spaps 0.8.1 → 0.9.0

package/assets/local-runtime/docker-compose.yml

@@ -7,10 +7,10 @@ services:
         SPAPS_SERVER_QUICKSTART_VERSION: ${SPAPS_SERVER_QUICKSTART_VERSION:-0.5.1}
     restart: unless-stopped
     ports:
-      - "${SPAPS_LOCAL_PORT:-3301}:8000"
+      - "127.0.0.1:${SPAPS_LOCAL_PORT:-3301}:8000"
     environment:
       ENV: dev
-      DATABASE_URL: postgresql+asyncpg://postgres:postgres@spaps-dev-db:5432/spaps
+      DATABASE_URL: postgresql+asyncpg://postgres:${SPAPS_LOCAL_POSTGRES_PASSWORD:?Set SPAPS_LOCAL_POSTGRES_PASSWORD}@spaps-dev-db:5432/spaps
       REDIS_URL: redis://spaps-dev-redis:6379/0
       SPAPS_LOCAL_MODE: "${SPAPS_LOCAL_MODE:-true}"
       JWT_SECRET: "${JWT_SECRET:-spaps_local_dev_jwt_secret}"
@@ -40,7 +40,7 @@ services:
     restart: unless-stopped
     environment:
       POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
+      POSTGRES_PASSWORD: ${SPAPS_LOCAL_POSTGRES_PASSWORD:?Set SPAPS_LOCAL_POSTGRES_PASSWORD}
       POSTGRES_DB: spaps
     volumes:
       - spaps-dev-pgdata:/var/lib/postgresql/data

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spaps",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Sweet Potato Authentication & Payment Service CLI - Docker Compose orchestrator for local Python/FastAPI SPAPS server with built-in admin middleware",
   "main": "src/index.js",
   "bin": {

package/src/local-server.js

@@ -12,6 +12,7 @@ const axios = require('axios');
 const os = require('os');
 const path = require('path');
 const fs = require('fs');
+const crypto = require('crypto');
 
 const PACKAGE_ROOT = path.resolve(__dirname, '..');
 const BUNDLED_RUNTIME_ROOT = path.join(PACKAGE_ROOT, 'assets', 'local-runtime');
@@ -127,11 +128,42 @@ function ensureBundledRuntime(runtimeDir) {
   }
 }
 
-function buildComposeEnv({ port, authBaseUrl }) {
+function readOrCreateRuntimeSecret(runtimeDir, envName, fileName) {
+  const envValue = process.env[envName];
+  if (envValue) {
+    return envValue;
+  }
+
+  const secretPath = path.join(runtimeDir, fileName);
+  if (fs.existsSync(secretPath)) {
+    const existing = fs.readFileSync(secretPath, 'utf8').trim();
+    if (existing) {
+      return existing;
+    }
+  }
+
+  fs.mkdirSync(runtimeDir, { recursive: true });
+  const generated = crypto.randomBytes(32).toString('hex');
+  fs.writeFileSync(secretPath, `${generated}\n`, { mode: 0o600 });
+  fs.chmodSync(secretPath, 0o600);
+  return generated;
+}
+
+function buildComposeEnv({ port, authBaseUrl, runtimeDir = null, runtimeMode = 'repo' }) {
   const manifest = readBundledRuntimeManifest();
   const portableRuntime = manifest.portable_runtime || {};
-  return {
+  const composeEnv = {
     ...process.env,
+  };
+  if (runtimeMode === 'bundle' && runtimeDir) {
+    composeEnv.SPAPS_LOCAL_POSTGRES_PASSWORD = readOrCreateRuntimeSecret(
+      runtimeDir,
+      'SPAPS_LOCAL_POSTGRES_PASSWORD',
+      '.spaps-local-postgres-password'
+    );
+  }
+  return {
+    ...composeEnv,
     SPAPS_LOCAL_PORT: String(port),
     SPAPS_LOCAL_MODE: String(process.env.SPAPS_LOCAL_MODE ?? portableRuntime.default_local_mode ?? true),
     SPAPS_AUTH_BASE_URL:
@@ -177,7 +209,7 @@ function resolveLocalRuntime({
       runtimeDir: repoRoot,
       cwd: repoRoot,
       composeFile: path.join(repoRoot, 'docker-compose.spaps-dev.yml'),
-      composeEnv: buildComposeEnv({ port, authBaseUrl }),
+      composeEnv: buildComposeEnv({ port, authBaseUrl, runtimeDir: repoRoot, runtimeMode: 'repo' }),
       projectName: path.basename(repoRoot),
     };
   }
@@ -192,7 +224,12 @@ function resolveLocalRuntime({
     runtimeDir: resolvedRuntimeDir,
     cwd: resolvedRuntimeDir,
     composeFile: path.join(resolvedRuntimeDir, 'docker-compose.yml'),
-    composeEnv: buildComposeEnv({ port, authBaseUrl }),
+    composeEnv: buildComposeEnv({
+      port,
+      authBaseUrl,
+      runtimeDir: resolvedRuntimeDir,
+      runtimeMode: 'bundle',
+    }),
     projectName: `spaps-local-${port}`,
   };
 }