Made by@slashcloneAdd demo accounts and starter content to production
@slashclone/seed-through-the-real-path
Fill a production app with demo accounts and starter content safely, through its own API or CLI instead of raw database inserts. Validation and audit logs run as for any user. Idempotent scripts with a dry run, short-lived tokens in a private file, a cleanup step that revokes them, and a guard that shows which database you are about to write to. Never prints tokens.
- Activity
- New: be the first to try it
- Installs
- 0 installs
- Likes
- 0 likes
- Clones
- 0 clones
- 1#!/usr/bin/env node
- 2// seed-guard: two safety checks to run before seeding a production app.
- 3//
- 4// target Layer env files in order (later files win), then print only the
- 5// host of one URL variable, so you know which database or API a
- 6// seeding script will reach. Never prints the URL or credentials.
- 7// tokens Check a seeding token file: outside the repo, mode 0600, valid
- 8// JSON of account name to token. Prints account names only.
- 9//
- 10// Usage:
- 11// node scripts/seed-guard.mjs target --env-file .env --env-file .env.production --var DATABASE_URL --expect prod
- 12// node scripts/seed-guard.mjs tokens --file /secure/place/seed-tokens.json
- 13//
- 14// Import readTokenFile() from your own seeding scripts so every reader of the
- 15// token file fails with a generic message instead of echoing its contents.
- 16//
- 17// Node 22 or newer, standard library only.
- 18import { readFileSync, statSync } from "node:fs";
- 19import { isAbsolute, relative, resolve } from "node:path";
- 20import { fileURLToPath } from "node:url";
- 21import { parseArgs, parseEnv } from "node:util";
- 23export class GuardError extends Error {}
- 25/** Merge env files in order. A later file overrides an earlier one. Values are never printed. */
- 26export function layerEnvFiles(files) {
- 27 const merged = {};
- 28 for (const file of files) {
- 29 let text;
- 30 try {
- 31 text = readFileSync(file, "utf8");
- 32 } catch {
- 33 throw new GuardError(`Could not read env file ${file}.`);
- 34 }
- 35 let parsed;
- 36 try {
- 37 parsed = parseEnv(text);
- 38 } catch {
- 39 throw new GuardError(`Could not parse env file ${file}.`);
- 40 }
- 41 Object.assign(merged, parsed);
- 42 }
- 43 return merged;
- 44}
- 46/** The host of a URL value, or a GuardError that does not quote the value. */
- 47export function hostOf(value, name) {
- 48 if (!value) throw new GuardError(`${name} is not set in the env files given.`);
- 49 try {
- 50 const url = new URL(value);
- 51 if (!url.hostname) throw new Error("no host");
- 52 return url.hostname;
- 53 } catch {
- 54 throw new GuardError(`${name} is not a URL with a host.`);
- 55 }
- 56}
- 58/**
- 59 * Read a seeding token file safely. Errors never include the file's contents.
- 60 * Returns a map of account name to token.
- 61 */
- 62export function readTokenFile(file, { repo = process.cwd(), checkMode = true } = {}) {
- 63 const path = resolve(file);
- 64 const rel = relative(resolve(repo), path);
- 65 if (rel === "" || (!rel.startsWith("..") && !isAbsolute(rel))) {
- 66 throw new GuardError("The token file is inside the repo. Move it outside the repo.");
- 67 }
- 68 let stats;
- 69 try {
- 70 stats = statSync(path);
- 71 } catch {
- 72 throw new GuardError("The token file does not exist or cannot be read.");
- 73 }
- 74 if (checkMode && process.platform !== "win32" && (stats.mode & 0o077) !== 0) {
- 75 throw new GuardError("The token file is readable by others. Run: chmod 600 on it.");
- 76 }
- 77 let data;
- 78 try {
- 79 data = JSON.parse(readFileSync(path, "utf8"));
- 80 } catch {
- 81 throw new GuardError("The token file is not valid JSON. Contents not shown.");
- 82 }
- 83 if (!data || typeof data !== "object" || Array.isArray(data)) {
- 84 throw new GuardError("The token file must be a JSON object of account name to token.");
- 85 }
- 86 for (const [name, token] of Object.entries(data)) {
- 87 if (typeof token !== "string" || token.length === 0) {
- 88 throw new GuardError(`The entry for ${name} is not a token string.`);
- 89 }
- 90 }
- 91 return data;
- 92}
- 94function main(argv) {
- 95 const [command, ...rest] = argv;
- 96 const { values } = parseArgs({
- 97 args: rest,
- 98 options: {
- 99 "env-file": { type: "string", multiple: true, default: [] },
- 100 var: { type: "string", default: "DATABASE_URL" },
- 101 expect: { type: "string" },
- 102 file: { type: "string" },
- 103 repo: { type: "string", default: process.cwd() },
- 104 },
- 105 });
- 107 if (command === "target") {
- 108 if (values["env-file"].length === 0) throw new GuardError("Give at least one --env-file.");
- 109 const env = layerEnvFiles(values["env-file"]);
- 110 const host = hostOf(env[values.var], values.var);
- 111 console.log(`${values.var} points at host: ${host}`);
- 112 if (values.expect && !host.includes(values.expect)) {
- 113 throw new GuardError(
- 114 `Host does not contain "${values.expect}". Stop and check the env files.`,
- 115 );
- 116 }
- 117 return;
- 118 }
- 120 if (command === "tokens") {
- 121 if (!values.file) throw new GuardError("Give --file with the token file path.");
- 122 const tokens = readTokenFile(values.file, { repo: values.repo });
- 123 const names = Object.keys(tokens);
- 124 console.log(`Token file ok: ${String(names.length)} account(s): ${names.join(", ")}`);
- 125 return;
- 126 }
- 128 throw new GuardError("Usage: seed-guard.mjs target|tokens [options]. See the top of the file.");
- 129}
- 131if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
- 132 try {
- 133 main(process.argv.slice(2));
- 134 } catch (error) {
- 135 // Print only our own messages. Anything else gets a generic line, so a
- 136 // stray error can never quote a secret into a log.
- 137 console.error(
- 138 error instanceof GuardError ? error.message : "seed-guard failed. Details hidden.",
- 139 );
- 140 process.exit(1);
- 141 }
- 142}