devpush 0.0.0-stage → 1.0.0-beta.4

package/src/routes/invites.$token.tsx

@@ -0,0 +1,35 @@
+import { pageHead } from '#devpush/lib/page-head'
+import { createFileRoute, redirect } from '@tanstack/react-router'
+
+import { getCurrentUserContext } from '#devpush/server/auth/context'
+import {
+  TeamInvite,
+  TeamInvitePending,
+} from '#devpush/features/teams/team-invite'
+
+export const Route = createFileRoute('/invites/$token')({
+  ssr: false,
+  loader: async ({ params }) => {
+    const context = await getCurrentUserContext()
+    if (context?.user.profileConfirmedAt === null)
+      throw redirect({
+        to: '/onboarding',
+        search: { redirect: `/invites/${params.token}` },
+      })
+    if (!context) {
+      throw redirect({
+        to: '/auth/login',
+        search: { redirect: `/invites/${params.token}` },
+      })
+    }
+  },
+  pendingMs: 150,
+  pendingComponent: TeamInvitePending,
+  component: TeamInviteRoute,
+  head: () => pageHead('Team invitation'),
+})
+
+function TeamInviteRoute() {
+  const { token } = Route.useParams()
+  return <TeamInvite token={token} />
+}

package/src/routes/mcp.ts

@@ -0,0 +1,13 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { handleMcpRequest } from '#devpush/server/mcp/handler'
+
+export const Route = createFileRoute('/mcp')({
+  server: {
+    handlers: {
+      GET: ({ request }) => handleMcpRequest(request),
+      POST: ({ request }) => handleMcpRequest(request),
+      DELETE: ({ request }) => handleMcpRequest(request),
+      OPTIONS: ({ request }) => handleMcpRequest(request),
+    },
+  },
+})

package/src/routes/oauth.consent.tsx

@@ -0,0 +1,54 @@
+import { pageHead } from '#devpush/lib/page-head'
+import { createFileRoute, redirect } from '@tanstack/react-router'
+import {
+  McpConsent,
+  McpConsentPending,
+} from '#devpush/features/users/mcp-consent'
+import { getMcpConsentAction } from '#devpush/server/mcp/functions'
+
+export const Route = createFileRoute('/oauth/consent')({
+  ssr: false,
+  server: {
+    handlers: {
+      GET: ({ request, next }) => {
+        const url = new URL(request.url)
+        // The provider signs repeated query parameters. Wrap the original
+        // bytes before the router's search normalization can rewrite them.
+        if (
+          url.search &&
+          !(url.searchParams.size === 1 && url.searchParams.has('oauthQuery'))
+        ) {
+          return new Response(null, {
+            status: 302,
+            headers: {
+              location: `/oauth/consent?oauthQuery=${encodeURIComponent(url.search.slice(1))}`,
+              'cache-control': 'no-store',
+            },
+          })
+        }
+        return next()
+      },
+    },
+  },
+  validateSearch: (search: Record<string, unknown>) => ({
+    oauthQuery: typeof search.oauthQuery === 'string' ? search.oauthQuery : '',
+  }),
+  loaderDeps: ({ search }) => search,
+  loader: async ({ deps }) => {
+    const context = await getMcpConsentAction({ data: deps })
+    if (!context)
+      throw redirect({
+        to: '/auth/login',
+        search: {
+          redirect: `/oauth/consent?oauthQuery=${encodeURIComponent(deps.oauthQuery)}`,
+        },
+      })
+    return context
+  },
+  component: ConsentRoute,
+  pendingComponent: McpConsentPending,
+  head: () => pageHead('Authorize application'),
+})
+function ConsentRoute() {
+  return <McpConsent context={Route.useLoaderData()} />
+}

package/src/routes/onboarding.tsx

@@ -0,0 +1,37 @@
+import {
+  createFileRoute,
+  redirect,
+  Outlet,
+  useChildMatches,
+} from '@tanstack/react-router'
+import { getCurrentUserContext } from '#devpush/server/auth/context'
+import { getSafeRedirectPath } from '#devpush/lib/internal-redirect'
+import { ProfileOnboarding } from '#devpush/features/onboarding/profile-onboarding'
+import { pageHead } from '#devpush/lib/page-head'
+
+export const Route = createFileRoute('/onboarding')({
+  ssr: false,
+  validateSearch: (search: Record<string, unknown>): { redirect?: string } => ({
+    redirect:
+      typeof search.redirect === 'string'
+        ? getSafeRedirectPath(search.redirect)
+        : undefined,
+  }),
+  loader: async () => {
+    const context = await getCurrentUserContext()
+    if (!context) throw redirect({ to: '/auth/login' })
+    return context
+  },
+  component: OnboardingRoute,
+  head: () => pageHead('Confirm your details'),
+})
+function OnboardingRoute() {
+  const context = Route.useLoaderData()
+  const search = Route.useSearch()
+  const hasChild = useChildMatches({ select: (matches) => matches.length > 0 })
+  return hasChild ? (
+    <Outlet />
+  ) : (
+    <ProfileOnboarding context={context} destination={search.redirect} />
+  )
+}

package/src/routes/onboarding.workspace.tsx

@@ -0,0 +1,44 @@
+import { createFileRoute, redirect } from '@tanstack/react-router'
+import {
+  WorkspaceOnboarding,
+  hasWorkspaceOnboarding,
+} from '#devpush/features/plugins/contributions'
+import { getCurrentUserContext } from '#devpush/server/auth/context'
+import { onboardingDestination } from '#devpush/lib/onboarding'
+import { pageHead } from '#devpush/lib/page-head'
+
+export const Route = createFileRoute('/onboarding/workspace')({
+  ssr: false,
+  validateSearch: (search: Record<string, unknown>): { team?: string } => ({
+    team: typeof search.team === 'string' ? search.team : undefined,
+  }),
+  loaderDeps: ({ search }) => ({ team: search.team }),
+  loader: async ({ deps }) => {
+    const context = await getCurrentUserContext()
+    if (!context) throw redirect({ to: '/auth/login' })
+    if (!hasWorkspaceOnboarding()) throw redirect({ to: '/' })
+    if (context.user.profileConfirmedAt === null)
+      throw redirect({ to: '/onboarding' })
+    const team = deps.team
+      ? context.teams.find((candidate) => candidate.slug === deps.team)
+      : context.defaultTeam
+    if (!team || team.role !== 'owner') throw redirect({ to: '/' })
+    return { team }
+  },
+  component: WorkspaceOnboardingRoute,
+  head: () => pageHead('Set up workspace'),
+})
+function WorkspaceOnboardingRoute() {
+  const { team: defaultTeam } = Route.useLoaderData()
+  return (
+    <WorkspaceOnboarding
+      teamSlug={defaultTeam.slug}
+      role={defaultTeam.role}
+      onContinue={() =>
+        window.location.assign(
+          onboardingDestination(undefined, defaultTeam.slug),
+        )
+      }
+    />
+  )
+}

package/src/routes/settings.tsx

@@ -0,0 +1,30 @@
+import { pageHead } from '#devpush/lib/page-head'
+import { createFileRoute, redirect } from '@tanstack/react-router'
+
+import { UserSettings } from '#devpush/features/users/user-settings'
+import { UserSettingsPending, userSettingsModule } from '#devpush/features/settings/settings-route-pending'
+import { getUserSettingsContext } from '#devpush/server/users/functions'
+
+export const Route = createFileRoute('/settings')({
+  ssr: false,
+  loader: async () => {
+    void userSettingsModule.load()
+    const context = await getUserSettingsContext()
+
+    if (!context) {
+      throw redirect({ to: '/auth/login' })
+    }
+
+    return context
+  },
+  pendingMs: 150,
+  pendingComponent: UserSettingsPending,
+  component: SettingsRoute,
+  head: () => pageHead('Account settings'),
+})
+
+function SettingsRoute() {
+  const context = Route.useLoaderData()
+
+  return <UserSettings key={context.user.id} context={context} />
+}

package/src/routes/uploads/avatars/$fileName.ts

@@ -0,0 +1,44 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+import { getObjectStore } from '#devpush/server/storage/object-store'
+
+const avatarNamePattern =
+  /^(?:user|team|project)_[A-Za-z0-9_-]+(?:~[a-f0-9]{32})?\.(?:png|jpe?g|webp)$/
+
+export const Route = createFileRoute('/uploads/avatars/$fileName')({
+  server: {
+    handlers: {
+      GET: async ({ params }) => {
+        if (!avatarNamePattern.test(params.fileName)) {
+          return new Response('Not found.', { status: 404 })
+        }
+
+        try {
+          const content = await getObjectStore().get(
+            `avatars/${params.fileName}`,
+          )
+          return new Response(new Uint8Array(content.body), {
+            headers: {
+              'cache-control': 'public, max-age=3600',
+              'content-type':
+                content.contentType ?? contentType(params.fileName),
+              'x-content-type-options': 'nosniff',
+            },
+          })
+        } catch (error) {
+          console.error('Unable to read avatar object', {
+            error,
+            fileName: params.fileName,
+          })
+          return new Response('Not found.', { status: 404 })
+        }
+      },
+    },
+  },
+})
+
+function contentType(fileName: string) {
+  if (fileName.endsWith('.png')) return 'image/png'
+  if (fileName.endsWith('.webp')) return 'image/webp'
+  return 'image/jpeg'
+}

package/src/server/admin/access.ts

@@ -0,0 +1,67 @@
+import { and, eq, sql } from 'drizzle-orm'
+
+import { config } from '#devpush/server/config'
+import { db } from '#devpush/server/db'
+import { user } from '#devpush/server/db/schema'
+
+type AdminCandidate = {
+  id: string
+  email: string
+}
+
+export async function isInstallationAdmin(candidate: AdminCandidate) {
+  const [current] = await db
+    .select({ id: user.id })
+    .from(user)
+    .where(
+      and(eq(user.id, candidate.id), installationAdminPredicate(candidate.id)),
+    )
+    .limit(1)
+  return Boolean(current)
+}
+
+export function installationAdminPredicate(userId: string) {
+  const email = config.DEVPUSH_ADMIN_EMAIL?.trim().toLowerCase()
+  return sql`exists(select 1 from user as admin_actor where admin_actor.id = ${userId}
+    and admin_actor.status = 'active' and ${
+      email
+        ? sql`lower(trim(admin_actor.email)) = ${email}`
+        : sql`admin_actor.id = (select id from user order by created_at, id limit 1)`
+    })`
+}
+
+export function matchesInstallationAdmin({
+  candidate,
+  configuredEmail,
+  firstUserId,
+}: {
+  candidate: AdminCandidate
+  configuredEmail?: string
+  firstUserId?: string
+}) {
+  return configuredEmail
+    ? candidate.email.trim().toLowerCase() ===
+        configuredEmail.trim().toLowerCase()
+    : candidate.id === firstUserId
+}
+
+export async function requireInstallationAdmin(candidate: AdminCandidate) {
+  if (!(await isInstallationAdmin(candidate))) {
+    throw new Error('Forbidden')
+  }
+}
+
+export async function requireInstallationAdminById(userId: string) {
+  const rows = await db
+    .select({ id: user.id, email: user.email })
+    .from(user)
+    .where(eq(user.id, userId))
+    .limit(1)
+  const candidate = rows.at(0)
+
+  if (!candidate) {
+    throw new Error('Forbidden')
+  }
+
+  await requireInstallationAdmin(candidate)
+}

package/src/server/admin/functions.ts

@@ -0,0 +1,122 @@
+import {
+  allowlistRuleSchema,
+  allowlistImportSchema,
+} from '#devpush/lib/allowlist-schema'
+import { adminSearchSchema } from '#devpush/lib/admin-search-schema'
+import { formErrors } from '#devpush/lib/form-errors'
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+
+import {
+  getAuthSession,
+  requireAuthSession,
+} from '#devpush/server/auth/session.server'
+import { requireInstallationAdmin } from '#devpush/server/admin/access'
+import {
+  addAllowlistRule,
+  banUser,
+  deleteAdminUser,
+  deleteAllowlistRule,
+  getAdminOverview,
+  importAllowlistEmails,
+  unbanUser,
+} from '#devpush/server/admin/service'
+import { getUserContext } from '#devpush/server/teams/service'
+
+const idSchema = z.object({
+  id: z.string().min(1),
+})
+
+const userIdSchema = z.object({
+  userId: z.string().min(1),
+})
+
+export const getAdminSettingsContext = createServerFn({
+  method: 'GET',
+})
+  .validator((data: unknown) => adminSearchSchema.parse(data))
+  .handler(async ({ data }) => {
+    const session = await getAuthSession()
+
+    if (!session) {
+      return null
+    }
+
+    const [userContext, adminOverview] = await Promise.all([
+      getUserContext(session.user.id),
+      getAdminOverview(session.user, data),
+    ])
+
+    return {
+      userContext,
+      adminOverview,
+    }
+  })
+
+export const addAllowlistRuleAction = createServerFn({ method: 'POST' })
+  .validator((data: z.input<typeof allowlistRuleSchema>) => data)
+  .handler(async ({ data }) => {
+    const session = await requireAuthSession()
+    await requireInstallationAdmin(session.user)
+    const parsed = allowlistRuleSchema.safeParse(data)
+    if (!parsed.success) return { fieldErrors: formErrors(parsed.error.issues) }
+    await addAllowlistRule({ actorUserId: session.user.id, ...parsed.data })
+    return { fieldErrors: null }
+  })
+
+export const importAllowlistEmailsAction = createServerFn({ method: 'POST' })
+  .validator((data: z.input<typeof allowlistImportSchema>) => data)
+  .handler(async ({ data }) => {
+    const session = await requireAuthSession()
+    await requireInstallationAdmin(session.user)
+    const parsed = allowlistImportSchema.safeParse(data)
+    if (!parsed.success) return { fieldErrors: formErrors(parsed.error.issues) }
+    await importAllowlistEmails({
+      actorUserId: session.user.id,
+      ...parsed.data,
+    })
+    return { fieldErrors: null }
+  })
+
+export const deleteAllowlistRuleAction = createServerFn({ method: 'POST' })
+  .validator((data: unknown) => idSchema.parse(data))
+  .handler(async ({ data }) => {
+    const session = await requireAuthSession()
+
+    await requireInstallationAdmin(session.user)
+
+    await deleteAllowlistRule({ actorUserId: session.user.id, ...data })
+  })
+
+export const banUserAction = createServerFn({ method: 'POST' })
+  .validator((data: unknown) => userIdSchema.parse(data))
+  .handler(async ({ data }) => {
+    const session = await requireAuthSession()
+
+    await requireInstallationAdmin(session.user)
+
+    await banUser({ actorUserId: session.user.id, targetUserId: data.userId })
+  })
+
+export const unbanUserAction = createServerFn({ method: 'POST' })
+  .validator((data: unknown) => userIdSchema.parse(data))
+  .handler(async ({ data }) => {
+    const session = await requireAuthSession()
+
+    await requireInstallationAdmin(session.user)
+
+    await unbanUser({ actorUserId: session.user.id, targetUserId: data.userId })
+  })
+
+export const deleteAdminUserAction = createServerFn({ method: 'POST' })
+  .validator((data: unknown) => userIdSchema.parse(data))
+  .handler(async ({ data }) => {
+    const session = await requireAuthSession()
+
+    await requireInstallationAdmin(session.user)
+
+    await deleteAdminUser({
+      actorUserId: session.user.id,
+      targetUserId: data.userId,
+    })
+  })