@auersperg/flare 0.3.7 → 0.3.8

package/dist/platform/runtime.js

@@ -526,10 +526,41 @@ class PasswordAuth {
     return { userId: input.id };
   }
 }
+
+// packages/core/src/maintenance.ts
+function scopeForDeletion(value) {
+  if (typeof value !== "string")
+    fail("INVALID_INPUT");
+  const parts = value.split("/");
+  if (parts.length !== 2)
+    fail("INVALID_INPUT");
+  return `${uuid(parts[0])}/${environment(parts[1])}`;
+}
+async function markEnvironmentDeleting(ctx) {
+  ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS _flared_deleted (id INTEGER PRIMARY KEY)");
+  ctx.storage.sql.exec("INSERT OR IGNORE INTO _flared_deleted VALUES (0)");
+  await ctx.storage.sync();
+}
+async function eraseEnvironment(ctx) {
+  ctx.facets.delete("app");
+  await ctx.storage.deleteAlarm();
+  await ctx.storage.deleteAll();
+  ctx.storage.sql.exec("CREATE TABLE _flared_deleted (id INTEGER PRIMARY KEY)");
+  ctx.storage.sql.exec("INSERT INTO _flared_deleted VALUES (1)");
+  await ctx.storage.sync();
+}
+
+// packages/core/src/dashboard-live.ts
+function dashboardIdentity(value) {
+  const v = value;
+  if (!v || typeof v.email !== "string" || v.email.length > 254 || !/^\S+@\S+\.\S+$/.test(v.email) || !Number.isSafeInteger(v.expires) || v.expires <= Date.now() || v.expires > Date.now() + 600000)
+    fail("UNAUTHORIZED");
+  return { email: v.email.toLowerCase(), expires: v.expires };
+}
 // packages/core/package.json
 var package_default = {
   name: "@flare/platform",
-  version: "0.3.7",
+  version: "0.3.8",
   type: "module",
   license: "MIT",
   private: true,
@@ -596,29 +627,6 @@ var documents = new WeakMap;
 // packages/flare/src/sdk/backup.ts
 var SNAPSHOT_BYTES = 4 * 1048576;
 
-// packages/core/src/maintenance.ts
-function scopeForDeletion(value) {
-  if (typeof value !== "string")
-    fail("INVALID_INPUT");
-  const parts = value.split("/");
-  if (parts.length !== 2)
-    fail("INVALID_INPUT");
-  return `${uuid(parts[0])}/${environment(parts[1])}`;
-}
-async function markEnvironmentDeleting(ctx) {
-  ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS _flared_deleted (id INTEGER PRIMARY KEY)");
-  ctx.storage.sql.exec("INSERT OR IGNORE INTO _flared_deleted VALUES (0)");
-  await ctx.storage.sync();
-}
-async function eraseEnvironment(ctx) {
-  ctx.facets.delete("app");
-  await ctx.storage.deleteAlarm();
-  await ctx.storage.deleteAll();
-  ctx.storage.sql.exec("CREATE TABLE _flared_deleted (id INTEGER PRIMARY KEY)");
-  ctx.storage.sql.exec("INSERT INTO _flared_deleted VALUES (1)");
-  await ctx.storage.sync();
-}
-
 // packages/core/src/files.ts
 var types = new Set([
   "text/plain",
@@ -904,6 +912,9 @@ class BackupStore {
     this.bucket = bucket;
     this.files = files;
   }
+  async completed(scope, id) {
+    return !!(await this.bucket.head(backupPrefix(scope, id) + "manifest.json"))?.customMetadata?.sha256;
+  }
   async read(scope, id) {
     const object = await this.bucket.get(backupPrefix(scope, id) + "manifest.json");
     if (!object)
@@ -1039,6 +1050,86 @@ class BackupStore {
   }
 }
 
+class BackupInventory {
+  storage;
+  store;
+  scope;
+  constructor(storage, store, scope) {
+    this.storage = storage;
+    this.store = store;
+    this.scope = scope;
+    storage.sql.exec("CREATE TABLE IF NOT EXISTS backup_inventory (id INTEGER PRIMARY KEY,cursor TEXT,complete INTEGER NOT NULL)");
+    storage.sql.exec("INSERT OR IGNORE INTO backup_inventory VALUES (1,NULL,0)");
+    storage.sql.exec("CREATE TABLE IF NOT EXISTS backup_index (id TEXT PRIMARY KEY,at INTEGER NOT NULL,summary TEXT NOT NULL)");
+    storage.sql.exec("CREATE INDEX IF NOT EXISTS backup_index_at ON backup_index(at DESC,id DESC)");
+  }
+  async record(summary) {
+    this.storage.sql.exec("INSERT OR REPLACE INTO backup_index VALUES (?,?,?)", summary.id, summary.at, JSON.stringify(summary));
+    await this.storage.sync();
+    return summary;
+  }
+  async remove(id) {
+    this.storage.sql.exec("DELETE FROM backup_index WHERE id=?", id);
+    this.storage.sql.exec("UPDATE backup_inventory SET cursor=NULL,complete=0 WHERE id=1");
+    await this.storage.sync();
+    return this.store.remove(this.scope, id);
+  }
+  async list(cursor) {
+    if (cursor && (typeof cursor !== "string" || cursor.length > 2048))
+      fail("INVALID_CURSOR");
+    let before;
+    if (cursor) {
+      try {
+        before = JSON.parse(atob(cursor));
+      } catch {
+        fail("INVALID_CURSOR");
+      }
+      if (!before || before.scope !== this.scope || !Number.isSafeInteger(before.at) || before.at < -1)
+        fail("INVALID_CURSOR");
+      uuid(before.id);
+    }
+    const checkpoint = this.storage.sql.exec("SELECT cursor,complete FROM backup_inventory WHERE id=1").one();
+    if (!checkpoint.complete) {
+      const result = await this.store.list(this.scope, checkpoint.cursor == null ? undefined : String(checkpoint.cursor));
+      for (const item of result.page)
+        this.storage.sql.exec("INSERT OR REPLACE INTO backup_index VALUES (?,?,?)", item.id, "at" in item ? item.at : -1, JSON.stringify(item));
+      this.storage.sql.exec("UPDATE backup_inventory SET cursor=?,complete=? WHERE id=1", result.cursor, result.cursor ? 0 : 1);
+      await this.storage.sync();
+    }
+    const complete = !!this.storage.sql.exec("SELECT complete FROM backup_inventory WHERE id=1").one().complete;
+    const rows = before ? this.storage.sql.exec("SELECT * FROM backup_index WHERE at<? OR (at=? AND id<?) ORDER BY at DESC,id DESC LIMIT 21", before.at, before.at, before.id).toArray() : this.storage.sql.exec("SELECT * FROM backup_index ORDER BY at DESC,id DESC LIMIT 21").toArray();
+    const page = rows.slice(0, 20).map((r) => JSON.parse(String(r.summary)));
+    const last = rows[19];
+    const newest = complete ? this.storage.sql.exec("SELECT summary FROM backup_index WHERE at>=0 ORDER BY at DESC,id DESC LIMIT 1").toArray()[0] : undefined;
+    const latest = newest ? JSON.parse(String(newest.summary)) : null;
+    if (latest && !await this.store.completed(this.scope, latest.id)) {
+      this.storage.sql.exec("DELETE FROM backup_index WHERE id=?", latest.id);
+      this.storage.sql.exec("UPDATE backup_inventory SET cursor=NULL,complete=0 WHERE id=1");
+      await this.storage.sync();
+      return {
+        page: page.filter((r) => r.id !== latest.id),
+        cursor: null,
+        inventory: "partial",
+        latest: null,
+        recoveryPoint: "unknown",
+        ageMs: null
+      };
+    }
+    return {
+      page,
+      cursor: rows.length > 20 ? btoa(JSON.stringify({
+        scope: this.scope,
+        at: Number(last.at),
+        id: String(last.id)
+      })) : null,
+      inventory: complete ? "complete" : "partial",
+      latest,
+      recoveryPoint: !complete ? "unknown" : !latest ? "missing" : Date.now() - latest.at > 86400000 ? "overdue" : "within-24h",
+      ageMs: latest ? Math.max(0, Date.now() - latest.at) : null
+    };
+  }
+}
+
 // packages/core/src/observability.ts
 class InvocationSummaries {
   sql;
@@ -7949,6 +8040,10 @@ class EnvironmentSupervisor extends DurableObject {
           connection.close(1008, "Unauthorized");
           return;
         }
+        if (state.dashboard && !await this.env.ADMIN_API.dashboardAllowed(this.config().scope, state.dashboard.email)) {
+          connection.close(1008, "Unauthorized");
+          return;
+        }
         connection.setState(state);
         await this.scheduleExpiry();
         connection.send('{"type":"ready"}');
@@ -7956,6 +8051,10 @@ class EnvironmentSupervisor extends DurableObject {
       onMessage: async (connection, message) => {
         await this.serial(async () => {
           try {
+            if (connection.state?.dashboard) {
+              connection.close(1002, "Read-only channel");
+              return;
+            }
             const auth = this.connectionAuth(connection), state = connection.state;
             const now = Date.now();
             if (!state.windowAt || now - state.windowAt >= 60000) {
@@ -8307,6 +8406,7 @@ class EnvironmentSupervisor extends DurableObject {
       await this.arm();
       await this.recover();
     }
+    await this.dashboardHint();
     return { hash: metadata.release.hash, unchanged: false };
   }
   async arm() {
@@ -8357,7 +8457,7 @@ class EnvironmentSupervisor extends DurableObject {
     }
   }
   async scheduleExpiry(exclude) {
-    const times = [...this.sockets.getConnections()].filter((c) => c.id !== exclude && c.state?.auth != null).map((c) => c.state?.expires ?? Date.now());
+    const times = [...this.sockets.getConnections()].filter((c) => c.id !== exclude && (c.state?.auth != null || !!c.state?.dashboard)).map((c) => c.state?.expires ?? Date.now());
     if (!times.length)
       await this.lifecycle.jobs.cancel("expire");
     else
@@ -8368,8 +8468,31 @@ class EnvironmentSupervisor extends DurableObject {
         singleflight: true
       });
   }
+  async dashboardHint() {
+    const allowed = new Map;
+    for (const c of this.sockets.getConnections()) {
+      const identity = c.state?.dashboard;
+      if (!identity)
+        continue;
+      try {
+        if (identity.expires <= Date.now()) {
+          c.close(1008, "Expired");
+          continue;
+        }
+        if (!allowed.has(identity.email))
+          allowed.set(identity.email, await this.env.ADMIN_API.dashboardAllowed(this.config().scope, identity.email));
+        if (!allowed.get(identity.email))
+          c.close(1008, "Revoked");
+        else
+          c.send('{"type":"invalidate"}');
+      } catch {
+        c.close(1008, "Unavailable");
+      }
+    }
+  }
   async broadcast() {
-    const connections = [...this.sockets.getConnections()];
+    await this.dashboardHint();
+    const connections = [...this.sockets.getConnections()].filter((c) => !c.state?.dashboard);
     if (!connections.length)
       return;
     const cache = new SnapshotCache;
@@ -8439,7 +8562,7 @@ class EnvironmentSupervisor extends DurableObject {
           const state = c.state;
           if (!state)
             c.close(1008, "Expired");
-          else if (state.auth) {
+          else if (state.auth || state.dashboard) {
             if (state.expires === null || state.expires <= Date.now())
               c.close(1008, "Expired");
             else
@@ -8560,6 +8683,7 @@ class EnvironmentSupervisor extends DurableObject {
         fail("UNAUTHORIZED");
       const result = await this.passwords().public(input.operation, input.body ?? {}, input.authorization?.slice(7) ?? null);
       this.closeRevokedSockets();
+      await this.dashboardHint();
       return result;
     });
   }
@@ -8696,6 +8820,8 @@ class EnvironmentSupervisor extends DurableObject {
     if (kind !== "query" || outcome !== "ok")
       await this.prune();
     this.summaries.record({ at: Date.now(), path, kind, status: outcome, ms });
+    if (kind !== "query")
+      await this.dashboardHint();
   }
   async event(path, kind, outcome, ms) {
     await this.serial(async () => this.record(path, kind, outcome, ms));
@@ -8722,7 +8848,7 @@ class EnvironmentSupervisor extends DurableObject {
     const store = new BackupStore(this.env.BUNDLES, this.env.FILES), scope = this.config().scope;
     const existing = await store.read(scope, id);
     if (existing)
-      return store.summary(existing);
+      return this.backupInventory().record(store.summary(existing));
     this.assertQuiet();
     await this.finishActivation();
     const data = await this.facetAdmin("backup-export");
@@ -8741,7 +8867,7 @@ class EnvironmentSupervisor extends DurableObject {
       size: Number(row.size),
       createdAt: Number(row.createdAt)
     }));
-    return store.create({
+    return this.backupInventory().record(await store.create({
       format: 1,
       id,
       scope,
@@ -8749,7 +8875,10 @@ class EnvironmentSupervisor extends DurableObject {
       bundle,
       data,
       authUsers: this.passwords().backupUsers()
-    }, files);
+    }, files));
+  }
+  backupInventory() {
+    return new BackupInventory(this.ctx.storage, new BackupStore(this.env.BUNDLES, this.env.FILES), this.config().scope);
   }
   async restoreBackup(input) {
     const scope = this.config().scope, source = scopeForDeletion(input.source);
@@ -8813,7 +8942,7 @@ class EnvironmentSupervisor extends DurableObject {
   }
   async admin(op, input) {
     await this.lifecycle.start();
-    return this.serial(async () => {
+    const result = await this.serial(async () => {
       if (this.removed)
         fail("NOT_FOUND");
       if (op.startsWith("auth-")) {
@@ -8859,7 +8988,7 @@ class EnvironmentSupervisor extends DurableObject {
       if (op === "backup-create")
         return this.createBackup(input.id);
       if (op === "backup-list")
-        return new BackupStore(this.env.BUNDLES, this.env.FILES).list(this.config().scope, input.cursor);
+        return this.backupInventory().list(input.cursor);
       if (op === "backup-pin") {
         const target = scopeForDeletion(input.target), scope = this.config().scope;
         if (target === scope || target.split("/")[0] !== scope.split("/")[0])
@@ -8878,7 +9007,7 @@ class EnvironmentSupervisor extends DurableObject {
       if (op === "backup-delete") {
         if (this.ctx.storage.sql.exec("SELECT 1 FROM backup_pins WHERE id=? LIMIT 1", input.id).toArray().length)
           fail("BACKUP_BUSY");
-        return new BackupStore(this.env.BUNDLES, this.env.FILES).remove(this.config().scope, input.id);
+        return this.backupInventory().remove(input.id);
       }
       if (op === "backup-restore")
         return this.restoreBackup(input);
@@ -8944,6 +9073,25 @@ class EnvironmentSupervisor extends DurableObject {
         };
       fail("INVALID_OPERATION");
     });
+    if ([
+      "auth-create",
+      "auth-password",
+      "auth-disable",
+      "auth-revoke",
+      "auth-configure",
+      "edit",
+      "file-upload",
+      "file-delete",
+      "job-cancel",
+      "cron-set",
+      "cron-cancel",
+      "backup-create",
+      "backup-delete",
+      "backup-restore",
+      "release-rollback"
+    ].includes(op))
+      await this.serial(() => this.dashboardHint());
+    return result;
   }
   async job(job) {
     await this.lifecycle.start();
@@ -8957,6 +9105,7 @@ class EnvironmentSupervisor extends DurableObject {
       return await promise;
     } finally {
       this.runningJobs.delete(job.id);
+      await this.serial(() => this.dashboardHint());
     }
   }
   async executeJob(job) {
@@ -8993,7 +9142,7 @@ class EnvironmentSupervisor extends DurableObject {
   }
   async fileCommand(op, input) {
     await this.lifecycle.start();
-    return this.serial(async () => {
+    const result = await this.serial(async () => {
       if (input?.origin && !fileOriginAllowed(input.origin, this.config().origins, this.env.DASHBOARD_URL))
         fail("FORBIDDEN");
       this.assertAvailable();
@@ -9013,6 +9162,9 @@ class EnvironmentSupervisor extends DurableObject {
         return this.files().complete(input.id);
       fail("INVALID_OPERATION");
     });
+    if (["reserve", "delete", "complete"].includes(op))
+      await this.serial(() => this.dashboardHint());
+    return result;
   }
   cronRows() {
     return this.ctx.storage.sql.exec("SELECT name,id,path,cron,enabled,schedulerId FROM crons ORDER BY name LIMIT 20").toArray().map((row) => ({ ...row, enabled: Number(row.enabled) === 1 }));
@@ -9073,7 +9225,7 @@ class EnvironmentSupervisor extends DurableObject {
   }
   async scheduleCommand(op, input) {
     await this.lifecycle.start();
-    return this.serial(async () => {
+    const result = await this.serial(async () => {
       if (op === "set")
         return this.setCron(input);
       if (op === "cancel")
@@ -9082,6 +9234,9 @@ class EnvironmentSupervisor extends DurableObject {
         return this.cronRows();
       fail("INVALID_OPERATION");
     });
+    if (op !== "list")
+      await this.serial(() => this.dashboardHint());
+    return result;
   }
 }
 
@@ -9155,6 +9310,30 @@ class AppCapability extends WorkerEntrypoint {
 }
 
 class RuntimeControl extends WorkerEntrypoint {
+  async fetch(request) {
+    try {
+      const url = new URL(request.url);
+      if (url.host !== "dashboard.internal" || request.headers.get("upgrade")?.toLowerCase() !== "websocket")
+        fail("FORBIDDEN");
+      const scope = scopeForDeletion(url.pathname.slice(1));
+      const identity = dashboardIdentity(JSON.parse(request.headers.get("x-flared-dashboard") ?? "null"));
+      if (!await this.env.ADMIN_API.dashboardAllowed(scope, identity.email))
+        fail("FORBIDDEN");
+      return getSupervisor(this.env, scope).fetch(new Request("https://dashboard.internal/", {
+        headers: {
+          upgrade: "websocket",
+          "x-flared-identity": stableJson({
+            auth: null,
+            expires: identity.expires,
+            dashboard: identity
+          })
+        }
+      }));
+    } catch (error) {
+      const result = status(error);
+      return Response.json({ error: result.code }, { status: result.status });
+    }
+  }
   async command(op, args) {
     return capture(async () => {
       if (![

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auersperg/flare",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "license": "MIT",
   "type": "module",
   "description": "Flare client, server declarations and development CLI",

package/dist/platform/dashboard/_astro/auth-view.DxyBDw7Z.js

@@ -1 +0,0 @@
-import{a as e,r as t}from"./client.BeKNsjPN.js";import{S as n,_ as r,a as i,b as a,f as o,g as s,mt as c,n as l,p as u,pt as d,s as f,u as p,v as m,x as h,y as g}from"./common.D6YHScsr.js";import{o as _}from"./index.astro_astro_type_script_index_0_lang.BQ7pqT75.js";var v=e(t(),1),y=c();function b(e){let t=s(e.project,e.env),[c,b]=(0,v.useState)(``),[x,S]=(0,v.useState)(),C=p(t+`/auth-users`+(c?`?cursor=`+encodeURIComponent(c):``)),w=p(t+`/auth-settings`),T=e.session.role===`owner`,E=(n,r,i,a=[])=>{S({title:r,description:`Passwords are never displayed. Changes revoke existing sessions.`,productionId:e.env===`prod`?e.project.id:void 0,fields:a,submit:async r=>{try{await u(t+`/`+n,{...i,...o(a,e=>new FormData(r).get(e)),confirm:e.project.id})}catch(e){throw e instanceof Error&&e.message===`INVALID_PASSWORD`?Error(`Password must contain 6–128 characters. Spaces are allowed; the password is not trimmed.`):e instanceof Error&&e.message===`REGISTRATION_UNAVAILABLE`?Error(`This login is already registered. Choose another login or manage the existing user.`):e}C.refresh(),w.refresh()}})},D={name:`password`,type:`password`,required:!0,description:`6–128 characters.`};return(0,y.jsxs)(`div`,{className:`space-y-4 p-4`,children:[(0,y.jsx)(`h1`,{className:`page-title`,children:`Auth`}),(0,y.jsx)(f,{loading:C.loading||w.loading,error:C.error||w.error}),w.data&&(0,y.jsxs)(`div`,{className:`flex flex-wrap items-center gap-2`,children:[(0,y.jsx)(_,{status:w.data.enabled?`Enabled`:`Disabled`}),(0,y.jsx)(_,{status:w.data.registration?`Public registration`:`Registration closed`}),T&&(0,y.jsx)(d,{variant:`outline`,onClick:()=>E(`auth-configure`,`Configure authentication`,{},[{name:`enabled`,type:`boolean`,value:w.data.enabled},{name:`registration`,type:`boolean`,value:w.data.registration}]),children:`Configure`}),T&&(0,y.jsx)(d,{onClick:()=>E(`auth-create`,`Create user`,{},[{name:`login`,type:`string`,required:!0},D]),children:`Create user`})]}),C.data&&(0,y.jsxs)(y.Fragment,{children:[(0,y.jsxs)(r,{children:[(0,y.jsx)(h,{children:(0,y.jsxs)(n,{children:[(0,y.jsx)(a,{children:`Login`}),(0,y.jsx)(a,{children:`User ID`}),(0,y.jsx)(a,{children:`Status`}),(0,y.jsx)(a,{children:`Created`}),(0,y.jsx)(a,{children:`Actions`})]})}),(0,y.jsx)(m,{children:C.data.users.map(e=>(0,y.jsxs)(n,{children:[(0,y.jsx)(g,{children:e.login}),(0,y.jsx)(g,{children:(0,y.jsx)(`code`,{children:e.id})}),(0,y.jsx)(g,{children:(0,y.jsx)(_,{status:e.disabled?`Blocked`:`Active`})}),(0,y.jsx)(g,{children:new Date(e.createdAt).toLocaleString()}),(0,y.jsx)(g,{children:(0,y.jsx)(`div`,{className:`flex flex-wrap gap-2`,children:T&&(0,y.jsxs)(y.Fragment,{children:[(0,y.jsx)(d,{variant:`outline`,size:`sm`,onClick:()=>E(`auth-password`,`Change user password`,{id:e.id},[D]),children:`Change password`}),(0,y.jsx)(d,{variant:`outline`,size:`sm`,onClick:()=>E(`auth-revoke`,`Revoke all sessions`,{id:e.id}),children:`Revoke sessions`}),(0,y.jsx)(d,{variant:`outline`,size:`sm`,onClick:()=>E(`auth-disable`,e.disabled?`Unblock user`:`Block user`,{id:e.id,disabled:!e.disabled}),children:e.disabled?`Unblock`:`Block`})]})})})]},e.id))})]}),!C.data.users.length&&(0,y.jsx)(l,{title:`No users`}),(0,y.jsxs)(`div`,{className:`flex gap-2`,children:[(0,y.jsx)(d,{variant:`outline`,disabled:!c,onClick:()=>b(``),children:`First page`}),(0,y.jsx)(d,{variant:`outline`,disabled:!C.data.next,onClick:()=>b(C.data.next),children:`Next page`})]})]}),x&&(0,y.jsx)(i,{modal:x,onClose:()=>S(void 0)})]})}export{b as default};