@app-vitals/agent-admin 1.4.0 → 1.5.0

package/src/agent-marketplaces-api.integration.test.ts

@@ -0,0 +1,263 @@
+/**
+ * admin/src/agent-marketplaces-api.integration.test.ts
+ * Integration tests for AgentMarketplaceService, the /agents/{id}/marketplaces
+ * routes and the `marketplaces` field of GET /agents/{id}/config, against a
+ * real PostgreSQL DB.
+ *
+ * Requires DATABASE_URL_ADMIN_TEST to be set; skips otherwise.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import type { PrismaClient } from "../prisma/client/client.ts";
+import { AgentMarketplaceService } from "./agent-marketplaces.ts";
+import { AgentTokenService } from "./agent-tokens.ts";
+import { AgentService } from "./agents.ts";
+import {
+  type AdminDeps,
+  createAdminApp,
+  parseAdminApiKeys,
+} from "./agents-api.ts";
+import { createAgentRuntimeApp } from "./api.ts";
+import { NotFoundError, UnprocessableEntityError } from "./errors.ts";
+import { createAdminPrismaClient } from "./prisma-client.ts";
+
+const TEST_DB = process.env.DATABASE_URL_ADMIN_TEST;
+const describeOrSkip = TEST_DB ? describe : describe.skip;
+
+const SESSION_SECRET = "test-admin-session-secret-32-bytes!";
+const ADMIN_KEY = "admin-key-token";
+
+describeOrSkip("AgentMarketplaceService + routes (integration)", () => {
+  let prisma: PrismaClient;
+  let service: AgentMarketplaceService;
+  let tokens: AgentTokenService;
+  let adminApp: ReturnType<typeof createAdminApp>;
+  let runtimeApp: ReturnType<typeof createAgentRuntimeApp>;
+  let agentA: string;
+  let agentB: string;
+  let tokenA: string;
+  let tokenB: string;
+
+  const adminKeys = parseAdminApiKeys(`root:${ADMIN_KEY}:*`);
+  const json = (token: string, body?: unknown, method = "POST") => ({
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+  });
+  const get = (token: string) => ({
+    headers: { Authorization: `Bearer ${token}` },
+  });
+
+  beforeEach(async () => {
+    prisma = createAdminPrismaClient(TEST_DB as string);
+    await prisma.agentMarketplace.deleteMany();
+    await prisma.agentPlugin.deleteMany();
+    await prisma.agentToken.deleteMany();
+    await prisma.agentCronJob.deleteMany();
+    await prisma.agentTool.deleteMany();
+    await prisma.agentEnv.deleteMany();
+    await prisma.agentMember.deleteMany();
+    await prisma.agent.deleteMany();
+
+    agentA = (await prisma.agent.create({ data: { name: "A" } })).id;
+    agentB = (await prisma.agent.create({ data: { name: "B" } })).id;
+    service = new AgentMarketplaceService(prisma);
+    tokens = new AgentTokenService(prisma);
+    tokenA = (await tokens.create(agentA)).rawToken;
+    tokenB = (await tokens.create(agentB)).rawToken;
+
+    adminApp = createAdminApp({
+      agentTokenService: tokens,
+      agentMemberService: { exists: async () => false },
+      agentMarketplaceService: service,
+      prisma,
+      sessionSecret: SESSION_SECRET,
+      adminApiKeys: adminKeys,
+    } as unknown as AdminDeps);
+
+    runtimeApp = createAgentRuntimeApp({
+      agentEnvService: { getConfigBundle: async () => null },
+      agentCronJobService: { list: async () => [] },
+      agentService: new AgentService(prisma),
+      agentPluginService: { listEnabled: async () => [] },
+      agentMarketplaceService: service,
+      sessionSecret: SESSION_SECRET,
+      adminApiKeys: adminKeys,
+      agentTokenService: tokens,
+    } as never);
+  });
+
+  afterEach(async () => {
+    await prisma.$disconnect();
+  });
+
+  describe("service", () => {
+    it("upserts, lists in creation order, and re-points an existing name", async () => {
+      const first = await service.upsert(agentA, {
+        name: "shipwright",
+        source: "app-vitals/shipwright",
+      });
+      expect(first.ref).toBeNull();
+      await service.upsert(agentA, {
+        name: "other",
+        source: "https://github.com/o/r.git",
+        ref: "v1",
+      });
+      const again = await service.upsert(agentA, {
+        name: "shipwright",
+        source: "app-vitals/shipwright-fork",
+        ref: "main",
+      });
+      expect(again.id).toBe(first.id);
+
+      const rows = await service.list(agentA);
+      expect(rows.map((r) => r.name)).toEqual(["shipwright", "other"]);
+      expect(rows[0]?.source).toBe("app-vitals/shipwright-fork");
+      expect(rows[0]?.ref).toBe("main");
+      expect(await service.list(agentB)).toEqual([]);
+    });
+
+    it("same name on two agents are independent rows", async () => {
+      await service.upsert(agentA, { name: "m", source: "o/a" });
+      await service.upsert(agentB, { name: "m", source: "o/b" });
+      expect((await service.list(agentA))[0]?.source).toBe("o/a");
+      expect((await service.list(agentB))[0]?.source).toBe("o/b");
+    });
+
+    it("rejects an invalid source without writing", async () => {
+      await expect(
+        service.upsert(agentA, { name: "m", source: "http://x.com/o/r" }),
+      ).rejects.toBeInstanceOf(UnprocessableEntityError);
+      expect(await service.list(agentA)).toEqual([]);
+    });
+
+    it("remove deletes an owned row and 404s on another agent's row", async () => {
+      const row = await service.upsert(agentA, { name: "m", source: "o/r" });
+      await expect(service.remove(agentB, row.id)).rejects.toBeInstanceOf(
+        NotFoundError,
+      );
+      expect(await service.list(agentA)).toHaveLength(1);
+      await service.remove(agentA, row.id);
+      expect(await service.list(agentA)).toEqual([]);
+      await expect(service.remove(agentA, row.id)).rejects.toBeInstanceOf(
+        NotFoundError,
+      );
+    });
+  });
+
+  describe("routes", () => {
+    it("POST upserts (201), GET lists, DELETE removes (204)", async () => {
+      const created = await adminApp.request(
+        `/agents/${agentA}/marketplaces`,
+        json(tokenA, {
+          name: "shipwright",
+          source: "app-vitals/shipwright",
+          ref: "main",
+        }),
+      );
+      expect(created.status).toBe(201);
+      const { marketplace } = await created.json();
+      expect(marketplace).toMatchObject({
+        agentId: agentA,
+        name: "shipwright",
+        source: "app-vitals/shipwright",
+        ref: "main",
+      });
+
+      const listed = await adminApp.request(
+        `/agents/${agentA}/marketplaces`,
+        get(ADMIN_KEY),
+      );
+      expect(listed.status).toBe(200);
+      expect((await listed.json()).marketplaces).toHaveLength(1);
+
+      const del = await adminApp.request(
+        `/agents/${agentA}/marketplaces/${marketplace.id}`,
+        json(tokenA, undefined, "DELETE"),
+      );
+      expect(del.status).toBe(204);
+      expect(await service.list(agentA)).toEqual([]);
+    });
+
+    it("platform admin key can write and read any agent", async () => {
+      const res = await adminApp.request(
+        `/agents/${agentB}/marketplaces`,
+        json(ADMIN_KEY, { name: "m", source: "o/r" }),
+      );
+      expect(res.status).toBe(201);
+    });
+
+    it("invalid source returns 422 and writes nothing", async () => {
+      for (const source of [
+        "http://x.com/o/r",
+        "not-a-source",
+        "git@github.com:o/r.git",
+        "",
+      ]) {
+        const res = await adminApp.request(
+          `/agents/${agentA}/marketplaces`,
+          json(tokenA, { name: "m", source }),
+        );
+        expect(res.status).toBe(422);
+      }
+      expect(await service.list(agentA)).toEqual([]);
+    });
+
+    it("deleting another agent's row returns 404 and leaves it", async () => {
+      const row = await service.upsert(agentB, { name: "m", source: "o/r" });
+      const res = await adminApp.request(
+        `/agents/${agentA}/marketplaces/${row.id}`,
+        json(tokenA, undefined, "DELETE"),
+      );
+      expect(res.status).toBe(404);
+      expect(await service.list(agentB)).toHaveLength(1);
+    });
+
+    it("another agent's key is 403 on every method; no credential is 401", async () => {
+      const row = await service.upsert(agentA, { name: "m", source: "o/r" });
+      const post = await adminApp.request(
+        `/agents/${agentA}/marketplaces`,
+        json(tokenB, { name: "x", source: "o/r" }),
+      );
+      const list = await adminApp.request(
+        `/agents/${agentA}/marketplaces`,
+        get(tokenB),
+      );
+      const del = await adminApp.request(
+        `/agents/${agentA}/marketplaces/${row.id}`,
+        json(tokenB, undefined, "DELETE"),
+      );
+      expect([post.status, list.status, del.status]).toEqual([403, 403, 403]);
+      expect(
+        (await adminApp.request(`/agents/${agentA}/marketplaces`)).status,
+      ).toBe(401);
+      expect(await service.list(agentA)).toHaveLength(1);
+    });
+  });
+
+  describe("GET /agents/:id/config", () => {
+    it("includes marketplaces: [] when none", async () => {
+      const res = await runtimeApp.request(`/${agentA}/config`, get(tokenA));
+      expect(res.status).toBe(200);
+      expect((await res.json()).marketplaces).toEqual([]);
+    });
+
+    it("includes name/source/ref for the agent's own rows only", async () => {
+      await service.upsert(agentA, { name: "one", source: "o/r", ref: "v1" });
+      await service.upsert(agentA, {
+        name: "two",
+        source: "https://h.example/o/r",
+      });
+      await service.upsert(agentB, { name: "theirs", source: "o/x" });
+      const res = await runtimeApp.request(`/${agentA}/config`, get(tokenA));
+      expect(res.status).toBe(200);
+      expect((await res.json()).marketplaces).toEqual([
+        { name: "one", source: "o/r", ref: "v1" },
+        { name: "two", source: "https://h.example/o/r", ref: null },
+      ]);
+    });
+  });
+});

package/src/agent-marketplaces.ts

@@ -0,0 +1,120 @@
+/**
+ * admin/src/agent-marketplaces.ts
+ * AgentMarketplaceService — CRUD for remote Claude Code plugin marketplaces
+ * per agent.
+ *
+ * A marketplace is identified by `name` (the name plugins reference after the
+ * "@" in "<plugin>@<marketplace>") and points at a `source`: a GitHub
+ * "owner/repo" or an https git URL, optionally pinned to a `ref`. The unique
+ * constraint on [agentId, name] makes two versions of one marketplace
+ * impossible; upsert() re-points an existing name.
+ *
+ * Input is validated here (422) rather than in the Zod request schema, which
+ * would answer 400: `source` and `ref` end up as arguments to `git`/`claude`
+ * in the runtime, so anything that could be read as an option, a local path,
+ * or a credential-bearing URL is refused.
+ */
+
+import type {
+  AgentMarketplace,
+  PrismaClient,
+} from "../prisma/client/client.ts";
+import { NotFoundError, UnprocessableEntityError } from "./errors.ts";
+
+export type { AgentMarketplace };
+
+const GITHUB_SHORTHAND =
+  /^[A-Za-z0-9_][A-Za-z0-9_.-]*\/[A-Za-z0-9_][A-Za-z0-9_.-]*$/;
+const NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const REF = /^[A-Za-z0-9_][A-Za-z0-9_./-]*$/;
+const HOST = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
+
+/** Throws UnprocessableEntityError unless `source` is `owner/repo` or an https git URL. */
+export function validateMarketplaceSource(source: string): void {
+  if (GITHUB_SHORTHAND.test(source)) return;
+  if (source.startsWith("https://") && !/\s/.test(source)) {
+    try {
+      const url = new URL(source);
+      if (
+        url.protocol === "https:" &&
+        HOST.test(url.hostname) &&
+        url.username === "" &&
+        url.password === "" &&
+        url.pathname.length > 1
+      ) {
+        return;
+      }
+    } catch {
+      // fall through to the 422 below
+    }
+  }
+  throw new UnprocessableEntityError(
+    "source must be a GitHub 'owner/repo' or an https git URL without credentials",
+  );
+}
+
+/** Throws UnprocessableEntityError unless `name` is a plain marketplace name. */
+export function validateMarketplaceName(name: string): void {
+  if (!NAME.test(name)) {
+    throw new UnprocessableEntityError(
+      "name must start with a letter or digit and contain only letters, digits, '.', '_' and '-'",
+    );
+  }
+}
+
+/** Throws UnprocessableEntityError for a ref that is not a plain branch, tag or sha. */
+export function validateMarketplaceRef(ref: string | null | undefined): void {
+  if (ref === undefined || ref === null) return;
+  if (!REF.test(ref) || ref.includes("..")) {
+    throw new UnprocessableEntityError(
+      "ref must be a plain branch, tag or sha",
+    );
+  }
+}
+
+export class AgentMarketplaceService {
+  constructor(private prisma: PrismaClient) {}
+
+  /** List all marketplaces for a given agent, ordered by createdAt. */
+  async list(agentId: string): Promise<AgentMarketplace[]> {
+    return this.prisma.agentMarketplace.findMany({
+      where: { agentId },
+      orderBy: { createdAt: "asc" },
+    });
+  }
+
+  /**
+   * Add a marketplace for the agent, or re-point the existing one with the
+   * same name at a new source/ref. Throws UnprocessableEntityError on invalid
+   * input.
+   */
+  async upsert(
+    agentId: string,
+    input: { name: string; source: string; ref?: string | null },
+  ): Promise<AgentMarketplace> {
+    const { name, source } = input;
+    const ref = input.ref ?? null;
+    validateMarketplaceName(name);
+    validateMarketplaceSource(source);
+    validateMarketplaceRef(ref);
+    return this.prisma.agentMarketplace.upsert({
+      where: { agentId_name: { agentId, name } },
+      create: { agentId, name, source, ref },
+      update: { source, ref },
+    });
+  }
+
+  /**
+   * Remove a marketplace by ID. Verifies agentId ownership before deleting.
+   * Throws NotFoundError if the id doesn't exist or belongs to another agent.
+   */
+  async remove(agentId: string, marketplaceId: string): Promise<void> {
+    const existing = await this.prisma.agentMarketplace.findUnique({
+      where: { id: marketplaceId },
+    });
+    if (!existing || existing.agentId !== agentId) {
+      throw new NotFoundError(`marketplace ${marketplaceId} not found`);
+    }
+    await this.prisma.agentMarketplace.delete({ where: { id: marketplaceId } });
+  }
+}

package/src/agent-marketplaces.unit.test.ts

@@ -0,0 +1,72 @@
+/**
+ * admin/src/agent-marketplaces.unit.test.ts
+ * Unit tests for marketplace input validation (source, name, ref).
+ */
+
+import { describe, expect, it } from "bun:test";
+import {
+  validateMarketplaceName,
+  validateMarketplaceRef,
+  validateMarketplaceSource,
+} from "./agent-marketplaces.ts";
+import { UnprocessableEntityError } from "./errors.ts";
+
+describe("validateMarketplaceSource", () => {
+  it.each([
+    "app-vitals/shipwright",
+    "owner/repo.name",
+    "Org_1/repo-2",
+    "https://github.com/app-vitals/shipwright.git",
+    "https://gitlab.example.com/group/sub/repo",
+  ])("accepts %s", (source) => {
+    expect(() => validateMarketplaceSource(source)).not.toThrow();
+  });
+
+  it.each([
+    "",
+    "   ",
+    "repo",
+    "owner/",
+    "/repo",
+    "owner/repo/extra",
+    "owner/re po",
+    "http://github.com/o/r",
+    "git@github.com:o/r.git",
+    "ssh://git@github.com/o/r",
+    "file:///etc/passwd",
+    "../etc",
+    "./local/path",
+    "-owner/repo",
+    "https://",
+    "https://user:pass@github.com/o/r",
+    "https://github.com/o/r with space",
+    "https://-evil.com/x",
+  ])("rejects %p with a 422", (source) => {
+    expect(() => validateMarketplaceSource(source)).toThrow(
+      UnprocessableEntityError,
+    );
+  });
+});
+
+describe("validateMarketplaceName", () => {
+  it("accepts simple names", () => {
+    expect(() => validateMarketplaceName("shipwright")).not.toThrow();
+    expect(() => validateMarketplaceName("my.market_place-2")).not.toThrow();
+  });
+  it.each(["", "a b", "a@b", "a/b", "-x"])("rejects %p", (name) => {
+    expect(() => validateMarketplaceName(name)).toThrow(
+      UnprocessableEntityError,
+    );
+  });
+});
+
+describe("validateMarketplaceRef", () => {
+  it("accepts branches, tags, shas and absent refs", () => {
+    for (const ref of [undefined, null, "main", "v1.2.3", "feat/x", "abc123"]) {
+      expect(() => validateMarketplaceRef(ref)).not.toThrow();
+    }
+  });
+  it.each(["", "-x", "a b", "a..b", "x;rm"])("rejects %p", (ref) => {
+    expect(() => validateMarketplaceRef(ref)).toThrow(UnprocessableEntityError);
+  });
+});

package/src/agents-api.ts

@@ -41,8 +41,8 @@ import {
 } from "./account-agent-create.ts";
 import {
   reconcileAgentAfterAccountChange,
-  reconcileAgentAfterSpecialtyChange,
   reconcileAgentAfterPodServiceAccountChange,
+  reconcileAgentAfterSpecialtyChange,
 } from "./agent-account-assignment.ts";
 import {
   type AgentAskDeps,
@@ -60,6 +60,7 @@ import type { DeleteAgentFullyDeps } from "./agent-deletion.ts";
 import { deleteAgentFully } from "./agent-deletion.ts";
 import type { AgentEnvService } from "./agent-envs.ts";
 import type { AgentGitHubInstallationsService } from "./agent-github-installations.ts";
+import { AgentMarketplaceService } from "./agent-marketplaces.ts";
 import type { AgentMemberService } from "./agent-members.ts";
 import type { AgentPluginService } from "./agent-plugins.ts";
 import {
@@ -116,6 +117,7 @@ import {
   AgentEnvResponseSchema,
   AgentGitHubInstallationsSnapshotSchema,
   AgentIdParamSchema,
+  AgentMarketplaceSchema,
   AgentPluginSchema,
   AgentRepoParamSchema,
   AgentSummarySchema,
@@ -143,6 +145,7 @@ import {
   EnvKeyParamSchema,
   ErrorSchema,
   ListCronRunsQuerySchema,
+  MarketplaceIdParamSchema,
   type ModelBreakdownEntry,
   OkSchema,
   PatchAgentBodySchema,
@@ -154,6 +157,7 @@ import {
   PutGitHubInstallationsBodySchema,
   TokenIdParamSchema,
   ToolIdParamSchema,
+  UpsertAgentMarketplaceBodySchema,
   UpsertChatTokenDailyBodySchema,
 } from "./openapi-schemas.ts";
 import type { SelfServeConfig } from "./self-serve-config.ts";
@@ -212,6 +216,14 @@ export interface AdminDeps {
     AgentPluginService,
     "list" | "add" | "remove" | "removeByName"
   >;
+  /**
+   * PMK-1.2: remote plugin marketplaces. Optional (additive to the exported
+   * AdminDeps): defaults to an AgentMarketplaceService over `prisma`.
+   */
+  agentMarketplaceService?: Pick<
+    AgentMarketplaceService,
+    "list" | "upsert" | "remove"
+  >;
   agentMemberService: Pick<
     AgentMemberService,
     "add" | "listByAgentId" | "exists" | "listByEmail"
@@ -492,6 +504,14 @@ const PluginWrapperSchema = z
   .object({ plugin: AgentPluginSchema })
   .openapi("PluginWrapper");
 
+const MarketplaceWrapperSchema = z
+  .object({ marketplace: AgentMarketplaceSchema })
+  .openapi("MarketplaceWrapper");
+
+const MarketplacesWrapperSchema = z
+  .object({ marketplaces: z.array(AgentMarketplaceSchema) })
+  .openapi("MarketplacesWrapper");
+
 const PluginsWrapperSchema = z
   .object({ plugins: z.array(AgentPluginSchema) })
   .openapi("PluginsWrapper");
@@ -1211,6 +1231,58 @@ const deletePluginRoute = createRoute({
   },
 });
 
+const listMarketplacesRoute = createRoute({
+  method: "get",
+  path: "/agents/{id}/marketplaces",
+  summary: "List marketplaces",
+  description:
+    "Returns every remote plugin marketplace configured for the agent.",
+  request: { params: AgentIdParamSchema },
+  responses: {
+    200: {
+      description: "List of marketplaces",
+      content: { "application/json": { schema: MarketplacesWrapperSchema } },
+    },
+  },
+});
+
+const upsertMarketplaceRoute = createRoute({
+  method: "post",
+  path: "/agents/{id}/marketplaces",
+  summary: "Add or update a marketplace",
+  description:
+    "Upserts a remote plugin marketplace by `name`. `source` must be a GitHub `owner/repo` or an https git URL (no credentials); `ref` optionally pins a branch, tag or sha. 422 on an invalid `name`, `source` or `ref`.",
+  request: {
+    params: AgentIdParamSchema,
+    body: {
+      content: {
+        "application/json": { schema: UpsertAgentMarketplaceBodySchema },
+      },
+    },
+  },
+  responses: {
+    201: {
+      description: "Marketplace added or updated",
+      content: { "application/json": { schema: MarketplaceWrapperSchema } },
+    },
+    400: { description: "Bad request", ...jsonError },
+    422: { description: "Invalid name, source or ref", ...jsonError },
+  },
+});
+
+const deleteMarketplaceRoute = createRoute({
+  method: "delete",
+  path: "/agents/{id}/marketplaces/{marketplaceId}",
+  summary: "Remove a marketplace",
+  description:
+    "Removes the marketplace row by id. 404 when the id does not exist or belongs to a different agent.",
+  request: { params: MarketplaceIdParamSchema },
+  responses: {
+    204: { description: "Marketplace removed" },
+    404: { description: "Marketplace not found", ...jsonError },
+  },
+});
+
 const upsertChatTokenDailyRoute = createRoute({
   method: "post",
   path: "/agents/{id}/chat-tokens/daily",
@@ -2532,6 +2604,34 @@ export function createAdminApp(deps: AdminDeps): OpenAPIHono<AdminAuthEnv> {
     return c.body(null, 204);
   });
 
+  // ─── Marketplaces (PMK-1.2) ────────────────────────────────────────────────
+  // Auth is the shared /agents/* middleware: the agent's own key, a platform
+  // admin and authorised session members pass; other agents' keys get 403.
+  // No route here writes the runtime-reported baked-marketplace list (PMK-1.4).
+
+  const agentMarketplaceService =
+    deps.agentMarketplaceService ??
+    new AgentMarketplaceService(prisma as PrismaClient);
+
+  app.openapi(listMarketplacesRoute, async (c) => {
+    const { id: agentId } = c.req.valid("param");
+    const rows = await agentMarketplaceService.list(agentId);
+    return c.json({ marketplaces: rows.map(serializeMarketplace) }, 200);
+  });
+
+  app.openapi(upsertMarketplaceRoute, async (c) => {
+    const { id: agentId } = c.req.valid("param");
+    const body = c.req.valid("json");
+    const row = await agentMarketplaceService.upsert(agentId, body);
+    return c.json({ marketplace: serializeMarketplace(row) }, 201);
+  });
+
+  app.openapi(deleteMarketplaceRoute, async (c) => {
+    const { id: agentId, marketplaceId } = c.req.valid("param");
+    await agentMarketplaceService.remove(agentId, marketplaceId);
+    return c.body(null, 204);
+  });
+
   // ─── Cron-run token stats ──────────────────────────────────────────────────
 
   // GET /agents/all/cron-runs/stats — aggregated token stats across all agents
@@ -2844,6 +2944,22 @@ function serializeTool(tool: {
   } as z.infer<typeof AgentToolSchema>;
 }
 
+function serializeMarketplace(row: {
+  id: string;
+  agentId: string;
+  name: string;
+  source: string;
+  ref: string | null;
+  createdAt: Date;
+  updatedAt: Date;
+}): z.infer<typeof AgentMarketplaceSchema> {
+  return {
+    ...row,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
 function serializePlugin(plugin: {
   createdAt: Date;
   updatedAt: Date;