--purge arg on remove

Author: jamesgibbons92

cmd/sst/main.go

@@ -837,6 +837,14 @@ var root = &cli.Command{
 						Long:  "Only run it for the given component.",
 					},
 				},
+				{
+					Name: "purge",
+					Type: "bool",
+					Description: cli.Description{
+						Short: "Fully remove the stage state",
+						Long:  "Remove all state associated with the stage, including the passphrase. Warning: This is irreversible and the stage's encryption key and state will be permanently lost.",
+					},
+				},
 			},
 			Run: CmdRemove,
 		},

cmd/sst/remove.go

@@ -47,6 +47,7 @@ func CmdRemove(c *cli.Cli) error {
 	err = p.Run(c.Context, &project.StackInput{
 		Command:    "remove",
 		Target:     target,
+		Purge:      c.Bool("purge"),
 		ServerPort: s.Port,
 		Verbose:    c.Bool("verbose"),
 	})

pkg/project/provider/aws.go

@@ -691,6 +691,22 @@ func (a *AwsHome) getPassphrase(app string, stage string) (string, error) {
 	return *result.Parameter.Value, nil
 }
 
+func (a *AwsHome) removePassphrase(app, stage string) error {
+	ssmClient := ssm.NewFromConfig(a.provider.config)
+
+	_, err := ssmClient.DeleteParameter(context.TODO(), &ssm.DeleteParameterInput{
+		Name: aws.String(a.pathForPassphrase(app, stage)),
+	})
+	if err != nil {
+		var pnf *ssmTypes.ParameterNotFound
+		if errors.As(err, &pnf) {
+			return nil
+		}
+		return err
+	}
+	return nil
+}
+
 func (a *AwsHome) setPassphrase(app, stage, passphrase string) error {
 	ssmClient := ssm.NewFromConfig(a.provider.config)
 

pkg/project/provider/cloudflare.go

@@ -169,6 +169,10 @@ func (c *CloudflareHome) removeData(kind, app, stage string) error {
 	return nil
 }
 
+func (c *CloudflareHome) removePassphrase(app, stage string) error {
+	return c.removeData("passphrase", app, stage)
+}
+
 // these should go into secrets manager once it's out of beta
 func (c *CloudflareHome) setPassphrase(app, stage string, passphrase string) error {
 	return c.putData("passphrase", app, stage, bytes.NewReader([]byte(passphrase)))

pkg/project/provider/local.go

@@ -65,6 +65,10 @@ func (l *LocalHome) removeData(key, app, stage string) error {
 	return os.Remove(p)
 }
 
+func (c *LocalHome) removePassphrase(app, stage string) error {
+	return c.removeData("passphrase", app, stage)
+}
+
 // these should go into secrets manager once it's out of beta
 func (c *LocalHome) setPassphrase(app, stage string, passphrase string) error {
 	return c.putData("passphrase", app, stage, bytes.NewReader([]byte(passphrase)))

pkg/project/provider/provider.go

@@ -29,6 +29,7 @@ type Home interface {
 	getPassphrase(app, stage string) (string, error)
 	listStages(app string) ([]string, error)
 	cleanup(key, app, stage string) error
+	removePassphrase(app, stage string) error
 	info() (util.KeyValuePairs[string], error)
 }
 
@@ -168,6 +169,19 @@ func Cleanup(backend Home, app, stage string) error {
 	return nil
 }
 
+func Purge(backend Home, app, stage string) error {
+	if err := backend.removeData("secret", app, stage); err != nil {
+		return err
+	}
+	if err := backend.removeData("app", app, stage); err != nil {
+		return err
+	}
+	if err := backend.removePassphrase(app, stage); err != nil {
+		return err
+	}
+	return nil
+}
+
 func GetSecrets(backend Home, app, stage string) (map[string]string, error) {
 	if stage == "" {
 		stage = "_fallback"

pkg/project/run.go

@@ -653,6 +653,9 @@ loop:
 
 	if input.Command == "remove" && len(complete.Resources) == 0 {
 		provider.Cleanup(p.home, p.app.Name, p.app.Stage)
+		if input.Purge {
+			provider.Purge(p.home, p.app.Name, p.app.Stage)
+		}
 	}
 
 	log.Info("done running stack command", "resources", len(complete.Resources))

pkg/project/stack.go

@@ -23,6 +23,7 @@ type StackInput struct {
 	Dev        bool
 	Verbose    bool
 	Continue   bool
+	Purge      bool
 	SkipHash   string
 	PolicyPath string
 }