@useatlas/create 0.0.6 → 0.0.7

package/templates/nextjs-standalone/src/lib/sandbox/credentials.ts

@@ -0,0 +1,206 @@
+/**
+ * Sandbox credential storage.
+ *
+ * Stores per-org BYOC sandbox provider credentials (Vercel, E2B, Daytona)
+ * in the internal database. Follows the same pattern as
+ * `packages/api/src/lib/teams/store.ts`.
+ */
+
+import { hasInternalDB, internalQuery } from "@atlas/api/lib/db/internal";
+import { createLogger } from "@atlas/api/lib/logger";
+
+const log = createLogger("sandbox-credentials");
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+export const SANDBOX_PROVIDERS = ["vercel", "e2b", "daytona"] as const;
+
+export type SandboxProvider = (typeof SANDBOX_PROVIDERS)[number];
+
+export interface SandboxCredential {
+  id: string;
+  orgId: string;
+  provider: SandboxProvider;
+  credentials: Record<string, unknown>;
+  displayName: string | null;
+  validatedAt: string | null;
+  connectedAt: string;
+}
+
+// ---------------------------------------------------------------------------
+// Shared row parser
+// ---------------------------------------------------------------------------
+
+function parseRow(
+  row: Record<string, unknown>,
+  context: Record<string, unknown>,
+): SandboxCredential | null {
+  const id = row.id;
+  const orgId = row.org_id;
+  const provider = row.provider;
+
+  if (typeof id !== "string" || typeof orgId !== "string" || typeof provider !== "string") {
+    log.warn(context, "Invalid sandbox_credentials record in database");
+    return null;
+  }
+
+  let creds: Record<string, unknown>;
+  if (typeof row.credentials === "string") {
+    try {
+      creds = JSON.parse(row.credentials) as Record<string, unknown>;
+    } catch (err) {
+      log.warn(
+        { ...context, parseError: err instanceof Error ? err.message : String(err) },
+        "Failed to parse sandbox credentials JSON — treating record as invalid",
+      );
+      return null;
+    }
+  } else if (row.credentials && typeof row.credentials === "object") {
+    creds = row.credentials as Record<string, unknown>;
+  } else {
+    log.warn(context, "Missing credentials field in sandbox_credentials record");
+    return null;
+  }
+
+  if (!SANDBOX_PROVIDERS.includes(provider as SandboxProvider)) {
+    log.warn({ ...context, provider }, "Unknown sandbox provider in database record");
+    return null;
+  }
+
+  return {
+    id,
+    orgId,
+    provider: provider as SandboxProvider,
+    credentials: creds,
+    displayName: typeof row.display_name === "string" ? row.display_name : null,
+    validatedAt: typeof row.validated_at === "string" ? row.validated_at : null,
+    connectedAt: typeof row.connected_at === "string" ? row.connected_at : new Date().toISOString(),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Read operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Get all connected sandbox providers for an org.
+ */
+export async function getSandboxCredentials(orgId: string): Promise<SandboxCredential[]> {
+  if (!hasInternalDB()) return [];
+
+  try {
+    const rows = await internalQuery<Record<string, unknown>>(
+      `SELECT id, org_id, provider, credentials, display_name,
+              validated_at::text, connected_at::text
+       FROM sandbox_credentials
+       WHERE org_id = $1
+       ORDER BY connected_at`,
+      [orgId],
+    );
+    const results: SandboxCredential[] = [];
+    for (const row of rows) {
+      const parsed = parseRow(row, { orgId });
+      if (parsed) results.push(parsed);
+    }
+    return results;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId },
+      "Failed to query sandbox_credentials",
+    );
+    throw err;
+  }
+}
+
+/**
+ * Get a single provider's credential for an org.
+ */
+export async function getSandboxCredentialByProvider(
+  orgId: string,
+  provider: string,
+): Promise<SandboxCredential | null> {
+  if (!hasInternalDB()) return null;
+
+  try {
+    const rows = await internalQuery<Record<string, unknown>>(
+      `SELECT id, org_id, provider, credentials, display_name,
+              validated_at::text, connected_at::text
+       FROM sandbox_credentials
+       WHERE org_id = $1 AND provider = $2`,
+      [orgId, provider],
+    );
+    if (rows.length === 0) return null;
+    return parseRow(rows[0], { orgId, provider });
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId, provider },
+      "Failed to query sandbox_credentials by provider",
+    );
+    throw err;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Write operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Save or update a sandbox provider credential (upsert).
+ */
+export async function saveSandboxCredential(
+  orgId: string,
+  provider: string,
+  credentials: Record<string, unknown>,
+  displayName?: string,
+): Promise<void> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot save sandbox credentials — no internal database configured");
+  }
+
+  try {
+    await internalQuery(
+      `INSERT INTO sandbox_credentials (org_id, provider, credentials, display_name, validated_at)
+       VALUES ($1, $2, $3, $4, now())
+       ON CONFLICT (org_id, provider) DO UPDATE SET
+         credentials = $3,
+         display_name = COALESCE($4, sandbox_credentials.display_name),
+         validated_at = now()`,
+      [orgId, provider, JSON.stringify(credentials), displayName ?? null],
+    );
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId, provider },
+      "Failed to save sandbox_credentials",
+    );
+    throw err;
+  }
+}
+
+/**
+ * Remove a sandbox provider credential.
+ * Returns true if a row was deleted.
+ */
+export async function deleteSandboxCredential(
+  orgId: string,
+  provider: string,
+): Promise<boolean> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot delete sandbox credentials — no internal database configured");
+  }
+
+  try {
+    const rows = await internalQuery<{ id: string }>(
+      "DELETE FROM sandbox_credentials WHERE org_id = $1 AND provider = $2 RETURNING id",
+      [orgId, provider],
+    );
+    return rows.length > 0;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId, provider },
+      "Failed to delete sandbox_credentials",
+    );
+    throw err;
+  }
+}

package/templates/nextjs-standalone/src/lib/sandbox/validate.ts

@@ -0,0 +1,179 @@
+/**
+ * Sandbox provider credential validation.
+ *
+ * Each function hits the real provider API to verify that the supplied
+ * credentials are valid. Returns a discriminated union indicating
+ * success (with display name) or failure (with error message).
+ */
+
+import { createLogger } from "@atlas/api/lib/logger";
+
+const log = createLogger("sandbox-validate");
+
+export type ValidationResult =
+  | { valid: true; displayName: string }
+  | { valid: false; error: string };
+
+/** Timeout for provider API validation calls (10 seconds). */
+const VALIDATION_TIMEOUT_MS = 10_000;
+
+// ---------------------------------------------------------------------------
+// URL safety (SSRF prevention)
+// ---------------------------------------------------------------------------
+
+/**
+ * Validates that a user-supplied URL is safe for server-side requests.
+ * Blocks non-HTTPS schemes and private/internal hostnames.
+ */
+function isSafeExternalUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") return false;
+    const host = parsed.hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host === "0.0.0.0" || host === "::1") return false;
+    if (host.startsWith("10.") || host.startsWith("192.168.")) return false;
+    if (host.startsWith("169.254.")) return false; // AWS metadata
+    if (host.startsWith("172.")) {
+      const second = parseInt(host.split(".")[1], 10);
+      if (second >= 16 && second <= 31) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Vercel
+// ---------------------------------------------------------------------------
+
+export async function validateVercelCredentials(
+  accessToken: string,
+  teamId: string,
+): Promise<ValidationResult> {
+  try {
+    const res = await fetch(`https://api.vercel.com/v2/teams/${encodeURIComponent(teamId)}`, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(VALIDATION_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+      const status = res.status;
+      if (status === 401 || status === 403) {
+        return { valid: false, error: "Invalid access token — check your Vercel token permissions" };
+      }
+      if (status === 404) {
+        return { valid: false, error: "Team not found — verify your Team ID" };
+      }
+      return { valid: false, error: `Vercel API returned ${status}` };
+    }
+    const data = (await res.json().catch(() => ({}))) as { name?: string };
+    return { valid: true, displayName: data.name ?? teamId };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log.warn({ err: msg }, "Vercel credential validation failed");
+    return { valid: false, error: `Could not reach Vercel API: ${msg}` };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// E2B
+// ---------------------------------------------------------------------------
+
+export async function validateE2BCredentials(
+  apiKey: string,
+): Promise<ValidationResult> {
+  try {
+    const res = await fetch("https://api.e2b.dev/sandboxes", {
+      method: "GET",
+      headers: { "X-API-Key": apiKey },
+      signal: AbortSignal.timeout(VALIDATION_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+      const status = res.status;
+      if (status === 401 || status === 403) {
+        return { valid: false, error: "Invalid API key — check your E2B API key" };
+      }
+      return { valid: false, error: `E2B API returned ${status}` };
+    }
+    return { valid: true, displayName: "E2B" };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log.warn({ err: msg }, "E2B credential validation failed");
+    return { valid: false, error: `Could not reach E2B API: ${msg}` };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Daytona
+// ---------------------------------------------------------------------------
+
+export async function validateDaytonaCredentials(
+  apiKey: string,
+  apiUrl?: string,
+): Promise<ValidationResult> {
+  const base = apiUrl ?? "https://api.daytona.io";
+
+  // Validate user-supplied URL to prevent SSRF
+  if (apiUrl && !isSafeExternalUrl(apiUrl)) {
+    return { valid: false, error: "API URL must use HTTPS and point to a public hostname" };
+  }
+
+  try {
+    const res = await fetch(`${base}/health`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(VALIDATION_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+      const status = res.status;
+      if (status === 401 || status === 403) {
+        return { valid: false, error: "Invalid API key — check your Daytona API key" };
+      }
+      return { valid: false, error: `Daytona API returned ${status}` };
+    }
+    return { valid: true, displayName: apiUrl ? `Daytona (${apiUrl})` : "Daytona Cloud" };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log.warn({ err: msg }, "Daytona credential validation failed");
+    return { valid: false, error: `Could not reach Daytona API: ${msg}` };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Dispatch
+// ---------------------------------------------------------------------------
+
+export async function validateCredentials(
+  provider: string,
+  credentials: Record<string, unknown>,
+): Promise<ValidationResult> {
+  switch (provider) {
+    case "vercel": {
+      const accessToken = credentials.accessToken;
+      const teamId = credentials.teamId;
+      if (typeof accessToken !== "string" || !accessToken) {
+        return { valid: false, error: "Access token is required" };
+      }
+      if (typeof teamId !== "string" || !teamId) {
+        return { valid: false, error: "Team ID is required" };
+      }
+      return validateVercelCredentials(accessToken, teamId);
+    }
+    case "e2b": {
+      const apiKey = credentials.apiKey;
+      if (typeof apiKey !== "string" || !apiKey) {
+        return { valid: false, error: "API key is required" };
+      }
+      return validateE2BCredentials(apiKey);
+    }
+    case "daytona": {
+      const apiKey = credentials.apiKey;
+      if (typeof apiKey !== "string" || !apiKey) {
+        return { valid: false, error: "API key is required" };
+      }
+      const apiUrl = typeof credentials.apiUrl === "string" ? credentials.apiUrl : undefined;
+      return validateDaytonaCredentials(apiKey, apiUrl);
+    }
+    default:
+      return { valid: false, error: `Unknown sandbox provider: ${provider}` };
+  }
+}

package/templates/nextjs-standalone/src/lib/scheduled-task-types.ts

@@ -1,49 +1,34 @@
 /**
  * Scheduled task types for Atlas.
  *
- * DeliveryChannel determines where results are sent.
- * RunStatus tracks the lifecycle of a single scheduled run.
- * ScheduledTaskRow / ScheduledTask represent the DB and API shapes.
- * ScheduledTaskRunRow / ScheduledTaskRun represent run history.
+ * ScheduledTaskRow / ScheduledTaskRunRow are the DB shapes (API-internal only).
+ * All other types (DeliveryChannel, RunStatus, ScheduledTask, etc.) are
+ * re-exported from @useatlas/types/scheduled-task.
  */
 
-import type { ActionApprovalMode } from "@atlas/api/lib/action-types";
+// Re-export shared types from @useatlas/types
+export {
+  DELIVERY_CHANNELS,
+  RUN_STATUSES,
+  DELIVERY_STATUSES,
+  isRecipient,
+} from "@useatlas/types/scheduled-task";
+export type {
+  DeliveryChannel,
+  RunStatus,
+  DeliveryStatus,
+  EmailRecipient,
+  SlackRecipient,
+  WebhookRecipient,
+  Recipient,
+  ScheduledTask,
+  ScheduledTaskWithRuns,
+  ScheduledTaskRun,
+  ScheduledTaskRunWithTaskName,
+} from "@useatlas/types/scheduled-task";
 
 // ---------------------------------------------------------------------------
-// Enums (const arrays → union types)
-// ---------------------------------------------------------------------------
-
-export const DELIVERY_CHANNELS = ["email", "slack", "webhook"] as const;
-export type DeliveryChannel = (typeof DELIVERY_CHANNELS)[number];
-
-export const RUN_STATUSES = ["running", "success", "failed", "skipped"] as const;
-export type RunStatus = (typeof RUN_STATUSES)[number];
-
-// ---------------------------------------------------------------------------
-// Recipient discriminated union
-// ---------------------------------------------------------------------------
-
-export interface EmailRecipient {
-  type: "email";
-  address: string;
-}
-
-export interface SlackRecipient {
-  type: "slack";
-  channel: string;
-  teamId?: string;
-}
-
-export interface WebhookRecipient {
-  type: "webhook";
-  url: string;
-  headers?: Record<string, string>;
-}
-
-export type Recipient = EmailRecipient | SlackRecipient | WebhookRecipient;
-
-// ---------------------------------------------------------------------------
-// Database row shapes (snake_case)
+// Database row shapes (snake_case) — API-internal only
 // ---------------------------------------------------------------------------
 
 export interface ScheduledTaskRow {
@@ -73,60 +58,7 @@ export interface ScheduledTaskRunRow {
   action_id: string | null;
   error: string | null;
   tokens_used: number | null;
+  delivery_status: string | null;
+  delivery_error: string | null;
   created_at: string;
 }
-
-// ---------------------------------------------------------------------------
-// API shapes (camelCase)
-// ---------------------------------------------------------------------------
-
-export interface ScheduledTask {
-  id: string;
-  ownerId: string;
-  name: string;
-  question: string;
-  cronExpression: string;
-  deliveryChannel: DeliveryChannel;
-  /** Recipients should match the deliveryChannel type (email recipients for email channel, etc). */
-  recipients: Recipient[];
-  connectionId: string | null;
-  approvalMode: ActionApprovalMode;
-  enabled: boolean;
-  lastRunAt: string | null;
-  nextRunAt: string | null;
-  createdAt: string;
-  updatedAt: string;
-}
-
-export interface ScheduledTaskWithRuns extends ScheduledTask {
-  recentRuns: ScheduledTaskRun[];
-}
-
-export interface ScheduledTaskRun {
-  id: string;
-  taskId: string;
-  startedAt: string;
-  completedAt: string | null;
-  status: RunStatus;
-  conversationId: string | null;
-  actionId: string | null;
-  error: string | null;
-  tokensUsed: number | null;
-  createdAt: string;
-}
-
-// ---------------------------------------------------------------------------
-// Runtime type guard
-// ---------------------------------------------------------------------------
-
-/** Runtime type guard for Recipient — validates JSONB boundary. */
-export function isRecipient(value: unknown): value is Recipient {
-  if (typeof value !== "object" || value === null || !("type" in value)) return false;
-  const r = value as Record<string, unknown>;
-  switch (r.type) {
-    case "email": return typeof r.address === "string" && r.address.length > 0;
-    case "slack": return typeof r.channel === "string" && r.channel.length > 0;
-    case "webhook": return typeof r.url === "string" && r.url.length > 0;
-    default: return false;
-  }
-}