pgkiln 0.31.0 → 0.35.0

package/src/runtime/search.ts

@@ -0,0 +1,252 @@
+// Search region and search configurations (APEX 22.2: the Search region and
+// Shared Components → Search Configurations), migration 080.
+//
+// A search region searches the configurations it names (all of the
+// application's when it names none) with one search field, or with a page
+// item's value ({"item": "P1_SEARCH"}), and shows the results grouped per
+// configuration, the matched words marked. Each configuration searches:
+//
+//  - table: a table or view, its columns quoted as identifiers;
+//  - sql:   a SELECT (binds allowed), wrapped as a subquery;
+//  - list:  the entries of a list (Shared Components → Lists) the user may see.
+//
+// Every word of the search text must be found in one of the searchable
+// columns (ILIKE, % and _ escaped, the text as a query parameter). The
+// queries run as the application's role in the page's transaction, each in a
+// savepoint, so one configuration that fails shows its error and the others
+// still answer. Without JavaScript the field is a GET form; app.js searches
+// as the user types (the region endpoint, see routes.ts).
+import pg from 'pg';
+import { applyBinds } from '../binds.ts';
+import { runtime, savepoint } from '../db.ts';
+import { html, raw, type Raw } from '../html.ts';
+import { icon } from '../icons.ts';
+import type { Region } from '../metadata.ts';
+import { bindValues, publicError, stripSemicolon, type PageContext } from './context.ts';
+import { fillItems, linkAttrs } from './links.ts';
+import { listTree, type ListNode } from './lists.ts';
+
+const ident = pg.escapeIdentifier;
+
+export interface SearchConfig {
+  name: string;
+  label: string;
+  seq: number;
+  source_type: 'table' | 'sql' | 'list';
+  source: string;
+  searchable_columns: string[];
+  title_column: string | null;
+  subtitle_column: string | null;
+  description_column: string | null;
+  badge_column: string | null;
+  icon: string | null;
+  link: { page?: number; items?: Record<string, string> } | null;
+  max_results: number;
+}
+
+export interface SearchRegionConfig {
+  configs?: string[];
+  item?: string;
+  placeholder?: string;
+  min_length?: number;
+  empty?: string;
+}
+
+/** At most this many words of the search text count. */
+const MAX_WORDS = 8;
+const MAX_TEXT = 200;
+const COLUMN = /^[A-Za-z_][A-Za-z0-9_$]{0,62}$/;
+const TABLE = /^([A-Za-z_][A-Za-z0-9_$]{0,62}\.)?[A-Za-z_][A-Za-z0-9_$]{0,62}$/;
+
+/** The columns a configuration names (for the Advisor's check of its source). */
+export const configColumns = (c: Pick<SearchConfig, 'title_column' | 'subtitle_column' | 'description_column' | 'badge_column' | 'searchable_columns' | 'icon'>) =>
+  [...new Set([c.title_column, c.subtitle_column, c.description_column, c.badge_column, ...(c.searchable_columns ?? []), /^#(.+)#$/.exec(c.icon ?? '')?.[1]]
+    .filter((x): x is string => !!x && COLUMN.test(x)))];
+
+/** The words of a search text (at most MAX_WORDS, each once, case kept). */
+export function searchWords(text: string | null | undefined) {
+  const words = (text ?? '').slice(0, MAX_TEXT).split(/\s+/).map((w) => w.trim()).filter(Boolean);
+  return [...new Map(words.map((w) => [w.toLowerCase(), w])).values()].slice(0, MAX_WORDS);
+}
+
+/** A word as an ILIKE pattern that matches it anywhere, literally. */
+export const likePattern = (word: string) => `%${word.replace(/[\\%_]/g, (c) => `\\${c}`)}%`;
+
+/** The parameter of the region's own search field. */
+export const searchParam = (r: Region) => `s${r.id}`;
+
+/** Problems of a configuration (the builder shows them; the runtime refuses the configuration). */
+export function searchConfigProblems(c: Partial<SearchConfig>): string[] {
+  const out: string[] = [];
+  const cols = [c.title_column, c.subtitle_column, c.description_column, c.badge_column, ...(c.searchable_columns ?? [])].filter((x): x is string => !!x);
+  if (c.source_type !== 'list') {
+    for (const col of cols) if (!COLUMN.test(col)) out.push(`"${col}" is not a column name.`);
+    if (!c.title_column) out.push('Choose the column that is the title of each result.');
+  }
+  if (c.source_type === 'sql' && !/^\s*(select|with)\b/i.test(c.source ?? '')) out.push('The source of an SQL query configuration is a SELECT.');
+  if (c.source_type === 'table' && !TABLE.test((c.source ?? '').trim())) out.push('The source of a table configuration is a table or view name, e.g. sales.customers.');
+  if (c.icon && !/^(#[A-Za-z_][A-Za-z0-9_$]*#|[a-z0-9-]{1,40})$/.test(c.icon)) out.push('The icon is an icon name, or #COLUMN# for a column that holds icon names.');
+  if (c.link && (typeof c.link !== 'object' || !Number.isInteger(c.link.page))) out.push('The link is {"page": 3, "items": {"P3_ID": "#ID#"}}.');
+  return out;
+}
+
+/** The configurations a region searches, in sequence order (components of an excluded build option left out). */
+async function configsOf(ctx: PageContext, r: Region): Promise<SearchConfig[]> {
+  const conf = (r.config ?? {}) as SearchRegionConfig;
+  const names = Array.isArray(conf.configs) ? conf.configs.map((n) => String(n).toUpperCase()) : [];
+  return (
+    await runtime.query<SearchConfig>(
+      `select name, label, seq, source_type, source, searchable_columns, title_column, subtitle_column, description_column,
+              badge_column, icon, link, max_results
+         from meta.search_config
+        where app_id = $1 and meta.build_option_on(app_id, build_option) and (cardinality($2::text[]) = 0 or name = any($2))
+        order by seq, name`,
+      [ctx.app.id, names],
+    )
+  ).rows;
+}
+
+interface Hit {
+  title: string;
+  subtitle: string | null;
+  description: string | null;
+  badge: string | null;
+  icon: string | null;
+  href: Raw | null;
+}
+
+const text = (v: unknown) => (v === null || v === undefined ? null : typeof v === 'object' ? JSON.stringify(v) : String(v));
+
+/** A row's value of a column, case-insensitively. */
+function col(row: Record<string, unknown>, name: string | null) {
+  if (!name) return null;
+  const key = Object.keys(row).find((k) => k.toLowerCase() === name.toLowerCase());
+  return key === undefined ? null : text(row[key]);
+}
+
+/** One configuration's results on a table or a query: up to max_results, and whether there are more. */
+async function searchRows(ctx: PageContext, c: SearchConfig, words: string[]): Promise<{ hits: Hit[]; more: boolean }> {
+  const searched = (c.searchable_columns.length ? c.searchable_columns : [c.title_column, c.subtitle_column, c.description_column]).filter(
+    (x): x is string => !!x,
+  );
+  const conditions = words.map((_, i) => `(${searched.map((s) => `t.${ident(s)}::text ilike $${i + 1} escape '\\'`).join(' or ')})`);
+  let from: string;
+  if (c.source_type === 'table') {
+    const table = (await ctx.client!.query('select $1::regclass::text as t', [c.source])).rows[0].t as string;
+    from = `${table} t`;
+  } else from = `(${stripSemicolon(applyBinds(c.source, bindValues(ctx)))}) t`;
+  const sql = `select t.* from ${from} where ${conditions.join(' and ') || 'true'}${c.title_column ? ` order by t.${ident(c.title_column)}` : ''} limit ${c.max_results + 1}`;
+  const res = await ctx.client!.query(sql, words.map(likePattern));
+  const rows = res.rows as Record<string, unknown>[];
+  const iconCol = /^#(.+)#$/.exec(c.icon ?? '')?.[1] ?? null;
+  return {
+    more: rows.length > c.max_results,
+    hits: rows.slice(0, c.max_results).map((row) => ({
+      title: col(row, c.title_column) ?? '',
+      subtitle: col(row, c.subtitle_column),
+      description: col(row, c.description_column),
+      badge: col(row, c.badge_column),
+      icon: iconCol ? col(row, iconCol) : c.icon,
+      href:
+        c.link && Number.isInteger(c.link.page)
+          ? linkAttrs(ctx, c.link.page!, fillItems(c.link.items, (name) => col(row, name) ?? undefined))
+          : null,
+    })),
+  };
+}
+
+/** One configuration's results on a list: the entries (and their children) the user may see. */
+async function searchList(ctx: PageContext, c: SearchConfig, words: string[]): Promise<{ hits: Hit[]; more: boolean }> {
+  const nodes = (await listTree(ctx, c.source)) ?? [];
+  const flat: ListNode[] = [];
+  const walk = (ns: ListNode[]) => ns.forEach((n) => (flat.push(n), walk(n.children)));
+  walk(nodes);
+  const found = flat.filter((n) => n.href && words.every((w) => `${n.label} ${n.description ?? ''}`.toLowerCase().includes(w.toLowerCase())));
+  return {
+    more: found.length > c.max_results,
+    hits: found.slice(0, c.max_results).map((n) => ({
+      title: n.label,
+      subtitle: null,
+      description: n.description,
+      badge: n.badge,
+      icon: n.icon ?? c.icon,
+      href: html`href="${n.href}"${n.external ? raw(' rel="noopener noreferrer"') : ''}${n.modal ? raw(' data-dialog') : ''}`,
+    })),
+  };
+}
+
+/** The text with the search words marked (<mark>), escaped. */
+export function marked(value: string, words: string[]): Raw {
+  if (!words.length || !value) return html`${value}`;
+  const re = new RegExp(words.map((w) => w.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).sort((a, b) => b.length - a.length).join('|'), 'gi');
+  const parts: Raw[] = [];
+  let last = 0;
+  for (const m of value.matchAll(re)) {
+    if (!m[0]) continue;
+    parts.push(html`${value.slice(last, m.index)}<mark>${m[0]}</mark>`);
+    last = m.index! + m[0].length;
+  }
+  parts.push(html`${value.slice(last)}`);
+  return html`${parts}`;
+}
+
+/** The search text of a region: its page item's value, or its own field's. */
+export function searchText(ctx: PageContext, r: Region) {
+  const conf = (r.config ?? {}) as SearchRegionConfig;
+  const item = typeof conf.item === 'string' ? conf.item.toUpperCase() : null;
+  return ((item ? ctx.session.state[item] : ctx.params.get(searchParam(r))) ?? '').slice(0, MAX_TEXT);
+}
+
+/** The results part of a search region (also what app.js swaps in while the user types). */
+async function searchResults(ctx: PageContext, r: Region, query: string): Promise<Raw> {
+  const conf = (r.config ?? {}) as SearchRegionConfig;
+  const words = searchWords(query);
+  const minLength = Number.isInteger(conf.min_length) && conf.min_length! > 0 ? conf.min_length! : 1;
+  if (!words.length || query.trim().length < minLength) return html``;
+  const groups: Raw[] = [];
+  for (const c of await configsOf(ctx, r)) {
+    let body: Raw;
+    try {
+      const problems = searchConfigProblems(c);
+      if (problems.length) throw new Error(`Search configuration ${c.name}: ${problems.join(' ')}`);
+      const { hits, more } = await savepoint(ctx.client!, () => (c.source_type === 'list' ? searchList(ctx, c, words) : searchRows(ctx, c, words)));
+      if (!hits.length) continue;
+      body = html`<ul class="search-hits">${hits.map((h) => {
+        const inner = html`${h.icon ? html`<span class="search-icon">${icon(h.icon)}</span>` : ''}
+          <span class="search-text"><span class="search-title">${marked(h.title, words)}</span>${
+            h.subtitle ? html`<span class="search-subtitle">${marked(h.subtitle, words)}</span>` : ''}${
+            h.description ? html`<span class="search-description">${marked(h.description, words)}</span>` : ''}</span>
+          ${h.badge ? html`<span class="badge-pill">${marked(h.badge, words)}</span>` : ''}`;
+        return html`<li>${h.href ? html`<a class="search-hit" ${h.href}>${inner}</a>` : html`<div class="search-hit">${inner}</div>`}</li>`;
+      })}</ul>${more ? html`<p class="muted search-more">${ctx.locale.t('region.first_rows', { n: String(c.max_results) })}</p>` : ''}`;
+    } catch (e) {
+      body = html`<div class="alert alert-error" role="alert">${await publicError(ctx, e, `search configuration ${c.name}`)}</div>`;
+    }
+    // the label is translated like the page's own texts (Shared Components → Globalization)
+    groups.push(html`<section class="search-group"><h3>${ctx.locale.tr(c.label)}</h3>${body}</section>`);
+  }
+  // (a configuration that failed shows its error as a group of its own)
+  return groups.length ? html`${groups}` : html`<p class="muted search-empty">${conf.empty ?? ctx.locale.t('lov.no_rows')}</p>`;
+}
+
+export async function renderSearch(ctx: PageContext, r: Region): Promise<Raw> {
+  const conf = (r.config ?? {}) as SearchRegionConfig;
+  const t = ctx.locale.t;
+  const query = searchText(ctx, r);
+  const results = html`<div class="search-results" id="R${r.id}_results" aria-live="polite">${await searchResults(ctx, r, query)}</div>`;
+  if (typeof conf.item === 'string' && conf.item) return results;
+  // its own field: a GET form that keeps the page's other parameters (item values with their checksum)
+  const param = searchParam(r);
+  const keep = [...ctx.params].filter(([k]) => k !== param);
+  const fieldId = `R${r.id}_q`;
+  return html`<form method="get" action="${ctx.base}/${ctx.page.page_no}" class="search-form" role="search">
+      ${keep.map(([k, v]) => html`<input type="hidden" name="${k}" value="${v}">`)}
+      <label class="label" for="${fieldId}">${t('report.search')}</label>
+      <div class="input-with-button">
+        <input type="search" id="${fieldId}" name="${param}" value="${query}" maxlength="${MAX_TEXT}" autocomplete="off"
+          placeholder="${conf.placeholder ?? t('report.search_placeholder')}" data-search-region="${r.id}">
+        <button class="btn">${icon('search')} ${t('report.search')}</button>
+      </div>
+    </form>
+    ${results}`;
+}

package/src/runtime/url-region.ts

@@ -0,0 +1,93 @@
+// URL region (APEX: URL region): another site's page in the region, in a
+// sandboxed iframe.
+//
+// The region's source is the URL. Its origin must be written out in the
+// source (https://host[:port], or a path on this server): an item can't
+// choose the host. &ITEM. substitutions are allowed after the origin and are
+// URL-encoded. The page's Content-Security-Policy gets frame-src for exactly
+// the origins of its URL regions (security.ts), so nothing else can be framed.
+// The site itself decides whether it may be framed (X-Frame-Options,
+// frame-ancestors): the region has a link to open it in a new tab as well.
+//
+// Attributes: {"height": 480, "sandbox": ["allow-scripts", ...] | false,
+// "fullscreen": true}.
+import { html, type Raw } from '../html.ts';
+import type { Region } from '../metadata.ts';
+import { substitute, type PageContext } from './context.ts';
+
+/** The sandbox flags a region may give its frame. */
+export const SANDBOX_FLAGS = [
+  'allow-scripts', 'allow-forms', 'allow-popups', 'allow-same-origin', 'allow-downloads', 'allow-modals', 'allow-popups-to-escape-sandbox',
+] as const;
+const DEFAULT_SANDBOX = ['allow-scripts', 'allow-forms', 'allow-popups', 'allow-same-origin'];
+const LOCAL = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
+
+export interface UrlRegionConfig {
+  height?: number;
+  sandbox?: string[] | false;
+  fullscreen?: boolean;
+}
+
+/**
+ * The origin a URL region frames: { origin } for an https URL (http only for
+ * localhost), { origin: null } for a path on this server, or { error }.
+ */
+export function urlTarget(source: string | null | undefined): { origin: string | null } | { error: string } {
+  const s = (source ?? '').trim();
+  if (!s) return { error: 'A URL region needs a URL in its source.' };
+  if (/^\/(?![/\\])/.test(s)) return { origin: null };
+  // the scheme and host are literal: no &ITEM. before the path
+  const m = /^(https?):\/\/([^/?#&\\\s]+)(?=[/?#]|$)/i.exec(s);
+  if (!m) return { error: 'A URL region needs an https:// URL (or a path on this server starting with /); its host can\'t come from an item.' };
+  let u: URL;
+  try {
+    u = new URL(`${m[1]}://${m[2]}/`);
+  } catch {
+    return { error: 'The URL of this region is not valid.' };
+  }
+  if (u.username || u.password) return { error: 'A URL region\'s URL can\'t contain a user name or password.' };
+  if (u.protocol === 'http:' && !LOCAL.test(u.hostname)) return { error: 'A URL region needs an https:// URL (http:// only for localhost).' };
+  return { origin: u.origin };
+}
+
+/** The checks of a region's attributes (the builder shows them; the runtime ignores what fails). */
+export function urlConfigProblem(config: unknown): string | null {
+  const c = (config ?? {}) as UrlRegionConfig;
+  if (c.height !== undefined && !(Number.isInteger(c.height) && c.height >= 100 && c.height <= 4000)) return 'height: a whole number of pixels from 100 to 4000.';
+  if (c.sandbox !== undefined && c.sandbox !== false) {
+    if (!Array.isArray(c.sandbox)) return 'sandbox: a list of flags, or false for no sandbox.';
+    const bad = c.sandbox.filter((f) => !(SANDBOX_FLAGS as readonly string[]).includes(f));
+    if (bad.length) return `sandbox: unknown flag ${bad[0]} (allowed: ${SANDBOX_FLAGS.join(', ')}).`;
+  }
+  return null;
+}
+
+/** The origins the page's URL regions frame (for the Content-Security-Policy's frame-src). */
+export function frameOrigins(regions: Region[]) {
+  const out = new Set<string>();
+  for (const r of regions) {
+    if (r.type !== 'url') continue;
+    const t = urlTarget(r.source);
+    if (!('error' in t) && t.origin) out.add(t.origin);
+  }
+  return out;
+}
+
+export function renderUrlRegion(ctx: PageContext, r: Region): Raw {
+  const t = ctx.locale.t;
+  const target = urlTarget(r.source);
+  if ('error' in target) return html`<div class="alert alert-error" role="alert">${target.error}</div>`;
+  const url = substitute((r.source ?? '').trim(), ctx, encodeURIComponent);
+  // the substituted URL still goes to the same origin (substitutions are encoded, but check anyway)
+  const resolved = new URL(url, 'https://same.origin.invalid');
+  if (target.origin ? resolved.origin !== target.origin : resolved.origin !== 'https://same.origin.invalid')
+    return html`<div class="alert alert-error" role="alert">The URL of this region is not valid.</div>`;
+  const c = (r.config ?? {}) as UrlRegionConfig;
+  const problem = urlConfigProblem(c);
+  const height = !problem && c.height ? c.height : 480;
+  const sandbox = !problem && c.sandbox === false ? null : (!problem && Array.isArray(c.sandbox) ? c.sandbox : DEFAULT_SANDBOX).join(' ');
+  const cls = `url-frame ${ctx.css.cls(`height:${height}px`)}`;
+  return html`<iframe class="${cls}" src="${url}" title="${r.title ?? t('region.url_frame')}" loading="lazy" referrerpolicy="strict-origin-when-cross-origin"${
+    sandbox === null ? '' : html` sandbox="${sandbox}"`}${c.fullscreen === true ? html` allowfullscreen` : ''}></iframe>
+    <p class="url-open"><a href="${url}" target="_blank" rel="noopener noreferrer">${t('region.url_open')}</a></p>`;
+}

package/src/security.ts

@@ -69,6 +69,10 @@ declare module 'fastify' {
   interface FastifyRequest {
     /** The CSP nonce of this response: the only inline <style> allowed carries it. */
     cspNonce: string;
+    /** (078) origins this page frames (URL regions): the CSP's frame-src */
+    frameSrc: Set<string> | null;
+    /** (086) https origins of the page's display image items: added to the CSP's img-src */
+    imgSrc: Set<string> | null;
   }
 }
 
@@ -78,8 +82,12 @@ const MAP_TILES = tileOrigin();
 /** Security headers for every response. */
 export function securityHeaders(app: FastifyInstance) {
   app.decorateRequest('cspNonce', '');
+  app.decorateRequest('frameSrc', null);
+  app.decorateRequest('imgSrc', null);
   app.addHook('onRequest', async (req) => {
     req.cspNonce = randomBytes(18).toString('base64');
+    req.frameSrc = new Set();
+    req.imgSrc = new Set();
   });
   app.addHook('onSend', async (req, reply, payload) => {
     reply.header('X-Content-Type-Options', 'nosniff');
@@ -94,7 +102,9 @@ export function securityHeaders(app: FastifyInstance) {
       // chart geometry) carries this response's nonce; style="" attributes are refused.
       reply.header(
         'Content-Security-Policy',
-        `default-src 'self'; script-src 'self'; style-src 'self' 'nonce-${req.cspNonce}'; img-src 'self' data:${MAP_TILES ? ` ${MAP_TILES}` : ''}; ` +
+        `default-src 'self'; script-src 'self'; style-src 'self' 'nonce-${req.cspNonce}'; img-src 'self' data:${MAP_TILES ? ` ${MAP_TILES}` : ''}${req.imgSrc?.size ? ` ${[...req.imgSrc].join(' ')}` : ''}; ` +
+          // (078) a page with URL regions may frame exactly their origins (literal https origins, see url-region.ts)
+          (req.frameSrc?.size ? `frame-src 'self' ${[...req.frameSrc].join(' ')}; ` : '') +
           "frame-ancestors 'self'; form-action 'self'; base-uri 'none'; object-src 'none'",
       );
       // Pages contain user data: never cache them (e.g. back button after sign-out).

package/src/server.ts

@@ -4,6 +4,7 @@ import { startScheduler } from './automations.ts';
 import { startWorkflowRunner } from './workflow.ts';
 import { startProcessJobRunner } from './process-jobs.ts';
 import { startPushListener } from './push.ts';
+import { startMailListener } from './mail/mail.ts';
 
 const app = await buildApp();
 await app.listen({ port: Number(process.env.PORT ?? 3100), host: process.env.HOST ?? '127.0.0.1' });
@@ -12,3 +13,4 @@ startScheduler();
 await startWorkflowRunner();
 await startProcessJobRunner();
 await startPushListener();
+await startMailListener();

package/src/session.ts

@@ -15,6 +15,10 @@ export interface Session {
   /** Builder only: the developer's workspaces and the current one (src/builder/workspaces.ts). */
   workspaces?: { id: number; name: string }[];
   workspace?: { id: number; name: string } | null;
+  /** Builder only (079): sha256 of the developer toolbar token (src/runtime/devbar.ts). */
+  devbar_hash?: string | null;
+  /** (085) when the session started, in ms since the epoch (its maximum length counts from here) */
+  created_ms?: number;
 }
 
 // instance settings (src/instance.ts): the builder's value, else SESSION_* environment variables, else 60 minutes / 8 hours
@@ -23,6 +27,8 @@ const MAX_HOURS = () => instanceSetting('session_max_hours');
 const secure = () => process.env.COOKIE_SECURE === 'true';
 
 export const cookieName = (appId: number | null) => (appId === null ? 'pgkiln_dev' : `pgkiln_app_${appId}`);
+/** The idle and maximum session length (minutes, hours), for lookups outside this file. */
+export const sessionLimits = () => ({ idleMinutes: IDLE_MINUTES(), maxHours: MAX_HOURS() });
 
 async function find(token: string | undefined, appId: number | null) {
   if (!token || token.length > 100) return undefined;
@@ -31,7 +37,7 @@ async function find(token: string | undefined, appId: number | null) {
       where token_hash = $1 and app_id is not distinct from $2
         and last_seen > now() - make_interval(mins => $3)
         and created_at > now() - make_interval(hours => $4)
-     returning id, app_id, username, csrf_token, state, roles`,
+     returning id, app_id, username, csrf_token, state, roles, devbar_hash, (extract(epoch from created_at) * 1000)::float8 as created_ms`,
     [hashToken(token), appId, IDLE_MINUTES(), MAX_HOURS()],
   );
 }
@@ -44,7 +50,7 @@ export async function createSession(reply: FastifyReply, appId: number | null, p
   const token = newToken();
   const s = (await runtime.one<Session>(
     `insert into meta.session (token_hash, app_id, username, roles) values ($1, $2, $3, $4)
-     returning id, app_id, username, csrf_token, state, roles`,
+     returning id, app_id, username, csrf_token, state, roles, (extract(epoch from created_at) * 1000)::float8 as created_ms`,
     [hashToken(token), appId, username, roles.map((r) => r.toLowerCase())],
   ))!;
   if (Math.random() < 0.05)

package/src/workingcopy.ts

@@ -341,8 +341,8 @@ export async function mergeCopy(copyId: number, o: MergeOptions) {
     } catch (e) {
       throw new WorkingCopyError(`The merged application is not consistent: ${(e as Error).message}. Resolve it in the working copy (or the main application) first.`);
     }
-    if (o.direction === 'merge') await replaceApp(c, doc, l.mainAlias);
-    await replaceApp(c, doc, l.copy.alias);
+    if (o.direction === 'merge') await replaceApp(c, doc, l.mainAlias, { backup: { reason: 'merge', user: o.username, note: `merge of working copy ${l.copy.alias}` } });
+    await replaceApp(c, doc, l.copy.alias, { backup: { reason: 'merge', user: o.username } });
     // the copy keeps running nothing on its own
     await c.query('update meta.automation set enabled = false where app_id = $1', [copyId]);
     await c.query('update meta.rest_source set sync_enabled = false where app_id = $1', [copyId]);