devpush 0.0.0-stage → 1.0.0-beta.4

package/src/server/projects/creation-state.ts

@@ -0,0 +1,46 @@
+import { sql } from 'drizzle-orm'
+import type { BaseSQLiteDatabase } from 'drizzle-orm/sqlite-core'
+import type { AtomicStore } from '#devpush/server/db/atomic'
+import * as schema from '#devpush/server/db/schema'
+import type { ApiMutationAdmission } from '#devpush/server/api/admission'
+import { createComposeRuntimeConfig } from '#devpush/lib/project-runtime-config'
+
+export async function insertProject(
+  store: Pick<BaseSQLiteDatabase<'async', unknown, typeof schema>, 'insert'> &
+    AtomicStore,
+  input: {
+    project: typeof schema.projects.$inferInsert
+    environment: typeof schema.environments.$inferInsert
+    hostname: string | null
+    https: boolean
+    userId?: string
+    admission?: ApiMutationAdmission
+  },
+) {
+  const p = input.project
+  const e = input.environment
+  const created = sql`exists(select 1 from ${schema.projects} where id = ${p.id})`
+  const actor = input.userId
+    ? sql`exists(select 1 from ${schema.teamMembers} m join ${schema.user} u on u.id = m.user_id join ${schema.teams} t on t.id = m.team_id where m.user_id = ${input.userId} and m.team_id = ${p.teamId} and u.status = 'active' and t.status = 'active')`
+    : sql`1`
+  const [inserted] = await store.batch([
+    store.all(sql`insert into ${schema.projects}
+      (id,team_id,slug,name,status,github_repo_id,github_repo,github_installation_id,default_server_id,routes,env_vars_encrypted,runtime_config,compose_metadata)
+      select ${p.id},${p.teamId},${p.slug},${p.name},'active',${p.githubRepoId ?? null},${p.githubRepo},${p.githubInstallationId ?? null},${p.defaultServerId ?? null},${p.routes == null ? null : JSON.stringify(p.routes)},${p.envVarsEncrypted ?? null},${JSON.stringify(p.runtimeConfig ?? createComposeRuntimeConfig())},${p.composeMetadata == null ? null : JSON.stringify(p.composeMetadata)}
+      where ${created} or (${actor} and ${input.admission?.guard ?? sql`1`} and (${p.defaultServerId ?? null} is null or exists(select 1 from ${schema.servers} where id = ${p.defaultServerId ?? null} and team_id = ${p.teamId} and status <> 'deleted'))) returning id`),
+    store.run(sql`insert into ${schema.environments} (id,project_id,server_id,name,slug,branch,is_production,position,color,status,runtime_id)
+      select ${e.id},${e.projectId},${e.serverId ?? null},${e.name},${e.slug},${e.branch},${Number(e.isProduction ?? false)},${e.position ?? 0},${e.color ?? 'blue'},${e.status ?? 'active'},${e.runtimeId} where ${created}`),
+    ...(input.hostname
+      ? [
+          store.run(sql`insert into aliases
+      (id, project_id, environment_id, hostname, type, https)
+      select ${crypto.randomUUID()}, ${input.project.id}, ${input.environment.id},
+        case when exists(select 1 from domains where hostname = ${input.hostname})
+          then null else ${input.hostname} end,
+        'environment', ${Number(input.https)} where ${created}`),
+        ]
+      : []),
+    ...(input.admission?.statements ?? []),
+  ])
+  return inserted.length === 1
+}

package/src/server/projects/deletion-state.ts

@@ -0,0 +1,69 @@
+import { releaseBackupCleanupRuns } from '#devpush/server/backups/queue-state'
+import type { ApiMutationAdmission } from '#devpush/server/api/admission'
+import { sql } from 'drizzle-orm'
+import type { AtomicStore } from '#devpush/server/db/atomic'
+import { runtimeCleanupInsert } from '#devpush/server/agents/cleanup'
+
+export async function deleteProjectState(
+  store: AtomicStore,
+  input: {
+    projectId: string
+    teamId: string
+    userId: string
+    removeDeployments: boolean
+    now: Date
+    admission?: ApiMutationAdmission
+  },
+) {
+  const now = input.now.getTime()
+  const guard = sql`exists(select 1 from projects p join teams t on t.id = p.team_id
+    join team_members m on m.team_id = t.id join user u on u.id = m.user_id
+    where p.id = ${input.projectId} and p.team_id = ${input.teamId} and p.status = 'active'
+      and t.status = 'active' and u.status = 'active' and m.user_id = ${input.userId}
+      and m.role in ('owner', 'admin')) and ${input.admission?.guard ?? sql`1`}`
+  const envIds = sql`select id from environments where project_id = ${input.projectId}`
+  const message = 'Canceled because the project was deleted.'
+  const results = await store.batch([
+    store.run(
+      releaseBackupCleanupRuns({
+        jobIds: sql`select id from agent_jobs where project_id = ${input.projectId}`,
+        guard,
+        message,
+        now: input.now,
+      }),
+    ),
+    store.run(sql`update agent_jobs set status = 'canceled', error_message = ${message},
+      finished_at = ${now}, updated_at = ${now} where project_id = ${input.projectId}
+      and type in ('deploy', 'backup', 'restore', 'backup_cleanup') and status in ('queued', 'running') and ${guard}`),
+    ...(input.removeDeployments
+      ? [
+          store.run(
+            runtimeCleanupInsert({
+              projectIds: sql`select id from projects where id = ${input.projectId}`,
+              projectId: input.projectId,
+              guard,
+              reason: 'Project deleted.',
+              now: input.now,
+            }),
+          ),
+        ]
+      : []),
+    store.run(sql`update backup_runs set status = 'canceled', error_message = ${message},
+      finished_at = ${now}, updated_at = ${now} where project_id = ${input.projectId}
+      and status in ('queued', 'running') and ${guard}`),
+    ...(input.removeDeployments
+      ? [
+          store.run(sql`update environments set status = 'deleted',
+      is_production = 0, updated_at = ${now} where project_id = ${input.projectId} and ${guard}`),
+        ]
+      : []),
+    store.run(sql`update deployments set status = 'canceled', phase = 'canceled', error_message = ${message},
+      finished_at = ${now} where environment_id in (${envIds}) and status in ('queued', 'running') and ${guard}`),
+    // Keep hostname reservations until the agent confirms container removal.
+    store.all(sql`update projects set status = 'deleted', updated_at = ${now} where id = ${input.projectId}
+      and ${guard} returning id`),
+    ...(input.admission?.statements ?? []),
+  ])
+  const changed = results.at(-1 - (input.admission?.statements.length ?? 0))
+  return Array.isArray(changed) && changed.length === 1
+}

package/src/server/projects/deployment-config.ts

@@ -0,0 +1,139 @@
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  randomBytes,
+} from 'node:crypto'
+import { z } from 'zod'
+
+import { config } from '#devpush/server/config'
+import { projectRuntimeConfigSchema } from '#devpush/lib/project-runtime-config'
+
+const deploymentRouteSchema = z.strictObject({
+  host: z.string().min(1),
+  service: z.string().min(1),
+  port: z.number().int().min(1).max(65_535),
+  path: z.string().regex(/^\//),
+  https: z.boolean(),
+  stripPrefix: z.boolean(),
+})
+
+const deploymentConfigSchema = z.strictObject({
+  schemaVersion: z.literal(1),
+  runtime: projectRuntimeConfigSchema,
+  routes: z.array(deploymentRouteSchema),
+})
+
+const deploymentEnvVarsSchema = z.array(
+  z.strictObject({
+    key: z.string(),
+    value: z.string(),
+  }),
+)
+
+export type DeploymentEnvVar = {
+  key: string
+  value: string
+}
+
+export type DeploymentCommitMeta = {
+  githubSenderId?: string
+  message: string | null
+  authorName: string | null
+  authoredAt: string | null
+  url: string | null
+}
+
+export type DeploymentConfig = z.infer<typeof deploymentConfigSchema>
+
+export function encryptDeploymentEnvVars(envVars: Array<DeploymentEnvVar>) {
+  return encryptJson(envVars)
+}
+
+export function decryptDeploymentEnvVars(
+  payload: string,
+): Array<DeploymentEnvVar> {
+  return deploymentEnvVarsSchema.parse(decryptJson(payload))
+}
+
+export function parseDeploymentConfig(value: unknown): DeploymentConfig | null {
+  const result = deploymentConfigSchema.safeParse(value)
+  return result.success ? result.data : null
+}
+
+export function toDeploymentCommitMeta(commit: {
+  message: string | null
+  authorName?: string | null
+  authoredAt?: string | null
+  url?: string | null
+}): DeploymentCommitMeta {
+  return {
+    message: commit.message,
+    authorName: commit.authorName ?? null,
+    authoredAt: commit.authoredAt ?? null,
+    url: commit.url ?? null,
+  }
+}
+
+export function normalizeDeploymentCommitMeta(
+  value: unknown,
+): DeploymentCommitMeta {
+  if (typeof value === 'object' && value !== null && 'message' in value) {
+    const record = value as Record<string, unknown>
+    return {
+      message: typeof record.message === 'string' ? record.message : null,
+      authorName:
+        typeof record.authorName === 'string' ? record.authorName : null,
+      authoredAt:
+        typeof record.authoredAt === 'string' ? record.authoredAt : null,
+      url: typeof record.url === 'string' ? record.url : null,
+      ...(typeof record.githubSenderId === 'string' &&
+      /^\d+$/.test(record.githubSenderId)
+        ? { githubSenderId: record.githubSenderId }
+        : {}),
+    }
+  }
+  return { message: null, authorName: null, authoredAt: null, url: null }
+}
+
+function encryptJson(value: unknown) {
+  const iv = randomBytes(12)
+  const cipher = createCipheriv('aes-256-gcm', encryptionKey(), iv)
+  const encrypted = Buffer.concat([
+    cipher.update(JSON.stringify(value), 'utf8'),
+    cipher.final(),
+  ])
+  const tag = cipher.getAuthTag()
+
+  return [
+    'v1',
+    iv.toString('base64url'),
+    tag.toString('base64url'),
+    encrypted.toString('base64url'),
+  ].join(':')
+}
+
+function decryptJson(payload: string): unknown {
+  const [version, ivValue, tagValue, encryptedValue] = payload.split(':')
+
+  if (version !== 'v1' || !ivValue || !tagValue || !encryptedValue) {
+    throw new Error('Invalid encrypted deployment payload.')
+  }
+
+  const decipher = createDecipheriv(
+    'aes-256-gcm',
+    encryptionKey(),
+    Buffer.from(ivValue, 'base64url'),
+  )
+  decipher.setAuthTag(Buffer.from(tagValue, 'base64url'))
+  const decrypted = Buffer.concat([
+    decipher.update(Buffer.from(encryptedValue, 'base64url')),
+    decipher.final(),
+  ])
+
+  return JSON.parse(decrypted.toString('utf8'))
+}
+
+function encryptionKey() {
+  return createHash('sha256').update(config.BETTER_AUTH_SECRET).digest()
+}

package/src/server/projects/deployment-logs.ts

@@ -0,0 +1,97 @@
+import { and, desc, eq, gte, inArray, like, sql } from 'drizzle-orm'
+import type { SQL } from 'drizzle-orm'
+
+import { db, logsDb } from '#devpush/server/db'
+import { deploymentLogs } from '#devpush/server/db/log-schema'
+import { deployments, environments } from '#devpush/server/db/schema'
+
+type Filters = {
+  projectId: string
+  branch?: string | null
+  deploymentId?: string | null
+  environmentId?: string | null
+  keyword?: string | null
+  since?: Date | null
+}
+type Line = {
+  deploymentId: string
+  stream: string
+  seq: number
+  content: string
+  createdAt: Date
+}
+
+// Call after main-project authorization. Denormalized identity filters the
+// large store; main lookups exclude output whose deployment has been removed.
+async function readOutput(filters: Filters, limit: number) {
+  const conditions: SQL[] = [eq(deploymentLogs.projectId, filters.projectId)]
+  if (filters.branch) conditions.push(eq(deploymentLogs.branch, filters.branch))
+  if (filters.deploymentId)
+    conditions.push(eq(deploymentLogs.deploymentId, filters.deploymentId))
+  if (filters.environmentId)
+    conditions.push(eq(deploymentLogs.environmentId, filters.environmentId))
+  if (filters.keyword)
+    conditions.push(
+      like(deploymentLogs.searchContent, `%${filters.keyword.toLowerCase()}%`),
+    )
+  if (filters.since)
+    conditions.push(gte(deploymentLogs.createdAt, filters.since))
+  const output: Line[] = []
+  let cursor: SQL | undefined
+  const pageSize = Math.min(200, Math.max(32, limit))
+  while (output.length < limit) {
+    const candidates = await logsDb
+      .select({
+        deploymentId: deploymentLogs.deploymentId,
+        stream: deploymentLogs.stream,
+        seq: deploymentLogs.seq,
+        content: deploymentLogs.content,
+        createdAt: deploymentLogs.createdAt,
+      })
+      .from(deploymentLogs)
+      .where(and(...conditions, cursor))
+      .orderBy(
+        desc(deploymentLogs.createdAt),
+        desc(deploymentLogs.deploymentId),
+        desc(deploymentLogs.stream),
+        desc(deploymentLogs.seq),
+      )
+      .limit(pageSize)
+    if (!candidates.length) break
+    const ids = [...new Set(candidates.map((line) => line.deploymentId))]
+    const live = new Set<string>()
+    for (let offset = 0; offset < ids.length; offset += 80) {
+      const rows = await db
+        .select({ id: deployments.id })
+        .from(deployments)
+        .innerJoin(environments, eq(environments.id, deployments.environmentId))
+        .where(
+          and(
+            eq(environments.projectId, filters.projectId),
+            inArray(deployments.id, ids.slice(offset, offset + 80)),
+            filters.branch
+              ? eq(deployments.gitBranch, filters.branch)
+              : undefined,
+            filters.environmentId
+              ? eq(deployments.environmentId, filters.environmentId)
+              : undefined,
+          ),
+        )
+      for (const row of rows) live.add(row.id)
+    }
+    output.push(...candidates.filter((line) => live.has(line.deploymentId)))
+    if (candidates.length < pageSize) break
+    const last = candidates[candidates.length - 1]
+    if (!last) break
+    cursor = sql`(${deploymentLogs.createdAt}, ${deploymentLogs.deploymentId}, ${deploymentLogs.stream}, ${deploymentLogs.seq}) < (${last.createdAt}, ${last.deploymentId}, ${last.stream}, ${last.seq})`
+  }
+  return output.slice(0, limit)
+}
+
+export async function readProjectDeploymentLogs(filters: Filters, limit = 200) {
+  return readOutput(filters, limit)
+}
+
+export async function projectHasDeploymentLogs(projectId: string) {
+  return (await readOutput({ projectId }, 1)).length > 0
+}