devpush 0.0.0-stage → 1.0.0-beta.3

package/src/server/github/webhook-handler.ts

@@ -0,0 +1,198 @@
+import { notifyProject } from '#devpush/server/realtime/service'
+import { notifyAfterProjectUpdate } from '#devpush/server/notifications/observe'
+import { handleGitHubInstallationWebhook } from '#devpush/server/github/service'
+import {
+  getBranchFromGitHubRef,
+  InvalidGitHubInstallationPayloadError,
+  parseGitHubInstallationWebhookPayload,
+  parseGitHubPushPayload,
+  requireGitHubWebhookConfiguration,
+  validateGitHubWebhookHeaders,
+  verifyGitHubWebhookSignature,
+} from '#devpush/server/github/webhooks'
+import { createDeploymentsForGitHubPush } from '#devpush/server/projects/deployments'
+import {
+  RequestBodyTooLargeError,
+  readRequestText,
+} from '#devpush/server/http/request-body'
+import { enforceRateLimit } from '#devpush/server/http/rate-limit'
+
+// GitHub permits larger payloads, but this endpoint buffers the body before
+// signature verification and only consumes compact push/installation fields.
+const maxGitHubWebhookBytes = 5 * 1024 * 1024
+
+export async function handleGitHubWebhook(request: Request) {
+  const webhookHeaders = validateGitHubWebhookHeaders(request.headers)
+
+  if (!webhookHeaders.ok) {
+    if (webhookHeaders.status === 401) {
+      const limited = await enforceRateLimit({
+        limit: 120,
+        request,
+        scope: 'github-webhook',
+        windowMs: 60_000,
+      })
+      if (limited) return limited
+    }
+    return Response.json(
+      { error: webhookHeaders.error },
+      { status: webhookHeaders.status },
+    )
+  }
+
+  try {
+    requireGitHubWebhookConfiguration()
+  } catch (error) {
+    return Response.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : 'GitHub webhook verification failed.',
+      },
+      { status: 503 },
+    )
+  }
+
+  let body: string
+
+  try {
+    body = await readRequestText(request, maxGitHubWebhookBytes)
+  } catch (error) {
+    if (error instanceof RequestBodyTooLargeError) {
+      return Response.json(
+        { error: 'Webhook payload is too large.' },
+        { status: 413 },
+      )
+    }
+
+    throw error
+  }
+
+  try {
+    const isValidSignature = verifyGitHubWebhookSignature({
+      body,
+      signature: webhookHeaders.signature,
+    })
+
+    if (!isValidSignature) {
+      const rateLimitResponse = await enforceRateLimit({
+        limit: 120,
+        request,
+        scope: 'github-webhook',
+        windowMs: 60_000,
+      })
+      if (rateLimitResponse) {
+        return rateLimitResponse
+      }
+
+      return Response.json({ error: 'Invalid signature.' }, { status: 401 })
+    }
+  } catch (error) {
+    return Response.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : 'GitHub webhook verification failed.',
+      },
+      { status: 503 },
+    )
+  }
+
+  let payload: ReturnType<typeof parseGitHubPushPayload> | null = null
+  const { deliveryId, event } = webhookHeaders
+
+  if (
+    event === 'installation' ||
+    event === 'installation_repositories' ||
+    event === 'installation_target'
+  ) {
+    try {
+      const installationPayload = parseGitHubInstallationWebhookPayload(body)
+      await handleGitHubInstallationWebhook({
+        action: installationPayload.action,
+        event,
+        installationId: installationPayload.installationId,
+      })
+    } catch (error) {
+      if (error instanceof InvalidGitHubInstallationPayloadError) {
+        return Response.json({ error: error.message }, { status: 400 })
+      }
+
+      throw error
+    }
+
+    return Response.json({ ok: true })
+  }
+
+  if (event === 'push') {
+    try {
+      payload = parseGitHubPushPayload(body)
+    } catch (error) {
+      return Response.json(
+        {
+          error:
+            error instanceof Error
+              ? error.message
+              : 'Invalid GitHub webhook payload.',
+        },
+        { status: 400 },
+      )
+    }
+  }
+
+  if (event !== 'push') {
+    return Response.json({ ok: true, ignored: event })
+  }
+
+  if (!payload) {
+    return Response.json(
+      { error: 'Invalid GitHub webhook payload.' },
+      { status: 400 },
+    )
+  }
+
+  const branch = getBranchFromGitHubRef(payload.ref)
+  const installationId = payload.installation?.id
+  const repositoryId = payload.repository?.id
+  const repositoryFullName = payload.repository?.full_name
+  const gitSha = payload.head_commit?.id
+
+  if (
+    !branch ||
+    typeof installationId !== 'number' ||
+    !Number.isSafeInteger(installationId) ||
+    typeof repositoryId !== 'number' ||
+    !Number.isSafeInteger(repositoryId) ||
+    !repositoryFullName ||
+    !gitSha
+  ) {
+    return Response.json({ ok: true, ignored: 'unsupported_push' })
+  }
+
+  const result = await createDeploymentsForGitHubPush({
+    deliveryId,
+    installationId,
+    repositoryId,
+    repositoryFullName,
+    branch,
+    gitSha,
+    message: payload.head_commit?.message ?? null,
+    authorName: payload.head_commit?.author?.name ?? null,
+    authoredAt: payload.head_commit?.timestamp ?? null,
+    commitUrl: payload.head_commit?.url ?? null,
+    githubSenderId:
+      Number.isSafeInteger(payload.sender?.id) && (payload.sender?.id ?? 0) > 0
+        ? String(payload.sender!.id)
+        : undefined,
+  })
+
+  for (const projectId of new Set(
+    [...result.created, ...result.skipped].map((item) => item.projectId),
+  )) {
+    await notifyProject(projectId)
+    notifyAfterProjectUpdate(projectId)
+  }
+  return Response.json({ ok: true, ...result })
+}

package/src/server/github/webhooks.ts

@@ -0,0 +1,205 @@
+import { createHmac, timingSafeEqual } from 'node:crypto'
+
+import { config } from '#devpush/server/config'
+
+export type GitHubPushWebhookPayload = {
+  sender?: { id?: number } | null
+  ref?: string
+  head_commit?: {
+    id?: string
+    message?: string
+    author?: { name?: string }
+    timestamp?: string
+    url?: string
+  } | null
+  installation?: {
+    id?: number
+  } | null
+  repository?: {
+    id?: number
+    full_name?: string
+  } | null
+}
+
+export type GitHubInstallationWebhookPayload = {
+  action: string
+  installationId: number
+}
+
+export type GitHubInstallationWebhookEvent =
+  | 'installation'
+  | 'installation_repositories'
+  | 'installation_target'
+
+export type GitHubInstallationChange =
+  | { type: 'refresh' }
+  | { type: 'status'; status: 'deleted' | 'suspended' }
+  | { type: 'ignore' }
+
+type GitHubWebhookHeadersResult =
+  | {
+      ok: true
+      deliveryId: string
+      event: string
+      signature: string
+    }
+  | { ok: false; error: string; status: 400 | 401 }
+
+export function validateGitHubWebhookHeaders(
+  headers: Headers,
+): GitHubWebhookHeadersResult {
+  const signature = headers.get('x-hub-signature-256')?.trim() ?? ''
+  if (!/^sha256=[a-f0-9]{64}$/i.test(signature)) {
+    return { ok: false, error: 'Invalid signature.', status: 401 }
+  }
+
+  const deliveryId = headers.get('x-github-delivery')?.trim() ?? ''
+  if (!/^[a-z0-9-]{1,255}$/i.test(deliveryId)) {
+    return {
+      ok: false,
+      error: 'Missing or invalid GitHub delivery ID.',
+      status: 400,
+    }
+  }
+
+  const event = headers.get('x-github-event')?.trim() ?? ''
+  if (!/^[a-z][a-z0-9_]{0,63}$/.test(event)) {
+    return {
+      ok: false,
+      error: 'Missing or invalid GitHub event.',
+      status: 400,
+    }
+  }
+
+  return { ok: true, deliveryId, event, signature }
+}
+
+export function requireGitHubWebhookConfiguration() {
+  if (!config.GITHUB_APP_WEBHOOK_SECRET) {
+    throw new Error('GitHub webhook secret is not configured.')
+  }
+
+  return config.GITHUB_APP_WEBHOOK_SECRET
+}
+
+export function verifyGitHubWebhookSignature({
+  body,
+  signature,
+}: {
+  body: string
+  signature: string | null
+}) {
+  const webhookSecret = requireGitHubWebhookConfiguration()
+
+  if (!signature?.startsWith('sha256=')) {
+    return false
+  }
+
+  const expected = createHmac('sha256', webhookSecret)
+    .update(body)
+    .digest('hex')
+  const actual = signature.slice('sha256='.length)
+
+  return safeEqualHex(actual, expected)
+}
+
+export function parseGitHubPushPayload(body: string): GitHubPushWebhookPayload {
+  const payload: unknown = JSON.parse(body)
+
+  if (!payload || typeof payload !== 'object') {
+    throw new Error('Invalid GitHub webhook payload.')
+  }
+
+  return payload
+}
+
+export class InvalidGitHubInstallationPayloadError extends Error {
+  constructor() {
+    super('Invalid GitHub installation webhook payload.')
+  }
+}
+
+export function parseGitHubInstallationWebhookPayload(
+  body: string,
+): GitHubInstallationWebhookPayload {
+  let payload: unknown
+  try {
+    payload = JSON.parse(body)
+  } catch {
+    throw new InvalidGitHubInstallationPayloadError()
+  }
+
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+    throw new InvalidGitHubInstallationPayloadError()
+  }
+
+  const record = payload as Record<string, unknown>
+  const installation = record.installation
+
+  if (
+    typeof record.action !== 'string' ||
+    !installation ||
+    typeof installation !== 'object' ||
+    Array.isArray(installation)
+  ) {
+    throw new InvalidGitHubInstallationPayloadError()
+  }
+
+  const installationId = (installation as Record<string, unknown>).id
+
+  if (
+    typeof installationId !== 'number' ||
+    !Number.isSafeInteger(installationId)
+  ) {
+    throw new InvalidGitHubInstallationPayloadError()
+  }
+
+  return { action: record.action, installationId }
+}
+
+export function getGitHubInstallationChange(
+  event: GitHubInstallationWebhookEvent,
+  action: string,
+): GitHubInstallationChange {
+  if (event === 'installation') {
+    if (action === 'deleted') {
+      return { type: 'status', status: 'deleted' }
+    }
+
+    if (action === 'suspend') {
+      return { type: 'status', status: 'suspended' }
+    }
+
+    if (
+      !['created', 'new_permissions_accepted', 'unsuspend'].includes(action)
+    ) {
+      return { type: 'ignore' }
+    }
+  }
+
+  return { type: 'refresh' }
+}
+
+export function getBranchFromGitHubRef(ref: string | undefined) {
+  const prefix = 'refs/heads/'
+
+  if (!ref?.startsWith(prefix)) {
+    return null
+  }
+
+  return ref.slice(prefix.length)
+}
+
+function safeEqualHex(actualHex: string, expectedHex: string) {
+  if (
+    !/^[a-f0-9]+$/i.test(actualHex) ||
+    actualHex.length !== expectedHex.length
+  ) {
+    return false
+  }
+
+  return timingSafeEqual(
+    Buffer.from(actualHex, 'hex'),
+    Buffer.from(expectedHex, 'hex'),
+  )
+}

package/src/server/http/auth.ts

@@ -0,0 +1,11 @@
+import { timingSafeEqual } from 'node:crypto'
+
+export function matchesBearerSecret(
+  authorization: string | null,
+  secret: string,
+) {
+  if (!authorization || !secret) return false
+  const actual = Buffer.from(authorization)
+  const expected = Buffer.from(`Bearer ${secret}`)
+  return actual.length === expected.length && timingSafeEqual(actual, expected)
+}

package/src/server/http/error-diagnostics.ts

@@ -0,0 +1,66 @@
+// Keep source locations for investigation without retaining exception messages,
+// query text, URLs, or serialized request values. This works on Node and Workers.
+export function safeErrorDiagnostics(error: unknown) {
+  if (!(error instanceof Error))
+    return { errorName: 'unknown', stackFrames: [] as string[] }
+  try {
+    const errorName = /^[A-Za-z][A-Za-z0-9_.-]{0,79}$/.test(error.name)
+      ? error.name
+      : 'Error'
+    if (typeof error.stack !== 'string')
+      return { errorName, stackFrames: [] as string[] }
+    // A multiline exception message can itself contain frame-shaped text.
+    // Remove the complete message before examining actual stack frames.
+    const messagePosition = error.message
+      ? error.stack.indexOf(error.message)
+      : -1
+    const stack =
+      messagePosition >= 0
+        ? error.stack.slice(messagePosition + error.message.length)
+        : error.stack.slice(error.stack.indexOf('\n') + 1)
+    const stackFrames: string[] = []
+    for (const line of stack.slice(0, 32 * 1024).split('\n')) {
+      const match =
+        /^\s*at\s+(?:(.*?)\s+\()?([^()\n]+):(\d{1,8}):(\d{1,8})\)?$/.exec(line)
+      if (!match) continue
+      const source = safeSourceLocation(match[2]!)
+      if (!source) continue
+      const functionName =
+        match[1] &&
+        /^(?:(?:async|new) )?[A-Za-z_$][A-Za-z0-9_.$]{0,100}$/.test(match[1])
+          ? match[1]
+          : undefined
+      const location = `${source}:${match[3]}:${match[4]}`
+      stackFrames.push(
+        functionName ? `at ${functionName} (${location})` : `at ${location}`,
+      )
+      if (stackFrames.length === 8) break
+    }
+    return { errorName, stackFrames }
+  } catch {
+    // Nonstandard error accessors must not prevent the public error response.
+    return { errorName: 'Error', stackFrames: [] as string[] }
+  }
+}
+
+function safeSourceLocation(source: string) {
+  if (/^node:[A-Za-z0-9_./-]{1,180}$/.test(source)) return source
+  if (
+    /^[A-Za-z][A-Za-z0-9+.-]*:/.test(source) &&
+    !source.startsWith('file:///') &&
+    !/^[A-Za-z]:[\\/]/.test(source)
+  )
+    return null
+  const parts = source
+    .replace(/^file:\/\/\//, '/')
+    .replace(/\\/g, '/')
+    .split('/')
+    .slice(-4)
+  if (
+    !parts.length ||
+    parts.some((part) => !/^[A-Za-z0-9_$@.~-]{1,100}$/.test(part))
+  )
+    return null
+  if (!/\.(?:[cm]?js|tsx?|jsx)$/.test(parts.at(-1)!)) return null
+  return parts.join('/').slice(-200)
+}

package/src/server/http/plugin-request.ts

@@ -0,0 +1,15 @@
+import { getAuthSession } from '#devpush/server/auth/session.server'
+import { getPluginServices } from '#devpush/server/plugins/services.server'
+
+export async function handlePluginRequest(request: Request) {
+  const session = await getAuthSession()
+  return getPluginServices().handleRequest!(
+    request,
+    session
+      ? {
+          userId: session.user.id,
+          email: session.user.email,
+        }
+      : null,
+  )
+}

package/src/server/http/proxy-request.ts

@@ -0,0 +1,53 @@
+import { config } from '#devpush/server/config'
+import { isCloudflareRuntime } from '#devpush/server/runtime/platform-env'
+
+export function resolveProxyRequest(
+  request: Request,
+  options = {
+    trusted: config.DEVPUSH_TRUST_PROXY && !isCloudflareRuntime(),
+    origins: [
+      config.DEVPUSH_BASE_URL,
+      config.BETTER_AUTH_URL,
+      config.DEVPUSH_MCP_URL,
+    ],
+  },
+): Request {
+  if (!options.trusted) return request
+  const protocol = request.headers
+    .get('x-forwarded-proto')
+    ?.split(',')
+    .at(-1)
+    ?.trim()
+    .toLowerCase()
+  if (protocol !== 'http' && protocol !== 'https') return request
+  const current = new URL(request.url)
+  const host =
+    request.headers.get('x-forwarded-host')?.split(',').at(-1)?.trim() ??
+    current.host
+  let origin: URL
+  try {
+    origin = new URL(`${protocol}://${host}`)
+  } catch {
+    return request
+  }
+  if (
+    origin.username ||
+    origin.password ||
+    origin.pathname !== '/' ||
+    origin.search ||
+    origin.hash
+  )
+    return request
+  if (!options.origins.some((value) => new URL(value).origin === origin.origin))
+    return request
+  if (current.origin === origin.origin) return request
+  const url = new URL(current.pathname + current.search, origin)
+  return new Request(url, {
+    method: request.method,
+    headers: request.headers,
+    body: request.body,
+    signal: request.signal,
+    redirect: request.redirect,
+    duplex: 'half',
+  } as RequestInit)
+}

package/src/server/http/public-errors.ts

@@ -0,0 +1,48 @@
+import { createMiddleware } from '@tanstack/react-start'
+import { PublicError } from '#devpush/lib/public-error'
+import { ZodError } from 'zod'
+import { safeErrorDiagnostics } from './error-diagnostics'
+
+export const publicErrorsMiddleware = createMiddleware({
+  type: 'function',
+}).server(async ({ next }) => {
+  try {
+    return await next()
+  } catch (error) {
+    throw publicErrorPayload(error)
+  }
+})
+
+export function toPublicError(error: unknown): PublicError {
+  if (error instanceof PublicError) return error
+  if (
+    error &&
+    typeof error === 'object' &&
+    (('status' in error && error.status === 429) ||
+      ('statusCode' in error && error.statusCode === 429))
+  )
+    return new PublicError('RATE_LIMITED')
+  if (error instanceof ZodError) return new PublicError('INVALID_INPUT')
+  if (error instanceof Error && error.message === 'Forbidden')
+    return new PublicError('FORBIDDEN')
+  if (
+    error instanceof Error &&
+    (error.message === 'Unauthorized' ||
+      error.message.startsWith('Sign in before '))
+  )
+    return new PublicError('UNAUTHORIZED')
+  console.error('Server action failed', safeErrorDiagnostics(error))
+  return new PublicError('INTERNAL_ERROR')
+}
+
+// Plain objects survive Start's default transport without per-window adapters.
+export function publicErrorPayload(error: unknown) {
+  const safe = toPublicError(error)
+  return {
+    name: 'PublicError' as const,
+    code: safe.code,
+    message: safe.message,
+    ...(safe.policy ? { policy: safe.policy } : {}),
+    ...(safe.reloadUrl ? { reloadUrl: safe.reloadUrl } : {}),
+  }
+}

package/src/server/http/rate-limit.ts

@@ -0,0 +1,59 @@
+import { createHash } from 'node:crypto'
+
+import { lt, sql } from 'drizzle-orm'
+
+import { db } from '#devpush/server/db'
+import { rateLimits } from '#devpush/server/db/schema'
+import { getRequestPublicAddress } from './request-ip'
+
+export async function enforceRateLimit({
+  limit,
+  request,
+  identity: explicitIdentity,
+  scope,
+  windowMs,
+}: {
+  limit: number
+  request?: Request
+  identity?: string
+  scope: string
+  windowMs: number
+}) {
+  const identity =
+    explicitIdentity ??
+    (request ? getRequestPublicAddress(request) : null) ??
+    'unknown-address'
+  const key = `${scope}:${createHash('sha256').update(identity).digest('hex')}`
+  const now = new Date()
+  const resetAt = new Date(now.getTime() + windowMs)
+  const rows = await db
+    .insert(rateLimits)
+    .values({ key, count: 1, resetAt })
+    .onConflictDoUpdate({
+      target: rateLimits.key,
+      set: {
+        count: sql<number>`case when ${rateLimits.resetAt} <= ${now} then 1 else ${rateLimits.count} + 1 end`,
+        resetAt: sql<Date>`case when ${rateLimits.resetAt} <= ${now} then ${resetAt} else ${rateLimits.resetAt} end`,
+      },
+    })
+    .returning({ count: rateLimits.count, resetAt: rateLimits.resetAt })
+  const state = rows[0]
+  if (!state) throw new Error('Rate limit update returned no state.')
+
+  if (state.count <= limit) {
+    return null
+  }
+
+  const retryAfter = Math.max(
+    1,
+    Math.ceil((state.resetAt.getTime() - now.getTime()) / 1000),
+  )
+  return Response.json(
+    { error: 'Too many requests. Try again later.' },
+    { status: 429, headers: { 'retry-after': String(retryAfter) } },
+  )
+}
+
+export async function cleanupExpiredRateLimits() {
+  await db.delete(rateLimits).where(lt(rateLimits.resetAt, new Date()))
+}