Add a server-side, atomic, declarative reconcile loop for a single app —
the foundation of the project-tool design. Developers describe an app's
scripts, routes, triggers, and secret-names in `picloud.toml`, then
`pic pull / plan / apply [--prune]` to converge live state to the manifest.
Server (manager-core):
- apply_service: a pure diff engine (compute_diff) shared by plan and
apply, plus an ApplyService that composes the existing per-repo writes
into ONE Postgres transaction. Identity keys mirror the DB UNIQUE
constraints (script=lower(name); route=(method,host_kind,host,
path_kind,path); trigger=per-kind semantic tuple; secret=name).
Apply takes a per-app advisory lock, recomputes the diff in-tx, applies
scripts -> routes -> triggers, prunes dependents-first, commits, then
refreshes the route table once post-commit.
- apply_api: POST /apps/{id}/plan (AppRead) and /apps/{id}/apply.
Apply requires the per-kind write caps the bundle exercises (all three
when --prune), plus AppSecretsRead when it binds an email trigger.
- tx-accepting repo siblings (insert/update/delete *_tx) so the existing
create/update/delete delegate to one SQL definition each.
- email triggers reference an inbound secret by NAME; the value is
resolved, decrypted (AAD-bound), and re-sealed server-side at apply —
it never travels in the manifest.
CLI (picloud-cli):
- manifest.rs (picloud.toml model), client plan/apply, and the pull/plan/
apply commands. pull rejects filesystem-unsafe script names up front.
Safety properties enforced and tested:
- idempotent: a freshly-pulled manifest re-applies as all-NoOp.
- atomic: a mid-bundle failure rolls back with nothing written.
- routes delete-before-insert so a freed binding is reusable in one apply.
- queue one-consumer invariant held inside the shared tx.
- email triggers are never pruned, and a script that still owns an
email/dead-letter trigger can't be pruned (the FK cascade would destroy
the sealed secret) — refused with a pointer to `pic triggers rm`.
- plan and apply agree on unset email-secret references.
No migration: the existing schema's UNIQUE constraints serve as identity
keys. Groups, env-scoping, and the `enabled` toggle are later milestones.
Tested: manager-core lib (360) + CLI bins (27) + 8 project-tool journeys
(pull/plan/apply/prune/email+queue), all green; clippy -D warnings clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
154 lines
4.6 KiB
Rust
154 lines
4.6 KiB
Rust
//! `pic apply` journey: apply a manifest to an empty app (atomic create),
|
|
//! re-apply is an idempotent no-op, and a bundle containing any invalid
|
|
//! resource applies nothing (all-or-nothing).
|
|
|
|
use std::fs;
|
|
|
|
use tempfile::TempDir;
|
|
|
|
use crate::common;
|
|
use crate::common::cleanup::AppGuard;
|
|
|
|
fn manifest_dir() -> TempDir {
|
|
let dir = TempDir::new().expect("tempdir");
|
|
fs::create_dir_all(dir.path().join("scripts")).expect("scripts dir");
|
|
dir
|
|
}
|
|
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn apply_creates_then_noop() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let slug = common::unique_slug("apply");
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &slug])
|
|
.assert()
|
|
.success();
|
|
let _guard = AppGuard::new(&env.url, &env.token, &slug);
|
|
|
|
let dir = manifest_dir();
|
|
fs::write(
|
|
dir.path().join("scripts/greet.rhai"),
|
|
"let body = #{ ok: true }; body",
|
|
)
|
|
.unwrap();
|
|
let manifest = format!(
|
|
"[app]\nslug = \"{slug}\"\nname = \"Apply Test\"\n\n\
|
|
[[scripts]]\nname = \"greet\"\nfile = \"scripts/greet.rhai\"\n\n\
|
|
[[routes]]\nscript = \"greet\"\nmethod = \"POST\"\n\
|
|
host_kind = \"any\"\npath_kind = \"exact\"\npath = \"/greet\"\n\n\
|
|
[[triggers.cron]]\nscript = \"greet\"\nschedule = \"0 0 * * * *\"\ntimezone = \"UTC\"\n"
|
|
);
|
|
let manifest_path = dir.path().join("picloud.toml");
|
|
fs::write(&manifest_path, &manifest).unwrap();
|
|
|
|
// First apply: creates script + route + trigger.
|
|
let out = common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(&manifest_path)
|
|
.output()
|
|
.expect("apply");
|
|
assert!(
|
|
out.status.success(),
|
|
"apply failed: {}",
|
|
String::from_utf8_lossy(&out.stderr)
|
|
);
|
|
let stdout = String::from_utf8(out.stdout).unwrap();
|
|
assert!(
|
|
stdout.contains("+1"),
|
|
"expected creations in report:\n{stdout}"
|
|
);
|
|
|
|
// The resources now exist.
|
|
let s = String::from_utf8(
|
|
common::pic_as(&env)
|
|
.args(["scripts", "ls", "--app", &slug])
|
|
.output()
|
|
.unwrap()
|
|
.stdout,
|
|
)
|
|
.unwrap();
|
|
assert!(s.contains("greet"), "script not created:\n{s}");
|
|
|
|
// Plan is now clean (apply reached desired state).
|
|
let p = String::from_utf8(
|
|
common::pic_as(&env)
|
|
.args(["plan", "--file"])
|
|
.arg(&manifest_path)
|
|
.output()
|
|
.unwrap()
|
|
.stdout,
|
|
)
|
|
.unwrap();
|
|
assert!(
|
|
!p.contains("create") && !p.contains("update"),
|
|
"expected clean plan after apply:\n{p}"
|
|
);
|
|
|
|
// Re-apply: idempotent — nothing created/updated.
|
|
let r = String::from_utf8(
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(&manifest_path)
|
|
.output()
|
|
.unwrap()
|
|
.stdout,
|
|
)
|
|
.unwrap();
|
|
assert!(!r.contains("+1"), "re-apply should be a no-op:\n{r}");
|
|
}
|
|
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn apply_rejects_bad_bundle_atomically() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let slug = common::unique_slug("apply-atomic");
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &slug])
|
|
.assert()
|
|
.success();
|
|
let _guard = AppGuard::new(&env.url, &env.token, &slug);
|
|
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/good.rhai"), "let x = 1; x").unwrap();
|
|
// Invalid Rhai — fails validation, so the whole apply must abort.
|
|
fs::write(dir.path().join("scripts/bad.rhai"), "let x = ;").unwrap();
|
|
let manifest = format!(
|
|
"[app]\nslug = \"{slug}\"\nname = \"Atomic Test\"\n\n\
|
|
[[scripts]]\nname = \"good\"\nfile = \"scripts/good.rhai\"\n\n\
|
|
[[scripts]]\nname = \"bad\"\nfile = \"scripts/bad.rhai\"\n"
|
|
);
|
|
let manifest_path = dir.path().join("picloud.toml");
|
|
fs::write(&manifest_path, &manifest).unwrap();
|
|
|
|
let out = common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(&manifest_path)
|
|
.output()
|
|
.expect("apply");
|
|
assert!(
|
|
!out.status.success(),
|
|
"apply with an invalid script should fail"
|
|
);
|
|
|
|
// Atomic: the valid script must NOT have been created.
|
|
let s = String::from_utf8(
|
|
common::pic_as(&env)
|
|
.args(["scripts", "ls", "--app", &slug])
|
|
.output()
|
|
.unwrap()
|
|
.stdout,
|
|
)
|
|
.unwrap();
|
|
assert!(
|
|
!s.contains("good"),
|
|
"a failed apply must leave nothing behind:\n{s}"
|
|
);
|
|
}
|