devpush 0.0.0-stage → 1.0.0-beta.4

package/src/server/agents/runtime-logs.ts

@@ -0,0 +1,337 @@
+import { createHash, randomUUID } from 'node:crypto'
+
+import { and, desc, eq, inArray, lt, sql } from 'drizzle-orm'
+
+import { db, logsDb } from '#devpush/server/db'
+import { runtimeLogs } from '#devpush/server/db/log-schema'
+import { deployments, environments, projects } from '#devpush/server/db/schema'
+import { getPluginServices } from '#devpush/server/plugins/services.server'
+import { admitRuntimeLogs, reserveLogBudget } from '#devpush/server/logs/budget'
+import { requireAgentServer } from '#devpush/server/servers/service'
+import {
+  runtimeLogRetentionMs,
+  runtimeLogPruneBatchSize,
+} from '#devpush/server/logs/retention'
+
+export type RuntimeLogLine = {
+  runtimeId: string
+  service: string
+  observedAt: string
+  content: string
+}
+
+const maxRuntimeLogLines = 500
+const maxRuntimeLogContentLength = 16_384
+const maxRuntimeLogRowsPerRuntime = 10_000
+
+export async function recordRuntimeLogs({
+  serverId,
+  token,
+  logs,
+}: {
+  serverId: string
+  token: string
+  logs: Array<RuntimeLogLine>
+}) {
+  const server = await requireAgentServer({ serverId, token })
+
+  const normalizedLogs = normalizeRuntimeLogs(logs)
+
+  if (normalizedLogs.length === 0) {
+    return { ok: true, accepted: 0, inserted: 0 }
+  }
+
+  const assignments = await listAllowedRuntimes({
+    serverId,
+    runtimeIds: Array.from(new Set(normalizedLogs.map((log) => log.runtimeId))),
+  })
+  let rows = normalizedLogs.flatMap((log) => {
+    const assignment = assignments.get(log.runtimeId)
+    if (!assignment) return []
+    return [
+      {
+        id: randomUUID(),
+        projectId: assignment.projectId,
+        environmentId: assignment.environmentId,
+        serverId,
+        runtimeId: log.runtimeId,
+        service: log.service,
+        observedAt: new Date(Math.min(log.observedAt.getTime(), Date.now())),
+        content: log.content,
+        searchContent: log.content.toLowerCase(),
+        contentHash: hashRuntimeLogLine(log),
+      },
+    ]
+  })
+
+  if (rows.length === 0) {
+    return { ok: true, accepted: 0, inserted: 0 }
+  }
+
+  const acknowledged = rows.length
+  let dropped = 0
+  const limits = getPluginServices().runtimeLogLimits?.(server.teamId)
+  if (limits) {
+    // Replayed batches must not consume another allowance after their rows were stored.
+    const known = new Set<string>()
+    for (let start = 0; start < rows.length; start += 80) {
+      const existing = await logsDb
+        .select({ hash: runtimeLogs.contentHash })
+        .from(runtimeLogs)
+        .where(
+          and(
+            eq(runtimeLogs.serverId, serverId),
+            inArray(
+              runtimeLogs.contentHash,
+              rows.slice(start, start + 80).map((row) => row.contentHash),
+            ),
+          ),
+        )
+      for (const row of existing) known.add(row.hash)
+    }
+    rows = rows.filter((row) => {
+      if (known.has(row.contentHash)) return false
+      known.add(row.contentHash)
+      return true
+    })
+    if (rows.length && !(await admitRuntimeLogs(server.teamId, limits, rows))) {
+      dropped = rows.length
+      const first = rows[0]!
+      rows = []
+      // One visible notice per workspace/day. Never block agent delivery on a quota refusal.
+      if (
+        await reserveLogBudget({
+          teamId: server.teamId,
+          kind: 'notice',
+          amount: 1,
+          limit: 1,
+          windowMs: 86_400_000,
+        })
+      ) {
+        const content =
+          'Runtime log limit reached. Some logs were dropped; collection resumes when the allowance resets. Applications and deployments are unaffected.'
+        rows.push({
+          ...first,
+          id: randomUUID(),
+          service: 'devpush',
+          content,
+          searchContent: content.toLowerCase(),
+          observedAt: new Date(),
+          contentHash: createHash('sha256')
+            .update(
+              `log-limit:${server.teamId}:${Math.floor(Date.now() / 86_400_000)}`,
+            )
+            .digest('hex'),
+        })
+      }
+    }
+  }
+
+  // Keep each statement below D1's parameter limit. A partially completed
+  // request is safe to replay because each line has a stable content hash.
+  let inserted = 0
+  for (let offset = 0; offset < rows.length; offset += 32) {
+    const statements = []
+    for (
+      let start = offset;
+      start < Math.min(offset + 32, rows.length);
+      start += 8
+    ) {
+      statements.push(
+        logsDb
+          .insert(runtimeLogs)
+          .values(rows.slice(start, Math.min(start + 8, rows.length)))
+          .onConflictDoNothing({
+            target: [
+              runtimeLogs.serverId,
+              runtimeLogs.runtimeId,
+              runtimeLogs.contentHash,
+            ],
+          })
+          .returning({ id: runtimeLogs.id }),
+      )
+    }
+    const [first, ...rest] = statements
+    if (first) {
+      const batch = await logsDb.batch([first, ...rest])
+      inserted += batch.reduce((count, result) => count + result.length, 0)
+    }
+  }
+
+  await pruneRuntimeLogs({
+    serverId,
+    runtimeIds: Array.from(new Set(rows.map((row) => row.runtimeId))),
+    now: new Date(),
+  })
+
+  return {
+    ok: true,
+    accepted: acknowledged,
+    inserted,
+    ...(dropped ? { dropped } : {}),
+  }
+}
+
+function normalizeRuntimeLogs(logs: Array<RuntimeLogLine>) {
+  return logs
+    .slice(0, maxRuntimeLogLines)
+    .map((log) => {
+      const runtimeId = log.runtimeId.trim()
+      const service = log.service.trim() || 'runtime'
+      const content = log.content.slice(0, maxRuntimeLogContentLength)
+      const observedAt = new Date(log.observedAt)
+
+      if (
+        runtimeId.length === 0 ||
+        runtimeId.length > 128 ||
+        service.length > 128 ||
+        content.length === 0 ||
+        Number.isNaN(observedAt.getTime())
+      ) {
+        return null
+      }
+
+      return {
+        runtimeId,
+        service,
+        observedAt,
+        content,
+      }
+    })
+    .filter((log): log is NonNullable<typeof log> => log !== null)
+}
+
+async function listAllowedRuntimes({
+  serverId,
+  runtimeIds,
+}: {
+  serverId: string
+  runtimeIds: Array<string>
+}) {
+  const assignments = new Map<
+    string,
+    { projectId: string; environmentId: string }
+  >()
+  for (let offset = 0; offset < runtimeIds.length; offset += 80) {
+    const rows = await db
+      .select({
+        runtimeId: environments.runtimeId,
+        projectId: projects.id,
+        environmentId: environments.id,
+      })
+      .from(environments)
+      .innerJoin(projects, eq(projects.id, environments.projectId))
+      .where(
+        and(
+          eq(
+            sql`coalesce(${environments.serverId}, ${projects.defaultServerId})`,
+            serverId,
+          ),
+          eq(environments.status, 'active'),
+          eq(projects.status, 'active'),
+          inArray(
+            environments.runtimeId,
+            runtimeIds.slice(offset, offset + 80),
+          ),
+        ),
+      )
+    for (const row of rows) assignments.set(row.runtimeId, row)
+    // A durable capture can arrive after replacement or project deletion.
+    // Historical deployment ownership, never the agent's claim alone, permits
+    // delivery from the original server. Existing display/retention guards stay.
+    const historical = await db
+      .selectDistinct({
+        runtimeId: deployments.runtimeId,
+        projectId: projects.id,
+        environmentId: environments.id,
+      })
+      .from(deployments)
+      .innerJoin(environments, eq(environments.id, deployments.environmentId))
+      .innerJoin(projects, eq(projects.id, environments.projectId))
+      .where(
+        and(
+          eq(deployments.serverId, serverId),
+          inArray(deployments.runtimeId, runtimeIds.slice(offset, offset + 80)),
+        ),
+      )
+    for (const row of historical) {
+      if (!assignments.has(row.runtimeId)) assignments.set(row.runtimeId, row)
+    }
+  }
+  return assignments
+}
+
+async function pruneRuntimeLogs({
+  serverId,
+  runtimeIds,
+  now,
+}: {
+  serverId: string
+  runtimeIds: Array<string>
+  now: Date
+}) {
+  if (runtimeIds.length === 0) {
+    return
+  }
+
+  const cutoff = new Date(now.getTime() - runtimeLogRetentionMs)
+
+  for (const runtimeId of runtimeIds) {
+    const scope = and(
+      eq(runtimeLogs.serverId, serverId),
+      eq(runtimeLogs.runtimeId, runtimeId),
+    )
+    // Bound cleanup work independently of how long the agent was disconnected.
+    await logsDb.delete(runtimeLogs).where(
+      inArray(
+        runtimeLogs.id,
+        logsDb
+          .select({ id: runtimeLogs.id })
+          .from(runtimeLogs)
+          .where(and(scope, lt(runtimeLogs.observedAt, cutoff)))
+          .orderBy(runtimeLogs.observedAt, runtimeLogs.id)
+          .limit(runtimeLogPruneBatchSize),
+      ),
+    )
+    await logsDb
+      .delete(runtimeLogs)
+      .where(
+        inArray(
+          runtimeLogs.id,
+          logsDb
+            .select({ id: runtimeLogs.id })
+            .from(runtimeLogs)
+            .where(scope)
+            .orderBy(
+              desc(runtimeLogs.observedAt),
+              desc(runtimeLogs.createdAt),
+              desc(runtimeLogs.id),
+            )
+            .offset(maxRuntimeLogRowsPerRuntime)
+            .limit(runtimeLogPruneBatchSize),
+        ),
+      )
+  }
+}
+
+function hashRuntimeLogLine({
+  runtimeId,
+  service,
+  observedAt,
+  content,
+}: {
+  runtimeId: string
+  service: string
+  observedAt: Date
+  content: string
+}) {
+  return createHash('sha256')
+    .update(runtimeId)
+    .update('\0')
+    .update(service)
+    .update('\0')
+    .update(observedAt.toISOString())
+    .update('\0')
+    .update(content)
+    .digest('hex')
+}

package/src/server/agents/runtime-state.ts

@@ -0,0 +1,125 @@
+import { sql } from 'drizzle-orm'
+import type { SQL } from 'drizzle-orm'
+import type { AtomicStore } from '#devpush/server/db/atomic'
+import {
+  agentJobs,
+  agentRuntimeObservations,
+  deployments,
+  environments,
+  projects,
+} from '#devpush/server/db/schema'
+import { cleanupVolumeRetentionMs } from './cleanup'
+import type { ReportedRuntime } from './reconciliation'
+
+export async function reconcileRuntimeState(
+  store: AtomicStore,
+  input: {
+    serverId: string
+    runtimeIds: string[]
+    runtimes: ReportedRuntime[]
+    now: Date
+  },
+) {
+  const now = input.now.getTime()
+  const services = new Map(
+    input.runtimes.map((runtime) => [runtime.runtimeId, runtime.services]),
+  )
+  const reportedServices = JSON.stringify([...services.keys()])
+  const observations = []
+  for (let offset = 0; offset < input.runtimeIds.length; offset += 8) {
+    const rows = input.runtimeIds.slice(offset, offset + 8).map(
+      (runtimeId) => sql`(
+      ${crypto.randomUUID()}, ${input.serverId}, ${runtimeId},
+      ${services.has(runtimeId) ? JSON.stringify(services.get(runtimeId)) : null}, ${now}, ${now}, ${now}, ${now})`,
+    )
+    observations.push(
+      store.run(sql`insert into ${agentRuntimeObservations}
+      (id, server_id, runtime_id, services, first_seen_at, last_seen_at, created_at, updated_at)
+      values ${sql.join(rows, sql`, `)} on conflict(server_id, runtime_id) do update set
+      last_seen_at = excluded.last_seen_at, updated_at = excluded.updated_at,
+      services = case when runtime_id in (select value from json_each(${reportedServices}))
+        then excluded.services else services end`),
+    )
+  }
+  // Decide whether a runtime is still needed inside the same write batch that
+  // enqueues cleanup. Assignment or deployment changes cannot race this check.
+  const needed = sql`exists(select 1 from ${environments} as env join ${projects} as project on project.id = env.project_id
+      where env.runtime_id = ob.runtime_id and env.status = 'active'
+        and coalesce(env.server_id, project.default_server_id) = ${input.serverId})
+    or exists(select 1 from ${deployments} as deployment
+      where deployment.runtime_id = ob.runtime_id and deployment.server_id = ${input.serverId}
+        and deployment.status in ('queued', 'running'))`
+  const orphan = sql`substr(ob.runtime_id, 1, 3) = 'dp_'
+    and not (${needed})
+    and not exists(select 1 from ${agentJobs} as job
+      where job.server_id = ${input.serverId} and job.type in ('deprovision', 'purge')
+        and job.status in ('queued', 'running') and json_type(job.payload, '$.runtimeIds') = 'array'
+        and exists(select 1 from json_each(job.payload, '$.runtimeIds') as runtime
+          where runtime.type = 'text' and runtime.value = ob.runtime_id))`
+  const cleanupId = crypto.randomUUID()
+  const purgeId = crypto.randomUUID()
+  const queue = (
+    id: string,
+    type: 'deprovision' | 'purge',
+    eligible: SQL,
+    reason: string,
+  ) =>
+    store.run(sql`
+    insert into ${agentJobs} (id, type, status, server_id, payload, max_attempts, available_at, created_at, updated_at)
+    select ${id}, ${type}, 'queued', ${input.serverId},
+      json_object('schemaVersion', 1, 'runtimeIds', json_group_array(runtime_id),
+        'removeVolumes', json(${type === 'purge' ? 'true' : 'false'}), 'reason', ${reason}),
+      10, ${now}, ${now}, ${now}
+    from (select ob.runtime_id from ${agentRuntimeObservations} as ob
+      where ob.server_id = ${input.serverId} and ${eligible} and ${orphan} order by ob.runtime_id limit 200)
+    having count(*) > 0`)
+  const cleanup = queue(
+    cleanupId,
+    'deprovision',
+    sql`ob.cleanup_queued_at is null and ob.first_seen_at <= ${now - 10 * 60 * 1000}
+      and ob.runtime_id in (select value from json_each(${JSON.stringify(input.runtimeIds)}))`,
+    'devpush detected a Compose runtime that is no longer assigned.',
+  )
+  const markCleanup =
+    store.all(sql`update ${agentRuntimeObservations} set cleanup_queued_at = ${now}, updated_at = ${now}
+    where server_id = ${input.serverId} and runtime_id in (
+      select runtime.value from ${agentJobs} as job, json_each(job.payload, '$.runtimeIds') as runtime where job.id = ${cleanupId})
+    returning runtime_id`)
+  const purge = queue(
+    purgeId,
+    'purge',
+    sql`ob.cleanup_queued_at <= ${now - cleanupVolumeRetentionMs} and ob.purge_queued_at is null`,
+    'devpush detected retained volumes for a Compose runtime that is no longer assigned.',
+  )
+  const markPurge =
+    store.all(sql`update ${agentRuntimeObservations} set purge_queued_at = ${now}, updated_at = ${now}
+    where server_id = ${input.serverId} and runtime_id in (
+      select runtime.value from ${agentJobs} as job, json_each(job.payload, '$.runtimeIds') as runtime where job.id = ${purgeId})
+    returning runtime_id`)
+  // A reused runtime starts a new orphan lifecycle when it is detached again.
+  // Pending cleanup alone is not ownership and must not reset the grace period.
+  const resetOwned = store.run(sql`update ${agentRuntimeObservations} as ob
+    set cleanup_queued_at = null, purge_queued_at = null, first_seen_at = ${now}, updated_at = ${now}
+    where ob.server_id = ${input.serverId} and (${needed})`)
+  const tail = [resetOwned, cleanup, markCleanup, purge, markPurge] as const
+  const [first, ...rest] = observations
+  const results = first
+    ? await store.batch([first, ...rest, ...tail])
+    : await store.batch(tail)
+  const runtimeIds: string[] = []
+  for (const result of [results.at(-3), results.at(-1)]) {
+    if (!Array.isArray(result))
+      throw new Error('Invalid runtime reconciliation result.')
+    for (const row of result as unknown[]) {
+      const id = Array.isArray(row)
+        ? row[0]
+        : typeof row === 'object' && row !== null && 'runtime_id' in row
+          ? row.runtime_id
+          : undefined
+      if (typeof id !== 'string')
+        throw new Error('Invalid runtime reconciliation result.')
+      runtimeIds.push(id)
+    }
+  }
+  return runtimeIds
+}

package/src/server/api/admission.ts

@@ -0,0 +1,12 @@
+import type { SQL } from 'drizzle-orm'
+import type { AtomicStore } from '#devpush/server/db/atomic'
+
+// Domain services commit these statements in the same transaction as their
+// effect. The guard is checked by the effect itself, after any provider reads.
+export type ApiMutationAdmission = {
+  guard: SQL
+  statements: ReturnType<AtomicStore['run']>[]
+  resourceId: string
+  secondaryResourceId?: string
+  idempotencyId?: string
+}

package/src/server/api/authorization.ts

@@ -0,0 +1,115 @@
+import { sql } from 'drizzle-orm'
+import { apiRoleRank, apiScopeDefinitions } from '#devpush/lib/api-key-schema'
+import { PublicError } from '#devpush/lib/public-error'
+import type { ApiScope } from '#devpush/lib/api-key-schema'
+import type { TeamRole } from '#devpush/lib/team-role'
+import {
+  apiGrants,
+  apiKeys,
+  projects,
+  teamMembers,
+  teams,
+  user,
+} from '#devpush/server/db/schema'
+
+export type ApiPrincipal = {
+  userId: string
+  teamId: string
+  membershipId: string
+  roleCeiling: TeamRole
+  projectIds: string[] | null
+  scopes: string[]
+  credentialId: string
+  credentialKind?: 'api_key' | 'oauth'
+  providerGrantId?: string | null
+}
+
+export function requireApiScope(
+  principal: ApiPrincipal,
+  scope: string,
+  minimumRole: TeamRole = 'member',
+) {
+  const definition = Object.hasOwn(apiScopeDefinitions, scope)
+    ? apiScopeDefinitions[scope as ApiScope]
+    : undefined
+  if (
+    !definition ||
+    !principal.scopes.includes(scope) ||
+    apiRoleRank[principal.roleCeiling] <
+      Math.max(apiRoleRank[definition.minimumRole], apiRoleRank[minimumRole])
+  ) {
+    throw new PublicError('FORBIDDEN')
+  }
+}
+
+export function requireApiProject(principal: ApiPrincipal, projectId: string) {
+  if (
+    principal.projectIds !== null &&
+    !principal.projectIds.includes(projectId)
+  ) {
+    throw new PublicError('FORBIDDEN')
+  }
+}
+
+/** Recheck live credentials and membership at the SQL admission point. */
+export function apiAuthorizationCondition(
+  principal: ApiPrincipal,
+  options: {
+    scope?: string
+    projectId?: string
+    teamId?: string
+    minimumRole?: TeamRole
+    allowDeletedProject?: boolean
+  } = {},
+) {
+  if (options.teamId && options.teamId !== principal.teamId) return sql`0`
+  if (
+    options.projectId &&
+    principal.projectIds !== null &&
+    !principal.projectIds.includes(options.projectId)
+  )
+    return sql`0`
+  const definition =
+    options.scope && Object.hasOwn(apiScopeDefinitions, options.scope)
+      ? apiScopeDefinitions[options.scope as ApiScope]
+      : undefined
+  if (
+    options.scope &&
+    (!definition || !principal.scopes.includes(options.scope))
+  )
+    return sql`0`
+  const rank = Math.max(
+    apiRoleRank[options.minimumRole ?? 'member'],
+    apiRoleRank[definition?.minimumRole ?? 'member'],
+  )
+  if (apiRoleRank[principal.roleCeiling] < rank) return sql`0`
+  const credential = principal.credentialKind === 'oauth' ? apiGrants : apiKeys
+  const expirationGuard =
+    principal.credentialKind === 'oauth'
+      ? sql`credential.expires_at > cast(unixepoch('subsec') * 1000 as integer)`
+      : sql`(credential.expires_at is null or credential.expires_at > cast(unixepoch('subsec') * 1000 as integer))`
+  const scopeGuard = options.scope
+    ? sql`exists(select 1 from json_each(credential.scopes) where value = ${options.scope})`
+    : sql`1`
+  const projectGuard = options.projectId
+    ? sql`exists(select 1 from ${projects} as granted_project where granted_project.id = ${options.projectId} and granted_project.team_id = ${principal.teamId} and ${options.allowDeletedProject ? sql`granted_project.status in ('active','deleted')` : sql`granted_project.status = 'active'`})
+    and (credential.project_ids is null or exists(select 1 from json_each(credential.project_ids) where value = ${options.projectId}))`
+    : sql`1`
+  const roleRank = (column: ReturnType<typeof sql>) =>
+    sql`case ${column} when 'owner' then 2 when 'admin' then 1 else 0 end`
+  return sql`exists (
+    select 1 from ${credential} as credential
+    join ${teamMembers} as membership on membership.id = credential.membership_id
+    join ${user} as actor on actor.id = credential.user_id
+    join ${teams} as actor_team on actor_team.id = credential.team_id
+    where credential.id = ${principal.credentialId}
+      and credential.user_id = ${principal.userId} and credential.team_id = ${principal.teamId}
+      and credential.membership_id = ${principal.membershipId}
+      and membership.user_id = credential.user_id and membership.team_id = credential.team_id
+      and actor.status = 'active' and actor_team.status = 'active'
+      and credential.revoked_at is null and ${expirationGuard}
+      and ${roleRank(sql`membership.role`)} >= ${rank}
+      and ${roleRank(sql`credential.role_ceiling`)} >= ${rank}
+      and ${scopeGuard} and ${projectGuard}
+  )`
+}