alepha 0.21.2 → 0.22.0

package/src/cli/{platform → platform-lib}/__tests__/CloudflareAdapter.spec.ts

@@ -9,6 +9,7 @@ import {
 import { describe, test } from "vitest";
 import { CloudflareAdapter } from "../adapters/CloudflareAdapter.ts";
 import type { PlatformContext } from "../adapters/PlatformAdapter.ts";
+import { platformOptions } from "../atoms/platformOptions.ts";
 import { CloudflareApi } from "../services/CloudflareApi.ts";
 import { NamingService } from "../services/NamingService.ts";
 
@@ -203,7 +204,14 @@ describe("CloudflareAdapter", () => {
     project: "acme-portal",
     env: "production",
     envConfig: { adapter: "cloudflare" },
-    apps: [],
+    entry: { root: "/project", server: "src/main.ts" },
+    resources: {
+      hasDatabase: false,
+      hasBucket: false,
+      hasKV: false,
+      hasQueue: false,
+      hasCron: false,
+    },
     root: "/project",
     naming: naming.forContext("acme-portal", "production"),
     ...overrides,
@@ -270,20 +278,14 @@ describe("CloudflareAdapter", () => {
     }) => {
       const { adapter, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: true,
-              hasBucket: false,
-              hasKV: false,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: true,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       const run = createMockRun();
@@ -298,20 +300,14 @@ describe("CloudflareAdapter", () => {
     }) => {
       const { adapter, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: true,
-              hasBucket: false,
-              hasKV: false,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: true,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       // Pre-seed existing database
@@ -333,20 +329,14 @@ describe("CloudflareAdapter", () => {
     }) => {
       const { adapter, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: false,
-              hasBucket: true,
-              hasKV: false,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: true,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       const run = createMockRun();
@@ -361,20 +351,14 @@ describe("CloudflareAdapter", () => {
     }) => {
       const { adapter, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: false,
-              hasBucket: false,
-              hasKV: true,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: true,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       const run = createMockRun();
@@ -389,20 +373,14 @@ describe("CloudflareAdapter", () => {
     }) => {
       const { adapter, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: false,
-              hasBucket: false,
-              hasKV: false,
-              hasQueue: true,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: true,
+          hasCron: false,
+        },
       });
 
       const run = createMockRun();
@@ -419,20 +397,14 @@ describe("CloudflareAdapter", () => {
     }) => {
       const { adapter, fs, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: false,
-              hasBucket: false,
-              hasKV: false,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       await fs.writeFile(
@@ -457,23 +429,293 @@ describe("CloudflareAdapter", () => {
       expect(names).toEqual(["APP_SECRET", "GOOGLE_API_KEY"]);
     });
 
+    test("with platform.secrets.keys, resolves the allowlist from process.env (no .env file) and ignores ambient vars", async ({
+      expect,
+    }) => {
+      const { adapter, alepha, naming, api } = createTestEnv();
+      // Declare an explicit allowlist — the CI shape: secrets arrive via the
+      // job environment, there is no .env.production on the runner.
+      alepha.set(platformOptions, {
+        secrets: { keys: ["APP_SECRET", "GOOGLE_CLIENT_ID", "EMAIL_FROM"] },
+        environments: { production: { adapter: "cloudflare" } },
+      } as any);
+
+      const ctx = makeCtx(naming, {
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
+      });
+
+      process.env.APP_SECRET = "from-env-secret";
+      process.env.GOOGLE_CLIENT_ID = "from-env-google";
+      // EMAIL_FROM intentionally unset → declared but unresolved, not pushed.
+      // PATH-style ambient var that must never leak into worker secrets.
+      process.env.AMBIENT_RUNNER_VAR = "leak-me-not";
+      try {
+        const run = createMockRun();
+        await adapter.secrets(ctx, run);
+      } finally {
+        delete process.env.APP_SECRET;
+        delete process.env.GOOGLE_CLIENT_ID;
+        delete process.env.AMBIENT_RUNNER_VAR;
+      }
+
+      const pushed = api.secrets.get("acme-portal-production") ?? [];
+      const names = pushed.map((s) => s.name).sort();
+      expect(names).toEqual(["APP_SECRET", "GOOGLE_CLIENT_ID"]);
+    });
+
+    test("with platform.secrets.keys, the .env file overrides process.env per key", async ({
+      expect,
+    }) => {
+      const { adapter, alepha, fs, naming, api } = createTestEnv();
+      alepha.set(platformOptions, {
+        secrets: { keys: ["APP_SECRET", "GOOGLE_CLIENT_ID"] },
+        environments: { production: { adapter: "cloudflare" } },
+      } as any);
+
+      const ctx = makeCtx(naming, {
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
+      });
+
+      // APP_SECRET in the file → file wins. GOOGLE_CLIENT_ID only in env → env.
+      await fs.writeFile(
+        "/project/.env.production",
+        ["APP_SECRET=from-file", ""].join("\n"),
+      );
+      process.env.APP_SECRET = "from-env";
+      process.env.GOOGLE_CLIENT_ID = "env-google";
+      try {
+        const run = createMockRun();
+        await adapter.secrets(ctx, run);
+      } finally {
+        delete process.env.APP_SECRET;
+        delete process.env.GOOGLE_CLIENT_ID;
+      }
+
+      // Secret *values* land in the full binding set (api.bindings); the
+      // api.secrets projection only keeps names.
+      const bindings = api.bindings.get("acme-portal-production") ?? [];
+      const byName = Object.fromEntries(
+        bindings
+          .filter((b) => b.type === "secret_text")
+          .map((b) => [b.name, b.text]),
+      );
+      expect(byName.APP_SECRET).toBe("from-file");
+      expect(byName.GOOGLE_CLIENT_ID).toBe("env-google");
+    });
+
+    test("uses dist/manifest.json `env` as the default allowlist, resolved from process.env", async ({
+      expect,
+    }) => {
+      const { adapter, fs, naming, api } = createTestEnv();
+      // No platform.secrets.keys and no .env file → the manifest's declared
+      // env list is the allowlist. This is the CI shape.
+      const ctx = makeCtx(naming, {
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
+      });
+
+      await fs.writeFile(
+        "/project/dist/manifest.json",
+        JSON.stringify({
+          env: [
+            "APP_SECRET",
+            "GOOGLE_CLIENT_ID",
+            "CLOUDFLARE_ZONE",
+            "LOG_LEVEL",
+          ],
+        }),
+      );
+
+      process.env.APP_SECRET = "s1";
+      process.env.GOOGLE_CLIENT_ID = "g1";
+      process.env.CLOUDFLARE_ZONE = "example.com"; // declared but EXCLUDED
+      // LOG_LEVEL is declared + ambient in the runner, but EXCLUDED (infra knob).
+      try {
+        const run = createMockRun();
+        await adapter.secrets(ctx, run);
+      } finally {
+        delete process.env.APP_SECRET;
+        delete process.env.GOOGLE_CLIENT_ID;
+        delete process.env.CLOUDFLARE_ZONE;
+      }
+
+      const pushed = api.secrets.get("acme-portal-production") ?? [];
+      expect(pushed.map((s) => s.name).sort()).toEqual([
+        "APP_SECRET",
+        "GOOGLE_CLIENT_ID",
+      ]);
+    });
+
+    test("pushes per-deploy keys from .env.<env>.local even when not in the manifest", async ({
+      expect,
+    }) => {
+      const { adapter, fs, naming, api } = createTestEnv();
+      const ctx = makeCtx(naming, {
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
+      });
+
+      // Manifest declares only APP_SECRET…
+      await fs.writeFile(
+        "/project/dist/manifest.json",
+        JSON.stringify({ env: ["APP_SECRET"] }),
+      );
+      // …but an orchestrator (Rocket) injected CLUB_CONFIG_JSON into the
+      // per-deploy override file. It must still be pushed.
+      await fs.writeFile(
+        "/project/.env.production.local",
+        ["APP_SECRET=s1", 'CLUB_CONFIG_JSON={"id":"b14"}', ""].join("\n"),
+      );
+
+      const run = createMockRun();
+      await adapter.secrets(ctx, run);
+
+      const pushed = api.secrets.get("acme-portal-production") ?? [];
+      expect(pushed.map((s) => s.name).sort()).toEqual([
+        "APP_SECRET",
+        "CLUB_CONFIG_JSON",
+      ]);
+    });
+
+    test("platform.secrets.keys overrides the manifest `env` allowlist", async ({
+      expect,
+    }) => {
+      const { adapter, alepha, fs, naming, api } = createTestEnv();
+      alepha.set(platformOptions, {
+        secrets: { keys: ["APP_SECRET"] }, // narrow override
+        environments: { production: { adapter: "cloudflare" } },
+      } as any);
+
+      const ctx = makeCtx(naming, {
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
+      });
+
+      // Manifest lists more keys, but the explicit override wins.
+      await fs.writeFile(
+        "/project/dist/manifest.json",
+        JSON.stringify({ env: ["APP_SECRET", "GOOGLE_CLIENT_ID"] }),
+      );
+
+      process.env.APP_SECRET = "s1";
+      process.env.GOOGLE_CLIENT_ID = "g1";
+      try {
+        const run = createMockRun();
+        await adapter.secrets(ctx, run);
+      } finally {
+        delete process.env.APP_SECRET;
+        delete process.env.GOOGLE_CLIENT_ID;
+      }
+
+      const pushed = api.secrets.get("acme-portal-production") ?? [];
+      expect(pushed.map((s) => s.name)).toEqual(["APP_SECRET"]);
+    });
+
+    test("auto-derives PUBLIC_URL from the configured domain", async ({
+      expect,
+    }) => {
+      const { adapter, fs, naming, api } = createTestEnv();
+      const ctx = makeCtx(naming, {
+        envConfig: { adapter: "cloudflare", domain: "lore.alepha.dev" },
+      });
+
+      await fs.writeFile(
+        "/project/.env.production",
+        ["APP_SECRET=my-secret", ""].join("\n"),
+      );
+
+      const run = createMockRun();
+      await adapter.secrets(ctx, run);
+
+      const bindings = api.bindings.get("acme-portal-production") ?? [];
+      const publicUrl = bindings.find((b) => b.name === "PUBLIC_URL");
+      expect(publicUrl?.text).toBe("https://lore.alepha.dev");
+    });
+
+    test("derives PUBLIC_URL for a tenant subdomain", async ({ expect }) => {
+      const { adapter, fs, naming, api } = createTestEnv();
+      const ctx = makeCtx(naming, {
+        envConfig: { adapter: "cloudflare", domain: "alepha.dev" },
+        tenant: "acme",
+      });
+
+      await fs.writeFile(
+        "/project/.env.production",
+        ["APP_SECRET=my-secret", ""].join("\n"),
+      );
+
+      const run = createMockRun();
+      await adapter.secrets(ctx, run);
+
+      const bindings = api.bindings.get("acme-portal-production") ?? [];
+      const publicUrl = bindings.find((b) => b.name === "PUBLIC_URL");
+      expect(publicUrl?.text).toBe("https://acme.alepha.dev");
+    });
+
+    test("honors an explicit PUBLIC_URL over the derived one", async ({
+      expect,
+    }) => {
+      const { adapter, fs, naming, api } = createTestEnv();
+      const ctx = makeCtx(naming, {
+        envConfig: { adapter: "cloudflare", domain: "lore.alepha.dev" },
+      });
+
+      await fs.writeFile(
+        "/project/.env.production",
+        ["PUBLIC_URL=https://custom.example.com", ""].join("\n"),
+      );
+
+      const run = createMockRun();
+      await adapter.secrets(ctx, run);
+
+      const bindings = api.bindings.get("acme-portal-production") ?? [];
+      const publicUrl = bindings.find((b) => b.name === "PUBLIC_URL");
+      expect(publicUrl?.text).toBe("https://custom.example.com");
+    });
+
     test("skips when no env file exists", async ({ expect }) => {
       const { adapter, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: false,
-              hasBucket: false,
-              hasKV: false,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       const run = createMockRun();
@@ -485,20 +727,14 @@ describe("CloudflareAdapter", () => {
     test("skips comments and empty lines", async ({ expect }) => {
       const { adapter, fs, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: false,
-              hasBucket: false,
-              hasKV: false,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       await fs.writeFile(
@@ -518,20 +754,14 @@ describe("CloudflareAdapter", () => {
     }) => {
       const { adapter, fs, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: false,
-              hasBucket: false,
-              hasKV: false,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       await fs.writeFile(
@@ -570,20 +800,14 @@ describe("CloudflareAdapter", () => {
     test("PATCHes when secrets changed (hash mismatch)", async ({ expect }) => {
       const { adapter, fs, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: false,
-              hasBucket: false,
-              hasKV: false,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: false,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       await fs.writeFile("/project/.env.production", "APP_SECRET=v1");
@@ -614,20 +838,14 @@ describe("CloudflareAdapter", () => {
     }) => {
       const { adapter, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: true,
-              hasBucket: true,
-              hasKV: false,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: true,
+          hasBucket: true,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       // Pre-seed existing resources
@@ -664,20 +882,14 @@ describe("CloudflareAdapter", () => {
     test("deletes resources via REST API", async ({ expect }) => {
       const { adapter, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
-        apps: [
-          {
-            name: "api",
-            path: "apps/api",
-            entry: { root: "/project/apps/api", server: "src/main.ts" },
-            resources: {
-              hasDatabase: true,
-              hasBucket: true,
-              hasKV: true,
-              hasQueue: false,
-              hasCron: false,
-            },
-          },
-        ],
+        entry: { root: "/project", server: "src/main.ts" },
+        resources: {
+          hasDatabase: true,
+          hasBucket: true,
+          hasKV: true,
+          hasQueue: false,
+          hasCron: false,
+        },
       });
 
       // Pre-seed existing resources
@@ -702,6 +914,51 @@ describe("CloudflareAdapter", () => {
       expect(api.kvNamespaces).toHaveLength(0);
     });
   });
+
+  describe("exportDb", () => {
+    test("dumps remote D1 and imports it into a local SQLite snapshot", async ({
+      expect,
+    }) => {
+      const { adapter, naming } = createTestEnv();
+      const ctx = makeCtx(naming, {
+        resources: {
+          hasDatabase: true,
+          hasBucket: false,
+          hasKV: false,
+          hasQueue: false,
+          hasCron: false,
+        },
+      });
+
+      // Record the raw shell strings exportDb issues via run().
+      const commands: string[] = [];
+      const run: any = async (cmd: any) => {
+        if (typeof cmd === "string") commands.push(cmd);
+      };
+      run.pause = () => {};
+      run.resume = () => {};
+      run.end = () => {};
+
+      await adapter.exportDb(ctx, run, {
+        output: "/tmp/snap.db",
+        keepSql: true,
+      });
+
+      expect(
+        commands.some((c) => /^wrangler d1 export .+ --remote /.test(c)),
+      ).toBe(true);
+      expect(commands.some((c) => /sqlite3 '\/tmp\/snap\.db' < /.test(c))).toBe(
+        true,
+      );
+    });
+
+    test("refuses when no database is detected", async ({ expect }) => {
+      const { adapter, naming } = createTestEnv();
+      const ctx = makeCtx(naming); // resources.hasDatabase defaults to false
+      const run = createMockRun();
+      await expect(adapter.exportDb(ctx, run)).rejects.toThrow(/no database/i);
+    });
+  });
 });
 
 /**