specweave 0.21.2 → 0.21.3

package/plugins/specweave/iac-templates/supabase/environments/prod.defaults.json

@@ -0,0 +1,75 @@
+{
+  "environment": "prod",
+  "region": "us-east-1",
+  "plan": "pro",
+  "selfHosted": false,
+  "database": {
+    "maxConnections": 200,
+    "extensions": ["uuid-ossp", "pgcrypto"],
+    "pointInTimeRecovery": true,
+    "backupRetention": 30
+  },
+  "auth": {
+    "providers": ["email", "google", "github"],
+    "emailConfirmRequired": true,
+    "passwordMinLength": 12,
+    "jwtExpiry": 3600,
+    "enableSignup": true,
+    "doubleConfirmChanges": true,
+    "customSmtp": true,
+    "mfaEnabled": true
+  },
+  "storage": {
+    "publicBucket": {
+      "fileSizeLimit": 10485760,
+      "allowedMimeTypes": ["image/jpeg", "image/png", "image/webp", "application/pdf"]
+    },
+    "privateBucket": {
+      "fileSizeLimit": 10485760,
+      "allowedMimeTypes": ["image/jpeg", "image/png", "application/pdf", "application/json"]
+    }
+  },
+  "api": {
+    "maxRows": 1000,
+    "rateLimit": true
+  },
+  "rls": {
+    "strictMode": true,
+    "defaultDeny": true,
+    "auditLogging": true
+  },
+  "network": {
+    "ipWhitelist": [],
+    "corsOrigins": ["https://*.example.com"]
+  },
+  "security": {
+    "networkRestrictions": true,
+    "auditLog": true,
+    "soc2Compliant": true
+  },
+  "costOptimization": {
+    "description": "Production-ready - Pro plan with optimal settings",
+    "estimatedMonthlyCost": "$45-100",
+    "freeTierEligible": false,
+    "plan": "Pro",
+    "included": {
+      "database": "8 GB",
+      "storage": "100 GB",
+      "edgeFunctions": "2M invocations/month",
+      "bandwidth": "50 GB",
+      "realtime": "500 concurrent connections",
+      "backups": "Daily (30-day retention)",
+      "support": "Priority email support"
+    },
+    "notes": [
+      "Pro plan required for production ($25/month base)",
+      "Point-in-time recovery enabled",
+      "Email confirmation required",
+      "Strict RLS policies (default deny)",
+      "MFA recommended",
+      "Custom SMTP for transactional emails",
+      "Network restrictions for security",
+      "Audit logging enabled"
+    ]
+  }
+}

package/plugins/specweave/iac-templates/supabase/environments/staging.defaults.json

@@ -0,0 +1,54 @@
+{
+  "environment": "staging",
+  "region": "us-east-1",
+  "plan": "free",
+  "selfHosted": false,
+  "database": {
+    "maxConnections": 100,
+    "extensions": ["uuid-ossp", "pgcrypto"]
+  },
+  "auth": {
+    "providers": ["email", "google"],
+    "emailConfirmRequired": false,
+    "passwordMinLength": 10,
+    "jwtExpiry": 7200,
+    "enableSignup": true,
+    "doubleConfirmChanges": false
+  },
+  "storage": {
+    "publicBucket": {
+      "fileSizeLimit": 20971520,
+      "allowedMimeTypes": ["image/*", "application/pdf"]
+    },
+    "privateBucket": {
+      "fileSizeLimit": 20971520,
+      "allowedMimeTypes": ["image/*", "application/pdf", "application/json"]
+    }
+  },
+  "api": {
+    "maxRows": 10000
+  },
+  "rls": {
+    "strictMode": true,
+    "defaultDeny": false
+  },
+  "costOptimization": {
+    "description": "Free or Pro tier - Upgrade if exceeding limits",
+    "estimatedMonthlyCost": "$0-32",
+    "freeTierEligible": true,
+    "plan": "Free (upgrade to Pro if needed)",
+    "limits": {
+      "database": "500 MB (8 GB on Pro)",
+      "storage": "1 GB (100 GB on Pro)",
+      "edgeFunctions": "500K invocations/month (2M on Pro)",
+      "bandwidth": "2 GB (50 GB on Pro)",
+      "realtime": "200 concurrent (500 on Pro)"
+    },
+    "notes": [
+      "Start with Free tier",
+      "Upgrade to Pro if needed ($25/month base)",
+      "Stricter RLS policies",
+      "OAuth providers enabled"
+    ]
+  }
+}

package/plugins/specweave/iac-templates/supabase/iam.tf.hbs

@@ -0,0 +1,146 @@
+# IAM and Security Configuration for Supabase
+# Project: {{projectName}}
+
+{{#unless selfHosted}}
+###############################
+# Row Level Security (RLS) Policies
+###############################
+
+# RLS policies are defined in the migration SQL (main.tf)
+# This file contains additional security configurations
+
+###############################
+# API Key Management
+###############################
+
+# Anonymous key (public) - For client-side access
+# Generated automatically by Supabase
+
+# Service role key (private) - For server-side access
+# Generated automatically by Supabase
+
+# Custom API keys can be created via Supabase Dashboard
+
+###############################
+# Database Roles
+###############################
+
+# Default roles created by Supabase:
+# - postgres: Superuser
+# - authenticator: Used by PostgREST
+# - authenticated: For logged-in users
+# - anon: For anonymous users
+# - service_role: For backend services
+
+# Additional custom roles can be created via migrations
+
+resource "supabase_migration" "custom_roles" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+  version     = "20240101000001"
+  name        = "custom_roles"
+
+  statements = [
+    <<-SQL
+      -- Create custom role for read-only access
+      DO $$
+      BEGIN
+        IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'readonly') THEN
+          CREATE ROLE readonly;
+        END IF;
+      END
+      $$;
+
+      GRANT USAGE ON SCHEMA public TO readonly;
+      GRANT SELECT ON ALL TABLES IN SCHEMA public TO readonly;
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO readonly;
+
+      {{#if (eq environment "prod")}}
+      -- Production: Create audit role
+      DO $$
+      BEGIN
+        IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'auditor') THEN
+          CREATE ROLE auditor;
+        END IF;
+      END
+      $$;
+
+      GRANT USAGE ON SCHEMA public TO auditor;
+      GRANT SELECT ON ALL TABLES IN SCHEMA public TO auditor;
+      {{/if}}
+    SQL
+  ]
+}
+
+###############################
+# Storage Security
+###############################
+
+# Storage policies are defined in main.tf
+# Additional security configurations:
+
+{{#if (eq environment "prod")}}
+# Production: Enable strict CORS
+resource "supabase_settings" "{{snakeCase projectName}}_storage" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+
+  storage = {
+    cors_allowed_origins = ["https://{{projectName}}.com"]
+  }
+}
+{{/if}}
+
+###############################
+# Network Security
+###############################
+
+{{#if (eq environment "prod")}}
+# Production: Configure network restrictions
+resource "supabase_network_restrictions" "{{snakeCase projectName}}" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+
+  # Restrict database access to specific IP ranges
+  # Example: Only allow from your backend servers
+  # allowed_cidrs = ["10.0.0.0/8", "172.16.0.0/12"]
+
+  # Enable IPv6 restrictions
+  apply_to_ipv6 = true
+}
+{{/if}}
+
+{{else}}
+###############################
+# Self-Hosted Security Configuration
+###############################
+
+# For self-hosted deployments:
+# 1. Configure Kong API Gateway security
+# 2. Set up SSL/TLS certificates
+# 3. Configure firewall rules
+# 4. Set strong database passwords
+# 5. Restrict network access
+
+# Example: Docker network isolation is handled in main.tf
+{{/unless}}
+
+###############################
+# Authentication Security
+###############################
+
+# Auth settings are configured in main.tf
+# Additional recommendations:
+
+# {{#if (eq environment "prod")}}
+# Production checklist:
+# - Enable email confirmation
+# - Set strong password requirements (12+ chars)
+# - Enable double confirmation for email changes
+# - Configure rate limiting
+# - Enable MFA (configure in Supabase Dashboard)
+# - Set up custom SMTP for transactional emails
+# - Configure OAuth providers with proper scopes
+# {{else}}
+# Development notes:
+# - Email confirmation disabled for easier testing
+# - Weaker password requirements (8+ chars)
+# - No rate limiting
+# {{/if}}

package/plugins/specweave/iac-templates/supabase/main.tf.hbs

@@ -0,0 +1,310 @@
+# Supabase with PostgreSQL, Auth, Storage, and Edge Functions
+# Generated by SpecWeave Serverless Intelligence
+# Platform: Supabase
+# Project: {{projectName}}
+# Environment: {{environment}}
+
+terraform {
+  required_version = ">= 1.0"
+  required_providers {
+    supabase = {
+      source  = "supabase/supabase"
+      version = "~> 1.0"
+    }
+    {{#if selfHosted}}
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "~> 3.0"
+    }
+    {{/if}}
+  }
+}
+
+{{#unless selfHosted}}
+###############################
+# Supabase Cloud Project
+###############################
+
+resource "supabase_project" "{{snakeCase projectName}}" {
+  organization_id   = var.organization_id
+  name              = "{{projectName}}-{{environment}}"
+  database_password = var.database_password
+  region            = var.region
+
+  {{#if (eq environment "prod")}}
+  # Production settings
+  plan = "pro"
+  {{else}}
+  # Development/Staging settings
+  plan = "free"
+  {{/if}}
+}
+
+###############################
+# Database Configuration
+###############################
+
+# Database URL is automatically generated by Supabase
+# Access via: supabase_project.{{snakeCase projectName}}.database.host
+
+# Enable required extensions
+resource "supabase_settings" "{{snakeCase projectName}}_db" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+
+  database = {
+    extensions = [
+      "uuid-ossp",
+      "pgcrypto",
+      {{#if enablePostgis}}"postgis",{{/if}}
+      {{#if enableVectors}}"vector",{{/if}}
+    ]
+  }
+}
+
+{{#if databaseName}}
+# SQL Migration for initial schema
+resource "supabase_migration" "{{snakeCase databaseName}}_schema" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+  version     = "20240101000000"
+  name        = "initial_schema"
+
+  statements = [
+    <<-SQL
+      -- Create items table
+      CREATE TABLE IF NOT EXISTS items (
+        id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+        user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE,
+        title TEXT NOT NULL,
+        description TEXT,
+        status TEXT DEFAULT 'active',
+        created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
+
+      -- Enable Row Level Security
+      ALTER TABLE items ENABLE ROW LEVEL SECURITY;
+
+      -- Create RLS policies
+      CREATE POLICY "Users can view their own items"
+        ON items FOR SELECT
+        USING (auth.uid() = user_id);
+
+      CREATE POLICY "Users can insert their own items"
+        ON items FOR INSERT
+        WITH CHECK (auth.uid() = user_id);
+
+      CREATE POLICY "Users can update their own items"
+        ON items FOR UPDATE
+        USING (auth.uid() = user_id);
+
+      CREATE POLICY "Users can delete their own items"
+        ON items FOR DELETE
+        USING (auth.uid() = user_id);
+
+      -- Create indexes
+      CREATE INDEX IF NOT EXISTS items_user_id_idx ON items(user_id);
+      CREATE INDEX IF NOT EXISTS items_status_idx ON items(status);
+      CREATE INDEX IF NOT EXISTS items_created_at_idx ON items(created_at DESC);
+
+      -- Create updated_at trigger
+      CREATE OR REPLACE FUNCTION update_updated_at_column()
+      RETURNS TRIGGER AS $$
+      BEGIN
+        NEW.updated_at = NOW();
+        RETURN NEW;
+      END;
+      $$ language 'plpgsql';
+
+      CREATE TRIGGER update_items_updated_at
+        BEFORE UPDATE ON items
+        FOR EACH ROW
+        EXECUTE FUNCTION update_updated_at_column();
+    SQL
+  ]
+}
+{{/if}}
+
+###############################
+# Authentication Configuration
+###############################
+
+resource "supabase_settings" "{{snakeCase projectName}}_auth" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+
+  auth = {
+    site_url = {{#if (eq environment "prod")}}"https://{{projectName}}.com"{{else}}"http://localhost:3000"{{/if}}
+
+    external_email_enabled     = true
+    external_phone_enabled     = false
+    email_confirm_required     = {{#if (eq environment "prod")}}true{{else}}false{{/if}}
+    enable_signup              = true
+    double_confirm_changes_enabled = {{#if (eq environment "prod")}}true{{else}}false{{/if}}
+
+    # JWT settings
+    jwt_expiry = {{#if (eq environment "prod")}}3600{{else}}86400{{/if}}
+
+    # Password settings
+    password_min_length = {{#if (eq environment "prod")}}12{{else}}8{{/if}}
+
+    {{#if enableOAuth}}
+    # OAuth providers (configure secrets separately)
+    external_google_enabled = true
+    external_github_enabled = true
+    {{/if}}
+  }
+}
+
+###############################
+# Storage Buckets
+###############################
+
+resource "supabase_bucket" "{{snakeCase projectName}}_public" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+  name        = "public"
+  public      = true
+  file_size_limit = {{#if (eq environment "prod")}}10485760{{else}}52428800{{/if}} # {{#if (eq environment "prod")}}10MB{{else}}50MB{{/if}}
+  allowed_mime_types = [
+    "image/jpeg",
+    "image/png",
+    "image/gif",
+    "image/webp",
+    "application/pdf"
+  ]
+}
+
+resource "supabase_bucket" "{{snakeCase projectName}}_private" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+  name        = "private"
+  public      = false
+  file_size_limit = {{#if (eq environment "prod")}}10485760{{else}}52428800{{/if}}
+  allowed_mime_types = [
+    "image/jpeg",
+    "image/png",
+    "application/pdf",
+    "application/json"
+  ]
+}
+
+# Storage policies
+resource "supabase_storage_policy" "{{snakeCase projectName}}_private_read" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+  bucket_name = supabase_bucket.{{snakeCase projectName}}_private.name
+  name        = "Users can read their own files"
+  operation   = "SELECT"
+  definition  = "(bucket_id = 'private' AND auth.uid()::text = (storage.foldername(name))[1])"
+}
+
+resource "supabase_storage_policy" "{{snakeCase projectName}}_private_write" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+  bucket_name = supabase_bucket.{{snakeCase projectName}}_private.name
+  name        = "Users can upload to their own folder"
+  operation   = "INSERT"
+  definition  = "(bucket_id = 'private' AND auth.uid()::text = (storage.foldername(name))[1])"
+}
+
+###############################
+# Edge Functions (Deno)
+###############################
+
+# Edge Functions are deployed via Supabase CLI
+# supabase functions deploy {{functionName}}
+
+# Example function configuration
+resource "supabase_function" "{{snakeCase functionName}}" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+  name        = "{{functionName}}"
+  verify_jwt  = true
+
+  # Deploy source code via CLI
+  # Source: supabase/functions/{{functionName}}/index.ts
+}
+
+###############################
+# API Configuration
+###############################
+
+resource "supabase_settings" "{{snakeCase projectName}}_api" {
+  project_ref = supabase_project.{{snakeCase projectName}}.id
+
+  api = {
+    max_rows = {{#if (eq environment "prod")}}1000{{else}}100000{{/if}}
+    extra_search_path = "public,extensions"
+  }
+}
+
+{{else}}
+###############################
+# Self-Hosted Supabase (Docker)
+###############################
+
+# Docker network
+resource "docker_network" "supabase" {
+  name = "supabase-{{environment}}"
+}
+
+# PostgreSQL
+resource "docker_container" "postgres" {
+  name  = "supabase-db-{{environment}}"
+  image = "supabase/postgres:15.1.0.117"
+
+  networks_advanced {
+    name = docker_network.supabase.name
+  }
+
+  ports {
+    internal = 5432
+    external = {{#if (eq environment "prod")}}5432{{else}}54322{{/if}}
+  }
+
+  env = [
+    "POSTGRES_PASSWORD=${var.database_password}",
+    "POSTGRES_DB=postgres",
+  ]
+
+  volumes {
+    container_path = "/var/lib/postgresql/data"
+    host_path      = "${var.data_path}/db"
+  }
+
+  restart = "unless-stopped"
+}
+
+# Supabase Studio (Admin UI)
+resource "docker_container" "studio" {
+  name  = "supabase-studio-{{environment}}"
+  image = "supabase/studio:latest"
+
+  networks_advanced {
+    name = docker_network.supabase.name
+  }
+
+  ports {
+    internal = 3000
+    external = {{#if (eq environment "prod")}}3000{{else}}54323{{/if}}
+  }
+
+  env = [
+    "SUPABASE_URL=http://kong:8000",
+    "STUDIO_PG_META_URL=http://meta:8080",
+  ]
+
+  restart = "unless-stopped"
+}
+
+# Kong API Gateway
+resource "docker_container" "kong" {
+  name  = "supabase-kong-{{environment}}"
+  image = "supabase/kong:latest"
+
+  networks_advanced {
+    name = docker_network.supabase.name
+  }
+
+  ports {
+    internal = 8000
+    external = {{#if (eq environment "prod")}}8000{{else}}54321{{/if}}
+  }
+
+  restart = "unless-stopped"
+}
+{{/unless}}

package/plugins/specweave/iac-templates/supabase/outputs.tf.hbs

@@ -0,0 +1,74 @@
+# Terraform Outputs for Supabase
+# Project: {{projectName}}
+
+{{#unless selfHosted}}
+output "project_id" {
+  description = "Supabase project ID"
+  value       = supabase_project.{{snakeCase projectName}}.id
+}
+
+output "project_ref" {
+  description = "Supabase project reference"
+  value       = supabase_project.{{snakeCase projectName}}.id
+}
+
+output "api_url" {
+  description = "Supabase API URL"
+  value       = "https://${supabase_project.{{snakeCase projectName}}.id}.supabase.co"
+}
+
+output "anon_key" {
+  description = "Supabase anonymous (public) key"
+  value       = supabase_project.{{snakeCase projectName}}.anon_key
+  sensitive   = true
+}
+
+output "service_role_key" {
+  description = "Supabase service role (private) key"
+  value       = supabase_project.{{snakeCase projectName}}.service_role_key
+  sensitive   = true
+}
+
+output "database_url" {
+  description = "PostgreSQL database URL"
+  value       = "postgresql://postgres:${var.database_password}@db.${supabase_project.{{snakeCase projectName}}.id}.supabase.co:5432/postgres"
+  sensitive   = true
+}
+
+output "database_host" {
+  description = "PostgreSQL database host"
+  value       = "db.${supabase_project.{{snakeCase projectName}}.id}.supabase.co"
+}
+
+output "studio_url" {
+  description = "Supabase Studio URL"
+  value       = "https://app.supabase.com/project/${supabase_project.{{snakeCase projectName}}.id}"
+}
+
+output "public_bucket_url" {
+  description = "Public storage bucket URL"
+  value       = "https://${supabase_project.{{snakeCase projectName}}.id}.supabase.co/storage/v1/object/public/public"
+}
+
+{{else}}
+output "api_url" {
+  description = "Self-hosted Supabase API URL"
+  value       = "http://localhost:{{#if (eq environment "prod")}}8000{{else}}54321{{/if}}"
+}
+
+output "studio_url" {
+  description = "Self-hosted Supabase Studio URL"
+  value       = "http://localhost:{{#if (eq environment "prod")}}3000{{else}}54323{{/if}}"
+}
+
+output "database_url" {
+  description = "PostgreSQL database URL"
+  value       = "postgresql://postgres:${var.database_password}@localhost:{{#if (eq environment "prod")}}5432{{else}}54322{{/if}}/postgres"
+  sensitive   = true
+}
+
+output "database_port" {
+  description = "PostgreSQL database port"
+  value       = {{#if (eq environment "prod")}}5432{{else}}54322{{/if}}
+}
+{{/unless}}

package/plugins/specweave/iac-templates/supabase/provider.tf.hbs

@@ -0,0 +1,19 @@
+# Supabase Provider Configuration
+# Project: {{projectName}}
+
+{{#unless selfHosted}}
+provider "supabase" {
+  access_token = var.supabase_access_token
+  # Get token from: https://app.supabase.com/account/tokens
+}
+
+variable "supabase_access_token" {
+  description = "Supabase personal access token"
+  type        = string
+  sensitive   = true
+}
+{{else}}
+provider "docker" {
+  host = "unix:///var/run/docker.sock"
+}
+{{/unless}}