feat: refactor gitlab to alchemy

apps/server/package.json

@@ -34,7 +34,7 @@
     "prepublishOnly": "pnpm run db:generate",
     "prestart": "npm run db:deploy",
     "start": "node --enable-source-maps dist/bootstrap.js",
-    "pretest": "pnpm run db:generate",
+    "pretest": "pnpm --filter @cpn-console/miracle run build && pnpm run db:generate",
     "test": "vitest run",
     "pretest:cov": "pnpm run db:generate",
     "test:cov": "vitest run --coverage",

apps/server/prisma.config.ts

@@ -1,22 +1,19 @@
-import path from 'node:path'
-import * as dotenv from 'dotenv'
-import { defineConfig } from 'prisma/config'
+import { defineConfig, env } from 'prisma/config'
 
 if (process.env.DOCKER !== 'true') {
-  dotenv.config({ path: '.env' })
+  process.loadEnvFile('.env')
 }
 
 if (process.env.INTEGRATION === 'true') {
-  const envInteg = dotenv.config({ path: '.env.integ' })
-  process.env = {
-    ...process.env,
-    ...(envInteg?.parsed ?? {}),
-  }
+  process.loadEnvFile('.env.integ')
 }
 
 export default defineConfig({
-  schema: path.join('src', 'prisma', 'schema'),
+  schema: 'src/prisma/schema',
   migrations: {
-    path: path.join('src', 'prisma', 'migrations'),
+    path: 'src/prisma/migrations',
+  },
+  datasource: {
+    url: env('DB_URL'),
   },
 })

apps/server/src/prisma/schema/schema.prisma

@@ -19,3 +19,12 @@ model Log {
   project   Project? @relation(fields: [projectId], references: [id])
   user      User?    @relation(fields: [userId], references: [id])
 }
+
+model AlchemyState {
+  scope     String   @db.Text
+  key       String   @db.Text
+  value     Json
+  updatedAt DateTime @updatedAt
+
+  @@id([scope, key])
+}

apps/server/src/utils/hook-wrapper.spec.ts

@@ -222,18 +222,148 @@ describe('transformToHookProject', () => {
     })))
 
     // Assert sur la transformation des environnements
-    expect(result.environments).toEqual(project.environments.map(({ permissions: _, stage, quota, ...environment }) => ({
-      quota,
-      stage: stage.name,
-      permissions: [{ permissions: { rw: true, ro: true }, userId: project.ownerId }],
-      ...environment,
-      apis: {},
-    })))
+    expect(result.environments).toEqual(project.environments.map((env: any) => {
+      const { permissions: _permissions, stage, quota, ...environment } = env
+      return {
+        quota,
+        stage: stage.name,
+        permissions: [{ permissions: { rw: true, ro: true }, userId: project.ownerId }],
+        ...environment,
+        apis: {},
+      }
+    }))
 
     // Assert sur la transformation des repositories
-    expect(result.repositories).toEqual(project.repositories.map(repo => ({ ...repo, newCreds: mockReposCreds[repo.internalRepoName] })))
+    expect(result.repositories).toEqual(project.repositories.map((repo: any) => ({ ...repo, newCreds: mockReposCreds[repo.internalRepoName] })))
 
     // Assert sur le store
     expect(result.store).toEqual(mockStore)
   })
 })
+
+describe('hook.project.upsert retry policy', () => {
+  it('does not retry when HOOK_UPSERT_PROJECT_MAX_ATTEMPTS=1', async () => {
+    const previous = process.env.HOOK_UPSERT_PROJECT_MAX_ATTEMPTS
+    process.env.HOOK_UPSERT_PROJECT_MAX_ATTEMPTS = '1'
+
+    const { vi } = await import('vitest')
+    vi.resetModules()
+    vi.doMock('@cpn-console/hooks', () => ({
+      hooks: {
+        upsertProject: {
+          execute: vi.fn().mockResolvedValue({
+            args: {},
+            results: {},
+            failed: ['observability'],
+            warning: [],
+            totalExecutionTime: 1,
+            config: {},
+            messageResume: 'Errors:\nobservability: failed;',
+          }),
+        },
+        deleteProject: { execute: vi.fn() },
+        getProjectSecrets: { execute: vi.fn() },
+        upsertProjectMember: { execute: vi.fn() },
+        deleteProjectMember: { execute: vi.fn() },
+        upsertProjectRole: { execute: vi.fn() },
+        deleteProjectRole: { execute: vi.fn() },
+        upsertCluster: { execute: vi.fn() },
+        deleteCluster: { execute: vi.fn() },
+        upsertZone: { execute: vi.fn() },
+        deleteZone: { execute: vi.fn() },
+        checkServices: { execute: vi.fn() },
+        syncRepository: { execute: vi.fn() },
+        retrieveUserByEmail: { execute: vi.fn() },
+        upsertAdminRole: { execute: vi.fn() },
+        deleteAdminRole: { execute: vi.fn() },
+      },
+    }))
+
+    vi.doMock('@/resources/project-service/business.js', () => ({
+      dbToObj: (v: any) => v ?? {},
+    }))
+
+    vi.doMock('@/resources/queries-index.js', () => {
+      const projectId = 'p1'
+      return {
+        archiveProject: vi.fn(),
+        getAdminPlugin: vi.fn().mockResolvedValue({}),
+        getAdminRoleById: vi.fn(),
+        getClusterByIdOrThrow: vi.fn(),
+        getClusterNamesByZoneId: vi.fn(),
+        getClustersAssociatedWithProject: vi.fn().mockResolvedValue([]),
+        getHookProjectInfos: vi.fn().mockResolvedValue({
+          id: projectId,
+          slug: 'fpdafpdfa',
+          name: 'infra-observability',
+          description: null,
+          status: 'initializing',
+          locked: false,
+          createdAt: new Date().toISOString(),
+          updatedAt: new Date().toISOString(),
+          everyonePerms: 0n,
+          ownerId: 'u1',
+          members: [],
+          environments: [
+            {
+              id: 'e1',
+              name: 'dev',
+              projectId,
+              createdAt: new Date().toISOString(),
+              updatedAt: new Date().toISOString(),
+              clusterId: 'c1',
+              quotaId: 'q1',
+              stageId: 's1',
+              quota: { id: 'q1', memory: '1Gi', cpu: 1, name: 'small', isPrivate: false },
+              stage: { id: 's1', name: 'dev' },
+              cluster: {
+                id: 'c1',
+                infos: null,
+                label: 'cluster',
+                privacy: 'dedicated',
+                secretName: 'sn1',
+                kubeconfig: { id: 'k1', user: {}, cluster: {} },
+                clusterResources: false,
+                zone: { id: 'z1', slug: 'default' },
+              },
+            },
+          ],
+          repositories: [],
+          plugins: [],
+          owner: {
+            id: 'u1',
+            firstName: 'Jean',
+            lastName: 'Dupont',
+            email: 'jean@example.com',
+            createdAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+            adminRoleIds: [],
+          },
+          roles: [],
+          clusters: [],
+        }),
+        getHookRepository: vi.fn(),
+        getProjectStore: vi.fn().mockResolvedValue({}),
+        getRole: vi.fn(),
+        getZoneByIdOrThrow: vi.fn(),
+        saveProjectStore: vi.fn(),
+        updateProjectClusterHistory: vi.fn(),
+        updateProjectCreated: vi.fn().mockResolvedValue({ id: projectId }),
+        updateProjectFailed: vi.fn().mockResolvedValue({ id: projectId }),
+        updateProjectWarning: vi.fn().mockResolvedValue({ id: projectId }),
+      }
+    })
+
+    const { hook } = await import('./hook-wrapper.ts')
+    await hook.project.upsert('p1')
+
+    const { hooks } = await import('@cpn-console/hooks')
+    expect((hooks.upsertProject.execute as any).mock.calls).toHaveLength(1)
+
+    if (previous === undefined) {
+      delete process.env.HOOK_UPSERT_PROJECT_MAX_ATTEMPTS
+    } else {
+      process.env.HOOK_UPSERT_PROJECT_MAX_ATTEMPTS = previous
+    }
+  })
+})

apps/server/src/utils/hook-wrapper.ts

@@ -3,6 +3,7 @@ import type { AsyncReturnType } from '@cpn-console/shared'
 import type { Cluster, Kubeconfig, Project, ProjectMembers, ProjectRole, Zone } from '@prisma/client'
 import type { ConfigRecords } from '@/resources/project-service/business.js'
 import { hooks } from '@cpn-console/hooks'
+import { logger as baseLogger } from '@cpn-console/logger'
 import { getPermsByUserRoles, ProjectAuthorized, resourceListToDict } from '@cpn-console/shared'
 import { dbToObj } from '@/resources/project-service/business.js'
 import { archiveProject, getAdminPlugin, getAdminRoleById, getClusterByIdOrThrow, getClusterNamesByZoneId, getClustersAssociatedWithProject, getHookProjectInfos, getHookRepository, getProjectStore, getRole, getZoneByIdOrThrow, saveProjectStore, updateProjectClusterHistory, updateProjectCreated, updateProjectFailed, updateProjectWarning } from '@/resources/queries-index.js'
@@ -11,6 +12,30 @@ import { genericProxy } from './proxy.js'
 export type ReposCreds = Record<Repository['internalRepoName'], RepoCreds>
 export type ProjectInfos = AsyncReturnType<typeof getHookProjectInfos>
 
+const logger = baseLogger.child({ scope: 'utils:hook-wrapper' })
+
+function summarizeHookResultForLogs(hookResult: HookResult<any>) {
+  const nonOkResults = Object.fromEntries(
+    Object.entries(hookResult.results ?? {})
+      .filter(([_pluginName, result]) => result?.status?.result !== 'OK')
+      .map(([pluginName, result]) => [
+        pluginName,
+        {
+          result: result.status.result,
+          message: result.status.result === 'OK' ? undefined : result.status.message,
+        },
+      ]),
+  )
+
+  return {
+    failed: hookResult.failed,
+    warning: hookResult.warning,
+    messageResume: hookResult.messageResume,
+    totalExecutionTime: hookResult.totalExecutionTime,
+    nonOkResults,
+  }
+}
+
 async function getProjectPayload(projectId: Project['id'], reposCreds?: ReposCreds) {
   const [
     project,
@@ -50,11 +75,55 @@ async function upsertProject(projectId: Project['id'], reposCreds?: ReposCreds)
     project,
   }
 }
+
+function getUpsertProjectMaxAttempts() {
+  const raw = process.env.HOOK_UPSERT_PROJECT_MAX_ATTEMPTS
+  const parsed = raw === undefined ? 2 : Number(raw)
+  const safe = Number.isFinite(parsed) ? Math.trunc(parsed) : 2
+  return Math.min(2, Math.max(1, safe))
+}
 const project = {
   upsert: async (projectId: Project['id'], reposCreds?: ReposCreds) => {
-    const results = await upsertProject(projectId, reposCreds)
-    // automatically retry one time if it fails
-    return results.results.failed ? upsertProject(projectId, reposCreds) : results
+    const maxAttempts = getUpsertProjectMaxAttempts()
+    const first = await upsertProject(projectId, reposCreds)
+    if (!first.results.failed) {
+      return first
+    }
+
+    if (maxAttempts <= 1) {
+      logger.warn({
+        action: 'upsertProject',
+        projectId,
+        attempt: 1,
+        maxAttempts,
+        ...summarizeHookResultForLogs(first.results),
+      }, 'Hook upsertProject failed, no retry configured')
+      return first
+    }
+
+    logger.warn({
+      action: 'upsertProject',
+      projectId,
+      attempt: 1,
+      maxAttempts,
+      ...summarizeHookResultForLogs(first.results),
+    }, 'Hook upsertProject failed, retrying once')
+
+    const second = await upsertProject(projectId, reposCreds)
+    const logPayload = {
+      action: 'upsertProject',
+      projectId,
+      attempt: 2,
+      maxAttempts,
+      ...summarizeHookResultForLogs(second.results),
+    }
+    if (second.results.failed) {
+      logger.error(logPayload, 'Hook upsertProject retry failed')
+    } else {
+      logger.info(logPayload, 'Hook upsertProject retry succeeded')
+    }
+
+    return second
   },
   delete: async (projectId: Project['id']) => {
     const [payload, config] = await Promise.all([

packages/miracle/eslint.config.js

@@ -0,0 +1,3 @@
+import eslintConfigBase from '@cpn-console/eslint-config'
+
+export default eslintConfigBase

packages/miracle/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@cpn-console/miracle",
+  "type": "module",
+  "version": "0.1.0",
+  "private": false,
+  "description": "Alchemy-based wrappers for external service APIs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/cloud-pi-native/console"
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "types/index.d.ts",
+  "files": [
+    "dist",
+    "types"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "build:clean": "node --input-type=module -e \"import { rm } from 'node:fs/promises'; await rm('./dist', { recursive: true, force: true }); await rm('./types', { recursive: true, force: true }); await rm('./tsconfig.tsbuildinfo', { force: true });\"",
+    "format": "eslint ./ --fix",
+    "lint": "eslint ./",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "@gitbeaker/core": "^40.6.0",
+    "@gitbeaker/rest": "^40.6.0",
+    "@prisma/client": "6.19.2",
+    "alchemy": "^0.23.0"
+  },
+  "devDependencies": {
+    "@cpn-console/eslint-config": "workspace:^",
+    "@cpn-console/ts-config": "workspace:^",
+    "@types/node": "^24.12.0",
+    "typescript": "^5.9.3",
+    "vitest": "^2.1.9"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public",
+    "tag": "latest"
+  }
+}