rastack 0.0.61 → 0.0.63

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.63](https://github.com/theserverkid/reactapistack/compare/v0.0.62...v0.0.63) (2026-07-20)
+
+
+### Features
+
+* **deploy:** dev + prod environments with per-env Cognito, proxy, and .env ([996e726](https://github.com/theserverkid/reactapistack/commit/996e726e7e0d55f01e3111579594c2b66e88a79c))
+
+### [0.0.62](https://github.com/theserverkid/reactapistack/compare/v0.0.61...v0.0.62) (2026-07-19)
+
+
+### Features
+
+* **admin:** Iceberg table discovery — surface warehouse tables the manifest doesn't declare ([9a3b687](https://github.com/theserverkid/reactapistack/commit/9a3b68768878c545e3d1c4c7a95bc3ba75c94856))
+* **catalog:** Iceberg REST Catalog so DuckDB/PyIceberg can write the warehouse (phase 2) ([bf402eb](https://github.com/theserverkid/reactapistack/commit/bf402eb9d2b5ff99ac8074d55fc132a9f26466ab))
+* **store:** make the native engine Iceberg-native — read rows by walking the manifests ([b15fe8b](https://github.com/theserverkid/reactapistack/commit/b15fe8bdbb7053ed4fcadd7dc750c2a4ce313878))
+* **store:** publish real Apache Iceberg tables so DuckDB/PyIceberg can read the warehouse (phase 1) ([13835cd](https://github.com/theserverkid/reactapistack/commit/13835cdeab8f2a48360947ac767808e43d5bd2f8))
+
+
+### Bug Fixes
+
+* **ci:** avoid raw f-string SQL in verify_iceberg.py (Semgrep SAST) ([cffd674](https://github.com/theserverkid/reactapistack/commit/cffd6742ddb7ec04ed8f7b65c293c8de5eca1060))
+
 ### [0.0.61](https://github.com/theserverkid/reactapistack/compare/v0.0.60...v0.0.61) (2026-07-19)
 
 

package/admin/AdminApp.tsx

@@ -23,7 +23,9 @@ import type { RastackEngine } from "../provider/types";
 import {
   AdminResource,
   changelistHeaders,
+  DISCOVER_PATH,
   findResource,
+  mergeDiscovered,
 } from "./adapters";
 import {
   useDashboardStats,
@@ -653,12 +655,45 @@ function useSidebarCollapsed(): [boolean, () => void] {
   return [collapsed, toggle];
 }
 
+/**
+ * Fold warehouse-discovered tables (Iceberg discovery, `GET /api/discover/`)
+ * into the manifest-declared resources. Runs once against the ready engine —
+ * the same seam in both modes (WASM locally, HTTP to `rastack-server`
+ * remotely). Discovery is best-effort: an older server without the endpoint, or
+ * a non-admin identity, just leaves the declared set untouched.
+ */
+function useDiscoveredResources(
+  engine: RastackEngine,
+  declared: AdminResource[],
+): AdminResource[] {
+  const [resources, setResources] = useState(declared);
+  useEffect(() => {
+    let live = true;
+    setResources(declared);
+    (async () => {
+      try {
+        const res = await engine.handle("GET", DISCOVER_PATH, {}, undefined);
+        if (live && res && res.status === 200) {
+          setResources(mergeDiscovered(declared, res.body));
+        }
+      } catch {
+        /* discovery is optional — keep the manifest resources */
+      }
+    })();
+    return () => {
+      live = false;
+    };
+  }, [engine, declared]);
+  return resources;
+}
+
 export function AdminApp(props: {
   engine: RastackEngine;
   resources: AdminResource[];
 }): React.JSX.Element {
   const route = useRoute();
-  const { engine, resources } = props;
+  const { engine } = props;
+  const resources = useDiscoveredResources(engine, props.resources);
   const [collapsed, toggleCollapsed] = useSidebarCollapsed();
 
   const activeKey =

package/admin/adapters.ts

@@ -47,6 +47,12 @@ export interface AdminResource {
   listDisplay: string[] | null;
   /** Whether this resource is shown in the admin (admin !== false). */
   adminEnabled: boolean;
+  /**
+   * True when this table was found in the warehouse (Iceberg discovery) but is
+   * *not* declared in the compiled manifest. Its fields are inferred from a
+   * sample of its rows rather than authored, so the UI badges it as discovered.
+   */
+  discovered?: boolean;
 }
 
 interface RawField {
@@ -69,6 +75,19 @@ interface RawManifest {
   resources?: RawResource[];
 }
 
+/** Map one raw manifest/discovery field to an admin field descriptor. */
+function toAdminField(f: RawField): AdminField {
+  return {
+    name: f.name,
+    type: f.type,
+    primaryKey: f.primaryKey === true,
+    maxLength: f.maxLength,
+    nullable: f.null === true,
+    unique: f.unique === true,
+    relation: f.relation,
+  };
+}
+
 /** Parse a manifest (object or JSON string) into admin resource descriptors. */
 export function parseManifest(manifest: object | string): AdminResource[] {
   const doc: RawManifest =
@@ -78,15 +97,7 @@ export function parseManifest(manifest: object | string): AdminResource[] {
     model: r.model,
     key: `${r.app}.${r.model}`,
     label: humanizeKey(r.model),
-    fields: (r.fields ?? []).map((f) => ({
-      name: f.name,
-      type: f.type,
-      primaryKey: f.primaryKey === true,
-      maxLength: f.maxLength,
-      nullable: f.null === true,
-      unique: f.unique === true,
-      relation: f.relation,
-    })),
+    fields: (r.fields ?? []).map(toAdminField),
     search: r.search ?? [],
     listDisplay:
       r.admin && Array.isArray(r.admin.listDisplay) ? r.admin.listDisplay : null,
@@ -94,6 +105,66 @@ export function parseManifest(manifest: object | string): AdminResource[] {
   }));
 }
 
+// -- Iceberg table discovery (`GET /api/discover/`) -------------------------
+
+/** The discovery endpoint the WASM/HTTP engine answers, over the `handle` seam. */
+export const DISCOVER_PATH = "/api/discover/";
+
+/** One table in the discovery payload (`{ tables: [...] }`). */
+interface DiscoveredTable {
+  app: string;
+  model: string;
+  declared: boolean;
+  adminEnabled?: boolean;
+  rowCount?: number;
+  fields?: RawField[];
+}
+
+/** Read the `{ tables: [...] }` discovery body defensively. */
+export function parseDiscovered(body: unknown): DiscoveredTable[] {
+  const tables = (body as { tables?: unknown } | null)?.tables;
+  if (!Array.isArray(tables)) return [];
+  return tables.filter(
+    (t): t is DiscoveredTable =>
+      !!t && typeof t === "object" && typeof (t as any).app === "string" &&
+      typeof (t as any).model === "string",
+  );
+}
+
+/**
+ * Merge warehouse-discovered tables over the manifest-declared resources. The
+ * manifest is authoritative — a declared table keeps its authored schema. A
+ * table present in the warehouse but absent from the manifest is appended as a
+ * `discovered` resource, its fields inferred from the sampled rows, so it shows
+ * up in the console even though the compiled schema never mentioned it.
+ */
+export function mergeDiscovered(
+  declared: AdminResource[],
+  body: unknown,
+): AdminResource[] {
+  const have = new Set(declared.map((r) => r.key));
+  const extra: AdminResource[] = [];
+  for (const t of parseDiscovered(body)) {
+    const key = `${t.app}.${t.model}`;
+    if (t.declared || have.has(key)) continue;
+    have.add(key);
+    extra.push({
+      app: t.app,
+      model: t.model,
+      key,
+      label: humanizeKey(t.model),
+      fields: (t.fields ?? []).map(toAdminField),
+      search: [],
+      listDisplay: null,
+      adminEnabled: t.adminEnabled !== false,
+      discovered: true,
+    });
+  }
+  // Declared first (stable), then discovered tables in app/model order.
+  extra.sort((a, b) => a.key.localeCompare(b.key));
+  return [...declared, ...extra];
+}
+
 /** The resources shown in the admin index (admin not disabled). */
 export function adminResources(resources: AdminResource[]): AdminResource[] {
   return resources.filter((r) => r.adminEnabled);

package/admin/ui/Sidebar.tsx

@@ -80,6 +80,14 @@ export function Sidebar(props: {
                 >
                   <IconTable size={16} className="ras-ico" />
                   <span className="ras-nav-text">{r.label}</span>
+                  {r.discovered ? (
+                    <span
+                      className="ras-nav-tag"
+                      title="Discovered from the warehouse — not in the compiled schema"
+                    >
+                      discovered
+                    </span>
+                  ) : null}
                 </a>
               );
             })}

package/admin/ui/styles.ts

@@ -145,6 +145,19 @@ a { color: inherit; text-decoration: none; }
   font-weight: 600;
 }
 .ras-nav-link.is-active .ras-ico { color: var(--color-accent); }
+.ras-nav-tag {
+  margin-left: auto;
+  font-size: 9px;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  padding: 2px 6px;
+  border-radius: 999px;
+  color: var(--color-warning);
+  background: color-mix(in srgb, var(--color-warning) 16%, transparent);
+  white-space: nowrap;
+}
+.is-collapsed .ras-nav-tag { display: none; }
 .ras-nav-link.is-active::before {
   content: "";
   position: absolute;

package/auth/provider.ts

@@ -74,10 +74,7 @@ export interface CognitoAuthProviderConfig extends Partial<CognitoAuthConfig> {
 }
 
 export type CognitoAuthStatus =
-  | "loading"
-  | "authenticated"
-  | "unauthenticated"
-  | "error";
+  "loading" | "authenticated" | "unauthenticated" | "error";
 
 /** What `useCognitoAuth()` returns. */
 export interface CognitoAuthContextValue {
@@ -178,7 +175,8 @@ export function CognitoAuthProvider({
   const keyBase = config.storageKey ?? "rastack.auth";
   const sessionKey = `${keyBase}.session`;
   const pkceKey = `${keyBase}.pkce`;
-  const doFetch = config.fetchImpl ?? (globalThis.fetch?.bind(globalThis) as typeof fetch);
+  const doFetch =
+    config.fetchImpl ?? (globalThis.fetch?.bind(globalThis) as typeof fetch);
 
   const [session, setSession] = useState<CognitoSession | null>(null);
   const [status, setStatus] = useState<CognitoAuthStatus>("loading");
@@ -242,7 +240,8 @@ export function CognitoAuthProvider({
         const redirect = parseRedirect(dom.window.location.search);
         if (redirect.error) {
           clearUrl();
-          if (!cancelled) fail(new Error(redirect.errorDescription ?? redirect.error));
+          if (!cancelled)
+            fail(new Error(redirect.errorDescription ?? redirect.error));
           return;
         }
         if (redirect.code) {
@@ -288,14 +287,17 @@ export function CognitoAuthProvider({
   ): Promise<CognitoSession> {
     const hosted = requireHostedConfig(config);
     const pending = storage.getItem(pkceKey);
-    if (!pending) throw new Error("No pending PKCE verifier — restart sign-in.");
+    if (!pending)
+      throw new Error("No pending PKCE verifier — restart sign-in.");
     const { verifier, state: expectedState } = JSON.parse(pending) as {
       verifier: string;
       state: string;
     };
     storage.removeItem(pkceKey);
     if (expectedState && state && expectedState !== state) {
-      throw new Error("OAuth state mismatch — possible CSRF, sign-in rejected.");
+      throw new Error(
+        "OAuth state mismatch — possible CSRF, sign-in rejected.",
+      );
     }
     const response = await doFetch(tokenEndpoint(hosted), {
       method: "POST",
@@ -484,3 +486,64 @@ export function useRastackAuthFromCognito(): RastackAuth {
     [auth.isAuthenticated, auth.claims],
   );
 }
+
+// -- Dev-time Cognito runtime config (real dev pool, opt-in) ------------------
+// `rastack dev` serves the dev environment's Cognito coordinates at
+// `/__rastack/cognito.json` so a locally-running app can sign in against the
+// *real* dev user pool (to obtain real tokens — e.g. for the deployed
+// external-API proxy) instead of the unsigned `mode:"local"` shim. These
+// helpers turn that JSON into a `<CognitoAuthProvider config>`; a developer opts
+// in with `cognitoConfigFromGlobal() ?? { mode: "local" }`.
+
+/** The shape `rastack dev` serves at `/__rastack/cognito.json`. */
+export interface RastackCognitoRuntime {
+  userPoolId?: string;
+  clientId: string;
+  /** Hosted UI base URL (`https://…amazoncognito.com`). */
+  hostedUiUrl: string;
+  region: string;
+}
+
+/**
+ * Map a served runtime config into a `CognitoAuthProviderConfig` for the real
+ * Hosted UI flow. `redirectUri` defaults to the current page origin (where
+ * `rastack dev` serves the app), so local sign-in round-trips back correctly.
+ */
+export function cognitoRuntimeToConfig(
+  runtime: RastackCognitoRuntime,
+  opts: { redirectUri?: string } & Partial<CognitoAuthProviderConfig> = {},
+): CognitoAuthProviderConfig {
+  const origin = dom.window?.location?.origin as string | undefined;
+  const { redirectUri, ...rest } = opts;
+  return {
+    mode: "hosted-ui",
+    domain: runtime.hostedUiUrl,
+    clientId: runtime.clientId,
+    region: runtime.region,
+    userPoolId: runtime.userPoolId,
+    redirectUri: redirectUri ?? origin ?? "",
+    ...rest,
+  };
+}
+
+/**
+ * Read the runtime Cognito config `rastack dev` injects as
+ * `globalThis.__RASTACK_COGNITO__`, mapped to a provider config — or undefined
+ * when none is present (so the caller falls back to `{ mode: "local" }`). Set
+ * the global from the served JSON, e.g.:
+ *
+ * ```html
+ * <script>
+ *   fetch("/__rastack/cognito.json").then(r => r.ok && r.json())
+ *     .then(c => { if (c) window.__RASTACK_COGNITO__ = c; })
+ * </script>
+ * ```
+ */
+export function cognitoConfigFromGlobal(
+  opts: { redirectUri?: string } & Partial<CognitoAuthProviderConfig> = {},
+): CognitoAuthProviderConfig | undefined {
+  const runtime = (dom as { __RASTACK_COGNITO__?: RastackCognitoRuntime })
+    .__RASTACK_COGNITO__;
+  if (!runtime?.clientId || !runtime?.hostedUiUrl) return undefined;
+  return cognitoRuntimeToConfig(runtime, opts);
+}