opacacms 0.1.0

package/src/db/kysely/schema-builder.ts

@@ -0,0 +1,439 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+import type { Collection, Global } from "../../types";
+import { logger } from "../../utils/logger";
+import { getSystemCollections } from "../system-schema";
+import {
+  flattenFields,
+  getRelationalFields,
+  mapFieldToPostgresType,
+  mapFieldToSQLiteType,
+  toSnakeCase,
+} from "./field-mapper";
+import { assertSafeIdentifier } from "./sql-utils";
+
+export type DialectType = "postgres" | "sqlite" | "d1";
+
+/**
+ * Dynamically pushes schemas to the database using Kysely's safe Schema Builder API.
+ *
+ * @param db The Kysely database instance
+ * @param dialect "postgres", "sqlite", or "d1"
+ * @param collections The user collections
+ * @param globals The user globals
+ * @param options Push options
+ */
+export async function pushSchema(
+  db: Kysely<any>,
+  dialect: DialectType,
+  collections: Collection[],
+  globals: Global[] = [],
+  options: { pushDestructive?: boolean } = {},
+): Promise<void> {
+  const rawSchemas = [...getSystemCollections(), ...collections, ...globals];
+  const allSchemas: (Collection | Global)[] = [];
+  const seenSlugs = new Set<string>();
+
+  for (const schema of rawSchemas) {
+    if (!seenSlugs.has(schema.slug)) {
+      seenSlugs.add(schema.slug);
+      allSchemas.push(schema);
+    }
+  }
+  const { pushDestructive } = options;
+
+  logger.debug(`Starting schema push via Kysely (${dialect})...`);
+
+  const mapType = dialect === "postgres" ? mapFieldToPostgresType : mapFieldToSQLiteType;
+
+  // 1. Fetch existing tables based on dialect
+  let existingTables: string[] = [];
+  try {
+    if (dialect === "postgres") {
+      const res =
+        await sql`SELECT table_name FROM information_schema.tables WHERE table_schema = 'public'`.execute(
+          db,
+        );
+      existingTables = (res.rows as any[]).map((r) => r.table_name);
+    } else {
+      // SQLite/D1
+      const res = await sql`SELECT name FROM sqlite_master WHERE type='table'`.execute(db);
+      existingTables = (res.rows as any[]).map((r) => r.name);
+    }
+  } catch (_) {
+    logger.warn("Failed to fetch existing tables:");
+  }
+
+  logger.info(`Existing tables: ${existingTables.join(", ")}`);
+  const existingTableSet = new Set(existingTables);
+  const expectedTableNames = new Set<string>();
+
+  for (const collection of allSchemas) {
+    const slug = collection.slug;
+    const tableName = toSnakeCase(slug);
+    assertSafeIdentifier(tableName);
+    expectedTableNames.add(tableName);
+
+    const flattenedFields = flattenFields(collection.fields);
+    const hasTimestamps = collection.timestamps !== false;
+    const versions = (collection as any).versions;
+
+    // Check if table exists
+    if (!existingTableSet.has(tableName)) {
+      logger.info(`  -> Creating table: ${logger.format("green", `"${tableName}"`)}`);
+      let builder = db.schema.createTable(tableName).ifNotExists();
+
+      // OpacaCMS uses string IDs for everything
+      builder = builder.addColumn("id", "text", (col) => col.primaryKey());
+
+      for (const field of flattenedFields) {
+        if (field.type === "relationship" && "hasMany" in field && field.hasMany) continue;
+        const colName = toSnakeCase(field.name!);
+        if (colName === "id") continue;
+
+        assertSafeIdentifier(colName);
+        const colType = mapType(field);
+
+        builder = builder.addColumn(colName, colType as any, (col) => {
+          let c = col;
+          if (field.unique) c = c.unique();
+          if (field.required) c = c.notNull();
+          if (field.defaultValue !== undefined) c = c.defaultTo(field.defaultValue);
+          return c;
+        });
+      }
+
+      // Versions & Drafts column
+      if (versions?.drafts) {
+        builder = builder.addColumn("_status", "text", (col) => col.defaultTo("draft"));
+      }
+
+      // Timestamps columns
+      if (hasTimestamps) {
+        const ts = (collection as any).timestamps ?? {};
+        const config = typeof ts === "object" ? ts : {};
+        const createdField = toSnakeCase(config.createdAt ?? "createdAt");
+        const updatedField = toSnakeCase(config.updatedAt ?? "updatedAt");
+        const tsType = (dialect === "postgres" ? "timestamp with time zone" : "text") as any;
+        builder = builder.addColumn(createdField, tsType, (col) =>
+          col.defaultTo(sql`CURRENT_TIMESTAMP`),
+        );
+        builder = builder.addColumn(updatedField, tsType, (col) =>
+          col.defaultTo(sql`CURRENT_TIMESTAMP`),
+        );
+      }
+
+      await builder.execute();
+
+      // Create Versions Table if needed
+      if (versions) {
+        const versionsTable = `${slug}_versions`.toLowerCase();
+        assertSafeIdentifier(versionsTable);
+        expectedTableNames.add(versionsTable);
+
+        if (!existingTableSet.has(versionsTable)) {
+          logger.info(
+            `  -> Creating versions table: ${logger.format("green", `"${versionsTable}"`)}`,
+          );
+          await db.schema
+            .createTable(versionsTable)
+            .addColumn("id", "text", (col) => col.primaryKey())
+            .addColumn("_parent_id", "text", (col) => col.notNull())
+            .addColumn("_version_data", (dialect === "postgres" ? "jsonb" : "text") as any, (col) =>
+              col.notNull(),
+            )
+            .addColumn("_status", "text")
+            .addColumn(
+              "created_at",
+              (dialect === "postgres" ? "timestamp with time zone" : "text") as any,
+              (col) => col.defaultTo(sql`CURRENT_TIMESTAMP`),
+            )
+            .execute();
+        }
+      }
+    } else {
+      // Alter table logic
+      let existingColumns: string[] = [];
+      try {
+        if (dialect === "postgres") {
+          const res =
+            await sql`SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ${slug}`.execute(
+              db,
+            );
+          existingColumns = (res.rows as any[]).map((r) => r.column_name);
+        } else {
+          const res = await sql`PRAGMA table_info(${sql.id(slug)})`.execute(db);
+          existingColumns = (res.rows as any[]).map((r) => r.name);
+        }
+      } catch (e) {
+        logger.warn(`Failed to fetch columns for ${slug}:`, e);
+      }
+      const existingColSet = new Set(existingColumns);
+
+      for (const field of flattenedFields) {
+        if (field.type === "relationship" && "hasMany" in field && field.hasMany) continue;
+        const colName = toSnakeCase(field.name!);
+        if (colName === "id") continue;
+
+        assertSafeIdentifier(colName);
+        if (!existingColSet.has(colName)) {
+          logger.info(
+            `  -> Adding missing column: ${logger.format("green", `${slug}.${colName}`)}`,
+          );
+          const colType = mapType(field);
+          await db.schema
+            .alterTable(slug)
+            .addColumn(colName, colType as any)
+            .execute();
+        }
+      }
+
+      // Versions & Drafts column (Alter)
+      if (versions?.drafts && !existingColSet.has("_status")) {
+        logger.info(`  -> Adding missing status column to: ${slug}`);
+        await db.schema
+          .alterTable(slug)
+          .addColumn("_status", "text", (col) => col.defaultTo("draft"))
+          .execute();
+      }
+
+      // Timestamps columns (Alter)
+      if (hasTimestamps) {
+        const ts = (collection as any).timestamps ?? {};
+        const config = typeof ts === "object" ? ts : {};
+        const createdField = toSnakeCase(config.createdAt ?? "createdAt");
+        const updatedField = toSnakeCase(config.updatedAt ?? "updatedAt");
+        const tsType = (dialect === "postgres" ? "timestamp with time zone" : "text") as any;
+
+        if (!existingColSet.has(createdField)) {
+          logger.info(`  -> Adding missing timestamp column: ${slug}.${createdField}`);
+          await db.schema
+            .alterTable(slug)
+            .addColumn(createdField, tsType, (col) => col.defaultTo(sql`CURRENT_TIMESTAMP`))
+            .execute();
+        }
+        if (!existingColSet.has(updatedField)) {
+          logger.info(`  -> Adding missing timestamp column: ${slug}.${updatedField}`);
+          await db.schema
+            .alterTable(slug)
+            .addColumn(updatedField, tsType, (col) => col.defaultTo(sql`CURRENT_TIMESTAMP`))
+            .execute();
+        }
+      }
+
+      // Versions table (Alter phase)
+      if (versions) {
+        const versionsTable = `${slug}_versions`.toLowerCase();
+        expectedTableNames.add(versionsTable);
+        if (!existingTableSet.has(versionsTable)) {
+          logger.info(`  -> Creating missing versions table for: ${slug}`);
+          await db.schema
+            .createTable(versionsTable)
+            .addColumn("id", "text", (col) => col.primaryKey())
+            .addColumn("_parent_id", "text", (col) => col.notNull())
+            .addColumn("_version_data", (dialect === "postgres" ? "jsonb" : "text") as any, (col) =>
+              col.notNull(),
+            )
+            .addColumn("_status", "text")
+            .addColumn(
+              "created_at",
+              (dialect === "postgres" ? "timestamp with time zone" : "text") as any,
+              (col) => col.defaultTo(sql`CURRENT_TIMESTAMP`),
+            )
+            .execute();
+        }
+      }
+
+      // Column Pruning
+      if (pushDestructive) {
+        const expectedCols = new Set(
+          flattenedFields
+            .filter((f) => !(f.type === "relationship" && f.hasMany))
+            .map((f) => toSnakeCase(f.name!)),
+        );
+        if (hasTimestamps) {
+          const ts = (collection as any).timestamps ?? {};
+          const config = typeof ts === "object" ? ts : {};
+          expectedCols.add(toSnakeCase(config.createdAt ?? "createdAt"));
+          expectedCols.add(toSnakeCase(config.updatedAt ?? "updatedAt"));
+        }
+        if (versions?.drafts) expectedCols.add("_status");
+        expectedCols.add("id");
+
+        for (const existingCol of existingColumns) {
+          if (!expectedCols.has(existingCol)) {
+            logger.info(
+              `  -> Dropping stale column: ${logger.format("red", `${slug}.${existingCol}`)}`,
+            );
+            try {
+              await db.schema.alterTable(slug).dropColumn(existingCol).execute();
+            } catch (_) {
+              logger.warn(`Failed to drop column ${existingCol}.`);
+            }
+          }
+        }
+      }
+    }
+
+    const relationalFields = getRelationalFields(collection.fields);
+
+    // Join tables (hasMany)
+    for (const field of relationalFields) {
+      if (field.type === "relationship" && "hasMany" in field && field.hasMany) {
+        const sourceIdType = "text";
+        const colName = toSnakeCase(field.name!);
+        const joinTableName = `${slug}_${colName}_relations`.toLowerCase();
+        assertSafeIdentifier(joinTableName);
+        expectedTableNames.add(joinTableName);
+
+        if (!existingTableSet.has(joinTableName)) {
+          logger.info(
+            `  -> Creating relation table: ${logger.format("green", `"${joinTableName}"`)}`,
+          );
+          await db.schema
+            .createTable(joinTableName)
+            .ifNotExists()
+            .addColumn("id", "text", (col) => col.primaryKey())
+            .addColumn("source_id", sourceIdType, (col) => col.notNull())
+            .addColumn("target_id", "text", (col) => col.notNull())
+            .addColumn("order", "integer", (col) => col.defaultTo(0))
+            .execute();
+        }
+      }
+    }
+
+    // Block tables
+    for (const field of relationalFields) {
+      if (field.type === "blocks" && field.blocks && Array.isArray(field.blocks)) {
+        const parentIdType = "text";
+
+        for (const block of field.blocks) {
+          const blockName = toSnakeCase(field.name!);
+          const blockSlug = toSnakeCase(block.slug);
+          assertSafeIdentifier(blockName);
+          assertSafeIdentifier(blockSlug);
+
+          const blockTableName = `${slug}_${blockName}_${blockSlug}`.toLowerCase();
+          assertSafeIdentifier(blockTableName);
+          expectedTableNames.add(blockTableName);
+
+          if (!existingTableSet.has(blockTableName)) {
+            logger.info(
+              `  -> Creating block table: ${logger.format("green", `"${blockTableName}"`)}`,
+            );
+            let bBuilder = db.schema
+              .createTable(blockTableName)
+              .ifNotExists()
+              .addColumn("id", "text", (col) => col.primaryKey())
+              .addColumn("_parent_id", parentIdType, (col) => col.notNull())
+              .addColumn("_order", "integer", (col) => col.defaultTo(0))
+              .addColumn("block_type", "text", (col) => col.notNull().defaultTo(block.slug));
+
+            const blockFlattened = flattenFields(block.fields);
+            for (const bField of blockFlattened) {
+              const bColName = toSnakeCase(bField.name!);
+              if (bColName === "id") continue;
+
+              assertSafeIdentifier(bColName);
+              const bColType = mapType(bField);
+              bBuilder = bBuilder.addColumn(bColName, bColType as any, (col) => {
+                let c = col;
+                if (bField.unique) c = c.unique();
+                if (bField.required) c = c.notNull();
+                if (bField.defaultValue !== undefined) c = c.defaultTo(bField.defaultValue);
+                return c;
+              });
+            }
+
+            const tsType = (dialect === "postgres" ? "timestamp with time zone" : "text") as any;
+            bBuilder = bBuilder.addColumn("created_at", tsType, (col) =>
+              col.defaultTo(sql`CURRENT_TIMESTAMP`),
+            );
+            bBuilder = bBuilder.addColumn("updated_at", tsType, (col) =>
+              col.defaultTo(sql`CURRENT_TIMESTAMP`),
+            );
+
+            await bBuilder.execute();
+          } else {
+            // Alter block table
+            let existingBCols: string[] = [];
+            try {
+              if (dialect === "postgres") {
+                const res =
+                  await sql`SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ${blockTableName}`.execute(
+                    db,
+                  );
+                existingBCols = (res.rows as any[]).map((r) => r.column_name);
+              } else {
+                const res = await sql`PRAGMA table_info(${sql.id(blockTableName)})`.execute(db);
+                existingBCols = (res.rows as any[]).map((r) => r.name);
+              }
+            } catch (_) {
+              // Ignore
+            }
+            const existingBColSet = new Set(existingBCols);
+            const blockFlattened = flattenFields(block.fields);
+
+            for (const bField of blockFlattened) {
+              const bColName = toSnakeCase(bField.name!);
+              if (bColName === "id") continue;
+
+              if (!existingBColSet.has(bColName)) {
+                const bColType = mapType(bField);
+                await db.schema
+                  .alterTable(blockTableName)
+                  .addColumn(bColName, bColType as any)
+                  .execute();
+              }
+            }
+
+            // Ensure internal block columns exist
+            if (!existingBColSet.has("_parent_id")) {
+              await db.schema
+                .alterTable(blockTableName)
+                .addColumn("_parent_id", "text", (col) => col.notNull().defaultTo(""))
+                .execute();
+            }
+            if (!existingBColSet.has("_order")) {
+              await db.schema
+                .alterTable(blockTableName)
+                .addColumn("_order", "integer", (col) => col.defaultTo(0))
+                .execute();
+            }
+            if (!existingBColSet.has("block_type")) {
+              await db.schema
+                .alterTable(blockTableName)
+                .addColumn("block_type", "text", (col) => col.notNull().defaultTo(block.slug))
+                .execute();
+            }
+          }
+        }
+      }
+    }
+  }
+
+  // Table Pruning
+  if (pushDestructive) {
+    for (const tableName of existingTables) {
+      if (
+        !expectedTableNames.has(tableName) &&
+        !tableName.startsWith("better_auth") &&
+        !tableName.startsWith("__kysely")
+      ) {
+        logger.info(`  -> Dropping stale table: ${logger.format("red", `"${tableName}"`)}`);
+        try {
+          await db.schema.dropTable(tableName).ifExists().cascade().execute();
+        } catch (_) {
+          // sqlite might not support cascade, try without
+          try {
+            await db.schema.dropTable(tableName).ifExists().execute();
+          } catch (_) {
+            logger.warn(`Failed to drop table ${tableName}`);
+          }
+        }
+      }
+    }
+  }
+
+  logger.success(`Schema push to Kysely (${dialect}) completed.`);
+}

package/src/db/kysely/sql-utils.ts

@@ -0,0 +1,13 @@
+export function assertSafeIdentifier(identifier: string): void {
+  if (typeof identifier !== "string" || !identifier) {
+    throw new Error(`Invalid identifier: must be a non-empty string. Got: ${identifier}`);
+  }
+
+  const isValid = /^[a-zA-Z0-9_-]+$/.test(identifier);
+
+  if (!isValid) {
+    throw new Error(
+      `API Error: Unsafe SQL identifier detected: "${identifier}". Identifiers can only contain alphanumeric characters, underscores, and hyphens.`,
+    );
+  }
+}