botversion-sdk 2.2.3 → 2.3.0

package/undo/lib/undo-prisma.js

@@ -0,0 +1,404 @@
+// lib/undo-prisma.js
+"use strict";
+// UNDO (Prisma + Postgres): restores the rows saved for one AI action, all or nothing.
+// Logs: table names and counts only.
+
+const log = require("./log");
+const snapshotCrypto = require("./snapshot-crypto");
+const { TABLE } = require("./snapshot-store");
+const requester = require("./requester");
+const { findHostRoot, dialectFromPrismaClient } = require("./scanner");
+const structure = require("./prisma-structure");
+
+// Prisma needs a special value to write "database NULL" into a Json column.
+let dbNull = null;
+function jsonNull() {
+  try {
+    if (!dbNull) {
+      const p = require.resolve("@prisma/client", {
+        paths: [findHostRoot(), process.cwd()],
+      });
+      dbNull = require(p).Prisma.DbNull;
+    }
+  } catch (_) {
+    /* leave it null: the column is then left to its default */
+  }
+  return dbNull;
+}
+
+let base = null; // the app's own PrismaClient (not the extended one, so our writes are never captured)
+let dialect = "postgres"; // database type of the app's Prisma client
+function remember(client, d) {
+  // TEMP DEBUG: was the Prisma client and database type remembered, and when?
+  log.debug(
+    "undoPrisma.remember called:",
+    "dialectPassed=" + String(d),
+    "hasClient=" + !!client,
+    "hasTransactionFn=" +
+      !!(client && typeof client.$transaction === "function"),
+  );
+  base = client;
+  // FIX: the hook's value first, then what the live client reports, then Postgres (the old default).
+  dialect = d || dialectFromPrismaClient(client) || "postgres";
+  // MongoDB has its own Undo file (no SQL there).
+  if (dialect === "mongodb") require("./undo-prisma-mongo").remember(client);
+}
+// SQL pieces that differ per database: the placeholder, "current time", and how a row lock is asked for.
+const PH = () =>
+  dialect === "mysql" || dialect === "sqlite"
+    ? "?"
+    : dialect === "sqlserver"
+      ? "@P1"
+      : "$1";
+const NOW = () =>
+  dialect === "mysql"
+    ? "UTC_TIMESTAMP(3)"
+    : dialect === "sqlite"
+      ? "strftime('%Y-%m-%dT%H:%M:%fZ','now')"
+      : dialect === "sqlserver"
+        ? "SYSUTCDATETIME()"
+        : "now()";
+// "Is this snapshot still inside its time window" as 1 or 0 (SQL Server cannot return a bare comparison as a column).
+const LIVE = () => `CASE WHEN expires_at > ${NOW()} THEN 1 ELSE 0 END`;
+// Row lock while Undo checks and restores: SQL Server wants a hint after the table name, SQLite has no row locks.
+const LOCK_HINT = () =>
+  dialect === "sqlserver" ? " WITH (UPDLOCK, ROWLOCK)" : "";
+const LOCK_SUFFIX = () =>
+  dialect === "postgres" || dialect === "mysql" ? " FOR UPDATE" : "";
+
+class Refuse extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+
+// Same text for equal rows: sorted keys, dates as ISO text, big numbers as text.
+function canon(v) {
+  return JSON.stringify(v, (k, val) => {
+    if (typeof val === "bigint") return val.toString();
+    if (val && typeof val === "object" && !Array.isArray(val)) {
+      const o = {};
+      for (const key of Object.keys(val).sort()) o[key] = val[key];
+      return o;
+    }
+    return val;
+  });
+}
+
+function infoFor(table) {
+  const models =
+    base && base._runtimeDataModel && base._runtimeDataModel.models;
+  if (!models) return null;
+  for (const name of Object.keys(models)) {
+    const m = models[name];
+    if ((m.dbName || name) !== table) continue;
+    const scalars = m.fields.filter(
+      (f) => f.kind === "scalar" || f.kind === "enum",
+    );
+    const pkFields =
+      m.primaryKey &&
+      Array.isArray(m.primaryKey.fields) &&
+      m.primaryKey.fields.length
+        ? m.primaryKey.fields.slice()
+        : m.fields.filter((f) => f.isId).map((f) => f.name);
+    return {
+      acc: name.charAt(0).toLowerCase() + name.slice(1),
+      scalars,
+      // FIX: when the client carries no key markers, use the primary key read from the database itself.
+      pkFields: pkFields.length
+        ? pkFields
+        : structure.primaryKeyFields(base, m.dbName || name, scalars),
+    };
+  }
+  return null;
+}
+const colOf = (f) => f.dbName || f.name;
+const toColumns = (info, row) => {
+  const o = {};
+  for (const f of info.scalars) o[colOf(f)] = row[f.name];
+  return o;
+};
+function whereOf(info, pk) {
+  const w = {};
+  for (const n of info.pkFields) {
+    const f = info.scalars.find((x) => x.name === n);
+    w[n] = pk[f ? colOf(f) : n];
+  }
+  return w;
+}
+
+// Returns { undone: number }. Throws Refuse (nothing changed) or another error (nothing changed).
+async function undoAction(actionId, requesterHash, opts) {
+  if (dialect === "mongodb" && base)
+    return require("./undo-prisma-mongo").undoAction(
+      actionId,
+      requesterHash,
+      opts,
+    );
+  if (!base || typeof base.$transaction !== "function") {
+    throw new Refuse(
+      "no-client",
+      "Undo is not ready yet: the app has not created its Prisma client in this process. Open any page of the app and try again.",
+    );
+  }
+  if (!snapshotCrypto.hasKey())
+    throw new Refuse("no-key", "Undo is off: no API key was given to the SDK.");
+
+  // FIX: make sure the primary keys are known before restoring rows (once per client; a restart clears them).
+  await structure.load(base, dialect);
+  // TEMP DEBUG: tracks which step an undo failure happened in (table and operation only, never values)
+  let step = "reading saved rows";
+  try {
+    return await base.$transaction(
+      async (tx) => {
+        // Order by real save time first: seq restarts for each request, so it cannot order rows across requests.
+        const allRows = await tx.$queryRawUnsafe(
+          `SELECT id, seq, table_name, operation, primary_key, before_data, after_data, requester_hash, status, ${LIVE()} AS live ` +
+            `FROM ${TABLE}${LOCK_HINT()} WHERE action_id = ${PH()} ORDER BY created_at DESC, seq DESC${LOCK_SUFFIX()}`,
+          actionId,
+        );
+        // Visual runs undo only the rows of one request (onlyIds); otherwise the whole action.
+        const only =
+          opts && opts.onlyIds
+            ? new Set(opts.onlyIds.map((x) => String(x).toLowerCase()))
+            : null;
+        const rows = only
+          ? allRows.filter((r) => only.has(String(r.id).toLowerCase()))
+          : allRows;
+        if (!rows.length)
+          throw new Refuse(
+            "not-found",
+            "Nothing to undo for this action (it may have expired or saved nothing).",
+          );
+        // Requester check: every saved row must carry the same hash as this request's secret.
+        if (
+          !rows.every((r) => requester.same(r.requester_hash, requesterHash))
+        ) {
+          throw new Refuse(
+            "forbidden",
+            "Undo refused: this request is not from the browser session that ran the AI action.",
+          );
+        }
+        if (rows.some((r) => r.status === "undone"))
+          throw new Refuse("already-undone", "This action was already undone.");
+        if (rows.some((r) => Number(r.live) !== 1))
+          throw new Refuse(
+            "expired",
+            "Undo is no longer available: the 30 minute window has passed.",
+          );
+
+        for (const r of rows) {
+          // TEMP DEBUG: which saved row Undo is working on
+          step = `${r.operation} ${r.table_name} (seq ${r.seq})`;
+          // last write first; each write is checked just before it is reversed
+          const info = infoFor(r.table_name);
+          if (!info)
+            throw new Refuse(
+              "unsupported",
+              `Cannot undo changes to "${r.table_name}" yet (only Prisma models are supported for now). Nothing was changed.`,
+            );
+          if (!["insert", "update", "delete"].includes(r.operation))
+            throw new Refuse(
+              "unsupported",
+              "This kind of change cannot be undone yet. Nothing was changed.",
+            );
+          // A deleted row: put it back, but only if nothing else has taken its key since.
+          if (r.operation === "delete") {
+            if (!r.before_data)
+              throw new Refuse(
+                "conflict",
+                "The deleted row was not saved. Nothing was changed.",
+              );
+            const dpk = snapshotCrypto.decrypt(r.primary_key);
+            const old = snapshotCrypto.decrypt(r.before_data);
+            const exists = await tx[info.acc].findFirst({
+              where: whereOf(info, dpk),
+            });
+            if (exists)
+              throw new Refuse(
+                "conflict",
+                `Not undone: a row with the same key exists again in "${r.table_name}". Nothing was changed.`,
+              );
+            const data = {};
+            for (const f of info.scalars) {
+              if (!(colOf(f) in old)) continue;
+              const v = old[colOf(f)];
+              if (v === null && f.type === "Json") {
+                const n = jsonNull();
+                if (n) data[f.name] = n;
+                continue;
+              }
+              data[f.name] = v;
+            }
+            if (dialect === "sqlserver") {
+              // SQL Server refuses an explicit value in an identity column unless IDENTITY_INSERT is on; handles any table with an auto-number key.
+              const qn = "[" + String(r.table_name).replace(/\]/g, "]]") + "]";
+              const idn = await tx.$queryRawUnsafe(
+                "SELECT COUNT(*) AS n FROM sys.columns WHERE object_id = OBJECT_ID(@P1) AND is_identity = 1",
+                qn,
+              );
+              const hasIdentity = Number(idn[0] && idn[0].n) > 0;
+              const names = Object.keys(data);
+              const colList = names
+                .map((n) => {
+                  const f = info.scalars.find((x) => x.name === n);
+                  return (
+                    "[" + String(f ? colOf(f) : n).replace(/\]/g, "]]") + "]"
+                  );
+                })
+                .join(", ");
+              const holders = names.map((_, i) => "@P" + (i + 1)).join(", ");
+              const values = names.map((n) => {
+                const v = data[n];
+                return v !== null &&
+                  typeof v === "object" &&
+                  !(v instanceof Date) &&
+                  !Buffer.isBuffer(v)
+                  ? JSON.stringify(v)
+                  : v;
+              });
+              // One batch, so IDENTITY_INSERT is on and off on the same connection as the insert.
+              const ins = `INSERT INTO ${qn} (${colList}) VALUES (${holders})`;
+              await tx.$executeRawUnsafe(
+                hasIdentity
+                  ? `SET IDENTITY_INSERT ${qn} ON; ${ins}; SET IDENTITY_INSERT ${qn} OFF;`
+                  : ins,
+                ...values,
+              );
+            } else {
+              await tx[info.acc].create({ data });
+            }
+            continue;
+          }
+
+          if (!r.after_data)
+            throw new Refuse(
+              "conflict",
+              `Cannot verify "${r.table_name}": its after-state was not saved. Nothing was changed.`,
+            );
+
+          const pk = snapshotCrypto.decrypt(r.primary_key);
+          const after = snapshotCrypto.decrypt(r.after_data);
+          const where = whereOf(info, pk);
+          const current = await tx[info.acc].findFirst({ where });
+          if (!current || canon(toColumns(info, current)) !== canon(after)) {
+            throw new Refuse(
+              "conflict",
+              `Not undone: a row in "${r.table_name}" was changed after the AI action. Nothing was changed.`,
+            );
+          }
+
+          if (r.operation === "insert") {
+            const res = await tx[info.acc].deleteMany({ where });
+            if (res.count !== 1) throw new Error("unexpected delete count");
+          } else {
+            if (!r.before_data)
+              throw new Refuse(
+                "conflict",
+                "The old row was not saved. Nothing was changed.",
+              );
+            const before = snapshotCrypto.decrypt(r.before_data);
+            const data = {};
+            for (const f of info.scalars) {
+              if (info.pkFields.includes(f.name)) continue;
+              if (colOf(f) in before) data[f.name] = before[colOf(f)];
+            }
+            const res = await tx[info.acc].updateMany({ where, data });
+            if (res.count !== 1) throw new Error("unexpected update count");
+          }
+        }
+        // discard = rolled back by the confirm gate: remove the rows so the action can run again with the same id
+        if (opts && opts.discard && only) {
+          const ph = (i) =>
+            dialect === "mysql" || dialect === "sqlite"
+              ? "?"
+              : dialect === "sqlserver"
+                ? "@P" + (i + 1)
+                : "$" + (i + 1) + "::uuid";
+          await tx.$executeRawUnsafe(
+            `DELETE FROM ${TABLE} WHERE id IN (${rows.map((_, i) => ph(i)).join(", ")})`,
+            ...rows.map((r) => r.id),
+          );
+        } else
+          await tx.$executeRawUnsafe(
+            opts && opts.discard
+              ? `DELETE FROM ${TABLE} WHERE action_id = ${PH()}`
+              : `UPDATE ${TABLE} SET status = 'undone' WHERE action_id = ${PH()}`,
+            actionId,
+          );
+        return {
+          undone: rows.length,
+          hadDelete: rows.some((r) => r.operation === "delete"),
+        };
+      },
+      { maxWait: 5000, timeout: 30000 },
+    );
+  } catch (e) {
+    if (e instanceof Refuse && e.code === "conflict") {
+      try {
+        await base.$executeRawUnsafe(
+          `UPDATE ${TABLE} SET status = 'conflict' WHERE action_id = ${PH()}`,
+          actionId,
+        );
+      } catch (_) {
+        /* ignore */
+      }
+    }
+    if (!(e instanceof Refuse)) {
+      // TEMP DEBUG: real cause of an undo failure. Only the error type, codes and the database's own message are printed, never row values.
+      try {
+        const raw = String((e && e.message) || "");
+        const dbCode = /Code: `([^`]*)`/.exec(raw);
+        const dbMsg = /Message: `([^`]*)`/.exec(raw);
+        const lastLine =
+          raw
+            .split("\n")
+            .map((s) => s.trim())
+            .filter(Boolean)
+            .pop() || "";
+      } catch (_) {
+        /* never break the host */
+      }
+    }
+    throw e;
+  }
+}
+
+// Is there anything to undo for this action, for this browser session? Answers true/false only.
+// Throws Refuse("no-client") when this process has no Prisma client (the caller then tries pg).
+async function statusAction(actionId, requesterHash) {
+  if (dialect === "mongodb" && base)
+    return require("./undo-prisma-mongo").statusAction(actionId, requesterHash);
+  if (!base || typeof base.$queryRawUnsafe !== "function") {
+    throw new Refuse("no-client", "Prisma client not ready.");
+  }
+  const rows = await base.$queryRawUnsafe(
+    `SELECT requester_hash, status, ${LIVE()} AS live FROM ${TABLE} WHERE action_id = ${PH()}`,
+    actionId,
+  );
+  // Same safety checks as Undo itself: same browser session, still captured, still inside the window.
+  return (
+    rows.length > 0 &&
+    rows.every(
+      (r) =>
+        requester.same(r.requester_hash, requesterHash) &&
+        r.status === "captured" &&
+        Number(r.live) === 1,
+    )
+  );
+}
+
+module.exports = {
+  remember,
+  undoAction,
+  statusAction,
+  Refuse,
+  // shared with the MongoDB Undo file
+  infoFor,
+  toColumns,
+  whereOf,
+  canon,
+  colOf,
+  jsonNull,
+};

package/undo/lib/undo-route.js

@@ -0,0 +1,197 @@
+// lib/undo-route.js
+"use strict";
+// The Undo endpoint: POST /botversion-undo  body {"actionId":"..."}.
+// TESTING ONLY until the id is tied to the signed-in user (README section 9).
+
+const log = require("./log");
+const undoPrisma = require("./undo-prisma");
+const requester = require("./requester");
+const undoPg = require("./undo-pg");
+const undoMysql = require("./undo-mysql");
+const undoMongo = require("./undo-mongo");
+const undoSqlite = require("./undo-sqlite");
+const undoMssql = require("./undo-mssql");
+
+const PATH = "/botversion-undo";
+const NOTE = "Emails, payments and other outside actions cannot be undone.";
+
+const STATUS_PATH = "/botversion-undo-status";
+
+// true only when something saved for this action can still be undone by this browser session.
+// Any problem answers false, so the widget simply does not draw the button.
+async function statusOf(id, hash) {
+  try {
+    // Ask each database in turn; the first one that has something to undo answers true.
+    for (const u of [
+      undoPrisma,
+      undoPg,
+      undoMysql,
+      undoMongo,
+      undoSqlite,
+      undoMssql,
+    ]) {
+      try {
+        if (await u.statusAction(id, hash)) return true;
+      } catch (e) {
+        if (!(e instanceof undoPrisma.Refuse && e.code === "no-client"))
+          throw e;
+      }
+    }
+    return false;
+  } catch (_) {
+    return false;
+  }
+}
+
+// Lets a browser on another domain call Undo. No cookies are used, so "*" is safe: the signed id and the session secret are the protection.
+const CORS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "POST, OPTIONS",
+  "Access-Control-Allow-Headers":
+    "Content-Type, x-botversion-requester, x-botversion-action-id",
+  "Access-Control-Max-Age": "600",
+};
+
+function send(res, status, obj) {
+  try {
+    res.statusCode = status;
+    for (const k of Object.keys(CORS)) res.setHeader(k, CORS[k]);
+    res.setHeader("Content-Type", "application/json");
+    res.end(JSON.stringify(obj));
+  } catch (_) {
+    /* ignore */
+  }
+}
+
+// Returns true when it answered the request.
+function handle(req, res, isValidId) {
+  const urlPath = String(req.url || "").split("?")[0];
+  const isStatus = urlPath === STATUS_PATH;
+  if (urlPath !== PATH && !isStatus) return false;
+  // Browser permission check (preflight) for cross-domain hosts.
+  if (req.method === "OPTIONS") {
+    try {
+      res.statusCode = 204;
+      for (const k of Object.keys(CORS)) res.setHeader(k, CORS[k]);
+      res.end();
+    } catch (_) {
+      /* ignore */
+    }
+    return true;
+  }
+  if (req.method !== "POST") {
+    send(res, 405, { ok: false, message: "Use POST." });
+    return true;
+  }
+
+  let body = "";
+  let tooBig = false;
+  req.on("data", (c) => {
+    if (tooBig) return;
+    body += c;
+    if (body.length > 4096) {
+      tooBig = true;
+      send(res, 413, { ok: false, message: "Request too large." });
+    }
+  });
+  req.on("error", () => {});
+  req.on("end", async () => {
+    if (tooBig) return;
+    try {
+      let id = null;
+      try {
+        id = JSON.parse(body).actionId;
+      } catch (_) {
+        /* bad JSON */
+      }
+      if (typeof id !== "string" || !isValidId(id)) {
+        return send(res, 403, { ok: false, message: "Invalid action id." });
+      }
+      // Try Prisma first; if the saved change is not a Prisma model (or Prisma is not in use), try pg.
+      const hash = requester.fromHeaders(req.headers);
+      // Status question from the widget: is there anything to undo? (changes nothing)
+      if (isStatus) {
+        return send(res, 200, {
+          ok: true,
+          available: await statusOf(id, hash),
+        });
+      }
+      // Try each database in turn; move on only when it says "not mine" (unsupported) or "no client here" (no-client).
+      let r;
+      let unsupported = null;
+      let notFound = null;
+      let last = null;
+      for (const u of [
+        undoPrisma,
+        undoPg,
+        undoMysql,
+        undoMongo,
+        undoSqlite,
+        undoMssql,
+      ]) {
+        try {
+          r = await u.undoAction(id, hash);
+          break;
+        } catch (e) {
+          const next =
+            e instanceof undoPrisma.Refuse &&
+            (e.code === "unsupported" ||
+              e.code === "no-client" ||
+              e.code === "not-found");
+          log.debug(
+            "undo route: undoer said",
+            (e && e.code) || (e && e.name) || "unknown",
+            next ? "(trying next database)" : "(stopping)",
+          );
+          if (!next) throw e;
+          if (e.code === "unsupported" && !unsupported) unsupported = e;
+          if (e.code === "not-found" && !notFound) notFound = e;
+          last = e;
+        }
+      }
+      if (!r) throw unsupported || notFound || last;
+      send(res, 200, {
+        ok: true,
+        undone: r.undone,
+        message:
+          `Database changes were undone. ` +
+          (r.hadDelete
+            ? "Restoring deleted data is best effort: server-set or hidden values may not come back exactly. "
+            : "") +
+          NOTE,
+      });
+    } catch (e) {
+      log.debug(
+        "undo route FINAL error:",
+        e instanceof undoPrisma.Refuse
+          ? "refuse code=" + e.code
+          : "unexpected " +
+              (e && e.name) +
+              " code=" +
+              ((e && e.code) || "none"),
+      );
+      if (e instanceof undoPrisma.Refuse) {
+        const status =
+          e.code === "forbidden"
+            ? 403
+            : e.code === "conflict" || e.code === "already-undone"
+              ? 409
+              : e.code === "not-found"
+                ? 404
+                : 422;
+        return send(res, status, {
+          ok: false,
+          code: e.code,
+          message: e.message,
+        });
+      }
+      send(res, 500, {
+        ok: false,
+        message: "Undo failed. Nothing was changed.",
+      });
+    }
+  });
+  return true;
+}
+
+module.exports = { handle };