alchemy 2.0.0-beta.64 → 2.0.0-beta.66

package/src/Prisma/AuthProvider.ts

@@ -0,0 +1,260 @@
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../Auth/AuthProvider.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
+import { getEnvRedacted, retryOnce } from "../Auth/Env.ts";
+import { AlchemyProfile } from "../Auth/Profile.ts";
+import * as Clank from "../Util/Clank.ts";
+
+export const PRISMA_AUTH_PROVIDER_NAME = "Prisma";
+export const PRISMA_SERVICE_TOKEN_ENV = "PRISMA_SERVICE_TOKEN";
+export const PRISMA_API_TOKEN_ENV = "PRISMA_API_TOKEN";
+
+export type PrismaAuthConfig = { method: "env" } | { method: "stored" };
+
+export interface PrismaStoredCredentials {
+  type: "serviceToken";
+  serviceToken: string;
+}
+
+export interface PrismaResolvedCredentials {
+  type: "serviceToken";
+  serviceToken: Redacted.Redacted<string>;
+  source: { type: PrismaAuthConfig["method"]; details?: string };
+}
+
+const options: Array<{
+  value: PrismaAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "env",
+    label: "Environment Variable",
+    hint: `${PRISMA_SERVICE_TOKEN_ENV} or ${PRISMA_API_TOKEN_ENV}`,
+  },
+  {
+    value: "stored",
+    label: "Service Token",
+    hint: "enter interactively, stored in ~/.alchemy/credentials",
+  },
+];
+
+const nonEmptyToken = (
+  token: Redacted.Redacted<string> | undefined,
+): token is Redacted.Redacted<string> =>
+  token !== undefined && Redacted.value(token).trim().length > 0;
+
+const validStoredCredentials = (
+  credentials: PrismaStoredCredentials | undefined,
+): credentials is PrismaStoredCredentials =>
+  credentials?.type === "serviceToken" &&
+  credentials.serviceToken.trim().length > 0;
+
+const trimToken = (token: Redacted.Redacted<string>) =>
+  Redacted.make(Redacted.value(token).trim());
+
+const readEnvServiceToken = Effect.fnUntraced(function* () {
+  const serviceToken = yield* getEnvRedacted(PRISMA_SERVICE_TOKEN_ENV);
+  if (nonEmptyToken(serviceToken)) {
+    return {
+      serviceToken: trimToken(serviceToken),
+      envName: PRISMA_SERVICE_TOKEN_ENV,
+    };
+  }
+
+  const apiToken = yield* getEnvRedacted(PRISMA_API_TOKEN_ENV);
+  if (nonEmptyToken(apiToken)) {
+    return {
+      serviceToken: trimToken(apiToken),
+      envName: PRISMA_API_TOKEN_ENV,
+    };
+  }
+
+  return undefined;
+});
+
+/**
+ * Layer that registers the Prisma Management API auth provider.
+ */
+export const PrismaAuth = AuthProviderLayer<
+  PrismaAuthConfig,
+  PrismaResolvedCredentials
+>()(
+  PRISMA_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const profiles = yield* AlchemyProfile;
+    const store = yield* CredentialsStore;
+
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const serviceToken = yield* Clank.password({
+        message: "Prisma Service Token",
+        validate: (v) => (v.trim().length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      yield* store.write<PrismaStoredCredentials>(
+        profileName,
+        "prisma-stored",
+        {
+          type: "serviceToken",
+          serviceToken: serviceToken.trim(),
+        },
+      );
+      yield* Clank.success("Prisma: credentials saved.");
+      return { method: "stored" as const };
+    });
+
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "Prisma authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
+
+    const configure = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) return { method: "env" as const };
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
+
+    const read = (
+      profileName: string,
+      config: PrismaAuthConfig,
+    ): Effect.Effect<PrismaResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const envToken = yield* readEnvServiceToken();
+            if (!envToken) {
+              return yield* new AuthError({
+                message: `Prisma env credentials not found. Set ${PRISMA_SERVICE_TOKEN_ENV} or ${PRISMA_API_TOKEN_ENV}.`,
+              });
+            }
+            return {
+              type: "serviceToken" as const,
+              serviceToken: envToken.serviceToken,
+              source: { type: "env" as const, details: envToken.envName },
+            };
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store
+            .read<PrismaStoredCredentials>(profileName, "prisma-stored")
+            .pipe(
+              Effect.flatMap((creds) =>
+                !validStoredCredentials(creds)
+                  ? Effect.fail(
+                      new AuthError({
+                        message:
+                          creds == null
+                            ? "Prisma stored credentials not found. Run: alchemy login --configure"
+                            : "Prisma stored credentials are invalid. Run: alchemy login --configure",
+                      }),
+                    )
+                  : Effect.succeed({
+                      type: "serviceToken" as const,
+                      serviceToken: Redacted.make(creds.serviceToken.trim()),
+                      source: { type: "stored" as const },
+                    }),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const login = (profileName: string, config: PrismaAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () =>
+            readEnvServiceToken().pipe(
+              Effect.flatMap((envToken) =>
+                envToken
+                  ? Effect.void
+                  : Effect.gen(function* () {
+                      const next = yield* configureInteractive(profileName);
+                      const existing = yield* profiles.getProfile(profileName);
+                      yield* profiles.setProfile(profileName, {
+                        ...existing,
+                        [PRISMA_AUTH_PROVIDER_NAME]: next,
+                      });
+                    }),
+              ),
+            ),
+          ),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<PrismaStoredCredentials>(profileName, "prisma-stored")
+              .pipe(
+                Effect.flatMap((creds) =>
+                  validStoredCredentials(creds)
+                    ? Effect.void
+                    : loginStored(profileName),
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    const logout = (profileName: string, config: PrismaAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "prisma-stored")
+            .pipe(
+              Effect.andThen(
+                Clank.success("Prisma: stored credentials removed"),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const prettyPrint = (profileName: string, config: PrismaAuthConfig) =>
+      read(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const source = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Effect.all([
+            Console.log(
+              `  serviceToken: ${displayRedacted(creds.serviceToken, 9)}`,
+            ),
+            Console.log(`  source: ${source}`),
+          ]);
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
+
+    return { configure, login, logout, prettyPrint, read };
+  }),
+);

package/src/Prisma/Branch.ts

@@ -0,0 +1,396 @@
+import * as Effect from "effect/Effect";
+import { Unowned } from "../AdoptPolicy.ts";
+import { isResolved } from "../Diff.ts";
+import { createPhysicalName } from "../PhysicalName.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import {
+  PrismaClient,
+  isConflict,
+  isNotFound,
+  type PrismaManagementClient,
+} from "./Client.ts";
+import type { Project } from "./Project.ts";
+import type { Providers } from "./Providers.ts";
+import {
+  concreteIdsChanged,
+  isInputObject,
+  isPrismaDevId,
+  resolveProjectId,
+  unresolvedProjectIdOf,
+} from "./Refs.ts";
+import type { Branch as ApiBranch } from "./Types.ts";
+
+export interface BranchProps {
+  /**
+   * Project ID or `project.projectId` output that owns this branch.
+   */
+  project: string | Project;
+  /**
+   * Git-style branch name. If omitted, Alchemy generates a stable physical
+   * name.
+   */
+  gitName?: string;
+  /**
+   * Promote this branch to be the project's default branch. Setting this to
+   * `false` does not demote a current default because the Management API only
+   * supports promotion; promoting another branch atomically demotes it.
+   *
+   * @default false
+   */
+  isDefault?: boolean;
+}
+
+export interface Branch extends Resource<
+  "Prisma.Branch",
+  BranchProps,
+  {
+    /**
+     * Prisma branch ID.
+     */
+    branchId: string;
+    /**
+     * Git-style branch name.
+     */
+    gitName: string;
+    /**
+     * Project ID that owns the branch.
+     */
+    projectId: string;
+    /**
+     * Whether this branch is the project's default branch.
+     */
+    isDefault: boolean;
+    /**
+     * Branch that was default before this preview branch was promoted. Alchemy
+     * restores it before deleting this resource so destroy remains reversible.
+     */
+    previousDefaultBranchId?: string;
+    /**
+     * Branch role used by Prisma to resolve deploy-time environment variables.
+     */
+    role: "production" | "preview";
+    /**
+     * ISO timestamp when the branch was created.
+     */
+    createdAt: string;
+    /**
+     * ISO timestamp when the branch was last updated.
+     */
+    updatedAt: string;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A Prisma project branch for preview-class databases and compute resources.
+ *
+ * @resource
+ * @section Creating a Branch
+ * @example Preview branch
+ * ```typescript
+ * const branch = yield* Prisma.Branch("preview", {
+ *   project: project.projectId,
+ *   gitName: "feature/search", // optional — omitted, a stable name is generated
+ * });
+ * ```
+ */
+export const Branch = Resource<Branch>("Prisma.Branch");
+
+const createGitName = (id: string, gitName: string | undefined) =>
+  gitName === undefined ? createPhysicalName({ id }) : Effect.succeed(gitName);
+
+const findBranch = (
+  client: PrismaManagementClient,
+  projectId: string,
+  gitName: string,
+) =>
+  client.listBranches(projectId, { gitName }).pipe(
+    Effect.flatMap((branches) => {
+      const matches = branches.filter((b: ApiBranch) => b.gitName === gitName);
+      return matches.length > 1
+        ? Effect.fail(
+            new Error(
+              `Prisma project '${projectId}' has multiple branches named '${gitName}'; refusing to select one arbitrarily.`,
+            ),
+          )
+        : Effect.succeed(matches[0]);
+    }),
+  );
+
+const attrsFrom = (
+  branch: ApiBranch,
+  previousDefaultBranchId?: string,
+): Branch["Attributes"] => ({
+  branchId: branch.id,
+  gitName: branch.gitName,
+  projectId: branch.project.id,
+  isDefault: branch.isDefault,
+  ...(previousDefaultBranchId === undefined ? {} : { previousDefaultBranchId }),
+  role: branch.role,
+  createdAt: branch.createdAt,
+  updatedAt: branch.updatedAt,
+});
+
+const ensureBranchIdentity = (
+  branch: ApiBranch,
+  expected: { projectId: string; gitName: string },
+) =>
+  branch.project.id === expected.projectId &&
+  branch.gitName === expected.gitName
+    ? Effect.void
+    : Effect.fail(
+        new Error(
+          `Prisma branch '${branch.id}' belongs to project '${branch.project.id}' with git name '${branch.gitName}', but this resource requires project '${expected.projectId}' and git name '${expected.gitName}'. Refusing to promote or delete a mismatched branch.`,
+        ),
+      );
+
+export const BranchProvider = () =>
+  Provider.effect(
+    Branch,
+    Effect.gen(function* () {
+      const client = yield* PrismaClient;
+      return {
+        stables: ["branchId"],
+        list: Effect.fn(function* () {
+          const projects = yield* client.listProjects();
+          const branches = yield* Effect.forEach(
+            projects,
+            (project) =>
+              client
+                .listBranches(project.id)
+                .pipe(Effect.catchIf(isNotFound, () => Effect.succeed([]))),
+            { concurrency: 8 },
+          );
+          // Current defaults and production-role branches are project-owned
+          // and undeletable through the Branch API. Project deletion removes
+          // them; omit them here so unsafe nuke only receives deletable rows.
+          return branches
+            .flat()
+            .filter(
+              (branch) => !branch.isDefault && branch.role !== "production",
+            )
+            .map((branch) => attrsFrom(branch));
+        }),
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+          if (!isInputObject(news)) return undefined;
+          if (isPrismaDevId(output?.branchId)) {
+            return { action: "update" } as const;
+          }
+          const oldProjectId =
+            output?.projectId ?? unresolvedProjectIdOf(olds.project);
+          const newProjectId = isResolved(news.project)
+            ? unresolvedProjectIdOf(news.project)
+            : undefined;
+          const newGitName = isResolved(news.gitName)
+            ? yield* createGitName(id, news.gitName)
+            : undefined;
+          if (
+            concreteIdsChanged(oldProjectId, newProjectId) ||
+            (newGitName !== undefined &&
+              newGitName !==
+                (output?.gitName ?? (yield* createGitName(id, olds.gitName))))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (!isResolved(news.isDefault)) return undefined;
+          // The Management API can promote a branch, atomically demoting the
+          // old default, but explicitly rejects demoting the current default.
+          // `false` therefore means "do not promote", not "demote".
+          if (news.isDefault === true && output?.isDefault !== true) {
+            return { action: "update" } as const;
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const branchId = isPrismaDevId(output?.branchId)
+            ? undefined
+            : output?.branchId;
+          const branch = branchId
+            ? yield* client
+                .getBranch(branchId)
+                .pipe(
+                  Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+                )
+            : yield* Effect.gen(function* () {
+                const projectId = unresolvedProjectIdOf(olds.project);
+                return projectId
+                  ? yield* findBranch(
+                      client,
+                      projectId,
+                      yield* createGitName(id, olds.gitName),
+                    )
+                  : undefined;
+              });
+          if (!branch) return undefined;
+          const attrs = attrsFrom(branch, output?.previousDefaultBranchId);
+          return branchId === undefined ? Unowned(attrs) : attrs;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+          const projectId = yield* resolveProjectId(news.project);
+          const gitName = yield* createGitName(id, news.gitName);
+          let previousDefaultBranchId = output?.previousDefaultBranchId;
+          const branchId = isPrismaDevId(output?.branchId)
+            ? undefined
+            : output?.branchId;
+          let branch = branchId
+            ? yield* client
+                .getBranch(branchId)
+                .pipe(
+                  Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+                )
+            : undefined;
+          if (!branch) {
+            const liveBranches = yield* client.listBranches(projectId);
+            const defaults = liveBranches.filter(
+              (candidate) => candidate.isDefault,
+            );
+            if (defaults.length !== 1) {
+              return yield* Effect.fail(
+                new Error(
+                  defaults.length === 0
+                    ? `Prisma project '${projectId}' has no default branch. Refusing to create a standalone Branch because the Management API would make it the undeletable production branch; create or repair the owning Prisma.Project first.`
+                    : `Prisma project '${projectId}' has ${defaults.length} default branches. Refusing to create a Branch until the project invariant is repaired.`,
+                ),
+              );
+            }
+            previousDefaultBranchId = defaults[0]!.id;
+            branch = yield* client
+              .createBranch(projectId, {
+                gitName,
+                isDefault: news.isDefault,
+              })
+              .pipe(
+                Effect.catchIf(isConflict, () =>
+                  Effect.fail(
+                    new Error(
+                      `Prisma branch '${gitName}' appeared after the adoption check. Refusing to take it over; rerun with adoption enabled if it is the intended branch.`,
+                    ),
+                  ),
+                ),
+              );
+          }
+          yield* ensureBranchIdentity(branch, {
+            projectId,
+            gitName,
+          });
+          if (news.isDefault === true && !branch.isDefault) {
+            const liveBranches = yield* client.listBranches(projectId);
+            const defaults = liveBranches.filter(
+              (candidate) => candidate.isDefault,
+            );
+            if (defaults.length !== 1 || defaults[0]!.id === branch.id) {
+              return yield* Effect.fail(
+                new Error(
+                  `Prisma project '${projectId}' does not have exactly one different default branch to restore later. Refusing to promote '${branch.gitName}'.`,
+                ),
+              );
+            }
+            previousDefaultBranchId = defaults[0]!.id;
+            branch = yield* client.updateBranch(branch.id, {
+              isDefault: true,
+            });
+            yield* ensureBranchIdentity(branch, {
+              projectId,
+              gitName,
+            });
+            if (!branch.isDefault) {
+              return yield* Effect.fail(
+                new Error(
+                  `Prisma branch '${branch.id}' promotion did not converge to the default branch.`,
+                ),
+              );
+            }
+          }
+          return attrsFrom(branch, previousDefaultBranchId);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (isPrismaDevId(output.branchId)) return;
+          const branch = yield* client
+            .getBranch(output.branchId)
+            .pipe(Effect.catchIf(isNotFound, () => Effect.succeed(undefined)));
+          if (!branch) return;
+          yield* ensureBranchIdentity(branch, {
+            projectId: output.projectId,
+            gitName: output.gitName,
+          });
+          if (branch.role === "production") {
+            return yield* Effect.fail(
+              new Error(
+                `Cannot delete Prisma branch '${branch.gitName ?? output.branchId}' directly because its production role is immutable. Delete the owning Prisma.Project.`,
+              ),
+            );
+          }
+          if (branch.isDefault) {
+            const previousDefaultBranchId = output.previousDefaultBranchId;
+            if (
+              previousDefaultBranchId === undefined ||
+              previousDefaultBranchId === branch.id
+            ) {
+              return yield* Effect.fail(
+                new Error(
+                  `Cannot safely delete default Prisma branch '${branch.gitName}' because state does not identify the branch it displaced. Promote another branch explicitly before deleting this resource.`,
+                ),
+              );
+            }
+            const previous = yield* client
+              .getBranch(previousDefaultBranchId)
+              .pipe(
+                Effect.catchIf(isNotFound, () =>
+                  Effect.fail(
+                    new Error(
+                      `Cannot restore previous default Prisma branch '${previousDefaultBranchId}' because it no longer exists. Promote another branch explicitly before deleting '${branch.gitName}'.`,
+                    ),
+                  ),
+                ),
+              );
+            if (
+              previous.project.id !== output.projectId ||
+              previous.id === branch.id
+            ) {
+              return yield* Effect.fail(
+                new Error(
+                  `Previous default Prisma branch '${previous.id}' does not belong to project '${output.projectId}'. Refusing an unsafe promotion.`,
+                ),
+              );
+            }
+            const restored = previous.isDefault
+              ? previous
+              : yield* client.updateBranch(previous.id, { isDefault: true });
+            if (
+              restored.id !== previous.id ||
+              restored.project.id !== output.projectId ||
+              !restored.isDefault
+            ) {
+              return yield* Effect.fail(
+                new Error(
+                  `Prisma did not confirm restoration of previous default branch '${previous.id}'. Refusing to delete '${branch.gitName}'.`,
+                ),
+              );
+            }
+            const demoted = yield* client
+              .getBranch(branch.id)
+              .pipe(
+                Effect.catchIf(isNotFound, () => Effect.succeed(undefined)),
+              );
+            if (!demoted) return;
+            yield* ensureBranchIdentity(demoted, {
+              projectId: output.projectId,
+              gitName: output.gitName,
+            });
+            if (demoted.isDefault) {
+              return yield* Effect.fail(
+                new Error(
+                  `Prisma branch '${branch.gitName}' remained default after restoring '${previous.gitName}'. Refusing to delete it.`,
+                ),
+              );
+            }
+          }
+          yield* client
+            .deleteBranch(output.branchId)
+            .pipe(Effect.catchIf(isNotFound, () => Effect.void));
+        }),
+      };
+    }),
+  );