fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(cli): add pic triggers + dead-letters + secrets subcommands

Browse Source 
Closes the audit's High-severity CLI coverage gap, raising the count
from ~25 to ~40+ subcommands and bringing the integration test count
from 63 to 73.

- pic triggers {ls, rm, create-kv, create-cron, create-dead-letter,
  create-from-json}: three per-kind wrappers cover the most common
  trigger shapes; the generic create-from-json is the escape hatch
  for docs/files/pubsub/email/queue and any future advanced retry
  knobs — body JSON inline, via @<file>, or "-" for stdin.

- pic dead-letters {ls, show, replay, resolve}: full operator
  workflow for the dispatcher's dead_letters rows, including the
  --unresolved filter and the per-row replay + manual-resolve actions.

- pic secrets {ls, set, rm}: list names + updated_at, set values
  via stdin (the only secure channel — inline values would leak
  into shell history), and delete by name. --json on set treats
  stdin as raw JSON for non-string values.

Ten new integration tests follow the established #[ignore] pattern,
gated on DATABASE_URL. All 73 ignored tests pass against the local
dev stack.

The `pic admin reset-password` server-binary subcommand exists on
the picloud binary side already; the audit's "surface it in pic
--help" note is a one-line addition deferred to Stage 6 with the
other small UX touches.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-06-10 21:41:57 +02:00
parent 59645e8159
commit 24490d5ddb
10 changed files with 1215 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

293
crates/picloud-cli/src/main.rs
View File

@@ -84,6 +84,32 @@ enum Cmd {
#[command(subcommand)]
cmd: AdminsCmd,
},
/// Trigger management — list / create / delete the triggers that
/// fire scripts on KV mutations, cron schedules, dead-letter rows,
/// etc. `create-from-json` is the escape hatch for kinds the CLI
/// doesn't expose a per-kind wrapper for (docs/files/pubsub/email/
/// queue) — pass the body JSON inline, via `@<file>`, or `-` to
/// read from stdin.
Triggers {
#[command(subcommand)]
cmd: TriggersCmd,
},
/// Dead-letter management — inspect, replay, and resolve rows the
/// dispatcher wrote after exhausting a trigger's retries.
#[command(name = "dead-letters")]
DeadLetters {
#[command(subcommand)]
cmd: DeadLettersCmd,
},
/// Per-app secret storage — list names, set values from stdin,
/// delete by name. Values never leave the server after `set`.
Secrets {
#[command(subcommand)]
cmd: SecretsCmd,
},
}
#[derive(Args)]
@@ -214,6 +240,15 @@ impl From<DispatchModeArg> for picloud_shared::DispatchMode {
}
}
/// Wire form for trigger dispatch — the trigger handlers accept
/// `"sync"` / `"async"` as JSON strings, so we send that directly.
const fn dispatch_wire(d: DispatchModeArg) -> &'static str {
match d {
DispatchModeArg::Sync => "sync",
DispatchModeArg::Async => "async",
}
}
#[derive(Clone, Copy, ValueEnum)]
enum HostKindArg {
/// Any host (default).
@@ -338,6 +373,167 @@ enum RoutesCmd {
},
}
#[derive(Subcommand)]
enum TriggersCmd {
/// List every trigger in an app.
Ls {
#[arg(long)]
app: String,
},
/// Delete a trigger by id.
Rm {
#[arg(long)]
app: String,
trigger_id: String,
},
/// Create a KV trigger.
#[command(name = "create-kv")]
CreateKv {
#[arg(long)]
app: String,
#[arg(long)]
script: String,
/// Glob over collection names (`*`, `users`, `events_*`, …).
#[arg(long)]
collection: String,
/// Repeat to filter ops: `--op insert --op delete`. Empty
/// (the default) means any op fires the trigger.
#[arg(long = "op")]
ops: Vec<String>,
#[arg(long, value_enum, default_value_t = DispatchModeArg::Async)]
dispatch: DispatchModeArg,
},
/// Create a cron trigger.
#[command(name = "create-cron")]
CreateCron {
#[arg(long)]
app: String,
#[arg(long)]
script: String,
/// 6-field cron expression (with seconds).
#[arg(long)]
schedule: String,
/// IANA timezone name. Defaults to UTC.
#[arg(long)]
timezone: Option<String>,
#[arg(long, value_enum, default_value_t = DispatchModeArg::Async)]
dispatch: DispatchModeArg,
},
/// Create a dead-letter trigger — fires when ANOTHER trigger's
/// retries exhaust. Filters narrow the match: omit to fire on
/// every DL in the app.
#[command(name = "create-dead-letter")]
CreateDeadLetter {
#[arg(long)]
app: String,
#[arg(long)]
script: String,
/// Source filter — match only DL rows that originated from
/// `kv` / `docs` / `queue` / etc.
#[arg(long = "source-filter")]
source_filter: Option<String>,
/// Trigger id filter — match only DL rows from one trigger.
#[arg(long = "trigger-id-filter")]
trigger_id_filter: Option<String>,
/// Script id filter — match only DL rows from one script.
#[arg(long = "script-id-filter")]
script_id_filter: Option<String>,
#[arg(long, value_enum, default_value_t = DispatchModeArg::Async)]
dispatch: DispatchModeArg,
},
/// Create a trigger of any kind from a raw JSON body — escape
/// hatch for kinds the CLI doesn't expose per-kind wrappers for
/// (docs/files/pubsub/email/queue) and for advanced retry/dispatch
/// settings beyond the per-kind defaults.
#[command(name = "create-from-json")]
CreateFromJson {
#[arg(long)]
app: String,
/// Trigger kind: `kv`, `docs`, `cron`, `files`, `pubsub`,
/// `dead_letter`, `email`, or `queue`.
#[arg(long)]
kind: String,
/// Body JSON. Pass inline, `@<file>`, or `-` for stdin.
#[arg(long)]
body: String,
},
}
#[derive(Subcommand)]
enum DeadLettersCmd {
/// List dead-letter rows for an app.
Ls {
#[arg(long)]
app: String,
/// Show only unresolved rows.
#[arg(long)]
unresolved: bool,
#[arg(long, default_value_t = 50)]
limit: u32,
},
/// Show a single dead-letter row's full payload.
Show {
#[arg(long)]
app: String,
dl_id: String,
},
/// Re-enqueue the original event so the trigger fires again. The
/// DL row is marked resolved with reason `replayed`.
Replay {
#[arg(long)]
app: String,
dl_id: String,
},
/// Mark a DL row resolved without replaying. Useful for permanent
/// failures the operator has already addressed manually.
Resolve {
#[arg(long)]
app: String,
dl_id: String,
/// Free-form resolution reason. Required by the server.
#[arg(long)]
reason: String,
},
}
#[derive(Subcommand)]
enum SecretsCmd {
/// List secret names + last-modified for an app. Values never
/// leave the server.
Ls {
#[arg(long)]
app: String,
},
/// Set a secret. Reads the value from stdin (the only safe
/// channel — inline values would land in shell history). Pipe
/// the value in: `echo -n "mysecret" | pic secrets set --app foo my_key`.
Set {
#[arg(long)]
app: String,
name: String,
/// Treat stdin as raw JSON (numbers, maps, …) instead of a
/// string literal.
#[arg(long)]
json: bool,
},
/// Delete a secret by name.
Rm {
#[arg(long)]
app: String,
name: String,
},
}
#[derive(Subcommand)]
enum AdminsCmd {
/// List admin accounts.
@@ -555,6 +751,103 @@ async fn main() -> ExitCode {
Cmd::Admins {
cmd: AdminsCmd::Rm { id },
} => cmds::admins::rm(&id).await,
Cmd::Triggers {
cmd: TriggersCmd::Ls { app },
} => cmds::triggers::ls(&app, mode).await,
Cmd::Triggers {
cmd: TriggersCmd::Rm { app, trigger_id },
} => cmds::triggers::rm(&app, &trigger_id).await,
Cmd::Triggers {
cmd:
TriggersCmd::CreateKv {
app,
script,
collection,
ops,
dispatch,
},
} => {
cmds::triggers::create_kv(
&app,
&script,
&collection,
&ops,
dispatch_wire(dispatch),
mode,
)
.await
}
Cmd::Triggers {
cmd:
TriggersCmd::CreateCron {
app,
script,
schedule,
timezone,
dispatch,
},
} => {
cmds::triggers::create_cron(
&app,
&script,
&schedule,
timezone.as_deref(),
dispatch_wire(dispatch),
mode,
)
.await
}
Cmd::Triggers {
cmd:
TriggersCmd::CreateDeadLetter {
app,
script,
source_filter,
trigger_id_filter,
script_id_filter,
dispatch,
},
} => {
cmds::triggers::create_dead_letter(
&app,
&script,
source_filter.as_deref(),
trigger_id_filter.as_deref(),
script_id_filter.as_deref(),
dispatch_wire(dispatch),
mode,
)
.await
}
Cmd::Triggers {
cmd: TriggersCmd::CreateFromJson { app, kind, body },
} => cmds::triggers::create_from_json(&app, &kind, &body, mode).await,
Cmd::DeadLetters {
cmd:
DeadLettersCmd::Ls {
app,
unresolved,
limit,
},
} => cmds::dead_letters::ls(&app, unresolved, limit, mode).await,
Cmd::DeadLetters {
cmd: DeadLettersCmd::Show { app, dl_id },
} => cmds::dead_letters::show(&app, &dl_id, mode).await,
Cmd::DeadLetters {
cmd: DeadLettersCmd::Replay { app, dl_id },
} => cmds::dead_letters::replay(&app, &dl_id).await,
Cmd::DeadLetters {
cmd: DeadLettersCmd::Resolve { app, dl_id, reason },
} => cmds::dead_letters::resolve(&app, &dl_id, &reason).await,
Cmd::Secrets {
cmd: SecretsCmd::Ls { app },
} => cmds::secrets::ls(&app, mode).await,
Cmd::Secrets {
cmd: SecretsCmd::Set { app, name, json },
} => cmds::secrets::set(&app, &name, json).await,
Cmd::Secrets {
cmd: SecretsCmd::Rm { app, name },
} => cmds::secrets::rm(&app, &name).await,
};
match result {