nestjs-ddd-cli 3.2.2 → 3.3.0

package/dist/commands/generate-migration-deployment.js

@@ -0,0 +1,326 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateMigrationDeployment = generateMigrationDeployment;
+const fs = __importStar(require("fs-extra"));
+const path = __importStar(require("node:path"));
+const chalk_1 = __importDefault(require("chalk"));
+const file_utils_1 = require("../utils/file.utils");
+const migration_1 = require("./migration");
+const config_utils_1 = require("../utils/config.utils");
+const DNS_LABEL = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
+const SECRET_KEY = /^[A-Za-z_][A-Za-z0-9_.-]*$/;
+const IMMUTABLE_IMAGE = /^[A-Za-z0-9][A-Za-z0-9._/:-]*@sha256:[a-f0-9]{64}$/;
+async function generateMigrationDeployment(options) {
+    const resolved = await resolveOptions(options);
+    const runnerPath = path.join(resolved.basePath, 'src', 'migration-runner.ts');
+    const jobPath = path.join(resolved.basePath, 'k8s', 'migration-job.yaml');
+    await assertSafeOutput(runnerPath, resolved.dryRun);
+    await assertSafeOutput(jobPath, resolved.dryRun);
+    if (!resolved.dryRun) {
+        await (0, file_utils_1.ensureDir)(path.dirname(runnerPath));
+        await (0, file_utils_1.ensureDir)(path.dirname(jobPath));
+    }
+    await (0, file_utils_1.writeGeneratedFile)(runnerPath, renderMigrationRunner(resolved.migrationRuntimeDirectory), resolved.dryRun);
+    await (0, file_utils_1.writeGeneratedFile)(jobPath, renderMigrationJob(resolved), resolved.dryRun);
+    const verb = resolved.dryRun ? 'Would generate' : 'Generated';
+    console.log(chalk_1.default.green(`  ✓ ${verb} src/migration-runner.ts`));
+    console.log(chalk_1.default.green(`  ✓ ${verb} k8s/migration-job.yaml`));
+}
+async function resolveOptions(options) {
+    const basePath = path.resolve(options.path ?? process.cwd());
+    const packageJsonPath = path.join(basePath, 'package.json');
+    const packageJson = (await fs.readJson(packageJsonPath));
+    const appName = options.appName ?? (typeof packageJson.name === 'string' ? packageJson.name : undefined);
+    if (!appName || !isDnsLabel(appName)) {
+        throw new Error('Migration deployment requires a DNS-label-safe --app-name');
+    }
+    if (!options.image || !IMMUTABLE_IMAGE.test(options.image)) {
+        throw new Error('Migration deployment --image must be pinned by sha256 digest');
+    }
+    const databaseSecret = options.databaseSecret ?? `${appName}-secrets`;
+    validateDnsLabel(databaseSecret, '--database-secret');
+    const databaseUrlKey = options.databaseUrlKey ?? 'DATABASE_URL';
+    validateSecretKey(databaseUrlKey, '--database-url-key');
+    const databaseSslKey = options.databaseSslKey ?? 'DATABASE_SSL';
+    validateSecretKey(databaseSslKey, '--database-ssl-key');
+    if (options.configMap) {
+        validateDnsLabel(options.configMap, '--config-map');
+    }
+    if (options.imagePullSecret) {
+        validateDnsLabel(options.imagePullSecret, '--image-pull-secret');
+    }
+    const databaseSslCaSecret = options.databaseSslCaSecret;
+    const databaseSslCaKey = options.databaseSslCaKey ?? 'DATABASE_SSL_CA';
+    if (databaseSslCaSecret) {
+        validateDnsLabel(databaseSslCaSecret, '--database-ssl-ca-secret');
+        validateSecretKey(databaseSslCaKey, '--database-ssl-ca-key');
+    }
+    else if (options.databaseSslCaKey) {
+        throw new Error('--database-ssl-ca-key requires --database-ssl-ca-secret');
+    }
+    const databaseSslInsecureSkipVerify = options.databaseSslInsecureSkipVerify ?? false;
+    if (databaseSslCaSecret && databaseSslInsecureSkipVerify) {
+        throw new Error('--database-ssl-ca-secret cannot be combined with --database-ssl-insecure-skip-verify');
+    }
+    if ((databaseSslCaSecret || databaseSslInsecureSkipVerify) && !options.configMap) {
+        throw new Error('--config-map is required when configuring a database CA or insecure TLS opt-in');
+    }
+    const config = await (0, config_utils_1.loadConfig)(basePath);
+    const configuredMigrationPath = config.paths?.migrations;
+    if (typeof configuredMigrationPath !== 'string' ||
+        configuredMigrationPath.trim().length === 0 ||
+        /[\0*?{}[\]]/.test(configuredMigrationPath)) {
+        throw new Error('.dddrc.json paths.migrations must be a non-empty directory path');
+    }
+    const migrationSourceDirectory = (0, migration_1.resolveMigrationOutputPath)(basePath, configuredMigrationPath, 'src/migrations');
+    const migrationRuntimeDirectory = resolveCompiledMigrationRuntimeDirectory(basePath, migrationSourceDirectory);
+    return {
+        basePath,
+        appName,
+        image: options.image,
+        databaseSecret,
+        databaseUrlKey,
+        configMap: options.configMap,
+        databaseSslKey,
+        databaseSslCaSecret,
+        databaseSslCaKey,
+        databaseSslInsecureSkipVerify,
+        imagePullSecret: options.imagePullSecret,
+        migrationRuntimeDirectory,
+        dryRun: options.dryRun ?? false,
+    };
+}
+function resolveCompiledMigrationRuntimeDirectory(basePath, migrationSourceDirectory) {
+    const sourceRoot = findOwningSourceRoot(migrationSourceDirectory);
+    if (!sourceRoot) {
+        throw new Error('.dddrc.json paths.migrations must be inside a source directory named "src"');
+    }
+    const compiledMigrationDirectory = path.join(path.dirname(sourceRoot), 'dist', path.relative(sourceRoot, migrationSourceDirectory));
+    const compiledRunnerDirectory = path.join(basePath, 'dist');
+    const relativeRuntimeDirectory = path.relative(compiledRunnerDirectory, compiledMigrationDirectory);
+    return (relativeRuntimeDirectory || '.').split(path.sep).join('/');
+}
+function findOwningSourceRoot(migrationSourceDirectory) {
+    let current = path.resolve(migrationSourceDirectory);
+    while (true) {
+        if (path.basename(current) === 'src') {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return undefined;
+        }
+        current = parent;
+    }
+}
+function isDnsLabel(value) {
+    return value.length <= 63 && DNS_LABEL.test(value);
+}
+function validateDnsLabel(value, optionName) {
+    if (!isDnsLabel(value)) {
+        throw new Error(`${optionName} must be a valid Kubernetes DNS label`);
+    }
+}
+function validateSecretKey(value, optionName) {
+    if (value.length > 253 || !SECRET_KEY.test(value)) {
+        throw new Error(`${optionName} must be a valid Kubernetes Secret or ConfigMap key`);
+    }
+}
+async function assertSafeOutput(filePath, dryRun) {
+    if (!dryRun && (await (0, file_utils_1.fileExists)(filePath))) {
+        throw new Error(`Refusing to overwrite existing migration deployment file: ${filePath}`);
+    }
+}
+function renderMigrationRunner(migrationRuntimeDirectory) {
+    const serializedRuntimeDirectory = JSON.stringify(migrationRuntimeDirectory);
+    return `import 'reflect-metadata';
+import * as path from 'node:path';
+import { DataSource, DataSourceOptions } from 'typeorm';
+
+export type MigrationEnvironment = Readonly<Record<string, string | undefined>>;
+
+export function createMigrationDataSourceOptions(
+  environment: MigrationEnvironment = process.env,
+): DataSourceOptions {
+  const databaseUrl = environment.DATABASE_URL?.trim();
+  if (!databaseUrl) {
+    throw new Error('DATABASE_URL is required to run migrations');
+  }
+
+  const sslEnabled = parseBoolean(environment.DATABASE_SSL ?? 'false', 'DATABASE_SSL');
+  const insecureSkipVerify = parseBoolean(
+    environment.DATABASE_SSL_INSECURE_SKIP_VERIFY ?? 'false',
+    'DATABASE_SSL_INSECURE_SKIP_VERIFY',
+  );
+  const certificateAuthority = environment.DATABASE_SSL_CA?.trim();
+
+  if (!sslEnabled && (insecureSkipVerify || certificateAuthority)) {
+    throw new Error(
+      'DATABASE_SSL must be true when DATABASE_SSL_INSECURE_SKIP_VERIFY or DATABASE_SSL_CA is set',
+    );
+  }
+  if (insecureSkipVerify && certificateAuthority) {
+    throw new Error(
+      'DATABASE_SSL_CA cannot be combined with DATABASE_SSL_INSECURE_SKIP_VERIFY=true',
+    );
+  }
+
+  const ssl = sslEnabled
+    ? {
+        rejectUnauthorized: !insecureSkipVerify,
+        ...(certificateAuthority ? { ca: certificateAuthority } : {}),
+      }
+    : false;
+
+  return {
+    type: 'postgres',
+    url: databaseUrl,
+    ssl,
+    synchronize: false,
+    migrationsRun: false,
+    migrationsTableName: 'migrations',
+    migrations: [path.resolve(__dirname, ${serializedRuntimeDirectory}, '*.js')],
+  };
+}
+
+export async function runMigrations(dataSource: DataSource): Promise<void> {
+  await dataSource.initialize();
+  try {
+    await dataSource.runMigrations({ transaction: 'all' });
+  } finally {
+    if (dataSource.isInitialized) {
+      await dataSource.destroy();
+    }
+  }
+}
+
+function parseBoolean(value: string, name: string): boolean {
+  const normalized = value.trim().toLowerCase();
+  if (normalized === 'true') return true;
+  if (normalized === 'false') return false;
+  throw new Error(\`${'${name}'} must be true or false\`);
+}
+
+async function main(): Promise<void> {
+  const dataSource = new DataSource(createMigrationDataSourceOptions());
+  try {
+    await runMigrations(dataSource);
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : 'Unknown migration failure';
+    console.error(\`Migration failed: ${'${message}'}\`);
+    process.exitCode = 1;
+  }
+}
+
+if (require.main === module) {
+  void main(); // NOSONAR -- CommonJS executable entrypoints cannot use top-level await.
+}
+`;
+}
+function renderMigrationJob(options) {
+    const pullSecret = options.imagePullSecret
+        ? `      imagePullSecrets:\n        - name: ${options.imagePullSecret}\n`
+        : '';
+    const sslSource = options.configMap
+        ? `            - name: DATABASE_SSL\n              valueFrom:\n                configMapKeyRef:\n                  name: ${options.configMap}\n                  key: ${options.databaseSslKey}\n`
+        : `            - name: DATABASE_SSL\n              value: 'false'\n`;
+    const caSource = options.databaseSslCaSecret
+        ? `            - name: DATABASE_SSL_CA\n              valueFrom:\n                secretKeyRef:\n                  name: ${options.databaseSslCaSecret}\n                  key: ${options.databaseSslCaKey}\n`
+        : '';
+    return `apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ${options.appName}-migrate
+  labels:
+    app: ${options.appName}
+    app.kubernetes.io/component: database-migration
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
+spec:
+  backoffLimit: 2
+  activeDeadlineSeconds: 600
+  ttlSecondsAfterFinished: 3600
+  template:
+    metadata:
+      labels:
+        app: ${options.appName}
+        app.kubernetes.io/component: database-migration
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: Never
+${pullSecret}      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        runAsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: migrate
+          image: ${options.image}
+          imagePullPolicy: IfNotPresent
+          command:
+            - node
+            - dist/migration-runner.js
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: ${options.databaseSecret}
+                  key: ${options.databaseUrlKey}
+${sslSource}            - name: DATABASE_SSL_INSECURE_SKIP_VERIFY
+              value: '${options.databaseSslInsecureSkipVerify ? 'true' : 'false'}'
+${caSource}          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+              ephemeral-storage: 16Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+              ephemeral-storage: 128Mi
+`;
+}
+//# sourceMappingURL=generate-migration-deployment.js.map

package/dist/commands/generate-migration-deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-migration-deployment.js","sourceRoot":"","sources":["../../src/commands/generate-migration-deployment.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,kEAwBC;AAlED,6CAA+B;AAC/B,gDAAkC;AAClC,kDAA0B;AAC1B,oDAAgF;AAChF,2CAAyD;AACzD,wDAAmD;AAiCnD,MAAM,SAAS,GAAG,mCAAmC,CAAC;AACtD,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAChD,MAAM,eAAe,GAAG,oDAAoD,CAAC;AAEtE,KAAK,UAAU,2BAA2B,CAC/C,OAAmC;IAEnC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAE1E,MAAM,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,IAAA,+BAAkB,EACtB,UAAU,EACV,qBAAqB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EACzD,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,MAAM,IAAA,+BAAkB,EAAC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,OAAO,IAAI,yBAAyB,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAmC;IAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAuB,CAAC;IAC/E,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE3F,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,GAAG,OAAO,UAAU,CAAC;IACtE,gBAAgB,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;IAEtD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,cAAc,CAAC;IAChE,iBAAiB,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAExD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,cAAc,CAAC;IAChE,iBAAiB,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAExD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,gBAAgB,CAAC,OAAO,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,iBAAiB,CAAC;IACvE,IAAI,mBAAmB,EAAE,CAAC;QACxB,gBAAgB,CAAC,mBAAmB,EAAE,0BAA0B,CAAC,CAAC;QAClE,iBAAiB,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,IAAI,KAAK,CAAC;IACrF,IAAI,mBAAmB,IAAI,6BAA6B,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,mBAAmB,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAU,EAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,uBAAuB,GAAY,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;IAClE,IACE,OAAO,uBAAuB,KAAK,QAAQ;QAC3C,uBAAuB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC3C,aAAa,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,wBAAwB,GAAG,IAAA,sCAA0B,EACzD,QAAQ,EACR,uBAAuB,EACvB,gBAAgB,CACjB,CAAC;IACF,MAAM,yBAAyB,GAAG,wCAAwC,CACxE,QAAQ,EACR,wBAAwB,CACzB,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc;QACd,cAAc;QACd,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc;QACd,mBAAmB;QACnB,gBAAgB;QAChB,6BAA6B;QAC7B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,yBAAyB;QACzB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,wCAAwC,CAC/C,QAAgB,EAChB,wBAAgC;IAEhC,MAAM,UAAU,GAAG,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,0BAA0B,GAAG,IAAI,CAAC,IAAI,CAC1C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EACxB,MAAM,EACN,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC,CACpD,CAAC;IACF,MAAM,uBAAuB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,wBAAwB,GAAG,IAAI,CAAC,QAAQ,CAC5C,uBAAuB,EACvB,0BAA0B,CAC3B,CAAC;IAEF,OAAO,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,oBAAoB,CAAC,wBAAgC;IAC5D,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAErD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,UAAkB;IACzD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,uCAAuC,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,UAAkB;IAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,qDAAqD,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAe;IAC/D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAA,uBAAU,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6DAA6D,QAAQ,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,yBAAiC;IAC9D,MAAM,0BAA0B,GAAG,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAE7E,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA8CkC,0BAA0B;;;;;;;;;;;;;;;;;;;sBAmB/C,SAAS;;;;;;;;;wCASS,YAAY;;;;;;;;CAQnD,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA2C;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe;QACxC,CAAC,CAAC,4CAA4C,OAAO,CAAC,eAAe,IAAI;QACzE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS;QACjC,CAAC,CAAC,yHAAyH,OAAO,CAAC,SAAS,4BAA4B,OAAO,CAAC,cAAc,IAAI;QAClM,CAAC,CAAC,kEAAkE,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,mBAAmB;QAC1C,CAAC,CAAC,yHAAyH,OAAO,CAAC,mBAAmB,4BAA4B,OAAO,CAAC,gBAAgB,IAAI;QAC9M,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;UAGC,OAAO,CAAC,OAAO;;WAEd,OAAO,CAAC,OAAO;;;;;;;;;;;;eAYX,OAAO,CAAC,OAAO;;;;;EAK5B,UAAU;;;;;;;;mBAQO,OAAO,CAAC,KAAK;;;;;;;;;0BASN,OAAO,CAAC,cAAc;yBACvB,OAAO,CAAC,cAAc;EAC7C,SAAS;wBACa,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;EAC9E,QAAQ;;;;;;;;;;;;;;;CAeT,CAAC;AACF,CAAC"}

package/dist/commands/generate-migration-deployment.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/generate-migration-deployment.spec.js

@@ -0,0 +1,337 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs-extra"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const typescript_1 = __importDefault(require("typescript"));
+const yaml_1 = require("yaml");
+const config_utils_1 = require("../utils/config.utils");
+const generate_migration_deployment_1 = require("./generate-migration-deployment");
+async function compileAndLoadRunner(projectPath) {
+    const runnerPath = path.join(projectPath, 'src/migration-runner.ts');
+    const declarationsPath = path.join(projectPath, 'generated-runtime-types.d.ts');
+    const outputPath = path.join(projectPath, 'dist');
+    await fs.writeFile(declarationsPath, `declare module 'reflect-metadata';
+declare module 'typeorm' {
+  export interface DataSourceOptions {
+    migrations?: string[];
+    ssl?: false | { rejectUnauthorized: boolean; ca?: string };
+    [key: string]: unknown;
+  }
+
+  export class DataSource {
+    constructor(options: DataSourceOptions);
+    isInitialized: boolean;
+    initialize(): Promise<void>;
+    runMigrations(options: { transaction: 'all' }): Promise<void>;
+    destroy(): Promise<void>;
+  }
+}
+`, 'utf8');
+    const program = typescript_1.default.createProgram({
+        rootNames: [declarationsPath, runnerPath],
+        options: {
+            esModuleInterop: true,
+            forceConsistentCasingInFileNames: true,
+            module: typescript_1.default.ModuleKind.CommonJS,
+            moduleResolution: typescript_1.default.ModuleResolutionKind.Node10,
+            noEmitOnError: true,
+            outDir: outputPath,
+            rootDir: path.join(projectPath, 'src'),
+            skipLibCheck: true,
+            strict: true,
+            target: typescript_1.default.ScriptTarget.ES2020,
+            typeRoots: [path.resolve(__dirname, '../../node_modules/@types')],
+            types: ['node'],
+        },
+    });
+    const emitResult = program.emit();
+    const diagnostics = typescript_1.default
+        .getPreEmitDiagnostics(program)
+        .concat(emitResult.diagnostics)
+        .map((diagnostic) => typescript_1.default.flattenDiagnosticMessageText(diagnostic.messageText, typescript_1.default.sys.newLine));
+    expect(diagnostics).toEqual([]);
+    await fs.outputFile(path.join(projectPath, 'node_modules/typeorm/index.js'), 'class DataSource {}\nmodule.exports = { DataSource };\n', 'utf8');
+    await fs.outputFile(path.join(projectPath, 'node_modules/reflect-metadata/index.js'), '', 'utf8');
+    return require(path.join(outputPath, 'migration-runner.js'));
+}
+describe('generateMigrationDeployment', () => {
+    let projectPath;
+    beforeEach(async () => {
+        (0, config_utils_1.resetConfigCache)();
+        projectPath = await fs.mkdtemp(path.join(os.tmpdir(), 'ddd-migration-deployment-'));
+        await fs.writeJson(path.join(projectPath, 'package.json'), { name: 'identity-api' });
+    });
+    afterEach(async () => {
+        (0, config_utils_1.resetConfigCache)();
+        await fs.remove(projectPath);
+    });
+    it('generates a loadable secure runner and a valid immutable-image PreSync Job', async () => {
+        const digest = 'a'.repeat(64);
+        await (0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: projectPath,
+            image: `registry.example/identity-api@sha256:${digest}`,
+            databaseSecret: 'identity-api-secrets',
+            configMap: 'identity-api-config',
+            imagePullSecret: 'registry-pull',
+        });
+        const runner = await compileAndLoadRunner(projectPath);
+        const migrationOptions = runner.createMigrationDataSourceOptions({
+            DATABASE_URL: 'postgres://localhost/identity',
+            DATABASE_SSL: 'true',
+        });
+        const job = (0, yaml_1.parse)(await fs.readFile(path.join(projectPath, 'k8s/migration-job.yaml'), 'utf8'));
+        const canonicalProjectPath = await fs.realpath(projectPath);
+        expect(migrationOptions.migrations).toEqual([
+            path.join(canonicalProjectPath, 'dist/migrations/*.js'),
+        ]);
+        expect(migrationOptions.ssl).toEqual({ rejectUnauthorized: true });
+        const migrationCalls = [];
+        const dataSource = {
+            isInitialized: false,
+            async initialize() {
+                this.isInitialized = true;
+                migrationCalls.push('initialize');
+            },
+            async runMigrations(options) {
+                migrationCalls.push(`run:${options.transaction}`);
+            },
+            async destroy() {
+                this.isInitialized = false;
+                migrationCalls.push('destroy');
+            },
+        };
+        await runner.runMigrations(dataSource);
+        expect(migrationCalls).toEqual(['initialize', 'run:all', 'destroy']);
+        expect(job).toMatchObject({
+            apiVersion: 'batch/v1',
+            kind: 'Job',
+            metadata: {
+                name: 'identity-api-migrate',
+                annotations: {
+                    'argocd.argoproj.io/hook': 'PreSync',
+                    'argocd.argoproj.io/hook-delete-policy': 'BeforeHookCreation,HookSucceeded',
+                },
+            },
+            spec: {
+                template: {
+                    spec: {
+                        automountServiceAccountToken: false,
+                        restartPolicy: 'Never',
+                        securityContext: {
+                            runAsNonRoot: true,
+                            runAsUser: 1001,
+                            runAsGroup: 1001,
+                            seccompProfile: { type: 'RuntimeDefault' },
+                        },
+                        imagePullSecrets: [{ name: 'registry-pull' }],
+                        containers: [
+                            {
+                                name: 'migrate',
+                                image: `registry.example/identity-api@sha256:${digest}`,
+                                command: ['node', 'dist/migration-runner.js'],
+                                env: expect.arrayContaining([
+                                    {
+                                        name: 'DATABASE_URL',
+                                        valueFrom: {
+                                            secretKeyRef: { name: 'identity-api-secrets', key: 'DATABASE_URL' },
+                                        },
+                                    },
+                                    {
+                                        name: 'DATABASE_SSL',
+                                        valueFrom: {
+                                            configMapKeyRef: { name: 'identity-api-config', key: 'DATABASE_SSL' },
+                                        },
+                                    },
+                                    { name: 'DATABASE_SSL_INSECURE_SKIP_VERIFY', value: 'false' },
+                                ]),
+                            },
+                        ],
+                    },
+                },
+            },
+        });
+    });
+    it('uses the configured compiled migration directory inside an application', async () => {
+        await fs.writeJson(path.join(projectPath, '.dddrc.json'), {
+            paths: { migrations: 'src/database/migrations' },
+        });
+        await (0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: projectPath,
+            image: `registry.example/identity-api@sha256:${'b'.repeat(64)}`,
+        });
+        const runner = await compileAndLoadRunner(projectPath);
+        const options = runner.createMigrationDataSourceOptions({
+            DATABASE_URL: 'postgres://localhost/identity',
+        });
+        const canonicalProjectPath = await fs.realpath(projectPath);
+        expect(options.migrations).toEqual([
+            path.join(canonicalProjectPath, 'dist/database/migrations/*.js'),
+        ]);
+    });
+    it('uses the owning package dist directory for monorepo-shared migrations', async () => {
+        const workspacePath = projectPath;
+        const appPath = path.join(workspacePath, 'apps/identity-api');
+        await fs.ensureDir(path.join(workspacePath, '.git'));
+        await fs.ensureDir(path.join(workspacePath, 'packages/identity-storage/src/migrations'));
+        await fs.ensureDir(appPath);
+        await fs.writeJson(path.join(appPath, 'package.json'), { name: 'identity-api' });
+        await fs.writeJson(path.join(appPath, '.dddrc.json'), {
+            paths: { migrations: '../../packages/identity-storage/src/migrations' },
+        });
+        await (0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: appPath,
+            image: `registry.example/identity-api@sha256:${'c'.repeat(64)}`,
+        });
+        const runner = await compileAndLoadRunner(appPath);
+        const options = runner.createMigrationDataSourceOptions({
+            DATABASE_URL: 'postgres://localhost/identity',
+        });
+        const canonicalWorkspacePath = await fs.realpath(workspacePath);
+        expect(options.migrations).toEqual([
+            path.join(canonicalWorkspacePath, 'packages/identity-storage/dist/migrations/*.js'),
+        ]);
+    });
+    it('keeps TLS verification on, supports a trusted CA, and gates insecure TLS explicitly', async () => {
+        await (0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: projectPath,
+            image: `registry.example/identity-api@sha256:${'d'.repeat(64)}`,
+            configMap: 'identity-api-config',
+            databaseSslCaSecret: 'identity-database-ca',
+        });
+        const runner = await compileAndLoadRunner(projectPath);
+        const databaseUrl = 'postgres://localhost/identity';
+        expect(runner.createMigrationDataSourceOptions({
+            DATABASE_URL: databaseUrl,
+            DATABASE_SSL: 'true',
+            DATABASE_SSL_CA: 'trusted-ca-pem',
+        }).ssl).toEqual({ rejectUnauthorized: true, ca: 'trusted-ca-pem' });
+        expect(runner.createMigrationDataSourceOptions({
+            DATABASE_URL: databaseUrl,
+            DATABASE_SSL: 'true',
+            DATABASE_SSL_INSECURE_SKIP_VERIFY: 'true',
+        }).ssl).toEqual({ rejectUnauthorized: false });
+        expect(() => runner.createMigrationDataSourceOptions({
+            DATABASE_URL: databaseUrl,
+            DATABASE_SSL: 'false',
+            DATABASE_SSL_INSECURE_SKIP_VERIFY: 'true',
+        })).toThrow('DATABASE_SSL must be true');
+        expect(() => runner.createMigrationDataSourceOptions({
+            DATABASE_URL: databaseUrl,
+            DATABASE_SSL: 'true',
+            DATABASE_SSL_CA: 'trusted-ca-pem',
+            DATABASE_SSL_INSECURE_SKIP_VERIFY: 'true',
+        })).toThrow('cannot be combined');
+        const job = (0, yaml_1.parse)(await fs.readFile(path.join(projectPath, 'k8s/migration-job.yaml'), 'utf8'));
+        expect(job.spec.template.spec.containers[0]?.env).toEqual(expect.arrayContaining([
+            {
+                name: 'DATABASE_SSL_CA',
+                valueFrom: {
+                    secretKeyRef: { name: 'identity-database-ca', key: 'DATABASE_SSL_CA' },
+                },
+            },
+        ]));
+    });
+    it('requires an explicit coherent opt-in before generating insecure database TLS', async () => {
+        const image = `registry.example/identity-api@sha256:${'3'.repeat(64)}`;
+        await expect((0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: projectPath,
+            image,
+            databaseSslInsecureSkipVerify: true,
+        })).rejects.toThrow('--config-map is required');
+        await expect((0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: projectPath,
+            image,
+            configMap: 'identity-api-config',
+            databaseSslCaSecret: 'identity-database-ca',
+            databaseSslInsecureSkipVerify: true,
+        })).rejects.toThrow('cannot be combined');
+        await (0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: projectPath,
+            image,
+            configMap: 'identity-api-config',
+            databaseSslInsecureSkipVerify: true,
+        });
+        const job = (0, yaml_1.parse)(await fs.readFile(path.join(projectPath, 'k8s/migration-job.yaml'), 'utf8'));
+        expect(job.spec.template.spec.containers[0]?.env).toEqual(expect.arrayContaining([{ name: 'DATABASE_SSL_INSECURE_SKIP_VERIFY', value: 'true' }]));
+    });
+    it('rejects invalid or unbuildable configured migration paths', async () => {
+        await fs.writeJson(path.join(projectPath, '.dddrc.json'), {
+            paths: { migrations: 'migrations' },
+        });
+        await expect((0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: projectPath,
+            image: `registry.example/identity-api@sha256:${'e'.repeat(64)}`,
+        })).rejects.toThrow('must be inside a source directory named "src"');
+        (0, config_utils_1.resetConfigCache)();
+        await fs.writeJson(path.join(projectPath, '.dddrc.json'), {
+            paths: { migrations: '' },
+        });
+        await expect((0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: projectPath,
+            image: `registry.example/identity-api@sha256:${'f'.repeat(64)}`,
+        })).rejects.toThrow('must be a non-empty directory path');
+    });
+    it('rejects a mutable image tag', async () => {
+        await expect((0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: projectPath,
+            image: 'registry.example/identity-api:staging',
+        })).rejects.toThrow('must be pinned by sha256 digest');
+    });
+    it('does not overwrite an existing migration gate', async () => {
+        const options = {
+            path: projectPath,
+            image: `registry.example/identity-api@sha256:${'1'.repeat(64)}`,
+        };
+        await (0, generate_migration_deployment_1.generateMigrationDeployment)(options);
+        await expect((0, generate_migration_deployment_1.generateMigrationDeployment)(options)).rejects.toThrow('Refusing to overwrite');
+    });
+    it('keeps dry-run non-mutating', async () => {
+        await (0, generate_migration_deployment_1.generateMigrationDeployment)({
+            path: projectPath,
+            image: `registry.example/identity-api@sha256:${'2'.repeat(64)}`,
+            dryRun: true,
+        });
+        await expect(fs.pathExists(path.join(projectPath, 'src/migration-runner.ts'))).resolves.toBe(false);
+        await expect(fs.pathExists(path.join(projectPath, 'k8s/migration-job.yaml'))).resolves.toBe(false);
+        await expect(fs.pathExists(path.join(projectPath, 'src'))).resolves.toBe(false);
+        await expect(fs.pathExists(path.join(projectPath, 'k8s'))).resolves.toBe(false);
+    });
+});
+//# sourceMappingURL=generate-migration-deployment.spec.js.map