claude-hdb
a10349d835
Public tool, private state. cast holds no hostnames, no bindings, no secrets: it joins a product repo's .infra/ manifest with a state directory you point it at, and makes Coolify match. Extracted from heavy-duty/infra, which was half tool and half state — the inconsistency that made it impossible to say whether "infra" named a CLI or a runbook. rig builds the boxes; cast fills them; infra is what they are filled with. Two changes were required to make it genuinely stateless and publishable: - The implicit cwd contract (environments.yaml / secrets/ / .coolify.env resolved against the working directory, silently reading the wrong file from the wrong place) is now an explicit --state <dir> / $CAST_STATE. - BANNED_IN_PROD — a hardcoded list of one product's ALLOW_* flags, the only product knowledge in the executor — becomes the generic, operator- owned environments.<env>.forbidden_var_patterns. The guard now lives in private state, so a product-side change cannot lower its own guard, and it is a pattern rather than a list, so it catches unforeseen siblings. Age identities resolve as $CAST_AGE_KEY_FILE_<ENV> then ~/.config/cast/age-<env>.key — which is the entire attended-vs-unattended apply mechanism, with no environment names known to the tool. Instance identity (org names, the GitHub App name, founder domains) is out of the fixtures and out of register-github-app.sh, which took APP_NAME and ORG as arguments rather than baking them in. 69 tests green; bin/cast + curl installer mirror rig's shape. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
113 lines
3.2 KiB
TypeScript
113 lines
3.2 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { computeDiff, renderDiff } from "../src/diff.js";
|
|
|
|
const desiredApp = {
|
|
kind: "application" as const,
|
|
name: "core-api",
|
|
fields: { build_pack: "nixpacks", domains: ["https://api.example.com"] },
|
|
env: {
|
|
vars: {
|
|
PORT: { value: "3000", secret: false },
|
|
MAILGUN_KEY: { value: "mk-123", secret: true },
|
|
},
|
|
},
|
|
};
|
|
|
|
describe("computeDiff", () => {
|
|
it("plans a create when live is missing", () => {
|
|
const r = computeDiff([desiredApp], [], "full");
|
|
expect(r.changes).toHaveLength(1);
|
|
expect(r.changes[0].op).toBe("create");
|
|
expect(r.clean).toBe(false);
|
|
});
|
|
it("is clean when live matches", () => {
|
|
const r = computeDiff(
|
|
[desiredApp],
|
|
[
|
|
{
|
|
kind: "application",
|
|
name: "core-api",
|
|
uuid: "u1",
|
|
fields: { ...desiredApp.fields },
|
|
env: { PORT: "3000", MAILGUN_KEY: "mk-123" },
|
|
},
|
|
],
|
|
"full",
|
|
);
|
|
expect(r.clean).toBe(true);
|
|
});
|
|
it("marks build_pack drift as non-updatable", () => {
|
|
const r = computeDiff(
|
|
[desiredApp],
|
|
[
|
|
{
|
|
kind: "application",
|
|
name: "core-api",
|
|
uuid: "u1",
|
|
fields: { build_pack: "static", domains: desiredApp.fields.domains },
|
|
env: { PORT: "3000", MAILGUN_KEY: "mk-123" },
|
|
},
|
|
],
|
|
"full",
|
|
);
|
|
expect(r.changes[0].fieldDiffs).toEqual([
|
|
{
|
|
field: "build_pack",
|
|
desired: "nixpacks",
|
|
live: "static",
|
|
updatable: false,
|
|
},
|
|
]);
|
|
});
|
|
it("full mode diffs env; structural mode does not", () => {
|
|
const live = [
|
|
{
|
|
kind: "application" as const,
|
|
name: "core-api",
|
|
uuid: "u1",
|
|
fields: { ...desiredApp.fields },
|
|
env: { PORT: "3000", MAILGUN_KEY: "OLD", EXTRA: "x" },
|
|
},
|
|
];
|
|
const full = computeDiff([desiredApp], live, "full");
|
|
expect(full.changes[0].envDiffs).toEqual([
|
|
{ key: "MAILGUN_KEY", state: "change", secret: true },
|
|
{ key: "EXTRA", state: "remove-candidate", secret: false },
|
|
]);
|
|
expect(computeDiff([desiredApp], live, "structural").clean).toBe(true);
|
|
});
|
|
it("reports orphans, never plans deletion", () => {
|
|
const r = computeDiff(
|
|
[],
|
|
[{ kind: "service", name: "old-thing", uuid: "u9", fields: {} }],
|
|
"full",
|
|
);
|
|
expect(r.changes).toHaveLength(0);
|
|
expect(r.orphans).toEqual([
|
|
{ kind: "service", name: "old-thing", uuid: "u9" },
|
|
]);
|
|
expect(r.clean).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe("renderDiff", () => {
|
|
it("never prints secret values", () => {
|
|
const live = [
|
|
{
|
|
kind: "application" as const,
|
|
name: "core-api",
|
|
uuid: "u1",
|
|
fields: { ...desiredApp.fields },
|
|
env: { PORT: "3000", MAILGUN_KEY: "OLD-SECRET" },
|
|
},
|
|
];
|
|
const out = renderDiff(computeDiff([desiredApp], live, "full"));
|
|
expect(out).toContain("secret MAILGUN_KEY differs");
|
|
expect(out).not.toContain("mk-123");
|
|
expect(out).not.toContain("OLD-SECRET");
|
|
});
|
|
it("structural mode says env was not compared", () => {
|
|
const out = renderDiff(computeDiff([desiredApp], [], "structural"));
|
|
expect(out).toMatch(/env vars not compared \(structural mode/);
|
|
});
|
|
});
|