icdev 0.0.3__py3-none-any.whl

tools/forge_studio/deploy/env_manager.py

@@ -0,0 +1,431 @@
+# CUI // SP-CTI
+"""Environment manager — dev/staging/prod configuration profiles for Forge Studio apps.
+
+Manages per-app, per-environment configurations:
+- Environment variables (encrypted secrets vs plain config)
+- Feature flags per environment
+- Domain + SSL settings
+- Resource sizing presets
+- Environment promotion (dev → staging → prod)
+
+Architecture decision: D-FS-DEPLOY-5 — environment configs stored as JSON in
+forge_studio_environments table, layered: base app config + env override.
+
+CLI: python tools/forge_studio/deploy/env_manager.py --create --app-id "..." --env dev --json
+"""
+from __future__ import annotations
+
+import json
+import logging
+import uuid
+from datetime import datetime, timezone
+from typing import Any, Dict, List, Optional
+
+from tools.forge_studio.audit import log_forge_event
+
+logger = logging.getLogger("forge_studio.deploy.env")
+
+# ---------------------------------------------------------------------------
+# Default environment presets
+# ---------------------------------------------------------------------------
+
+ENV_PRESETS: Dict[str, Dict[str, Any]] = {
+    "dev": {
+        "description": "Development — local testing and iteration",
+        "variables": {
+            "NODE_ENV": "development",
+            "LOG_LEVEL": "debug",
+            "ENABLE_DEBUG_PANEL": "true",
+            "RATE_LIMIT_RPM": "1000",
+        },
+        "feature_flags": {
+            "debug_toolbar": True,
+            "hot_reload": True,
+            "mock_auth": True,
+            "seed_data": True,
+        },
+        "resources": {
+            "replicas": 1,
+            "cpu": "0.25",
+            "memory": "512Mi",
+            "db_size": "small",
+        },
+        "ssl": False,
+    },
+    "staging": {
+        "description": "Staging — pre-production validation",
+        "variables": {
+            "NODE_ENV": "production",
+            "LOG_LEVEL": "info",
+            "ENABLE_DEBUG_PANEL": "false",
+            "RATE_LIMIT_RPM": "500",
+        },
+        "feature_flags": {
+            "debug_toolbar": False,
+            "hot_reload": False,
+            "mock_auth": False,
+            "seed_data": True,
+        },
+        "resources": {
+            "replicas": 1,
+            "cpu": "0.5",
+            "memory": "1Gi",
+            "db_size": "medium",
+        },
+        "ssl": True,
+    },
+    "prod": {
+        "description": "Production — live user traffic",
+        "variables": {
+            "NODE_ENV": "production",
+            "LOG_LEVEL": "warn",
+            "ENABLE_DEBUG_PANEL": "false",
+            "RATE_LIMIT_RPM": "200",
+        },
+        "feature_flags": {
+            "debug_toolbar": False,
+            "hot_reload": False,
+            "mock_auth": False,
+            "seed_data": False,
+        },
+        "resources": {
+            "replicas": 2,
+            "cpu": "1",
+            "memory": "2Gi",
+            "db_size": "large",
+        },
+        "ssl": True,
+    },
+}
+
+
+# ---------------------------------------------------------------------------
+# Environment CRUD
+# ---------------------------------------------------------------------------
+
+def create_environment(
+    app_id: str,
+    environment: str = "dev",
+    domain: str = "",
+    variables: Optional[Dict[str, str]] = None,
+    feature_flags: Optional[Dict[str, bool]] = None,
+    secrets: Optional[Dict[str, str]] = None,
+    project_id: str = "",
+) -> Dict[str, Any]:
+    """Create an environment config for an app.
+
+    Merges provided overrides with ENV_PRESETS defaults.
+    Secrets are stored separately from plain variables.
+    """
+    from tools.db.storage import get_connection
+
+    if environment not in ENV_PRESETS:
+        return {"status": "error", "error": f"Invalid environment: {environment}. Valid: {list(ENV_PRESETS.keys())}"}
+
+    preset = ENV_PRESETS[environment]
+    env_id = f"env-{uuid.uuid4().hex[:12]}"
+
+    merged_vars = {**preset["variables"]}
+    if variables:
+        merged_vars.update(variables)
+
+    merged_flags = {**preset["feature_flags"]}
+    if feature_flags:
+        merged_flags.update(feature_flags)
+
+    config = {
+        "variables": merged_vars,
+        "feature_flags": merged_flags,
+        "resources": preset["resources"],
+        "ssl": preset["ssl"],
+        "domain": domain,
+        "secrets_count": len(secrets) if secrets else 0,
+    }
+
+    # Store secrets as separate keys (not in plain config)
+    secret_keys = list(secrets.keys()) if secrets else []
+
+    now = datetime.now(timezone.utc).isoformat()
+    with get_connection() as conn:
+        conn.execute(
+            "INSERT INTO forge_studio_environments "
+            "(id, app_id, environment, domain, config_json, secret_keys_json, "
+            "status, classification, created_at, updated_at) "
+            "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+            (
+                env_id, app_id, environment, domain,
+                json.dumps(config), json.dumps(secret_keys),
+                "active", "CUI // SP-CTI", now, now,
+            ),
+        )
+
+    log_forge_event("forge_studio_env_created", {
+        "env_id": env_id, "app_id": app_id, "environment": environment,
+        "domain": domain, "secret_count": len(secret_keys),
+    }, project_id=project_id)
+
+    return {
+        "status": "success",
+        "env_id": env_id,
+        "environment": environment,
+        "config": config,
+        "secret_keys": secret_keys,
+    }
+
+
+def get_environment(app_id: str, environment: str) -> Optional[Dict[str, Any]]:
+    """Get environment config for an app."""
+    from tools.db.storage import get_connection
+
+    with get_connection() as conn:
+        row = conn.execute(
+            "SELECT id, app_id, environment, domain, config_json, secret_keys_json, "
+            "status, created_at, updated_at FROM forge_studio_environments "
+            "WHERE app_id = ? AND environment = ? ORDER BY created_at DESC LIMIT 1",
+            (app_id, environment),
+        ).fetchone()
+
+    if not row:
+        return None
+
+    return {
+        "id": row[0], "app_id": row[1], "environment": row[2], "domain": row[3],
+        "config": json.loads(row[4]) if row[4] else {},
+        "secret_keys": json.loads(row[5]) if row[5] else [],
+        "status": row[6], "created_at": row[7], "updated_at": row[8],
+    }
+
+
+def list_environments(app_id: str) -> List[Dict[str, Any]]:
+    """List all environment configs for an app."""
+    from tools.db.storage import get_connection
+
+    with get_connection() as conn:
+        rows = conn.execute(
+            "SELECT id, environment, domain, status, created_at, updated_at "
+            "FROM forge_studio_environments WHERE app_id = ? "
+            "ORDER BY CASE environment WHEN 'dev' THEN 1 WHEN 'staging' THEN 2 WHEN 'prod' THEN 3 END",
+            (app_id,),
+        ).fetchall()
+
+    return [
+        {"id": r[0], "environment": r[1], "domain": r[2],
+         "status": r[3], "created_at": r[4], "updated_at": r[5]}
+        for r in rows
+    ]
+
+
+def update_environment(
+    app_id: str,
+    environment: str,
+    variables: Optional[Dict[str, str]] = None,
+    feature_flags: Optional[Dict[str, bool]] = None,
+    domain: Optional[str] = None,
+    project_id: str = "",
+) -> Dict[str, Any]:
+    """Update environment config (merges with existing)."""
+    from tools.db.storage import get_connection
+
+    existing = get_environment(app_id, environment)
+    if not existing:
+        return {"status": "error", "error": f"No {environment} environment for app {app_id}"}
+
+    config = existing["config"]
+    if variables:
+        config["variables"].update(variables)
+    if feature_flags:
+        config["feature_flags"].update(feature_flags)
+
+    now = datetime.now(timezone.utc).isoformat()
+    updates = ["config_json = ?", "updated_at = ?"]
+    params: list = [json.dumps(config), now]
+
+    if domain is not None:
+        updates.append("domain = ?")
+        params.append(domain)
+
+    params.append(existing["id"])
+
+    with get_connection() as conn:
+        conn.execute(
+            f"UPDATE forge_studio_environments SET {', '.join(updates)} WHERE id = ?",
+            params,
+        )
+
+    log_forge_event("forge_studio_env_updated", {
+        "app_id": app_id, "environment": environment,
+    }, project_id=project_id)
+
+    return {"status": "success", "environment": environment, "config": config}
+
+
+def promote_environment(
+    app_id: str,
+    from_env: str = "dev",
+    to_env: str = "staging",
+    project_id: str = "",
+) -> Dict[str, Any]:
+    """Promote config from one environment to another.
+
+    Copies variables and feature flags, but preserves target's domain,
+    resources, and secrets. Only promotes: dev→staging, staging→prod.
+    """
+    valid_promotions = {("dev", "staging"), ("staging", "prod")}
+    if (from_env, to_env) not in valid_promotions:
+        return {"status": "error", "error": f"Invalid promotion: {from_env} → {to_env}. Valid: dev→staging, staging→prod"}
+
+    source = get_environment(app_id, from_env)
+    if not source:
+        return {"status": "error", "error": f"No {from_env} environment for app {app_id}"}
+
+    target = get_environment(app_id, to_env)
+
+    # Merge source variables into target (preserve target secrets/resources)
+    promoted_vars = dict(source["config"].get("variables", {}))
+    # Override env-specific values
+    promoted_vars["NODE_ENV"] = "production" if to_env != "dev" else "development"
+    promoted_vars["LOG_LEVEL"] = ENV_PRESETS[to_env]["variables"]["LOG_LEVEL"]
+
+    promoted_flags = dict(source["config"].get("feature_flags", {}))
+    # Disable dev-only flags in higher envs
+    if to_env in ("staging", "prod"):
+        promoted_flags["debug_toolbar"] = False
+        promoted_flags["hot_reload"] = False
+        promoted_flags["mock_auth"] = False
+    if to_env == "prod":
+        promoted_flags["seed_data"] = False
+
+    if target:
+        return update_environment(
+            app_id, to_env,
+            variables=promoted_vars,
+            feature_flags=promoted_flags,
+            project_id=project_id,
+        )
+    else:
+        return create_environment(
+            app_id, to_env,
+            variables=promoted_vars,
+            feature_flags=promoted_flags,
+            project_id=project_id,
+        )
+
+
+def generate_dotenv(app_id: str, environment: str = "dev") -> str:
+    """Generate .env file content from environment config.
+
+    Secret values are replaced with placeholders.
+    """
+    env_config = get_environment(app_id, environment)
+    if not env_config:
+        # Fall back to preset
+        preset = ENV_PRESETS.get(environment, ENV_PRESETS["dev"])
+        variables = preset["variables"]
+        secret_keys: list = []
+    else:
+        variables = env_config["config"].get("variables", {})
+        secret_keys = env_config.get("secret_keys", [])
+
+    lines = [
+        "# CUI // SP-CTI",
+        f"# Environment: {environment}",
+        f"# Generated: {datetime.now(timezone.utc).isoformat()}",
+        "",
+    ]
+
+    for key, value in sorted(variables.items()):
+        lines.append(f"{key}={value}")
+
+    if secret_keys:
+        lines.append("")
+        lines.append("# Secrets (replace placeholders with actual values)")
+        for key in sorted(secret_keys):
+            lines.append(f"{key}=<REPLACE_WITH_SECRET>")
+
+    lines.append("")
+    return "\n".join(lines)
+
+
+# ---------------------------------------------------------------------------
+# DB schema
+# ---------------------------------------------------------------------------
+
+ENV_SCHEMA = """
+CREATE TABLE IF NOT EXISTS forge_studio_environments (
+    id TEXT PRIMARY KEY,
+    app_id TEXT NOT NULL,
+    environment TEXT NOT NULL CHECK(environment IN ('dev','staging','prod')),
+    domain TEXT,
+    config_json TEXT,
+    secret_keys_json TEXT,
+    status TEXT DEFAULT 'active' CHECK(status IN ('active','archived')),
+    classification TEXT DEFAULT 'CUI // SP-CTI',
+    created_at TEXT NOT NULL,
+    updated_at TEXT,
+    UNIQUE(app_id, environment)
+);
+"""
+
+
+def ensure_env_tables():
+    """Create environment tables if they don't exist."""
+    from tools.db.storage import get_connection
+
+    with get_connection() as conn:
+        for stmt in ENV_SCHEMA.split(";"):
+            s = stmt.strip()
+            if s and not s.startswith("--"):
+                conn.execute(s)
+    logger.info("Forge Studio environment tables ensured")
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+
+def main():
+    import argparse
+    import sys
+
+    parser = argparse.ArgumentParser(description="Forge Studio Environment Manager")
+    parser.add_argument("--create", action="store_true", help="Create environment")
+    parser.add_argument("--get", action="store_true", help="Get environment config")
+    parser.add_argument("--list", action="store_true", help="List environments for app")
+    parser.add_argument("--promote", action="store_true", help="Promote env config")
+    parser.add_argument("--dotenv", action="store_true", help="Generate .env file")
+    parser.add_argument("--app-id", type=str, required=True, help="App ID")
+    parser.add_argument("--env", type=str, default="dev", help="Environment")
+    parser.add_argument("--to-env", type=str, default="staging", help="Target env for promotion")
+    parser.add_argument("--domain", type=str, default="", help="Custom domain")
+    parser.add_argument("--project-id", type=str, default="", help="Project ID")
+    parser.add_argument("--json", action="store_true", help="JSON output")
+    args = parser.parse_args()
+
+    ensure_env_tables()
+
+    if args.create:
+        result = create_environment(
+            app_id=args.app_id, environment=args.env,
+            domain=args.domain, project_id=args.project_id,
+        )
+    elif args.get:
+        result = get_environment(args.app_id, args.env) or {"status": "not_found"}
+    elif args.list:
+        result = list_environments(args.app_id)
+    elif args.promote:
+        result = promote_environment(
+            args.app_id, from_env=args.env, to_env=args.to_env,
+            project_id=args.project_id,
+        )
+    elif args.dotenv:
+        print(generate_dotenv(args.app_id, args.env))
+        return
+    else:
+        parser.print_help()
+        sys.exit(0)
+
+    print(json.dumps(result, indent=2, default=str))
+
+
+if __name__ == "__main__":
+    main()

tools/forge_studio/eject/__init__.py

@@ -0,0 +1,2 @@
+# CUI // SP-CTI
+"""Eject engine — export generated app to standalone React + Supabase project."""

tools/forge_studio/eject/docker_compose_generator.py

@@ -0,0 +1,237 @@
+# CUI // SP-CTI
+"""Docker Compose generator — produces docker-compose.yml for self-hosted Forge Studio apps.
+
+Includes Supabase stack (PostgreSQL, Auth, Realtime, Storage, Studio) and the
+Next.js app container. Deterministic template-based generation.
+"""
+from __future__ import annotations
+
+import logging
+from typing import Any, Dict, Optional
+
+logger = logging.getLogger("forge_studio.eject.docker")
+
+
+def generate_docker_compose(app_name: str = "forge-app",
+                             supabase_port: int = 54321,
+                             app_port: int = 3000) -> str:
+    """Generate docker-compose.yml for self-hosted deployment.
+
+    Includes full Supabase stack + Next.js app.
+    """
+    safe_name = app_name.lower().replace(" ", "-").replace("_", "-")
+    return f'''# CUI // SP-CTI
+# Docker Compose for {app_name}
+# Generated by Forge Studio — self-hosted deployment
+# Usage: docker compose up -d
+
+version: "3.8"
+
+services:
+  # ── Supabase Stack ──────────────────────────────────────────
+  db:
+    image: supabase/postgres:15.6.1.120
+    container_name: {safe_name}-db
+    restart: unless-stopped
+    ports:
+      - "54322:5432"
+    environment:
+      POSTGRES_PASSWORD: ${{POSTGRES_PASSWORD:-your-super-secret-password}}
+      POSTGRES_DB: postgres
+    volumes:
+      - db-data:/var/lib/postgresql/data
+      - ./supabase/migrations:/docker-entrypoint-initdb.d/migrations
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  auth:
+    image: supabase/gotrue:v2.158.1
+    container_name: {safe_name}-auth
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      GOTRUE_API_HOST: "0.0.0.0"
+      GOTRUE_API_PORT: "9999"
+      API_EXTERNAL_URL: http://localhost:{supabase_port}
+      GOTRUE_DB_DRIVER: postgres
+      GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:${{POSTGRES_PASSWORD:-your-super-secret-password}}@db:5432/postgres
+      GOTRUE_SITE_URL: http://localhost:{app_port}
+      GOTRUE_JWT_SECRET: ${{JWT_SECRET:-your-super-secret-jwt-token-with-at-least-32-characters}}
+      GOTRUE_JWT_EXP: "3600"
+      GOTRUE_DISABLE_SIGNUP: "false"
+      GOTRUE_MAILER_AUTOCONFIRM: "true"
+
+  rest:
+    image: postgrest/postgrest:v12.2.3
+    container_name: {safe_name}-rest
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      PGRST_DB_URI: postgres://authenticator:${{POSTGRES_PASSWORD:-your-super-secret-password}}@db:5432/postgres
+      PGRST_DB_SCHEMAS: public,graphql_public
+      PGRST_DB_ANON_ROLE: anon
+      PGRST_JWT_SECRET: ${{JWT_SECRET:-your-super-secret-jwt-token-with-at-least-32-characters}}
+
+  realtime:
+    image: supabase/realtime:v2.30.34
+    container_name: {safe_name}-realtime
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      PORT: "4000"
+      DB_HOST: db
+      DB_PORT: "5432"
+      DB_USER: supabase_admin
+      DB_PASSWORD: ${{POSTGRES_PASSWORD:-your-super-secret-password}}
+      DB_NAME: postgres
+      SECRET_KEY_BASE: ${{JWT_SECRET:-your-super-secret-jwt-token-with-at-least-32-characters}}
+
+  storage:
+    image: supabase/storage-api:v1.10.1
+    container_name: {safe_name}-storage
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      ANON_KEY: ${{ANON_KEY:-your-anon-key}}
+      SERVICE_KEY: ${{SERVICE_ROLE_KEY:-your-service-role-key}}
+      DATABASE_URL: postgres://supabase_storage_admin:${{POSTGRES_PASSWORD:-your-super-secret-password}}@db:5432/postgres
+      STORAGE_BACKEND: file
+      FILE_STORAGE_BACKEND_PATH: /var/lib/storage
+      PGRST_JWT_SECRET: ${{JWT_SECRET:-your-super-secret-jwt-token-with-at-least-32-characters}}
+    volumes:
+      - storage-data:/var/lib/storage
+
+  kong:
+    image: kong:2.8.1
+    container_name: {safe_name}-kong
+    restart: unless-stopped
+    ports:
+      - "{supabase_port}:8000"
+    environment:
+      KONG_DATABASE: "off"
+      KONG_DECLARATIVE_CONFIG: /home/kong/kong.yml
+    volumes:
+      - ./supabase/kong.yml:/home/kong/kong.yml:ro
+    depends_on:
+      - auth
+      - rest
+      - realtime
+      - storage
+
+  studio:
+    image: supabase/studio:20240923-24e285c
+    container_name: {safe_name}-studio
+    restart: unless-stopped
+    ports:
+      - "54323:3000"
+    environment:
+      STUDIO_PG_META_URL: http://meta:8080
+      SUPABASE_URL: http://kong:8000
+      SUPABASE_REST_URL: http://kong:8000/rest/v1/
+      SUPABASE_ANON_KEY: ${{ANON_KEY:-your-anon-key}}
+      SUPABASE_SERVICE_KEY: ${{SERVICE_ROLE_KEY:-your-service-role-key}}
+    depends_on:
+      - kong
+
+  meta:
+    image: supabase/postgres-meta:v0.83.2
+    container_name: {safe_name}-meta
+    restart: unless-stopped
+    environment:
+      PG_META_PORT: "8080"
+      PG_META_DB_HOST: db
+      PG_META_DB_PORT: "5432"
+      PG_META_DB_NAME: postgres
+      PG_META_DB_USER: supabase_admin
+      PG_META_DB_PASSWORD: ${{POSTGRES_PASSWORD:-your-super-secret-password}}
+    depends_on:
+      db:
+        condition: service_healthy
+
+  # ── Application ─────────────────────────────────────────────
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: {safe_name}-app
+    restart: unless-stopped
+    ports:
+      - "{app_port}:3000"
+    environment:
+      NEXT_PUBLIC_SUPABASE_URL: http://localhost:{supabase_port}
+      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ANON_KEY:-your-anon-key}}
+    depends_on:
+      - kong
+
+volumes:
+  db-data:
+  storage-data:
+'''
+
+
+def generate_dockerfile() -> str:
+    """Generate Dockerfile for the Next.js app."""
+    return '''# CUI // SP-CTI
+# Multi-stage Dockerfile for Forge Studio generated app
+
+FROM node:20-alpine AS base
+
+# Install dependencies
+FROM base AS deps
+WORKDIR /app
+COPY package.json package-lock.json* ./
+RUN npm ci
+
+# Build the app
+FROM base AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN npm run build
+
+# Production image
+FROM base AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+
+RUN addgroup --system --gid 1001 nodejs
+RUN adduser --system --uid 1001 nextjs
+
+COPY --from=builder /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+EXPOSE 3000
+ENV PORT=3000
+CMD ["node", "server.js"]
+'''
+
+
+def generate_env_file() -> str:
+    """Generate .env template for Docker Compose."""
+    return """# CUI // SP-CTI
+# Environment variables for self-hosted deployment
+# Copy to .env and fill in values
+
+# PostgreSQL
+POSTGRES_PASSWORD=your-super-secret-password
+
+# JWT (must be at least 32 characters)
+JWT_SECRET=your-super-secret-jwt-token-with-at-least-32-characters-long
+
+# Supabase Keys (generate with: npx supabase gen keys)
+ANON_KEY=your-anon-key
+SERVICE_ROLE_KEY=your-service-role-key
+"""