feat(cli): db + s3 resource verbs (spec 29) - #88
Merged
Conversation
Extend provision.Postgres with EnsureRole/Grant/EnsureDatabase (existence- guarded, idempotent) and dispatch resource.Postgres.Ensure by kind: role/user create a tenant LOGIN role (optional GRANT read|write|admin on a target db), database with an owner param does CREATE DATABASE ... OWNER <role> with no new role. Table-driven mock-Conn tests for each path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…29 stage 2) New internal/resource/minio.go: bucket create/remove/list + object lifecycle (expiry + optional transition), versioning toggle, bucket policy, and CORS via the pure-Go aws-sdk-go-v2 S3 client (path-style, MinIO root creds) behind a mockable S3API seam. Wire it into the orchestrate registry with a 127.0.0.1 minio-provision overlay (port base 49000, container port 9000, distinct from postgres 45432); generalize writeProvisionOverlay with a container-port arg and add UpDeps.S3Factory + orchestrate/minio_ops.go bucket helpers. Fake-S3 unit tests for every op + an orchestrate wiring test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
db group (graduates the reserved db stub): create/user create/grant/list/drop/ gc — tenant-scoped Postgres databases + roles/grants through the resource_ops lock->overlay->provisioner->ledger->event flow, --json + confirm-gated drop/gc. s3 group: mb/rb/ls/lifecycle set|get|rm/versioning/policy set|get/cors set|get on the MinIO provisioner, project-prefixed buckets with --no-prefix. aws -- shim: argv passthrough over the host aws binary with --endpoint-url/--region prepended and dev creds injected via child env (never argv), clear error when absent. Table-driven CLI tests: registration, flags, --json, arg passthrough, absent- binary error, prefix + transition + cors parsing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spec 29 (db + object-storage half) — the first imperative resource verbs on the spec-27 substrate. Built in a worktree, verified locally (
make ci+ determinism + CGO=0 4-target cross-build green; MinIO came up healthy end-to-end).db—create(tenant db owned by the project role),user create(--role read|write|admin),grant,list,drop,gc. Extendsprovision.Postgreswith existence-guardedEnsureRole/Grant/EnsureDatabase. Graduates the reserveddbstub.s3—mb/rb/ls,lifecycle set --expire-days/--transition,versioning on|off,policy,cors. New pure-Go MinIO/S3 provisioner viaaws-sdk-go-v2/service/s3(path-style, behind a mockableS3APIseam), reached over a newminio-provision127.0.0.1 host-port overlay (port base 49000). Buckets are project-prefixed (--no-prefixescape).aws --— thin argv passthrough to the hostawsCLI with--endpoint-url/--region+ dev creds prefilled (never reimplements AWS; clear absent-binary error).Every mutation flows through the flock; reads lock-free; tenant-scoped. New dep:
aws-sdk-go-v2(S3) — pure-Go, confirmed CGO-free in the static cross-build.make vulnis unchanged pre-existing go1.26-toolchain noise (aws-sdk not called).Follow-ups (noted):
aws --helpstarts the engine to resolve the endpoint (should short-circuit bare help);s3 rb --forceobject-purge loop; generated-cred → Pusher delivery (Full scope). Messaging verbs are Phase 3b.🤖 Generated with Claude Code