@qwickapps/server 1.7.2 → 1.8.0

package/src/plugins/maintenance/seed-executor.ts

@@ -40,33 +40,33 @@ const MAX_OUTPUT_SIZE = 100 * 1024;
 /**
  * Validate script path to prevent path traversal attacks
  *
- * @param scriptName - Name of the script (e.g., "seed-products.mjs")
+ * @param scriptPath - Relative path to the script (e.g., "database/001.init.mjs" or "01-Setup/seed-data.mjs")
  * @param scriptsPath - Base path for scripts directory
- * @returns Resolved path if valid, null if invalid
+ * @returns Resolved absolute path if valid, null if invalid
  */
-export function validateScriptPath(scriptName: string, scriptsPath: string): string | null {
-  // Only allow seed-*.mjs pattern
-  if (!/^seed-[a-z0-9-]+\.mjs$/.test(scriptName)) {
+export function validateScriptPath(scriptPath: string, scriptsPath: string): string | null {
+  // Only allow .mjs files
+  if (!scriptPath.endsWith('.mjs')) {
     return null;
   }
 
   // Resolve paths
   const basePath = resolve(scriptsPath);
-  const scriptPath = resolve(basePath, scriptName);
+  const resolvedScriptPath = resolve(basePath, scriptPath);
 
   // Ensure resolved path is within scriptsPath (prevent path traversal)
   // Use relative() for platform-agnostic check (works on Windows and Unix)
-  const relativePath = relative(basePath, scriptPath);
+  const relativePath = relative(basePath, resolvedScriptPath);
   if (relativePath.startsWith('..') || relativePath.includes('../') || relativePath.includes('..\\')) {
     return null;
   }
 
   // Ensure file exists
-  if (!existsSync(scriptPath)) {
+  if (!existsSync(resolvedScriptPath)) {
     return null;
   }
 
-  return scriptPath;
+  return resolvedScriptPath;
 }
 
 /**
@@ -95,30 +95,64 @@ export class SeedExecutor {
    *
    * @param scriptPath - Absolute path to the script
    * @param res - Express response object (for SSE streaming)
+   * @param databaseUrl - Optional database URL to pass to the script
+   * @param projectRoot - Optional project root directory (defaults to script's directory)
    * @returns Promise resolving to execution result
    */
-  async execute(scriptPath: string, res: Response): Promise<SeedExecutionResult> {
+  async execute(scriptPath: string, res: Response, databaseUrl?: string, projectRoot?: string): Promise<SeedExecutionResult> {
     this.startTime = Date.now();
     this.outputBuffer = '';
     this.errorBuffer = '';
     this.outputSize = 0;
 
     return new Promise((resolvePromise, rejectPromise) => {
-      // Spawn Node.js process with minimal environment
-      // Use process.execPath to ensure we use the same node binary as the parent process
-      this.child = spawn(process.execPath, [scriptPath], {
+      // Determine if we need tsx (for .ts/.mts files that import TS modules)
+      // Use tsx for .mjs files too since they might import from TS source
+      const needsTsx = scriptPath.match(/\.(mjs|ts|mts)$/);
+      const execCommand = needsTsx ? 'tsx' : process.execPath;
+      const execArgs = needsTsx ? [scriptPath] : [scriptPath];
+
+      // Spawn process with TypeScript support if needed
+      this.child = spawn(execCommand, execArgs, {
         env: {
+          ...process.env, // Inherit all env vars for tsx to work properly
           NODE_ENV: process.env.NODE_ENV || 'development',
-          DATABASE_URI: process.env.DATABASE_URI,
-          DATABASE_URL: process.env.DATABASE_URL,
+          DATABASE_URI: databaseUrl || process.env.DATABASE_URI,
+          DATABASE_URL: databaseUrl || process.env.DATABASE_URL,
           PAYLOAD_PUBLIC_SERVER_URL: process.env.PAYLOAD_PUBLIC_SERVER_URL,
           NEXT_PUBLIC_SERVER_URL: process.env.NEXT_PUBLIC_SERVER_URL,
           API_URL: process.env.API_URL,
+          PAYLOAD_SECRET: process.env.PAYLOAD_SECRET || 'dev-secret-key-change-in-production',
         },
-        stdio: ['ignore', 'pipe', 'pipe'], // stdin: ignore, stdout: pipe, stderr: pipe
-        cwd: resolve(scriptPath, '..'), // Run from scripts directory
+        stdio: ['pipe', 'pipe', 'pipe'], // stdin: pipe, stdout: pipe, stderr: pipe
+        cwd: projectRoot || resolve(scriptPath, '..'), // Run from project root (or scripts directory if not provided)
       });
 
+      // Auto-answer interactive prompts (like Drizzle's schema push confirmation)
+      // Send 'y\n' every 500ms to handle any prompts that appear
+      const stdinInterval = setInterval(() => {
+        if (this.child && this.child.stdin && !this.child.stdin.destroyed) {
+          try {
+            this.child.stdin.write('y\n');
+          } catch (err) {
+            // Ignore errors - stdin might be closed
+          }
+        }
+      }, 500);
+
+      // Clear interval when process exits
+      const cleanupInterval = () => {
+        clearInterval(stdinInterval);
+        // Close stdin to signal EOF
+        if (this.child && this.child.stdin && !this.child.stdin.destroyed) {
+          try {
+            this.child.stdin.end();
+          } catch (err) {
+            // Ignore errors
+          }
+        }
+      };
+
       // Handle stdout
       this.child.stdout?.on('data', (data: Buffer) => {
         const text = data.toString();
@@ -165,6 +199,8 @@ export class SeedExecutor {
 
       // Handle process exit
       this.child.on('exit', (code, signal) => {
+        cleanupInterval(); // Clean up stdin interval
+
         const exitCode = code ?? (signal ? 1 : 0);
         const duration = Date.now() - this.startTime;
 
@@ -188,6 +224,8 @@ export class SeedExecutor {
 
       // Handle spawn errors
       this.child.on('error', (err: Error) => {
+        cleanupInterval(); // Clean up stdin interval
+
         sendSSEEvent(res, {
           type: 'error',
           data: err.message,
@@ -199,6 +237,7 @@ export class SeedExecutor {
 
       // Handle SSE connection close - terminate child process
       res.on('close', () => {
+        cleanupInterval(); // Clean up stdin interval
         if (this.child && !this.child.killed) {
           this.child.kill('SIGTERM');
         }

package/src/plugins/maintenance-plugin.ts

@@ -10,13 +10,103 @@
  * Copyright (c) 2025 QwickApps.com. All rights reserved.
  */
 
-import { readdirSync, statSync } from 'fs';
-import { resolve } from 'path';
+import { readdirSync, statSync, readFileSync } from 'fs';
+import { resolve, join, relative } from 'path';
 import type { Request, Response } from 'express';
 import type { Plugin, PluginConfig, PluginRegistry } from '../core/plugin-registry.js';
 import { SeedExecutor, validateScriptPath } from './maintenance/seed-executor.js';
 import { getPostgres, hasPostgres } from './postgres-plugin.js';
 
+/**
+ * Extract description from JSDoc comment at top of file
+ */
+function extractDescription(filePath: string): string | undefined {
+  try {
+    const content = readFileSync(filePath, 'utf-8');
+    // Match JSDoc comment at start of file (after any whitespace)
+    const jsdocMatch = content.match(/^\s*\/\*\*\s*\n([\s\S]*?)\*\//);
+
+    if (jsdocMatch) {
+      // Extract lines and clean up asterisks and whitespace
+      const lines = jsdocMatch[1]
+        .split('\n')
+        .map(line => line.replace(/^\s*\*\s?/, '').trim())
+        .filter(line => line.length > 0);
+
+      // Skip the first line if it's just the title (will be shown separately)
+      // Return subsequent lines as the description
+      return lines.slice(1).join(' ').trim() || undefined;
+    }
+  } catch (err) {
+    // Failed to read file or parse description
+  }
+
+  return undefined;
+}
+
+/**
+ * Recursively scan directory for .mjs files
+ */
+function scanSeedScripts(dir: string, basePath: string = dir): any[] {
+  const results: any[] = [];
+
+  try {
+    const entries = readdirSync(dir, { withFileTypes: true });
+
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+
+      if (entry.isDirectory()) {
+        // Recursively scan subdirectories
+        results.push(...scanSeedScripts(fullPath, basePath));
+      } else if (entry.isFile() && entry.name.endsWith('.mjs')) {
+        // Found a .mjs file
+        const stats = statSync(fullPath);
+        const relativePath = relative(basePath, fullPath);
+        const description = extractDescription(fullPath);
+
+        results.push({
+          type: 'file',
+          name: entry.name,
+          path: relativePath, // Relative path from scripts directory
+          fullPath: fullPath, // Absolute path
+          size: stats.size,
+          createdAt: stats.birthtime,
+          modifiedAt: stats.mtime,
+          description, // Add description from JSDoc
+        });
+      }
+    }
+  } catch (err) {
+    // Directory not accessible, return empty array
+  }
+
+  return results;
+}
+
+/**
+ * Custom seed task handler
+ */
+export interface SeedTaskHandler {
+  (options?: Record<string, any>, res?: Response): Promise<void>;
+}
+
+/**
+ * Custom seed task definition
+ */
+export interface SeedTask {
+  /** Unique task identifier */
+  id: string;
+  /** Display name */
+  name: string;
+  /** Description of what this task does */
+  description: string;
+  /** Task handler function */
+  handler: SeedTaskHandler;
+  /** Optional task options/parameters */
+  options?: Record<string, any>;
+}
+
 export interface MaintenancePluginConfig {
   /** Path to scripts directory (default: './scripts') */
   scriptsPath?: string;
@@ -41,6 +131,9 @@ export interface MaintenancePluginConfig {
 
   /** Enable database operations (default: true) */
   enableDatabaseOps?: boolean;
+
+  /** Custom seed tasks */
+  customTasks?: SeedTask[];
 }
 
 /**
@@ -60,6 +153,38 @@ export function createMaintenancePlugin(config: MaintenancePluginConfig = {}): P
       const logger = registry.getLogger('maintenance');
       logger.info('Maintenance plugin starting...');
 
+      // Initialize seed_executions table if PostgreSQL is available
+      if (hasPostgres()) {
+        try {
+          const db = getPostgres();
+          await db.queryRaw(`
+            CREATE TABLE IF NOT EXISTS seed_executions (
+              id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+              name TEXT NOT NULL,
+              status TEXT NOT NULL CHECK (status IN ('running', 'completed', 'failed')),
+              started_at TIMESTAMPTZ NOT NULL,
+              completed_at TIMESTAMPTZ,
+              exit_code INTEGER,
+              output TEXT,
+              error TEXT,
+              duration_ms INTEGER,
+              created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+              updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+            )
+          `);
+
+          // Create index on status for faster queries
+          await db.queryRaw(`
+            CREATE INDEX IF NOT EXISTS idx_seed_executions_status
+            ON seed_executions(status)
+          `);
+
+          logger.debug('Seed executions table initialized');
+        } catch (error) {
+          logger.error('Failed to initialize seed_executions table', { error });
+        }
+      }
+
       // Clean up orphaned executions from previous crashes
       if (hasPostgres()) {
         try {
@@ -112,7 +237,7 @@ export function createMaintenancePlugin(config: MaintenancePluginConfig = {}): P
           logger.warn('Seed management requires PostgreSQL plugin for execution history');
         }
 
-        // GET /seeds/discover - List available seed scripts
+        // GET /seeds/discover - List available seed scripts and custom tasks
         registry.addRoute({
           method: 'get',
           path: '/seeds/discover',
@@ -120,25 +245,30 @@ export function createMaintenancePlugin(config: MaintenancePluginConfig = {}): P
           handler: (_req: Request, res: Response) => {
             try {
               const resolvedPath = resolve(scriptsPath);
-              const files = readdirSync(resolvedPath);
-
-              // Filter for seed-*.mjs files
-              const seedFiles = files
-                .filter((file) => /^seed-[a-z0-9-]+\.mjs$/.test(file))
-                .map((file) => {
-                  const filePath = resolve(resolvedPath, file);
-                  const stats = statSync(filePath);
-                  return {
-                    name: file,
-                    path: filePath,
-                    size: stats.size,
-                    createdAt: stats.birthtime,
-                    modifiedAt: stats.mtime,
-                  };
-                })
-                .sort((a, b) => a.name.localeCompare(b.name));
-
-              res.json({ seeds: seedFiles });
+              let seedFiles: any[] = [];
+
+              try {
+                // Recursively scan for .mjs files
+                seedFiles = scanSeedScripts(resolvedPath);
+
+                // Sort by relative path (natural ordering respects numbered prefixes)
+                // Example: "01-Setup/001.init.mjs" comes before "02-Production/001.seed.mjs"
+                seedFiles.sort((a, b) => a.path.localeCompare(b.path, undefined, { numeric: true }));
+              } catch (err) {
+                // Scripts directory may not exist, which is fine if we have custom tasks
+                logger.debug('Scripts directory not found or not readable');
+              }
+
+              // Add custom tasks
+              const customTasks = (config.customTasks || []).map((task) => ({
+                type: 'task',
+                id: task.id,
+                name: task.name,
+                description: task.description,
+                options: task.options,
+              }));
+
+              res.json({ seeds: [...seedFiles, ...customTasks] });
             } catch (error) {
               logger.error('Failed to discover seed scripts', { error });
               res.status(500).json({
@@ -149,23 +279,45 @@ export function createMaintenancePlugin(config: MaintenancePluginConfig = {}): P
           },
         });
 
-        // POST /seeds/execute - Execute a seed script
+        // POST /seeds/execute - Execute a seed script or custom task
         registry.addRoute({
           method: 'post',
           path: '/seeds/execute',
           pluginId: 'maintenance',
           handler: async (req: Request, res: Response) => {
             try {
-              const { name } = req.body;
+              const { name, type, options } = req.body;
 
               if (!name || typeof name !== 'string') {
                 return res.status(400).json({ error: 'Script name is required' });
               }
 
-              // Validate script path
-              const scriptPath = validateScriptPath(name, scriptsPath);
-              if (!scriptPath) {
-                return res.status(400).json({ error: 'Invalid script name or file not found' });
+              // Ensure seed_executions table exists (lazy initialization)
+              if (hasPostgres()) {
+                const db = getPostgres();
+                try {
+                  await db.queryRaw(`
+                    CREATE TABLE IF NOT EXISTS seed_executions (
+                      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+                      name TEXT NOT NULL,
+                      status TEXT NOT NULL CHECK (status IN ('running', 'completed', 'failed')),
+                      started_at TIMESTAMPTZ NOT NULL,
+                      completed_at TIMESTAMPTZ,
+                      exit_code INTEGER,
+                      output TEXT,
+                      error TEXT,
+                      duration_ms INTEGER,
+                      created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                      updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+                    )
+                  `);
+                  await db.queryRaw(`
+                    CREATE INDEX IF NOT EXISTS idx_seed_executions_status
+                    ON seed_executions(status)
+                  `);
+                } catch (err) {
+                  logger.debug('Table initialization check', { err });
+                }
               }
 
               // Check for concurrent execution
@@ -204,10 +356,39 @@ export function createMaintenancePlugin(config: MaintenancePluginConfig = {}): P
                 executionId = result?.id || null;
               }
 
-              // Execute seed script
-              const executor = new SeedExecutor();
+              const startTime = Date.now();
+              let exitCode = 0;
+              let output = '';
+              let error = '';
+
               try {
-                const result = await executor.execute(scriptPath, res);
+                // Execute based on type
+                if (type === 'task') {
+                  // Find custom task
+                  const task = (config.customTasks || []).find((t) => t.id === name);
+                  if (!task) {
+                    throw new Error(`Custom task not found: ${name}`);
+                  }
+
+                  // Execute custom task handler with SSE streaming
+                  await task.handler(options || {}, res);
+                } else {
+                  // Execute file-based seed script
+                  const scriptPath = validateScriptPath(name, scriptsPath);
+                  if (!scriptPath) {
+                    throw new Error('Invalid script name or file not found');
+                  }
+
+                  const executor = new SeedExecutor();
+                  // Project root is one level up from scripts directory
+                  const projectRoot = resolve(scriptsPath, '..');
+                  const result = await executor.execute(scriptPath, res, config.databaseUrl, projectRoot);
+                  exitCode = result.exitCode;
+                  output = result.output;
+                  error = result.error;
+                }
+
+                const duration = Date.now() - startTime;
 
                 // Update execution record
                 if (hasPostgres() && executionId) {
@@ -218,11 +399,11 @@ export function createMaintenancePlugin(config: MaintenancePluginConfig = {}): P
                          output = $3, error = $4, duration_ms = $5, updated_at = NOW()
                      WHERE id = $6`,
                     [
-                      result.exitCode === 0 ? 'completed' : 'failed',
-                      result.exitCode,
-                      result.output,
-                      result.error,
-                      result.duration,
+                      exitCode === 0 ? 'completed' : 'failed',
+                      exitCode,
+                      output,
+                      error,
+                      duration,
                       executionId,
                     ]
                   );
@@ -262,6 +443,56 @@ export function createMaintenancePlugin(config: MaintenancePluginConfig = {}): P
           },
         });
 
+        // POST /database/reset - Drop and recreate database schema (local/dev only)
+        registry.addRoute({
+          method: 'post',
+          path: '/database/reset',
+          pluginId: 'maintenance',
+          handler: async (req: Request, res: Response) => {
+            try {
+              // Security: Only allow in local or development environments
+              const nodeEnv = process.env.NODE_ENV?.toLowerCase();
+              if (nodeEnv !== 'local' && nodeEnv !== 'development') {
+                return res.status(403).json({
+                  error: 'Database reset is only available in local or development environments',
+                  currentEnv: nodeEnv || 'production',
+                });
+              }
+
+              if (!hasPostgres()) {
+                return res.status(503).json({
+                  error: 'PostgreSQL plugin required for database reset',
+                });
+              }
+
+              const db = getPostgres();
+
+              // Drop and recreate public schema (removes all tables, data, etc.)
+              await db.queryRaw('DROP SCHEMA IF EXISTS public CASCADE');
+              await db.queryRaw('CREATE SCHEMA public');
+              await db.queryRaw('GRANT ALL ON SCHEMA public TO public');
+              await db.queryRaw('GRANT ALL ON SCHEMA public TO postgres');
+              await db.queryRaw('GRANT ALL ON SCHEMA public TO qwickapps');
+
+              // Grant default privileges for future tables and sequences
+              await db.queryRaw('ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO qwickapps');
+              await db.queryRaw('ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO qwickapps');
+
+              res.json({
+                success: true,
+                message: 'Database schema has been reset. All tables and data have been deleted.',
+                timestamp: new Date().toISOString(),
+              });
+            } catch (error) {
+              logger.error('Database reset failed', { error });
+              res.status(500).json({
+                error: 'Failed to reset database',
+                message: error instanceof Error ? error.message : String(error),
+              });
+            }
+          },
+        });
+
         // GET /seeds/history - List execution history
         registry.addRoute({
           method: 'get',