fix(iac): converge empty tcpProxies and import database networking (#1169)

* fix(iac): converge empty tcpProxies and import database networking

`tcp: []` compiles to `tcpProxies: {}` while Railway serializes a
proxy-less service with no `tcpProxies` key, so a database (or service)
declared private re-planned `Update <name> networking` after every
successful apply. Empty networking maps now normalize away before the
diff.

Database nodes also import their live networking through the same helper
services use, `railway config pull` writes it back as
`db.networking = { tcpProxies: { "5432": {} } }` when a proxy exists, and
a database node without a networking block keeps the exposure it has.

Fixes #1168

* fix(iac): plan the effect of an authored networking block, not the block

`environmentApplyChangeSet` reads `networking` as a sparse patch: a key the
author leaves out stays as Railway has it, and inside `tcpProxies` an entry
keeps or creates a proxy, a `null` entry deletes one, and an unmentioned port
is left alone — so an empty map changes nothing.

Diffing the block as if it were the whole desired state promised three changes
the apply never makes, and re-planned every one of them after each apply:
`tcpProxies` left out, `privateNetworkEndpoint` left out, and `tcpProxies: {}`
against a live proxy.

The plan now diffs the block's effect, so a change is planned only when the
apply will move something, while the change set still carries the block as
written — that is the payload the apply sends, and a `null` entry is how a
proxy gets deleted. `tcpProxies: { "5432": null }` converges once the apply
has removed the proxy, and an empty map warns that it cannot remove one
instead of planning a removal that never lands.

Author: paulocsanz

src/commands/config/mod.rs

@@ -738,6 +738,12 @@ fn render_graph_as_railway(
                         lang,
                         &mut out,
                     );
+                    render_database_networking_overrides(
+                        resource.networking.as_ref(),
+                        &var_name,
+                        lang,
+                        &mut out,
+                    );
                 }
             }
             "service" => {
@@ -1138,6 +1144,42 @@ fn render_database_deploy_overrides(
     }
 }
 
+/// A database's public exposure is authored on the helper result, e.g.
+/// `db.networking = { tcpProxies: { "5432": {} } }`, so a pulled file keeps the
+/// proxy it found and a plan sees the drift when one appears or disappears.
+/// Service domains are platform-generated and stay out of the file.
+fn render_database_networking_overrides(
+    networking: Option<&serde_json::Value>,
+    var_name: &str,
+    lang: AuthoringLang,
+    out: &mut String,
+) {
+    let Some(networking) = networking.and_then(|value| value.as_object()) else {
+        return;
+    };
+    let mut overrides = networking.clone();
+    overrides.remove("serviceDomains");
+    overrides.retain(|_, value| !value.as_object().is_some_and(|map| map.is_empty()));
+    if overrides.is_empty() {
+        return;
+    }
+    let value = serde_json::Value::Object(overrides);
+    match lang {
+        AuthoringLang::TypeScript => out.push_str(&format!(
+            "  {var_name}.networking = {};\n",
+            ts_value(&value)
+        )),
+        AuthoringLang::Python => out.push_str(&format!(
+            "    # networking overrides: {}\n",
+            code_value(&value, lang)
+        )),
+        AuthoringLang::Go => out.push_str(&format!(
+            "  // networking overrides: {}\n",
+            code_value(&value, lang)
+        )),
+    }
+}
+
 fn render_volume_attachments(
     attachments: Option<&serde_json::Map<String, serde_json::Value>>,
     resource_names: &std::collections::HashMap<String, String>,
@@ -2044,6 +2086,64 @@ mod tests {
         }
     }
 
+    fn database_resource(
+        name: &str,
+        engine: &str,
+        networking: Option<serde_json::Value>,
+    ) -> runner::DesiredResource {
+        runner::DesiredResource {
+            address: Some(format!("database.{name}")),
+            r#type: "database".to_string(),
+            name: name.to_string(),
+            engine: Some(engine.to_string()),
+            variables: None,
+            source: None,
+            build: None,
+            deploy: None,
+            networking,
+            volume_attachments: None,
+            config: None,
+            group_id: None,
+        }
+    }
+
+    fn render_database(networking: Option<serde_json::Value>) -> String {
+        let graph = runner::DesiredGraph {
+            project: Some(runner::DesiredProject { name: "app".into() }),
+            resources: vec![database_resource("postgres", "postgres", networking)],
+        };
+        render_graph_as_railway(&graph, true, AuthoringLang::TypeScript)
+    }
+
+    #[test]
+    fn pull_renderer_authors_a_database_tcp_proxy() {
+        let rendered = render_database(Some(json!({
+            "tcpProxies": { "5432": {} },
+            "serviceDomains": { "postgres.up.railway.app": { "port": 5432 } }
+        })));
+        let helper = rendered
+            .lines()
+            .position(|line| line.contains("= postgres(\"postgres\")"))
+            .expect("database helper call");
+        assert_eq!(
+            rendered.lines().nth(helper + 1).unwrap().trim(),
+            "postgresDatabase.networking = { tcpProxies: { \"5432\": {} } };"
+        );
+        assert!(!rendered.contains("serviceDomains"));
+    }
+
+    #[test]
+    fn pull_renderer_leaves_a_private_database_without_networking() {
+        assert!(!render_database(None).contains(".networking"));
+        assert!(
+            !render_database(Some(json!({
+                "serviceDomains": { "postgres.up.railway.app": { "port": 5432 } }
+            })))
+            .contains(".networking")
+        );
+        assert!(!render_database(Some(json!({ "tcpProxies": {} }))).contains(".networking"));
+    }
+
     #[test]
     fn pull_renderer_preserves_single_region_placement() {
         assert_eq!(

src/iac/change_set.rs

@@ -337,6 +337,12 @@ fn diff_networking(
 ) {
     let before = previous.get("networking");
     let after = resource.get("networking");
+    // The database helpers take no networking, and pulled files only author it
+    // when a proxy exists, so a database node without a networking block keeps
+    // whatever exposure it has.
+    if resource_type(resource) == "database" && after.is_none() {
+        return;
+    }
     let before_domains = before.and_then(|n| n.get("customDomains"));
     diagnose_unsupported_custom_domains(resource, diagnostics, before_domains);
     let mut before_copy = before.cloned().unwrap_or(json!({}));
@@ -349,9 +355,18 @@ fn diff_networking(
         obj.remove("customDomains");
         obj.remove("serviceDomains");
     }
+    diagnose_unremovable_tcp_proxies(resource, diagnostics, &before_copy, &after_copy);
     let normalized_before = normalize_for_diff("networking", &before_copy);
     let normalized_after = normalize_for_diff("networking", &after_copy);
-    if stable_stringify(&normalized_before) != stable_stringify(&normalized_after) {
+    // Plan the change only when applying the authored block moves something.
+    // The block is a sparse patch, so what the plan promises is its effect,
+    // while the change set still carries the block as written: that is the
+    // payload the apply sends, and a `null` entry is how a proxy is deleted.
+    let applied = normalize_for_diff(
+        "networking",
+        &networking_after_apply(&before_copy, &after_copy),
+    );
+    if stable_stringify(&normalized_before) != stable_stringify(&applied) {
         changes.push(update(
             &resource_addr(resource),
             "networking",
@@ -364,6 +379,85 @@ fn diff_networking(
     }
 }
 
+/// What `networking` looks like once Railway has applied the authored block.
+///
+/// `environmentApplyChangeSet` reads the block as a sparse patch: a key the
+/// author leaves out stays as Railway has it, and inside `tcpProxies` an entry
+/// keeps or creates a proxy, a `null` entry deletes one, and an unmentioned port
+/// is left alone — so an empty map changes nothing. The plan diffs against that
+/// same effect, because a plan that plans anything else promises work the apply
+/// will not do and then plans it again after every apply.
+fn networking_after_apply(before: &Value, after: &Value) -> Value {
+    let mut effective = before.as_object().cloned().unwrap_or_default();
+    let Some(authored) = after.as_object() else {
+        return Value::Object(effective);
+    };
+    for (key, value) in authored {
+        if key != "tcpProxies" {
+            effective.insert(key.clone(), value.clone());
+            continue;
+        }
+        let mut proxies = before
+            .get("tcpProxies")
+            .and_then(Value::as_object)
+            .cloned()
+            .unwrap_or_default();
+        for (port, entry) in value.as_object().into_iter().flatten() {
+            if entry.is_null() {
+                proxies.remove(port);
+            } else {
+                proxies.entry(port.clone()).or_insert_with(|| entry.clone());
+            }
+        }
+        effective.insert(key.clone(), Value::Object(proxies));
+    }
+    Value::Object(effective)
+}
+
+/// An empty `tcpProxies` map — what `tcp: []` compiles to — cannot take a proxy
+/// away, because the apply leaves every port the block does not mention alone.
+/// Say that out loud instead of leaving the author with a file that reads
+/// "private" next to a proxy that is still serving traffic.
+fn diagnose_unremovable_tcp_proxies(
+    resource: &Value,
+    diagnostics: &mut Vec<Diagnostic>,
+    before: &Value,
+    after: &Value,
+) {
+    let authored_empty = after
+        .get("tcpProxies")
+        .and_then(Value::as_object)
+        .is_some_and(Map::is_empty);
+    if !authored_empty {
+        return;
+    }
+    let live = before.get("tcpProxies").and_then(Value::as_object);
+    let Some(live) = live.filter(|proxies| !proxies.is_empty()) else {
+        return;
+    };
+    let ports = live
+        .keys()
+        .map(String::as_str)
+        .collect::<Vec<_>>()
+        .join(", ");
+    let removals = live
+        .keys()
+        .map(|port| format!("\"{port}\": null"))
+        .collect::<Vec<_>>()
+        .join(", ");
+    diagnostics.push(Diagnostic {
+        severity: "warning".into(),
+        path: format!(
+            "resources.{}.networking.tcpProxies",
+            resource_addr(resource)
+        ),
+        message: format!(
+            "{} has a public TCP proxy on port {ports}, and an empty tcpProxies map does not remove it. Author networking.tcpProxies = {{ {removals} }} to remove the proxy, or remove it from the dashboard.",
+            resource_name(resource)
+        ),
+    });
+}
+
 fn diagnose_unsupported_custom_domains(
     resource: &Value,
     diagnostics: &mut Vec<Diagnostic>,
@@ -1100,6 +1194,11 @@ fn normalize_for_diff(field_name: &str, value: &Value) -> Value {
             copy.remove("dockerfilePath");
         }
     }
+    if field_name == "networking" {
+        // `tcp: []` compiles to `tcpProxies: {}`; Railway serializes a service
+        // with no proxy as no `tcpProxies` at all. Both mean the same thing.
+        copy.retain(|_, child| !child.is_null() && !child.as_object().is_some_and(Map::is_empty));
+    }
     if field_name == "deploy" {
         if copy.get("useLegacyStacker") == Some(&json!(false)) {
             copy.remove("useLegacyStacker");

src/iac/compiler.rs

@@ -656,6 +656,11 @@ pub fn environment_config_to_graph(
                     "deploy": service.get("deploy").cloned().unwrap_or(Value::Null),
                     "volumeMounts": service.get("volumeMounts").cloned().unwrap_or(Value::Null),
                 }));
+                if let Some(networking) =
+                    networking_from_environment_config(service, service_id, options)
+                {
+                    node["networking"] = networking;
+                }
                 if let Some(group_id) = field_str(service, "groupId") {
                     node["groupId"] = json!(
                         group_names_by_id
@@ -710,20 +715,8 @@ pub fn environment_config_to_graph(
             if let Some(variables) = service.get("variables") {
                 node["variables"] = variables_from_environment_config(variables);
             }
-            let mut networking = service.get("networking").cloned().unwrap_or(json!({}));
-            if let Some(domains) = options.custom_domains_by_service_id.get(service_id) {
-                networking["customDomains"] = domains.clone();
-            } else if let Some(existing) = service
-                .get("networking")
-                .and_then(|n| n.get("customDomains"))
-            {
-                networking["customDomains"] = existing.clone();
-            }
-            let networking = prune_empty(networking);
-            if networking.as_object().is_some_and(|obj| !obj.is_empty())
-                || options
-                    .custom_domains_by_service_id
-                    .contains_key(service_id)
+            if let Some(networking) =
+                networking_from_environment_config(service, service_id, options)
             {
                 node["networking"] = networking;
             }
@@ -820,6 +813,32 @@ pub fn environment_config_to_graph(
     }))
 }
 
+/// Import a service's live networking (TCP proxies, domains) as graph state.
+///
+/// Databases go through this too: a public TCP proxy on a database is exposure
+/// the plan has to be able to see, and the imported graph is what
+/// `railway config pull` renders.
+fn networking_from_environment_config(
+    service: &Value,
+    service_id: &str,
+    options: &EnvironmentConfigToGraphOptions,
+) -> Option<Value> {
+    let mut networking = service.get("networking").cloned().unwrap_or(json!({}));
+    if let Some(domains) = options.custom_domains_by_service_id.get(service_id) {
+        networking["customDomains"] = domains.clone();
+    }
+    let networking = prune_empty(networking);
+    if networking.as_object().is_some_and(|obj| !obj.is_empty())
+        || options
+            .custom_domains_by_service_id
+            .contains_key(service_id)
+    {
+        Some(networking)
+    } else {
+        None
+    }
+}
+
 fn variables_from_environment_config(variables: &Value) -> Value {
     let Some(map) = variables.as_object() else {
         return json!({});