@x47base/pocketbase-addon 0.1.0

package/backups/register.go

@@ -0,0 +1,120 @@
+package backups
+
+import (
+	"errors"
+	"fmt"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+type Config struct {
+	Encrypted     bool   `json:"encrypted"`
+	EncryptionEnv string `json:"encryptionEnv"`
+}
+
+func (c Config) Validate() error {
+	if c.EncryptionEnv != "" && !backupEnvPattern.MatchString(c.EncryptionEnv) {
+		return errors.New("invalid encryption environment name")
+	}
+	if c.Encrypted {
+		_, err := c.encryptionKey()
+		return err
+	}
+	return nil
+}
+func (c Config) KeyConfigured() bool { _, err := c.encryptionKey(); return err == nil }
+
+type stagedApp struct {
+	core.App
+	dir string
+}
+
+func (a *stagedApp) NewBackupsFilesystem() (*filesystem.System, error) {
+	return filesystem.NewLocal(a.dir)
+}
+func Register(app core.App, config func(core.App) (Config, error)) {
+	app.OnBackupCreate().BindFunc(func(e *core.BackupEvent) error {
+		c, err := config(e.App)
+		if err != nil {
+			return err
+		}
+		if !c.Encrypted {
+			return e.Next()
+		}
+		if err = c.Validate(); err != nil {
+			return err
+		}
+		if e.Name == "" {
+			e.Name = "pb_backup_" + time.Now().UTC().Format("20060102_150405.000000000") + ".zip"
+		}
+		if filepath.Base(e.Name) != e.Name || strings.ContainsAny(e.Name, "/\\") {
+			return errors.New("invalid backup name")
+		}
+		final := EncryptedBackupName(e.Name, true)
+		realApp := e.App
+		realFS, err := realApp.NewBackupsFilesystem()
+		if err != nil {
+			return err
+		}
+		defer realFS.Close()
+		realFS.SetContext(e.Context)
+		exists, err := realFS.Exists(final)
+		if err != nil {
+			return err
+		}
+		if exists {
+			return errors.New("backup already exists")
+		}
+		tempRoot := filepath.Join(realApp.DataDir(), core.LocalTempDirName)
+		if err = os.MkdirAll(tempRoot, 0700); err != nil {
+			return err
+		}
+		if err = os.Chmod(tempRoot, 0700); err != nil {
+			return err
+		}
+		dir, err := os.MkdirTemp(tempRoot, "spink_backup_")
+		if err != nil {
+			return err
+		}
+		defer os.RemoveAll(dir)
+		e.App = &stagedApp{App: realApp, dir: dir}
+		err = e.Next()
+		e.App = realApp
+		if err != nil {
+			return err
+		}
+		encrypted, err := encryptBackup(e.Context, c, filepath.Join(dir, e.Name))
+		if err != nil {
+			return err
+		}
+		defer os.Remove(encrypted)
+		f, err := filesystem.NewFileFromPath(encrypted)
+		if err != nil {
+			return err
+		}
+		f.Name = final
+		f.OriginalName = final
+		realApp.Store().Set(core.StoreKeyActiveBackup, final)
+		if err = realFS.UploadFile(f, final); err != nil {
+			return fmt.Errorf("persist encrypted backup: %w", err)
+		}
+		e.Name = final
+		return nil
+	})
+	app.OnBackupRestore().Bind(&hook.Handler[*core.BackupEvent]{Id: "spink.restore.finalizer", Priority: 9999, Func: func(e *core.BackupEvent) error {
+		c, err := config(e.App)
+		if err != nil {
+			return err
+		}
+		if filepath.Base(e.Name) != e.Name || strings.ContainsAny(e.Name, "/\\") {
+			return errors.New("invalid backup name")
+		}
+		// Own the restore finalizer to authenticate before extraction and preserve cancellation.
+		return restore(e, c)
+	}})
+}

package/backups/restore.go

@@ -0,0 +1,119 @@
+package backups
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"runtime"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func restore(e *core.BackupEvent, config Config) error {
+	name := e.Name
+	if runtime.GOOS == "windows" {
+		return errors.New("restore is not supported on Windows")
+	}
+
+	// make sure that the special temp directory exists
+	// note: it needs to be inside the current pb_data to avoid "cross-device link" errors
+	localTempDir := filepath.Join(e.App.DataDir(), core.LocalTempDirName)
+	if err := os.MkdirAll(localTempDir, 0700); err != nil {
+		return fmt.Errorf("failed to create a temp dir: %w", err)
+	}
+
+	fsys, err := e.App.NewBackupsFilesystem()
+	if err != nil {
+		return err
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(e.Context)
+
+	if ok, _ := fsys.Exists(name); !ok {
+		return fmt.Errorf("missing or invalid backup file %q to restore", name)
+	}
+
+	extractedDataDir := filepath.Join(localTempDir, "pb_restore_"+security.PseudorandomString(8))
+	defer os.RemoveAll(extractedDataDir)
+
+	// extract the zip
+	if e.App.Settings().Backups.S3.Enabled {
+		br, err := fsys.GetReader(name)
+		if err != nil {
+			return err
+		}
+		defer br.Close()
+
+		// create a temp zip file from the blob.Reader and try to extract it
+		tempZip, err := os.CreateTemp(localTempDir, "pb_restore_zip")
+		if err != nil {
+			return err
+		}
+		defer os.Remove(tempZip.Name())
+		defer tempZip.Close() // note: this technically shouldn't be necessary but it is here to workaround platforms discrepancies
+
+		_, err = io.Copy(tempZip, backupContextReader{e.Context, br})
+		if err != nil {
+			return err
+		}
+
+		err = extractBackup(e.Context, config, tempZip.Name(), extractedDataDir, name)
+		if err != nil {
+			return err
+		}
+
+		// remove the temp zip file since we no longer need it
+		// (this is in case the app restarts and the defer calls are not called)
+		_ = tempZip.Close()
+		err = os.Remove(tempZip.Name())
+		if err != nil {
+			e.App.Logger().Warn(
+				"[RestoreBackup] Failed to remove the temp zip backup file",
+				slog.String("file", tempZip.Name()),
+				slog.String("error", err.Error()),
+			)
+		}
+	} else {
+		// manually construct the local path to avoid creating a copy of the zip file
+		// since the blob reader currently doesn't implement ReaderAt
+		zipPath := filepath.Join(e.App.DataDir(), core.LocalBackupsDirName, filepath.Base(name))
+
+		err = extractBackup(e.Context, config, zipPath, extractedDataDir, name)
+		if err != nil {
+			return err
+		}
+	}
+
+	// ensure that at least a database file exists
+	extractedDB := filepath.Join(extractedDataDir, "data.db")
+	if _, err := os.Stat(extractedDB); err != nil {
+		return fmt.Errorf("data.db file is missing or invalid: %w", err)
+	}
+
+	oldTempDataDir := filepath.Join(localTempDir, "old_pb_data_"+security.PseudorandomString(8))
+
+	if err := e.Context.Err(); err != nil {
+		return err
+	}
+	revertDataDirChanges, err := replaceData(e, extractedDataDir, oldTempDataDir, osutils.MoveDirContent)
+	if err != nil {
+		return err
+	}
+
+	// restart the app
+	if err := e.App.Restart(); err != nil {
+		if revertErr := revertDataDirChanges(); revertErr != nil {
+			panic(revertErr)
+		}
+
+		return fmt.Errorf("failed to restart the app process: %w", err)
+	}
+
+	return nil
+}

package/backups/s3_test.go

@@ -0,0 +1,52 @@
+package backups
+
+import (
+	"context"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+)
+
+func TestS3DestinationReceivesOnlyCiphertext(t *testing.T) {
+	a, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer a.Cleanup()
+	var mu sync.Mutex
+	var uploads [][]byte
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method {
+		case "HEAD":
+			w.WriteHeader(404)
+		case "PUT":
+			data, _ := io.ReadAll(r.Body)
+			mu.Lock()
+			uploads = append(uploads, data)
+			mu.Unlock()
+			w.Header().Set("ETag", `"fixture"`)
+			w.WriteHeader(200)
+		default:
+			w.WriteHeader(404)
+		}
+	}))
+	defer server.Close()
+	a.Settings().Backups.S3 = core.S3Config{Enabled: true, Bucket: "backups", Endpoint: server.URL, Region: "us-east-1", AccessKey: "fixture", Secret: "fixture", ForcePathStyle: true}
+	t.Setenv("PB_BACKUP_TEST_KEY", strings.Repeat("x", 32))
+	Register(a, func(core.App) (Config, error) {
+		return Config{Encrypted: true, EncryptionEnv: "PB_BACKUP_TEST_KEY"}, nil
+	})
+	if err = a.CreateBackup(context.Background(), "s3.zip"); err != nil {
+		t.Fatal(err)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if len(uploads) != 1 || !strings.HasPrefix(string(uploads[0]), EncryptedBackupHeader) {
+		t.Fatalf("unexpected uploaded object count/format: %d", len(uploads))
+	}
+}

package/backups/swap.go

@@ -0,0 +1,53 @@
+package backups
+
+import (
+	"fmt"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+type moveFiles func(string, string, ...string) error
+
+func replaceData(e *core.BackupEvent, extracted, old string, move moveFiles) (func() error, error) {
+	oldMoved, newMoved := false, false
+	rollback := func() error {
+		if newMoved {
+			if err := move(e.App.DataDir(), extracted, e.Exclude...); err != nil {
+				return fmt.Errorf("revert replacement: %w", err)
+			}
+			newMoved = false
+		}
+		if oldMoved {
+			if err := move(old, e.App.DataDir(), e.Exclude...); err != nil {
+				return fmt.Errorf("restore original data: %w", err)
+			}
+			oldMoved = false
+		}
+		return nil
+	}
+	err := e.App.RunInTransaction(func(tx core.App) error {
+		return tx.AuxRunInTransaction(func(tx core.App) error {
+			if err := e.Context.Err(); err != nil {
+				return err
+			}
+			if err := move(tx.DataDir(), old, e.Exclude...); err != nil {
+				return err
+			}
+			oldMoved = true
+			if err := e.Context.Err(); err != nil {
+				return err
+			}
+			if err := move(extracted, tx.DataDir(), e.Exclude...); err != nil {
+				return err
+			}
+			newMoved = true
+			return nil
+		})
+	})
+	if err != nil {
+		if rollbackErr := rollback(); rollbackErr != nil {
+			panic(fmt.Errorf("restore failed (%v) and rollback failed: %w", err, rollbackErr))
+		}
+		return nil, err
+	}
+	return rollback, nil
+}

package/backups/swap_test.go

@@ -0,0 +1,75 @@
+package backups
+
+import (
+	"context"
+	"errors"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+type commitFailureApp struct{ core.App }
+
+func (a commitFailureApp) RunInTransaction(fn func(core.App) error) error {
+	if err := a.App.RunInTransaction(fn); err != nil {
+		return err
+	}
+	return errors.New("injected commit failure")
+}
+func TestRestoreSwapRollsBackEveryFailure(t *testing.T) {
+	for _, mode := range []string{"second-move", "commit", "cancel"} {
+		t.Run(mode, func(t *testing.T) {
+			a, err := tests.NewTestApp()
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer a.Cleanup()
+			marker := filepath.Join(a.DataDir(), "marker.txt")
+			os.WriteFile(marker, []byte("original"), 0600)
+			stage := t.TempDir()
+			old := t.TempDir()
+			os.WriteFile(filepath.Join(stage, "marker.txt"), []byte("new"), 0600)
+			var app core.App = a
+			if mode == "commit" {
+				app = commitFailureApp{a}
+			}
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			if mode == "cancel" {
+				cancel()
+			}
+			e := &core.BackupEvent{App: app, Context: ctx, Exclude: []string{core.LocalTempDirName, core.LocalBackupsDirName, core.LocalNotifyDirName}}
+			calls := 0
+			move := func(from, to string, exclude ...string) error {
+				calls++
+				if mode == "second-move" && calls == 2 {
+					return errors.New("injected second move failure")
+				}
+				return osutils.MoveDirContent(from, to, exclude...)
+			}
+			if _, err = replaceData(e, stage, old, move); err == nil {
+				t.Fatal("accepted failure")
+			}
+			raw, err := os.ReadFile(marker)
+			if err != nil || string(raw) != "original" {
+				t.Fatalf("original data displaced: %s %v", raw, err)
+			}
+		})
+	}
+}
+func TestLaterRestoreHookStillExecutes(t *testing.T) {
+	a, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer a.Cleanup()
+	Register(a, func(core.App) (Config, error) { return Config{}, nil })
+	called := false
+	a.OnBackupRestore().BindFunc(func(e *core.BackupEvent) error { called = true; return errors.New("operator denied restore") })
+	if err = a.RestoreBackup(context.Background(), "missing.zip"); err == nil || !called {
+		t.Fatal("restore suppressed application hook")
+	}
+}

package/backups/upload.go

@@ -0,0 +1,52 @@
+package backups
+
+import (
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"io"
+	"path/filepath"
+	"strings"
+)
+
+func RegisterUpload(app core.App) {
+	app.OnServe().BindFunc(func(e *core.ServeEvent) error {
+		e.Router.POST("/api/spink/backups/upload", func(r *core.RequestEvent) error {
+			files, err := r.FindUploadedFiles("file")
+			if err != nil || len(files) != 1 {
+				return r.BadRequestError("Select one encrypted backup", err)
+			}
+			f := files[0]
+			if filepath.Base(f.OriginalName) != f.OriginalName || !strings.HasSuffix(f.OriginalName, ".zip.age") {
+				return r.BadRequestError("Expected .zip.age archive", nil)
+			}
+			rd, err := f.Reader.Open()
+			if err != nil {
+				return err
+			}
+			header := make([]byte, len(EncryptedBackupHeader))
+			_, err = io.ReadFull(rd, header)
+			rd.Close()
+			if err != nil || string(header) != EncryptedBackupHeader {
+				return r.BadRequestError("Invalid encrypted archive header", nil)
+			}
+			fs, err := r.App.NewBackupsFilesystem()
+			if err != nil {
+				return err
+			}
+			defer fs.Close()
+			fs.SetContext(r.Request.Context())
+			exists, err := fs.Exists(f.OriginalName)
+			if err != nil {
+				return err
+			}
+			if exists {
+				return r.BadRequestError("Backup already exists", nil)
+			}
+			if err = fs.UploadFile(f, f.OriginalName); err != nil {
+				return err
+			}
+			return r.NoContent(204)
+		}).Bind(apis.RequireSuperuserAuth(), apis.BodyLimit(0))
+		return e.Next()
+	})
+}

package/bin/pocketbase-extension.mjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import {spawn,spawnSync} from 'node:child_process';
+import {mkdtempSync,rmSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {fileURLToPath} from 'node:url';
+import {resolve,join} from 'node:path';
+const root=fileURLToPath(new URL('..',import.meta.url));
+const args=process.argv.slice(2);
+let target='pocketbase';
+if(args[0]==='loadtest'||args[0]==='import-fork')target=args.shift();
+if(target==='pocketbase'&&args.length===0)args.push('serve');
+let hasDir=false;
+for(let i=0;i<args.length;i++){
+ if(args[i].startsWith('--dir=')){args[i]='--dir='+resolve(process.cwd(),args[i].slice(6));hasDir=true;}
+ else if(args[i]==='--dir'&&args[i+1]){args[++i]=resolve(process.cwd(),args[i]);hasDir=true;}
+}
+if(target==='pocketbase'&&!hasDir)args.push('--dir='+resolve(process.cwd(),'pb_data'));
+const temp=mkdtempSync(join(tmpdir(),'spink-pocketbase-'));
+const binary=join(temp,process.platform==='win32'?'pocketbase.exe':'pocketbase');
+const result=spawnSync('go',['build','-o',binary,'./cmd/'+target],{cwd:root,stdio:'inherit',env:{...process.env,GOWORK:'off'}});
+if(result.error||result.status!==0){rmSync(temp,{recursive:true,force:true});console.error('Building the extension requires Go 1.27+.',result.error?.message||'');process.exit(result.status||1);}
+const child=spawn(binary,args,{cwd:process.cwd(),stdio:'inherit',env:process.env});
+child.on('error',error=>{rmSync(temp,{recursive:true,force:true});console.error(error.message);process.exitCode=1;});
+for(const signal of ['SIGINT','SIGTERM'])process.on(signal,()=>child.kill(signal));
+child.on('exit',(code,signal)=>{rmSync(temp,{recursive:true,force:true});process.exitCode=code??(signal?1:0)});

package/cmd/edge/main.go

@@ -0,0 +1,123 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/spink-dev/pocketbase-extension/edge"
+	"golang.org/x/net/netutil"
+)
+
+func main() {
+	upstream := flag.String("upstream", "http://pocketbase:8090", "Private PocketBase origin")
+	listen := flag.String("listen", ":8080", "Public listener")
+	operator := flag.String("operator", ":8081", "Operator listener; publish on loopback only")
+	policyPath := flag.String("policy", "/etc/spink/edge.json", "Edge policy file")
+	checkpoint := flag.String("checkpoint", "/state/state.json", "Read-only security checkpoint")
+	probe := flag.String("probe", "", "Health URL to check and exit")
+	flag.Parse()
+	if *probe != "" {
+		c := http.Client{Timeout: 2 * time.Second}
+		r, e := c.Get(*probe)
+		if e != nil {
+			os.Exit(1)
+		}
+		r.Body.Close()
+		if r.StatusCode < 200 || r.StatusCode >= 300 {
+			os.Exit(1)
+		}
+		return
+	}
+	slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, nil)))
+	u, err := url.Parse(*upstream)
+	if err != nil || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") || u.User != nil || u.Path != "" || u.RawQuery != "" {
+		slog.Error("invalid upstream origin")
+		os.Exit(1)
+	}
+	p, err := edge.LoadPolicy(*policyPath)
+	if err != nil {
+		slog.Error("invalid edge policy", "error", err)
+		os.Exit(1)
+	}
+	g, err := edge.New(u, p)
+	if err != nil {
+		slog.Error("gateway startup", "error", err)
+		os.Exit(1)
+	}
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	go func() {
+		ticker := time.NewTicker(time.Second)
+		defer ticker.Stop()
+		wasValid := false
+		for {
+			next, pe := edge.LoadPolicy(*policyPath)
+			snapshot, se := edge.LoadSnapshot(*checkpoint)
+			valid := pe == nil && se == nil
+			g.Apply(next, snapshot, valid)
+			if valid != wasValid {
+				slog.Info("edge policy readiness changed", "ready", valid)
+				wasValid = valid
+			}
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+			}
+		}
+	}()
+	go func() {
+		c := http.Client{Timeout: 2 * time.Second}
+		ticker := time.NewTicker(2 * time.Second)
+		defer ticker.Stop()
+		for {
+			r, e := c.Get(u.String() + "/api/health")
+			healthy := e == nil && r.StatusCode == 200
+			if r != nil {
+				r.Body.Close()
+			}
+			g.SetHealthy(healthy)
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+			}
+		}
+	}()
+	servers := []*http.Server{
+		{Addr: *listen, Handler: http.HandlerFunc(g.Public), ReadHeaderTimeout: 3 * time.Second, ReadTimeout: 10 * time.Second, WriteTimeout: 30 * time.Second, IdleTimeout: 15 * time.Second, MaxHeaderBytes: 16 << 10},
+		{Addr: *operator, Handler: http.HandlerFunc(g.Operator), ReadHeaderTimeout: 5 * time.Second, ReadTimeout: 120 * time.Second, WriteTimeout: 120 * time.Second, IdleTimeout: 30 * time.Second, MaxHeaderBytes: 32 << 10},
+	}
+	for i, s := range servers {
+		l, e := net.Listen("tcp", s.Addr)
+		if e != nil {
+			slog.Error("listen", "error", e)
+			os.Exit(1)
+		}
+		limit := 256
+		if i == 1 {
+			limit = 32
+		}
+		go func() {
+			if e := s.Serve(netutil.LimitListener(l, limit)); e != nil && e != http.ErrServerClosed {
+				slog.Error("serve", "error", e)
+				stop()
+			}
+		}()
+	}
+	slog.Info("gateway started", "public", *listen, "operator", *operator)
+	<-ctx.Done()
+	shutdown, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	for _, s := range servers {
+		s.Shutdown(shutdown)
+	}
+}

package/cmd/import-fork/main.go

@@ -0,0 +1,37 @@
+package main
+
+import (
+	"flag"
+	"github.com/pocketbase/pocketbase/core"
+	_ "github.com/pocketbase/pocketbase/migrations"
+	extension "github.com/spink-dev/pocketbase-extension"
+	"github.com/spink-dev/pocketbase-extension/migration"
+	"log"
+	"path/filepath"
+)
+
+func main() {
+	dir := flag.String("dir", "", "Offline database copy to import")
+	encryptionEnv := flag.String("encryptionEnv", "", "Environment variable holding the native settings encryption key")
+	flag.Parse()
+	if *dir == "" {
+		log.Fatal("--dir is required; stop the server and use a backed-up copy")
+	}
+	abs, err := filepath.Abs(*dir)
+	if err != nil {
+		log.Fatal(err)
+	}
+	app := core.NewBaseApp(core.BaseAppConfig{DataDir: abs, EncryptionEnv: *encryptionEnv})
+	if err = extension.Register(app, extension.DefaultConfig()); err != nil {
+		log.Fatal(err)
+	}
+	if err = app.Bootstrap(); err != nil {
+		log.Fatal(err)
+	}
+	defer app.ResetBootstrapState()
+	changed, err := migration.Import(app)
+	if err != nil {
+		log.Fatal(err)
+	}
+	log.Printf("Fork settings import complete; changed=%v", changed)
+}