devpush 0.0.0-stage → 1.0.0-beta.3

package/src/lib/account-settings-schema.ts

@@ -0,0 +1,78 @@
+import { settingsVersionSchema } from '#devpush/lib/settings-version'
+import { z } from 'zod'
+import { avatarDataUrlSchema } from '#devpush/lib/avatar-schema'
+
+export const accountSettingsSchema = z.object({
+  settingsVersion: settingsVersionSchema,
+  name: z
+    .string()
+    .trim()
+    .min(1, 'Enter your name.')
+    .max(256, 'Name must be 256 characters or fewer.'),
+  username: z
+    .string()
+    .trim()
+    .min(1, 'Enter a username.')
+    .max(50, 'Username must be 50 characters or fewer.')
+    .regex(
+      /^[A-Za-z0-9][A-Za-z0-9._-]*[A-Za-z0-9]$/,
+      'Username must start and end with a letter or number and only use letters, numbers, dots, underscores, or hyphens.',
+    ),
+  avatarDataUrl: avatarDataUrlSchema,
+  deleteAvatar: z.boolean().optional(),
+})
+export type AccountSettingsErrors = Partial<
+  Record<'name' | 'username' | 'avatarDataUrl' | 'form', string>
+>
+
+export function accountValidationErrors(
+  issues: Array<{ path: PropertyKey[]; message: string }>,
+): AccountSettingsErrors {
+  const errors: AccountSettingsErrors = {}
+  for (const issue of issues) {
+    const field = issue.path[0]
+    const key =
+      field === 'name' || field === 'username' || field === 'avatarDataUrl'
+        ? field
+        : 'form'
+    errors[key] ??= issue.message
+  }
+  return errors
+}
+
+export function accountServiceErrors(
+  error: unknown,
+): AccountSettingsErrors | null {
+  if (!(error instanceof Error)) return null
+  if (error.message === 'Name is required.') return { name: 'Enter your name.' }
+  if (
+    [
+      'Username is already taken.',
+      'Username is required.',
+      'Username must be 50 characters or fewer.',
+      'Username must start and end with a letter or number and only use letters, numbers, dots, underscores hyphens.',
+    ].includes(error.message)
+  )
+    return { username: error.message }
+  if (
+    [
+      'Upload a PNG, JPEG, or WebP image.',
+      'Avatars must be 2 MB or smaller.',
+      'The uploaded file does not match its image type.',
+    ].includes(error.message)
+  ) {
+    return { avatarDataUrl: error.message }
+  }
+  return null
+}
+
+export const accountEmailSchema = z.object({
+  settingsVersion: settingsVersionSchema,
+  newEmail: z
+    .string()
+    .trim()
+    .min(1, 'Enter an email address.')
+    .email('Enter a valid email address.')
+    .max(320, 'Email addresses must be 320 characters or fewer.')
+    .transform((email) => email.toLowerCase()),
+})

package/src/lib/action-feedback.ts

@@ -0,0 +1,81 @@
+import { getPolicyRecoveryUrl } from './public-error'
+import { toast } from 'sonner'
+
+export async function copyText(text: string, label: string) {
+  try {
+    await navigator.clipboard.writeText(text)
+    toast.success(`${label} copied.`)
+    return true
+  } catch {
+    toast.error(
+      `Unable to copy ${label.toLowerCase()}. Please select and copy it manually.`,
+    )
+    return false
+  }
+}
+
+// A committed mutation must not be reported as failed when its follow-up fails:
+// retrying a create/queue operation could otherwise produce duplicates.
+export async function afterMutation(
+  task: () => Promise<unknown>,
+  message: string,
+) {
+  try {
+    await task()
+    return true
+  } catch {
+    toast.warning(message)
+    return false
+  }
+}
+
+export async function refreshView(task: () => Promise<unknown>, id: string) {
+  try {
+    await task()
+    toast.dismiss(id)
+  } catch {
+    toast.error(
+      'Unable to refresh. Displayed information may be out of date. Please reload.',
+      { id },
+    )
+  }
+}
+
+export async function navigateFilters(task: () => Promise<unknown>) {
+  try {
+    await task()
+    toast.dismiss('filter-navigation')
+  } catch {
+    toast.error('Unable to apply filters. Please try again.', {
+      id: 'filter-navigation',
+    })
+  }
+}
+
+export function mutationErrorOptions(
+  error: unknown,
+):
+  | []
+  | [
+      {
+        duration: number
+        closeButton: boolean
+        action: { label: string; onClick: () => void }
+      },
+    ] {
+  const url = getPolicyRecoveryUrl(error)
+  return url
+    ? [
+        {
+          duration: Infinity,
+          closeButton: true,
+          action: {
+            label: 'Review settings',
+            onClick: () => {
+              window.location.assign(url)
+            },
+          },
+        },
+      ]
+    : []
+}

package/src/lib/admin-search-schema.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod'
+
+export const adminSearchSchema = z.object({
+  userQuery: z.string().trim().max(255).catch(''),
+  userPage: z.coerce.number().int().min(1).max(1_000_000).catch(1),
+  allowlistQuery: z.string().trim().max(255).catch(''),
+  allowlistPage: z.coerce.number().int().min(1).max(1_000_000).catch(1),
+})

package/src/lib/agent-release.d.mts

@@ -0,0 +1,21 @@
+export type AgentReleaseAsset = Readonly<{
+  os: 'linux'
+  arch: 'amd64' | 'arm64'
+  filename: string
+  url: string
+  sha256: string
+  size: number
+}>
+export type AgentRelease = Readonly<{
+  schemaVersion: 1
+  repository: string
+  version: string
+  goVersion: string
+  protocolVersion: number
+  capabilities: readonly string[]
+  assets: readonly AgentReleaseAsset[]
+}>
+export const agentReleasePlatforms: readonly Readonly<
+  Pick<AgentReleaseAsset, 'os' | 'arch' | 'filename'>
+>[]
+export function validateAgentRelease(value: unknown): AgentRelease

package/src/lib/agent-release.mjs

@@ -0,0 +1,90 @@
+export const agentReleasePlatforms = Object.freeze([
+  Object.freeze({
+    os: 'linux',
+    arch: 'amd64',
+    filename: 'devpush-agent-linux-amd64',
+  }),
+  Object.freeze({
+    os: 'linux',
+    arch: 'arm64',
+    filename: 'devpush-agent-linux-arm64',
+  }),
+])
+const maxAgentBinaryBytes = 32 * 1024 * 1024
+
+export function validateAgentRelease(value) {
+  const fail = () => {
+    throw new Error('Invalid agent release manifest.')
+  }
+  if (!value || typeof value !== 'object' || value.schemaVersion !== 1) fail()
+  if (
+    typeof value.version !== 'string' ||
+    !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value.version)
+  )
+    fail()
+  if (
+    typeof value.repository !== 'string' ||
+    !/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(
+      value.repository,
+    )
+  )
+    fail()
+  if (
+    typeof value.goVersion !== 'string' ||
+    !/^go\d+\.\d+\.\d+$/.test(value.goVersion)
+  )
+    fail()
+  if (!Number.isInteger(value.protocolVersion) || value.protocolVersion < 1)
+    fail()
+  if (
+    !Array.isArray(value.capabilities) ||
+    !value.capabilities.length ||
+    value.capabilities.some(
+      (item) => typeof item !== 'string' || !/^[a-z][a-z0-9.-]+$/.test(item),
+    ) ||
+    new Set(value.capabilities).size !== value.capabilities.length
+  )
+    fail()
+  if (
+    !Array.isArray(value.assets) ||
+    value.assets.length !== agentReleasePlatforms.length
+  )
+    fail()
+  const assets = agentReleasePlatforms.map((platform) => {
+    const matches = value.assets.filter(
+      (asset) =>
+        asset && asset.os === platform.os && asset.arch === platform.arch,
+    )
+    if (matches.length !== 1) fail()
+    const asset = matches[0]
+    if (
+      asset.filename !== platform.filename ||
+      typeof asset.sha256 !== 'string' ||
+      !/^[a-f0-9]{64}$/.test(asset.sha256)
+    )
+      fail()
+    if (
+      !Number.isSafeInteger(asset.size) ||
+      asset.size < 1 ||
+      asset.size > maxAgentBinaryBytes
+    )
+      fail()
+    const url = `https://github.com/${value.repository}/releases/download/v${value.version}/${platform.filename}`
+    if (asset.url !== url) fail()
+    return Object.freeze({
+      ...platform,
+      url,
+      sha256: asset.sha256,
+      size: asset.size,
+    })
+  })
+  return Object.freeze({
+    schemaVersion: 1,
+    repository: value.repository,
+    version: value.version,
+    goVersion: value.goVersion,
+    protocolVersion: value.protocolVersion,
+    capabilities: Object.freeze([...value.capabilities]),
+    assets: Object.freeze(assets),
+  })
+}

package/src/lib/allowlist-schema.ts

@@ -0,0 +1,79 @@
+import { z } from 'zod'
+import safeRegex from 'safe-regex2'
+
+const emailSchema = z.string().email().max(320)
+export function isValidAllowlistPattern(value: string) {
+  return value.length <= 255 && safeRegex(value)
+}
+export const allowlistRuleSchema = z
+  .object({
+    type: z.enum(['email', 'domain', 'pattern']),
+    value: z
+      .string()
+      .trim()
+      .min(1, 'Enter an allowlist rule.')
+      .max(255, 'Rules must be 255 characters or fewer.'),
+  })
+  .superRefine(({ type, value }, ctx) => {
+    if (!value) return
+    const valid =
+      type === 'email'
+        ? emailSchema.safeParse(value).success
+        : type === 'domain'
+          ? emailSchema.safeParse(`member@${value.replace(/^@/, '')}`).success
+          : isValidAllowlistPattern(value)
+    if (!valid)
+      ctx.addIssue({
+        code: 'custom',
+        path: ['value'],
+        message:
+          type === 'email'
+            ? 'Enter a valid email address.'
+            : type === 'domain'
+              ? 'Enter a domain such as example.com, without a URL or path.'
+              : 'Enter a valid regular expression without excessive repetition.',
+      })
+  })
+  .transform(({ type, value }) => ({
+    type,
+    value:
+      type === 'pattern'
+        ? value
+        : type === 'domain'
+          ? value.toLowerCase().replace(/^@/, '')
+          : value.toLowerCase(),
+  }))
+
+export function parseAllowlistEmails(value: string) {
+  return [
+    ...new Set(
+      value
+        .split(/[\s,]+/)
+        .map((email) => email.trim().toLowerCase())
+        .filter(Boolean),
+    ),
+  ]
+}
+export const allowlistImportSchema = z.object({
+  emails: z
+    .string()
+    .trim()
+    .min(1, 'Enter at least one email address.')
+    .max(20_000, 'Import at most 20,000 characters at a time.')
+    .superRefine((value, ctx) => {
+      const emails = parseAllowlistEmails(value)
+      if (!emails.length)
+        ctx.addIssue({
+          code: 'custom',
+          message: 'Enter at least one email address.',
+        })
+      const invalid = emails.find(
+        (email) => !emailSchema.safeParse(email).success,
+      )
+      if (invalid)
+        ctx.addIssue({
+          code: 'custom',
+          message: `Invalid email address: ${invalid}.`,
+        })
+    }),
+})

package/src/lib/api-key-schema.ts

@@ -0,0 +1,176 @@
+import { z } from 'zod'
+import type { TeamRole } from '#devpush/lib/team-role'
+import type { ResourceColor } from '#devpush/server/resources/color'
+
+export const apiScopeDefinitions = {
+  'projects:read': { minimumRole: 'member', label: 'Read projects' },
+  'servers:read': { minimumRole: 'member', label: 'Read servers' },
+  'deployments:read': { minimumRole: 'member', label: 'Read deployments' },
+  'logs:read': {
+    minimumRole: 'member',
+    label: 'Read deployment and operation logs',
+  },
+  'backups:read': { minimumRole: 'member', label: 'Read backups' },
+  'deployments:write': {
+    minimumRole: 'member',
+    label: 'Deploy, redeploy and roll back',
+  },
+  'projects:write': {
+    minimumRole: 'member',
+    label: 'Manage project configuration',
+  },
+  'secrets:write': {
+    minimumRole: 'member',
+    label: 'Write environment variables',
+  },
+  'backups:write': {
+    minimumRole: 'admin',
+    label: 'Run and configure backups',
+  },
+  'servers:write': { minimumRole: 'admin', label: 'Manage servers' },
+  'backups:restore': { minimumRole: 'admin', label: 'Restore backups' },
+  'projects:host-commands': {
+    minimumRole: 'admin',
+    label: 'Manage host lifecycle commands',
+  },
+} as const satisfies Record<string, { minimumRole: TeamRole; label: string }>
+
+export type ApiScope = keyof typeof apiScopeDefinitions
+export const apiKeyPresetSchema = z.enum(['read', 'deploy', 'manage'])
+export type ApiKeyPreset = z.infer<typeof apiKeyPresetSchema>
+
+export const apiKeyExpirationOptions = [
+  { value: '1', label: '1 day', days: 1 },
+  { value: '7', label: '7 days', days: 7 },
+  { value: '30', label: '30 days', days: 30 },
+  { value: '90', label: '90 days', days: 90 },
+  { value: '180', label: '180 days', days: 180 },
+  { value: '365', label: '1 year', days: 365 },
+  { value: 'never', label: 'Never expires', days: null },
+] as const
+export const apiKeyMaxExpirationDays = Math.max(
+  ...apiKeyExpirationOptions.map(({ days }) => days ?? 0),
+)
+
+const readScopes = Object.keys(apiScopeDefinitions).filter(
+  (scope) => scope.endsWith(':read') && scope !== 'logs:read',
+) as ApiScope[]
+export const apiKeyPresets: Record<
+  ApiKeyPreset,
+  { label: string; description: string; scopes: ApiScope[] }
+> = {
+  read: {
+    label: 'Read only',
+    description: 'Read projects, servers, deployments and backups.',
+    scopes: readScopes,
+  },
+  deploy: {
+    label: 'Deploy',
+    description: 'Read resources and deploy, redeploy or roll back projects.',
+    scopes: [...readScopes, 'deployments:write'],
+  },
+  manage: {
+    label: 'Manage',
+    description: 'Manage resources within your current team permissions.',
+    scopes: Object.keys(apiScopeDefinitions).filter(
+      (scope) => scope !== 'logs:read',
+    ) as ApiScope[],
+  },
+}
+
+export const apiRoleRank: Record<TeamRole, number> = {
+  member: 0,
+  admin: 1,
+  owner: 2,
+}
+
+export function scopesForApiPreset(
+  preset: ApiKeyPreset,
+  role: TeamRole,
+  includeLogs = false,
+): ApiScope[] {
+  return [
+    ...apiKeyPresets[preset].scopes,
+    ...(includeLogs ? ['logs:read' as const] : []),
+  ].filter(
+    (scope) =>
+      apiRoleRank[role] >= apiRoleRank[apiScopeDefinitions[scope].minimumRole],
+  )
+}
+
+export const createApiKeySchema = z
+  .object({
+    name: z.string().trim().min(1).max(80),
+    teamId: z.string().min(1).max(128),
+    projectIds: z
+      .array(z.string().min(1).max(128))
+      .min(1)
+      .max(100)
+      .nullable()
+      .default(null),
+    preset: apiKeyPresetSchema.default('read'),
+    includeLogs: z.boolean().default(false),
+    expiresInDays: z
+      .number()
+      .int()
+      .min(1)
+      .max(apiKeyMaxExpirationDays)
+      .nullable()
+      .default(30),
+  })
+  .strict()
+  .refine(
+    (input) =>
+      input.projectIds === null ||
+      new Set(input.projectIds).size === input.projectIds.length,
+    { path: ['projectIds'], message: 'Select each project only once.' },
+  )
+
+export const apiKeyIdSchema = z
+  .object({ id: z.string().min(1).max(128) })
+  .strict()
+
+export const apiKeySettingsSchema = z
+  .object({ page: z.number().int().min(1).max(1_000_000).default(1) })
+  .strict()
+
+export const apiKeyTeamsSchema = apiKeySettingsSchema.extend({
+  query: z.string().trim().max(100).default(''),
+})
+export const apiKeyProjectsSchema = apiKeyTeamsSchema.extend({
+  teamId: z.string().min(1).max(128),
+})
+
+export type ApiKeySummary = {
+  id: string
+  name: string
+  prefix: string
+  teamId: string
+  teamName: string
+  projectIds: string[] | null
+  preset: ApiKeyPreset
+  scopes: ApiScope[]
+  status: 'active' | 'expired' | 'revoked' | 'unavailable'
+  createdAt: string
+  expiresAt: string | null
+  lastUsedAt: string | null
+  revokedAt: string | null
+}
+
+export type ApiKeyTeamOption = {
+  id: string
+  name: string
+  slug: string
+  role: TeamRole
+  image: string | null
+  color: ResourceColor
+  projects: ApiKeyProjectOption[]
+}
+
+export type ApiKeyProjectOption = {
+  id: string
+  name: string
+  slug: string
+  avatarUrl: string | null
+  color: ResourceColor
+}

package/src/lib/auth/client.ts

@@ -0,0 +1,20 @@
+import { createAuthClient } from 'better-auth/react'
+import { emailOTPClient } from 'better-auth/client/plugins'
+
+function getAuthBaseURL() {
+  if (typeof window !== 'undefined') {
+    return new URL('/api/auth', window.location.origin).toString()
+  }
+
+  return new URL(
+    '/api/auth',
+    process.env.BETTER_AUTH_URL?.trim() ||
+      process.env.DEVPUSH_BASE_URL?.trim() ||
+      'http://localhost:7429',
+  ).toString()
+}
+
+export const authClient = createAuthClient({
+  baseURL: getAuthBaseURL(),
+  plugins: [emailOTPClient()],
+})

package/src/lib/avatar-schema.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod'
+
+export const avatarDataUrlSchema = z
+  .string()
+  .max(3_000_000)
+  .regex(
+    /^data:image\/(?:png|jpeg|webp);base64,/,
+    'Upload a PNG, JPEG, or WebP image.',
+  )
+  .nullable()
+  .optional()

package/src/lib/backup-cron.ts

@@ -0,0 +1,118 @@
+export function isCronDue(cron: string, now: Date) {
+  const [minute, hour, dayOfMonth, month, dayOfWeek] = cron.trim().split(/\s+/)
+
+  if (
+    minute === undefined ||
+    hour === undefined ||
+    dayOfMonth === undefined ||
+    month === undefined ||
+    dayOfWeek === undefined
+  )
+    return false
+
+  const minuteMatches = matchesCronPart(minute, now.getUTCMinutes(), 0, 59)
+  const hourMatches = matchesCronPart(hour, now.getUTCHours(), 0, 23)
+  const monthMatches = matchesCronPart(month, now.getUTCMonth() + 1, 1, 12)
+  const dayOfMonthMatches = matchesCronPart(dayOfMonth, now.getUTCDate(), 1, 31)
+  const dayOfWeekMatches = matchesCronPart(dayOfWeek, now.getUTCDay(), 0, 7)
+  const dayMatches =
+    dayOfMonth === '*'
+      ? dayOfWeekMatches
+      : dayOfWeek === '*'
+        ? dayOfMonthMatches
+        : dayOfMonthMatches || dayOfWeekMatches
+
+  return minuteMatches && hourMatches && monthMatches && dayMatches
+}
+
+export function isValidCron(cron: string) {
+  const parts = cron.trim().split(/\s+/)
+  const ranges = [
+    [0, 59],
+    [0, 23],
+    [1, 31],
+    [1, 12],
+    [0, 7],
+  ] as const
+
+  return (
+    parts.length === 5 &&
+    ranges.every(([min, max], index) => {
+      const part = parts[index]
+      return part !== undefined && isValidCronPart(part, min, max)
+    })
+  )
+}
+
+function isValidCronPart(part: string, min: number, max: number) {
+  return part.split(',').every((token) => {
+    const segments = token.split('/')
+    const base = segments[0]
+    const hasStep = segments.length === 2
+    if (segments.length > 2 || !base) return false
+
+    if (hasStep) {
+      const step = Number(segments[1])
+      if (!Number.isInteger(step) || step < 1 || step > max - min + 1) {
+        return false
+      }
+    }
+
+    if (base === '*') return true
+
+    if (base.includes('-')) {
+      const range = base.split('-')
+      if (range.length !== 2) return false
+      const start = Number(range[0])
+      const end = Number(range[1])
+      return (
+        Number.isInteger(start) &&
+        Number.isInteger(end) &&
+        start >= min &&
+        end <= max &&
+        start <= end
+      )
+    }
+
+    const numeric = Number(base)
+    return (
+      !hasStep && Number.isInteger(numeric) && numeric >= min && numeric <= max
+    )
+  })
+}
+
+function matchesCronPart(
+  part: string,
+  value: number,
+  min: number,
+  max: number,
+) {
+  for (const token of part.split(',')) {
+    const [base = '', rawStep] = token.split('/')
+    const step = rawStep ? Number(rawStep) : 1
+    let start = min
+    let end = max
+
+    if (base !== '*') {
+      if (base.includes('-')) {
+        const [rawStart, rawEnd] = base.split('-', 2)
+        start = Number(rawStart)
+        end = Number(rawEnd)
+      } else {
+        start = Number(base)
+        end = start
+      }
+    }
+
+    const normalizedValue = max === 7 && value === 0 && end === 7 ? 7 : value
+    if (
+      normalizedValue >= start &&
+      normalizedValue <= end &&
+      (normalizedValue - start) % step === 0
+    ) {
+      return true
+    }
+  }
+
+  return false
+}