rastack 0.0.61 → 0.0.63

package/src/deploy/workflows.ts

@@ -11,7 +11,7 @@
  * Pure string builders — `rastack-init.ts` is the thin wrapper that writes them.
  */
 
-import { DeployConfig } from "./config";
+import { DeployConfig, EnvName, resolveEnvironment } from "./config";
 
 /** A templated file: repo-relative path + its contents. */
 export interface ScaffoldFile {
@@ -27,6 +27,8 @@ const NODE_VERSION = "22";
  * every push/PR. The clean replacement for hand-written compile/check steps.
  */
 export function renderCiWorkflow(cfg: DeployConfig): string {
+  const prod = resolveEnvironment(cfg, "prod");
+  const dev = resolveEnvironment(cfg, "dev");
   return `name: CI
 
 # Validate the resource graph and compile the manifest on every change.
@@ -35,7 +37,7 @@ export function renderCiWorkflow(cfg: DeployConfig): string {
 
 on:
   push:
-    branches: [${cfg.github.branch}]
+    branches: [${prod.branch}, ${dev.branch}]
   pull_request:
 
 permissions:
@@ -65,19 +67,28 @@ jobs:
  */
 export function renderDeployWorkflow(cfg: DeployConfig): string {
   const arch = cfg.lambda.arch === "arm64" ? "arm64" : "x86_64";
+  const prod = resolveEnvironment(cfg, "prod");
+  const dev = resolveEnvironment(cfg, "dev");
+  // Pick the environment (and rastack --env flag) from the pushed branch.
+  const ghEnv = `\${{ github.ref_name == '${prod.branch}' && '${prod.ghEnvironment}' || '${dev.ghEnvironment}' }}`;
+  const envFlag = `\${{ github.ref_name == '${prod.branch}' && 'prod' || 'dev' }}`;
   return `name: Deploy backend
 
-# Ship the Rust API (rastack-server) to AWS Lambda. Infrastructure is created
-# once by a human via CloudFormation (docs/serverless-deploy.md); this workflow
+# Ship the Rust API (rastack-server) to AWS Lambda — dev and prod. Infrastructure
+# is created once by \`rastack init\` (docs/serverless-deploy.md); this workflow
 # only ever runs \`aws lambda update-function-code\`, wrapped by \`rastack ci\`.
 #
-# Wire these from the CloudFormation stack Outputs as GitHub repo Variables:
+# The environment is chosen from the branch:
+#   ${dev.branch} → ${dev.ghEnvironment} (dev stack)   ${prod.branch} → ${prod.ghEnvironment} (prod stack)
+#
+# Each GitHub Actions Environment holds its own AWS Variables (wired by
+# \`rastack init\` from that environment's stack Outputs):
 #   AWS_DEPLOY_ROLE_ARN   DeployRoleArn   (the OIDC role this job assumes)
 #   AWS_REGION            Region          (${cfg.region})
 
 on:
   push:
-    branches: [${cfg.github.branch}]
+    branches: [${prod.branch}, ${dev.branch}]
 
 # Least privilege: read the repo + mint an OIDC token to assume the deploy role.
 permissions:
@@ -85,15 +96,20 @@ permissions:
   id-token: write
 
 concurrency:
-  group: deploy-backend
+  # One in-flight deploy per branch, so dev and prod never cancel each other.
+  group: deploy-backend-\${{ github.ref_name }}
   cancel-in-progress: true
 
 jobs:
   deploy:
     name: Build & deploy the Lambda (${arch})
     runs-on: ubuntu-latest
-    # Skip on forks / repos that never wired the deploy role, so the job does
-    # not fail red for contributors who cannot (and should not) deploy.
+    # Select the GitHub Environment from the branch. Its scoped Variables
+    # (AWS_DEPLOY_ROLE_ARN / AWS_REGION) then resolve to the right stack, and
+    # prod protection rules (if any) gate the run.
+    environment: ${ghEnv}
+    # Skip on forks / environments that never wired the deploy role, so the job
+    # does not fail red for contributors who cannot (and should not) deploy.
     if: vars.AWS_DEPLOY_ROLE_ARN != ''
     steps:
       - uses: actions/checkout@v4
@@ -120,10 +136,10 @@ jobs:
           role-to-assume: \${{ vars.AWS_DEPLOY_ROLE_ARN }}
           aws-region: \${{ vars.AWS_REGION }}
 
-      # One line: compile the manifest, cross-build the bundle, bake the JWKS,
-      # and update-function-code. See \`rastack ci --plan deploy\`.
+      # One line: compile the manifest, cross-build the bundle, bake the env's
+      # Cognito JWKS, and update-function-code for that env's function.
       - name: Build & deploy
-        run: rastack ci deploy
+        run: rastack ci deploy --env ${envFlag}
 `;
 }
 
@@ -135,6 +151,100 @@ export function renderConfigFile(cfg: DeployConfig): string {
 export const CONFIG_PATH = ".rastack/deploy.json";
 export const CI_WORKFLOW_PATH = ".github/workflows/ci.yml";
 export const DEPLOY_WORKFLOW_PATH = ".github/workflows/deploy-backend.yml";
+export const ENV_PATH = ".env";
+export const GITIGNORE_PATH = ".gitignore";
+
+/**
+ * The generated `.env` — the app's **local** environment. Every value is
+ * non-secret (client ids, pool ids, public URLs from the stack Outputs), but the
+ * file is git-ignored by convention (`gitignoreWith`) so a developer can add
+ * their own secrets beside these without ever committing them. Values are blank
+ * until the matching stack is deployed; `rastack init` rewrites the file with the
+ * resolved Outputs after standing the backends up.
+ *
+ * Keys are `RASTACK_<ENV>_*` (a neutral prefix). For a browser bundle, re-export
+ * the ones you need under your bundler's public prefix (EXPO_PUBLIC_/VITE_/…);
+ * `rastack dev` also serves the dev pool config live at `/__rastack/cognito.json`.
+ */
+export function renderEnvFile(cfg: DeployConfig): string {
+  const lines: string[] = [
+    "# Generated by `rastack init` — local app environment (git-ignored).",
+    "# Non-secret values from the CloudFormation stack Outputs; add your own",
+    "# secrets below. Re-run `rastack init` to refresh after a deploy.",
+    "",
+    `RASTACK_APP=${cfg.app}`,
+    `RASTACK_REGION=${cfg.region}`,
+    "",
+  ];
+  const envKeys: [EnvName, string][] = [
+    ["dev", "DEV"],
+    ["prod", "PROD"],
+  ];
+  for (const [env, prefix] of envKeys) {
+    const e = resolveEnvironment(cfg, env);
+    const o = e.outputs ?? {};
+    lines.push(
+      `# ${env} (${e.branch} → ${e.ghEnvironment})`,
+      `RASTACK_${prefix}_API_URL=${o.apiUrl ?? ""}`,
+      `RASTACK_${prefix}_USER_POOL_ID=${o.userPoolId ?? ""}`,
+      `RASTACK_${prefix}_USER_POOL_CLIENT_ID=${o.userPoolClientId ?? ""}`,
+      `RASTACK_${prefix}_HOSTED_UI_URL=${o.hostedUiUrl ?? ""}`,
+      `RASTACK_${prefix}_PROXY_URL=${o.proxyUrl ?? ""}`,
+      "",
+    );
+  }
+  return lines.join("\n");
+}
+
+/**
+ * Upsert the generated `RASTACK_*` keys from `renderEnvFile(cfg)` into an
+ * existing `.env`, preserving every other line (a developer's own secrets,
+ * comments, extra keys). A matching `RASTACK_*=` line is updated in place;
+ * generated keys not yet present are appended. When there is no existing file,
+ * this is exactly `renderEnvFile(cfg)`. Pure — the IO wrapper reads/writes.
+ */
+export function applyEnvValues(existing: string, cfg: DeployConfig): string {
+  const rendered = renderEnvFile(cfg);
+  if (!existing.trim()) return rendered;
+
+  const generated = new Map<string, string>();
+  for (const line of rendered.split("\n")) {
+    const m = /^(RASTACK_[A-Z0-9_]+)=(.*)$/.exec(line);
+    if (m) generated.set(m[1], m[2]);
+  }
+
+  const seen = new Set<string>();
+  const out = existing.split("\n").map((line) => {
+    const m = /^(RASTACK_[A-Z0-9_]+)=/.exec(line);
+    if (m && generated.has(m[1])) {
+      seen.add(m[1]);
+      return `${m[1]}=${generated.get(m[1])}`;
+    }
+    return line;
+  });
+
+  const missing = [...generated].filter(([k]) => !seen.has(k));
+  if (missing.length) {
+    if (out.length && out[out.length - 1].trim() !== "") out.push("");
+    for (const [k, v] of missing) out.push(`${k}=${v}`);
+    out.push("");
+  }
+  return out.join("\n");
+}
+
+/**
+ * Return `.gitignore` content with a `.env` entry present (idempotent). Appends
+ * under a labelled block when missing, leaves the file untouched when `.env` is
+ * already ignored — so `rastack init` never duplicates the entry or clobbers a
+ * developer's existing ignore rules.
+ */
+export function gitignoreWith(existing: string, entry = ".env"): string {
+  const lines = existing.split("\n").map((l) => l.trim());
+  if (lines.includes(entry)) return existing;
+  const base = existing.replace(/\n+$/, "");
+  const block = `# rastack — local environment (secrets)\n${entry}\n`;
+  return base ? `${base}\n\n${block}` : block;
+}
 
 export interface ScaffoldOptions {
   /** Omit the GitHub Actions workflows (config only). */

package/src/rastack-ci.ts

@@ -19,12 +19,20 @@
 
 import { execSync } from "child_process";
 import { runCompile } from "./compile";
-import { DeployConfig } from "./deploy/config";
+import { DeployConfig, EnvName, ENV_NAMES } from "./deploy/config";
 import { CiPhase, CiPlanOptions, CiStep, ciPlan } from "./deploy/ci";
 import { loadConfig } from "./deploy/io";
 
 const PHASES: CiPhase[] = ["check", "build", "deploy"];
 
+/** Coerce a string to an `EnvName`, or undefined when unset/unrecognised. */
+function parseEnv(value: string | undefined): EnvName | undefined {
+  const v = (value ?? "").trim();
+  return (ENV_NAMES as readonly string[]).includes(v)
+    ? (v as EnvName)
+    : undefined;
+}
+
 interface Flags {
   phase: CiPhase;
   plan: boolean;
@@ -38,6 +46,7 @@ function parseFlags(argv: string[]): Flags {
     bin: process.env.RASTACK_BIN || "rastack",
     functionName: process.env.RASTACK_FUNCTION || undefined,
     jwksUrl: process.env.RASTACK_JWKS_URL || undefined,
+    env: parseEnv(process.env.RASTACK_ENV),
   };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
@@ -56,6 +65,15 @@ function parseFlags(argv: string[]): Flags {
       case "--jwks-url":
         opts.jwksUrl = next();
         break;
+      case "--env": {
+        const env = parseEnv(next());
+        if (!env) {
+          console.error(`Unknown --env: expected ${ENV_NAMES.join(" | ")}.`);
+          process.exit(1);
+        }
+        opts.env = env;
+        break;
+      }
       case "--bin":
         opts.bin = next();
         break;
@@ -75,7 +93,7 @@ function parseFlags(argv: string[]): Flags {
   }
   if (!phase) {
     console.error(
-      `Usage: rastack ci <${PHASES.join(" | ")}> [--plan] [--skip-build]\n`,
+      `Usage: rastack ci <${PHASES.join(" | ")}> [--env dev|prod] [--plan] [--skip-build]\n`,
     );
     process.exit(1);
   }

package/src/rastack-dev.ts

@@ -21,12 +21,19 @@
  * but a Rust + wasm toolchain is, it is built from source as a fallback.
  */
 
-import { execFileSync, spawn, spawnSync, type ChildProcess } from "child_process";
+import {
+  execFileSync,
+  spawn,
+  spawnSync,
+  type ChildProcess,
+} from "child_process";
 import * as fs from "fs";
 import * as http from "http";
 import * as net from "net";
 import * as path from "path";
 import { runCompile } from "./compile";
+import { cognitoRuntimeConfig } from "./deploy/config";
+import { loadConfig } from "./deploy/io";
 import {
   APP_ENTRY,
   WASM_ENTRY,
@@ -115,6 +122,37 @@ function serveFile(res: http.ServerResponse, file: string): void {
   });
 }
 
+/**
+ * Serve the dev environment's Cognito coordinates (`/__rastack/cognito.json`) so
+ * a locally-running app can sign in against the *real* dev user pool. Read from
+ * `.rastack/deploy.json`'s dev outputs; `{}` when the dev stack isn't deployed
+ * yet (the app then falls back to `mode:"local"`). Returns whether a real config
+ * was found, for the startup hint.
+ */
+function serveDevCognito(res: http.ServerResponse, cwd: string): void {
+  let body = "{}";
+  try {
+    const cfg = loadConfig(cwd);
+    const runtime = cfg ? cognitoRuntimeConfig(cfg, "dev") : null;
+    if (runtime) body = JSON.stringify(runtime);
+  } catch {
+    /* no/invalid config → empty object, app uses the local shim */
+  }
+  res
+    .writeHead(200, { "Content-Type": "application/json; charset=utf-8" })
+    .end(body);
+}
+
+/** Whether a real dev Cognito config is available to advertise on startup. */
+function hasDevCognito(cwd: string): boolean {
+  try {
+    const cfg = loadConfig(cwd);
+    return Boolean(cfg && cognitoRuntimeConfig(cfg, "dev"));
+  } catch {
+    return false;
+  }
+}
+
 /** Best-effort open the default browser at `url`. */
 function openBrowser(url: string): void {
   const cmd =
@@ -177,7 +215,9 @@ function getFreePort(): Promise<number> {
     srv.listen(0, "127.0.0.1", () => {
       const addr = srv.address();
       const port = addr && typeof addr === "object" ? addr.port : 0;
-      srv.close(() => (port ? resolve(port) : reject(new Error("no free port"))));
+      srv.close(() =>
+        port ? resolve(port) : reject(new Error("no free port")),
+      );
     });
   });
 }
@@ -241,7 +281,13 @@ function proxyToMetro(
   port: number,
 ): void {
   const proxyReq = http.request(
-    { host: "127.0.0.1", port, method: req.method, path: req.url, headers: req.headers },
+    {
+      host: "127.0.0.1",
+      port,
+      method: req.method,
+      path: req.url,
+      headers: req.headers,
+    },
     (proxyRes) => {
       res.writeHead(proxyRes.statusCode || 502, proxyRes.headers);
       proxyRes.pipe(res);
@@ -318,8 +364,13 @@ async function runMetroMode(args: DevArgs, cwd: string): Promise<void> {
       return serveUnder(res, wasmDir, url.slice("/wasm/".length));
     if (url === "/schema.rastack.json" || url === "/openapi.json")
       return serveUnder(res, args.outDir, path.basename(url));
+    if (url === "/__rastack/cognito.json") return serveDevCognito(res, cwd);
     if (url.startsWith("/data/warehouse/"))
-      return serveUnder(res, args.warehouseDir, url.slice("/data/warehouse/".length));
+      return serveUnder(
+        res,
+        args.warehouseDir,
+        url.slice("/data/warehouse/".length),
+      );
     // Everything else → the live Metro bundle (HTML, JS, assets, HMR polls).
     return proxyToMetro(req, res, metroPort);
   });
@@ -341,8 +392,7 @@ async function runMetroMode(args: DevArgs, cwd: string): Promise<void> {
   server.listen(args.port, () => {
     const url = `http://localhost:${args.port}`;
     console.log(`  ✓ Metro live on :${metroPort} — fast refresh on`);
-    if (wasmDir)
-      console.log(`  ✓ WASM engine: ${path.relative(cwd, wasmDir)}`);
+    if (wasmDir) console.log(`  ✓ WASM engine: ${path.relative(cwd, wasmDir)}`);
     console.log(`\n  ▸ ${url}\n`);
     console.log(
       "  Edits reload live. Need the database console? Run `rastack admin`. Ctrl+C to stop.\n",
@@ -393,6 +443,7 @@ async function main(argv: string[]): Promise<void> {
       return serveUnder(res, wasmDir, url.slice("/wasm/".length));
     if (url === "/schema.rastack.json" || url === "/openapi.json")
       return serveUnder(res, args.outDir, path.basename(url));
+    if (url === "/__rastack/cognito.json") return serveDevCognito(res, cwd);
     if (url.startsWith("/data/warehouse/"))
       return serveUnder(
         res,
@@ -432,6 +483,10 @@ async function main(argv: string[]): Promise<void> {
     if (appRoot)
       console.log(`  ✓ app: ${path.relative(process.cwd(), appRoot) || "."}`);
     else console.log(`  ○ no app found — serving the welcome page`);
+    if (hasDevCognito(cwd))
+      console.log(
+        `  ✓ dev Cognito: /__rastack/cognito.json (sign in against the real dev pool)`,
+      );
     console.log(`\n  ▸ ${url}\n`);
     console.log(
       "  Need the database console? Run `rastack admin`. Ctrl+C to stop.\n",