thinkwork-cli 0.12.12 → 0.12.15

package/dist/plugins/n8n/terraform/n8n/outputs.tf

@@ -0,0 +1,124 @@
+output "n8n_provisioned" {
+  description = "Whether the retained n8n substrate is provisioned."
+  value       = true
+}
+
+output "n8n_url" {
+  description = "Public n8n URL."
+  value       = var.public_url
+}
+
+output "n8n_alb_dns_name" {
+  description = "Public ALB DNS name for n8n."
+  value       = aws_lb.n8n.dns_name
+}
+
+output "n8n_alb_arn" {
+  description = "Public ALB ARN for n8n."
+  value       = aws_lb.n8n.arn
+}
+
+output "n8n_target_group_arn" {
+  description = "Target group ARN for the n8n main service."
+  value       = aws_lb_target_group.n8n.arn
+}
+
+output "n8n_cluster_arn" {
+  description = "ECS cluster ARN for n8n."
+  value       = aws_ecs_cluster.main.arn
+}
+
+output "n8n_main_service_name" {
+  description = "ECS service name for the n8n main service."
+  value       = aws_ecs_service.main.name
+}
+
+output "n8n_worker_service_name" {
+  description = "ECS service name for the n8n worker service."
+  value       = aws_ecs_service.worker.name
+}
+
+output "n8n_main_log_group_name" {
+  description = "CloudWatch log group for the n8n main service."
+  value       = aws_cloudwatch_log_group.main.name
+}
+
+output "n8n_worker_log_group_name" {
+  description = "CloudWatch log group for the n8n worker service."
+  value       = aws_cloudwatch_log_group.worker.name
+}
+
+output "n8n_security_group_id" {
+  description = "Security group ID for the n8n ECS tasks."
+  value       = aws_security_group.n8n.id
+}
+
+output "n8n_database_name" {
+  description = "Dedicated PostgreSQL database name for n8n."
+  value       = var.database_name
+}
+
+output "n8n_database_secret_arn" {
+  description = "Secrets Manager ARN used for n8n database runtime credentials."
+  value       = local.effective_database_url_secret_arn
+}
+
+output "n8n_database_admin_secret_arn" {
+  description = "Secrets Manager ARN used by the managed-app setup step for database lifecycle operations."
+  value       = var.database_admin_secret_arn
+}
+
+output "n8n_encryption_key_secret_arn" {
+  description = "Secrets Manager ARN used for N8N_ENCRYPTION_KEY."
+  value       = local.effective_encryption_key_secret_arn
+}
+
+output "n8n_operator_secret_arn" {
+  description = "Secrets Manager ARN used for the shared native n8n operator account."
+  value       = local.effective_operator_secret_arn
+}
+
+output "n8n_service_credential_secret_arn" {
+  description = "Secrets Manager ARN used for the n8n MCP tenant service credential."
+  value       = local.effective_service_credential_secret_arn
+}
+
+output "n8n_agent_step_bridge_credential_secret_arn" {
+  description = "Secrets Manager ARN used for the inbound n8n agent-step bridge credential."
+  value       = local.effective_agent_step_bridge_credential_secret_arn
+}
+
+output "n8n_valkey_replication_group_id" {
+  description = "ElastiCache replication group ID for the n8n queue."
+  value       = aws_elasticache_replication_group.n8n.id
+}
+
+output "n8n_valkey_endpoint" {
+  description = "ElastiCache primary endpoint for the n8n queue."
+  value       = aws_elasticache_replication_group.n8n.primary_endpoint_address
+}
+
+output "n8n_storage_bucket_name" {
+  description = "S3 bucket name used for n8n managed artifacts and optional storage mode objects."
+  value       = var.storage_bucket_name
+}
+
+output "n8n_storage_prefix" {
+  description = "S3 prefix reserved for n8n managed artifacts."
+  value       = local.storage_prefix
+}
+
+output "n8n_runtime_enabled" {
+  description = "Whether the n8n main and worker services are configured to run."
+  value       = var.runtime_enabled
+}
+
+output "n8n_image_digest" {
+  description = "Immutable digest extracted from the n8n wrapper image URI."
+  value       = local.image_digest
+}
+
+output "n8n_package_config_digest" {
+  description = "Digest of the reviewed n8n custom-package configuration."
+  value       = var.package_config_digest
+}

package/dist/plugins/n8n/terraform/n8n/scripts/sync-database.py

@@ -0,0 +1,250 @@
+#!/usr/bin/env python3
+"""Synchronize the dedicated n8n Postgres database and role.
+
+The managed app can create fresh runtime secrets while the shared Aurora role
+survives a teardown. This script makes the Terraform lifecycle idempotent by
+rotating the role password to match the runtime secret before ECS starts n8n.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import sys
+import urllib.parse
+
+IDENTIFIER = re.compile(r"^[A-Za-z_][A-Za-z0-9_]{0,62}$")
+
+
+def require_env(name: str) -> str:
+    value = os.environ.get(name, "").strip()
+    if not value:
+        raise RuntimeError(f"{name} is required")
+    return value
+
+
+def validate_identifier(value: str, label: str) -> str:
+    if not IDENTIFIER.fullmatch(value):
+        raise RuntimeError(f"{label} must be a valid PostgreSQL identifier")
+    return value
+
+
+def quote_ident(value: str) -> str:
+    return '"' + value.replace('"', '""') + '"'
+
+
+def quote_literal(value: str) -> str:
+    return "'" + value.replace("'", "''") + "'"
+
+
+def get_secret(secret_id: str) -> dict[str, object]:
+    raw = subprocess.check_output(
+        [
+            "aws",
+            "secretsmanager",
+            "get-secret-value",
+            "--secret-id",
+            secret_id,
+            "--output",
+            "json",
+        ],
+        text=True,
+    )
+    payload = json.loads(raw)
+    secret_string = payload.get("SecretString") or ""
+    if not isinstance(secret_string, str) or not secret_string:
+        raise RuntimeError(f"Secret {secret_id} has no SecretString")
+    try:
+        parsed = json.loads(secret_string)
+    except json.JSONDecodeError:
+        return {"DATABASE_URL": secret_string}
+    if not isinstance(parsed, dict):
+        raise RuntimeError(f"Secret {secret_id} must contain a JSON object")
+    return parsed
+
+
+def first_string(secret: dict[str, object], *keys: str) -> str:
+    for key in keys:
+        value = secret.get(key)
+        if isinstance(value, str) and value:
+            return value
+    return ""
+
+
+def parse_url(value: str) -> urllib.parse.ParseResult | None:
+    if not value:
+        return None
+    parsed = urllib.parse.urlparse(value)
+    if not parsed.scheme or not parsed.hostname:
+        return None
+    return parsed
+
+
+def admin_connection(secret: dict[str, object]) -> dict[str, str]:
+    host = require_env("N8N_DATABASE_HOST")
+    port = require_env("N8N_DATABASE_PORT")
+    url = first_string(secret, "DATABASE_URL", "PG_DATABASE_URL", "databaseUrl", "url")
+    parsed = parse_url(url)
+    username = ""
+    password = ""
+    if parsed:
+        username = urllib.parse.unquote(parsed.username or "")
+        password = urllib.parse.unquote(parsed.password or "")
+        host = parsed.hostname or host
+        port = str(parsed.port or port)
+    username = username or first_string(secret, "username", "user", "USERNAME", "PGUSER")
+    password = password or first_string(secret, "password", "PASSWORD", "PGPASSWORD")
+    if not username or not password:
+        raise RuntimeError("Admin database secret must contain username and password")
+    return {
+        "host": host,
+        "port": port,
+        "username": username,
+        "password": password,
+        "maintenance_db": first_string(secret, "maintenanceDatabase", "maintenance_database")
+        or "postgres",
+    }
+
+
+def runtime_password(secret: dict[str, object]) -> str:
+    password = first_string(secret, "DB_POSTGRESDB_PASSWORD", "password", "PASSWORD")
+    if password:
+        return password
+    parsed = parse_url(first_string(secret, "DATABASE_URL", "PG_DATABASE_URL", "databaseUrl"))
+    if parsed and parsed.password:
+        return urllib.parse.unquote(parsed.password)
+    raise RuntimeError("n8n runtime database secret is missing DB_POSTGRESDB_PASSWORD")
+
+
+def psql(conn: dict[str, str], database: str, sql: str, capture: bool = False) -> str:
+    env = os.environ.copy()
+    env["PGPASSWORD"] = conn["password"]
+    env["PGSSLMODE"] = "require"
+    args = [
+        "psql",
+        "-X",
+        "-v",
+        "ON_ERROR_STOP=1",
+        "-h",
+        conn["host"],
+        "-p",
+        conn["port"],
+        "-U",
+        conn["username"],
+        "-d",
+        database,
+        "-q",
+    ]
+    if capture:
+        args.append("-tA")
+    completed = subprocess.run(
+        args,
+        input=sql,
+        text=True,
+        env=env,
+        stdout=subprocess.PIPE if capture else None,
+        stderr=subprocess.PIPE,
+    )
+    if completed.returncode != 0:
+        detail = completed.stderr.strip() or f"psql exited {completed.returncode}"
+        raise RuntimeError(detail)
+    return completed.stdout.strip() if capture and completed.stdout else ""
+
+
+def sync_up() -> None:
+    database_name = validate_identifier(require_env("N8N_DATABASE_NAME"), "database_name")
+    database_username = validate_identifier(
+        require_env("N8N_DATABASE_USERNAME"), "database_username"
+    )
+    admin = admin_connection(get_secret(require_env("N8N_DATABASE_ADMIN_SECRET_ARN")))
+    password = runtime_password(get_secret(require_env("N8N_DATABASE_URL_SECRET_ARN")))
+    db_ident = quote_ident(database_name)
+    role_ident = quote_ident(database_username)
+
+    psql(
+        admin,
+        admin["maintenance_db"],
+        f"""
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = {quote_literal(database_username)}) THEN
+    EXECUTE format('CREATE ROLE %I WITH LOGIN PASSWORD %L', {quote_literal(database_username)}, {quote_literal(password)});
+  ELSE
+    EXECUTE format('ALTER ROLE %I WITH LOGIN PASSWORD %L', {quote_literal(database_username)}, {quote_literal(password)});
+  END IF;
+END $$;
+""",
+    )
+
+    exists = psql(
+        admin,
+        admin["maintenance_db"],
+        f"SELECT 1 FROM pg_database WHERE datname = {quote_literal(database_name)};",
+        capture=True,
+    )
+    if exists != "1":
+        psql(admin, admin["maintenance_db"], f"CREATE DATABASE {db_ident};")
+
+    psql(
+        admin,
+        admin["maintenance_db"],
+        f"""
+GRANT CONNECT, TEMPORARY ON DATABASE {db_ident} TO {role_ident};
+GRANT ALL PRIVILEGES ON DATABASE {db_ident} TO {role_ident};
+""",
+    )
+    psql(
+        admin,
+        database_name,
+        f"""
+CREATE SCHEMA IF NOT EXISTS public;
+GRANT USAGE, CREATE ON SCHEMA public TO {role_ident};
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO {role_ident};
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO {role_ident};
+GRANT ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public TO {role_ident};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO {role_ident};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON SEQUENCES TO {role_ident};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON FUNCTIONS TO {role_ident};
+""",
+    )
+    print(f"[n8n-db] synchronized database {database_name} and role {database_username}")
+
+
+def sync_destroy() -> None:
+    database_name = validate_identifier(require_env("N8N_DATABASE_NAME"), "database_name")
+    database_username = validate_identifier(
+        require_env("N8N_DATABASE_USERNAME"), "database_username"
+    )
+    admin = admin_connection(get_secret(require_env("N8N_DATABASE_ADMIN_SECRET_ARN")))
+    db_ident = quote_ident(database_name)
+    role_ident = quote_ident(database_username)
+    psql(
+        admin,
+        admin["maintenance_db"],
+        f"""
+SELECT pg_terminate_backend(pid)
+FROM pg_stat_activity
+WHERE datname = {quote_literal(database_name)}
+  AND pid <> pg_backend_pid();
+DROP DATABASE IF EXISTS {db_ident};
+DROP ROLE IF EXISTS {role_ident};
+""",
+    )
+    print(f"[n8n-db] dropped database {database_name} and role {database_username}")
+
+
+def main() -> int:
+    mode = sys.argv[1] if len(sys.argv) > 1 else "up"
+    if mode == "up":
+        sync_up()
+    elif mode == "destroy":
+        sync_destroy()
+    else:
+        raise RuntimeError(f"Unsupported mode: {mode}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/dist/plugins/n8n/terraform/n8n/scripts/test_sync_database.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+
+MODULE_PATH = Path(__file__).with_name("sync-database.py")
+
+
+def load_module():
+    spec = importlib.util.spec_from_file_location("sync_database", MODULE_PATH)
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_sync_up_creates_admin_owned_database_and_grants_runtime_role(monkeypatch):
+    module = load_module()
+    calls: list[tuple[str, str]] = []
+
+    monkeypatch.setenv("N8N_DATABASE_NAME", "thinkwork_n8n")
+    monkeypatch.setenv("N8N_DATABASE_USERNAME", "thinkwork_n8n")
+    monkeypatch.setenv("N8N_DATABASE_ADMIN_SECRET_ARN", "admin-secret")
+    monkeypatch.setenv("N8N_DATABASE_URL_SECRET_ARN", "runtime-secret")
+    monkeypatch.setenv("N8N_DATABASE_HOST", "db.example.test")
+    monkeypatch.setenv("N8N_DATABASE_PORT", "5432")
+
+    def fake_get_secret(secret_id: str):
+        if secret_id == "admin-secret":
+            return {
+                "username": "thinkwork_admin",
+                "password": "admin-password",
+                "maintenanceDatabase": "postgres",
+            }
+        if secret_id == "runtime-secret":
+            return {"DB_POSTGRESDB_PASSWORD": "runtime-password"}
+        raise AssertionError(secret_id)
+
+    def fake_psql(conn, database, sql, capture=False):
+        calls.append((database, sql))
+        if capture:
+            return ""
+        return ""
+
+    monkeypatch.setattr(module, "get_secret", fake_get_secret)
+    monkeypatch.setattr(module, "psql", fake_psql)
+
+    module.sync_up()
+
+    sql = "\n".join(statement for _, statement in calls)
+    assert 'CREATE DATABASE "thinkwork_n8n";' in sql
+    assert 'CREATE DATABASE "thinkwork_n8n" OWNER "thinkwork_n8n"' not in sql
+    assert 'ALTER DATABASE "thinkwork_n8n" OWNER TO "thinkwork_n8n"' not in sql
+    assert 'GRANT CONNECT, TEMPORARY ON DATABASE "thinkwork_n8n" TO "thinkwork_n8n"' in sql
+    assert 'GRANT USAGE, CREATE ON SCHEMA public TO "thinkwork_n8n"' in sql