@wtfalch/foundry 0.45.1 → 0.47.0

package/dist/plan/desktop-auth.js

@@ -0,0 +1,144 @@
+import { createHash } from 'node:crypto';
+import { ORG_SERVICE_SCHEMAS, orgServiceDatabase } from '../org.js';
+import { AGORA_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_PORT, ZITADEL_ORG_SCOPE_KEY, agoraHostnameFor, desktopAuthInternalName, desktopAuthUpstream, withRecordedMessagingProject, } from './agora.js';
+import { ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
+export { DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_PORT, desktopAuthInternalName, desktopAuthUpstream, };
+/**
+ * #440: Agora's desktop sign-in backend (`apps/desktop-auth` of the agora repo), one internal app per
+ * company on its Postgres server's `desktop_auth` home. Agora proxies `/auth/desktop/*` to it. Its own
+ * secrets (cookie, handoff key) live in its env only and are generated once.
+ */
+export const DESKTOP_AUTH_DOCKERFILE = '/apps/desktop-auth/Dockerfile';
+export const DESKTOP_AUTH_HOME = 'desktop_auth';
+/** The digest of the non-secret env last written; a changed hostname, issuer or id plans the step again. */
+export const DESKTOP_AUTH_REVISION_SCOPE_KEY = 'coolify_desktop_auth_revision';
+/** The Agora origin the app was last written for (CLAUDE.md rule 3: the applied hostname is a scope id). */
+export const DESKTOP_AUTH_ORIGIN_SCOPE_KEY = 'coolify_desktop_auth_origin';
+/** The callback URI last put on Agora's client, or `unsupported:<uri>` when the providers client cannot. */
+export const DESKTOP_AUTH_REDIRECT_SCOPE_KEY = 'coolify_desktop_auth_redirect';
+/** Recorded once the readiness probe through Agora answered. */
+export const DESKTOP_AUTH_READY_SCOPE_KEY = 'coolify_desktop_auth_ready';
+/** `https://<agora host>/auth/desktop/callback`. */
+export function desktopAuthCallbackUri(agoraOrigin) {
+    return `${agoraOrigin}/auth/desktop/callback`;
+}
+export const desktopAuthOrigin = (org) => `https://${agoraHostnameFor(org)}`;
+/** The route desktop-auth answers 200 on without a session; foundry probes it through Agora. */
+export const DESKTOP_AUTH_READY_PATH = '/auth/desktop/error';
+export const desktopAuthRedirectUnsupported = (uri) => `unsupported:${uri}`;
+/** The inputs from the host values and recorded ids, and the names of those still missing. */
+export function desktopAuthInputs(org, recorded, rawHost) {
+    const host = withRecordedMessagingProject(rawHost, recorded);
+    const clientId = recorded[AGORA_CLIENT_ID_SCOPE_KEY];
+    const organisationId = recorded[ZITADEL_ORG_SCOPE_KEY];
+    const missing = [];
+    if (!host.issuer)
+        missing.push('issuer');
+    if (!clientId)
+        missing.push('clientId');
+    if (!organisationId)
+        missing.push('zitadelOrgId');
+    if (!host.messagingProjectId)
+        missing.push('messagingProjectId');
+    if (!host.mailProjectId)
+        missing.push('mailProjectId');
+    if (missing.length > 0 || !host.issuer || !clientId || !organisationId) {
+        return { inputs: null, missing };
+    }
+    return {
+        inputs: {
+            origin: desktopAuthOrigin(org),
+            issuer: host.issuer,
+            clientId,
+            organisationId,
+            projectId: host.messagingProjectId,
+            mailProjectId: host.mailProjectId,
+            filesProjectId: recorded[ZITADEL_FILES_PROJECT_SCOPE_KEY] ?? null,
+        },
+        missing,
+    };
+}
+/** The env that is not a secret and not a connection URL. `APP_URL` is the origin with its slash: the app refuses any other form. */
+export function desktopAuthEnv(inputs, runtimeRole) {
+    return {
+        APP_URL: `${inputs.origin}/`,
+        AUTH_ISSUER: inputs.issuer,
+        AUTH_CLIENT_ID: inputs.clientId,
+        AUTH_ORGANIZATION_ID: inputs.organisationId,
+        AUTH_PROJECT_ID: inputs.projectId,
+        MAIL_PROJECT_ID: inputs.mailProjectId,
+        ...(inputs.filesProjectId ? { FILES_PROJECT_ID: inputs.filesProjectId } : {}),
+        DESKTOP_AUTH_RUNTIME_ROLE: runtimeRole,
+        PORT: DESKTOP_AUTH_PORT,
+    };
+}
+export function desktopAuthRevision(env) {
+    const sorted = Object.entries(env).sort(([a], [b]) => (a < b ? -1 : 1));
+    return createHash('sha256').update(JSON.stringify(sorted)).digest('hex').slice(0, 16);
+}
+/** The desktop-auth runtime role's name; the plan needs it for the revision before any URL exists. */
+function runtimeRoleFor(org) {
+    const home = ORG_SERVICE_SCHEMAS.find((h) => h.schema === DESKTOP_AUTH_HOME);
+    if (!home)
+        throw new Error('the desktop_auth home is missing from the topology');
+    return orgServiceDatabase(org, home).runtimeRole;
+}
+/**
+ * The `coolify:desktop-auth` step. Planned when the app is not recorded, when the env it was written for
+ * differs (a rename moves the origin), when it never ran healthy, when the callback URI is not on Agora's
+ * client, and when Agora carries the upstream but the readiness probe never answered. Not planned while
+ * Agora is blocked (its own line says why) or while the `desktop_auth` home cannot exist yet (blocked).
+ * `homePlanned` is true when the databases step in this plan creates the home.
+ */
+export function planDesktopAuth(org, recorded, input) {
+    if (!input.host)
+        return { step: null, blocked: null };
+    const home = ORG_SERVICE_SCHEMAS.find((h) => h.schema === DESKTOP_AUTH_HOME);
+    if (!home || (!recorded[home.scopeKey] && !input.homePlanned)) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s desktop sign-in service is blocked, not planned: its database on the company Postgres server is not recorded yet`,
+        };
+    }
+    const { inputs } = desktopAuthInputs(org, recorded, input.host);
+    const callback = desktopAuthCallbackUri(desktopAuthOrigin(org));
+    const redirect = recorded[DESKTOP_AUTH_REDIRECT_SCOPE_KEY];
+    const blocked = recorded[DESKTOP_AUTH_APP_SCOPE_KEY] && redirect === desktopAuthRedirectUnsupported(callback)
+        ? `${org.slug}'s Agora client lacks the desktop callback ${callback}: the providers client cannot change redirect URIs; add it by hand in ZITADEL or update @wtfalch/providers, then remove the recorded key ${DESKTOP_AUTH_REDIRECT_SCOPE_KEY}`
+        : null;
+    const revision = inputs ? desktopAuthRevision(desktopAuthEnv(inputs, runtimeRoleFor(org))) : null;
+    const upstreamLive = Boolean(input.liveAgoraEnv?.AGORA_DESKTOP_AUTH_UPSTREAM);
+    const reasons = [];
+    if (!recorded[DESKTOP_AUTH_APP_SCOPE_KEY])
+        reasons.push('provision');
+    else {
+        if (revision && recorded[DESKTOP_AUTH_REVISION_SCOPE_KEY] !== revision)
+            reasons.push('env');
+        if (!recorded[DESKTOP_AUTH_DEPLOYED_SCOPE_KEY])
+            reasons.push('never ran healthy');
+        if (redirect !== callback && !blocked)
+            reasons.push('callback URI not on the Agora client');
+        if (upstreamLive && !recorded[DESKTOP_AUTH_READY_SCOPE_KEY])
+            reasons.push('not probed');
+    }
+    if (reasons.length === 0)
+        return { step: null, blocked };
+    return {
+        step: {
+            action: {
+                system: 'coolify',
+                kind: 'desktop-auth',
+                key: org.id,
+                desired: { host: input.host, agoraOrigin: desktopAuthOrigin(org) },
+            },
+            step: {
+                description: reasons[0] === 'provision'
+                    ? `provision ${org.slug}'s desktop sign-in service`
+                    : `update ${org.slug}'s desktop sign-in service (${reasons.join('; ')})`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked,
+    };
+}

package/dist/plan/desktop-callback.d.ts

@@ -0,0 +1,26 @@
+import type { DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+import type { LiveResource } from './live.js';
+/**
+ * #339: the desktop app signs in through the company's web app, so every
+ * `@wtfalch/auth` web client foundry makes registers this path beside
+ * `/auth/callback`. Agora's own client (`/callback`) is not one of them.
+ */
+export declare const DESKTOP_CALLBACK_PATH = "/auth/desktop/callback";
+export declare function desktopCallbackUri(host: string): string;
+/** The URIs to add to an app's current list: current first, then each wanted one it lacks. */
+export declare function unionRedirectUris(current: readonly string[], wanted: readonly string[]): string[];
+/**
+ * The ZITADEL app id of company app `appKey` once its desktop callback was
+ * registered. `planDesktopCallbacks` names an app while its recorded id
+ * differs, so an app made before the callback existed, or made again under a
+ * new id, is repaired once.
+ */
+export declare function zitadelAppDesktopCallbackAppliedScopeKey(appKey: string): string;
+/**
+ * One `zitadel:desktop-callback` step names every live web sign-in app whose
+ * recorded id differs from its marker. Plans nothing when the host's ZITADEL
+ * client lacks the two redirect URI calls (`wired`), before the org and
+ * project are recorded, or while the platform's sign-in is not ready.
+ */
+export declare function planDesktopCallbacks(org: DeclaredOrg, live: readonly LiveResource[], recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], authReady: boolean, wired: boolean): DraftStep | null;

package/dist/plan/desktop-callback.js

@@ -0,0 +1,59 @@
+/**
+ * #339: the desktop app signs in through the company's web app, so every
+ * `@wtfalch/auth` web client foundry makes registers this path beside
+ * `/auth/callback`. Agora's own client (`/callback`) is not one of them.
+ */
+export const DESKTOP_CALLBACK_PATH = '/auth/desktop/callback';
+export function desktopCallbackUri(host) {
+    return `https://${host}${DESKTOP_CALLBACK_PATH}`;
+}
+/** The URIs to add to an app's current list: current first, then each wanted one it lacks. */
+export function unionRedirectUris(current, wanted) {
+    return [...new Set([...current, ...wanted])];
+}
+/**
+ * The ZITADEL app id of company app `appKey` once its desktop callback was
+ * registered. `planDesktopCallbacks` names an app while its recorded id
+ * differs, so an app made before the callback existed, or made again under a
+ * new id, is repaired once.
+ */
+export function zitadelAppDesktopCallbackAppliedScopeKey(appKey) {
+    return `zitadel_app_desktop_callback_applied.${appKey}`;
+}
+/** The fixed Agora client keeps its own `/callback`; it is not built on `@wtfalch/auth`. */
+const NO_DESKTOP_CALLBACK_APPS = new Set(['agora']);
+/**
+ * One `zitadel:desktop-callback` step names every live web sign-in app whose
+ * recorded id differs from its marker. Plans nothing when the host's ZITADEL
+ * client lacks the two redirect URI calls (`wired`), before the org and
+ * project are recorded, or while the platform's sign-in is not ready.
+ */
+export function planDesktopCallbacks(org, live, recordedIds, plannedSteps, authReady, wired) {
+    if (!wired || !authReady || !recordedIds.zitadel_org || !recordedIds.zitadel_project)
+        return null;
+    const apps = live
+        .filter((r) => r.system === 'zitadel' &&
+        r.kind === 'app' &&
+        r.config.appType === 'web' &&
+        !NO_DESKTOP_CALLBACK_APPS.has(r.key))
+        .map((r) => r.key)
+        // An app this plan recreates gets its marker when it is made.
+        .filter((appKey) => !plannedSteps.some((s) => s.action.system === 'zitadel' &&
+        s.action.kind === 'app' &&
+        s.action.key === appKey &&
+        s.action.desired.recreate === true))
+        .filter((appKey) => {
+        const appId = recordedIds[`zitadel:app:${appKey}`];
+        return (Boolean(appId) && recordedIds[zitadelAppDesktopCallbackAppliedScopeKey(appKey)] !== appId);
+    });
+    if (apps.length === 0)
+        return null;
+    return {
+        action: { system: 'zitadel', kind: 'desktop-callback', key: org.id, desired: { apps } },
+        step: {
+            description: `register the desktop sign-in callback for ${org.slug}'s sign-in apps (${apps.join(', ')})`,
+            destroys: false,
+            migrates: false,
+        },
+    };
+}

package/dist/plan/diff.d.ts

@@ -2,7 +2,7 @@ import type { DeclaredOrg, OrgId, OrgServiceSchema } from '../org.js';
 import type { Plan, PlanStep, UnmanagedItem, VersionChangeItem } from '../plan.js';
 import { type AgoraHostReading } from './agora.js';
 import { type BlueGreenServer } from './blue-green.js';
-import type { LiveResource } from './live.js';
+import { type LiveResource } from './live.js';
 import { type OrgPlatformReadiness } from './platform-org.js';
 import { type RemoteDatabaseFacts } from './remote-database.js';
 /**
@@ -49,10 +49,16 @@ export interface PlanOrgOptions {
     oikosZoneReady?: boolean;
     /** #267: the executor was built with a `loginHostBindings` port. */
     loginHostBindings?: boolean;
+    /** The `loginHostBindings` port writes the `clientOrganizations` map (577). */
+    loginHostClientOrganizations?: boolean;
     /** A live read said the org's login host serves OIDC discovery as `https://<host>`. Absent: not read, so Agora keeps the platform issuer. */
     loginHostServesDiscovery?: boolean;
     /** The executor's ZITADEL client has `updateOidcAppIdTokenUserinfoAssertion`; without it `planIdTokenUserinfo` plans nothing. */
     zitadelIdTokenUserinfo?: boolean;
+    /** The executor's ZITADEL client has `updateOidcAppPostLogoutRedirectUris`; without it `planPostLogoutUris` plans nothing. */
+    zitadelPostLogoutUris?: boolean;
+    /** The executor's ZITADEL client has `getOidcAppRedirectUris` and `updateOidcAppRedirectUris` (providers 0.12.0); without them `planDesktopCallbacks` plans nothing. */
+    zitadelRedirectUris?: boolean;
     /** The executor's ZITADEL client has `ensureOidcAppMcpAccess` and `ensureAccessTokenLifetime`; without them `planMcp` is blocked. */
     zitadelMcp?: boolean;
     /** The executor's ZITADEL client has `setOrgMetadata` and `removeOrgMetadata`; without them the customers organisation's sign-in metadata is reported blocked. */
@@ -203,9 +209,10 @@ export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[]
 export declare function isPlatformOwnOrg(org: Pick<DeclaredOrg, 'id'>, platformOwnerOrgId: string | null): boolean;
 /**
  * What {@link planOrgPostgres} reports about the org's one shared Postgres
- * server and its fixed schema topology (#444a, "manifest-and-plan-only"):
- * missing only, nothing applied. Deliberately **not** folded into
- * `plannedSteps` -- the same reason {@link VersionChangeItem} (`../plan.ts`)
+ * server and its fixed schema topology (#444a). Since #444 `planOrgPostgresSteps`
+ * turns it into `coolify:org-postgres` and `coolify:org-postgres-databases` steps; this
+ * report stays. The old note below on why it was **not** folded into
+ * `plannedSteps` is kept for the history -- the same reason {@link VersionChangeItem} (`../plan.ts`)
  * never is, restated in `computePlanDetail`'s own doc comment below, but
  * sharper here: `plan-apply.ts`'s `runSteps` executes every
  * `detail.plannedSteps` entry through `StepExecutor.execute`, which
@@ -236,6 +243,8 @@ export interface OrgPostgresPlan {
      * it as part of the full topology.
      */
     missingSchemas: readonly OrgServiceSchema[];
+    /** Homes whose data is still in a legacy Coolify database. Empty for a new company. Informational; a step exists only after the confirmation. */
+    legacyUnmigrated: readonly OrgServiceSchema[];
 }
 /** Restated from `executor.ts`, the same rule: the id of an ai key minted but not delivered. */
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";