insforge 1.2.10 → 1.3.0

package/backend/src/services/ai/chat-completion.service.ts

@@ -1,7 +1,7 @@
 import OpenAI from 'openai';
 import { AIUsageService } from './ai-usage.service.js';
 import { AIConfigService } from './ai-config.service.js';
-import { AIClientService } from '@/providers/ai/openrouter.provider.js';
+import { OpenRouterProvider } from '@/providers/ai/openrouter.provider.js';
 import type {
   AIConfigurationSchema,
   ChatCompletionResponse,
@@ -14,7 +14,7 @@ export class ChatCompletionService {
   private static instance: ChatCompletionService;
   private aiUsageService = AIUsageService.getInstance();
   private aiConfigService = AIConfigService.getInstance();
-  private aiClientService = AIClientService.getInstance();
+  private openRouterProvider = OpenRouterProvider.getInstance();
 
   private constructor() {}
 
@@ -106,7 +106,7 @@ export class ChatCompletionService {
       };
 
       // Send request with automatic renewal and retry logic
-      const response = await this.aiClientService.sendRequest((client) =>
+      const response = await this.openRouterProvider.sendRequest((client) =>
         client.chat.completions.create(request)
       );
 
@@ -173,7 +173,7 @@ export class ChatCompletionService {
       };
 
       // Send request with automatic renewal and retry logic
-      const stream = await this.aiClientService.sendRequest((client) =>
+      const stream = await this.openRouterProvider.sendRequest((client) =>
         client.chat.completions.create(request)
       );
 

package/backend/src/services/ai/image-generation.service.ts

@@ -2,7 +2,7 @@ import OpenAI from 'openai';
 
 import { AIUsageService } from './ai-usage.service.js';
 import { AIConfigService } from './ai-config.service.js';
-import { AIClientService } from '@/providers/ai/openrouter.provider.js';
+import { OpenRouterProvider } from '@/providers/ai/openrouter.provider.js';
 import type {
   AIConfigurationSchema,
   ImageGenerationRequest,
@@ -14,7 +14,7 @@ import { OpenRouterImageMessage } from '@/types/ai.js';
 export class ImageGenerationService {
   private static aiUsageService = AIUsageService.getInstance();
   private static aiConfigService = AIConfigService.getInstance();
-  private static aiClientService = AIClientService.getInstance();
+  private static openRouterProvider = OpenRouterProvider.getInstance();
 
   /**
    * Validate model and get config
@@ -75,7 +75,7 @@ export class ImageGenerationService {
       };
 
       // Send request with automatic renewal and retry logic
-      const response = (await this.aiClientService.sendRequest((client) =>
+      const response = (await this.openRouterProvider.sendRequest((client) =>
         client.chat.completions.create(
           request as OpenAI.Chat.ChatCompletionCreateParamsNonStreaming
         )

package/backend/src/services/auth/auth.service.ts

@@ -33,6 +33,7 @@ import {
   LinkedInUserInfo,
   DiscordUserInfo,
   XUserInfo,
+  AppleUserInfo,
   UserRecord,
   OAuthUserData,
 } from '@/types/auth.js';
@@ -42,6 +43,7 @@ import { AppError } from '@/api/middlewares/error.js';
 import { ERROR_CODES } from '@/types/error-constants.js';
 import { EmailService } from '@/services/email/email.service.js';
 import { XOAuthProvider } from '@/providers/oauth/x.provider.js';
+import { AppleOAuthProvider } from '@/providers/oauth/apple.provider.js';
 
 /**
  * Simplified JWT-based auth service
@@ -62,6 +64,7 @@ export class AuthService {
   private facebookOAuthProvider: FacebookOAuthProvider;
   private microsoftOAuthProvider: MicrosoftOAuthProvider;
   private xOAuthProvider: XOAuthProvider;
+  private appleOAuthProvider: AppleOAuthProvider;
 
   private constructor() {
     this.adminEmail = process.env.ADMIN_EMAIL ?? '';
@@ -82,6 +85,7 @@ export class AuthService {
     this.facebookOAuthProvider = FacebookOAuthProvider.getInstance();
     this.microsoftOAuthProvider = MicrosoftOAuthProvider.getInstance();
     this.xOAuthProvider = XOAuthProvider.getInstance();
+    this.appleOAuthProvider = AppleOAuthProvider.getInstance();
 
     logger.info('AuthService initialized');
   }
@@ -670,6 +674,7 @@ export class AuthService {
       | MicrosoftUserInfo
       | FacebookUserInfo
       | XUserInfo
+      | AppleUserInfo
       | Record<string, unknown>
   ): Promise<CreateSessionResponse> {
     const pool = this.getPool();
@@ -777,6 +782,7 @@ export class AuthService {
       | MicrosoftUserInfo
       | FacebookUserInfo
       | XUserInfo
+      | AppleUserInfo
       | Record<string, unknown>,
     avatarUrl: string
   ): Promise<CreateSessionResponse> {
@@ -870,6 +876,8 @@ export class AuthService {
         return this.microsoftOAuthProvider.generateOAuthUrl(state);
       case 'x':
         return this.xOAuthProvider.generateOAuthUrl(state);
+      case 'apple':
+        return this.appleOAuthProvider.generateOAuthUrl(state);
       default:
         throw new Error(`OAuth provider ${provider} is not implemented yet.`);
     }
@@ -906,6 +914,9 @@ export class AuthService {
       case 'x':
         userData = await this.xOAuthProvider.handleCallback(payload);
         break;
+      case 'apple':
+        userData = await this.appleOAuthProvider.handleCallback(payload);
+        break;
       default:
         throw new Error(`OAuth provider ${provider} is not implemented yet.`);
     }
@@ -949,6 +960,9 @@ export class AuthService {
       case 'x':
         userData = this.xOAuthProvider.handleSharedCallback(payloadData);
         break;
+      case 'apple':
+        userData = this.appleOAuthProvider.handleSharedCallback(payloadData);
+        break;
       case 'microsoft':
       default:
         throw new Error(`OAuth provider ${provider} is not supported for shared callback.`);

package/backend/src/services/database/database-table.service.ts

@@ -268,15 +268,6 @@ export class DatabaseTableService {
     }
   }
 
-  /**
-   * Get all table schemas
-   */
-  async getAllTableSchemas(): Promise<GetTableSchemaResponse[]> {
-    const tables = await this.listTables();
-    const schemas = await Promise.all(tables.map((table) => this.getTableSchema(table)));
-    return schemas;
-  }
-
   /**
    * Get table schema
    */

package/backend/src/services/database/database.service.ts

@@ -0,0 +1,127 @@
+import { DatabaseManager } from '@/infra/database/database.manager.js';
+import type {
+  DatabaseFunctionsResponse,
+  DatabaseIndexesResponse,
+  DatabasePoliciesResponse,
+  DatabaseTriggersResponse,
+} from '@insforge/shared-schemas';
+
+export class DatabaseService {
+  private static instance: DatabaseService;
+  private dbManager = DatabaseManager.getInstance();
+
+  private constructor() {}
+
+  public static getInstance(): DatabaseService {
+    if (!DatabaseService.instance) {
+      DatabaseService.instance = new DatabaseService();
+    }
+    return DatabaseService.instance;
+  }
+
+  /**
+   * Get all database functions (excluding system and extension functions)
+   */
+  async getFunctions(): Promise<DatabaseFunctionsResponse> {
+    const pool = this.dbManager.getPool();
+
+    const result = await pool.query(`
+      SELECT
+        p.proname as "functionName",
+        pg_get_functiondef(p.oid) as "functionDef",
+        p.prokind as "kind"
+      FROM pg_proc p
+      JOIN pg_namespace n ON p.pronamespace = n.oid
+      WHERE n.nspname = 'public'
+        AND p.prokind IN ('f', 'p', 'w')
+        AND NOT EXISTS (
+          SELECT 1 FROM pg_depend d
+          JOIN pg_extension e ON d.refobjid = e.oid
+          WHERE d.objid = p.oid
+        )
+      ORDER BY p.proname
+    `);
+
+    return {
+      functions: result.rows,
+    };
+  }
+
+  /**
+   * Get all indexes across all tables (excluding system tables)
+   */
+  async getIndexes(): Promise<DatabaseIndexesResponse> {
+    const pool = this.dbManager.getPool();
+
+    const result = await pool.query(`
+      SELECT
+        pi.tablename as "tableName",
+        pi.indexname as "indexName",
+        pi.indexdef as "indexDef",
+        idx.indisunique as "isUnique",
+        idx.indisprimary as "isPrimary"
+      FROM pg_indexes pi
+      JOIN pg_class cls ON cls.relname = pi.indexname
+        AND cls.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = pi.schemaname)
+      JOIN pg_index idx ON idx.indexrelid = cls.oid
+      WHERE pi.schemaname = 'public'
+        AND pi.tablename NOT LIKE '\\_%' ESCAPE '\\'
+      ORDER BY pi.tablename, pi.indexname
+    `);
+
+    return {
+      indexes: result.rows,
+    };
+  }
+
+  /**
+   * Get all RLS policies across all tables (excluding system tables)
+   */
+  async getPolicies(): Promise<DatabasePoliciesResponse> {
+    const pool = this.dbManager.getPool();
+
+    const result = await pool.query(`
+      SELECT
+        tablename as "tableName",
+        policyname as "policyName",
+        cmd,
+        roles,
+        qual,
+        with_check as "withCheck"
+      FROM pg_policies
+      WHERE schemaname = 'public'
+        AND tablename NOT LIKE '\\_%' ESCAPE '\\'
+      ORDER BY tablename, policyname
+    `);
+
+    return {
+      policies: result.rows,
+    };
+  }
+
+  /**
+   * Get all triggers across all tables (excluding system tables)
+   */
+  async getTriggers(): Promise<DatabaseTriggersResponse> {
+    const pool = this.dbManager.getPool();
+
+    const result = await pool.query(`
+      SELECT
+        event_object_table as "tableName",
+        trigger_name as "triggerName",
+        action_timing as "actionTiming",
+        event_manipulation as "eventManipulation",
+        action_orientation as "actionOrientation",
+        action_condition as "actionCondition",
+        action_statement as "actionStatement"
+      FROM information_schema.triggers
+      WHERE event_object_schema = 'public'
+        AND event_object_table NOT LIKE '\\_%' ESCAPE '\\'
+      ORDER BY event_object_table, trigger_name
+    `);
+
+    return {
+      triggers: result.rows,
+    };
+  }
+}

package/backend/src/services/email/email.service.ts

@@ -1,6 +1,7 @@
 import { EmailProvider } from '@/providers/email/base.provider.js';
 import { CloudEmailProvider } from '@/providers/email/cloud.provider.js';
 import { EmailTemplate } from '@/types/email.js';
+import { SendRawEmailRequest } from '@insforge/shared-schemas';
 import logger from '@/utils/logger.js';
 
 /**
@@ -53,17 +54,14 @@ export class EmailService {
   }
 
   /**
-   * Send raw email (if provider supports it)
-   * @param to - Recipient email address
-   * @param subject - Email subject
-   * @param html - HTML email body
-   * @param text - Plain text email body (optional)
+   * Send custom/raw email
+   * @param options - Email options (to, subject, html, cc, bcc, from, replyTo)
    */
-  public async sendRaw(to: string, subject: string, html: string, text?: string): Promise<void> {
+  public async sendRaw(options: SendRawEmailRequest): Promise<void> {
     if (!this.provider.sendRaw) {
       throw new Error('Current email provider does not support raw email sending');
     }
-    return this.provider.sendRaw(to, subject, html, text);
+    return this.provider.sendRaw(options);
   }
 
   /**

package/backend/src/services/realtime/index.ts

@@ -0,0 +1,3 @@
+export { RealtimeChannelService } from './realtime-channel.service.js';
+export { RealtimeAuthService } from './realtime-auth.service.js';
+export { RealtimeMessageService } from './realtime-message.service.js';

package/backend/src/services/realtime/realtime-auth.service.ts

@@ -0,0 +1,104 @@
+import { Pool, PoolClient } from 'pg';
+import { DatabaseManager } from '@/infra/database/database.manager.js';
+import logger from '@/utils/logger.js';
+import { RoleSchema } from '@insforge/shared-schemas';
+
+/**
+ * Handles channel authorization by checking RLS policies on the messages table.
+ *
+ * Permission Model (Supabase pattern):
+ * - SELECT on messages = 'join' permission (can subscribe to channel)
+ * - INSERT on messages = 'send' permission (can publish to channel)
+ *
+ * Developers define RLS policies on realtime.messages that check:
+ * - current_setting('request.jwt.claim.sub', true) = user ID
+ * - current_setting('request.jwt.claim.role', true) = user role
+ * - channel_name for channel-specific access
+ */
+export class RealtimeAuthService {
+  private static instance: RealtimeAuthService;
+  private pool: Pool | null = null;
+
+  private constructor() {}
+
+  static getInstance(): RealtimeAuthService {
+    if (!RealtimeAuthService.instance) {
+      RealtimeAuthService.instance = new RealtimeAuthService();
+    }
+    return RealtimeAuthService.instance;
+  }
+
+  private getPool(): Pool {
+    if (!this.pool) {
+      this.pool = DatabaseManager.getInstance().getPool();
+    }
+    return this.pool;
+  }
+
+  /**
+   * Check if user has permission to subscribe to a channel.
+   * Tests SELECT permission on channels table via RLS.
+   *
+   * @param channelName - The channel to check access for
+   * @param userId - The user ID (undefined for anonymous users)
+   * @param role - The database role to use (authenticated or anon)
+   * @returns true if user can subscribe, false otherwise
+   */
+  async checkSubscribePermission(
+    channelName: string,
+    userId: string | undefined,
+    role: RoleSchema
+  ): Promise<boolean> {
+    const client = await this.getPool().connect();
+    try {
+      // Begin transaction to ensure settings persist across queries
+      await client.query('BEGIN');
+      // Switch to specified role to enforce RLS policies
+      await client.query(`SET LOCAL ROLE ${role}`);
+      await this.setUserContext(client, userId, channelName);
+
+      // Test SELECT permission via RLS on channels table
+      const result = await client.query(
+        `SELECT 1 FROM realtime.channels
+         WHERE enabled = TRUE
+           AND (pattern = $1 OR $1 LIKE pattern)
+         LIMIT 1`,
+        [channelName]
+      );
+
+      // Commit transaction
+      await client.query('COMMIT');
+
+      // If query returns a row, user has permission
+      return result.rowCount !== null && result.rowCount > 0;
+    } catch (error) {
+      // Rollback transaction on error
+      await client.query('ROLLBACK').catch(() => {});
+      logger.debug('Subscribe permission denied', { channelName, userId, error });
+      return false;
+    } finally {
+      // Reset role back to default before releasing connection
+      await client.query('RESET ROLE');
+      client.release();
+    }
+  }
+
+  /**
+   * Set user context variables for RLS policy evaluation.
+   * Can be used by other services that need to execute queries with user context.
+   */
+  async setUserContext(
+    client: PoolClient,
+    userId: string | undefined,
+    channelName: string
+  ): Promise<void> {
+    if (userId) {
+      await client.query("SELECT set_config('request.jwt.claim.sub', $1, true)", [userId]);
+    } else {
+      await client.query("SELECT set_config('request.jwt.claim.sub', '', true)");
+    }
+
+    // Set the channel being accessed (used by realtime.channel_name())
+    await client.query("SELECT set_config('realtime.channel_name', $1, true)", [channelName]);
+  }
+}

package/backend/src/services/realtime/realtime-channel.service.ts

@@ -0,0 +1,237 @@
+import { Pool } from 'pg';
+import { DatabaseManager } from '@/infra/database/database.manager.js';
+import { AppError } from '@/api/middlewares/error.js';
+import { ERROR_CODES } from '@/types/error-constants.js';
+import logger from '@/utils/logger.js';
+import type {
+  RealtimeChannel,
+  CreateChannelRequest,
+  UpdateChannelRequest,
+  RealtimeMetadataSchema,
+  RlsPolicy,
+  RealtimePermissionsResponse,
+} from '@insforge/shared-schemas';
+
+const SYSTEM_POLICIES = ['project_admin_policy'];
+
+export class RealtimeChannelService {
+  private static instance: RealtimeChannelService;
+  private pool: Pool | null = null;
+
+  private constructor() {}
+
+  static getInstance(): RealtimeChannelService {
+    if (!RealtimeChannelService.instance) {
+      RealtimeChannelService.instance = new RealtimeChannelService();
+    }
+    return RealtimeChannelService.instance;
+  }
+
+  private getPool(): Pool {
+    if (!this.pool) {
+      this.pool = DatabaseManager.getInstance().getPool();
+    }
+    return this.pool;
+  }
+
+  async list(): Promise<RealtimeChannel[]> {
+    const result = await this.getPool().query(`
+      SELECT
+        id,
+        pattern,
+        description,
+        webhook_urls as "webhookUrls",
+        enabled,
+        created_at as "createdAt",
+        updated_at as "updatedAt"
+      FROM realtime.channels
+      ORDER BY created_at DESC
+    `);
+    return result.rows;
+  }
+
+  async getById(id: string): Promise<RealtimeChannel | null> {
+    const result = await this.getPool().query(
+      `SELECT
+        id,
+        pattern,
+        description,
+        webhook_urls as "webhookUrls",
+        enabled,
+        created_at as "createdAt",
+        updated_at as "updatedAt"
+      FROM realtime.channels
+      WHERE id = $1`,
+      [id]
+    );
+    return result.rows[0] || null;
+  }
+
+  /**
+   * Find a channel by name (exact match or wildcard pattern match).
+   * For wildcard patterns like "order:%", checks if channelName matches the pattern.
+   * Returns the matching channel if found and enabled, null otherwise.
+   */
+  async getByName(channelName: string): Promise<RealtimeChannel | null> {
+    const result = await this.getPool().query(
+      `SELECT
+        id,
+        pattern,
+        description,
+        webhook_urls as "webhookUrls",
+        enabled,
+        created_at as "createdAt",
+        updated_at as "updatedAt"
+      FROM realtime.channels
+      WHERE enabled = TRUE
+        AND (pattern = $1 OR $1 LIKE pattern)
+      ORDER BY pattern = $1 DESC
+      LIMIT 1`,
+      [channelName]
+    );
+    return result.rows[0] || null;
+  }
+
+  async create(input: CreateChannelRequest): Promise<RealtimeChannel> {
+    this.validateChannelPattern(input.pattern);
+
+    const result = await this.getPool().query(
+      `INSERT INTO realtime.channels (
+        pattern, description, webhook_urls, enabled
+      ) VALUES ($1, $2, $3, $4)
+      RETURNING
+        id,
+        pattern,
+        description,
+        webhook_urls as "webhookUrls",
+        enabled,
+        created_at as "createdAt",
+        updated_at as "updatedAt"`,
+      [input.pattern, input.description || null, input.webhookUrls || null, input.enabled ?? true]
+    );
+
+    logger.info('Realtime channel created', { pattern: input.pattern });
+    return result.rows[0];
+  }
+
+  async update(id: string, input: UpdateChannelRequest): Promise<RealtimeChannel> {
+    const existing = await this.getById(id);
+    if (!existing) {
+      throw new AppError('Channel not found', 404, ERROR_CODES.NOT_FOUND);
+    }
+
+    if (input.pattern) {
+      this.validateChannelPattern(input.pattern);
+    }
+
+    const result = await this.getPool().query(
+      `UPDATE realtime.channels
+       SET
+         pattern = COALESCE($2, pattern),
+         description = COALESCE($3, description),
+         webhook_urls = COALESCE($4, webhook_urls),
+         enabled = COALESCE($5, enabled)
+       WHERE id = $1
+       RETURNING
+         id,
+         pattern,
+         description,
+         webhook_urls as "webhookUrls",
+         enabled,
+         created_at as "createdAt",
+         updated_at as "updatedAt"`,
+      [id, input.pattern, input.description, input.webhookUrls, input.enabled]
+    );
+
+    logger.info('Realtime channel updated', { id });
+    return result.rows[0];
+  }
+
+  async delete(id: string): Promise<void> {
+    const existing = await this.getById(id);
+    if (!existing) {
+      throw new AppError('Channel not found', 404, ERROR_CODES.NOT_FOUND);
+    }
+
+    await this.getPool().query('DELETE FROM realtime.channels WHERE id = $1', [id]);
+    logger.info('Realtime channel deleted', { id, pattern: existing.pattern });
+  }
+
+  /**
+   * Get realtime metadata including channels and permissions
+   */
+  async getMetadata(): Promise<RealtimeMetadataSchema> {
+    const [channels, permissions] = await Promise.all([this.list(), this.getPermissions()]);
+
+    return {
+      channels,
+      permissions,
+    };
+  }
+
+  // ============================================================================
+  // Permissions Methods
+  // ============================================================================
+
+  /**
+   * Get RLS policies for a table in the realtime schema, excluding system policies
+   */
+  private async getPolicies(tableName: string): Promise<RlsPolicy[]> {
+    const result = await this.getPool().query(
+      `SELECT
+         policyname as "policyName",
+         tablename as "tableName",
+         cmd as "command",
+         roles,
+         qual as "using",
+         with_check as "withCheck"
+       FROM pg_policies
+       WHERE schemaname = 'realtime'
+         AND tablename = $1
+       ORDER BY policyname`,
+      [tableName]
+    );
+
+    // Filter out system policies
+    return result.rows.filter((policy) => !SYSTEM_POLICIES.includes(policy.policyName));
+  }
+
+  /**
+   * Get all realtime permissions (RLS policies for channels and messages tables)
+   *
+   * - Subscribe permission: RLS policies on realtime.channels (SELECT)
+   * - Publish permission: RLS policies on realtime.messages (INSERT)
+   */
+  async getPermissions(): Promise<RealtimePermissionsResponse> {
+    const [channelsPolicies, messagesPolicies] = await Promise.all([
+      this.getPolicies('channels'),
+      this.getPolicies('messages'),
+    ]);
+
+    return {
+      subscribe: {
+        policies: channelsPolicies,
+      },
+      publish: {
+        policies: messagesPolicies,
+      },
+    };
+  }
+
+  // ============================================================================
+  // Validation
+  // ============================================================================
+
+  private validateChannelPattern(pattern: string): void {
+    // Allow alphanumeric, colons, hyphens, and % for wildcards
+    // Note: underscore is not allowed as it's a SQL wildcard character
+    const validPattern = /^[a-zA-Z0-9-]+(:[a-zA-Z0-9%:-]+)*$/;
+    if (!validPattern.test(pattern)) {
+      throw new AppError(
+        'Invalid channel pattern. Use alphanumeric characters, colons, hyphens, and % for wildcards.',
+        400,
+        ERROR_CODES.INVALID_INPUT
+      );
+    }
+  }
+}