@hazem3500/komo 0.0.0-stage → 0.9.0

package/server/migrations/0001_comments.sql

@@ -0,0 +1,54 @@
+CREATE TABLE users (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  verified INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE sessions (
+  token_hash TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  project TEXT NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX session_expiry ON sessions(expires_at);
+CREATE TABLE threads (
+  id TEXT PRIMARY KEY,
+  project TEXT NOT NULL,
+  repo TEXT NOT NULL,
+  branch TEXT NOT NULL,
+  page TEXT NOT NULL,
+  anchor TEXT NOT NULL,
+  resolved INTEGER NOT NULL DEFAULT 0,
+  resolved_by TEXT REFERENCES users(id),
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE INDEX thread_scope ON threads(project, repo, branch, updated_at);
+CREATE TABLE comments (
+  id TEXT PRIMARY KEY,
+  thread_id TEXT NOT NULL REFERENCES threads(id) ON DELETE CASCADE,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  body TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  edited_at INTEGER
+);
+CREATE INDEX comment_thread ON comments(thread_id, created_at);
+CREATE TABLE reactions (
+  comment_id TEXT NOT NULL REFERENCES comments(id) ON DELETE CASCADE,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  emoji TEXT NOT NULL,
+  PRIMARY KEY(comment_id, user_id, emoji)
+);
+CREATE TABLE oauth_states (
+  state_hash TEXT PRIMARY KEY,
+  verifier TEXT NOT NULL,
+  project TEXT NOT NULL,
+  origin TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  exchange_hash TEXT NOT NULL,
+  session_token TEXT
+);
+CREATE TABLE rate_limits (
+  key TEXT PRIMARY KEY,
+  count INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL
+);

package/server/migrations/0002_identity.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN avatar_url TEXT;
+ALTER TABLE oauth_states ADD COLUMN provider TEXT NOT NULL DEFAULT 'github';

package/server/migrations/0003_accent_color.sql

@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN accent_color TEXT;

package/server/migrations/0004_workspaces.sql

@@ -0,0 +1,46 @@
+CREATE TABLE workspaces (
+  id TEXT PRIMARY KEY,
+  owner_id TEXT NOT NULL REFERENCES users(id),
+  repo TEXT NOT NULL,
+  origins TEXT NOT NULL,
+  suspended INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  CHECK(owner_id LIKE 'google:%')
+);
+CREATE INDEX workspace_owner ON workspaces(owner_id);
+CREATE TABLE project_owners (
+  project TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  CHECK(user_id LIKE 'google:%')
+);
+CREATE TABLE project_quotas (
+  project TEXT PRIMARY KEY,
+  max_comments INTEGER NOT NULL,
+  max_bytes INTEGER NOT NULL,
+  comments INTEGER NOT NULL DEFAULT 0,
+  bytes INTEGER NOT NULL DEFAULT 0
+);
+CREATE TRIGGER comment_quota_insert AFTER INSERT ON comments BEGIN
+  UPDATE project_quotas SET comments=comments+1, bytes=bytes+length(CAST(NEW.body AS BLOB))+256
+    WHERE project=(SELECT project FROM threads WHERE id=NEW.thread_id);
+  SELECT RAISE(ABORT, 'komo_quota_exceeded') WHERE EXISTS(SELECT 1 FROM project_quotas WHERE project=(SELECT project FROM threads WHERE id=NEW.thread_id) AND (comments>max_comments OR bytes>max_bytes));
+END;
+CREATE TRIGGER comment_quota_update AFTER UPDATE OF body ON comments BEGIN
+  UPDATE project_quotas SET bytes=bytes+length(CAST(NEW.body AS BLOB))-length(CAST(OLD.body AS BLOB)) WHERE project=(SELECT project FROM threads WHERE id=NEW.thread_id);
+  SELECT RAISE(ABORT, 'komo_quota_exceeded') WHERE EXISTS(SELECT 1 FROM project_quotas WHERE project=(SELECT project FROM threads WHERE id=NEW.thread_id) AND bytes>max_bytes);
+END;
+CREATE TRIGGER thread_quota_insert AFTER INSERT ON threads BEGIN
+  UPDATE project_quotas SET bytes=bytes+length(CAST(NEW.anchor AS BLOB))+length(CAST(NEW.page AS BLOB))+length(CAST(NEW.branch AS BLOB))+512 WHERE project=NEW.project;
+  SELECT RAISE(ABORT, 'komo_quota_exceeded') WHERE EXISTS(SELECT 1 FROM project_quotas WHERE project=NEW.project AND bytes>max_bytes);
+END;
+CREATE TRIGGER thread_quota_update AFTER UPDATE OF anchor ON threads BEGIN
+  UPDATE project_quotas SET bytes=bytes+length(CAST(NEW.anchor AS BLOB))-length(CAST(OLD.anchor AS BLOB)) WHERE project=NEW.project;
+  SELECT RAISE(ABORT, 'komo_quota_exceeded') WHERE EXISTS(SELECT 1 FROM project_quotas WHERE project=NEW.project AND bytes>max_bytes);
+END;
+CREATE TABLE setup_requests (
+  id TEXT PRIMARY KEY,
+  poll_hash TEXT NOT NULL,
+  config TEXT NOT NULL,
+  project TEXT,
+  expires_at INTEGER NOT NULL
+);

package/server/migrations/0005_domains.sql

@@ -0,0 +1,6 @@
+CREATE TABLE workspace_domains (
+  project TEXT NOT NULL REFERENCES workspaces(id),
+  origin TEXT NOT NULL,
+  verified_at INTEGER NOT NULL,
+  PRIMARY KEY(project,origin)
+);

package/server/migrations/0006_member_budget.sql

@@ -0,0 +1,16 @@
+CREATE TABLE project_members (
+  project TEXT NOT NULL,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  PRIMARY KEY(project,user_id)
+);
+CREATE TRIGGER member_quota_insert AFTER INSERT ON project_members BEGIN
+  UPDATE project_quotas SET bytes=bytes+13312 WHERE project=NEW.project;
+  SELECT RAISE(ABORT, 'komo_quota_exceeded') WHERE EXISTS(SELECT 1 FROM project_quotas WHERE project=NEW.project AND bytes>max_bytes);
+END;
+CREATE TRIGGER reaction_quota_insert AFTER INSERT ON reactions BEGIN
+  UPDATE project_quotas SET bytes=bytes+256 WHERE project=(SELECT t.project FROM comments c JOIN threads t ON t.id=c.thread_id WHERE c.id=NEW.comment_id);
+  SELECT RAISE(ABORT, 'komo_quota_exceeded') WHERE EXISTS(SELECT 1 FROM project_quotas WHERE project=(SELECT t.project FROM comments c JOIN threads t ON t.id=c.thread_id WHERE c.id=NEW.comment_id) AND bytes>max_bytes);
+END;
+CREATE TRIGGER reaction_quota_delete AFTER DELETE ON reactions BEGIN
+  UPDATE project_quotas SET bytes=MAX(0,bytes-256) WHERE project=(SELECT t.project FROM comments c JOIN threads t ON t.id=c.thread_id WHERE c.id=OLD.comment_id);
+END;

package/server/migrations/0007_revisions.sql

@@ -0,0 +1,17 @@
+CREATE TABLE scope_revisions (
+  project TEXT NOT NULL,
+  repo TEXT NOT NULL,
+  branch TEXT NOT NULL,
+  version INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY(project,repo,branch)
+);
+INSERT INTO scope_revisions(project,repo,branch,version) SELECT DISTINCT project,repo,branch,1 FROM threads;
+CREATE TRIGGER thread_revision_insert AFTER INSERT ON threads BEGIN
+  INSERT INTO scope_revisions(project,repo,branch,version) VALUES(NEW.project,NEW.repo,NEW.branch,1) ON CONFLICT(project,repo,branch) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER thread_revision_update AFTER UPDATE ON threads BEGIN
+  INSERT INTO scope_revisions(project,repo,branch,version) VALUES(NEW.project,NEW.repo,NEW.branch,1) ON CONFLICT(project,repo,branch) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER profile_revision_update AFTER UPDATE ON users BEGIN
+  UPDATE scope_revisions SET version=version+1 WHERE (project,repo,branch) IN (SELECT t.project,t.repo,t.branch FROM threads t JOIN comments c ON c.thread_id=t.id WHERE c.user_id=NEW.id);
+END;

package/server/migrations/0008_starter_comments.sql

@@ -0,0 +1 @@
+UPDATE project_quotas SET max_comments=250 WHERE max_comments=1000 AND project IN (SELECT id FROM workspaces);

package/server/migrations/0009_retention.sql

@@ -0,0 +1,19 @@
+-- Delete children while their scope and quota owner are still available.
+CREATE TRIGGER thread_delete_comments BEFORE DELETE ON threads BEGIN
+  DELETE FROM comments WHERE thread_id=OLD.id;
+END;
+CREATE TRIGGER comment_retention_delete AFTER DELETE ON comments BEGIN
+  UPDATE project_quotas SET comments=MAX(0,comments-1),
+    bytes=MAX(0,bytes-length(CAST(OLD.body AS BLOB))-256)
+    WHERE project=(SELECT project FROM threads WHERE id=OLD.thread_id);
+  UPDATE threads SET updated_at=MAX(updated_at+1,CAST(unixepoch('subsec')*1000 AS INTEGER))
+    WHERE id=OLD.thread_id;
+END;
+CREATE TRIGGER thread_retention_delete AFTER DELETE ON threads BEGIN
+  UPDATE project_quotas SET bytes=MAX(0,bytes-length(CAST(OLD.anchor AS BLOB))
+    -length(CAST(OLD.page AS BLOB))-length(CAST(OLD.branch AS BLOB))-512)
+    WHERE project=OLD.project;
+  INSERT INTO scope_revisions(project,repo,branch,version)
+    VALUES(OLD.project,OLD.repo,OLD.branch,1)
+    ON CONFLICT(project,repo,branch) DO UPDATE SET version=version+1;
+END;

package/server/migrations/0010_reviewer_history.sql

@@ -0,0 +1 @@
+CREATE INDEX comments_reviewer_history ON comments(user_id,created_at DESC);

package/server/migrations/0011_project_management.sql

@@ -0,0 +1,52 @@
+ALTER TABLE users ADD COLUMN email TEXT;
+CREATE TABLE project_settings (
+  project TEXT PRIMARY KEY,
+  access TEXT NOT NULL DEFAULT 'public' CHECK(access IN ('public','private'))
+);
+CREATE TABLE project_access (
+  project TEXT NOT NULL,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  PRIMARY KEY(project,user_id)
+);
+CREATE TABLE project_invites (
+  token_hash TEXT PRIMARY KEY,
+  project TEXT NOT NULL,
+  email TEXT NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX invite_project ON project_invites(project,expires_at);
+CREATE TRIGGER member_quota_delete AFTER DELETE ON project_members BEGIN
+  UPDATE project_quotas SET bytes=MAX(0,bytes-13312) WHERE project=OLD.project;
+END;
+
+CREATE TABLE export_revisions (project TEXT PRIMARY KEY, version INTEGER NOT NULL DEFAULT 0);
+CREATE TRIGGER export_threads_insert AFTER INSERT ON threads BEGIN
+ INSERT INTO export_revisions(project,version) SELECT NEW.project,1 WHERE NEW.project IS NOT NULL ON CONFLICT(project) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER export_threads_update AFTER UPDATE ON threads BEGIN
+ INSERT INTO export_revisions(project,version) SELECT NEW.project,1 WHERE NEW.project IS NOT NULL ON CONFLICT(project) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER export_threads_delete AFTER DELETE ON threads BEGIN
+ INSERT INTO export_revisions(project,version) SELECT OLD.project,1 WHERE OLD.project IS NOT NULL ON CONFLICT(project) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER export_comments_insert AFTER INSERT ON comments BEGIN
+ INSERT INTO export_revisions(project,version) SELECT (SELECT project FROM threads WHERE id=NEW.thread_id),1 WHERE (SELECT project FROM threads WHERE id=NEW.thread_id) IS NOT NULL ON CONFLICT(project) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER export_comments_update AFTER UPDATE ON comments BEGIN
+ INSERT INTO export_revisions(project,version) SELECT (SELECT project FROM threads WHERE id=NEW.thread_id),1 WHERE (SELECT project FROM threads WHERE id=NEW.thread_id) IS NOT NULL ON CONFLICT(project) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER export_comments_delete AFTER DELETE ON comments BEGIN
+ INSERT INTO export_revisions(project,version) SELECT (SELECT project FROM threads WHERE id=OLD.thread_id),1 WHERE (SELECT project FROM threads WHERE id=OLD.thread_id) IS NOT NULL ON CONFLICT(project) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER export_reactions_insert AFTER INSERT ON reactions BEGIN
+ INSERT INTO export_revisions(project,version) SELECT (SELECT t.project FROM comments c JOIN threads t ON t.id=c.thread_id WHERE c.id=NEW.comment_id),1 WHERE (SELECT t.project FROM comments c JOIN threads t ON t.id=c.thread_id WHERE c.id=NEW.comment_id) IS NOT NULL ON CONFLICT(project) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER export_reactions_update AFTER UPDATE ON reactions BEGIN
+ INSERT INTO export_revisions(project,version) SELECT (SELECT t.project FROM comments c JOIN threads t ON t.id=c.thread_id WHERE c.id=NEW.comment_id),1 WHERE (SELECT t.project FROM comments c JOIN threads t ON t.id=c.thread_id WHERE c.id=NEW.comment_id) IS NOT NULL ON CONFLICT(project) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER export_reactions_delete AFTER DELETE ON reactions BEGIN
+ INSERT INTO export_revisions(project,version) SELECT (SELECT t.project FROM comments c JOIN threads t ON t.id=c.thread_id WHERE c.id=OLD.comment_id),1 WHERE (SELECT t.project FROM comments c JOIN threads t ON t.id=c.thread_id WHERE c.id=OLD.comment_id) IS NOT NULL ON CONFLICT(project) DO UPDATE SET version=version+1;
+END;
+CREATE TRIGGER export_profile_update AFTER UPDATE ON users BEGIN
+ UPDATE export_revisions SET version=version+1 WHERE project IN (SELECT project FROM project_members WHERE user_id=NEW.id);
+END;

package/server/migrations/0012_setup_sites.sql

@@ -0,0 +1,3 @@
+-- Bind the owner's explicit site approvals to this one-use OAuth handoff.
+-- Existing reviewer and hosted-management sign-ins leave this column null.
+ALTER TABLE oauth_states ADD COLUMN approved_origins TEXT;

package/server/migrations/0013_project_sites.sql

@@ -0,0 +1,8 @@
+-- Owner-approved sites for projects configured in PROJECTS. Hosted
+-- workspaces keep theirs in workspace_domains, which references workspaces.
+CREATE TABLE project_sites (
+  project TEXT NOT NULL,
+  origin TEXT NOT NULL,
+  added_at INTEGER NOT NULL,
+  PRIMARY KEY(project,origin)
+);

package/server/migrations/0014_project_site_removals.sql

@@ -0,0 +1,3 @@
+-- Let owners remove sites that come from PROJECTS config. A removed row hides
+-- that config origin; other rows add sites on top of the config.
+ALTER TABLE project_sites ADD COLUMN removed INTEGER NOT NULL DEFAULT 0;

package/server/migrations/0015_query_efficiency.sql

@@ -0,0 +1,6 @@
+-- Match the list ordering; retain thread_scope for updated-at consumers.
+CREATE INDEX thread_created_scope ON threads(project,repo,branch,created_at,id);
+CREATE INDEX rate_limit_expiry ON rate_limits(expires_at);
+CREATE INDEX oauth_state_expiry ON oauth_states(expires_at);
+CREATE INDEX invite_expiry ON project_invites(expires_at);
+CREATE INDEX setup_request_expiry ON setup_requests(expires_at);

package/server/migrations/0016_thread_tags.sql

@@ -0,0 +1 @@
+ALTER TABLE threads ADD COLUMN tags TEXT NOT NULL DEFAULT '[]';

package/server/migrations/0017_project_webhooks.sql

@@ -0,0 +1,4 @@
+ALTER TABLE project_settings ADD COLUMN webhook_url TEXT;
+ALTER TABLE project_settings ADD COLUMN webhook_secret TEXT;
+ALTER TABLE project_settings ADD COLUMN webhook_events TEXT;
+ALTER TABLE project_settings ADD COLUMN webhook_enabled INTEGER NOT NULL DEFAULT 0;

package/server/node-webhooks.ts

@@ -0,0 +1,126 @@
+import { request as httpsRequest } from "node:https";
+import { lookup } from "node:dns/promises";
+import { isIP, type LookupFunction } from "node:net";
+import { validateWebhookUrl } from "./webhooks";
+
+const MAX_IN_FLIGHT = 8;
+const MAX_BODY_BYTES = 16 * 1024;
+let inFlight = 0;
+
+export function isPublicAddress(address: string) {
+  const version = isIP(address);
+  if (version === 4) {
+    const octets = address.split(".").map(Number);
+    const [a, b, c] = octets;
+    if (octets.length !== 4 || octets.some((value) => value < 0 || value > 255))
+      return false;
+    return !(
+      a === 0 ||
+      a === 10 ||
+      a === 127 ||
+      (a === 100 && b >= 64 && b <= 127) ||
+      (a === 169 && b === 254) ||
+      (a === 172 && b >= 16 && b <= 31) ||
+      (a === 192 && b === 0 && c === 0) ||
+      (a === 192 && b === 0 && c === 2) ||
+      (a === 192 && b === 88 && c === 99) ||
+      (a === 192 && b === 168) ||
+      (a === 198 && (b === 18 || b === 19)) ||
+      (a === 198 && b === 51 && c === 100) ||
+      (a === 203 && b === 0 && c === 113) ||
+      a >= 224
+    );
+  }
+  if (version !== 6 || address.includes("%")) return false;
+  const normalized = address.toLowerCase();
+  // Permit only global-unicast 2000::/3; reject documentation, transition,
+  // protocol-assignment, and IPv4-mapped ranges within it as well.
+  if (!/^[23]/.test(normalized)) return false;
+  const secondGroup = Number.parseInt(normalized.split(":")[1] || "0", 16);
+  return !(
+    normalized.startsWith("2001:db8:") ||
+    (normalized.startsWith("2001:") && secondGroup <= 0x1ff) ||
+    normalized.startsWith("2002:") ||
+    normalized.startsWith("3fff:") ||
+    normalized.startsWith("::ffff:")
+  );
+}
+
+export function assertPublicDnsRecords(records: { address: string; family: number }[]) {
+  if (!records.length || records.some((record) => !isPublicAddress(record.address)))
+    throw new Error("Webhook host did not resolve exclusively to public addresses.");
+}
+
+export function pinnedLookup(address: { address: string; family: number }): LookupFunction {
+  return (_hostname, options, callback) => {
+    if (options.all) callback(null, [{ address: address.address, family: address.family }]);
+    else callback(null, address.address, address.family);
+  };
+}
+
+export async function sendWebhookPinned(
+  urlValue: string,
+  body: string,
+  headers: Record<string, string>
+) {
+  if (inFlight >= MAX_IN_FLIGHT) throw new Error("Webhook capacity reached.");
+  if (Buffer.byteLength(body, "utf8") > MAX_BODY_BYTES)
+    throw new Error("Webhook payload exceeds the delivery limit.");
+  const url = new URL(validateWebhookUrl(urlValue));
+  inFlight++;
+  try {
+    let dnsTimer: NodeJS.Timeout | undefined;
+    const records = await Promise.race([
+      lookup(url.hostname, { all: true, verbatim: true }),
+      new Promise<never>((_, reject) => {
+        dnsTimer = setTimeout(() => reject(new Error("Webhook DNS lookup timed out.")), 2_000);
+      }),
+    ]).finally(() => clearTimeout(dnsTimer));
+    assertPublicDnsRecords(records);
+    const address = records[0];
+    await new Promise<void>((resolve, reject) => {
+      let settled = false;
+      let totalTimer: NodeJS.Timeout;
+      const finish = (error?: Error) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(totalTimer);
+        if (error) reject(error);
+        else resolve();
+      };
+      const req = httpsRequest(
+        url,
+        {
+          method: "POST",
+          headers: {
+            ...headers,
+            "Content-Type": "application/json",
+            "Content-Length": Buffer.byteLength(body, "utf8"),
+          },
+          timeout: 2_000,
+          lookup: pinnedLookup(address),
+        },
+        (response) => {
+          // Read and discard a bounded amount. Never follow redirects or log bodies.
+          let read = 0;
+          response.on("data", (chunk: Buffer) => {
+            read += chunk.length;
+            if (read > 1024) response.destroy();
+          });
+          response.on("end", () => finish());
+          response.on("close", () => finish());
+          response.on("error", (error) => finish(error));
+        }
+      );
+      totalTimer = setTimeout(
+        () => req.destroy(new Error("Webhook timed out.")),
+        2_000
+      );
+      req.on("timeout", () => req.destroy(new Error("Webhook timed out.")));
+      req.on("error", (error) => finish(error));
+      req.end(body);
+    });
+  } finally {
+    inFlight--;
+  }
+}