t3code-cli 0.10.0 → 0.12.0

package/src/config/environment-name/name.test.ts

@@ -0,0 +1,66 @@
+import "vite-plus/test/config";
+
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { assert, describe, it } from "@effect/vitest";
+
+import { expectFailWithMessage } from "../../effect.test-utils.ts";
+import { ConfigError } from "../error.ts";
+import {
+  defaultEnvironmentNameForLocal,
+  defaultEnvironmentNameFromUrl,
+  migrateV1EnvironmentName,
+  slugifyEnvironmentName,
+  validateEnvironmentName,
+} from "./name.ts";
+
+describe("slugifyEnvironmentName", () => {
+  it("slugifies invalid characters", () => {
+    assert.equal(slugifyEnvironmentName("app.example.com"), "app.example.com");
+    assert.equal(slugifyEnvironmentName("---"), "default");
+  });
+});
+
+describe("validateEnvironmentName", () => {
+  it.effect("rejects empty and invalid names", () =>
+    Effect.gen(function* () {
+      const empty = yield* validateEnvironmentName("").pipe(Effect.exit);
+      assert.equal(Exit.isFailure(empty), true);
+      const invalid = yield* validateEnvironmentName("bad name").pipe(Effect.exit);
+      assert.equal(Exit.isFailure(invalid), true);
+      yield* validateEnvironmentName("valid.name-1");
+    }),
+  );
+});
+
+describe("defaultEnvironmentNameFromUrl", () => {
+  it.effect("derives hostname from normalized url", () =>
+    Effect.gen(function* () {
+      const name = yield* defaultEnvironmentNameFromUrl("https://app.example.com/path");
+      assert.equal(name, "app.example.com");
+    }),
+  );
+
+  it.effect("maps invalid urls to ConfigError", () =>
+    expectFailWithMessage(defaultEnvironmentNameFromUrl("not-a-url"), ConfigError, "invalid url"),
+  );
+});
+
+describe("migrateV1EnvironmentName", () => {
+  it.effect("uses local name for local configs", () =>
+    Effect.gen(function* () {
+      const name = yield* migrateV1EnvironmentName({ local: true });
+      assert.equal(name, defaultEnvironmentNameForLocal());
+    }),
+  );
+
+  it.effect("derives name from url when present", () =>
+    Effect.gen(function* () {
+      const name = yield* migrateV1EnvironmentName({
+        url: "https://work.example",
+        local: false,
+      });
+      assert.equal(name, "work.example");
+    }),
+  );
+});

package/src/config/environment-name/name.ts

@@ -0,0 +1,49 @@
+import * as Effect from "effect/Effect";
+
+import { ConfigError } from "../error.ts";
+import { normalizeHttpBaseUrl } from "../url/url.ts";
+
+const environmentNamePattern = /^[A-Za-z0-9._-]+$/;
+
+export function slugifyEnvironmentName(value: string) {
+  const slug = value.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug.length > 0 ? slug : "default";
+}
+
+export function validateEnvironmentName(name: string) {
+  if (name.length === 0 || !environmentNamePattern.test(name)) {
+    return Effect.fail(
+      new ConfigError({
+        message: `invalid environment name '${name}': use non-empty [A-Za-z0-9._-]`,
+      }),
+    );
+  }
+  return Effect.void;
+}
+
+export function defaultEnvironmentNameFromUrl(url: string) {
+  return normalizeHttpBaseUrl(url).pipe(
+    Effect.mapError((error) => new ConfigError({ message: error.message, cause: error.cause })),
+    Effect.flatMap((normalized) => {
+      const hostname = slugifyEnvironmentName(new URL(normalized).hostname.trim());
+      return validateEnvironmentName(hostname).pipe(Effect.as(hostname));
+    }),
+  );
+}
+
+export function defaultEnvironmentNameForLocal() {
+  return "local" as const;
+}
+
+export function migrateV1EnvironmentName(input: {
+  readonly url?: string;
+  readonly local?: boolean;
+}) {
+  if (input.local === true) {
+    return Effect.succeed(defaultEnvironmentNameForLocal());
+  }
+  if (input.url !== undefined && input.url.length > 0) {
+    return defaultEnvironmentNameFromUrl(input.url);
+  }
+  return Effect.succeed("default");
+}

package/src/config/error.ts

@@ -1,21 +1,19 @@
-import * as Cause from "effect/Cause";
 import * as Schema from "effect/Schema";
 import { PlatformError } from "effect/PlatformError";
 
 const ConfigErrorCauseSchema = Schema.Union([
   Schema.instanceOf(PlatformError),
   Schema.instanceOf(Schema.SchemaError),
+  Schema.Defect(),
 ]);
 
-export class UrlError extends Schema.TaggedErrorClass<UrlError>()("UrlError", {
-  message: Schema.String,
-  protocol: Schema.optionalKey(Schema.String),
-  cause: Schema.optionalKey(Schema.instanceOf(Cause.IllegalArgumentError)),
-}) {}
-
 export class ConfigError extends Schema.TaggedErrorClass<ConfigError>()("ConfigError", {
   message: Schema.String,
   cause: Schema.optionalKey(ConfigErrorCauseSchema),
 }) {}
 
-export type ConfigServiceError = ConfigError | UrlError;
+export type ConfigServiceError = ConfigError;
+
+export function isPlatformNotFoundError(error: PlatformError) {
+  return error.reason["_tag"] === "NotFound";
+}

package/src/config/index.ts

@@ -1,5 +1,16 @@
-export { T3Config } from "./service.ts";
-export type { ResolvedConfig, StoredConfig } from "./service.ts";
-export { T3ConfigLive, makeT3Config } from "./layer.ts";
-export { ConfigError, UrlError } from "./error.ts";
-export type { ConfigServiceError } from "./error.ts";
+export * as Config from "./config.ts";
+export type {
+  EncryptedConfig,
+  EncryptedToken,
+  EnvironmentSummary,
+  ResolvedConfig,
+  UpsertEnvironmentInput,
+} from "./types.ts";
+export { ConfigError, type ConfigServiceError } from "./error.ts";
+export * as Credential from "./credential/index.ts";
+export * as Keystore from "./keystore/index.ts";
+export * as Selection from "./selection/index.ts";
+export * as Env from "./env/index.ts";
+export * as Paths from "./paths/index.ts";
+export * as Url from "./url/index.ts";
+export * as EnvironmentName from "./environment-name/index.ts";

package/src/config/keystore/error.ts

@@ -0,0 +1,9 @@
+import * as Schema from "effect/Schema";
+
+export class KeystoreUnavailableError extends Schema.TaggedErrorClass<KeystoreUnavailableError>()(
+  "KeystoreUnavailableError",
+  {
+    reason: Schema.Literals(["module-not-found", "backend-unavailable"]),
+    cause: Schema.Defect(),
+  },
+) {}

package/src/config/keystore/file.ts

@@ -0,0 +1,96 @@
+import * as Effect from "effect/Effect";
+import * as Encoding from "effect/Encoding";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+
+import { ConfigError, isPlatformNotFoundError } from "../error.ts";
+import {
+  masterKeyByteLength,
+  type MasterKeyKeystore,
+  type MasterKeyReadResult,
+} from "./service.ts";
+import { resolveKeyFilePath } from "../paths/paths.ts";
+
+const privateFileMode = 0o600;
+
+export const makeFileKeystore = Effect.fn("makeFileKeystore")(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const keyFilePath = yield* resolveKeyFilePath();
+
+  const read = (): Effect.Effect<MasterKeyReadResult, ConfigError> =>
+    Effect.gen(function* () {
+      const raw = yield* fs.readFileString(keyFilePath).pipe(
+        Effect.catchTags({
+          PlatformError: (error) =>
+            isPlatformNotFoundError(error)
+              ? Effect.succeed(undefined)
+              : Effect.fail(
+                  new ConfigError({ message: "failed to read credential key file", cause: error }),
+                ),
+        }),
+      );
+      if (raw === undefined) {
+        return { kind: "missing" };
+      }
+      const key = yield* Effect.fromResult(Encoding.decodeBase64(raw.trim())).pipe(
+        Effect.catchTags({
+          EncodingError: (error) =>
+            Effect.fail(
+              new ConfigError({
+                message: "invalid credential key file: invalid base64",
+                cause: error,
+              }),
+            ),
+        }),
+      );
+      if (key.byteLength !== masterKeyByteLength) {
+        return yield* Effect.fail(
+          new ConfigError({ message: "invalid credential key file: unexpected key length" }),
+        );
+      }
+      yield* fs.chmod(keyFilePath, privateFileMode).pipe(
+        Effect.mapError(
+          (error) =>
+            new ConfigError({
+              message: "failed to set credential key file permissions",
+              cause: error,
+            }),
+        ),
+      );
+      return { kind: "present", key };
+    });
+
+  const write = (key: Uint8Array): Effect.Effect<void, ConfigError> =>
+    Effect.gen(function* () {
+      yield* fs.makeDirectory(path.dirname(keyFilePath), { recursive: true, mode: 0o700 }).pipe(
+        Effect.catchTags({
+          PlatformError: (error) =>
+            Effect.fail(
+              new ConfigError({ message: "failed to write credential key file", cause: error }),
+            ),
+        }),
+      );
+      yield* fs
+        .writeFileString(keyFilePath, `${Encoding.encodeBase64(key)}\n`, { mode: privateFileMode })
+        .pipe(
+          Effect.catchTags({
+            PlatformError: (error) =>
+              Effect.fail(
+                new ConfigError({ message: "failed to write credential key file", cause: error }),
+              ),
+          }),
+        );
+      yield* fs.chmod(keyFilePath, privateFileMode).pipe(
+        Effect.mapError(
+          (error) =>
+            new ConfigError({
+              message: "failed to set credential key file permissions",
+              cause: error,
+            }),
+        ),
+      );
+    });
+
+  return { read, write } satisfies MasterKeyKeystore;
+});

package/src/config/keystore/index.ts

@@ -0,0 +1,4 @@
+export * as Service from "./service.ts";
+export { KeystoreUnavailableError } from "./error.ts";
+export * as KeyringNode from "./keyring-node.ts";
+export * as File from "./file.ts";

package/src/config/keystore/keyring-node.test.ts

@@ -0,0 +1,12 @@
+import "vite-plus/test/config";
+
+import { assert, describe, it } from "@effect/vitest";
+
+import { parseKeyringPassword } from "./keyring-node.ts";
+
+describe("parseKeyringPassword", () => {
+  it("treats invalid stored keyring values as corrupt", () => {
+    const result = parseKeyringPassword("not-a-valid-key");
+    assert.equal(result.kind, "corrupt");
+  });
+});

package/src/config/keystore/keyring-node.ts

@@ -0,0 +1,100 @@
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Encoding from "effect/Encoding";
+import * as Layer from "effect/Layer";
+import * as Predicate from "effect/Predicate";
+import * as Result from "effect/Result";
+
+import { KeystoreUnavailableError } from "./error.ts";
+import {
+  masterKeyByteLength,
+  T3MasterKeyKeystoreFactory,
+  type MasterKeyKeystore,
+  type MasterKeyReadResult,
+} from "./service.ts";
+
+type KeyringModule = typeof import("@napi-rs/keyring");
+
+const keyringService = "t3cli";
+const keyringAccount = "master-key";
+
+const loadKeyringModuleOnce = Effect.tryPromise(
+  () => import("@napi-rs/keyring") as Promise<KeyringModule>,
+);
+
+const loadKeyringModuleMemoized = Effect.cached(loadKeyringModuleOnce);
+
+const loadKeyringModule = Effect.flatMap(loadKeyringModuleMemoized, (load) =>
+  load.pipe(
+    Effect.mapError(
+      (error) =>
+        new KeystoreUnavailableError({
+          reason:
+            Predicate.hasProperty(error.cause, "code") &&
+            error.cause.code === "ERR_MODULE_NOT_FOUND"
+              ? "module-not-found"
+              : "backend-unavailable",
+          cause: error,
+        }),
+    ),
+  ),
+);
+
+export function parseKeyringPassword(password: string | null): MasterKeyReadResult {
+  if (password === null || password.length === 0) {
+    return { kind: "missing" };
+  }
+  return Result.match(Encoding.decodeBase64(password.trim()), {
+    onFailure: () => ({
+      kind: "corrupt" as const,
+      message: "invalid base64 key",
+    }),
+    onSuccess: (key) => {
+      if (key.byteLength !== masterKeyByteLength) {
+        return {
+          kind: "corrupt" as const,
+          message: "unexpected key length",
+        };
+      }
+      return { kind: "present" as const, key };
+    },
+  });
+}
+
+function createKeyringKeystore(keyring: KeyringModule): MasterKeyKeystore {
+  const entry = new keyring.Entry(keyringService, keyringAccount);
+  return {
+    read: () =>
+      Effect.sync(() => {
+        try {
+          return parseKeyringPassword(entry.getPassword());
+        } catch {
+          return {
+            kind: "unavailable" as const,
+            message: "failed to read credential key from OS keyring",
+          };
+        }
+      }),
+    write: (key) =>
+      Effect.try({
+        try: () => {
+          entry.setPassword(Encoding.encodeBase64(key));
+        },
+        catch: (cause) =>
+          new KeystoreUnavailableError({
+            reason: "backend-unavailable",
+            cause: new Cause.UnknownError(cause),
+          }),
+      }),
+  };
+}
+
+const make = (): T3MasterKeyKeystoreFactory["Service"] => ({
+  make: () =>
+    Effect.gen(function* () {
+      const keyring = yield* loadKeyringModule;
+      return createKeyringKeystore(keyring);
+    }),
+});
+
+export const layerNode = Layer.succeed(T3MasterKeyKeystoreFactory, make());

package/src/config/keystore/service.test-utils.ts

@@ -0,0 +1,15 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { KeystoreUnavailableError } from "./error.ts";
+import { T3MasterKeyKeystoreFactory } from "./service.ts";
+
+export const unavailableKeystoreFactoryLayer = Layer.succeed(T3MasterKeyKeystoreFactory)({
+  make: () =>
+    Effect.fail(
+      new KeystoreUnavailableError({
+        reason: "module-not-found",
+        cause: new Error("keyring unavailable in test"),
+      }),
+    ),
+});

package/src/config/keystore/service.test.ts

@@ -0,0 +1,18 @@
+import "vite-plus/test/config";
+
+import { describe, it } from "@effect/vitest";
+import { expect } from "vite-plus/test";
+
+import { shouldUseFileKeystoreForRead } from "./service.ts";
+
+describe("shouldUseFileKeystoreForRead", () => {
+  it("treats unavailable keyring reads as file-keystore fallback", () => {
+    const result = { kind: "unavailable" as const, message: "failed" };
+    expect(shouldUseFileKeystoreForRead(result)).toBe(true);
+  });
+
+  it("does not fall back for corrupt keyring reads", () => {
+    const result = { kind: "corrupt" as const, message: "invalid key" };
+    expect(shouldUseFileKeystoreForRead(result)).toBe(false);
+  });
+});

package/src/config/keystore/service.ts

@@ -0,0 +1,29 @@
+import * as Context from "effect/Context";
+import type * as Effect from "effect/Effect";
+
+import type { ConfigError } from "../error.ts";
+import type { KeystoreUnavailableError } from "./error.ts";
+
+export const masterKeyByteLength = 32;
+
+export type MasterKeyReadResult =
+  | { readonly kind: "missing" }
+  | { readonly kind: "present"; readonly key: Uint8Array }
+  | { readonly kind: "corrupt"; readonly message: string }
+  | { readonly kind: "unavailable"; readonly message: string };
+
+export type MasterKeyKeystore = {
+  readonly read: () => Effect.Effect<MasterKeyReadResult, ConfigError>;
+  readonly write: (key: Uint8Array) => Effect.Effect<void, ConfigError | KeystoreUnavailableError>;
+};
+
+export class T3MasterKeyKeystoreFactory extends Context.Service<
+  T3MasterKeyKeystoreFactory,
+  {
+    readonly make: () => Effect.Effect<MasterKeyKeystore, KeystoreUnavailableError>;
+  }
+>()("t3cli/T3MasterKeyKeystoreFactory") {}
+
+export function shouldUseFileKeystoreForRead(result: MasterKeyReadResult) {
+  return result.kind === "missing" || result.kind === "unavailable";
+}

package/src/config/layer.test-utils.ts

@@ -0,0 +1,45 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import * as Credential from "./credential/service.ts";
+import * as Config from "./config.ts";
+import * as Selection from "./selection/service.ts";
+import { CliRuntime } from "../cli/runtime/service.ts";
+import { ConfigPlatformLayer } from "./platform.test-utils.ts";
+import { t3CliEnvConfigLayer } from "./env/env.test-utils.ts";
+import * as CredentialCipherWeb from "./credential/cipher-web.ts";
+import * as Keystore from "./keystore/service.test-utils.ts";
+
+export type T3ConfigLayerTestInput = {
+  readonly selection?: string;
+  readonly env?: Readonly<Record<string, string | undefined>>;
+  readonly useSelectionLive?: boolean;
+};
+
+export function t3ConfigDepsLayer(homeDir: string, input: T3ConfigLayerTestInput = {}) {
+  const cliRuntimeLayer = CliRuntime.layerTest({ cwd: homeDir });
+  const configLayer = t3CliEnvConfigLayer(homeDir, input.env ?? {});
+  const platformEnvLayer = Layer.mergeAll(cliRuntimeLayer, configLayer);
+  const selectionLayer =
+    input.useSelectionLive === true
+      ? Selection.layer.pipe(Layer.provide(platformEnvLayer))
+      : Layer.succeed(Selection.T3ConfigSelection)({
+          getSelectedEnvironment: () => Effect.succeed(input.selection),
+        });
+
+  return Config.layer.pipe(
+    Layer.provide(Credential.layer),
+    Layer.provide(
+      Layer.mergeAll(
+        platformEnvLayer,
+        selectionLayer,
+        CredentialCipherWeb.layerWeb,
+        Keystore.unavailableKeystoreFactoryLayer,
+      ),
+    ),
+  );
+}
+
+export function t3ConfigLayerTest(homeDir: string, input: T3ConfigLayerTestInput = {}) {
+  return Layer.mergeAll(ConfigPlatformLayer, t3ConfigDepsLayer(homeDir, input));
+}