@motherbase/cli 0.2.4 → 0.2.5

package/src/commands/migrate.js

@@ -0,0 +1,179 @@
+'use strict';
+
+// `motherbase migrate codemod <dir>`: port a Supabase codebase's imports, and
+// report what this SDK does not implement.
+//
+// The rewrite is trivial and the report is the point. `@motherbase/client` is
+// supabase-js shaped, so most files need one import line changed; what breaks a
+// port is the handful of calls that do not exist here, and finding those at
+// build time beats finding them when a user hits that screen.
+//
+// Deliberately a text pass, not an AST pass. A codemod that needs a TypeScript
+// parser needs typescript as a CLI dependency, and the patterns below are
+// import specifiers and method names, which do not need one. The cost is that a
+// match inside a comment or a string is still reported: over-reporting in a
+// list a human reads is the acceptable direction to be wrong in.
+
+const fs = require('fs');
+const path = require('path');
+const { output } = require('./_util');
+const { CliError } = require('../context');
+
+const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts']);
+const SKIP_DIRECTORIES = new Set(['node_modules', '.git', 'dist', 'build', '.next', 'coverage', '.turbo']);
+
+/** Import specifiers that map one to one. */
+const IMPORT_REWRITES = [
+  { from: '@supabase/supabase-js', to: '@motherbase/client' },
+  { from: '@supabase/ssr', to: '@motherbase/ssr' },
+];
+
+/**
+ * Calls this SDK does not implement, and what to do instead.
+ *
+ * Kept short and kept true: every entry here is a row marked `Not supported` in
+ * packages/client/COMPATIBILITY.md. An entry that becomes supported and is left
+ * behind sends people to rewrite working code, so this list is part of the same
+ * change as implementing the feature.
+ */
+const UNSUPPORTED = [
+  {
+    pattern: /\.schema\(\s*['"`](?!public['"`])/g,
+    what: 'schema() on a schema other than public',
+    advice: 'The REST API exposes public only. Move the tables, or expose them through a view or an RPC.',
+  },
+  {
+    pattern: /exchangeCodeForSession\s*\(/g,
+    what: 'auth.exchangeCodeForSession()',
+    advice: 'This install runs the implicit flow. Read the session client side with auth.getSessionFromUrl().',
+  },
+  {
+    pattern: /signInAnonymously\s*\(/g,
+    what: 'auth.signInAnonymously()',
+    advice: 'Not implemented. Create a real user, or gate the feature behind sign-in.',
+  },
+  {
+    pattern: /transform\s*:\s*\{/g,
+    what: 'storage image transform options',
+    advice: 'No image pipeline yet. Store the sizes you need at upload time.',
+  },
+  {
+    pattern: /\.delete\(\s*\)\s*(?![\s\S]{0,200}?\.(eq|neq|in|gt|gte|lt|lte|like|ilike|is|filter|match|or|not)\()/g,
+    what: 'delete() with no filter',
+    advice: 'Refused with 400 on purpose, so a missing filter cannot empty a table. Add a filter.',
+  },
+];
+
+function walk(dir, files = []) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name.startsWith('.') && entry.name !== '.') continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (SKIP_DIRECTORIES.has(entry.name)) continue;
+      walk(full, files);
+    } else if (SOURCE_EXTENSIONS.has(path.extname(entry.name))) {
+      files.push(full);
+    }
+  }
+  return files;
+}
+
+/** Line number of an offset, 1-based, for a report a human can act on. */
+function lineAt(text, index) {
+  let line = 1;
+  for (let i = 0; i < index && i < text.length; i++) if (text[i] === '\n') line++;
+  return line;
+}
+
+function rewriteImports(text) {
+  let out = text;
+  let changed = 0;
+  for (const { from, to } of IMPORT_REWRITES) {
+    // Only inside a quoted specifier, so a mention in prose is left alone.
+    const pattern = new RegExp(`(['"\`])${from.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}\\1`, 'g');
+    out = out.replace(pattern, match => {
+      changed++;
+      return match.replace(from, to);
+    });
+  }
+  return { text: out, changed };
+}
+
+function scanUnsupported(text, file) {
+  const findings = [];
+  for (const rule of UNSUPPORTED) {
+    rule.pattern.lastIndex = 0;
+    let match;
+    while ((match = rule.pattern.exec(text)) !== null) {
+      findings.push({ file, line: lineAt(text, match.index), what: rule.what, advice: rule.advice });
+      if (match.index === rule.pattern.lastIndex) rule.pattern.lastIndex++;
+    }
+  }
+  return findings;
+}
+
+const codemod = {
+  summary: 'Rewrite Supabase imports and report what this SDK does not support',
+  usage: 'motherbase migrate codemod <dir> [--write]',
+  async run(ctx, args, flags) {
+    const target = path.resolve(ctx.cwd, args[0] || '.');
+    if (!fs.existsSync(target) || !fs.statSync(target).isDirectory()) {
+      throw new CliError(`${target} is not a directory.`);
+    }
+
+    const files = walk(target);
+    const rewritten = [];
+    const findings = [];
+
+    for (const file of files) {
+      const original = fs.readFileSync(file, 'utf8');
+      const { text, changed } = rewriteImports(original);
+      if (changed) {
+        rewritten.push({ file: path.relative(ctx.cwd, file), imports: changed });
+        // Scan the rewritten text so a line number matches what the file will
+        // hold after --write, not what it held before.
+        if (flags.write) fs.writeFileSync(file, text, 'utf8');
+      }
+      findings.push(...scanUnsupported(text, path.relative(ctx.cwd, file)));
+    }
+
+    const result = {
+      root: target,
+      scanned: files.length,
+      rewritten,
+      written: Boolean(flags.write),
+      findings,
+    };
+
+    output(ctx, result, (data, ui) => {
+      const verb = data.written ? 'Rewrote' : 'Would rewrite';
+      ui.info(`Scanned ${data.scanned} files under ${data.root}`);
+      if (data.rewritten.length) {
+        ui.info(`${verb} imports in ${data.rewritten.length} file(s):`);
+        for (const entry of data.rewritten) ui.info(`  ${entry.file} (${entry.imports})`);
+      } else {
+        ui.info('No Supabase imports found.');
+      }
+      if (!data.written && data.rewritten.length) ui.info('Re-run with --write to apply.');
+
+      if (!data.findings.length) {
+        ui.success('No unsupported calls found.');
+        return;
+      }
+      ui.info('');
+      ui.info(`${data.findings.length} call(s) this SDK does not support:`);
+      for (const finding of data.findings) {
+        ui.info(`  ${finding.file}:${finding.line}  ${finding.what}`);
+        ui.info(`      ${finding.advice}`);
+      }
+    });
+  },
+};
+
+module.exports = {
+  summary: 'Port an application from Supabase',
+  usage: 'motherbase migrate codemod <dir> [--write]',
+  subcommands: { codemod },
+  // Exported for the unit test: the scanner is the part worth pinning.
+  _internals: { rewriteImports, scanUnsupported },
+};

package/src/commands/migration.js

@@ -1,14 +1,21 @@
 'use strict';
 
-// `migration new <name>` — local scaffold only. The real migration lifecycle
-// (list/apply/rollback) lives under the `migrations` group and hits the server.
+// `migration`: Supabase's name for the group. The server-side lifecycle
+// (list/diff/get/create/apply/rollback) and the local `new` scaffold live
+// together here; `migrations` is registered as an alias of this entry.
 
 const fs = require('fs');
 const path = require('path');
+const api = require('../api');
 const ui = require('../ui');
-const { requireArg } = require('./_util');
+const { output, requireArg } = require('./_util');
 const { CliError } = require('../context');
 
+function readSql(cwd, file) {
+  if (!file) return undefined;
+  return fs.readFileSync(path.resolve(cwd, file), 'utf8');
+}
+
 const subcommands = {
   new: {
     summary: 'Scaffold a local migration .sql file',
@@ -20,14 +27,82 @@ const subcommands = {
       fs.mkdirSync(dir, { recursive: true });
       const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\..+/, '').replace('T', '');
       const file = path.join(dir, `${stamp}_${name}.sql`);
-      fs.writeFileSync(file, `-- Migration: ${name}\n-- Up\n\n\n-- Down (optional; keep in a separate file for \`migrations create --down\`)\n`);
+      fs.writeFileSync(file, `-- Migration: ${name}\n\n\n-- @down\n-- Optional: SQL that undoes the above, for \`migration down\`.\n`);
       ui.success(`Created ${path.relative(ctx.cwd, file)}`);
     },
   },
+  list: {
+    summary: 'List schema migrations',
+    usage: 'motherbase migration list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/migrations');
+      const rows = (data && data.migrations) || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table(rows, [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'NAME' },
+          { key: 'status', label: 'STATUS' },
+          { key: 'appliedAt', label: 'APPLIED' },
+        ]),
+      );
+    },
+  },
+  diff: {
+    summary: 'Show a diff between live schema and migrations',
+    usage: 'motherbase migration diff',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/migrations/diff');
+      output(ctx, data, (d, ui) => ui.json(d));
+    },
+  },
+  get: {
+    summary: 'Show a single migration',
+    usage: 'motherbase migration get <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'GET', `/migrations/${id}`);
+      output(ctx, data, (d, ui) => ui.keyValue((d && d.migration) || d || {}));
+    },
+  },
+  create: {
+    summary: 'Create a migration from up/down SQL files',
+    usage: 'motherbase migration create --name <name> --up <file.sql> [--down <file.sql>]',
+    async run(ctx, args, flags) {
+      const name = flags.name || args[0];
+      if (!name) throw new CliError('--name is required');
+      const upSql = readSql(ctx.cwd, flags.up);
+      const downSql = readSql(ctx.cwd, flags.down);
+      if (!upSql) throw new CliError('--up <file.sql> is required');
+      const data = await api.adminRequest(ctx, 'POST', '/migrations', { body: { name, upSql, downSql } });
+      output(ctx, data, (d, ui) => ui.success(`Created migration ${name}`));
+    },
+  },
+  apply: {
+    summary: 'Apply a migration',
+    usage: 'motherbase migration apply <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'POST', `/migrations/${id}/apply`);
+      output(ctx, data, (d, ui) => ui.success(`Applied ${id}`));
+    },
+  },
+  rollback: {
+    summary: 'Roll back a migration',
+    usage: 'motherbase migration rollback <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'POST', `/migrations/${id}/rollback`);
+      output(ctx, data, (d, ui) => ui.success(`Rolled back ${id}`));
+    },
+  },
 };
 
+// The local-files workflow (list/up/down/repair/squash/fetch) lives with its
+// helpers in ../migration.
+Object.assign(subcommands, require('../migration/commands').migrationSubcommands);
+
 module.exports = {
-  summary: 'Scaffold local migration files',
-  usage: 'motherbase migration new <name>',
+  summary: 'Schema migrations: local files and the remote history',
+  usage: 'motherbase migration <new|list|up|down|repair|squash|fetch|diff|get|create|apply|rollback> ...',
   subcommands,
 };

package/src/commands/network.js

@@ -0,0 +1,83 @@
+'use strict';
+
+// Who may open a direct Postgres connection (Supabase's `network-restrictions`
+// and `ssl-enforcement`). Both are project admin routes, so they work through
+// the Console proxy and in direct mode alike.
+
+const api = require('../api');
+const { output } = require('./_util');
+const { CliError } = require('../context');
+
+function renderRestrictions(d, ui) {
+  ui.keyValue({
+    'IPv4 allowed': d.dbAllowedCidrs.join(', ') || '(none)',
+    'IPv6 allowed': d.dbAllowedCidrsV6.join(', ') || '(none)',
+    status: d.status,
+    exposure: d.exposure,
+  });
+  if (d.status !== 'applied') ui.warn('Stored only: this API does not manage its database access (not a Console stack).');
+  if (d.exposure !== 'public') ui.info('The database port is not public, so only the stack and SSH tunnels reach it today.');
+}
+
+const networkRestrictions = {
+  summary: 'IP ranges allowed to connect to the database directly',
+  usage: 'motherbase network-restrictions <get|update> ...',
+  subcommands: {
+    get: {
+      summary: 'Show the allowed ranges',
+      usage: 'motherbase network-restrictions get',
+      async run(ctx) {
+        output(ctx, await api.adminRequest(ctx, 'GET', '/network-restrictions'), renderRestrictions);
+      },
+    },
+    update: {
+      summary: 'Replace the allowed ranges (repeat --db-allow-cidr; IPv4 and IPv6 are told apart)',
+      usage: 'motherbase network-restrictions update --db-allow-cidr <cidr> [--db-allow-cidr <cidr> ...]',
+      async run(ctx, _args, flags) {
+        const cidrs = [].concat(flags['db-allow-cidr'] ?? []).map(String);
+        if (!cidrs.length) {
+          throw new CliError('Pass at least one --db-allow-cidr (0.0.0.0/0 and ::/0 allow everyone).');
+        }
+        const body = {
+          dbAllowedCidrs: cidrs.filter(c => !c.includes(':')),
+          dbAllowedCidrsV6: cidrs.filter(c => c.includes(':')),
+        };
+        output(ctx, await api.adminRequest(ctx, 'PUT', '/network-restrictions', { body }), renderRestrictions);
+      },
+    },
+  },
+};
+
+function renderSsl(d, ui) {
+  ui.keyValue({ enforced: d.enforced, 'TLS active': d.sslActive, status: d.status });
+  if (d.enforced) ui.info('External clients must connect with sslmode=require.');
+}
+
+const sslEnforcement = {
+  summary: 'Require TLS for direct database connections',
+  usage: 'motherbase ssl-enforcement <get|update> ...',
+  subcommands: {
+    get: {
+      summary: 'Show whether TLS is enforced',
+      usage: 'motherbase ssl-enforcement get',
+      async run(ctx) {
+        output(ctx, await api.adminRequest(ctx, 'GET', '/ssl-enforcement'), renderSsl);
+      },
+    },
+    update: {
+      summary: 'Turn enforcement on or off',
+      usage: 'motherbase ssl-enforcement update --enable-db-ssl-enforcement | --disable-db-ssl-enforcement',
+      async run(ctx, _args, flags) {
+        const enable = Boolean(flags['enable-db-ssl-enforcement']);
+        const disable = Boolean(flags['disable-db-ssl-enforcement']);
+        if (enable === disable) {
+          throw new CliError('Pass exactly one of --enable-db-ssl-enforcement or --disable-db-ssl-enforcement.');
+        }
+        const data = await api.adminRequest(ctx, 'PUT', '/ssl-enforcement', { body: { enforced: enable } });
+        output(ctx, data, renderSsl);
+      },
+    },
+  },
+};
+
+module.exports = { networkRestrictions, sslEnforcement };

package/src/commands/orgs.js

@@ -0,0 +1,40 @@
+'use strict';
+
+// Tenant organizations on the Platform Console. Projects sit under an org, as
+// they do on Supabase.
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+
+const subcommands = {
+  list: {
+    summary: 'List the organizations you belong to',
+    usage: 'motherbase orgs list',
+    async run(ctx) {
+      const data = await api.consoleRequest(ctx, 'GET', '/orgs');
+      output(ctx, data, (rows, ui) =>
+        ui.table(Array.isArray(rows) ? rows : [], [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'NAME' },
+          { key: 'role', label: 'ROLE' },
+          { key: 'projectCount', label: 'PROJECTS' },
+        ]),
+      );
+    },
+  },
+  create: {
+    summary: 'Create an organization',
+    usage: 'motherbase orgs create <name>',
+    async run(ctx, args) {
+      const name = requireArg(args[0], 'name');
+      const data = await api.consoleRequest(ctx, 'POST', '/orgs', { body: { name } });
+      output(ctx, data, (d, ui) => ui.success(`Created org ${d.name} (${d.id})`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Manage organizations on the Platform Console',
+  usage: 'motherbase orgs <list|create> ...',
+  subcommands,
+};

package/src/commands/postgres-config.js

@@ -0,0 +1,113 @@
+'use strict';
+
+// `motherbase postgres-config get|update|delete`, Supabase's command of the
+// same name. The one difference is where a value lands: the server picks the
+// narrowest scope Postgres allows (a per-database override for
+// `statement_timeout`, ALTER SYSTEM for `shared_buffers`), and `--scope`
+// overrides that. Motherbase never restarts Postgres itself, so `--no-restart`
+// is accepted for script compatibility and a restart-only change is reported.
+
+const api = require('../api');
+const { output, parseKeyValues } = require('./_util');
+const { CliError } = require('../context');
+
+const SCOPES = ['database', 'role', 'system'];
+
+function scopeFlags(flags) {
+  if (flags.scope !== undefined && !SCOPES.includes(flags.scope)) {
+    throw new CliError(`--scope must be one of: ${SCOPES.join(', ')}`);
+  }
+  if (flags.scope === 'role' && !flags.role) throw new CliError('--scope role needs --role <name>');
+  return {
+    ...(flags.scope ? { scope: flags.scope } : {}),
+    ...(flags.role ? { role: String(flags.role) } : {}),
+  };
+}
+
+// What `get` prints: one row per setting that has an override, like Supabase,
+// or every curated setting with --all.
+function overrideRows(config, all) {
+  return config.settings.flatMap(setting => {
+    if (!setting.overrides.length) {
+      return all ? [{ name: setting.name, value: setting.value, scope: '', role: '', restart: setting.context === 'postmaster' }] : [];
+    }
+    return setting.overrides.map(o => ({
+      name: setting.name,
+      value: o.value,
+      scope: o.scope,
+      role: o.role || '',
+      restart: setting.context === 'postmaster',
+    }));
+  });
+}
+
+function reportChange(result, ui) {
+  for (const change of result.applied) {
+    ui.success(`${change.name}: ${change.scope}${change.role ? ` (${change.role})` : ''}`);
+  }
+  if (result.restartRequired.length) {
+    ui.warn(`Restart Postgres to apply: ${result.restartRequired.join(', ')}`);
+  }
+}
+
+const subcommands = {
+  get: {
+    summary: 'Show Postgres config overrides (--all for every managed setting)',
+    usage: 'motherbase postgres-config get [--all]',
+    async run(ctx, args, flags) {
+      const data = await api.adminRequest(ctx, 'GET', '/database/config');
+      output(ctx, data, (d, ui) => {
+        ui.table(overrideRows(d, Boolean(flags.all)), [
+          { key: 'name', label: 'PARAMETER' },
+          { key: 'value', label: 'VALUE' },
+          { key: 'scope', label: 'SCOPE' },
+          { key: 'role', label: 'ROLE' },
+          { key: 'restart', label: 'NEEDS RESTART' },
+        ]);
+        if (!d.systemOverridesReadable) ui.warn('System-level overrides could not be read with this connection.');
+      });
+    },
+  },
+  update: {
+    summary: 'Set Postgres config values',
+    usage: 'motherbase postgres-config update --config key=value [--config ...] [--scope database|role|system] [--role r] [--replace-existing-overrides]',
+    async run(ctx, args, flags) {
+      const values = parseKeyValues([].concat(flags.config || []).filter(Boolean), { coerce: false });
+      if (!Object.keys(values).length) throw new CliError('Provide at least one --config key=value.');
+      const target = scopeFlags(flags);
+      const changes = Object.entries(values).map(([name, value]) => ({ name, value, ...target }));
+
+      // Supabase's flag: anything overridden before and not named now goes back to its default.
+      if (flags['replace-existing-overrides']) {
+        const current = await api.adminRequest(ctx, 'GET', '/database/config');
+        for (const setting of current.settings) {
+          if (setting.name in values) continue;
+          for (const o of setting.overrides) {
+            changes.push({ name: setting.name, value: null, scope: o.scope, ...(o.role ? { role: o.role } : {}) });
+          }
+        }
+      }
+
+      const data = await api.adminRequest(ctx, 'PATCH', '/database/config', { body: { changes } });
+      output(ctx, data, (d, ui) => reportChange(d, ui));
+    },
+  },
+  delete: {
+    summary: 'Remove Postgres config overrides, restoring the defaults',
+    usage: 'motherbase postgres-config delete --config key1,key2 [--scope database|role|system] [--role r]',
+    async run(ctx, args, flags) {
+      const names = [].concat(flags.config || []).flatMap(v => String(v).split(',')).map(s => s.trim()).filter(Boolean);
+      if (!names.length) throw new CliError('Provide the settings to reset with --config key1,key2.');
+      const target = scopeFlags(flags);
+      const changes = names.map(name => ({ name, value: null, ...target }));
+      const data = await api.adminRequest(ctx, 'PATCH', '/database/config', { body: { changes } });
+      output(ctx, data, (d, ui) => reportChange(d, ui));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Postgres configuration (statement_timeout, work_mem, max_connections, ...)',
+  usage: 'motherbase postgres-config <get|update|delete> ...',
+  subcommands,
+};

package/src/commands/projects.js

@@ -1,8 +1,10 @@
 'use strict';
 
 const api = require('../api');
-const { output, requireArg } = require('./_util');
+const keys = require('./keys');
+const { output, alias, requireArg } = require('./_util');
 const { CliError } = require('../context');
+const { outputFormat } = require('../format');
 
 const LIFECYCLE = ['start', 'stop', 'restart', 'update', 'rebuild'];
 
@@ -68,7 +70,7 @@ const subcommands = {
         if (d && d.stdout) ui.print(d.stdout);
         if (d && d.stderr) ui.printErr(d.stderr);
       });
-      if (flags.f && !ctx.flags.json) {
+      if (flags.f && outputFormat(ctx.flags) === 'pretty') {
         // The console logs endpoint returns a snapshot; approximate -f by polling.
         const ui = require('../ui');
         ui.warn('(-f) polling every 3s; Ctrl-C to stop');
@@ -118,8 +120,11 @@ const subcommands = {
 
 for (const action of LIFECYCLE) subcommands[action] = lifecycleCmd(action);
 
+// Supabase's `projects api-keys`; the keys themselves live under `keys`.
+subcommands['api-keys'] = alias(keys.subcommands.list, 'motherbase projects api-keys [--project-ref <id>]');
+
 module.exports = {
   summary: 'Manage projects on the Platform Console',
-  usage: 'motherbase projects <list|create|start|stop|restart|update|rebuild|delete|logs|info|limits> ...',
+  usage: 'motherbase projects <list|create|start|stop|restart|update|rebuild|delete|logs|info|limits|api-keys> ...',
   subcommands,
 };