@wtfalch/foundry 0.45.1 → 0.47.0

package/dist/plan/executor.d.ts

@@ -3,6 +3,7 @@ import { type CallsSfuUrls } from '../calls-sfu.js';
 import type { DeclaredOrg, HostingBuildPack, OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import { type BlueGreenServer, type BlueGreenSubject } from './blue-green.js';
+import { type BouleOwnerSeed } from './boule.js';
 import { type BrokerPort } from './broker-entries.js';
 import { type DeployHealthRuntime } from './deploy-health.js';
 import { type StepAction } from './diff.js';
@@ -865,6 +866,10 @@ export interface ZitadelPort {
      * method is optional until it does; the platform's Access provider step
      * is blocked without it. Like `createApiApp`, the secret is shown once.
      */
+    /** providers 0.12.0: the app's redirect URIs. Absent on an older client. */
+    getOidcAppRedirectUris?(orgId: string, projectId: string, appId: string): Promise<string[]>;
+    /** providers 0.12.0: replaces the app's redirect URIs; true when it wrote. Absent on an older client. */
+    updateOidcAppRedirectUris?(orgId: string, projectId: string, appId: string, redirectUris: string[]): Promise<boolean>;
     createOidcAppWithSecret?(orgId: string, projectId: string, input: {
         name: string;
         redirectUris: string[];
@@ -1200,6 +1205,13 @@ export interface ZitadelPort {
      * `createOidcApp` and `createOidcAppWithSecret` send it on themselves.
      */
     updateOidcAppIdTokenUserinfoAssertion?(orgId: string, projectId: string, appId: string): Promise<boolean>;
+    /**
+     * Replaces an existing app's post-logout redirect URIs (`@wtfalch/providers`'
+     * `ZitadelClient.updateOidcAppPostLogoutRedirectUris`, which refuses an empty
+     * list). Optional: a host whose client lacks it gets no update planned
+     * (`FoundryPlanApplyOptions.zitadelPostLogoutUris`), and nothing throws.
+     */
+    updateOidcAppPostLogoutRedirectUris?(orgId: string, projectId: string, appId: string, postLogoutRedirectUris: string[]): Promise<void>;
     /**
      * Auth ADR 0002: an existing sign-in app issues JWT access tokens and holds
      * every `redirectUris` entry (`@wtfalch/providers` 0.11.0). Resolves `true`
@@ -1215,6 +1227,25 @@ export interface ZitadelPort {
     ensureAccessTokenLifetime?(seconds: number): Promise<{
         changed: boolean;
     }>;
+    /** Reads one app by id. Resolves `null` only when ZITADEL answers not-found (providers 0.12.0). */
+    getApp?(orgId: string, projectId: string, appId: string): Promise<{
+        id: string;
+        name: string;
+        appType: 'web' | 'native' | 'api';
+        state: string;
+        clientId?: string;
+    } | null>;
+    /** The app's registered redirect URIs (providers 0.12.0). */
+    getOidcAppRedirectUris?(orgId: string, projectId: string, appId: string): Promise<string[]>;
+    /** Replaces the app's redirect URIs. Resolves `true` when it wrote. Refuses an empty list (providers 0.12.0). */
+    updateOidcAppRedirectUris?(orgId: string, projectId: string, appId: string, redirectUris: string[]): Promise<boolean>;
+    /** Turns the project's role check and has-project check on or off. Idempotent (providers 0.12.0). */
+    setProjectRoleChecks?(orgId: string, projectId: string, want: {
+        projectRoleCheck: boolean;
+        hasProjectCheck: boolean;
+    }): Promise<{
+        changed: boolean;
+    }>;
     /**
      * Sets one metadata key on an org (`wtfalch.signIn = email-code` on the
      * customers organisation). An upsert, so a repeat is no change. Optional, with
@@ -1232,8 +1263,8 @@ export interface ZitadelPort {
  * listApps` -- a plain array, with no `loginBaseUri` or completeness signal
  * -- into {@link ZitadelPort.listApps}'s own shape, so a host wiring that
  * real client in satisfies this port without reaching into `executor.ts`
- * itself to build the wrapper by hand. `complete: true` on every call:
- * since providers 0.7.4 the real client pages `_search` to the end. A host
+ * itself to build the wrapper by hand. `complete` is true only when the client
+ * has `getApp` (#557; providers 0.12.0, which pages `_search` to the end). A host
  * that supplies its own `listApps` keeps whatever `complete` it reports.
  * Each app's `clientId` (providers 0.7.5) passes through. `loginBaseUri` comes back `undefined`
  * for every app for the identical reason -- the real client does not read
@@ -1244,6 +1275,7 @@ export interface ZitadelPort {
  */
 export declare function adaptZitadelListApps(client: {
     listApps(orgId: string, projectId: string): Promise<ZitadelListAppsRawApp[]>;
+    getApp?: unknown;
 }): ZitadelPort['listApps'];
 /**
  * The real `@wtfalch/providers` `ZitadelClient.listApps`' own return shape
@@ -1566,6 +1598,22 @@ export interface EdgePort {
  * `baseUrl` is refused (the real API's `409`); this port surfaces that as a
  * thrown error, like any other provider refusal in this file.
  */
+export interface BouleOwnersPort {
+    /** Posts the owners to the company's Boule. Throws `BouleOwnersError` (status only) on any failure. */
+    seed(input: {
+        hostname: string;
+        organisationId: string;
+        secret: string;
+        owners: readonly BouleOwnerSeed[];
+    }): Promise<{
+        results: readonly {
+            subject: string;
+            outcome: 'created' | 'exists' | 'refused';
+            filled: readonly string[];
+            code?: string;
+        }[];
+    }>;
+}
 export interface JobsSchedulerPort {
     registerProject(input: {
         name: string;
@@ -1613,6 +1661,8 @@ export interface FoundryStepExecutorPorts {
      * org's registration as blocked instead of planning a step that would throw.
      */
     jobsScheduler?: JobsSchedulerPort;
+    /** Seeds a company's declared owners into its Boule. Default: {@link httpBouleOwners}. */
+    bouleOwners?: BouleOwnersPort;
     /** The shared calls SFU's own LiveKit credentials (#145) -- see {@link CallsSfuPort}'s own doc comment. */
     callsSfu: CallsSfuPort;
     /**
@@ -2104,6 +2154,28 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * never the cause.
      */
     private zitadelIdTokenUserinfo;
+    /**
+     * Replaces the post-logout redirect URIs of each live app the planner named.
+     * An app's marker (its id and the set it holds) is recorded and persisted
+     * only after its call returned, so a call that throws leaves none and the
+     * next plan names the app again. The error names ids only, never the cause.
+     */
+    private zitadelPostLogoutUris;
+    /**
+     * #339: registers `/auth/desktop/callback` on each live web sign-in app the
+     * planner named, keeping every redirect URI the app already holds (the
+     * union of the current list and the wanted one; a write only when the
+     * union is larger). An app's marker (its ZITADEL app id) is recorded and
+     * persisted only after its read and write resolved, so a failure leaves no
+     * marker and the next plan names the app again. The error names ids only,
+     * never the cause.
+     */
+    private zitadelDesktopCallback;
+    /**
+     * The hostnames a company web app signs in at: the same rule `zitadelApp`
+     * uses for the redirect URIs it creates the app with.
+     */
+    private signInHostnames;
     /**
      * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
      * login host (`action.desired.host`) to the ZITADEL instance's trusted
@@ -2113,10 +2185,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      *
      * In-app sign-in (`signIn.inApp`, `plan/sign-in.ts` has the order): an app host is trusted first. It is
      * bound, and its app pointed at `/sign-in/`, only once its app runs `SIGNIN_UPSTREAM` (the app step
-     * records that). The bind moves the app's client id off the company's binding in the same write (the
-     * login refuses a client id in two bindings); a company binding left with no client is removed.
-     * Switched off, the client id goes back and the base URI returns to the login host, and a trusted
-     * domain is given up only after the app dropped the env.
+     * records that). From auth 0.28.0 the move is three writes (the login then allows one client in two
+     * bindings of one company): the app host's binding with the id kept on the company's, the base URI, then
+     * the company's binding without the id. Before it, one write moves the id (the login refuses a client in
+     * two bindings) and a short gap follows. A company binding left with no client is removed.
+     * Switched off, the id goes back to the company binding, then the base URI returns to the login host, then
+     * the app binding goes; a trusted domain is given up only after the app dropped the env.
      *
      * #274: when the org's host has moved (`recorded[key]`, the *previous*
      * run's resourceId, differs from this run's `host`), also removes every
@@ -2308,6 +2382,18 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * the connection URL or a response body.
      */
     private coolifyBackup;
+    private orgPostgresDeps;
+    /** `coolify:org-postgres` (#444): the company's one Postgres server. */
+    private orgPostgresServer;
+    /** `coolify:org-postgres-databases` (#444): a database and its roles for each home that has none. */
+    private orgPostgresDatabases;
+    /**
+     * `coolify:org-postgres-migrate` (#444): one home's data from its old Coolify database to the
+     * company's server. Refuses before any port call unless the staging confirmation is recorded.
+     */
+    private orgPostgresMigrate;
+    /** The apps that use a home's database, found the way each service finds its own app. */
+    private migrationConsumers;
     private coolifyDatabase;
     /**
      * Pushes the database's connection string into the app's environment,
@@ -2327,6 +2413,26 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * never logged, never interpolated into a thrown error.
      */
     private pushDatabaseUrl;
+    /**
+     * #444: the home's owner URL on the company's Postgres server, built from
+     * the server's live host and the owner password the host holds
+     * (`deliverSecret` under `org-postgres:<slug>:<home>:owner`). Only for a
+     * home {@link homeLocation} puts on the server. The password is registered
+     * for redaction and goes only into the returned URL.
+     */
+    private serverHome;
+    /** #444: whether `schema`'s database is on the company's server (recorded, and not waiting for its migration). */
+    private homeOnServer;
+    /**
+     * #444: a home's database. On the company's server nothing is made or
+     * recorded (the legacy id stays unset, or the home would read as unmigrated)
+     * and `ensureLegacy` is never called, so no `POSTGRES_INITDB_ARGS` is set:
+     * the provisioning job creates the database with its collation. Otherwise
+     * today's calls, unchanged.
+     */
+    private ensureHomeDatabase;
+    /** The owner URL of a home from {@link ensureHomeDatabase}; the legacy one is read live and started. */
+    private homeOwnerUrl;
     /**
      * `null` once the app already has a `DATABASE_URL` -- never rotated, the
      * same rule `ensureCmsRuntimeUrl` follows and for the same reason: the
@@ -2406,6 +2512,7 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * hosting entry's is: with the `AUTH_APP_KEY` `coolifyBoule` put in the
      * Boule app's env.
      */
+    private bouleOwners;
     private bouleBrokerEntry;
     /** The shared tail of both broker-entry steps: read the app's key, write the entry, record what was written. */
     private writeAppBrokerEntry;
@@ -2978,6 +3085,29 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * behind it.
      */
     private coolifyAgora;
+    /**
+     * `plan/desktop-auth.ts`'s `planDesktopAuth`: Agora's desktop sign-in backend, built from the agora repo's
+     * `apps/desktop-auth`, internal only (Agora proxies `/auth/desktop/*` to `<slug>-desktop-auth:8080`).
+     *
+     * Env: the non-secret values from `desktopAuthEnv`, the owner and runtime URLs of the company server's
+     * `desktop_auth` home (rebuilt from the held passwords on every run; the owner URL is for the migrate that
+     * runs first in the image, which drops it before the server starts), and two secrets generated once. A secret
+     * is minted only when the app's env lacks it, and both go into the one write with the rest, so a reapply or a
+     * crash before the write never leaves two. Neither is delivered anywhere else.
+     *
+     * Deployed once after creation, again when the app is not running, and restarted when only the env changed
+     * (decided from the live app, not from this run). The readiness probe goes through Agora once Agora carries
+     * the upstream; the first apply has none to probe, and the next plan turns the upstream on. The callback URI is
+     * added to Agora's client last, as the union of what the client holds and the callback (never removing one).
+     */
+    private coolifyDesktopAuth;
+    /** Whether the org's running Agora carries `AGORA_DESKTOP_AUTH_UPSTREAM`, read from its live env. */
+    private agoraUpstreamLive;
+    /**
+     * Adds `callback` to the Agora client's redirect URIs, keeping the ones it has. A providers client older
+     * than 0.12.0 cannot do it: the step records that and the planner reports it blocked, rather than failing.
+     */
+    private addDesktopAuthCallback;
     /**
      * Records whether an app's running env holds `SIGNIN_UPSTREAM` (the app's host while it does, `''` once it
      * does not), so the login-host step knows when to point the base URI at the app and when it may give the