devpush 0.0.0-stage → 1.0.0-beta.3

package/src/server/auth/email-change.ts

@@ -0,0 +1,47 @@
+import type { BetterAuthPlugin } from 'better-auth'
+import {
+  APIError,
+  createAuthMiddleware,
+  getSessionFromCtx,
+} from 'better-auth/api'
+import { PublicError } from '#devpush/lib/public-error'
+import { isEmailAllowlisted } from './access'
+
+export async function assertAllowedEmailChange(email: string) {
+  if (!(await isEmailAllowlisted(email)))
+    throw new PublicError('ACCOUNT_EMAIL_NOT_ALLOWED')
+}
+
+export async function assertAllowedAuthEmailChange(email: string) {
+  try {
+    await assertAllowedEmailChange(email)
+  } catch (error) {
+    if (error instanceof PublicError)
+      throw new APIError('FORBIDDEN', {
+        code: error.code,
+        message: error.message,
+      })
+    throw error
+  }
+}
+
+export function requireAllowedEmailChanges(): BetterAuthPlugin {
+  return {
+    id: 'devpush-allowed-email-changes',
+    hooks: {
+      before: [
+        {
+          matcher: (ctx) => ctx.path === '/change-email',
+          handler: createAuthMiddleware(async (ctx) => {
+            // Avoid exposing policy to anonymous callers and honor live revocation.
+            if (!(await getSessionFromCtx(ctx, { disableCookieCache: true })))
+              throw new APIError('UNAUTHORIZED')
+            const email: unknown = ctx.body?.newEmail
+            if (typeof email === 'string')
+              await assertAllowedAuthEmailChange(email)
+          }),
+        },
+      ],
+    },
+  }
+}

package/src/server/auth/email-delivery.ts

@@ -0,0 +1,51 @@
+import type { BetterAuthPlugin } from 'better-auth'
+import { APIError, createAuthMiddleware } from 'better-auth/api'
+
+export function requireAuthEmailDelivery(): BetterAuthPlugin {
+  return {
+    id: 'require-auth-email-delivery',
+    hooks: {
+      before: [
+        {
+          matcher: (ctx) =>
+            [
+              '/email-otp/send-verification-otp',
+              '/change-email',
+              '/send-verification-email',
+              '/verify-email',
+            ].includes(ctx.path ?? ''),
+          handler: createAuthMiddleware(async (ctx) => ({
+            context: {
+              context: {
+                // Better Auth's default helper logs and swallows send failures.
+                // Override only this request: success must mean sending succeeded.
+                runInBackgroundOrAwait: async (
+                  task: Promise<unknown> | void,
+                ) => {
+                  try {
+                    await task
+                  } catch (error) {
+                    ctx.context.logger.error(
+                      'Failed to send authentication email',
+                      error,
+                    )
+                    throw new APIError('SERVICE_UNAVAILABLE', {
+                      code:
+                        ctx.path === '/email-otp/send-verification-otp'
+                          ? 'OTP_SEND_FAILED'
+                          : 'EMAIL_SEND_FAILED',
+                      message:
+                        ctx.path === '/email-otp/send-verification-otp'
+                          ? 'Unable to send your sign-in code. Please try again in a moment.'
+                          : 'Unable to send the verification email. Please try again in a moment.',
+                    })
+                  }
+                },
+              },
+            },
+          })),
+        },
+      ],
+    },
+  }
+}

package/src/server/auth/provider-identity.ts

@@ -0,0 +1,19 @@
+import { sql } from 'drizzle-orm'
+import type { AtomicStore } from '#devpush/server/db/atomic'
+
+export async function replacePendingIdentity(
+  store: AtomicStore,
+  input: {
+    identifier: string
+    value: string
+    expiresAt: Date
+  },
+) {
+  await store.batch([
+    store.run(
+      sql`delete from verification where identifier = ${input.identifier}`,
+    ),
+    store.run(sql`insert into verification (id, identifier, value, expires_at)
+      values (${crypto.randomUUID()}, ${input.identifier}, ${input.value}, ${input.expiresAt.getTime()})`),
+  ])
+}

package/src/server/auth/provider-tokens.ts

@@ -0,0 +1,27 @@
+import { symmetricDecrypt, symmetricEncrypt } from 'better-auth/crypto'
+import { config } from '#devpush/server/config'
+
+// Better Auth's single-secret encryption format. Use the same key/codec as
+// encryptOAuthTokens so refresh and reconnect never switch storage formats.
+// Bare hex includes a 24-byte nonce and 16-byte authentication tag. Shorter
+// hex strings cannot be encrypted envelopes.
+function isEncrypted(value: string) {
+  return (
+    value.startsWith('$ba$') ||
+    (value.length >= 80 && value.length % 2 === 0 && /^[0-9a-f]+$/i.test(value))
+  )
+}
+
+export async function readProviderToken(value: string) {
+  return isEncrypted(value)
+    ? symmetricDecrypt({ key: config.BETTER_AUTH_SECRET, data: value })
+    : value
+}
+
+export async function storeProviderToken(value: string) {
+  if (isEncrypted(value)) {
+    await readProviderToken(value)
+    return value
+  }
+  return symmetricEncrypt({ key: config.BETTER_AUTH_SECRET, data: value })
+}

package/src/server/auth/session.server.ts

@@ -0,0 +1,19 @@
+import { getRequest } from '@tanstack/react-start/server'
+
+import { auth } from '#devpush/server/auth/better-auth'
+
+export async function getAuthSession() {
+  const request = getRequest()
+
+  return auth.api.getSession({
+    headers: request.headers,
+  })
+}
+
+export async function requireAuthSession(message = 'Unauthorized') {
+  const session = await getAuthSession()
+
+  if (!session) throw new Error(message)
+
+  return session
+}

package/src/server/backups/database-commands.ts

@@ -0,0 +1,40 @@
+import { backupDatabaseSchema } from '#devpush/lib/backup-database'
+import type { BackupDatabase } from '#devpush/lib/backup-database'
+
+function quote(value: string) {
+  return "'" + value.replaceAll("'", "'\\''") + "'"
+}
+export function buildDatabaseBackupCommand(value: BackupDatabase) {
+  const target = backupDatabaseSchema.parse(value)
+  const name = quote(target.database)
+  switch (target.engine) {
+    case 'postgres': {
+      const flags =
+        'pg_dump --clean --if-exists --no-owner --no-acl -U "${POSTGRES_USER:-postgres}"'
+      const dump = target.database
+        ? `${flags} --dbname=${name}`
+        : `databases="$(psql -v ON_ERROR_STOP=1 -U "\${POSTGRES_USER:-postgres}" --dbname=postgres -Atc "SELECT datname FROM pg_database WHERE NOT datistemplate ORDER BY datname")" || exit $?; printf '%s\\n' "$databases" | while IFS= read -r database; do ${flags} --create --dbname="$database" || exit $?; done`
+      return `export PGPASSWORD="\${POSTGRES_PASSWORD:-}"; ${dump}`
+    }
+    case 'mysql':
+      return `export MYSQL_PWD="\${MYSQL_ROOT_PASSWORD:?MYSQL_ROOT_PASSWORD is required}"; mysqldump -u root --single-transaction --quick --no-tablespaces ${target.database ? `--databases -- ${name}` : '--all-databases'}`
+    case 'mariadb':
+      return `export MYSQL_PWD="\${MARIADB_ROOT_PASSWORD:-\${MYSQL_ROOT_PASSWORD:?A root password is required}}"; mariadb-dump -u root --single-transaction --quick ${target.database ? `--databases -- ${name}` : '--all-databases'}`
+    case 'mongo':
+      return `mongodump --username="\${MONGO_INITDB_ROOT_USERNAME:?MongoDB username is required}" --password="\${MONGO_INITDB_ROOT_PASSWORD:?MongoDB password is required}" --authenticationDatabase=admin --archive${target.database ? ` --db=${name}` : ''}`
+  }
+}
+export function buildDatabaseRestoreCommand(value: BackupDatabase) {
+  const target = backupDatabaseSchema.parse(value)
+  const name = quote(target.database)
+  switch (target.engine) {
+    case 'postgres':
+      return `export PGPASSWORD="\${POSTGRES_PASSWORD:-}"; psql -v ON_ERROR_STOP=1 -U "\${POSTGRES_USER:-postgres}" --dbname=${target.database ? name : 'template1'}`
+    case 'mysql':
+      return 'export MYSQL_PWD="${MYSQL_ROOT_PASSWORD:?MYSQL_ROOT_PASSWORD is required}"; mysql -u root'
+    case 'mariadb':
+      return 'export MYSQL_PWD="${MARIADB_ROOT_PASSWORD:-${MYSQL_ROOT_PASSWORD:?A root password is required}}"; mariadb -u root'
+    case 'mongo':
+      return 'mongorestore --username="${MONGO_INITDB_ROOT_USERNAME:?MongoDB username is required}" --password="${MONGO_INITDB_ROOT_PASSWORD:?MongoDB password is required}" --authenticationDatabase=admin --archive --drop'
+  }
+}

package/src/server/backups/destination.ts

@@ -0,0 +1,12 @@
+import type { BackupDestination } from './service'
+
+// Runs and queued jobs keep location/ownership, never credential copies.
+export function backupDestinationSnapshot(destination: BackupDestination) {
+  return {
+    storageId: destination.storageId,
+    bucket: destination.bucket,
+    region: destination.region,
+    endpoint: destination.endpoint,
+    prefix: destination.prefix,
+  }
+}

package/src/server/backups/feature.ts

@@ -0,0 +1,6 @@
+import { config } from '#devpush/server/config'
+import { PublicError } from '#devpush/lib/public-error'
+
+export function requireBackupsEnabled() {
+  if (!config.DEVPUSH_BACKUPS_ENABLED) throw new PublicError('BACKUPS_DISABLED')
+}

package/src/server/backups/policy-validation.ts

@@ -0,0 +1,51 @@
+import { and, eq } from 'drizzle-orm'
+import { z } from 'zod'
+import {
+  backupConfigSchema,
+  normalizeBackupVolumes,
+} from '#devpush/lib/backup-policy-schema'
+import { getDefaultBackupPrefix } from '#devpush/lib/backup-paths'
+import { PublicError } from '#devpush/lib/public-error'
+import { db } from '#devpush/server/db'
+import { environments } from '#devpush/server/db/schema'
+import { resolveBackupDestination } from './storage'
+
+const policySchema = backupConfigSchema.extend({ id: z.string().trim().min(1) })
+
+export async function prepareBackupPolicy({
+  teamId,
+  projectId,
+  policy,
+}: {
+  teamId: string
+  projectId: string
+  policy: unknown
+}) {
+  const parsed = policySchema.parse(policy)
+  const [environment] = await db
+    .select({ id: environments.id })
+    .from(environments)
+    .where(
+      and(
+        eq(environments.id, parsed.environmentId),
+        eq(environments.projectId, projectId),
+        eq(environments.status, 'active'),
+      ),
+    )
+    .limit(1)
+  if (!environment) throw new PublicError('BACKUP_ENVIRONMENT_INVALID')
+  const normalized = {
+    ...parsed,
+    volumes: normalizeBackupVolumes(parsed.volumes),
+    destination: {
+      ...parsed.destination,
+      prefix:
+        parsed.destination.prefix ??
+        getDefaultBackupPrefix(projectId, parsed.environmentId, parsed.id),
+    },
+  }
+  if (normalized.destination.storageId || normalized.retention.remote.enabled) {
+    await resolveBackupDestination(teamId, normalized.destination)
+  }
+  return normalized
+}

package/src/server/backups/queue-state.ts

@@ -0,0 +1,137 @@
+import { backupDestinationSnapshot } from './destination'
+import { sql } from 'drizzle-orm'
+import type { SQL } from 'drizzle-orm'
+import type { AtomicStore } from '#devpush/server/db/atomic'
+import {
+  agentJobs,
+  backupConfigs,
+  backupRuns,
+  environments,
+  projects,
+  servers,
+} from '#devpush/server/db/schema'
+import type { BackupDestination, BackupJobPayload } from './service'
+import type { ApiMutationAdmission } from '#devpush/server/api/admission'
+
+export const backupCleanupRetryDelayMs = 60 * 60 * 1000
+
+// Release reservations before the associated jobs are canceled, in the same
+// deletion batch. Match project/server ownership as well as payload run IDs.
+export function releaseBackupCleanupRuns(input: {
+  jobIds: SQL
+  guard: SQL
+  message: string
+  now: Date
+}) {
+  return sql`update backup_runs set cleanup_queued_at = null, cleanup_error_message = ${input.message}, updated_at = ${input.now.getTime()}
+    where ${input.guard} and exists(select 1 from agent_jobs as cleanup,
+      json_each(case when json_valid(cleanup.payload) then cleanup.payload else '{}' end, '$.backupRunIds') as target
+      where cleanup.id in (${input.jobIds}) and cleanup.type = 'backup_cleanup' and cleanup.status in ('queued','running')
+      and cleanup.server_id = backup_runs.server_id and cleanup.project_id = backup_runs.project_id and target.value = backup_runs.id)`
+}
+
+export async function enqueueBackupCleanup(
+  store: AtomicStore,
+  input: {
+    jobId: string
+    projectId: string
+    serverId: string
+    backupRunIds: string[]
+    now: Date
+    destination: BackupDestination
+    artifacts: Array<{
+      backupRunId: string
+      storage: 'local' | 'remote'
+      objectKey: string
+    }>
+  },
+) {
+  const now = input.now.getTime()
+  // An ID collision must fail even when eligibility would otherwise skip the
+  // insert; the following statement must never find an older job with this ID.
+  const eligible = sql`select id from ${backupRuns}
+    where id in (select value from json_each(${JSON.stringify(input.backupRunIds)}))
+      and server_id = ${input.serverId} and project_id = ${input.projectId}
+      and exists(select 1 from servers where id = ${input.serverId} and status <> 'deleted')
+      and exists(select 1 from projects where id = ${input.projectId} and status = 'active')
+      and (cleanup_error_message is null or updated_at <= ${now - backupCleanupRetryDelayMs})
+      and (status = 'succeeded' or (status = 'failed' and json_extract(manifest, '$.localRecoveryAvailable') = 1)) and cleanup_queued_at is null`
+  const keys = (
+    storage: 'local' | 'remote',
+  ) => sql`select distinct json_extract(artifact.value, '$.objectKey') as object_key
+    from json_each(${JSON.stringify(input.artifacts)}) as artifact
+    where json_extract(artifact.value, '$.backupRunId') in (select id from eligible)
+      and json_extract(artifact.value, '$.storage') = ${storage} order by object_key`
+  const [, marked] = await store.batch([
+    store.run(sql`with eligible as materialized (${eligible}), local_keys as (${keys('local')}), remote_keys as (${keys('remote')})
+      insert into ${agentJobs} (id, type, status, server_id, project_id, payload, max_attempts, available_at, created_at, updated_at)
+      select ${input.jobId}, 'backup_cleanup', 'queued', ${input.serverId}, ${input.projectId},
+        json_patch(json_object('schemaVersion', 1, 'backupRunIds', json((select json_group_array(id) from eligible)),
+          'localObjectKeys', json((select json_group_array(object_key) from local_keys)),
+          'remoteObjectKeys', json((select json_group_array(object_key) from remote_keys)), 'reason', 'Backup retention expired.'),
+          case when exists(select 1 from remote_keys) then json_object('destination', json(${JSON.stringify(backupDestinationSnapshot(input.destination))})) else '{}' end),
+        5, ${now}, ${now}, ${now} where exists(select 1 from eligible)
+          or exists(select 1 from ${agentJobs} where id = ${input.jobId})`),
+    store.all(sql`update ${backupRuns} set cleanup_queued_at = ${now}, cleanup_error_message = null, updated_at = ${now}
+      where id in (select runtime.value from ${agentJobs} as job, json_each(job.payload, '$.backupRunIds') as runtime where job.id = ${input.jobId})
+      returning id`),
+  ])
+  return marked.map((row) => {
+    const id = Array.isArray(row)
+      ? row[0]
+      : typeof row === 'object' && row !== null && 'id' in row
+        ? row.id
+        : undefined
+    if (typeof id !== 'string')
+      throw new Error('Invalid backup cleanup queue result.')
+    return id
+  })
+}
+
+export async function enqueueBackup(
+  store: AtomicStore,
+  input: {
+    backupRunId: string
+    agentJobId: string
+    configId: string
+    projectId: string
+    environmentId: string
+    deploymentId: string | null
+    serverId: string
+    runtimeId: string
+    scheduleKey: string | null
+    manifest: unknown
+    payload: BackupJobPayload
+    now: Date
+    admission?: ApiMutationAdmission
+  },
+) {
+  const now = input.now.getTime()
+  // Force a primary-key error for a reused ID instead of letting a skipped
+  // insert attach the new job to an older backup run.
+  const [created] = await store.batch([
+    store.all(sql`insert into ${backupRuns}
+      (id, project_id, environment_id, deployment_id, server_id, runtime_id, config_id, schedule_key, status, manifest, destination, created_at, updated_at)
+      select ${input.backupRunId}, ${input.projectId}, ${input.environmentId}, ${input.deploymentId},
+        ${input.serverId}, ${input.runtimeId}, ${input.configId}, ${input.scheduleKey}, 'queued',
+        ${input.manifest == null ? null : JSON.stringify(input.manifest)}, ${input.payload.retention.remote.enabled ? JSON.stringify(backupDestinationSnapshot(input.payload.destination)) : null}, ${now}, ${now}
+      where exists(select 1 from ${backupRuns} where id = ${input.backupRunId}) or (
+        not exists(select 1 from ${backupRuns} where environment_id = ${input.environmentId} and status in ('queued', 'running'))
+        ${input.scheduleKey === null ? sql`` : sql`and not exists(select 1 from ${backupRuns} where environment_id = ${input.environmentId} and schedule_key = ${input.scheduleKey})`}
+        and exists(select 1 from ${backupConfigs} as config
+          join ${environments} as env on env.id = config.environment_id
+          join ${projects} as project on project.id = env.project_id
+          join ${servers} as server on server.id = coalesce(env.server_id, project.default_server_id)
+          where config.id = ${input.configId} and config.enabled = 1 and env.id = ${input.environmentId}
+            and project.id = ${input.projectId} and env.status = 'active' and project.status = 'active'
+            and server.id = ${input.serverId} and server.status in ('connected', 'disconnected'))
+        and ${input.admission?.guard ?? sql`1`}) returning id`),
+    store.run(sql`insert into ${agentJobs}
+      (id, type, status, server_id, project_id, payload, max_attempts, available_at, created_at, updated_at)
+      select ${input.agentJobId}, 'backup', 'queued', server_id, project_id,
+        ${JSON.stringify({ ...input.payload, destination: backupDestinationSnapshot(input.payload.destination) })}, 5, ${now}, ${now}, ${now}
+      from ${backupRuns} where id = ${input.backupRunId}`),
+    ...(input.admission?.statements ?? []),
+  ])
+  return created.length === 1
+}