@wtfalch/foundry 0.45.1 → 0.47.0

package/dist/plan/org-postgres.js

@@ -0,0 +1,293 @@
+import { randomBytes } from 'node:crypto';
+import { ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, orgServiceDatabase, } from '../org.js';
+import { JobFailure, waitForJob } from './job-app.js';
+import { ORG_POSTGRES_JOB_ADMIN_ENV, jobCreatesRuntimeRole, orgPostgresPasswordEnv, orgPostgresProvisionDockerfile, orgPostgresRuntimePasswordEnv, } from './org-postgres-job.js';
+import { boundedCall, withCallTimeout } from './signin-db.js';
+/** Recorded once a live company's data for `home` is copied to the org's server (#444). */
+export const orgPostgresMigratedScopeKey = (home) => `org_postgres_migrated.${home}`;
+/** Whether `home` still has a legacy Coolify database that has not been moved to the server. */
+export function legacyUnmigrated(org, home, recordedIds) {
+    const legacy = home.legacyKey(org);
+    return (legacy !== null &&
+        Boolean(recordedIds[legacy]) &&
+        !recordedIds[orgPostgresMigratedScopeKey(home.schema)]);
+}
+/**
+ * Pure. Where a consumer finds its database, from recorded ids alone: on the
+ * server once the home is recorded and either it never had a legacy database
+ * or its migration is recorded. A live company stays on its Coolify database
+ * until then.
+ */
+export function serviceOnServer(org, home, recordedIds) {
+    return Boolean(recordedIds[home.scopeKey]) && !legacyUnmigrated(org, home, recordedIds);
+}
+/** Pure. The home's endpoint on the server whose Coolify `internal_db_url` is given; null when that URL has no host. */
+export function serviceEndpoint(org, home, serverInternalUrl) {
+    if (!URL.canParse(serverInternalUrl))
+        return null;
+    const url = new URL(serverInternalUrl);
+    if (!url.hostname)
+        return null;
+    const names = orgServiceDatabase(org, home);
+    return {
+        host: url.hostname,
+        port: url.port || '5432',
+        database: names.database,
+        ownerUser: names.ownerRole,
+        runtimeUser: names.runtimeRole,
+    };
+}
+/** Pure. The owner URL, and the runtime URL when a runtime password is given. */
+export function serviceUrls(endpoint, ownerPassword, runtimePassword) {
+    const build = (user, password) => `postgres://${encodeURIComponent(user)}:${encodeURIComponent(password)}@${endpoint.host}:${endpoint.port}/${endpoint.database}`;
+    return {
+        owner: build(endpoint.ownerUser, ownerPassword),
+        runtime: runtimePassword === null ? null : build(endpoint.runtimeUser, runtimePassword),
+    };
+}
+// Restore path: roles are not in a Coolify dump. Re-run the provisioning job (idempotent; it is
+// given a password only for a home not recorded), then `pg_restore` each dump with
+// `--no-owner --no-acl --role=<owner>`. Template apps create `<db>_rt` again on first boot.
+/** The server's name in Coolify. */
+export const orgPostgresServerName = (org) => `${org.slug}-postgres`;
+/** The job app's name in Coolify. */
+export const orgPostgresJobName = (org) => `${org.slug}-postgres-job`;
+/** The job app's id while it exists. */
+export const ORG_POSTGRES_JOB_APP_SCOPE_KEY = 'org_postgres_job_app';
+/** An opaque id, set between a password's mint and its delivery. Never the password. */
+export const orgPostgresUndeliveredScopeKey = (home) => `org_postgres_undelivered.${home}`;
+/** Where the host holds a home's password, once delivered. */
+export const orgPostgresSecretRef = (org, home, role) => `org-postgres:${org.slug}:${home}:${role}`;
+/** How many times each password is handed to `deliverSecret`. */
+export const ORG_POSTGRES_DELIVERY_ATTEMPTS = 3;
+/**
+ * The two steps that make the company's Postgres server and its databases true, from recorded ids
+ * alone: the server while it is not recorded, the databases of every enabled home that is not. The
+ * databases step needs no precondition beyond the server step before it in the same plan.
+ */
+export function planOrgPostgresSteps(org, plan) {
+    const steps = [];
+    if (plan.serverMissing) {
+        steps.push({
+            action: { system: 'coolify', kind: 'org-postgres', key: org.id, desired: {} },
+            step: {
+                description: `create ${org.slug}'s one Postgres server (${orgPostgresServerName(org)})`,
+                destroys: false,
+                migrates: false,
+            },
+        });
+    }
+    if (plan.missingSchemas.length > 0) {
+        const homes = plan.missingSchemas.map((home) => home.schema);
+        steps.push({
+            action: {
+                system: 'coolify',
+                kind: 'org-postgres-databases',
+                key: org.id,
+                desired: { homes },
+            },
+            step: {
+                description: `create ${org.slug}'s databases and roles on its Postgres server: ${homes.join(', ')}`,
+                destroys: false,
+                migrates: false,
+            },
+        });
+    }
+    return steps;
+}
+const mint = () => randomBytes(24).toString('base64url');
+const mintOpaque = () => randomBytes(12).toString('hex');
+/** Creates the company's Postgres server once and starts it. Returns the Coolify uuid. */
+export async function provisionOrgPostgresServer(scope, deps, org) {
+    const coolify = withCallTimeout(deps.coolify);
+    let id = scope.recordedIds()[ORG_POSTGRES_SERVER_SCOPE_KEY];
+    if (!id) {
+        const projectUuid = await deps.ensureProject();
+        const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const name = orgPostgresServerName(org);
+        const found = (await coolify.listDatabases()).find((db) => db.name === name && db.environment_id === environment.id);
+        if (found) {
+            id = found.uuid;
+        }
+        else {
+            const created = await coolify.createPostgresDatabase({
+                project_uuid: projectUuid,
+                server_uuid: await deps.serverUuid(),
+                environment_name: environment.name,
+                environment_uuid: environment.uuid,
+                name,
+                postgres_db: 'postgres',
+                postgres_user: 'postgres',
+            });
+            id = created.uuid;
+        }
+        // Recorded before it is started: a crash after the create must not make a second container.
+        scope.recordScopeId(ORG_POSTGRES_SERVER_SCOPE_KEY, id);
+        await scope.persist();
+    }
+    await boundedCall(deps.startDatabase(id), 'Coolify startDatabase');
+    return { resourceId: id };
+}
+/**
+ * Creates the databases and roles of the homes in `homeKeys` that are not recorded, with one job app
+ * for all of them, then hands each owner password to the host and records the home.
+ *
+ * One mint (CLAUDE.md platform rule 1): each home's password is minted once per attempt, an opaque id
+ * is recorded under `org_postgres_undelivered.<home>` and persisted before the job runs, and the home
+ * is recorded only after the password is delivered. A run that dies between the two finds the id,
+ * and mints again: no consumer has read the old password, and the job sets the new one.
+ */
+export async function provisionOrgPostgresDatabases(scope, deps, org, homeKeys) {
+    const label = `${org.slug}'s Postgres databases`;
+    const coolify = withCallTimeout(deps.coolify);
+    const recorded = scope.recordedIds();
+    const serverId = recorded[ORG_POSTGRES_SERVER_SCOPE_KEY];
+    if (!serverId)
+        throw new Error(`${label}: the Postgres server is not recorded yet`);
+    const homes = ORG_SERVICE_SCHEMAS.filter((home) => homeKeys.includes(home.schema) && !recorded[home.scopeKey]);
+    if (homes.length === 0)
+        return;
+    const databases = homes.map((home) => orgServiceDatabase(org, home));
+    const onSecret = (value) => deps.onSecret?.(value);
+    const server = await boundedCall(deps.startDatabase(serverId), 'Coolify startDatabase');
+    if (!server.internal_db_url)
+        throw new Error(`${label}: the Postgres server has no internal URL`);
+    const adminUrl = server.internal_db_url;
+    onSecret(adminUrl);
+    if (URL.canParse(adminUrl)) {
+        const password = decodeURIComponent(new URL(adminUrl).password);
+        if (password)
+            onSecret(password);
+    }
+    const mintPassword = deps.mintPassword ?? mint;
+    const passwords = new Map();
+    for (const home of databases) {
+        const owner = mintPassword();
+        const runtime = jobCreatesRuntimeRole(home) ? mintPassword() : null;
+        onSecret(owner);
+        if (runtime)
+            onSecret(runtime);
+        passwords.set(home.schema, { owner, runtime });
+        scope.recordScopeId(orgPostgresUndeliveredScopeKey(home.schema), (deps.mintId ?? mintOpaque)());
+    }
+    await scope.persist();
+    await runJob(scope, deps, org, label, coolify, databases, adminUrl, passwords);
+    const failed = [];
+    for (const home of databases) {
+        const held = passwords.get(home.schema);
+        if (!held)
+            continue;
+        try {
+            await deliver(deps, orgPostgresSecretRef(org, home.schema, 'owner'), held.owner);
+            if (held.runtime) {
+                await deliver(deps, orgPostgresSecretRef(org, home.schema, 'runtime'), held.runtime);
+            }
+        }
+        catch {
+            failed.push(home.schema);
+            continue;
+        }
+        scope.recordScopeId(`org_postgres_schema.${home.schema}`, home.database);
+        scope.recordScopeId(orgPostgresUndeliveredScopeKey(home.schema), '');
+        await scope.persist();
+    }
+    if (failed.length > 0) {
+        throw new Error(`${label}: the passwords for ${failed.join(', ')} were set but could not be delivered after ${ORG_POSTGRES_DELIVERY_ATTEMPTS} attempts; the next apply sets and delivers new ones`);
+    }
+}
+async function deliver(deps, ref, secret) {
+    for (let attempt = 1; attempt <= ORG_POSTGRES_DELIVERY_ATTEMPTS; attempt += 1) {
+        try {
+            await boundedCall(deps.deliverSecret(ref, secret), 'deliverSecret');
+            return;
+        }
+        catch {
+            // The cause may carry the secret; nothing of it is kept.
+        }
+    }
+    throw new Error('delivery failed');
+}
+async function runJob(scope, deps, org, label, coolify, databases, adminUrl, passwords) {
+    const jobName = orgPostgresJobName(org);
+    let jobAppId;
+    try {
+        const projectUuid = await deps.ensureProject();
+        const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
+        // A job left by an earlier run holds an old script and old passwords: it is replaced, never reused.
+        const leftover = await coolify.findApplicationByName(jobName, {
+            environmentIds: [environment.id],
+        });
+        if (leftover)
+            await coolify.raw('DELETE', `/applications/${leftover.uuid}`);
+        const created = await coolify.createDockerfileApplication({
+            project_uuid: projectUuid,
+            server_uuid: await deps.serverUuid(),
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            dockerfile: orgPostgresProvisionDockerfile(databases),
+            name: jobName,
+            description: `${org.slug}'s Postgres databases job`,
+            instant_deploy: false,
+            autogenerate_domain: false,
+        });
+        jobAppId = created.uuid;
+        scope.recordScopeId(ORG_POSTGRES_JOB_APP_SCOPE_KEY, jobAppId);
+        await scope.persist();
+        await coolify.updateApplication(jobAppId, { health_check_enabled: false });
+        await coolify.bulkUpsertEnvs(jobAppId, [
+            { key: ORG_POSTGRES_JOB_ADMIN_ENV, value: adminUrl },
+            ...databases.flatMap((home) => {
+                const held = passwords.get(home.schema);
+                if (!held)
+                    return [];
+                return [
+                    { key: orgPostgresPasswordEnv(home.schema), value: held.owner },
+                    ...(held.runtime
+                        ? [{ key: orgPostgresRuntimePasswordEnv(home.schema), value: held.runtime }]
+                        : []),
+                ];
+            }),
+        ]);
+        await coolify.deploy(jobAppId, true);
+        await waitForJob(coolify, jobAppId, deps.runtime ?? {}, {
+            job: 'the Postgres job',
+            stopped: 'the Postgres job stopped before it finished',
+        });
+    }
+    catch (error) {
+        const why = error instanceof JobFailure ? error.message : 'a Coolify call failed or timed out';
+        // The failed job app must not keep running with the admin URL and passwords in its env.
+        let cleaned = '';
+        if (jobAppId) {
+            const id = jobAppId;
+            const blank = [
+                ORG_POSTGRES_JOB_ADMIN_ENV,
+                ...databases.flatMap((home) => [
+                    orgPostgresPasswordEnv(home.schema),
+                    orgPostgresRuntimePasswordEnv(home.schema),
+                ]),
+            ].map((key) => ({ key, value: '' }));
+            try {
+                await boundedCall(coolify.raw('POST', `/applications/${id}/stop`), 'stop the job');
+            }
+            catch {
+                cleaned += '; the job app could not be stopped, stop it in Coolify';
+            }
+            try {
+                await boundedCall(coolify.bulkUpsertEnvs(id, blank), 'clear the job env');
+            }
+            catch {
+                cleaned +=
+                    '; its env could not be cleared, delete the app in Coolify (it holds the admin URL)';
+            }
+        }
+        throw new Error(`${label}: ${why}${jobAppId ? `; the job app ${jobAppId} is left stopped without secrets for inspection and the next apply replaces it${cleaned}` : ''}; apply again`);
+    }
+    try {
+        await coolify.raw('DELETE', `/applications/${jobAppId}`);
+    }
+    catch {
+        throw new Error(`${label}: the job ran, but its app ${jobAppId} could not be deleted; delete it in Coolify (it holds the admin URL), then apply again`);
+    }
+    scope.recordScopeId(ORG_POSTGRES_JOB_APP_SCOPE_KEY, '');
+}

package/dist/plan/plan-apply.d.ts

@@ -1,5 +1,5 @@
 import type { DestroyProgress, PlanApply } from '../apply.js';
-import type { DeclaredOrg, OrgId } from '../org.js';
+import type { DeclaredOrg, HostingEntry, OrgId } from '../org.js';
 import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { ReleaseStore } from '../release/state.js';
@@ -14,6 +14,7 @@ import { type UnconfirmedUpgrade } from './confirm-upgrade.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
 import { type LoginHostDiscoveryPort } from './login-host.js';
+import { type OrgPostgresMigrationConfirmation } from './org-postgres-migrate.js';
 import { type EdgePortName, type HeldKeyResolver, type PlatformOwnerInput } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
 import { type ReleaseContext, type ReleaseHost } from './release-host.js';
@@ -62,9 +63,9 @@ export interface AuditLog {
     recordAdoption(entry: {
         actor: AuditActor;
         orgId: OrgId;
-        action: 'adopt' | 'release';
+        action: 'adopt' | 'release' | 'confirm-org-postgres-migration';
         entryKey: string;
-        outcome: 'adopted' | 'released' | 'refused';
+        outcome: 'adopted' | 'released' | 'refused' | 'recorded';
         reason?: string;
         at: Date;
     }): Promise<void>;
@@ -281,6 +282,8 @@ export interface PlatformStepExecutionContext {
 export interface PlatformDriftedSteps {
     archon?: boolean;
     auth?: boolean;
+    /** #643: a recorded sign-in app (ZITADEL, login or broker) is gone from Coolify or not running. */
+    authApps?: boolean;
     /** The host sets it. */
     edge?: boolean;
     /** #380 */
@@ -440,6 +443,18 @@ export declare class PlatformConfirmationRequiredError extends Error {
 export interface FoundryApplyOptions {
     /** Service names (`VersionChangeItem.service`), matched exactly, whose version change the operator confirmed. */
     confirmUpgrade?: readonly string[];
+    /**
+     * A company's own confirmation for one of its apps, in place of the org's name. `apply` passes a
+     * destroying or migrating step only when {@link stepEntryKey} says it belongs to `entryKey` and
+     * `typed` equals `entryKey` exactly. Every other such step still needs the org's name, as does
+     * the whole plan when `typed` differs. It never passes a platform step.
+     */
+    entryConfirmation?: {
+        entryKey: string;
+        typed: string;
+        /** The removed entry's gate keys, read by the caller from the company before the change. */
+        gates?: readonly string[];
+    };
 }
 export interface FoundryPlanApplyOptions {
     store: DeclaredOrgStore;
@@ -466,6 +481,12 @@ export interface FoundryPlanApplyOptions {
      * before zitadel-login's binding can be written.
      */
     loginHostBindings?: boolean;
+    /**
+     * True when the host's `loginHostBindings` port writes the `clientOrganizations` map
+     * (`upsertClientOrganizations` and `deleteClientOrganizations`). Absent or false: the plan says in one
+     * fixed line that the shared login does not check customers clients' organisation.
+     */
+    loginHostClientOrganizations?: boolean;
     /**
      * Reads `GET https://<login host>/.well-known/openid-configuration` for a
      * company's login host (5 s limit). Optional, and without it every company's
@@ -481,6 +502,15 @@ export interface FoundryPlanApplyOptions {
      * token of its existing sign-in apps.
      */
     zitadelIdTokenUserinfo?: boolean;
+    /** True when the host's ZITADEL client has `updateOidcAppPostLogoutRedirectUris`; without it no org plans the post-logout address update. */
+    zitadelPostLogoutUris?: boolean;
+    /**
+     * True when the host's ZITADEL client has `getOidcAppRedirectUris` and
+     * `updateOidcAppRedirectUris` (`@wtfalch/providers` 0.12.0). Optional, and
+     * false without them: no org plans the step that registers the desktop
+     * sign-in callback on its existing sign-in apps.
+     */
+    zitadelRedirectUris?: boolean;
     /**
      * Auth ADR 0002: true when the host's ZITADEL client has `ensureOidcAppMcpAccess`
      * and `ensureAccessTokenLifetime` (`@wtfalch/providers` 0.11.0). Without it every
@@ -644,8 +674,11 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly agora;
     private readonly jobsScheduler;
     private readonly loginHostBindings;
+    private readonly loginHostClientOrganizations;
     private readonly loginHostDiscovery;
     private readonly zitadelIdTokenUserinfo;
+    private readonly zitadelPostLogoutUris;
+    private readonly zitadelRedirectUris;
     private readonly zitadelMcp;
     private readonly zitadelOrgMetadata;
     private readonly broker;
@@ -706,6 +739,13 @@ export declare class FoundryPlanApply implements PlanApply {
      * {@link apply}. Every path writes an audit row.
      */
     release(id: OrgId, entryKey: string): Promise<AppliedState>;
+    /**
+     * Records that the staging copy of a live company's data was checked, which is the only thing that lets
+     * the org Postgres migration step run (#444). It is its own call, never part of an apply. Needs the
+     * platform permission. It stores the staging copy id, who confirmed and when, and writes an audit row.
+     * Throws {@link InvalidMigrationConfirmationError} for a confirmation that is not valid.
+     */
+    confirmOrgPostgresMigration(orgId: OrgId, confirmation: OrgPostgresMigrationConfirmation): Promise<void>;
     private computeAdopt;
     apply(plan: Plan, confirmedOrgName: string, options?: FoundryApplyOptions): Promise<AppliedState>;
     /**
@@ -919,3 +959,20 @@ export declare class FoundryPlanApply implements PlanApply {
  * than a second copy that could drift from it.
  */
 export declare function planNeedsConfirmation(steps: readonly PlanStep[]): boolean;
+/**
+ * The key of the hosting entry a step belongs to, or `null` for a step of the org or the platform.
+ * An entry's own steps are keyed `<orgId>:<entry key>` (its Coolify app, Worker, Worker app, and
+ * ai, edge and files keys); with `orgId` the prefix must be exactly that id. With `entries` (the
+ * declared ones) two more are known: the ZITADEL sign-in client named like an entry that declares
+ * `uses.auth`, and a gate named in an entry's `gates`. The org database, the org-wide files key,
+ * the customers organisation and the issuer belong to no entry. (`apply` lets an entry's
+ * confirmation pass the park of the org database once no declared entry uses a database.)
+ */
+export declare function stepEntryKey(step: {
+    action: Pick<StepAction, 'system' | 'kind' | 'key'>;
+}, orgId?: string, entries?: readonly Pick<HostingEntry, 'key' | 'uses' | 'gates'>[]): string | null;
+/** Whether `confirmation` passes every destroying or migrating step of `steps`: all belong to its entry, and it typed the key. */
+export declare function entryConfirms(confirmation: FoundryApplyOptions['entryConfirmation'], steps: readonly {
+    step: PlanStep;
+    action: StepAction;
+}[], orgId: string, entries: readonly HostingEntry[]): boolean;