workspacesLoaded2 = true;
+    return _workspaces2;
+  }
+  const rootPyproject = TOML.parse(
+    fs3.readFileSync(rootPyprojectPath, "utf8")
+  );
+  const workspaceMembers = rootPyproject?.tool?.uv?.workspace?.members ?? [];
+  const allPyprojectTomls = workspaceMembers.flatMap(
+    (member) => globSync2(path3.join(rootPath2, member, "pyproject.toml"))
+  );
+  const processor = new PackageDataProcessor({
+    language: "python",
+    pathList: allPyprojectTomls,
+    zodSchema: packageFilePythonSchema,
+    fileParser: TOML.parse,
+    nameExtractor: (data) => data.project.name
+  });
+  processor.convert((data) => {
+    const deployment = data.tool?.devops?.deployment;
+    const scripts = data.tool?.devops?.scripts;
+    const dependencyNames = data.project.dependencies ?? [];
+    return {
+      scripts,
+      deployment,
+      dependencyNames: processor.filterDependencies(dependencyNames)
+    };
+  }).forEach((pkgData) => {
+    _workspaces2[pkgData.name] = pkgData;
+  });
+  console.warn(
+    chalk2.yellow(
+      // prettier-ignore
+      `Python workspace discovery initialized. Workspaces found: ${Object.keys(_workspaces2).join(", ")}`
+    )
+  );
+  _workspacesLoaded2 = true;
+  return _workspaces2;
+}
+
+// src/libs/discovery/index.ts
+var rootPath3 = process.env.MONOREPO_ROOT || process.cwd();
+var _workspaces3 = {};
+var _workspacesLoaded3 = false;
+function workspaces() {
+  if (_workspacesLoaded3) return _workspaces3;
+  const nodeWorkspacesData = nodeWorkspaces();
+  const pythonWorkspacesData = pythonWorkspaces();
+  Object.values(nodeWorkspacesData).forEach((data) => {
+    _workspaces3[data.name] = {
+      rootPath: data.rootPath,
+      packageDataEntries: [data]
+    };
+  });
+  Object.values(pythonWorkspacesData).forEach((data) => {
+    const existing = _workspaces3[data.name];
+    if (existing) {
+      if (existing.rootPath !== data.rootPath) {
+        console.error(chalk3.red(`
+Workspace ${data.name} has conflicting root paths:
+	${existing.rootPath}
+	${data.rootPath}
+`));
+        process.exit(1);
+      }
+    } else {
+      _workspaces3[data.name] = {
+        rootPath: data.rootPath,
+        packageDataEntries: []
+      };
+    }
+    _workspaces3[data.name].packageDataEntries.push(data);
+  });
+  _workspacesLoaded3 = true;
+  return _workspaces3;
+}
+function workspaceDirectoryForLanguage(language) {
+  switch (language) {
+    case "node":
+      return nodeWorkspaces();
+    case "python":
+      return pythonWorkspaces();
+    default:
+      throw new Error(`Unsupported language: ${language}`);
+  }
+}
+function getWorkspace(workspaceName) {
+  const workspace = workspaces()[workspaceName];
+  if (!workspace) {
+    console.error(chalk3.red(`
+Workspace ${workspaceName} not found
+`));
+    process.exit(13);
+  }
+  return workspace;
+}
+function globEnvYamlFiles() {
+  const allWorkspaces = workspaces();
+  const workspacePaths = [
+    ...new Set(Object.values(allWorkspaces).map((w) => w.rootPath))
+  ];
+  return workspacePaths.map((wsPath) => path4.join(rootPath3, wsPath, "env.yaml")).filter((p) => fs4.existsSync(p));
+}
+
+// src/libs/config.ts
+var constantsFilePath = path5.join(process.cwd(), ".devops/config/constants.yaml");
+var imagesFilePath = path5.join(process.cwd(), ".devops/config/images.yaml");
+var { getConst } = processConstFile();
+var { getImageData, getImageNames, getTemplateData } = processImagesFile();
+function getImageType(image) {
+  const imageData = getImageData(image);
+  return imageData["cloudrun"] ? "cloudrun" : "k8s";
+}
+function processConstFile() {
+  let constants;
+  function constFileData() {
+    if (constants) return constants;
+    try {
+      const constantsYaml = readFileSync(constantsFilePath, "utf8");
+      constants = yaml.parse(constantsYaml);
+    } catch (e) {
+      console.warn("Warning: cannot read .devops/config/constants.yaml");
+      return { valid: false };
+    }
+    const parseRes = constFileSchema.safeParse(constants);
+    if (parseRes.error) {
+      console.error(`Error parsing config/constants.yaml: ${parseRes.error.toString()}`);
+      process.exit(1);
+    }
+    constants = { valid: true, data: parseRes.data };
+    return constants;
+  }
+  function getConst2(key, opts = {}) {
+    const { valid, data } = constFileData();
+    if (!valid && !opts.ignoreIfInvalid) {
+      console.error(".devops/config/constants.yaml is invalid");
+      process.exit(1);
+    }
+    const value = data?.[key];
+    if (!value && !opts.ignoreIfInvalid) {
+      console.error(`Missing constant in .devops/config/constants.yaml: ${key}`);
+      process.exit(1);
+    }
+    return value;
+  }
+  return { getConst: getConst2 };
+}
+function processImagesFile() {
+  let images;
+  function imagesFileData() {
+    if (images) return images;
+    try {
+      const imagesYaml = readFileSync(imagesFilePath, "utf8");
+      images = yaml.parse(imagesYaml);
+    } catch (e) {
+      console.error("Error reading .devops/config/images.yaml");
+      process.exit(1);
+    }
+    const parseRes = imageFileSchema.safeParse(images);
+    if (parseRes.error) {
+      console.error(
+        `Error parsing config/images.yaml: ${parseRes.error.toString()}`
+      );
+      process.exit(1);
+    }
+    return images;
+  }
+  function getImageData2(imageName) {
+    const imageData = imagesFileData()["images"][imageName];
+    if (!imageData) {
+      console.error(
+        `Image ${imageName} not found in .devops/config/images.yaml`
+      );
+      process.exit(1);
+    }
+    imageData.applications.forEach((project) => {
+      const data = getWorkspace(project);
+      if (!data) {
+        console.error(
+          `Project ${project} not found for image ${imageName} in .devops/config/images.yaml`
+        );
+        process.exit(1);
+      }
+    });
+    return imageData;
+  }
+  function getTemplateData2(templateName) {
+    const templateData = imagesFileData()["templates"][templateName];
+    if (!templateData) {
+      console.error(
+        `Template ${templateName} not found in .devops/config/images.yaml`
+      );
+      process.exit(1);
+    }
+    return templateData;
+  }
+  function getImageNames2() {
+    return Object.keys(imagesFileData()["images"]);
+  }
+  return { getImageData: getImageData2, getImageNames: getImageNames2, getTemplateData: getTemplateData2 };
+}
+
+export {
+  __export,
+  SUPPORTED_LANGUAGES,
+  constFileSchema,
+  imageFileSchema,
+  packageFileNodeSchema,
+  packageFilePythonSchema,
+  IGNORED_PATHS,
+  workspaces,
+  workspaceDirectoryForLanguage,
+  getWorkspace,
+  globEnvYamlFiles,
+  getConst,
+  getImageData,
+  getImageNames,
+  getTemplateData,
+  getImageType
+};