devpush 0.0.0-stage → 1.0.0-beta.4

package/src/routes/api/agents/register.ts

@@ -0,0 +1,45 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { getRequestPublicAddress } from '#devpush/server/http/request-ip'
+import {
+  handleAgentRequest,
+  registerAgentSchema,
+} from '#devpush/server/agents/protocol'
+import { registerAgent } from '#devpush/server/servers/service'
+import { enforceRateLimit } from '#devpush/server/http/rate-limit'
+
+export const Route = createFileRoute('/api/agents/register')({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        const limited = await enforceRateLimit({
+          limit: 20,
+          request,
+          scope: 'agent-register',
+          windowMs: 10 * 60 * 1000,
+        })
+
+        if (limited) {
+          return limited
+        }
+
+        return handleAgentRequest(
+          request,
+          registerAgentSchema,
+          (payload) =>
+            registerAgent({
+              token: payload.token,
+              agentVersion: payload.agentVersion,
+              protocolVersion: payload.protocolVersion,
+              capabilities: payload.capabilities,
+              publicAddress: getRequestPublicAddress(request),
+              routingAddress: payload.routingAddress,
+              publicIpv4: payload.publicIpv4,
+              publicIpv6: payload.publicIpv6,
+            }),
+          'Unable to register agent.',
+        )
+      },
+    },
+  },
+})

package/src/routes/api/agents/runtime-logs.ts

@@ -0,0 +1,22 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { recordRuntimeLogs } from '#devpush/server/agents/runtime-logs'
+import {
+  handleAgentRequest,
+  runtimeLogsSchema,
+} from '#devpush/server/agents/protocol'
+
+export const Route = createFileRoute('/api/agents/runtime-logs')({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        return handleAgentRequest(
+          request,
+          runtimeLogsSchema,
+          recordRuntimeLogs,
+          'Unable to record runtime logs.',
+        )
+      },
+    },
+  },
+})

package/src/routes/api/agents/switch.ts

@@ -0,0 +1,25 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { handleAgentRequest } from '#devpush/server/agents/protocol'
+import { switchServerControlPlane } from '#devpush/server/servers/switch'
+
+const schema = z.object({
+  serverId: z.string().min(1),
+  token: z.string().min(1),
+  action: z.enum(['prepare', 'rollback']),
+  ticket: z.string().optional(),
+})
+
+export const Route = createFileRoute('/api/agents/switch')({
+  server: {
+    handlers: {
+      POST: ({ request }) =>
+        handleAgentRequest(
+          request,
+          schema,
+          switchServerControlPlane,
+          'Unable to switch control plane.',
+        ),
+    },
+  },
+})

package/src/routes/api/auth/$.ts

@@ -0,0 +1,38 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { auth } from '#devpush/server/auth/better-auth'
+import { enforceRateLimit } from '#devpush/server/http/rate-limit'
+
+export const Route = createFileRoute('/api/auth/$')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => auth.handler(externalAuthRequest(request)),
+      POST: async ({ request }) => {
+        const tokenExchange =
+          new URL(request.url).pathname === '/api/auth/oauth2/token'
+        const limited = await enforceRateLimit({
+          limit: tokenExchange ? 300 : 30,
+          request,
+          scope: tokenExchange ? 'auth-token' : 'auth',
+          windowMs: 5 * 60 * 1000,
+        })
+
+        return limited ?? auth.handler(externalAuthRequest(request))
+      },
+    },
+  },
+})
+
+function externalAuthRequest(request: Request) {
+  const headers = new Headers(request.headers)
+  headers.delete('x-devpush-mcp-grant')
+  // Node's server request can be a framework wrapper rather than a native Fetch Request.
+  const init: RequestInit & { duplex: 'half' } = {
+    method: request.method,
+    headers,
+    body: request.body,
+    signal: request.signal,
+    duplex: 'half',
+  }
+  return new Request(request.url, init)
+}

package/src/routes/api/cron/backups.ts

@@ -0,0 +1,33 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { config } from '#devpush/server/config'
+import { matchesBearerSecret } from '#devpush/server/http/auth'
+import { queueDueBackupSchedules } from '#devpush/server/backups/service'
+
+export const Route = createFileRoute('/api/cron/backups')({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        if (!config.DEVPUSH_BACKUPS_ENABLED) {
+          return Response.json({ error: 'Not found.' }, { status: 404 })
+        }
+
+        if (!config.DEVPUSH_CRON_SECRET) {
+          return Response.json(
+            { error: 'Scheduled backups are not configured.' },
+            { status: 503 },
+          )
+        }
+
+        const authorization = request.headers.get('authorization')
+        if (!matchesBearerSecret(authorization, config.DEVPUSH_CRON_SECRET)) {
+          return Response.json({ error: 'Unauthorized.' }, { status: 401 })
+        }
+
+        const queued = await queueDueBackupSchedules()
+
+        return Response.json({ queued })
+      },
+    },
+  },
+})

package/src/routes/api/cron/maintenance.ts

@@ -0,0 +1,30 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { config } from '#devpush/server/config'
+import { matchesBearerSecret } from '#devpush/server/http/auth'
+import { runMaintenance } from '#devpush/server/maintenance'
+
+export const Route = createFileRoute('/api/cron/maintenance')({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        if (!config.DEVPUSH_CRON_SECRET) {
+          return Response.json(
+            { error: 'Scheduled maintenance is not configured.' },
+            { status: 503 },
+          )
+        }
+        if (
+          !matchesBearerSecret(
+            request.headers.get('authorization'),
+            config.DEVPUSH_CRON_SECRET,
+          )
+        ) {
+          return Response.json({ error: 'Unauthorized.' }, { status: 401 })
+        }
+
+        return Response.json(await runMaintenance())
+      },
+    },
+  },
+})

package/src/routes/api/github/install.callback.ts

@@ -0,0 +1,51 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { auth } from '#devpush/server/auth/better-auth'
+import {
+  getAppInstallation,
+  upsertGitHubInstallation,
+} from '#devpush/server/github/service'
+import { verifyGitHubInstallState } from '#devpush/server/github/install-state'
+
+export const Route = createFileRoute('/api/github/install/callback')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        const url = new URL(request.url)
+        const session = await auth.api.getSession({ headers: request.headers })
+        const state = url.searchParams.get('state')
+
+        if (!session || !state) {
+          return Response.json({ error: 'Unauthorized.' }, { status: 401 })
+        }
+
+        let next: string
+        try {
+          next = await verifyGitHubInstallState({
+            state,
+            userId: session.user.id,
+          })
+        } catch {
+          return Response.json(
+            { error: 'Invalid or expired GitHub installation state.' },
+            { status: 400 },
+          )
+        }
+        const setupAction = url.searchParams.get('setup_action')
+        const installationId = Number(url.searchParams.get('installation_id'))
+
+        if (
+          !Number.isSafeInteger(installationId) ||
+          !['install', 'update'].includes(setupAction ?? '')
+        ) {
+          return Response.redirect(new URL(next, url.origin), 302)
+        }
+
+        const installation = await getAppInstallation(installationId)
+        await upsertGitHubInstallation(installation)
+
+        return Response.redirect(new URL(next, url.origin), 302)
+      },
+    },
+  },
+})

package/src/routes/api/github/install.ts

@@ -0,0 +1,41 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { auth } from '#devpush/server/auth/better-auth'
+import { config } from '#devpush/server/config'
+import { getSafeRedirectPath } from '#devpush/lib/internal-redirect'
+import { createGitHubInstallState } from '#devpush/server/github/install-state'
+
+export const Route = createFileRoute('/api/github/install')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        const url = new URL(request.url)
+        const next = getSafeRedirectPath(url.searchParams.get('next'))
+        const session = await auth.api.getSession({
+          headers: request.headers,
+        })
+
+        if (!session) {
+          const loginUrl = new URL('/auth/login', url.origin)
+          loginUrl.searchParams.set('redirect', next)
+
+          return Response.redirect(loginUrl, 302)
+        }
+
+        if (!config.GITHUB_APP_NAME) {
+          return Response.redirect(new URL(next, url.origin), 302)
+        }
+
+        const installUrl = new URL(
+          `https://github.com/apps/${config.GITHUB_APP_NAME}/installations/new`,
+        )
+        installUrl.searchParams.set(
+          'state',
+          await createGitHubInstallState({ next, userId: session.user.id }),
+        )
+
+        return Response.redirect(installUrl, 302)
+      },
+    },
+  },
+})

package/src/routes/api/github/webhook.ts

@@ -0,0 +1,11 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { handleGitHubWebhook } from '#devpush/server/github/webhook-handler'
+
+export const Route = createFileRoute('/api/github/webhook')({
+  server: {
+    handlers: {
+      POST: ({ request }) => handleGitHubWebhook(request),
+    },
+  },
+})

package/src/routes/api/health.ts

@@ -0,0 +1,19 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { sql } from 'drizzle-orm'
+
+import { db } from '#devpush/server/db'
+
+export const Route = createFileRoute('/api/health')({
+  server: {
+    handlers: {
+      GET: async () => {
+        try {
+          await db.run(sql`select 1`)
+          return Response.json({ status: 'ok' })
+        } catch {
+          return Response.json({ status: 'unhealthy' }, { status: 503 })
+        }
+      },
+    },
+  },
+})

package/src/routes/api/install/agent.$token.ts

@@ -0,0 +1,50 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { config } from '#devpush/server/config'
+import {
+  buildTokenizedAgentInstallScript,
+  isAgentEnrollmentToken,
+} from '#devpush/server/install/agent-script'
+
+export const Route = createFileRoute('/api/install/agent/$token')({
+  server: {
+    handlers: {
+      HEAD: async ({ params }) => {
+        if (!isAgentEnrollmentToken(params.token))
+          return new Response(null, { status: 404 })
+        const script = buildTokenizedAgentInstallScript({
+          autoUpdate: config.DEVPUSH_AGENT_AUTO_UPDATE,
+          baseUrl: config.DEVPUSH_BASE_URL,
+          token: params.token,
+          traefikEmail: config.DEVPUSH_TRAEFIK_EMAIL,
+        })
+
+        return new Response(null, {
+          headers: installScriptHeaders(script),
+        })
+      },
+      GET: async ({ params }) => {
+        if (!isAgentEnrollmentToken(params.token))
+          return new Response(null, { status: 404 })
+        const script = buildTokenizedAgentInstallScript({
+          autoUpdate: config.DEVPUSH_AGENT_AUTO_UPDATE,
+          baseUrl: config.DEVPUSH_BASE_URL,
+          token: params.token,
+          traefikEmail: config.DEVPUSH_TRAEFIK_EMAIL,
+        })
+
+        return new Response(script, {
+          headers: installScriptHeaders(script),
+        })
+      },
+    },
+  },
+})
+
+function installScriptHeaders(script: string) {
+  return {
+    'cache-control': 'no-store',
+    'content-length': String(Buffer.byteLength(script)),
+    'content-type': 'text/x-shellscript; charset=utf-8',
+  }
+}

package/src/routes/api/install/agent.binary.ts

@@ -0,0 +1,83 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import {
+  AgentBinaryNotConfiguredError,
+  AgentBinaryUnsupportedPlatformError,
+  getAgentBinary,
+  getAgentReleaseDownloadUrl,
+  getAgentBinaryMetadata,
+} from '#devpush/server/install/agent-binary'
+
+export const Route = createFileRoute('/api/install/agent/binary')({
+  server: {
+    handlers: {
+      HEAD: async ({ request }) => {
+        try {
+          const url = getAgentReleaseDownloadUrl(getRequestedPlatform(request))
+          if (url) return Response.redirect(url, 302)
+          const { size, filename } = await getAgentBinaryMetadata(
+            getRequestedPlatform(request),
+          )
+
+          return new Response(null, {
+            headers: binaryHeaders(size, filename),
+          })
+        } catch (error) {
+          return binaryErrorResponse(error)
+        }
+      },
+      GET: async ({ request }) => {
+        try {
+          const url = getAgentReleaseDownloadUrl(getRequestedPlatform(request))
+          if (url) return Response.redirect(url, 302)
+          const { body, filename, size } = await getAgentBinary(
+            getRequestedPlatform(request),
+          )
+
+          return new Response(new Uint8Array(body), {
+            headers: binaryHeaders(size, filename),
+          })
+        } catch (error) {
+          return binaryErrorResponse(error)
+        }
+      },
+    },
+  },
+})
+
+function getRequestedPlatform(request: Request) {
+  const url = new URL(request.url)
+
+  return {
+    arch: url.searchParams.get('arch'),
+    os: url.searchParams.get('os'),
+  }
+}
+
+function binaryErrorResponse(error: unknown) {
+  return Response.json(
+    {
+      error:
+        error instanceof Error
+          ? error.message
+          : 'Unable to read configured agent binary.',
+    },
+    {
+      status:
+        error instanceof AgentBinaryNotConfiguredError
+          ? 501
+          : error instanceof AgentBinaryUnsupportedPlatformError
+            ? 400
+            : 500,
+    },
+  )
+}
+
+function binaryHeaders(size: number, filename: string) {
+  return {
+    'cache-control': 'no-store',
+    'content-disposition': `attachment; filename="${filename}"`,
+    'content-length': String(size),
+    'content-type': 'application/octet-stream',
+  }
+}

package/src/routes/api/install/agent.checksum.ts

@@ -0,0 +1,45 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import {
+  AgentBinaryNotConfiguredError,
+  AgentBinaryUnsupportedPlatformError,
+  getAgentBinaryChecksum,
+} from '#devpush/server/install/agent-binary'
+
+export const Route = createFileRoute('/api/install/agent/checksum')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        try {
+          const url = new URL(request.url)
+          const binary = await getAgentBinaryChecksum({
+            arch: url.searchParams.get('arch'),
+            os: url.searchParams.get('os'),
+          })
+          return new Response(`${binary.digest}  ${binary.filename}\n`, {
+            headers: {
+              'cache-control': 'no-store',
+              'content-type': 'text/plain; charset=utf-8',
+            },
+          })
+        } catch (error) {
+          const expected =
+            error instanceof AgentBinaryNotConfiguredError ||
+            error instanceof AgentBinaryUnsupportedPlatformError
+          if (!expected) console.error('Agent checksum unavailable.', error)
+          return Response.json(
+            { error: expected ? error.message : 'Agent checksum unavailable.' },
+            {
+              status:
+                error instanceof AgentBinaryNotConfiguredError
+                  ? 501
+                  : error instanceof AgentBinaryUnsupportedPlatformError
+                    ? 400
+                    : 500,
+            },
+          )
+        }
+      },
+    },
+  },
+})

package/src/routes/api/install/agent.ts

@@ -0,0 +1,26 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { AGENT_INSTALL_SCRIPT } from '#devpush/server/install/agent-script'
+
+export const Route = createFileRoute('/api/install/agent')({
+  server: {
+    handlers: {
+      HEAD: async () =>
+        new Response(null, {
+          headers: installScriptHeaders(),
+        }),
+      GET: async () =>
+        new Response(AGENT_INSTALL_SCRIPT, {
+          headers: installScriptHeaders(),
+        }),
+    },
+  },
+})
+
+function installScriptHeaders() {
+  return {
+    'cache-control': 'no-store',
+    'content-length': String(Buffer.byteLength(AGENT_INSTALL_SCRIPT)),
+    'content-type': 'text/x-shellscript; charset=utf-8',
+  }
+}

package/src/routes/api/plugins/$.ts

@@ -0,0 +1,11 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { handlePluginRequest } from '#devpush/server/http/plugin-request'
+
+export const Route = createFileRoute('/api/plugins/$')({
+  server: {
+    handlers: {
+      GET: ({ request }) => handlePluginRequest(request),
+      POST: ({ request }) => handlePluginRequest(request),
+    },
+  },
+})

package/src/routes/api/v1/$.ts

@@ -0,0 +1,15 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { handlePublicApiRequest } from '#devpush/server/api/handler'
+
+export const Route = createFileRoute('/api/v1/$')({
+  server: {
+    handlers: {
+      GET: ({ request }) => handlePublicApiRequest(request),
+      POST: ({ request }) => handlePublicApiRequest(request),
+      PATCH: ({ request }) => handlePublicApiRequest(request),
+      PUT: ({ request }) => handlePublicApiRequest(request),
+      DELETE: ({ request }) => handlePublicApiRequest(request),
+      OPTIONS: ({ request }) => handlePublicApiRequest(request),
+    },
+  },
+})

package/src/routes/api/workspaces/updates.ts

@@ -0,0 +1,8 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { connectWorkspaceUpdates } from '#devpush/server/realtime/service'
+
+export const Route = createFileRoute('/api/workspaces/updates')({
+  server: {
+    handlers: { GET: ({ request }) => connectWorkspaceUpdates(request) },
+  },
+})

package/src/routes/auth.login.tsx

@@ -0,0 +1,50 @@
+import { pageHead } from '#devpush/lib/page-head'
+import { createFileRoute, redirect } from '@tanstack/react-router'
+
+import { LoginForm, LoginPending } from '#devpush/features/auth/login-form'
+import { getLoginContext } from '#devpush/server/auth/context'
+import { getSafeRedirectPath } from '#devpush/lib/internal-redirect'
+
+export const Route = createFileRoute('/auth/login')({
+  validateSearch: (search: Record<string, unknown>): { redirect?: string } =>
+    typeof search.redirect === 'string'
+      ? { redirect: getSafeRedirectPath(search.redirect) }
+      : {},
+  loaderDeps: ({ search }) => ({ redirect: search.redirect }),
+  loader: async ({ deps }) => {
+    const { authMethods, userContext } = await getLoginContext()
+
+    if (userContext) {
+      if (userContext.user.profileConfirmedAt === null)
+        throw redirect({
+          to: '/onboarding',
+          search: { redirect: deps.redirect },
+        })
+      if (deps.redirect && deps.redirect !== '/') {
+        throw redirect({ href: deps.redirect })
+      }
+      throw redirect({
+        to: '/$teamSlug',
+        params: { teamSlug: userContext.defaultTeam.slug },
+      })
+    }
+
+    return { authMethods }
+  },
+  pendingMs: 150,
+  pendingComponent: LoginPending,
+  component: LoginRoute,
+  head: () => pageHead('Log in'),
+})
+
+function LoginRoute() {
+  const { authMethods } = Route.useLoaderData()
+  const { redirect: redirectPath } = Route.useSearch()
+
+  return (
+    <LoginForm
+      authMethods={authMethods}
+      redirectPath={redirectPath ?? '/'}
+    />
+  )
+}

package/src/routes/deployments.$deploymentId.unavailable.tsx

@@ -0,0 +1,21 @@
+import { createFileRoute, redirect } from '@tanstack/react-router'
+import { getUnavailableDeployment } from '#devpush/server/projects/functions'
+
+export const Route = createFileRoute('/deployments/$deploymentId/unavailable')({
+  ssr: false,
+  loader: async ({ params }) => {
+    const target = await getUnavailableDeployment({ data: params })
+    if (!target)
+      throw redirect({
+        to: '/auth/login',
+        search: {
+          redirect: `/deployments/${encodeURIComponent(params.deploymentId)}/unavailable`,
+        },
+      })
+    throw redirect({
+      to: '/$teamSlug/projects/$projectName/deployments/$deploymentId',
+      params: { ...target, deploymentId: params.deploymentId },
+      search: { unavailable: true },
+    })
+  },
+})

package/src/routes/index.tsx

@@ -0,0 +1,23 @@
+import { pageHead } from '#devpush/lib/page-head'
+import { createFileRoute, redirect } from '@tanstack/react-router'
+
+import { getCurrentUserContext } from '#devpush/server/auth/context'
+
+export const Route = createFileRoute('/')({
+  loader: async () => {
+    const context = await getCurrentUserContext()
+
+    if (!context) {
+      throw redirect({ to: '/auth/login' })
+    }
+
+    if (context.user.profileConfirmedAt === null)
+      throw redirect({ to: '/onboarding' })
+
+    throw redirect({
+      to: '/$teamSlug',
+      params: { teamSlug: context.defaultTeam.slug },
+    })
+  },
+  head: () => pageHead('Home'),
+})