alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/src/Alchemist/routes/nuke.ts

@@ -0,0 +1,146 @@
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
+import { MinimumLogLevel } from "effect/References";
+import * as Nuke from "../../Nuke.ts";
+import type { ProviderMode } from "../../ProviderMode.ts";
+import type { ApplyStatus } from "../../Report.ts";
+import { Progress, withSpanEvents } from "../Progress.ts";
+import {
+  buildStackProviders,
+  DEFAULT_ENTRYPOINT,
+  type Target,
+} from "../Session.ts";
+
+export interface ScanInput extends Target {
+  readonly mode: ProviderMode;
+  /** Provider-id globs to include. Omitted means every provider. */
+  readonly include?: ReadonlyArray<string>;
+  /** Provider-id globs to exclude. Applied after `include`. */
+  readonly exclude?: ReadonlyArray<string>;
+  readonly concurrency?: number | "unbounded";
+  readonly providerTimeoutSeconds?: number;
+}
+
+/** One discovered cloud object, bound to the provider that can delete it. */
+export type NukeResource = Nuke.Target;
+
+export interface NukeScan {
+  readonly mode: ProviderMode;
+  readonly resources: ReadonlyArray<NukeResource>;
+  readonly failures: ReadonlyArray<Nuke.ProviderFailure>;
+  /** The built provider context {@link execute} deletes under. */
+  readonly context: Context.Context<never>;
+}
+
+export interface ExecuteInput {
+  readonly scan: NukeScan;
+  /** The subset of `scan.resources` to delete. */
+  readonly resources: ReadonlyArray<NukeResource>;
+  readonly strategy: Nuke.Strategy;
+  readonly concurrency?: number | "unbounded";
+  readonly providerTimeoutSeconds?: number;
+}
+
+export type NukeResult = Nuke.Result;
+
+/** Enumerate everything the stack's registered providers can see. */
+export const scan = Effect.fn("Alchemist.nuke.scan")(function* (
+  input: ScanInput,
+) {
+  const report = withSpanEvents(yield* Progress);
+  const debug = yield* Config.string("DEBUG").pipe(
+    Config.withDefault(""),
+    Effect.map((value) => value.length > 0),
+  );
+  // Nuke needs the provider layer, not a stack instance: it deletes what
+  // the cloud has, not what state says we own.
+  const built = yield* buildStackProviders({
+    main: input.entrypoint ?? DEFAULT_ENTRYPOINT,
+    envFile: Option.fromNullishOr(input.envFile),
+    profile: input.profile,
+    logger: debug ? Logger.layer([Logger.defaultLogger]) : undefined,
+    extra: Layer.succeed(MinimumLogLevel, debug ? "Debug" : "Info"),
+  });
+  const context = built.context as Context.Context<never>;
+  const { resources, failures } = yield* Nuke.list({
+    context,
+    mode: input.mode,
+    include: input.include,
+    exclude: input.exclude,
+    concurrency: input.concurrency,
+    timeoutSeconds: input.providerTimeoutSeconds,
+    onScan: (total) => report({ _tag: "nuke.scan.started", total }),
+    onProviderStarted: (provider) =>
+      report({ _tag: "nuke.scan.provider.started", provider }),
+    onProvider: (provider, count, error) =>
+      report({
+        _tag: "nuke.scan.provider.completed",
+        provider,
+        resources: count,
+        error,
+      }),
+  });
+  return { mode: input.mode, resources, failures, context } satisfies NukeScan;
+});
+
+/**
+ * Permanently delete the selected resources. Each confirmed deletion is
+ * reported through {@link Progress} as `NukeResourceDeleted`.
+ */
+export const execute = Effect.fn("Alchemist.nuke.execute")(function* (
+  input: ExecuteInput,
+) {
+  const report = withSpanEvents(yield* Progress);
+  const keys = new Map(
+    input.resources.map((resource, index) => [resource, `nuke/${index}`]),
+  );
+  const status = (
+    resource: Nuke.Target,
+    status: ApplyStatus,
+    message?: string,
+  ) =>
+    report({
+      _tag: "apply.resource.status",
+      fqn: keys.get(resource)!,
+      id: resource.providerId,
+      type: resource.providerId,
+      status,
+      message,
+    });
+  return yield* Nuke.destroy({
+    targets: input.resources,
+    context: input.scan.context,
+    strategy: input.strategy,
+    concurrency: input.concurrency,
+    timeoutSeconds: input.providerTimeoutSeconds,
+    onPass: (pass) => report({ _tag: "nuke.pass.started", pass }),
+    onDeleting: (resource) => status(resource, "deleting"),
+    onHeld: (resource, blockedBy) =>
+      status(resource, "skipped", `Held back by ${blockedBy.join(", ")}`),
+    onDeleted: (resource) =>
+      status(resource, "deleted").pipe(
+        Effect.andThen(
+          report({
+            _tag: "nuke.resource.deleted",
+            provider: resource.providerId,
+            resource: resource.displayName,
+          }),
+        ),
+      ),
+    onFailed: (resource, message) =>
+      status(resource, "fail", message).pipe(
+        Effect.andThen(
+          report({
+            _tag: "nuke.resource.failed",
+            provider: resource.providerId,
+            resource: resource.displayName,
+            message,
+          }),
+        ),
+      ),
+  });
+});

package/src/Alchemist/routes/profile.ts

@@ -0,0 +1,427 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import type { Interaction } from "../../Interaction.ts";
+import { AuthError } from "../../Auth/AuthProvider.ts";
+import { CredentialsStore } from "../../Auth/Credentials.ts";
+import {
+  inspectProvider,
+  type ProviderConnection,
+} from "../../Auth/Inspect.ts";
+import { withProfileCredentialsLock } from "../../Auth/Lock.ts";
+import { ProfileStore } from "../../Auth/Profile.ts";
+import { AlchemistInvalidInput, AlchemistNotFound } from "../Errors.ts";
+import { Progress } from "../Progress.ts";
+import {
+  collectAuthProviders,
+  DEFAULT_ENTRYPOINT,
+  type Target,
+} from "../Session.ts";
+
+/** Which project/profile pair a provider-scoped route resolves against. */
+export interface ProviderContext extends Target {
+  readonly profile: string;
+}
+
+export interface ProfileSummary {
+  readonly name: string;
+  readonly active: boolean;
+  readonly providers: ReadonlyArray<{
+    readonly name: string;
+    readonly method: string;
+  }>;
+}
+
+export type { ProviderConnection } from "../../Auth/Inspect.ts";
+
+export interface ProfileSnapshot {
+  readonly name: string;
+  readonly active: boolean;
+  readonly providers: ReadonlyArray<ProviderConnection>;
+}
+
+export interface ConfigureField {
+  readonly name: string;
+  readonly label: string;
+  readonly secret: boolean;
+  readonly required: boolean;
+  readonly description?: string;
+  readonly placeholder?: string;
+}
+
+export interface ConfigureMethod {
+  readonly method: string;
+  readonly label: string;
+  readonly fields: ReadonlyArray<ConfigureField>;
+}
+
+export interface AuthProviderDescriptor {
+  readonly name: string;
+  readonly connected: boolean;
+  readonly configureMethods: ReadonlyArray<ConfigureMethod>;
+  readonly supportsRefresh: boolean;
+  readonly supportsLogout: boolean;
+}
+
+export interface ConfigureInput extends ProviderContext {
+  readonly provider: string;
+  readonly action: "add" | "reconfigure";
+  readonly method?: string;
+  readonly values?: Readonly<Record<string, Redacted.Redacted<string>>>;
+}
+
+/**
+ * Every auth provider reachable from the given project: the built-ins plus
+ * whatever the user's stack module registers.
+ */
+const registry = (input: ProviderContext) =>
+  collectAuthProviders({
+    main: input.entrypoint ?? DEFAULT_ENTRYPOINT,
+    envFile: Option.fromNullishOr(input.envFile),
+    profile: input.profile,
+  });
+
+/** The effective profile and how it was selected. */
+export const current = Effect.fn("Alchemist.profile.current")(function* () {
+  return yield* (yield* ProfileStore).current;
+});
+
+/** Every profile with its connected providers, active profile first. */
+export const list = Effect.fn("Alchemist.profile.list")(function* () {
+  const profiles = yield* ProfileStore;
+  const [manifest, selected] = yield* Effect.all([
+    profiles.readManifest,
+    profiles.current,
+  ]);
+  return Object.entries(manifest.profiles)
+    .sort(([a], [b]) =>
+      a === "default" ? -1 : b === "default" ? 1 : a.localeCompare(b),
+    )
+    .map(([name, profile]): ProfileSummary => ({
+      name,
+      active: name === selected.name,
+      providers: Object.entries(profile.providers)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([name, config]) => ({
+          name,
+          method: config.method ?? "unknown",
+        })),
+    }));
+});
+
+/** One profile with the live status of each connected provider. */
+export const get = Effect.fn("Alchemist.profile.get")(function* (input: {
+  readonly name: string;
+  readonly includeProviderStatus?: boolean;
+  readonly entrypoint?: string;
+  readonly envFile?: string;
+}) {
+  const includeProviderStatus = input.includeProviderStatus ?? true;
+  const profiles = yield* ProfileStore;
+  const [profile, selected] = yield* Effect.all([
+    profiles.getProfile(input.name),
+    profiles.current,
+  ]);
+  if (profile === undefined) {
+    return yield* Effect.fail(
+      new AlchemistNotFound({ kind: "profile", id: input.name }),
+    );
+  }
+  // Skipping the status probe is what makes `profile list` fast: it
+  // reaches no provider APIs, so every connection reads as connected.
+  const registered = includeProviderStatus
+    ? yield* registry({
+        profile: input.name,
+        entrypoint: input.entrypoint,
+        envFile: input.envFile,
+      })
+    : {};
+  const entries = Object.entries(profile.providers).sort(([a], [b]) =>
+    a.localeCompare(b),
+  );
+  return {
+    name: input.name,
+    active: selected.name === input.name,
+    providers: yield* Effect.forEach(
+      entries,
+      ([provider, config]): Effect.Effect<
+        ProviderConnection,
+        never,
+        Interaction
+      > =>
+        includeProviderStatus
+          ? inspectProvider(
+              input.name,
+              provider,
+              config,
+              registered,
+              (updated) =>
+                profiles.setProviderConfig(input.name, provider, updated).pipe(
+                  Effect.mapError(
+                    (cause) =>
+                      new AuthError({
+                        message: `Could not persist repaired ${provider} credentials for profile '${input.name}'.`,
+                        cause,
+                      }),
+                  ),
+                ),
+            )
+          : Effect.succeed({
+              name: provider,
+              method: config.method ?? "unknown",
+              status: "connected",
+              details: [],
+            }),
+    ),
+  } satisfies ProfileSnapshot;
+});
+
+export const create = Effect.fn("Alchemist.profile.create")(function* (input: {
+  readonly name: string;
+}) {
+  yield* (yield* ProfileStore).createProfile(input.name);
+  return yield* get({ name: input.name });
+});
+
+export const rename = Effect.fn("Alchemist.profile.rename")(function* (input: {
+  readonly name: string;
+  readonly newName: string;
+}) {
+  yield* (yield* ProfileStore).renameProfile(input.name, input.newName);
+  return yield* get({ name: input.newName });
+});
+
+/** Delete a profile and every credential stored for it. */
+export const deleteProfile = Effect.fn("Alchemist.profile.delete")(
+  function* (input: { readonly name: string }) {
+    const profiles = yield* ProfileStore;
+    const credentials = yield* CredentialsStore;
+    return yield* withProfileCredentialsLock(
+      input.name,
+      Effect.gen(function* () {
+        const deleted = yield* profiles.deleteProfile(input.name);
+        if (!deleted) {
+          return yield* Effect.fail(
+            new AlchemistNotFound({ kind: "profile", id: input.name }),
+          );
+        }
+        yield* credentials.deleteProfile(input.name);
+        return { name: input.name, credentialsDeleted: true } as const;
+      }),
+    );
+  },
+);
+
+/** Every registered auth provider and how it can be configured. */
+export const providers = Effect.fn("Alchemist.profile.providers")(
+  function* (input: {
+    readonly profile?: string;
+    readonly entrypoint?: string;
+    readonly envFile?: string;
+  }) {
+    const profiles = yield* ProfileStore;
+    const profile = input.profile ?? (yield* profiles.current).name;
+    const stored = yield* profiles.ensureProfile(profile);
+    const registered = yield* registry({ ...input, profile });
+    return Object.values(registered)
+      .sort((a, b) => a.name.localeCompare(b.name))
+      .map((provider): AuthProviderDescriptor => ({
+        name: provider.name,
+        connected: provider.name in stored.providers,
+        configureMethods: (provider.configureMethods ?? []).map((method) => ({
+          method: method.method,
+          label: method.method,
+          fields: method.fields.map((field) => ({
+            name: field.name,
+            label: field.label,
+            secret: field.secret ?? false,
+            required: !(field.optional ?? false),
+            description: field.description,
+            placeholder: field.placeholder,
+          })),
+        })),
+        supportsRefresh: true,
+        supportsLogout: true,
+      }));
+  },
+);
+
+/** The configure methods (and fields) one provider accepts. */
+export const configureForm = Effect.fn("Alchemist.profile.configureForm")(
+  function* (input: {
+    readonly profile: string;
+    readonly provider: string;
+    readonly method?: string;
+  }) {
+    const registered = yield* providers({ profile: input.profile });
+    const provider = registered.find(({ name }) => name === input.provider);
+    if (provider === undefined) {
+      return yield* Effect.fail(
+        new AlchemistNotFound({ kind: "provider", id: input.provider }),
+      );
+    }
+    return input.method === undefined
+      ? provider.configureMethods
+      : provider.configureMethods.filter(
+          ({ method }) => method === input.method,
+        );
+  },
+);
+
+/**
+ * Connect or reconfigure a provider in a profile. Reported through
+ * {@link Progress} as `ProviderConfigureStarted`; interactive providers drive
+ * their own prompts.
+ */
+export const configure = Effect.fn("Alchemist.profile.configure")(function* (
+  input: ConfigureInput,
+) {
+  const report = yield* Progress;
+  yield* report({
+    _tag: "provider.configure.started",
+    provider: input.provider,
+  });
+  const profiles = yield* ProfileStore;
+  const stored = yield* profiles.ensureProfile(input.profile);
+  const provider = (yield* registry(input))[input.provider];
+  if (provider === undefined) {
+    return yield* Effect.fail(
+      new AlchemistInvalidInput({
+        field: "provider",
+        message: `Auth provider '${input.provider}' is not registered.`,
+      }),
+    );
+  }
+  const connected = input.provider in stored.providers;
+  if (
+    (input.action === "add" && connected) ||
+    (input.action === "reconfigure" && !connected)
+  ) {
+    return yield* Effect.fail(
+      new AlchemistInvalidInput({
+        field: "provider",
+        message: `Provider '${input.provider}' is ${connected ? "already" : "not"} connected.`,
+      }),
+    );
+  }
+  const config =
+    input.method !== undefined &&
+    input.values !== undefined &&
+    provider.configureWith !== undefined
+      ? yield* provider.configureWith(input.profile, {
+          method: input.method,
+          values: Object.fromEntries(
+            Object.entries(input.values).map(([key, value]) => [
+              key,
+              Redacted.value(value),
+            ]),
+          ),
+        })
+      : yield* provider.configure(
+          input.profile,
+          connected
+            ? yield* provider
+                .decodeConfig(input.profile, stored.providers[input.provider]!)
+                .pipe(Effect.orElseSucceed(() => undefined))
+            : undefined,
+        );
+  yield* profiles.setProviderConfig(input.profile, input.provider, config);
+  yield* report({
+    _tag: "provider.configure.completed",
+    provider: input.provider,
+  });
+  return yield* get({
+    name: input.profile,
+    entrypoint: input.entrypoint,
+    envFile: input.envFile,
+  });
+});
+
+/** Log a provider out and disconnect it from the profile. */
+export const removeProvider = Effect.fn("Alchemist.profile.removeProvider")(
+  function* (
+    input: ProviderContext & {
+      readonly provider: string;
+      readonly logout?: boolean;
+    },
+  ) {
+    const profiles = yield* ProfileStore;
+    const stored = yield* profiles.ensureProfile(input.profile);
+    const config = stored.providers[input.provider];
+    if (config === undefined) {
+      return yield* Effect.fail(
+        new AlchemistNotFound({ kind: "provider", id: input.provider }),
+      );
+    }
+    const provider = (yield* registry(input))[input.provider];
+    let logout: "completed" | "skipped-invalid-config" | "unavailable" =
+      "unavailable";
+    if (provider !== undefined) {
+      const decoded = yield* provider
+        .decodeConfig(input.profile, config)
+        .pipe(Effect.option);
+      if (Option.isSome(decoded)) {
+        if (input.logout ?? true)
+          yield* provider.logout(input.profile, decoded.value);
+        logout = "completed";
+      } else logout = "skipped-invalid-config";
+    }
+    yield* profiles.deleteProviderConfig(input.profile, input.provider);
+    return { profile: input.profile, provider: input.provider, logout };
+  },
+);
+
+/**
+ * Re-run login for connected providers without reconfiguring them. Each
+ * provider is reported through {@link Progress} as `ProviderRefreshStarted`.
+ */
+export const refresh = Effect.fn("Alchemist.profile.refresh")(function* (
+  input: ProviderContext & {
+    readonly providers?: ReadonlyArray<string>;
+  },
+) {
+  const report = yield* Progress;
+  const profiles = yield* ProfileStore;
+  const stored = yield* profiles.ensureProfile(input.profile);
+  const registered = yield* registry(input);
+  const requested =
+    input.providers === undefined || input.providers.length === 0
+      ? Object.keys(stored.providers).sort()
+      : input.providers;
+  for (const name of requested) {
+    const config = stored.providers[name];
+    const provider = registered[name];
+    if (config === undefined || provider === undefined) {
+      return yield* Effect.fail(
+        new AlchemistInvalidInput({
+          field: "providers",
+          message: `Provider '${name}' is not connected or registered.`,
+        }),
+      );
+    }
+    yield* report({ _tag: "provider.refresh.started", provider: name });
+    const refreshed = yield* provider.login(
+      input.profile,
+      yield* provider.decodeConfig(input.profile, config),
+      (updated) =>
+        profiles.setProviderConfig(input.profile, name, updated).pipe(
+          Effect.mapError(
+            (cause) =>
+              new AuthError({
+                message: `Could not persist refreshed ${name} credentials for profile '${input.profile}'.`,
+                cause,
+              }),
+          ),
+        ),
+    );
+    if (refreshed !== undefined) {
+      yield* profiles.setProviderConfig(input.profile, name, refreshed);
+    }
+    yield* report({ _tag: "provider.refresh.completed", provider: name });
+  }
+  return yield* get({
+    name: input.profile,
+    entrypoint: input.entrypoint,
+    envFile: input.envFile,
+  });
+});

package/src/Alchemist/routes/provider.ts

@@ -0,0 +1,107 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import type { EnvironmentVariable } from "../../Auth/AuthProvider.ts";
+import { getEnv } from "../../Auth/Env.ts";
+import { resolveProfileName } from "../../Auth/Resolve.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { AlchemistInvalidInput } from "../Errors.ts";
+import {
+  collectAuthProviders,
+  DEFAULT_ENTRYPOINT,
+  type Target,
+} from "../Session.ts";
+
+export interface CheckEnvironmentInput extends Target {
+  /** Providers to check. Omitted means every registered provider. */
+  readonly providers?: ReadonlyArray<string>;
+}
+
+export interface EnvironmentCheck {
+  readonly provider: string;
+  readonly status: "satisfied" | "missing" | "no-contract";
+  readonly missing: ReadonlyArray<{
+    readonly alternatives: ReadonlyArray<string>;
+  }>;
+}
+
+export interface EnvironmentCheckResult {
+  readonly checks: ReadonlyArray<EnvironmentCheck>;
+  readonly satisfied: boolean;
+}
+
+const satisfied = (variable: EnvironmentVariable) =>
+  Effect.gen(function* () {
+    for (const name of [variable.name, ...(variable.alternatives ?? [])]) {
+      const value = yield* getEnv(name);
+      if (value !== undefined && value.length > 0) return true;
+    }
+    return false;
+  });
+
+/**
+ * Verify the environment variables each registered provider's CI contract
+ * requires are present.
+ */
+export const checkEnvironment = Effect.fn(
+  "Alchemist.provider.checkEnvironment",
+)(function* (input: CheckEnvironmentInput) {
+  const profile = yield* resolveProfileName(
+    Option.fromNullishOr(input.envFile),
+    input.profile,
+  );
+  const registry = yield* collectAuthProviders({
+    main: input.entrypoint ?? DEFAULT_ENTRYPOINT,
+    envFile: Option.fromNullishOr(input.envFile),
+    profile,
+  });
+  const known = Object.keys(registry).sort();
+  const names = yield* input.providers?.length
+    ? Effect.forEach(input.providers, (requested) => {
+        const name = known.find(
+          (candidate) => candidate.toLowerCase() === requested.toLowerCase(),
+        );
+        return name === undefined
+          ? Effect.fail(
+              new AlchemistInvalidInput({
+                field: "providers",
+                message: `Unknown provider '${requested}'. Registered: ${known.join(", ")}.`,
+              }),
+            )
+          : Effect.succeed(name);
+      })
+    : Effect.succeed(known);
+  const checks = yield* Effect.forEach(names, (name) =>
+    Effect.gen(function* () {
+      const contract = registry[name]!.environment;
+      const missing: Array<{ alternatives: ReadonlyArray<string> }> = [];
+      for (const variable of contract) {
+        if (variable.required && !(yield* satisfied(variable))) {
+          missing.push({
+            alternatives: [variable.name, ...(variable.alternatives ?? [])],
+          });
+        }
+      }
+      return {
+        provider: name,
+        status:
+          contract.length === 0
+            ? ("no-contract" as const)
+            : missing.length === 0
+              ? ("satisfied" as const)
+              : ("missing" as const),
+        missing,
+      } satisfies EnvironmentCheck;
+    }),
+  ).pipe(
+    Effect.provide(
+      ConfigProvider.layer(
+        yield* loadConfigProvider(Option.fromNullishOr(input.envFile)),
+      ),
+    ),
+  );
+  return {
+    checks,
+    satisfied: checks.every((check) => check.status !== "missing"),
+  } satisfies EnvironmentCheckResult;
+});