unoverse 0.1.76 → 0.1.77

package/operator/infra/aws/main.tf

@@ -14,8 +14,41 @@ terraform {
   }
 }
 
+# ── One universe, one group ───────────────────────────────────────────────────
+#
+# AWS has no projects. Its equivalent is TAGS, and `default_tags` is the only honest way
+# to apply them: it stamps every resource this configuration creates, so nothing is
+# forgotten the day someone adds a resource and does not think about tagging. The console
+# view comes from the Resource Group below, and the same tag drives cost allocation, which
+# a DigitalOcean project cannot do.
+#
+# It touches ONLY what this stack creates. An adopted database keeps its own tags, in
+# keeping with the rule that a universe never takes ownership of what it borrowed
+# (INFRASTRUCTURE.md, "Borrowed resources are never owned").
 provider "aws" {
   region = var.region
+
+  default_tags {
+    tags = {
+      Universe  = var.name
+      ManagedBy = "unoverse"
+      Size      = var.size
+    }
+  }
+}
+
+# The console's answer to "what does this universe own". A tag query rather than a
+# membership list, so it stays correct as the ground grows without anyone maintaining it.
+resource "aws_resourcegroups_group" "universe" {
+  name        = var.name
+  description = "unoverse universe: ${var.name}"
+
+  resource_query {
+    query = jsonencode({
+      ResourceTypeFilters = ["AWS::AllSupported"]
+      TagFilters          = [{ Key = "Universe", Values = [var.name] }]
+    })
+  }
 }
 
 # ── Network: default VPC + two security groups ─────────────────────────────────

package/operator/lib/deploy.sh

@@ -20,16 +20,23 @@
 # trusted-sources list, so pointing it at a borrowed cluster deletes the operator's own
 # IP, their other droplets and their apps. Read the rules, add ours if missing, write
 # them back. Nothing else moves, and running it twice changes nothing.
-_grant_droplet_to_adopted_db() {
+# Add or remove THIS universe's droplet in an adopted cluster's trusted sources.
+#   _adopted_db_access <cloud> grant|revoke [droplet_id]
+# Symmetric on purpose. The grant existed and nothing revoked it, so a teardown left a
+# stale rule behind — and worse, terraform's own destroy of an authoritative firewall
+# resource PUT an EMPTY list and locked the operator out of a database it had borrowed.
+# Both directions now touch exactly one rule and never the list.
+_adopted_db_access() {
   local cloud="$1" dir="$ROOT/infra/$cloud" cluster droplet_id
+  local mode="$2"
   cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
   [ -n "$cluster" ] || return 0
   [ -n "${DIGITALOCEAN_TOKEN:-}" ] || return 0
-  droplet_id=$(terraform -chdir="$dir" state show digitalocean_droplet.app 2>/dev/null | awk -F'"' '/^ *id *=/{print $2; exit}')
+  droplet_id="${3:-$(terraform -chdir="$dir" state show digitalocean_droplet.app 2>/dev/null | awk -F'"' '/^ *id *=/{print $2; exit}')}"
   [ -n "$droplet_id" ] || return 0
 
-  node - "$cluster" "$droplet_id" <<'NODE'
-const [cluster, droplet] = process.argv.slice(2);
+  node - "$cluster" "$droplet_id" "$mode" <<'NODE'
+const [cluster, droplet, mode] = process.argv.slice(2);
 const T = process.env.DIGITALOCEAN_TOKEN;
 const H = { Authorization: `Bearer ${T}`, "Content-Type": "application/json" };
 const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { headers: H, ...o });
@@ -38,13 +45,21 @@ const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { header
   const db = (list.databases || []).find((d) => d.name === cluster);
   if (!db) return;
   const fw = await (await api(`/databases/${db.id}/firewall`)).json();
-  const rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
-  if (rules.some((r) => r.type === "droplet" && String(r.value) === String(droplet))) return;
-  rules.push({ type: "droplet", value: String(droplet) });
+  let rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
+  const mine = (r) => r.type === "droplet" && String(r.value) === String(droplet);
+  const has = rules.some(mine);
+  if (mode === "revoke") {
+    if (!has) return;
+    rules = rules.filter((r) => !mine(r));   // ours only; every other rule survives
+  } else {
+    if (has) return;
+    rules.push({ type: "droplet", value: String(droplet) });
+  }
   const res = await api(`/databases/${db.id}/firewall`, { method: "PUT", body: JSON.stringify({ rules }) });
+  const what = mode === "revoke" ? "no longer reaches" : "may reach";
   console.log(res.ok
-    ? `  \x1b[32m✓\x1b[0m This universe may reach ${cluster} \x1b[2m(added to its trusted sources, nothing else changed)\x1b[0m`
-    : `  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — add droplet ${droplet} by hand`);
+    ? `  \x1b[32m✓\x1b[0m This universe ${what} ${cluster} \x1b[2m(one rule changed, ${rules.length} left in place)\x1b[0m`
+    : `  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — adjust droplet ${droplet} by hand`);
 })().catch(() => {});
 NODE
 }
@@ -311,7 +326,7 @@ cmd_deploy() {
     exit 1
   fi
 
-  _grant_droplet_to_adopted_db "$cloud"
+  _adopted_db_access "$cloud" grant
 
 
   # Read deploy target from .env.production

package/operator/lib/destroy.sh

@@ -91,6 +91,14 @@ cmd_destroy() {
     return 1
   fi
 
+  # Take our rule out of the borrowed cluster BEFORE the state goes, while the droplet id
+  # is still readable. One rule, ours, never the list.
+  if [ -n "$kept" ]; then
+    local dropped
+    dropped=$(terraform -chdir="$dir" state show digitalocean_droplet.app 2>/dev/null | awk -F'"' '/^ *id *=/{print $2; exit}')
+    [ -n "$dropped" ] && _adopted_db_access "$cloud" revoke "$dropped"
+  fi
+
   echo ""
   info "Taking it down..."
   echo ""

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.76",
+  "version": "0.1.77",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",