thinkwork-cli 0.12.11 → 0.12.15

package/dist/plugins/twenty/terraform/twenty/outputs.tf

@@ -0,0 +1,79 @@
+output "twenty_url" {
+  description = "Public Twenty CRM URL"
+  value       = var.public_url
+}
+
+output "twenty_alb_dns_name" {
+  description = "Public ALB DNS name for Twenty"
+  value       = aws_lb.twenty.dns_name
+}
+
+output "twenty_alb_arn" {
+  description = "Public ALB ARN for Twenty"
+  value       = aws_lb.twenty.arn
+}
+
+output "twenty_target_group_arn" {
+  description = "Target group ARN for the Twenty server"
+  value       = aws_lb_target_group.twenty.arn
+}
+
+output "twenty_cluster_arn" {
+  description = "ECS cluster ARN for Twenty"
+  value       = aws_ecs_cluster.main.arn
+}
+
+output "twenty_server_service_name" {
+  description = "ECS service name for the Twenty server"
+  value       = aws_ecs_service.server.name
+}
+
+output "twenty_worker_service_name" {
+  description = "ECS service name for the Twenty worker"
+  value       = aws_ecs_service.worker.name
+}
+
+output "twenty_server_log_group_name" {
+  description = "CloudWatch log group for the Twenty server"
+  value       = aws_cloudwatch_log_group.server.name
+}
+
+output "twenty_worker_log_group_name" {
+  description = "CloudWatch log group for the Twenty worker"
+  value       = aws_cloudwatch_log_group.worker.name
+}
+
+output "twenty_security_group_id" {
+  description = "Security group ID for the Twenty ECS tasks"
+  value       = aws_security_group.twenty.id
+}
+
+output "twenty_storage_file_system_id" {
+  description = "EFS file system ID backing Twenty local storage"
+  value       = aws_efs_file_system.twenty.id
+}
+
+output "twenty_cache_replication_group_id" {
+  description = "ElastiCache replication group ID for Twenty"
+  value       = aws_elasticache_replication_group.twenty.id
+}
+
+output "twenty_cache_endpoint" {
+  description = "ElastiCache primary endpoint for Twenty"
+  value       = aws_elasticache_replication_group.twenty.primary_endpoint_address
+}
+
+output "twenty_runtime_enabled" {
+  description = "Whether the Twenty server and worker are configured to run"
+  value       = var.runtime_enabled
+}
+
+output "twenty_db_url_secret_arn" {
+  description = "Secrets Manager ARN used for the Twenty PG_DATABASE_URL"
+  value       = local.effective_db_url_secret_arn
+}
+
+output "twenty_encryption_key_secret_arn" {
+  description = "Secrets Manager ARN used for the Twenty ENCRYPTION_KEY"
+  value       = local.effective_encryption_key_secret_arn
+}

package/dist/plugins/twenty/terraform/twenty/variables.tf

@@ -0,0 +1,268 @@
+variable "stage" {
+  description = "Deployment stage (e.g. dev, prod)"
+  type        = string
+}
+
+variable "vpc_id" {
+  description = "VPC ID for Twenty CRM networking"
+  type        = string
+}
+
+variable "subnet_ids" {
+  description = "Public subnet IDs for the Twenty ECS tasks and public ALB. Public subnets provide outbound egress in phase 1."
+  type        = list(string)
+
+  validation {
+    condition     = length(var.subnet_ids) > 0
+    error_message = "subnet_ids must include at least one public subnet for the Twenty ALB and ECS tasks."
+  }
+}
+
+variable "cache_subnet_ids" {
+  description = "Private subnet IDs for the ElastiCache subnet group. Leave empty to reuse subnet_ids in isolated test fixtures only."
+  type        = list(string)
+  default     = []
+}
+
+variable "storage_subnet_ids" {
+  description = "Subnet IDs for EFS mount targets. Leave empty to reuse subnet_ids."
+  type        = list(string)
+  default     = []
+}
+
+variable "db_security_group_id" {
+  description = "Security group ID for the shared PostgreSQL database instance"
+  type        = string
+}
+
+variable "db_port" {
+  description = "PostgreSQL port for Twenty's dedicated database"
+  type        = number
+  default     = 5432
+}
+
+variable "public_url" {
+  description = "Public HTTPS URL for Twenty, for example https://crm.example.com"
+  type        = string
+
+  validation {
+    condition     = can(regex("^https://[^/]+$", var.public_url))
+    error_message = "public_url must be an HTTPS origin without a path, for example https://crm.example.com."
+  }
+}
+
+variable "certificate_arn" {
+  description = "ACM certificate ARN used by the public HTTPS ALB listener"
+  type        = string
+
+  validation {
+    condition     = can(regex("^arn:aws(-[a-z]+)?:acm:[^:]+:[0-9]{12}:certificate/.+", var.certificate_arn))
+    error_message = "certificate_arn must be an ACM certificate ARN."
+  }
+}
+
+variable "image_uri" {
+  description = "Twenty CRM container image URI pinned to a reviewed immutable digest."
+  type        = string
+
+  validation {
+    condition     = can(regex("@sha256:[0-9a-f]{64}$", var.image_uri))
+    error_message = "image_uri must be pinned to an immutable sha256 image digest."
+  }
+}
+
+variable "runtime_enabled" {
+  description = "Whether the Twenty server and worker should run. Set false to park runtime while retaining data resources."
+  type        = bool
+  default     = true
+}
+
+variable "server_desired_count" {
+  description = "Desired Twenty server task count when runtime_enabled is true"
+  type        = number
+  default     = 1
+}
+
+variable "worker_desired_count" {
+  description = "Desired Twenty worker task count when runtime_enabled is true"
+  type        = number
+  default     = 1
+}
+
+variable "cpu" {
+  description = "Fargate task CPU units for each Twenty task"
+  type        = number
+  default     = 1024
+}
+
+variable "memory" {
+  description = "Fargate task memory in MB for each Twenty task"
+  type        = number
+  default     = 2048
+}
+
+variable "cpu_architecture" {
+  description = "Fargate CPU architecture for Twenty tasks"
+  type        = string
+  default     = "X86_64"
+
+  validation {
+    condition     = contains(["X86_64", "ARM64"], var.cpu_architecture)
+    error_message = "cpu_architecture must be X86_64 or ARM64."
+  }
+}
+
+variable "container_port" {
+  description = "Twenty server container port"
+  type        = number
+  default     = 3000
+}
+
+variable "health_check_path" {
+  description = "HTTP path used by ALB and container health checks"
+  type        = string
+  default     = "/healthz"
+}
+
+variable "health_check_grace_period_seconds" {
+  description = "Seconds ECS ignores failing load balancer health checks while Twenty starts"
+  type        = number
+  default     = 300
+}
+
+variable "wait_for_steady_state" {
+  description = "Whether Terraform waits for the Twenty ECS services to reach steady state"
+  type        = bool
+  default     = true
+}
+
+variable "log_retention_days" {
+  description = "CloudWatch log retention for Twenty services"
+  type        = number
+  default     = 14
+}
+
+variable "db_url_secret_arn" {
+  description = "Secrets Manager ARN containing a JSON PG_DATABASE_URL field for Twenty's dedicated database."
+  type        = string
+  default     = ""
+}
+
+variable "encryption_key_secret_arn" {
+  description = "Secrets Manager ARN containing a JSON ENCRYPTION_KEY field for Twenty."
+  type        = string
+  default     = ""
+}
+
+variable "fallback_encryption_key_secret_arn" {
+  description = "Optional Secrets Manager ARN containing a JSON FALLBACK_ENCRYPTION_KEY field during key rotation."
+  type        = string
+  default     = ""
+}
+
+variable "app_secret_arn" {
+  description = "Optional Secrets Manager ARN containing a JSON APP_SECRET field for legacy Twenty compatibility."
+  type        = string
+  default     = ""
+}
+
+variable "create_secret_placeholders" {
+  description = "Create operator-owned Secrets Manager placeholder containers for missing Twenty secrets. Secret values are placeholders and ignored after creation so rotation survives Terraform applies."
+  type        = bool
+  default     = false
+}
+
+variable "kms_key_arns" {
+  description = "Optional KMS key ARNs needed to decrypt injected secrets"
+  type        = list(string)
+  default     = []
+}
+
+variable "email_from_address" {
+  description = "Verified SES sender address for Twenty app emails. Leave empty to skip SMTP configuration."
+  type        = string
+  default     = ""
+}
+
+variable "email_from_name" {
+  description = "Display name for Twenty app email From headers."
+  type        = string
+  default     = "ThinkWork CRM"
+}
+
+variable "email_smtp_host" {
+  description = "SES SMTP host for Twenty app emails. Leave empty to use email-smtp.<region>.amazonaws.com."
+  type        = string
+  default     = ""
+}
+
+variable "email_smtp_port" {
+  description = "SES SMTP port for Twenty app emails."
+  type        = number
+  default     = 587
+}
+
+variable "email_smtp_no_tls" {
+  description = "Set true to disable TLS for Twenty SMTP. SES should use TLS."
+  type        = bool
+  default     = false
+}
+
+variable "cache_engine" {
+  description = "ElastiCache engine. Prefer valkey; redis is available as a compatibility fallback."
+  type        = string
+  default     = "valkey"
+
+  validation {
+    condition     = contains(["valkey", "redis"], var.cache_engine)
+    error_message = "cache_engine must be valkey or redis."
+  }
+}
+
+variable "cache_engine_version" {
+  description = "ElastiCache engine version for the selected cache engine"
+  type        = string
+  default     = "8.0"
+}
+
+variable "cache_parameter_group_family" {
+  description = "ElastiCache parameter group family matching cache_engine/cache_engine_version"
+  type        = string
+  default     = "valkey8"
+}
+
+variable "cache_node_type" {
+  description = "ElastiCache node type for the Twenty queue/cache"
+  type        = string
+  default     = "cache.t4g.micro"
+}
+
+variable "cache_port" {
+  description = "ElastiCache Redis-compatible port"
+  type        = number
+  default     = 6379
+}
+
+variable "cache_num_cache_clusters" {
+  description = "Number of cache nodes in the replication group. Use 1 for the smallest v1 deployment."
+  type        = number
+  default     = 1
+}
+
+variable "cache_transit_encryption_enabled" {
+  description = "Enable in-transit encryption for the Twenty cache"
+  type        = bool
+  default     = true
+}
+
+variable "allowed_public_cidr_blocks" {
+  description = "CIDR blocks allowed to reach the public Twenty HTTPS ALB."
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
+variable "enable_http_redirect" {
+  description = "Whether the public ALB should redirect HTTP requests to HTTPS"
+  type        = bool
+  default     = true
+}

package/dist/plugins/twenty/test/api/cutover.test.ts

@@ -0,0 +1,183 @@
+/**
+ * U10 Twenty cutover tests — fake deps, no DB. Covers adoption, the
+ * plugin-row-already-exists dedupe branch, token invalidation, the
+ * missing-install precondition, and idempotent re-runs.
+ */
+
+import { describe, expect, it, vi } from "vitest";
+
+import {
+  cutoverTwentyPluginForTenant,
+  TWENTY_PLUGIN_MCP_SLUG,
+  type TwentyCutoverAuditInput,
+  type TwentyCutoverDeps,
+} from "../../src/api/cutover.js";
+
+interface FakeState {
+  install: { id: string } | null;
+  legacy: { id: string; url: string } | null;
+  pluginRow: { id: string; url: string } | null;
+  tokenCount: number;
+}
+
+function fakeDeps(state: FakeState) {
+  const calls = {
+    invalidatedServerIds: [] as string[],
+    adopted: [] as Array<Record<string, unknown>>,
+    removed: [] as Array<Record<string, unknown>>,
+    audits: [] as TwentyCutoverAuditInput[],
+  };
+  const deps: TwentyCutoverDeps = {
+    getTwentyInstall: vi.fn(async () => state.install),
+    getLegacyManagedRow: vi.fn(async () => state.legacy),
+    getPluginRow: vi.fn(async () => state.pluginRow),
+    invalidateUserTokens: vi.fn(async (serverId: string) => {
+      calls.invalidatedServerIds.push(serverId);
+      const count = state.tokenCount;
+      state.tokenCount = 0;
+      return count;
+    }),
+    adoptLegacyRow: vi.fn(async (args) => {
+      calls.adopted.push(args as unknown as Record<string, unknown>);
+      calls.audits.push(args.audit);
+      // Adoption flips the legacy row into the plugin row.
+      state.pluginRow = state.legacy;
+      state.legacy = null;
+    }),
+    removeLegacyRow: vi.fn(async (args) => {
+      calls.removed.push(args as unknown as Record<string, unknown>);
+      calls.audits.push(args.audit);
+      state.legacy = null;
+    }),
+  };
+  return { deps, calls };
+}
+
+const actor = {
+  tenantId: "tenant-1",
+  actorId: "user-1",
+  actorType: "user" as const,
+};
+
+describe("cutoverTwentyPluginForTenant", () => {
+  it("requires the twenty plugin install to exist", async () => {
+    const { deps } = fakeDeps({
+      install: null,
+      legacy: { id: "legacy-1", url: "https://crm.example.com/mcp" },
+      pluginRow: null,
+      tokenCount: 2,
+    });
+    await expect(cutoverTwentyPluginForTenant(actor, deps)).rejects.toThrow(
+      /Install the twenty plugin/,
+    );
+  });
+
+  it("adopts the legacy managed row: tokens invalidated, ownership + component pointer updated, audit emitted", async () => {
+    const { deps, calls } = fakeDeps({
+      install: { id: "install-1" },
+      legacy: { id: "legacy-1", url: "https://crm.example.com/mcp" },
+      pluginRow: null,
+      tokenCount: 3,
+    });
+
+    const result = await cutoverTwentyPluginForTenant(actor, deps);
+
+    expect(result).toMatchObject({
+      adopted: true,
+      mcpServerId: "legacy-1",
+      invalidatedUserTokenCount: 3,
+    });
+    expect(calls.invalidatedServerIds).toEqual(["legacy-1"]);
+    expect(calls.adopted).toHaveLength(1);
+    expect(calls.adopted[0]).toMatchObject({
+      tenantId: "tenant-1",
+      installId: "install-1",
+      serverId: "legacy-1",
+      serverUrl: "https://crm.example.com/mcp",
+    });
+    expect(calls.removed).toHaveLength(0);
+    expect(calls.audits[0]).toMatchObject({
+      eventType: "plugin.cutover",
+      actorId: "user-1",
+      actorType: "user",
+      resourceId: "install-1",
+      payload: {
+        pluginKey: "twenty",
+        mcpServerId: "legacy-1",
+        mode: "adopted",
+        invalidatedUserTokenCount: 3,
+      },
+    });
+  });
+
+  it("removes the redundant legacy row when the plugin handler already provisioned its own", async () => {
+    const { deps, calls } = fakeDeps({
+      install: { id: "install-1" },
+      legacy: { id: "legacy-1", url: "https://crm.example.com/mcp" },
+      pluginRow: { id: "plugin-1", url: "https://crm.example.com/mcp" },
+      tokenCount: 1,
+    });
+
+    const result = await cutoverTwentyPluginForTenant(actor, deps);
+
+    expect(result).toMatchObject({
+      adopted: true,
+      mcpServerId: "plugin-1",
+      invalidatedUserTokenCount: 1,
+    });
+    // Tokens invalidated on the LEGACY row (the one users connected to).
+    expect(calls.invalidatedServerIds).toEqual(["legacy-1"]);
+    expect(calls.adopted).toHaveLength(0);
+    expect(calls.removed[0]).toMatchObject({ serverId: "legacy-1" });
+    expect(calls.audits[0]).toMatchObject({
+      payload: { mode: "legacy_row_removed", mcpServerId: "plugin-1" },
+    });
+  });
+
+  it("is idempotent: a re-run after adoption reports a no-op and touches nothing", async () => {
+    const state: FakeState = {
+      install: { id: "install-1" },
+      legacy: { id: "legacy-1", url: "https://crm.example.com/mcp" },
+      pluginRow: null,
+      tokenCount: 2,
+    };
+    const { deps, calls } = fakeDeps(state);
+
+    const first = await cutoverTwentyPluginForTenant(actor, deps);
+    expect(first.adopted).toBe(true);
+
+    const second = await cutoverTwentyPluginForTenant(actor, deps);
+    expect(second).toMatchObject({
+      adopted: false,
+      mcpServerId: "legacy-1",
+      invalidatedUserTokenCount: 0,
+    });
+    expect(second.message).toMatch(/idempotent re-run/);
+    // No second invalidation, adoption, removal, or audit.
+    expect(calls.invalidatedServerIds).toEqual(["legacy-1"]);
+    expect(calls.adopted).toHaveLength(1);
+    expect(calls.removed).toHaveLength(0);
+    expect(calls.audits).toHaveLength(1);
+  });
+
+  it("reports a no-op when no managed Twenty MCP row ever existed", async () => {
+    const { deps, calls } = fakeDeps({
+      install: { id: "install-1" },
+      legacy: null,
+      pluginRow: null,
+      tokenCount: 0,
+    });
+
+    const result = await cutoverTwentyPluginForTenant(actor, deps);
+    expect(result).toMatchObject({
+      adopted: false,
+      mcpServerId: null,
+      invalidatedUserTokenCount: 0,
+    });
+    expect(calls.audits).toHaveLength(0);
+  });
+
+  it("adopts under the plugin handler's canonical slug so re-provision converges", () => {
+    expect(TWENTY_PLUGIN_MCP_SLUG).toBe("twenty--crm");
+  });
+});