devpush 0.0.0-stage → 1.0.0-beta.3

package/src/server/projects/types.ts

@@ -0,0 +1,355 @@
+import type {
+  BackupStorageReference,
+  BackupStorageSummary,
+} from '#devpush/lib/backup-storage-schema'
+import type {
+  BackupDatabaseDump,
+  BackupRetentionPolicy,
+  BackupVolumeSelection,
+} from '#devpush/server/backups/service'
+import type { getResourceColor } from '#devpush/server/resources/color'
+import type { ServerStatus } from '#devpush/server/servers/status'
+import type {
+  ProjectSummary,
+  ServerSummary,
+  TeamSummary,
+  UserContext,
+} from '#devpush/server/teams/types'
+import type { ProjectComposeMetadata } from './compose-metadata'
+import type { ProjectRuntimeConfig } from '#devpush/lib/project-runtime-config'
+
+export type RepositorySelectionContext = {
+  github:
+    | {
+        connected: true
+        login: string
+        appConfigured: boolean
+        installUrl: string | null
+        installations: Array<{
+          id: number
+          accountLogin: string
+          accountType: string
+          repositorySelection: string
+        }>
+        repositories: Array<{
+          id: number
+          installationId: number
+          name: string
+          fullName: string
+          owner: string
+          private: boolean
+          defaultBranch: string
+          updatedAt: string
+          permissions: {
+            push: boolean
+          }
+        }>
+      }
+    | {
+        connected: false
+        login: null
+        appConfigured: boolean
+        installUrl: string | null
+        installations: []
+        repositories: []
+      }
+}
+
+export type CreatedProject = {
+  id: string
+  name: string
+  githubRepo: string
+  composePath: string | null
+}
+
+export type ProjectPublicRoute = {
+  host: string
+  service: string
+  port: number
+  path: string
+  https: boolean
+  stripPrefix: boolean
+}
+
+export type ProjectRoute = {
+  service: string
+  port: number
+  path: string
+  stripPrefix: boolean
+  environmentId?: string
+}
+
+export type ProjectDomain = {
+  id: string
+  host: string
+  environmentId: string
+  basePath: string | null
+  https: boolean
+  status: 'pending' | 'active' | 'disabled' | 'failed'
+  message: string | null
+  verifiedAt: Date | null
+}
+
+export type ProjectEnvironmentVariable = {
+  key: string
+  value: string
+  environment?: string
+}
+
+export type ProjectEnvironmentConfig = {
+  id: string
+  name: string
+  slug: string
+  branch: string
+  color: string
+  position: number
+  status: 'active' | 'deleted'
+  effectiveServerId: string | null
+  serverId: string | null
+  defaultHost?: string | null
+  defaultRouteHttps?: boolean
+}
+
+export type ProjectBackupConfig = {
+  settingsVersion: number
+  id: string
+  name: string
+  environmentId: string
+  enabled: boolean
+  schedule: ProjectBackupSchedule
+  destination: BackupStorageReference
+  retention: BackupRetentionPolicy
+  volumes: BackupVolumeSelection
+  databaseDumps: Array<BackupDatabaseDump>
+}
+
+export type BackupDestinationInput = BackupStorageReference
+
+export type ProjectBackupSchedule = {
+  cron: string
+}
+
+export type ProjectBackupRun = {
+  id: string
+  configId: string | null
+  localRecoveryAvailable: boolean
+  status: 'queued' | 'running' | 'succeeded' | 'failed' | 'canceled'
+  environmentId: string
+  environmentName: string
+  environmentColor: string
+  serverId: string | null
+  serverName: string | null
+  errorMessage: string | null
+  startedAt: string | null
+  finishedAt: string | null
+  createdAt: string
+  databaseTargets?: Array<BackupDatabaseDump>
+  artifacts: Array<ProjectBackupArtifact>
+}
+
+export type ProjectBackupRestore = {
+  artifacts?: Array<{
+    artifactId: string
+    type: 'volume' | 'database'
+    targetVolume?: string
+    targetService?: string
+  }>
+
+  serverId?: string | null
+  serverName?: string | null
+  id: string
+  backupRunId: string
+  environmentId: string
+  status: ProjectBackupRun['status']
+  errorMessage: string | null
+  createdAt: string
+  startedAt: string | null
+  finishedAt: string | null
+}
+
+export type ProjectBackupArtifact = {
+  id: string
+  type: 'manifest' | 'volume' | 'database'
+  storage: 'local' | 'remote'
+  objectKey: string
+  checksumSha256: string
+  sizeBytes: number
+  createdAt: string
+}
+
+export type DeploymentSummary = {
+  isServing: boolean
+  id: string
+  status: 'queued' | 'running' | 'succeeded' | 'failed' | 'canceled'
+  phase: string | null
+  trigger: 'user' | 'webhook' | 'api' | 'rollback'
+  gitSha: string
+  gitBranch: string
+  githubRepo: string
+  deploymentHost: string | null
+  deploymentRouteHttps: boolean
+  commitMessage: string | null
+  errorMessage: string | null
+  createdAt: string
+  startedAt: string | null
+  finishedAt: string | null
+  environmentName: string
+  environmentSlug: string
+  environmentColor: string
+  serverId: string | null
+  serverName: string
+  serverStatus: ServerStatus
+  projectName: string
+  projectColor: ReturnType<typeof getResourceColor>
+}
+
+export type ProjectContext = {
+  userContext: UserContext
+  team: TeamSummary
+  project: {
+    settingsVersion: number
+    id: string
+    name: string
+    githubInstallationId: number | null
+    githubRepoId: number | null
+    githubRepo: string
+    defaultServerId: string | null
+    avatarUrl: string | null
+    runtimeConfig: ProjectRuntimeConfig
+    color: ReturnType<typeof getResourceColor>
+  }
+  teamProjects: Array<ProjectSummary>
+  routes: Array<ProjectRoute>
+  composeMetadata: ProjectComposeMetadata | null
+  domains: Array<ProjectDomain>
+  envVars: Array<ProjectEnvironmentVariable>
+  backupStorage?: Array<BackupStorageSummary>
+  backupConfigs: Array<ProjectBackupConfig>
+  backupRuns: Array<ProjectBackupRun>
+  backupRestores: Array<ProjectBackupRestore>
+  environment: {
+    id: string
+    name: string
+    slug: string
+    branch: string
+    color: string
+    position: number
+    defaultHost: string | null
+    serverId: string | null
+    serverName: string | null
+    serverStatus: ServerStatus | null
+    serverAgentUpdate: ServerSummary['agentUpdate'] | null
+    envVars: Array<ProjectEnvironmentVariable>
+    publicRoutes: Array<ProjectPublicRoute>
+    runtime: {
+      observedAt: string
+      services: Array<{
+        name: string
+        containerName: string
+        state: string
+        health: string | null
+        restartCount: number
+        startedAt: string | null
+        exitCode: number
+      }>
+    } | null
+  }
+  environments: Array<ProjectEnvironmentConfig>
+  deployments: Array<DeploymentSummary>
+  servers: Array<ServerSummary>
+}
+
+export type ProjectContextScope =
+  | 'backups'
+  | 'deployments'
+  | 'full'
+  | 'overview'
+  | 'settings'
+  | 'shell'
+
+export type ProjectSectionContext =
+  | {
+      scope: 'overview'
+      projectId: string
+      deployments: ProjectContext['deployments']
+      runtime: ProjectContext['environment']['runtime']
+    }
+  | {
+      scope: 'deployments'
+      projectId: string
+      deployments: ProjectContext['deployments']
+    }
+  | {
+      scope: 'settings'
+      context: ProjectContext
+      projectId: string
+      composeMetadata: ProjectContext['composeMetadata']
+      domains: ProjectContext['domains']
+      envVars: ProjectContext['envVars']
+    }
+  | {
+      scope: 'backups'
+      projectId: string
+      backupStorage?: ProjectContext['backupStorage']
+      backupConfigs: ProjectContext['backupConfigs']
+      backupRuns: ProjectContext['backupRuns']
+      backupRestores: ProjectContext['backupRestores']
+      composeMetadata: ProjectContext['composeMetadata']
+    }
+
+export type PluginContext = {
+  userContext: UserContext
+  team: TeamSummary
+  project: ProjectContext['project']
+  teamProjects: Array<ProjectSummary>
+  latestDeployments: Array<DeploymentSummary>
+  environment: ProjectContext['environment']
+  environments: ProjectContext['environments']
+  servers: Array<ServerSummary>
+  deployment: DeploymentSummary
+  visitAliases: Array<{ type: string; hostname: string; https: boolean }>
+  logs: Array<{
+    seq: number
+    stream: string
+    content: string
+    createdAt: string
+  }>
+}
+
+export type DeploymentSectionContext = {
+  projectId: string
+  latestDeployments: Array<DeploymentSummary>
+  deployment: DeploymentSummary
+  visitAliases: Array<{ type: string; hostname: string; https: boolean }>
+}
+
+export type ProjectLogEntry = {
+  source: 'deployment' | 'runtime'
+  deploymentId: string | null
+  runtimeId: string | null
+  service: string | null
+  stream: string
+  seq: number
+  content: string
+  createdAt: string
+}
+
+export type ProjectLogsContext = ProjectContext & {
+  logs: Array<ProjectLogEntry>
+  hasAnyLogs: boolean
+  filters: {
+    branch: string | null
+    date: string | null
+    deploymentId: string | null
+    environmentId: string | null
+    keyword: string | null
+  }
+}
+
+export type ProjectLogsSectionContext = {
+  projectId: string
+  deployments: ProjectContext['deployments']
+  logs: ProjectLogsContext['logs']
+  hasAnyLogs: boolean
+  filters: ProjectLogsContext['filters']
+}

package/src/server/realtime/agent-events.ts

@@ -0,0 +1,32 @@
+import { notifyServer } from './service'
+
+export function agentEventKind(path: string, result: unknown) {
+  if (path === '/api/agents/heartbeat' || path === '/api/agents/register')
+    return 'servers' as const
+  if (path === '/api/agents/runtime-logs') return 'logs' as const
+  if (path === '/api/agents/jobs/next') {
+    return result && typeof result === 'object' && 'job' in result && result.job
+      ? ('deployments' as const)
+      : null
+  }
+  if (['/api/agents/jobs/progress', '/api/agents/jobs/complete'].includes(path))
+    return 'deployments' as const
+  return null
+}
+
+export async function notifyAgentMutation(
+  path: string,
+  payload: unknown,
+  result: unknown,
+) {
+  const kind = agentEventKind(path, result)
+  if (!kind) return
+  const source = path === '/api/agents/register' ? result : payload
+  if (
+    source &&
+    typeof source === 'object' &&
+    'serverId' in source &&
+    typeof source.serverId === 'string'
+  )
+    await notifyServer(source.serverId, kind)
+}

package/src/server/realtime/node-broadcaster.ts

@@ -0,0 +1,71 @@
+export type WorkspaceConnection = {
+  teamId: string
+  sessionId: string
+  expiresAt: number
+}
+export type NotificationPeer = {
+  id: string
+  send: (message: string) => unknown
+  close: (code: number, reason: string) => unknown
+}
+
+export function createNodeBroadcaster() {
+  const workspaces = new Map<
+    string,
+    Map<string, { peer: NotificationPeer; auth: WorkspaceConnection }>
+  >()
+  function remove(peer: NotificationPeer, teamId: string) {
+    const connections = workspaces.get(teamId)
+    connections?.delete(peer.id)
+    if (!connections?.size) workspaces.delete(teamId)
+  }
+  return {
+    add(peer: NotificationPeer, auth: WorkspaceConnection) {
+      let connections = workspaces.get(auth.teamId)
+      if (!connections) {
+        connections = new Map()
+        workspaces.set(auth.teamId, connections)
+      }
+      if (connections.size >= 2000) {
+        peer.close(1013, 'Workspace connection limit reached')
+        return
+      }
+      connections.set(peer.id, { peer, auth })
+    },
+    remove,
+    getByName(teamId: string) {
+      return {
+        async fetch() {
+          return new Response('Use the Node upgrade handler', { status: 426 })
+        },
+        async publish(kind: string, activeSessionIds: string[]) {
+          const authorized = new Set(activeSessionIds)
+          for (const { peer, auth } of workspaces.get(teamId)?.values() ?? []) {
+            if (
+              auth.expiresAt <= Date.now() ||
+              !authorized.has(auth.sessionId)
+            ) {
+              remove(peer, teamId)
+              peer.close(1008, 'Authorization expired')
+              continue
+            }
+            try {
+              peer.send(JSON.stringify({ type: 'changed', kind }))
+            } catch {
+              remove(peer, teamId)
+              peer.close(1011, 'Reconnect required')
+            }
+          }
+        },
+      }
+    },
+  }
+}
+
+// Nitro may load this module in separate HTTP/SSR bundles. Share the registry
+// across those module copies and development reloads within one process.
+const runtime = globalThis as typeof globalThis & {
+  __devpushWorkspaceBroadcaster?: ReturnType<typeof createNodeBroadcaster>
+}
+export const nodeBroadcaster = (runtime.__devpushWorkspaceBroadcaster ??=
+  createNodeBroadcaster())

package/src/server/realtime/node-handler.ts

@@ -0,0 +1,55 @@
+import { defineWebSocketHandler } from 'nitro'
+import { authorizeWorkspaceUpdates, connectWorkspaceUpdates } from './service'
+import { nodeBroadcaster } from './node-broadcaster'
+import type { WorkspaceConnection } from './node-broadcaster'
+
+function connection(
+  context: Record<string, unknown>,
+): WorkspaceConnection | null {
+  return typeof context.teamId === 'string' &&
+    typeof context.sessionId === 'string' &&
+    typeof context.expiresAt === 'number'
+    ? {
+        teamId: context.teamId,
+        sessionId: context.sessionId,
+        expiresAt: context.expiresAt,
+      }
+    : null
+}
+
+export default defineWebSocketHandler(
+  {
+    async upgrade(request) {
+      const authorization = await authorizeWorkspaceUpdates(request)
+      if (authorization instanceof Response) return authorization
+      return { context: authorization }
+    },
+    open(peer) {
+      const auth = connection(peer.context)
+      if (!auth) {
+        peer.close(1008, 'Unauthorized')
+        return
+      }
+      nodeBroadcaster.add(peer, auth)
+    },
+    message(peer, message) {
+      const auth = connection(peer.context)
+      if (!auth || auth.expiresAt <= Date.now()) {
+        peer.close(1008, 'Authorization expired')
+        return
+      }
+      if (message.text() === 'ping') peer.send('pong')
+      else peer.close(1008, 'Notifications only')
+    },
+    close(peer) {
+      const auth = connection(peer.context)
+      if (auth) nodeBroadcaster.remove(peer, auth.teamId)
+    },
+    error(peer) {
+      const auth = connection(peer.context)
+      if (auth) nodeBroadcaster.remove(peer, auth.teamId)
+      peer.close(1011, 'Reconnect required')
+    },
+  },
+  (event) => connectWorkspaceUpdates(event.req),
+)

package/src/server/realtime/service.ts

@@ -0,0 +1,125 @@
+import { and, eq, gt } from 'drizzle-orm'
+import { auth } from '#devpush/server/auth/better-auth'
+import { db } from '#devpush/server/db'
+import {
+  session,
+  teamMembers,
+  teams,
+  user,
+  servers,
+  projects,
+} from '#devpush/server/db/schema'
+import { getWorkspaceUpdates } from '#devpush/server/runtime/platform-env'
+import { resolveProxyRequest } from '#devpush/server/http/proxy-request'
+
+export async function authorizeWorkspaceUpdates(request: Request) {
+  request = resolveProxyRequest(request)
+  const origin = request.headers.get('Origin')
+  const upgrade = request.headers.get('Upgrade')?.toLowerCase() === 'websocket'
+  if (
+    (upgrade && !origin) ||
+    (origin && origin !== new URL(request.url).origin)
+  )
+    return new Response('Origin not allowed', { status: 403 })
+  const current = await auth.api.getSession({ headers: request.headers })
+  if (!current) return new Response('Unauthorized', { status: 401 })
+  const slug = new URL(request.url).searchParams.get('team')
+  const [team] = await db
+    .select({ id: teams.id })
+    .from(teams)
+    .innerJoin(teamMembers, eq(teamMembers.teamId, teams.id))
+    .innerJoin(user, eq(user.id, teamMembers.userId))
+    .where(
+      and(
+        eq(teams.slug, slug ?? ''),
+        eq(teamMembers.userId, current.user.id),
+        eq(teams.status, 'active'),
+        eq(user.status, 'active'),
+      ),
+    )
+    .limit(1)
+  if (!team) return new Response('Workspace not found', { status: 404 })
+  return {
+    teamId: team.id,
+    sessionId: current.session.id,
+    expiresAt: new Date(current.session.expiresAt).getTime(),
+  }
+}
+
+export async function connectWorkspaceUpdates(request: Request) {
+  const authorization = await authorizeWorkspaceUpdates(request)
+  if (authorization instanceof Response) return authorization
+  const upgrade = request.headers.get('Upgrade')?.toLowerCase() === 'websocket'
+  const namespace = getWorkspaceUpdates()
+  if (!upgrade) return Response.json({ available: Boolean(namespace) })
+  if (!namespace) return new Response('Use HTTP polling', { status: 501 })
+  const headers = new Headers(request.headers)
+  headers.set('x-devpush-session', authorization.sessionId)
+  headers.set('x-devpush-session-expires', String(authorization.expiresAt))
+  return namespace
+    .getByName(authorization.teamId)
+    .fetch(new Request(request.url, { headers }))
+}
+
+// Notifications are hints after committed writes. Delivery failure must not fail
+// an acknowledged mutation; slow recovery polling repairs missed notifications.
+export async function notifyWorkspace(
+  teamId: string,
+  kind: 'deployments' | 'servers' | 'logs',
+) {
+  const namespace = getWorkspaceUpdates()
+  if (!namespace) return
+  try {
+    const active = await db
+      .select({ id: session.id })
+      .from(session)
+      .innerJoin(teamMembers, eq(teamMembers.userId, session.userId))
+      .innerJoin(user, eq(user.id, session.userId))
+      .innerJoin(teams, eq(teams.id, teamMembers.teamId))
+      .where(
+        and(
+          eq(teamMembers.teamId, teamId),
+          gt(session.expiresAt, new Date()),
+          eq(user.status, 'active'),
+          eq(teams.status, 'active'),
+        ),
+      )
+    await namespace.getByName(teamId).publish(
+      kind,
+      active.map((row) => row.id),
+    )
+  } catch (error) {
+    console.error('Workspace notification failed', error)
+  }
+}
+
+export async function notifyServer(
+  serverId: string,
+  kind: 'deployments' | 'servers' | 'logs',
+) {
+  if (!getWorkspaceUpdates()) return
+  try {
+    const [server] = await db
+      .select({ teamId: servers.teamId })
+      .from(servers)
+      .where(eq(servers.id, serverId))
+      .limit(1)
+    if (server) await notifyWorkspace(server.teamId, kind)
+  } catch (error) {
+    console.error('Server notification failed', error)
+  }
+}
+
+export async function notifyProject(projectId: string) {
+  if (!getWorkspaceUpdates()) return
+  try {
+    const [project] = await db
+      .select({ teamId: projects.teamId })
+      .from(projects)
+      .where(eq(projects.id, projectId))
+      .limit(1)
+    if (project) await notifyWorkspace(project.teamId, 'deployments')
+  } catch (error) {
+    console.error('Project notification failed', error)
+  }
+}

package/src/server/realtime/workspace-object.cloudflare.ts

@@ -0,0 +1,62 @@
+import { DurableObject } from 'cloudflare:workers'
+import type {
+  DurableObjectState,
+  WebSocket as CloudflareSocket,
+} from '@cloudflare/workers-types'
+
+export class WorkspaceUpdates extends DurableObject<Env> {
+  private readonly state: DurableObjectState
+
+  constructor(ctx: DurableObjectState, env: Env) {
+    super(ctx, env)
+    this.state = ctx
+    ctx.setWebSocketAutoResponse(
+      new WebSocketRequestResponsePair('ping', 'pong'),
+    )
+  }
+
+  async fetch(request: Request) {
+    if (request.headers.get('Upgrade')?.toLowerCase() !== 'websocket')
+      return new Response('WebSocket required', { status: 426 })
+    const sessionId = request.headers.get('x-devpush-session')
+    const expiresAt = Number(request.headers.get('x-devpush-session-expires'))
+    if (!sessionId || !Number.isFinite(expiresAt) || expiresAt <= Date.now())
+      return new Response('Unauthorized', { status: 401 })
+    if (this.state.getWebSockets().length >= 2000)
+      return new Response('Workspace connection limit reached', { status: 503 })
+    const pair = new WebSocketPair()
+    this.state.acceptWebSocket(pair[1])
+    pair[1].serializeAttachment({ sessionId, expiresAt })
+    return new Response(null, { status: 101, webSocket: pair[0] })
+  }
+
+  publish(kind: string, activeSessionIds: string[]) {
+    const authorized = new Set(activeSessionIds)
+    for (const socket of this.state.getWebSockets()) {
+      const attachment = socket.deserializeAttachment() as {
+        sessionId: string
+        expiresAt: number
+      } | null
+      if (
+        !attachment ||
+        attachment.expiresAt <= Date.now() ||
+        !authorized.has(attachment.sessionId)
+      ) {
+        socket.close(1008, 'Authorization expired')
+        continue
+      }
+      try {
+        socket.send(JSON.stringify({ type: 'changed', kind }))
+      } catch {
+        socket.close(1011, 'Reconnect required')
+      }
+    }
+  }
+
+  webSocketMessage(socket: CloudflareSocket) {
+    socket.close(1008, 'Notifications only')
+  }
+  webSocketClose(socket: CloudflareSocket, code: number, reason: string) {
+    socket.close([1005, 1006, 1015].includes(code) ? 1000 : code, reason)
+  }
+}

package/src/server/realtime/workspace-object.ts

@@ -0,0 +1,3 @@
+// Cloudflare exports its Durable Object through this runtime alias.
+// Node uses the Nitro upgrade handler and its in-memory broadcaster.
+export class WorkspaceUpdates {}