@useatlas/create 0.0.6 → 0.0.7

package/templates/docker/src/lib/github/store.ts

@@ -0,0 +1,197 @@
+/**
+ * GitHub installation storage.
+ *
+ * Stores per-workspace personal access tokens in the internal database.
+ * Each workspace admin enters their own PAT (BYOT).
+ */
+
+import { hasInternalDB, internalQuery } from "@atlas/api/lib/db/internal";
+import { createLogger } from "@atlas/api/lib/logger";
+import type { GitHubInstallation, GitHubInstallationWithSecret } from "@atlas/api/lib/integrations/types";
+
+export type { GitHubInstallation, GitHubInstallationWithSecret } from "@atlas/api/lib/integrations/types";
+
+const log = createLogger("github-store");
+
+// ---------------------------------------------------------------------------
+// Shared row parser
+// ---------------------------------------------------------------------------
+
+function parseInstallationRow(
+  row: Record<string, unknown>,
+  context: Record<string, unknown>,
+): GitHubInstallationWithSecret | null {
+  const userId = row.user_id;
+  const accessToken = row.access_token;
+  if (typeof userId !== "string" || !userId || typeof accessToken !== "string" || !accessToken) {
+    log.warn(context, "Invalid GitHub installation record in database");
+    return null;
+  }
+  return {
+    user_id: userId,
+    access_token: accessToken,
+    username: typeof row.username === "string" ? row.username : null,
+    org_id: typeof row.org_id === "string" ? row.org_id : null,
+    installed_at: typeof row.installed_at === "string" ? row.installed_at : new Date().toISOString(),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Read operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Get the GitHub installation for a user ID (GitHub numeric user ID).
+ */
+export async function getGitHubInstallation(
+  userId: string,
+): Promise<GitHubInstallationWithSecret | null> {
+  if (!hasInternalDB()) {
+    return null;
+  }
+
+  try {
+    const rows = await internalQuery<Record<string, unknown>>(
+      "SELECT user_id, access_token, username, org_id, installed_at::text FROM github_installations WHERE user_id = $1",
+      [userId],
+    );
+    if (rows.length > 0) {
+      return parseInstallationRow(rows[0], { userId });
+    }
+    return null;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), userId },
+      "Failed to query github_installations",
+    );
+    throw err;
+  }
+}
+
+/**
+ * Get the GitHub installation for an org. Returns null if not found or
+ * if no internal database is configured.
+ */
+export async function getGitHubInstallationByOrg(
+  orgId: string,
+): Promise<GitHubInstallation | null> {
+  if (!hasInternalDB()) {
+    return null;
+  }
+
+  try {
+    const rows = await internalQuery<Record<string, unknown>>(
+      "SELECT user_id, access_token, username, org_id, installed_at::text FROM github_installations WHERE org_id = $1",
+      [orgId],
+    );
+    if (rows.length > 0) {
+      const full = parseInstallationRow(rows[0], { orgId });
+      if (!full) return null;
+      const { access_token: _, ...pub } = full;
+      return pub;
+    }
+    return null;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId },
+      "Failed to query github_installations by org",
+    );
+    throw err;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Write operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Save or update a GitHub installation (PAT submission).
+ * Throws if the GitHub user is already bound to a different organization (hijack protection).
+ * Throws if the database write fails.
+ */
+export async function saveGitHubInstallation(
+  userId: string,
+  opts: { orgId?: string; username?: string; accessToken: string },
+): Promise<void> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot save GitHub installation — no internal database configured");
+  }
+
+  const orgId = opts.orgId ?? null;
+  const username = opts.username ?? null;
+
+  try {
+    // Atomic upsert with hijack protection — the WHERE clause rejects rows
+    // bound to a different org in one statement (no TOCTOU race).
+    const rows = await internalQuery<{ user_id: string }>(
+      `INSERT INTO github_installations (user_id, access_token, username, org_id)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (user_id) DO UPDATE SET
+         access_token = $2,
+         username = COALESCE($3, github_installations.username),
+         org_id = COALESCE($4, github_installations.org_id),
+         installed_at = now()
+       WHERE github_installations.org_id IS NULL OR github_installations.org_id = $4
+       RETURNING user_id`,
+      [userId, opts.accessToken, username, orgId],
+    );
+
+    if (rows.length === 0) {
+      throw new Error(
+        `GitHub user ${userId} is already bound to a different organization. ` +
+        `Disconnect the existing installation first.`,
+      );
+    }
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), userId },
+      "Failed to save github_installations",
+    );
+    throw err;
+  }
+}
+
+/**
+ * Remove a GitHub installation by user ID.
+ * Throws if no internal DB or if the query fails.
+ */
+export async function deleteGitHubInstallation(userId: string): Promise<void> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot delete GitHub installation — no internal database configured");
+  }
+
+  try {
+    await internalQuery("DELETE FROM github_installations WHERE user_id = $1", [userId]);
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), userId },
+      "Failed to delete github_installations",
+    );
+    throw err;
+  }
+}
+
+/**
+ * Remove the GitHub installation for an org.
+ * Returns true if a row was deleted, false if no matching row found.
+ * Throws if no internal DB or if the query fails.
+ */
+export async function deleteGitHubInstallationByOrg(orgId: string): Promise<boolean> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot delete GitHub installation — no internal database configured");
+  }
+
+  try {
+    const rows = await internalQuery<{ user_id: string }>(
+      "DELETE FROM github_installations WHERE org_id = $1 RETURNING user_id",
+      [orgId],
+    );
+    return rows.length > 0;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId },
+      "Failed to delete github_installations by org",
+    );
+    throw err;
+  }
+}

package/templates/docker/src/lib/id.ts

@@ -0,0 +1,29 @@
+import { customAlphabet } from "nanoid";
+
+const prefixes: Record<string, unknown> = {};
+
+interface GenerateIdOptions {
+  length?: number;
+  separator?: string;
+}
+
+export function generateId(
+  prefixOrOptions?: keyof typeof prefixes | GenerateIdOptions,
+  inputOptions: GenerateIdOptions = {},
+) {
+  const finalOptions =
+    typeof prefixOrOptions === "object" ? prefixOrOptions : inputOptions;
+
+  const prefix =
+    typeof prefixOrOptions === "object" ? undefined : prefixOrOptions;
+
+  const { length = 12, separator = "_" } = finalOptions;
+  const id = customAlphabet(
+    "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
+    length,
+  )();
+
+  return prefix && prefix in prefixes
+    ? `${prefixes[prefix]}${separator}${id}`
+    : id;
+}

package/templates/docker/src/lib/integrations/types.ts

@@ -0,0 +1,166 @@
+/**
+ * Shared integration installation types.
+ *
+ * Each platform has a public type (safe for API responses) and a
+ * WithSecret variant (for internal store operations). The public type
+ * excludes tokens, keys, and credentials. Store `*ByOrg` functions
+ * strip secret fields at runtime before returning the public type.
+ */
+
+// ---------------------------------------------------------------------------
+// Base
+// ---------------------------------------------------------------------------
+
+export interface BaseInstallation {
+  org_id: string | null;
+  installed_at: string;
+}
+
+// ---------------------------------------------------------------------------
+// Slack
+// ---------------------------------------------------------------------------
+
+export interface SlackInstallation extends BaseInstallation {
+  team_id: string;
+  workspace_name: string | null;
+}
+
+export interface SlackInstallationWithSecret extends SlackInstallation {
+  bot_token: string;
+}
+
+// ---------------------------------------------------------------------------
+// Teams
+// ---------------------------------------------------------------------------
+
+export interface TeamsInstallation extends BaseInstallation {
+  tenant_id: string;
+  tenant_name: string | null;
+}
+
+export interface TeamsInstallationWithSecret extends TeamsInstallation {
+  app_password: string | null;
+}
+
+// ---------------------------------------------------------------------------
+// Discord
+// ---------------------------------------------------------------------------
+
+export interface DiscordInstallation extends BaseInstallation {
+  guild_id: string;
+  guild_name: string | null;
+  application_id: string | null;
+  public_key: string | null;
+}
+
+export interface DiscordInstallationWithSecret extends DiscordInstallation {
+  bot_token: string | null;
+}
+
+// ---------------------------------------------------------------------------
+// Telegram
+// ---------------------------------------------------------------------------
+
+export interface TelegramInstallation extends BaseInstallation {
+  bot_id: string;
+  bot_username: string | null;
+}
+
+export interface TelegramInstallationWithSecret extends TelegramInstallation {
+  bot_token: string;
+}
+
+// ---------------------------------------------------------------------------
+// Google Chat
+// ---------------------------------------------------------------------------
+
+export interface GChatInstallation extends BaseInstallation {
+  project_id: string;
+  service_account_email: string;
+}
+
+export interface GChatInstallationWithSecret extends GChatInstallation {
+  credentials_json: string;
+}
+
+// ---------------------------------------------------------------------------
+// GitHub
+// ---------------------------------------------------------------------------
+
+export interface GitHubInstallation extends BaseInstallation {
+  /** GitHub numeric user ID (stable identifier, unlike login names). */
+  user_id: string;
+  username: string | null;
+}
+
+export interface GitHubInstallationWithSecret extends GitHubInstallation {
+  access_token: string;
+}
+
+// ---------------------------------------------------------------------------
+// Linear
+// ---------------------------------------------------------------------------
+
+export interface LinearInstallation extends BaseInstallation {
+  /** Linear viewer ID (stable identifier from /viewer query). */
+  user_id: string;
+  user_name: string | null;
+  user_email: string | null;
+}
+
+export interface LinearInstallationWithSecret extends LinearInstallation {
+  api_key: string;
+}
+
+// ---------------------------------------------------------------------------
+// WhatsApp
+// ---------------------------------------------------------------------------
+
+export interface WhatsAppInstallation extends BaseInstallation {
+  phone_number_id: string;
+  display_phone: string | null;
+}
+
+export interface WhatsAppInstallationWithSecret extends WhatsAppInstallation {
+  access_token: string;
+}
+
+// ---------------------------------------------------------------------------
+// Email
+// ---------------------------------------------------------------------------
+
+export type EmailProvider = "smtp" | "sendgrid" | "postmark" | "ses";
+
+export interface SmtpConfig {
+  host: string;
+  port: number;
+  username: string;
+  password: string;
+  tls: boolean;
+}
+
+export interface SendGridConfig {
+  apiKey: string;
+}
+
+export interface PostmarkConfig {
+  serverToken: string;
+}
+
+export interface SesConfig {
+  region: string;
+  accessKeyId: string;
+  secretAccessKey: string;
+}
+
+export type ProviderConfig = SmtpConfig | SendGridConfig | PostmarkConfig | SesConfig;
+
+export interface EmailInstallation extends BaseInstallation {
+  config_id: string;
+  provider: EmailProvider;
+  sender_address: string;
+}
+
+export interface EmailInstallationWithSecret extends EmailInstallation {
+  config: ProviderConfig;
+}

package/templates/docker/src/lib/learn/pattern-analyzer.ts

@@ -0,0 +1,224 @@
+/**
+ * Pattern analysis for the learned patterns system.
+ *
+ * Inspired by packages/cli/lib/learn/analyze.ts, adapted for runtime use
+ * with literal-placeholder normalization for stronger deduplication.
+ * Provides SQL normalization, fingerprinting, and novelty detection
+ * against YAML query_patterns in the semantic layer.
+ */
+
+import * as crypto from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+import * as yaml from "js-yaml";
+import { Parser } from "node-sql-parser";
+import { createLogger } from "@atlas/api/lib/logger";
+import { getSemanticRoot as getDefaultSemanticRoot } from "@atlas/api/lib/semantic/files";
+
+const log = createLogger("pattern-analyzer");
+
+const parser = new Parser();
+
+// ── SQL normalization ──────────────────────────────────────────────
+
+/**
+ * Normalize SQL for pattern deduplication.
+ *
+ * Strips comments, replaces string and numeric literals with placeholders,
+ * removes LIMIT/OFFSET, collapses whitespace, and lowercases.
+ */
+export function normalizeSQL(sql: string): string {
+  return sql
+    .replace(/--[^\n]*/g, "")                     // strip line comments
+    .replace(/\/\*[\s\S]*?\*\//g, "")             // strip block comments
+    .replace(/'(?:[^']|'')*'/g, "'?'")            // normalize string literals
+    .replace(/\b\d+(?:\.\d+)?\b/g, "?")          // normalize numeric literals
+    .replace(/\bLIMIT\s+\?\s*/gi, "")             // remove LIMIT (placeholder from step above)
+    .replace(/\bOFFSET\s+\?\s*/gi, "")            // remove OFFSET
+    .replace(/\s+/g, " ")                         // collapse whitespace
+    .trim()
+    .toLowerCase();
+}
+
+/**
+ * Generate a 16-character SHA-256 hex prefix fingerprint for deduplication.
+ */
+export function fingerprintSQL(normalizedSql: string): string {
+  return crypto.createHash("sha256").update(normalizedSql).digest("hex").slice(0, 16);
+}
+
+// ── Pattern info extraction ────────────────────────────────────────
+
+export interface PatternInfo {
+  tables: string[];
+  hasJoins: boolean;
+  hasAggregation: boolean;
+  hasGroupBy: boolean;
+  primaryTable: string;
+  description: string;
+}
+
+/**
+ * Extract structural information from a SQL query for pattern metadata.
+ * Returns null if parsing fails.
+ */
+export function extractPatternInfo(sql: string, dialect: string = "PostgresQL"): PatternInfo | null {
+  try {
+    const ast = parser.astify(sql, { database: dialect });
+    const stmt = Array.isArray(ast) ? ast[0] : ast;
+    if (!stmt || stmt.type !== "select") return null;
+
+    let tables: string[];
+    try {
+      const tableRefs = parser.tableList(sql, { database: dialect });
+      tables = [...new Set(
+        tableRefs
+          .map((ref) => {
+            const parts = ref.split("::");
+            return parts.pop()?.toLowerCase() ?? "";
+          })
+          .filter(Boolean),
+      )];
+    } catch (tableListErr) {
+      log.debug(
+        { err: tableListErr instanceof Error ? tableListErr.message : String(tableListErr) },
+        "tableList extraction failed — falling back to empty tables",
+      );
+      tables = [];
+    }
+
+    const stmtObj = stmt as unknown as Record<string, unknown>;
+    const from = stmtObj.from as Array<Record<string, unknown>> | undefined;
+    const hasJoins = Array.isArray(from) && from.some((item) => !!item.join);
+    const hasGroupBy = !!stmtObj.groupby;
+    // AST JSON serializes function names as property values (e.g. "name":"COUNT"),
+    // not as SQL text. Match quoted function names instead of SQL-style `count(`.
+    const astJson = JSON.stringify(stmtObj).toLowerCase();
+    const hasAggregation = /"(count|sum|avg|min|max)"/.test(astJson);
+
+    const primaryTable = tables[0] ?? "unknown";
+
+    const descParts: string[] = [];
+    if (hasAggregation && hasGroupBy) {
+      descParts.push("Aggregation");
+    } else if (hasAggregation) {
+      descParts.push("Summary");
+    }
+    if (hasJoins) {
+      descParts.push("with joins");
+    }
+    if (tables.length > 0) {
+      descParts.push(`on ${primaryTable}`);
+    }
+    const description = descParts.length > 0 ? descParts.join(" ") : "Query pattern";
+
+    return { tables, hasJoins, hasAggregation, hasGroupBy, primaryTable, description };
+  } catch (err) {
+    log.debug(
+      { err: err instanceof Error ? err.message : String(err), sql: sql.slice(0, 200) },
+      "Failed to extract pattern info — skipping",
+    );
+    return null;
+  }
+}
+
+// ── YAML query_patterns loading ────────────────────────────────────
+
+/**
+ * Load all query_patterns SQL from entity YAMLs, normalized for comparison.
+ * Returns a Set of normalized SQL strings.
+ */
+export function loadYamlQueryPatterns(semanticRoot?: string): Set<string> {
+  const root = semanticRoot ?? getDefaultSemanticRoot();
+  const patterns = new Set<string>();
+
+  loadPatternsFromDir(path.join(root, "entities"), patterns);
+
+  if (fs.existsSync(root)) {
+    const reserved = new Set(["entities", "metrics", ".orgs"]);
+    try {
+      const entries = fs.readdirSync(root, { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isDirectory() || reserved.has(entry.name)) continue;
+        const subEntities = path.join(root, entry.name, "entities");
+        if (fs.existsSync(subEntities)) {
+          loadPatternsFromDir(subEntities, patterns);
+        }
+      }
+    } catch (err) {
+      log.warn(
+        { err: err instanceof Error ? err.message : String(err) },
+        "Failed to scan semantic root for pattern loading",
+      );
+    }
+  }
+
+  return patterns;
+}
+
+function loadPatternsFromDir(dir: string, out: Set<string>): void {
+  if (!fs.existsSync(dir)) return;
+
+  let files: string[];
+  try {
+    files = fs.readdirSync(dir).filter((f) => f.endsWith(".yml"));
+  } catch (err) {
+    log.warn(
+      { dir, err: err instanceof Error ? err.message : String(err) },
+      "Failed to read entities directory for pattern loading",
+    );
+    return;
+  }
+
+  for (const file of files) {
+    try {
+      const content = fs.readFileSync(path.join(dir, file), "utf-8");
+      const raw = yaml.load(content) as Record<string, unknown> | null;
+      if (!raw || typeof raw !== "object") continue;
+
+      const queryPatterns = raw.query_patterns;
+      if (!Array.isArray(queryPatterns)) continue;
+
+      for (const pattern of queryPatterns) {
+        if (pattern && typeof pattern === "object" && typeof (pattern as Record<string, unknown>).sql === "string") {
+          out.add(normalizeSQL((pattern as Record<string, unknown>).sql as string));
+        }
+      }
+    } catch (err) {
+      log.warn(
+        { file, dir, err: err instanceof Error ? err.message : String(err) },
+        "Skipping entity file during pattern loading",
+      );
+    }
+  }
+}
+
+// ── YAML pattern cache ─────────────────────────────────────────────
+
+let _yamlPatternCache: Set<string> | null = null;
+
+/** Get YAML patterns. When semanticRoot is provided, reads directly from disk
+ * (bypasses cache). Otherwise, lazily loads from the default semantic directory
+ * and caches for subsequent calls. Empty results are not cached so subsequent
+ * calls retry the load. */
+export function getYamlPatterns(semanticRoot?: string): Set<string> {
+  if (semanticRoot) return loadYamlQueryPatterns(semanticRoot);
+  if (!_yamlPatternCache) {
+    const loaded = loadYamlQueryPatterns();
+    if (loaded.size > 0) {
+      _yamlPatternCache = loaded;
+    }
+    return loaded;
+  }
+  return _yamlPatternCache;
+}
+
+/** Clear the YAML pattern cache. For testing. */
+export function _resetYamlPatternCache(): void {
+  _yamlPatternCache = null;
+}
+
+/** Pre-populate the YAML pattern cache. For testing. */
+export function _setYamlPatternCache(patterns: Set<string>): void {
+  _yamlPatternCache = patterns;
+}