@motherbase/cli 0.2.4 → 0.2.5

package/src/commands/users.js

@@ -104,10 +104,39 @@ const subcommands = {
       output(ctx, data, (d, ui) => ui.success(`Sessions revoked for ${id}`));
     },
   },
+  audit: {
+    summary: 'Read the auth audit log, newest first',
+    usage: 'motherbase users audit [--action <a>] [--actor <email|id>] [--type <log type>] [--from <iso>] [--to <iso>] [--limit <n>]',
+    async run(ctx, args, flags) {
+      const query = {
+        action: flags.action,
+        actor: flags.actor,
+        log_type: flags.type,
+        from: flags.from,
+        to: flags.to,
+        per_page: flags.limit || 50,
+      };
+      const data = await api.adminRequest(ctx, 'GET', '/auth/audit-logs', { query });
+      const entries = ((data && data.entries) || []).map(e => ({
+        at: e.created_at,
+        action: e.payload.action,
+        actor: e.payload.actor_username || e.payload.actor_id,
+        ip: e.ip_address,
+      }));
+      output(ctx, data, (_d, ui) =>
+        ui.table(entries, [
+          { key: 'at', label: 'AT' },
+          { key: 'action', label: 'ACTION' },
+          { key: 'actor', label: 'ACTOR' },
+          { key: 'ip', label: 'IP' },
+        ]),
+      );
+    },
+  },
 };
 
 module.exports = {
   summary: 'Project auth users',
-  usage: 'motherbase users <list|get|create|update|delete|reset-password|promote|demote|revoke-sessions> ...',
+  usage: 'motherbase users <list|get|create|update|delete|reset-password|promote|demote|revoke-sessions|audit> ...',
   subcommands,
 };

package/src/commands/vault.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+const { CliError } = require('../context');
+
+const subcommands = {
+  list: {
+    summary: 'List Vault secrets (names and metadata, never values)',
+    usage: 'motherbase vault list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/vault');
+      const secrets = (data && data.secrets) || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table(secrets, [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'NAME' },
+          { key: 'description', label: 'DESCRIPTION' },
+          { key: 'updatedAt', label: 'UPDATED' },
+        ]),
+      );
+    },
+  },
+  enable: {
+    summary: 'Install the Vault for this project',
+    usage: 'motherbase vault enable',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'POST', '/vault/enable');
+      output(ctx, data, (_d, ui) => ui.success('Vault enabled'));
+    },
+  },
+  create: {
+    summary: 'Store an encrypted secret',
+    usage: 'motherbase vault create <name> --secret <value> [--description <text>]',
+    async run(ctx, args, flags) {
+      const name = requireArg(args[0], 'name');
+      if (typeof flags.secret !== 'string') throw new CliError('--secret is required');
+      const body = { name, secret: flags.secret };
+      if (typeof flags.description === 'string') body.description = flags.description;
+      const data = await api.adminRequest(ctx, 'POST', '/vault/secrets', { body });
+      output(ctx, data, (_d, ui) => ui.success(`Created secret ${name}`));
+    },
+  },
+  update: {
+    summary: 'Rename a secret, change its value or its description',
+    usage: 'motherbase vault update <id> [--name <n>] [--secret <value>] [--description <text>]',
+    async run(ctx, args, flags) {
+      const id = requireArg(args[0], 'id');
+      const body = {};
+      for (const key of ['name', 'secret', 'description']) {
+        if (typeof flags[key] === 'string') body[key] = flags[key];
+      }
+      if (!Object.keys(body).length) throw new CliError('nothing to update: pass --name, --secret or --description');
+      const data = await api.adminRequest(ctx, 'PATCH', `/vault/secrets/${encodeURIComponent(id)}`, { body });
+      output(ctx, data, (_d, ui) => ui.success(`Updated secret ${id}`));
+    },
+  },
+  reveal: {
+    summary: 'Print the decrypted value of a secret',
+    usage: 'motherbase vault reveal <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'GET', `/vault/secrets/${encodeURIComponent(id)}/reveal`);
+      output(ctx, data, (d, ui) => ui.print(String((d && d.secret) ?? '')));
+    },
+  },
+  delete: {
+    summary: 'Delete a secret',
+    usage: 'motherbase vault delete <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'DELETE', `/vault/secrets/${encodeURIComponent(id)}`);
+      output(ctx, data, (_d, ui) => ui.success(`Deleted secret ${id}`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Encrypted secrets (Vault)',
+  usage: 'motherbase vault <list|enable|create|update|reveal|delete> ...',
+  subcommands,
+};

package/src/commands/wrappers.js

@@ -0,0 +1,150 @@
+'use strict';
+
+const api = require('../api');
+const { output, requireArg, parseKeyValues } = require('./_util');
+const { CliError } = require('../context');
+
+const enc = encodeURIComponent;
+
+// `--option host=db.example.com --option port=5432`, repeatable.
+function options(flags) {
+  return parseKeyValues([].concat(flags.option || []), { coerce: false });
+}
+
+// `schema.name` -> [schema, name]
+function qualified(ref) {
+  const [schema, name, ...rest] = requireArg(ref, 'schema.table').split('.');
+  if (!schema || !name || rest.length) throw new CliError('expected <schema>.<table>');
+  return [schema, name];
+}
+
+// `--column id:integer --column label:text`, repeatable.
+function columns(flags) {
+  const specs = [].concat(flags.column || []);
+  if (!specs.length) throw new CliError('at least one --column <name>:<type> is required');
+  return specs.map(spec => {
+    const idx = String(spec).indexOf(':');
+    if (idx <= 0) throw new CliError(`expected <name>:<type>, got "${spec}"`);
+    return { name: spec.slice(0, idx), type: spec.slice(idx + 1) };
+  });
+}
+
+const subcommands = {
+  list: {
+    summary: 'List wrappers, foreign servers and foreign tables',
+    usage: 'motherbase wrappers list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/wrappers');
+      output(ctx, data, (d, ui) => {
+        ui.table((d && d.wrappers) || [], [
+          { key: 'name', label: 'WRAPPER' },
+          { key: 'available', label: 'AVAILABLE' },
+          { key: 'installed', label: 'INSTALLED' },
+        ]);
+        ui.table((d && d.servers) || [], [
+          { key: 'name', label: 'SERVER' },
+          { key: 'wrapper', label: 'WRAPPER' },
+          { key: 'remoteUser', label: 'REMOTE USER' },
+          { key: 'foreignTables', label: 'TABLES' },
+        ]);
+        ui.table((d && d.tables) || [], [
+          { key: 'schema', label: 'SCHEMA' },
+          { key: 'name', label: 'TABLE' },
+          { key: 'server', label: 'SERVER' },
+          { key: 'columns', label: 'COLUMNS' },
+        ]);
+      });
+    },
+  },
+  enable: {
+    summary: 'Install a wrapper extension',
+    usage: 'motherbase wrappers enable <postgres_fdw|file_fdw>',
+    async run(ctx, args) {
+      const wrapper = requireArg(args[0], 'wrapper');
+      const data = await api.adminRequest(ctx, 'POST', `/wrappers/${enc(wrapper)}/enable`);
+      output(ctx, data, (_d, ui) => ui.success(`Enabled ${wrapper}`));
+    },
+  },
+  'create-server': {
+    summary: 'Create a foreign server; the password goes to the Vault',
+    usage:
+      'motherbase wrappers create-server <name> --wrapper <postgres_fdw|file_fdw> [--option k=v ...] [--user <u> --password <p>]',
+    async run(ctx, args, flags) {
+      const name = requireArg(args[0], 'name');
+      const body = { name, wrapper: requireArg(flags.wrapper, '--wrapper'), options: options(flags) };
+      if (typeof flags.user === 'string') body.user = flags.user;
+      if (typeof flags.password === 'string') body.password = flags.password;
+      const data = await api.adminRequest(ctx, 'POST', '/wrappers/servers', { body });
+      output(ctx, data, (_d, ui) => ui.success(`Created foreign server ${name}`));
+    },
+  },
+  'drop-server': {
+    summary: 'Drop a foreign server',
+    usage: 'motherbase wrappers drop-server <name>',
+    async run(ctx, args) {
+      const name = requireArg(args[0], 'name');
+      const data = await api.adminRequest(ctx, 'DELETE', `/wrappers/servers/${enc(name)}`);
+      output(ctx, data, (_d, ui) => ui.success(`Dropped foreign server ${name}`));
+    },
+  },
+  credentials: {
+    summary: 'Replace the remote credentials of a foreign server',
+    usage: 'motherbase wrappers credentials <server> --user <u> --password <p>',
+    async run(ctx, args, flags) {
+      const name = requireArg(args[0], 'server');
+      if (typeof flags.user !== 'string' || typeof flags.password !== 'string') {
+        throw new CliError('--user and --password are required');
+      }
+      const body = { user: flags.user, password: flags.password };
+      const data = await api.adminRequest(ctx, 'PUT', `/wrappers/servers/${enc(name)}/credentials`, { body });
+      output(ctx, data, (_d, ui) => ui.success(`Updated credentials of ${name}`));
+    },
+  },
+  import: {
+    summary: 'Import a remote schema as foreign tables',
+    usage:
+      'motherbase wrappers import <server> --remote-schema <s> --local-schema <s> [--tables a,b]',
+    async run(ctx, args, flags) {
+      const name = requireArg(args[0], 'server');
+      const body = {
+        remoteSchema: requireArg(flags['remote-schema'], '--remote-schema'),
+        localSchema: requireArg(flags['local-schema'], '--local-schema'),
+      };
+      if (typeof flags.tables === 'string') body.tables = flags.tables.split(',').map(t => t.trim()).filter(Boolean);
+      const data = await api.adminRequest(ctx, 'POST', `/wrappers/servers/${enc(name)}/import`, { body });
+      output(ctx, data, (_d, ui) => ui.success(`Imported ${body.remoteSchema} into ${body.localSchema}`));
+    },
+  },
+  'create-table': {
+    summary: 'Create one foreign table',
+    usage:
+      'motherbase wrappers create-table <schema>.<table> --server <s> --column <name>:<type> ... [--option k=v ...]',
+    async run(ctx, args, flags) {
+      const [schema, name] = qualified(args[0]);
+      const body = {
+        server: requireArg(flags.server, '--server'),
+        schema,
+        name,
+        columns: columns(flags),
+        options: options(flags),
+      };
+      const data = await api.adminRequest(ctx, 'POST', '/wrappers/tables', { body });
+      output(ctx, data, (_d, ui) => ui.success(`Created foreign table ${schema}.${name}`));
+    },
+  },
+  'drop-table': {
+    summary: 'Drop a foreign table',
+    usage: 'motherbase wrappers drop-table <schema>.<table>',
+    async run(ctx, args) {
+      const [schema, name] = qualified(args[0]);
+      const data = await api.adminRequest(ctx, 'DELETE', `/wrappers/tables/${enc(schema)}/${enc(name)}`);
+      output(ctx, data, (_d, ui) => ui.success(`Dropped foreign table ${schema}.${name}`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Foreign data wrappers (postgres_fdw, file_fdw)',
+  usage: 'motherbase wrappers <list|enable|create-server|drop-server|credentials|import|create-table|drop-table> ...',
+  subcommands,
+};

package/src/edge-templates.js

@@ -0,0 +1,194 @@
+'use strict';
+
+// Starting points for `motherbase functions new --template <id>`. Pure data.
+// The Studio's "new function" picker offers the same list
+// (apps/studio/src/features/api-tools/lib/function-templates.ts): keep the ids
+// and sources in step.
+//
+// Every source is a module-shaped function (`export default handler`) that runs
+// on the Deno edge runtime. `%NAME%` is replaced with the function's name.
+
+const templates = [
+  {
+    id: 'hello-world',
+    label: 'Hello world',
+    description: 'Echo the request body and the time.',
+    source: `// Edge function: %NAME%
+//
+// Runs on Deno with the whole Web platform: Request, Response, fetch, streams,
+// crypto.subtle (for webhook signature checks) and friends. npm:, jsr: and URL
+// imports load as they do on Deno; a bare package name is read as npm:
+//
+//   import { z } from 'zod';
+//
+// \`env\` holds this project's edge secrets, and \`sendMail()\` sends through the
+// project's own SMTP settings (the same transport auth uses):
+//
+//   await sendMail({ to: 'sales@example.com', subject: 'New lead', text: '...' });
+
+export default async (req: Request) => {
+  const body = req.method === 'GET' ? {} : await req.json().catch(() => ({}));
+  return Response.json({ hello: '%NAME%', received: body, at: new Date().toISOString() });
+};
+`,
+  },
+  {
+    id: 'stripe-webhook',
+    label: 'Stripe webhook',
+    description: 'Verify a Stripe signature, then handle the event.',
+    source: `// Edge function: %NAME%
+// Secrets to set: STRIPE_WEBHOOK_SECRET (the endpoint's "whsec_..." signing secret).
+
+const encoder = new TextEncoder();
+
+async function sign(secret: string, payload: string): Promise<string> {
+  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  const mac = await crypto.subtle.sign('HMAC', key, encoder.encode(payload));
+  return [...new Uint8Array(mac)].map(byte => byte.toString(16).padStart(2, '0')).join('');
+}
+
+export default async (req: Request) => {
+  // The raw body: a re-serialised one no longer matches the signature.
+  const payload = await req.text();
+  const header = req.headers.get('stripe-signature') ?? '';
+  const parts = Object.fromEntries(header.split(',').map(part => part.split('=') as [string, string]));
+  const expected = await sign(env.STRIPE_WEBHOOK_SECRET, \`\${parts.t}.\${payload}\`);
+  if (!parts.v1 || parts.v1 !== expected) return new Response('Invalid signature', { status: 400 });
+
+  const event = JSON.parse(payload);
+  switch (event.type) {
+    case 'checkout.session.completed':
+      console.log('checkout completed', event.data.object.id);
+      break;
+    default:
+      console.log('ignored event', event.type);
+  }
+  return Response.json({ received: true });
+};
+`,
+  },
+  {
+    id: 'openai',
+    label: 'OpenAI',
+    description: 'Send a prompt to OpenAI and return the answer.',
+    source: `// Edge function: %NAME%
+// Secrets to set: OPENAI_API_KEY.
+
+export default async (req: Request) => {
+  const { prompt } = await req.json();
+  if (typeof prompt !== 'string' || !prompt) return Response.json({ error: 'prompt is required' }, { status: 400 });
+
+  const response = await fetch('https://api.openai.com/v1/chat/completions', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', authorization: \`Bearer \${env.OPENAI_API_KEY}\` },
+    body: JSON.stringify({ model: 'gpt-4o-mini', messages: [{ role: 'user', content: prompt }] }),
+  });
+  if (!response.ok) return Response.json({ error: 'OpenAI request failed' }, { status: 502 });
+
+  const completion = await response.json();
+  return Response.json({ answer: completion.choices[0].message.content });
+};
+`,
+  },
+  {
+    id: 'resend-email',
+    label: 'Send email',
+    description: 'Send a transactional email with Resend, or with sendMail.',
+    source: `// Edge function: %NAME%
+// Secrets to set: RESEND_API_KEY. Prefer this project's own SMTP? Replace the
+// fetch below with: await sendMail({ to, subject, html });
+
+export default async (req: Request) => {
+  const { to, subject, html } = await req.json();
+  if (!to || !subject || !html) return Response.json({ error: 'to, subject and html are required' }, { status: 400 });
+
+  const response = await fetch('https://api.resend.com/emails', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', authorization: \`Bearer \${env.RESEND_API_KEY}\` },
+    body: JSON.stringify({ from: 'Acme <onboarding@resend.dev>', to, subject, html }),
+  });
+  return Response.json(await response.json(), { status: response.ok ? 200 : 502 });
+};
+`,
+  },
+  {
+    id: 'image-transform',
+    label: 'Image transform',
+    description: 'Resize an image fetched from a URL.',
+    source: `// Edge function: %NAME%
+// GET ?url=<image>&width=<px>. Uses ImageScript, a pure-JS image library.
+
+import { Image } from 'npm:imagescript@1';
+
+export default async (req: Request) => {
+  const params = new URL(req.url).searchParams;
+  const source = params.get('url');
+  const width = Math.min(Number(params.get('width') ?? 320), 2000);
+  if (!source || !Number.isFinite(width) || width < 1) return new Response('url and a positive width are required', { status: 400 });
+
+  const upstream = await fetch(source);
+  if (!upstream.ok) return new Response('Could not fetch the image', { status: 502 });
+
+  const image = await Image.decode(new Uint8Array(await upstream.arrayBuffer()));
+  const resized = image.resize(width, Image.RESIZE_AUTO);
+  return new Response(await resized.encode(), { headers: { 'content-type': 'image/png' } });
+};
+`,
+  },
+  {
+    id: 'websocket',
+    label: 'WebSocket',
+    description: 'Upgrade the request and echo every message.',
+    source: `// Edge function: %NAME%
+
+export default (req: Request) => {
+  if (req.headers.get('upgrade') !== 'websocket') return new Response('Expected a WebSocket upgrade', { status: 426 });
+
+  const { socket, response } = Deno.upgradeWebSocket(req);
+  socket.onopen = () => console.log('client connected');
+  socket.onmessage = event => socket.send(\`echo: \${event.data}\`);
+  socket.onclose = () => console.log('client disconnected');
+  return response;
+};
+`,
+  },
+  {
+    id: 'storage-upload',
+    label: 'Storage upload',
+    description: 'Store a request body as a file in Storage.',
+    source: `// Edge function: %NAME%
+// Secrets to set: SERVICE_TOKEN (a token allowed to write files). API_URL is
+// optional and defaults to this project's own API.
+
+export default async (req: Request) => {
+  const { path, text } = await req.json();
+  if (!path || typeof text !== 'string') return Response.json({ error: 'path and text are required' }, { status: 400 });
+
+  const form = new FormData();
+  form.append('file', new Blob([text], { type: 'text/plain' }), path);
+  form.append('path', path);
+
+  const response = await fetch(\`\${env.API_URL ?? 'http://api:5001'}/api/files/\`, {
+    method: 'POST',
+    headers: { authorization: \`Bearer \${env.SERVICE_TOKEN}\` },
+    body: form,
+  });
+  return Response.json(await response.json(), { status: response.ok ? 200 : 502 });
+};
+`,
+  },
+];
+
+const DEFAULT_TEMPLATE = 'hello-world';
+
+/** The template with this id, or undefined. */
+function findTemplate(id) {
+  return templates.find(template => template.id === id);
+}
+
+/** The source of a template for a function of this name. */
+function renderTemplate(template, name) {
+  return template.source.replace(/%NAME%/g, name);
+}
+
+module.exports = { templates, DEFAULT_TEMPLATE, findTemplate, renderTemplate };

package/src/format.js

@@ -0,0 +1,92 @@
+'use strict';
+
+// Machine output formats for `-o/--output`, matching the Supabase CLI's set
+// (minus toml). `pretty` is each command's own human renderer; the rest are
+// rendered here from the command's data, so every command gets them for free.
+
+const { CliError } = require('./context');
+
+const FORMATS = ['pretty', 'json', 'yaml', 'env'];
+
+// Resolved once in main (`-o json` also sets `json`), but commands and tests
+// that only pass `json: true` still land on the right format.
+function outputFormat(flags = {}) {
+  return flags.format || (flags.json ? 'json' : 'pretty');
+}
+
+// ── YAML ─────────────────────────────────────────────────────────────────────
+
+const YAML_RESERVED = /^(true|false|yes|no|on|off|null|~)$/i;
+
+// A string stays plain only when YAML would read it back as that same string;
+// anything else is double-quoted, and JSON's quoting is valid YAML.
+function yamlScalar(value) {
+  if (value === null || value === undefined) return 'null';
+  if (typeof value !== 'string') return String(value);
+  const plain =
+    /^[A-Za-z0-9_./@-][A-Za-z0-9_ ./@:-]*$/.test(value) &&
+    !/(: |:$| $)/.test(value) &&
+    !YAML_RESERVED.test(value) &&
+    Number.isNaN(Number(value)) &&
+    !/^\d{4}-\d\d-\d\d/.test(value);
+  return plain ? value : JSON.stringify(value);
+}
+
+function isNonEmptyCollection(value) {
+  return value !== null && typeof value === 'object' && Object.keys(value).length > 0;
+}
+
+function yamlLines(value) {
+  if (Array.isArray(value)) {
+    if (!value.length) return ['[]'];
+    return value.flatMap(item => {
+      const lines = yamlLines(item);
+      return [`- ${lines[0]}`, ...lines.slice(1).map(l => `  ${l}`)];
+    });
+  }
+  if (value !== null && typeof value === 'object') {
+    const keys = Object.keys(value).filter(k => value[k] !== undefined);
+    if (!keys.length) return ['{}'];
+    return keys.flatMap(key => {
+      const child = value[key];
+      const lines = yamlLines(child);
+      return isNonEmptyCollection(child)
+        ? [`${yamlScalar(key)}:`, ...lines.map(l => `  ${l}`)]
+        : [`${yamlScalar(key)}: ${lines[0]}`];
+    });
+  }
+  return [yamlScalar(value)];
+}
+
+function toYaml(value) {
+  return yamlLines(value).join('\n') + '\n';
+}
+
+// ── env ──────────────────────────────────────────────────────────────────────
+
+// `apiUrl` → `API_URL`, nested keys joined with `_`, as `supabase status -o env`.
+function envKey(key) {
+  return String(key)
+    .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+    .replace(/[^A-Za-z0-9]+/g, '_')
+    .toUpperCase();
+}
+
+function flattenEnv(value, prefix, out) {
+  for (const [key, child] of Object.entries(value)) {
+    if (child === undefined) continue;
+    const name = prefix ? `${prefix}_${envKey(key)}` : envKey(key);
+    if (child !== null && typeof child === 'object') flattenEnv(child, name, out);
+    else out.push(`${name}=${JSON.stringify(child === null ? '' : String(child))}`);
+  }
+  return out;
+}
+
+function toEnv(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new CliError('The env output format needs a single object; this command returns a list. Use -o json or -o yaml.');
+  }
+  return flattenEnv(value, '', []).join('\n') + '\n';
+}
+
+module.exports = { FORMATS, outputFormat, toYaml, toEnv };

package/src/inspect/csv.js

@@ -0,0 +1,22 @@
+'use strict';
+
+// CSV for `inspect report`, written the way Postgres' `COPY ... TO STDOUT WITH
+// CSV HEADER` writes it (which is how the Supabase CLI produces its report), so
+// the files read the same whichever tool made them: NULL is an empty field, an
+// empty string is `""`, booleans are `t`/`f`.
+
+function field(value) {
+  if (value === null || value === undefined) return '';
+  if (typeof value === 'boolean') return value ? 't' : 'f';
+  const text = typeof value === 'object' ? JSON.stringify(value) : String(value);
+  return text === '' || /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
+/** One CSV document: a header of column keys, then one line per row. */
+function toCsv(columns, rows) {
+  const lines = [columns.map(c => field(c.key)).join(',')];
+  for (const row of rows) lines.push(columns.map(c => field(row[c.key])).join(','));
+  return lines.join('\n') + '\n';
+}
+
+module.exports = { toCsv };