devpush 0.0.0-stage → 1.0.0-beta.4

package/src/server/backups/storage-functions.ts

@@ -0,0 +1,42 @@
+import { settingsVersionSchema } from '#devpush/lib/settings-version'
+import { publicErrorsMiddleware } from '#devpush/server/http/public-errors'
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { backupStorageSchema } from '#devpush/lib/backup-storage-schema'
+import { requireAuthSession } from '#devpush/server/auth/session.server'
+import { saveBackupStorage, deleteBackupStorage } from './storage'
+import { requireBackupsEnabled } from './feature'
+
+export const saveBackupStorageAction = createServerFn({ method: 'POST' })
+  .middleware([publicErrorsMiddleware])
+  .validator((data: unknown) =>
+    z
+      .object({
+        teamSlug: z.string().min(1),
+        settingsVersion: settingsVersionSchema.nullable(),
+        input: backupStorageSchema,
+      })
+      .parse(data),
+  )
+  .handler(async ({ data }) => {
+    requireBackupsEnabled()
+    const session = await requireAuthSession()
+    return saveBackupStorage({ userId: session.user.id, ...data })
+  })
+
+export const deleteBackupStorageAction = createServerFn({ method: 'POST' })
+  .middleware([publicErrorsMiddleware])
+  .validator((data: unknown) =>
+    z
+      .object({
+        teamSlug: z.string().min(1),
+        settingsVersion: settingsVersionSchema,
+        storageId: z.string().min(1),
+      })
+      .parse(data),
+  )
+  .handler(async ({ data }) => {
+    requireBackupsEnabled()
+    const session = await requireAuthSession()
+    return deleteBackupStorage({ userId: session.user.id, ...data })
+  })

package/src/server/backups/storage-state.ts

@@ -0,0 +1,67 @@
+import { sql } from 'drizzle-orm'
+import type { AtomicStore } from '#devpush/server/db/atomic'
+import type { ApiMutationAdmission } from '#devpush/server/api/admission'
+import { teamSettingsAccess } from '#devpush/server/settings-version'
+
+type StorageValues = {
+  name: string
+  bucket: string
+  region: string
+  endpoint: string | null
+  accessKeyId: string
+  secretAccessKeyCiphertext: string
+}
+
+export async function saveBackupStorageState(
+  store: AtomicStore,
+  input: {
+    teamId: string
+    userId: string
+    storageId: string
+    settingsVersion: number | null
+    values: StorageValues
+    now: Date
+    admission?: ApiMutationAdmission
+  },
+) {
+  const v = input.values
+  const access = sql`${teamSettingsAccess(input.teamId, input.userId)} and ${input.admission?.guard ?? sql`1`}`
+  const now = input.now.getTime()
+  const effect =
+    input.settingsVersion === null
+      ? store.all(sql`insert into backup_storage (id,team_id,name,bucket,region,endpoint,access_key_id,secret_access_key_ciphertext,created_at,updated_at)
+      select ${input.storageId},${input.teamId},${v.name},${v.bucket},${v.region},${v.endpoint},${v.accessKeyId},${v.secretAccessKeyCiphertext},${now},${now} where ${access} returning id`)
+      : store.all(sql`update backup_storage set settings_version = settings_version + 1,
+      name = ${v.name},access_key_id = ${v.accessKeyId},secret_access_key_ciphertext = ${v.secretAccessKeyCiphertext},updated_at = ${now}
+      where id = ${input.storageId} and team_id = ${input.teamId} and settings_version = ${input.settingsVersion}
+      and bucket = ${v.bucket} and region = ${v.region} and coalesce(endpoint,'') = ${v.endpoint ?? ''} and ${access} returning id`)
+  const [rows] = await store.batch([
+    effect,
+    ...(input.admission?.statements ?? []),
+  ])
+  return rows.length === 1
+}
+
+export async function deleteBackupStorageState(
+  store: AtomicStore,
+  input: {
+    teamId: string
+    userId: string
+    storageId: string
+    settingsVersion: number
+    admission?: ApiMutationAdmission
+  },
+) {
+  // A cleanup completion can remove only local files. Remaining remote artifact
+  // rows, not the run's last-cleanup timestamp, decide whether credentials are needed.
+  const unreferenced = sql`not exists(select 1 from backup_configs where json_extract(destination,'$.storageId') = ${input.storageId})
+    and not exists(select 1 from backup_runs as run where json_extract(run.destination,'$.storageId') = ${input.storageId}
+      and (run.status in ('queued','running') or exists(select 1 from backup_artifacts where backup_run_id = run.id and storage = 'remote')))`
+  const [rows] = await store.batch([
+    store.all(sql`delete from backup_storage where id = ${input.storageId} and team_id = ${input.teamId}
+      and settings_version = ${input.settingsVersion} and ${teamSettingsAccess(input.teamId, input.userId)}
+      and ${input.admission?.guard ?? sql`1`} and ${unreferenced} returning id`),
+    ...(input.admission?.statements ?? []),
+  ])
+  return rows.length === 1
+}

package/src/server/backups/storage.ts

@@ -0,0 +1,237 @@
+import { withWorkspaceAccess } from '#devpush/server/plugins/workspace-access'
+import {
+  saveBackupStorageState,
+  deleteBackupStorageState,
+} from './storage-state'
+import { requireBackupsEnabled } from '#devpush/server/backups/feature'
+import { PublicError } from '#devpush/lib/public-error'
+import { and, asc, eq } from 'drizzle-orm'
+import { backupStorageSchema } from '#devpush/lib/backup-storage-schema'
+import type {
+  BackupStorageInput,
+  BackupStorageSummary,
+  BackupStorageReference,
+} from '#devpush/lib/backup-storage-schema'
+import { db } from '#devpush/server/db'
+import { backupStorage } from '#devpush/server/db/schema'
+import { encryptSecret } from '#devpush/server/secrets/crypto'
+import { requireTeam, requireTeamManager } from '#devpush/server/teams/service'
+import type { BackupDestination } from './service'
+
+export async function listBackupStorage(
+  teamId: string,
+  includeAccessKey = false,
+): Promise<BackupStorageSummary[]> {
+  const rows = await db
+    .select({
+      settingsVersion: backupStorage.settingsVersion,
+      id: backupStorage.id,
+      name: backupStorage.name,
+      bucket: backupStorage.bucket,
+      region: backupStorage.region,
+      endpoint: backupStorage.endpoint,
+      accessKeyId: backupStorage.accessKeyId,
+    })
+    .from(backupStorage)
+    .where(eq(backupStorage.teamId, teamId))
+    .orderBy(asc(backupStorage.name))
+  return rows.map(({ accessKeyId, ...row }) => ({
+    ...row,
+    hasSecret: true,
+    ...(includeAccessKey ? { accessKeyId } : {}),
+  }))
+}
+
+export async function getBackupStorage({
+  userId,
+  teamSlug,
+}: {
+  userId: string
+  teamSlug: string
+}) {
+  const team = await requireTeam(userId, teamSlug)
+  return listBackupStorage(team.id, team.role !== 'member')
+}
+
+export async function saveBackupStorage({
+  userId,
+  teamSlug,
+  input,
+  settingsVersion,
+}: {
+  userId: string
+  teamSlug: string
+  settingsVersion?: number | null
+  input: BackupStorageInput
+}) {
+  requireBackupsEnabled()
+  const team = await requireTeamManager(userId, teamSlug)
+  return withWorkspaceAccess(
+    team.id,
+    'backup.storage.save',
+    async () => {
+      const prepared = await prepareBackupStorage({
+        teamId: team.id,
+        input,
+        settingsVersion,
+      })
+      const changed = await saveBackupStorageState(db, {
+        teamId: team.id,
+        userId,
+        storageId: prepared.id,
+        settingsVersion: prepared.settingsVersion,
+        values: prepared.values,
+        now: new Date(),
+      })
+      if (!changed)
+        throw new PublicError(
+          prepared.settingsVersion === null ? 'FORBIDDEN' : 'SETTINGS_CONFLICT',
+        )
+      return listBackupStorage(team.id, true)
+    },
+    { kind: 'user', userId },
+  )
+}
+
+export async function resolveBackupDestination(
+  teamId: string,
+  reference: BackupStorageReference,
+): Promise<BackupDestination> {
+  if (!reference.storageId) throw new PublicError('BACKUP_STORAGE_REQUIRED')
+  const row = (
+    await db
+      .select()
+      .from(backupStorage)
+      .where(
+        and(
+          eq(backupStorage.id, reference.storageId),
+          eq(backupStorage.teamId, teamId),
+        ),
+      )
+      .limit(1)
+  ).at(0)
+  if (!row) throw new PublicError('BACKUP_STORAGE_TEAM_MISMATCH')
+  return {
+    storageId: row.id,
+    bucket: row.bucket,
+    region: row.region,
+    endpoint: row.endpoint ?? undefined,
+    prefix: reference.prefix,
+    accessKeyId: row.accessKeyId,
+    secretAccessKeyCiphertext: row.secretAccessKeyCiphertext,
+  }
+}
+
+export async function refreshBackupCredentials(
+  teamId: string,
+  snapshot: BackupDestination,
+): Promise<BackupDestination> {
+  if (!snapshot.storageId) throw new PublicError('BACKUP_STORAGE_REQUIRED')
+  const current = await resolveBackupDestination(teamId, {
+    storageId: snapshot.storageId,
+  })
+  return {
+    ...snapshot,
+    accessKeyId: current.accessKeyId,
+    secretAccessKeyCiphertext: current.secretAccessKeyCiphertext,
+  }
+}
+
+export async function deleteBackupStorage({
+  userId,
+  teamSlug,
+  storageId,
+  settingsVersion,
+}: {
+  userId: string
+  teamSlug: string
+  settingsVersion?: number
+  storageId: string
+}) {
+  requireBackupsEnabled()
+  const team = await requireTeamManager(userId, teamSlug)
+  return withWorkspaceAccess(
+    team.id,
+    'backup.storage.delete',
+    async () => {
+      const current = await getOwnedBackupStorage(team.id, storageId)
+      if (!current) throw new PublicError('BACKUP_STORAGE_NOT_FOUND')
+      const expectedVersion = settingsVersion ?? current.settingsVersion
+      if (expectedVersion !== current.settingsVersion)
+        throw new PublicError('SETTINGS_CONFLICT')
+      const changed = await deleteBackupStorageState(db, {
+        teamId: team.id,
+        userId,
+        storageId,
+        settingsVersion: expectedVersion,
+      })
+      if (!changed) {
+        await requireTeamManager(userId, teamSlug)
+        const latest = await getOwnedBackupStorage(team.id, storageId)
+        if (!latest || latest.settingsVersion !== expectedVersion)
+          throw new PublicError('SETTINGS_CONFLICT')
+        throw new PublicError('BACKUP_STORAGE_IN_USE')
+      }
+      return listBackupStorage(team.id, true)
+    },
+    { kind: 'user', userId },
+  )
+}
+
+export async function getOwnedBackupStorage(teamId: string, storageId: string) {
+  const [row] = await db
+    .select()
+    .from(backupStorage)
+    .where(
+      and(eq(backupStorage.id, storageId), eq(backupStorage.teamId, teamId)),
+    )
+    .limit(1)
+  return row
+}
+
+export async function prepareBackupStorage({
+  teamId,
+  input,
+  settingsVersion,
+  newStorageId,
+}: {
+  teamId: string
+  input: unknown
+  settingsVersion?: number | null
+  newStorageId?: string
+}) {
+  const parsed = backupStorageSchema.parse(input)
+  const existing = parsed.id
+    ? await getOwnedBackupStorage(teamId, parsed.id)
+    : undefined
+  if (parsed.id && !existing) throw new PublicError('BACKUP_STORAGE_NOT_FOUND')
+  if (!existing && !parsed.secretAccessKey)
+    throw new PublicError('BACKUP_STORAGE_SECRET_REQUIRED')
+  if (
+    existing &&
+    (existing.bucket !== parsed.bucket ||
+      existing.region !== parsed.region ||
+      (existing.endpoint ?? '') !== parsed.endpoint)
+  ) {
+    throw new PublicError('BACKUP_STORAGE_LOCATION_IMMUTABLE')
+  }
+  const expectedVersion = existing
+    ? (settingsVersion ?? existing.settingsVersion)
+    : null
+  if (existing && expectedVersion !== existing.settingsVersion)
+    throw new PublicError('SETTINGS_CONFLICT')
+  return {
+    id: existing?.id ?? newStorageId ?? crypto.randomUUID(),
+    settingsVersion: expectedVersion,
+    values: {
+      name: parsed.name,
+      bucket: parsed.bucket,
+      region: parsed.region,
+      endpoint: parsed.endpoint || null,
+      accessKeyId: parsed.accessKeyId,
+      secretAccessKeyCiphertext: parsed.secretAccessKey
+        ? encryptSecret(parsed.secretAccessKey)
+        : existing!.secretAccessKeyCiphertext,
+    },
+  }
+}

package/src/server/config.ts

@@ -0,0 +1,274 @@
+import agentRelease from '../../agent-release.json'
+import { z } from 'zod'
+
+function normalizeOptional(value: unknown) {
+  if (value === '') {
+    return undefined
+  }
+
+  if (typeof value !== 'string') {
+    return value
+  }
+
+  const trimmed = value.trim()
+  if (
+    (trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+    (trimmed.startsWith("'") && trimmed.endsWith("'"))
+  ) {
+    return trimmed.slice(1, -1)
+  }
+
+  return value
+}
+
+const optionalString = z.preprocess(
+  normalizeOptional,
+  z.string().min(1).optional(),
+)
+const optionalUrl = z.preprocess(normalizeOptional, z.string().url().optional())
+const optionalEmail = z.preprocess(
+  (value) => (value === '' ? undefined : value),
+  z.string().email().optional(),
+)
+const envBoolean = z.preprocess(
+  (value) => (typeof value === 'string' ? value.toLowerCase() : value),
+  z.enum(['true', 'false']).transform((value) => value === 'true'),
+)
+
+const envSchema = z
+  .object({
+    DEVPUSH_DATABASE_URL: optionalString,
+    DEVPUSH_LOG_DATABASE_URL: optionalString,
+    DEVPUSH_DATABASE_AUTH_TOKEN: optionalString,
+    DEVPUSH_LOG_DATABASE_AUTH_TOKEN: optionalString,
+    DEVPUSH_DATABASE_PATH: z.string().min(1).default('.data/devpush.sqlite'),
+    DEVPUSH_LOG_DATABASE_PATH: z.string().min(1).default('.data/logs.sqlite'),
+    BETTER_AUTH_SECRET: z.string().min(1).default('dev-secret-change-me'),
+    DEVPUSH_BASE_URL: z.string().url().default('http://localhost:7429'),
+    BETTER_AUTH_URL: optionalUrl,
+    DEVPUSH_MCP_URL: optionalUrl,
+    DEVPUSH_ADMIN_EMAIL: optionalEmail,
+    EMAIL_FROM: optionalString,
+    RESEND_API_KEY: optionalString,
+    GOOGLE_CLIENT_ID: optionalString,
+    GOOGLE_CLIENT_SECRET: optionalString,
+    GITHUB_APP_CLIENT_ID: optionalString,
+    GITHUB_APP_CLIENT_SECRET: optionalString,
+    GITHUB_APP_ID: optionalString,
+    GITHUB_APP_NAME: optionalString,
+    GITHUB_APP_PRIVATE_KEY: optionalString,
+    GITHUB_APP_WEBHOOK_SECRET: optionalString,
+    DEVPUSH_SMOKE_GITHUB_TOKEN: optionalString,
+    DEVPUSH_AGENT_BINARY_DIR: optionalString,
+    DEVPUSH_RECOMMENDED_AGENT_VERSION: optionalString,
+    DEVPUSH_STORAGE_ENDPOINT: optionalString,
+    DEVPUSH_STORAGE_REGION: optionalString,
+    DEVPUSH_STORAGE_BUCKET: optionalString,
+    DEVPUSH_STORAGE_ACCESS_KEY_ID: optionalString,
+    DEVPUSH_STORAGE_SECRET_ACCESS_KEY: optionalString,
+    DEVPUSH_CRON_SECRET: optionalString,
+    DEVPUSH_BACKUPS_ENABLED: envBoolean.default(false),
+    DEVPUSH_AGENT_AUTO_UPDATE: envBoolean.default(false),
+    DEVPUSH_TRUST_PROXY: envBoolean.default(false),
+    DEVPUSH_CLIENT_IP_HEADER: z
+      .enum(['x-forwarded-for', 'x-real-ip'])
+      .default('x-forwarded-for'),
+    DEVPUSH_DEPLOYMENT_QUEUE_TTL_HOURS: z.coerce
+      .number()
+      .int()
+      .min(1)
+      .max(720)
+      .default(24),
+    DEVPUSH_DEPLOYMENT_LOG_MAX_LINES: z.coerce
+      .number()
+      .int()
+      .min(1)
+      .max(100_000)
+      .default(5_000),
+    DEVPUSH_DEPLOYMENT_LOG_LINE_BYTES: z.coerce
+      .number()
+      .int()
+      .min(64)
+      .max(65_536)
+      .default(2_048),
+    DEVPUSH_MONITORING_RETENTION_DAYS: z.coerce
+      .number()
+      .int()
+      .min(2)
+      .max(3650)
+      .default(7),
+    DEVPUSH_SECRET_ENCRYPTION_KEY: optionalString,
+    DEVPUSH_TRAEFIK_EMAIL: optionalEmail,
+  })
+  .superRefine((value, context) => {
+    for (const key of ['DEVPUSH_BASE_URL', 'BETTER_AUTH_URL'] as const) {
+      const raw = value[key]
+      if (!raw) continue
+      let url: URL
+      try {
+        url = new URL(raw)
+      } catch {
+        continue // The field schema reports malformed URLs.
+      }
+      if (
+        !['http:', 'https:'].includes(url.protocol) ||
+        url.username ||
+        url.password ||
+        url.pathname !== '/' ||
+        raw.includes('?') ||
+        raw.includes('#')
+      ) {
+        context.addIssue({
+          code: 'custom',
+          path: [key],
+          message: `${key} must be an HTTP(S) origin without credentials, path, query or fragment.`,
+        })
+      }
+      if (url.protocol === 'http:' && !isLocalMcpHostname(url.hostname)) {
+        context.addIssue({
+          code: 'custom',
+          path: [key],
+          message: `${key} must use HTTPS except for local development hosts.`,
+        })
+      }
+    }
+    let mcpUrl: URL
+    try {
+      mcpUrl = new URL(value.DEVPUSH_MCP_URL ?? '/mcp', value.DEVPUSH_BASE_URL)
+    } catch {
+      context.addIssue({
+        code: 'custom',
+        path: ['DEVPUSH_MCP_URL'],
+        message: 'DEVPUSH_MCP_URL requires a valid full endpoint and base URL.',
+      })
+      return
+    }
+    if (
+      mcpUrl.username ||
+      mcpUrl.password ||
+      mcpUrl.search ||
+      mcpUrl.hash ||
+      mcpUrl.href.includes('?') ||
+      mcpUrl.href.includes('#') ||
+      mcpUrl.pathname !== '/mcp' ||
+      !['http:', 'https:'].includes(mcpUrl.protocol)
+    ) {
+      context.addIssue({
+        code: 'custom',
+        path: ['DEVPUSH_MCP_URL'],
+        message:
+          'DEVPUSH_MCP_URL must be the full HTTP(S) /mcp endpoint without credentials, query or fragment.',
+      })
+    }
+    if (mcpUrl.protocol === 'http:' && !isLocalMcpHostname(mcpUrl.hostname)) {
+      context.addIssue({
+        code: 'custom',
+        path: ['DEVPUSH_MCP_URL'],
+        message:
+          'DEVPUSH_MCP_URL must use HTTPS except for local development hosts.',
+      })
+    }
+    const storageValues = [
+      value.DEVPUSH_STORAGE_ENDPOINT,
+      value.DEVPUSH_STORAGE_BUCKET,
+      value.DEVPUSH_STORAGE_ACCESS_KEY_ID,
+      value.DEVPUSH_STORAGE_SECRET_ACCESS_KEY,
+    ]
+
+    if (storageValues.some(Boolean) && storageValues.some((item) => !item)) {
+      context.addIssue({
+        code: 'custom',
+        path: ['DEVPUSH_STORAGE_ENDPOINT'],
+        message:
+          'Endpoint, bucket, access key ID, and secret access key are all required for object storage.',
+      })
+    }
+  })
+  .transform((value) => ({
+    ...value,
+    BETTER_AUTH_URL: value.BETTER_AUTH_URL ?? value.DEVPUSH_BASE_URL,
+    DEVPUSH_MCP_URL: new URL(
+      value.DEVPUSH_MCP_URL ?? '/mcp',
+      value.DEVPUSH_BASE_URL,
+    ).toString(),
+  }))
+
+export function parseConfig(env: NodeJS.ProcessEnv) {
+  return envSchema.parse(env)
+}
+
+function isLocalMcpHostname(hostname: string) {
+  const host = hostname
+    .toLowerCase()
+    .replace(/^\[|\]$/g, '')
+    .replace(/\.$/, '')
+  return (
+    host === 'localhost' ||
+    host.endsWith('.localhost') ||
+    host === 'host.lima.internal' ||
+    host === '::1' ||
+    /^127(?:\.\d{1,3}){3}$/.test(host)
+  )
+}
+
+export function assertRuntimeSecurity(value: ReturnType<typeof parseConfig>) {
+  const isLocal = [
+    value.DEVPUSH_BASE_URL,
+    value.BETTER_AUTH_URL,
+    value.DEVPUSH_MCP_URL,
+  ].every((url) => isLocalMcpHostname(new URL(url).hostname))
+
+  if (isLocal) {
+    return
+  }
+
+  if (
+    value.BETTER_AUTH_SECRET === 'dev-secret-change-me' ||
+    value.BETTER_AUTH_SECRET.startsWith('replace-with-') ||
+    value.BETTER_AUTH_SECRET.length < 32
+  ) {
+    throw new Error(
+      'BETTER_AUTH_SECRET must be a generated secret with at least 32 characters.',
+    )
+  }
+
+  if (!value.DEVPUSH_SECRET_ENCRYPTION_KEY) {
+    throw new Error('DEVPUSH_SECRET_ENCRYPTION_KEY is required.')
+  }
+
+  if (value.DEVPUSH_SECRET_ENCRYPTION_KEY.length < 32) {
+    throw new Error(
+      'DEVPUSH_SECRET_ENCRYPTION_KEY must contain at least 32 characters.',
+    )
+  }
+
+  if (value.DEVPUSH_SECRET_ENCRYPTION_KEY.startsWith('replace-with-')) {
+    throw new Error(
+      'DEVPUSH_SECRET_ENCRYPTION_KEY must be a generated secret, not an example placeholder.',
+    )
+  }
+
+  if (value.DEVPUSH_SECRET_ENCRYPTION_KEY === value.BETTER_AUTH_SECRET) {
+    throw new Error(
+      'DEVPUSH_SECRET_ENCRYPTION_KEY must differ from BETTER_AUTH_SECRET.',
+    )
+  }
+
+  if (
+    value.DEVPUSH_CRON_SECRET &&
+    (value.DEVPUSH_CRON_SECRET.length < 32 ||
+      value.DEVPUSH_CRON_SECRET.startsWith('replace-with-'))
+  ) {
+    throw new Error(
+      'DEVPUSH_CRON_SECRET must be a generated secret with at least 32 characters.',
+    )
+  }
+
+  if (value.DEVPUSH_CRON_SECRET === value.BETTER_AUTH_SECRET) {
+    throw new Error('DEVPUSH_CRON_SECRET must differ from BETTER_AUTH_SECRET.')
+  }
+}
+
+export const config = parseConfig(process.env)
+
+export const currentAgentVersion = agentRelease.version

package/src/server/db/atomic.ts

@@ -0,0 +1,16 @@
+import type { BatchItem, BatchResponse } from 'drizzle-orm/batch'
+import type { SQL } from 'drizzle-orm'
+import type { SQLiteRaw } from 'drizzle-orm/sqlite-core/query-builders/raw'
+
+// Both drivers execute a prebuilt batch atomically. Queries must encode their
+// guards in SQL; reads made before the batch are not an authorization snapshot.
+export type AtomicStore = {
+  run: (query: SQL) => SQLiteRaw<unknown>
+  all: <T = unknown>(query: SQL) => SQLiteRaw<T[]>
+  batch: <
+    TItem extends BatchItem<'sqlite'>,
+    T extends Readonly<[TItem, ...TItem[]]>,
+  >(
+    queries: T,
+  ) => Promise<BatchResponse<T>>
+}