smoonb 1.0.7 → 1.0.8

package/src/commands/restore/management.js

@@ -0,0 +1,74 @@
+async function management(
+  target,
+  endpoint,
+  { method = 'GET', body, fetchImpl = fetch } = {},
+) {
+  if (!/^[a-z0-9-]+$/.test(target.targetProjectId) || !target.targetAccessToken)
+    throw new Error('Management API credentials are required');
+  let response;
+  try {
+    response = await fetchImpl(
+      `https://api.supabase.com/v1/projects/${target.targetProjectId}/${endpoint}`,
+      {
+        method,
+        signal: AbortSignal.timeout(60000),
+        headers: {
+          Authorization: `Bearer ${target.targetAccessToken}`,
+          'Content-Type': 'application/json',
+        },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      },
+    );
+  } catch {
+    throw new Error(`Management API ${endpoint}: network failure`);
+  }
+  // Error response bodies may contain secrets from the submitted configuration.
+  if (!response.ok)
+    throw new Error(`Management API ${endpoint}: HTTP ${response.status}`);
+  return response.status === 204 ? null : response.json();
+}
+async function applyConfig(
+  target,
+  endpoint,
+  desired,
+  allowed,
+  request = management,
+) {
+  const before = await request(target, endpoint);
+  const patch = {};
+  const unsupported = [];
+  for (const [key, value] of Object.entries(desired)) {
+    if (JSON.stringify(before[key]) === JSON.stringify(value)) continue;
+    if (!allowed.includes(key)) {
+      unsupported.push(key);
+      continue;
+    }
+    if (
+      typeof value === 'string' &&
+      /^(\*{3,}|[•●]{3,}|\[redacted\])$/i.test(value)
+    )
+      throw new Error(`Masked configuration cannot be restored: ${key}`);
+    patch[key] = value;
+  }
+  if (unsupported.length)
+    throw new Error(
+      `Configuration requires manual migration: ${unsupported.join(', ')}`,
+    );
+  if (Object.keys(patch).length)
+    await request(target, endpoint, { method: 'PATCH', body: patch });
+  const after = await request(target, endpoint);
+  const differences = Object.keys(desired).filter(
+    (k) => JSON.stringify(desired[k]) !== JSON.stringify(after[k]),
+  );
+  if (differences.length)
+    throw new Error(
+      `Configuration verification failed: ${differences.join(', ')}`,
+    );
+  return {
+    success: true,
+    verified: true,
+    fields_verified: Object.keys(desired).length,
+    fields_updated: Object.keys(patch),
+  };
+}
+module.exports = { management, applyConfig };

package/src/commands/restore/pg.js

@@ -0,0 +1,83 @@
+const { spawn } = require('child_process');
+
+const ident = (value) => '"' + String(value).replace(/"/g, '""') + '"';
+const literal = (value) => "'" + String(value).replace(/'/g, "''") + "'";
+
+// SQL and credentials go through stdin/environment, never a shell command.
+function runSql(databaseUrl, sql, { postgresMajor = 17 } = {}) {
+  const url = new URL(databaseUrl);
+  if (!['postgres:', 'postgresql:'].includes(url.protocol))
+    throw new Error('Invalid database URL');
+  if (![15, 16, 17].includes(Number(postgresMajor)))
+    throw new Error('Unsupported PostgreSQL major');
+  const env = {
+    ...process.env,
+    PGHOST: url.hostname,
+    PGPORT: url.port || '5432',
+    PGUSER: decodeURIComponent(url.username),
+    PGPASSWORD: decodeURIComponent(url.password),
+    PGDATABASE: decodeURIComponent(url.pathname.slice(1) || 'postgres'),
+    PGSSLMODE: url.searchParams.get('sslmode') || 'prefer',
+    PGCONNECT_TIMEOUT: '20',
+  };
+  const args = [
+    'run',
+    '--rm',
+    '-i',
+    '--network',
+    'host',
+    ...[
+      'PGHOST',
+      'PGPORT',
+      'PGUSER',
+      'PGPASSWORD',
+      'PGDATABASE',
+      'PGSSLMODE',
+      'PGCONNECT_TIMEOUT',
+    ].flatMap((k) => ['-e', k]),
+    `postgres:${postgresMajor}`,
+    'psql',
+    '-X',
+    '-q',
+    '-A',
+    '-t',
+    '-v',
+    'ON_ERROR_STOP=1',
+    '-v',
+    'VERBOSITY=sqlstate',
+  ];
+  return new Promise((resolve, reject) => {
+    const child = spawn('docker', args, {
+      env,
+      windowsHide: true,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let output = '';
+    let errors = '';
+    child.stdout.on('data', (chunk) => {
+      output += chunk;
+    });
+    child.stderr.on('data', (chunk) => {
+      errors += chunk;
+    });
+    child.stdin.on('error', () => {});
+    child.on('error', () =>
+      reject(new Error('Could not start Docker PostgreSQL client')),
+    );
+    child.on('close', (code) => {
+      if (code !== 0) {
+        // COPY errors can contain customer records. Expose SQLSTATE only.
+        const states = [
+          ...new Set(errors.match(/\b[0-9A-Z]{5}\b/g) || []),
+        ].filter((x) => /\d/.test(x));
+        reject(
+          new Error(
+            `Database operation failed (exit ${code}; SQLSTATE ${states.join(', ') || 'unavailable'}). Transaction rolled back when applicable.`,
+          ),
+        );
+      } else resolve(output.trim());
+    });
+    child.stdin.end(sql);
+  });
+}
+module.exports = { runSql, ident, literal };

package/src/commands/restore/runner.js

@@ -0,0 +1,117 @@
+const fs = require('fs');
+const path = require('path');
+const { t } = require('../../i18n');
+const { buildRestore, readDump } = require('./dump');
+const { storagePlan } = require('./steps/06-storage');
+const steps = {
+  database: require('./steps/03-database'),
+  edgeFunctions: require('./steps/04-edge-functions'),
+  authSettings: require('./steps/05-auth-settings'),
+  storage: require('./steps/06-storage'),
+  databaseSettings: require('./steps/07-database-settings'),
+  realtimeSettings: require('./steps/08-realtime-settings'),
+};
+async function runRestore(
+  {
+    selectedBackup,
+    components,
+    targetProject,
+    processDir,
+    postgresMajor,
+    remapUrls = true,
+  },
+  implementations = steps,
+) {
+  if (selectedBackup.projectId === targetProject.targetProjectId)
+    throw new Error('Restore requires a different, empty destination project');
+  const context = {
+    backupPath: selectedBackup.path,
+    backupFilePath: path.join(selectedBackup.path, selectedBackup.backupFile),
+    targetProject,
+    targetDatabaseUrl: targetProject.targetDatabaseUrl,
+    sourceProjectId: selectedBackup.projectId,
+    targetProjectId: targetProject.targetProjectId,
+    postgresMajor,
+    remapUrls,
+  };
+  const report = {
+    process: 'restore',
+    smoonb_version: require('../../../package.json').version,
+    created_at: new Date().toISOString(),
+    source_project_id: selectedBackup.projectId,
+    target_project_id: targetProject.targetProjectId,
+    status: 'running',
+    components,
+    results: {},
+    remap_service_urls: remapUrls,
+    notes: [
+      'Local source files and backup archives are preserved.',
+      'Verification covers selected components; application login and workflows require acceptance testing.',
+    ],
+  };
+  const save = () =>
+    fs.writeFileSync(
+      path.join(processDir, 'report.json'),
+      JSON.stringify(report, null, 2),
+    );
+  save();
+  let current = 'preflight';
+  try {
+    if (targetProject.targetDatabaseUrl) {
+      const url = new URL(targetProject.targetDatabaseUrl);
+      const hosted =
+        url.hostname.endsWith('.supabase.co') ||
+        url.hostname.endsWith('.supabase.com');
+      if (
+        hosted &&
+        url.hostname !== `db.${targetProject.targetProjectId}.supabase.co` &&
+        !decodeURIComponent(url.username).endsWith(
+          `.${targetProject.targetProjectId}`,
+        )
+      )
+        throw new Error(
+          'Database connection does not match the destination project',
+        );
+    }
+    if (
+      targetProject.targetUrl &&
+      new URL(targetProject.targetUrl).hostname !==
+        `${targetProject.targetProjectId}.supabase.co`
+    )
+      throw new Error('API URL does not match the destination project');
+    // Parse and validate inventories before the first mutation.
+    if (components.database)
+      buildRestore(readDump(context.backupFilePath), context);
+    if (components.storage)
+      storagePlan(context.backupPath, context.backupFilePath);
+    for (const [name, step] of Object.entries(implementations)) {
+      if (!components[name]) continue;
+      current = name;
+      report.results[name] = { success: false, status: 'running' };
+      save();
+      const labels = {
+        database: 'restoringDatabase', edgeFunctions: 'restoringEdgeFunctions',
+        authSettings: 'restoringAuthSettings', storage: 'restoringStorageBuckets',
+        databaseSettings: 'restoringDatabaseSettings', realtimeSettings: 'restoringRealtimeSettings',
+      };
+      console.log((global.smoonbI18n?.t || t)(`restore.index.${labels[name]}`));
+      const result = await step(context);
+      if (!result?.success || !result?.verified)
+        throw new Error(`Component ${name} did not pass verification`);
+      report.results[name] = { ...result, status: 'verified' };
+      save();
+    }
+    report.status = 'verified';
+    report.completed_at = new Date().toISOString();
+    save();
+    return report.results;
+  } catch (error) {
+    report.status = 'failed';
+    report.failed_component = current;
+    report.results[current] = { success: false, status: 'failed' };
+    report.completed_at = new Date().toISOString();
+    save();
+    throw error;
+  }
+}
+module.exports = { runRestore };

package/src/commands/restore/steps/03-database.js

@@ -1,84 +1,18 @@
-const chalk = require('chalk');
-const path = require('path');
-const { execSync } = require('child_process');
-const { t } = require('../../../i18n');
-const ui = require('../../../utils/cliUi');
-
-/**
- * Etapa 3: Restaurar Database via psql
- */
-module.exports = async ({ backupFilePath, targetDatabaseUrl }) => {
-  try {
-    const getT = global.smoonbI18n?.t || t;
-    const backupDirAbs = path.resolve(path.dirname(backupFilePath));
-    const fileName = path.basename(backupFilePath);
-    let uncompressedFile = fileName;
-    
-    // Verificar se é arquivo .backup.gz (compactado) ou .backup (descompactado)
-    if (fileName.endsWith('.backup.gz')) {
-      console.log(chalk.white(`   - ${getT('restore.steps.database.detectedGz')}`));
-      console.log(chalk.white(`   - ${getT('restore.steps.database.extractingGz')}`));
-      
-      const unzipCmd = [
-        'docker run --rm',
-        `-v "${backupDirAbs}:/host"`,
-        'postgres:17 gunzip /host/' + fileName
-      ].join(' ');
-      
-      execSync(unzipCmd, { stdio: 'pipe' });
-      uncompressedFile = fileName.replace('.gz', '');
-      console.log(chalk.white(`   - ${getT('restore.steps.database.uncompressed', { file: uncompressedFile })}`));
-    } else if (fileName.endsWith('.backup')) {
-      console.log(chalk.white(`   - ${getT('restore.steps.database.detectedBackup')}`));
-      console.log(chalk.white(`   - ${getT('restore.steps.database.proceeding')}`));
-    } else {
-      throw new Error(`Formato de arquivo inválido. Esperado .backup.gz ou .backup, recebido: ${fileName}`);
-    }
-    
-    // Extrair credenciais da URL de conexão
-    const urlMatch = targetDatabaseUrl.match(/postgresql:\/\/([^@:]+):([^@]+)@(.+)$/);
-    
-    if (!urlMatch) {
-      const getT = global.smoonbI18n?.t || t;
-      throw new Error(getT('error.databaseUrlInvalid'));
-    }
-    
-    // Comando psql conforme documentação oficial Supabase
-    const restoreCmd = [
-      'docker run --rm --network host',
-      `-v "${backupDirAbs}:/host"`,
-      `-e PGPASSWORD="${encodeURIComponent(urlMatch[2])}"`,
-      'postgres:17 psql',
-      `-d "${targetDatabaseUrl}"`,
-      `-f /host/${uncompressedFile}`
-    ].join(' ');
-    
-    console.log(chalk.cyan(`   - ${getT('restore.steps.database.executing')}`));
-    console.log(chalk.cyan(`   ℹ️ ${getT('restore.steps.database.followingDocs')}`));
-    console.log(chalk.yellow(`   ⚠️ ${getT('restore.steps.database.warning')}`));
-    console.log(chalk.yellow(`   ⚠️ ${getT('restore.steps.database.warningReason1')}`));
-    console.log(chalk.yellow(`   ⚠️ ${getT('restore.steps.database.warningReason2')}`));
-    
-    // Executar comando de restauração
-    execSync(restoreCmd, { stdio: 'inherit', encoding: 'utf8' });
-    
-    console.log(chalk.green(`   ✅ ${getT('restore.steps.database.success')}`));
-    ui.hint(`   ℹ️ ${getT('restore.steps.database.normalErrors')}`);
-    
-  } catch (error) {
-    // Erros esperados conforme documentação oficial Supabase
-    const getT = global.smoonbI18n?.t || t;
-    if (error.message.includes('already exists') || 
-        error.message.includes('constraint') ||
-        error.message.includes('duplicate') ||
-        error.stdout?.includes('already exists')) {
-      console.log(chalk.yellow(`   ⚠️ ${getT('restore.steps.database.expectedErrors')}`));
-      console.log(chalk.green(`   ✅ ${getT('restore.steps.database.success')}`));
-      ui.hint(`   ℹ️ ${getT('restore.steps.database.errorsIgnored')}`);
-    } else {
-      console.error(chalk.red(`   ❌ ${getT('restore.steps.database.error', { message: error.message })}`));
-      throw error;
-    }
-  }
-};
-
+const { readDump, buildRestore } = require('../dump');
+const { runSql } = require('../pg');
+module.exports = async ({
+  backupFilePath,
+  targetDatabaseUrl,
+  sourceProjectId,
+  targetProjectId,
+  remapUrls = true,
+  postgresMajor = 17,
+}) => {
+  const plan = buildRestore(readDump(backupFilePath), {
+    sourceProjectId,
+    targetProjectId,
+    remapUrls,
+  });
+  await runSql(targetDatabaseUrl, plan.sql, { postgresMajor });
+  return plan.summary;
+};

package/src/commands/restore/steps/04-edge-functions.js

@@ -1,122 +1,95 @@
-const chalk = require('chalk');
-const path = require('path');
-const fs = require('fs').promises;
-const { execSync } = require('child_process');
-const { copyDirectoryRecursive } = require('../utils');
-const { t } = require('../../../i18n');
-
-/**
- * Etapa 4: Restaurar Edge Functions via supabase functions deploy
- */
-module.exports = async ({ backupPath, targetProject }) => {
-  try {
-    const getT = global.smoonbI18n?.t || t;
-    const edgeFunctionsDir = path.join(backupPath, 'edge-functions');
-    
-    if (!await fs.access(edgeFunctionsDir).then(() => true).catch(() => false)) {
-      console.log(chalk.yellow(`   ⚠️  ${getT('restore.steps.edgeFunctions.notFound')}`));
-      return { success: false, functions_count: 0, success_count: 0 };
-    }
-    
-    const items = await fs.readdir(edgeFunctionsDir);
-    const functions = [];
-    
-    for (const item of items) {
-      const itemPath = path.join(edgeFunctionsDir, item);
-      const stats = await fs.stat(itemPath);
-      if (stats.isDirectory()) {
-        functions.push(item);
-      }
-    }
-    
-    if (functions.length === 0) {
-      console.log(chalk.yellow(`   ⚠️  ${getT('restore.steps.edgeFunctions.notFound')}`));
-      return { success: false, functions_count: 0, success_count: 0 };
-    }
-    
-    console.log(chalk.white(`   - ${getT('restore.steps.edgeFunctions.found', { count: functions.length })}`));
-    
-    // COPIAR Edge Functions de backups/backup-XXX/edge-functions para supabase/functions
-    const supabaseFunctionsDir = path.join(process.cwd(), 'supabase', 'functions');
-    
-    // Criar diretório supabase/functions se não existir
-    await fs.mkdir(supabaseFunctionsDir, { recursive: true });
-    
-    // Limpar supabase/functions antes de copiar (necessário para garantir ambiente limpo)
-    console.log(chalk.cyan(`   - ${getT('restore.steps.edgeFunctions.cleaningBefore')}`));
-    try {
-      await fs.rm(supabaseFunctionsDir, { recursive: true, force: true });
-      await fs.mkdir(supabaseFunctionsDir, { recursive: true });
-    } catch {
-      // Ignorar erro de limpeza se não existir
-    }
-    
-    // Copiar cada Edge Function para supabase/functions
-    for (const funcName of functions) {
-      const backupFuncPath = path.join(edgeFunctionsDir, funcName);
-      const targetFuncPath = path.join(supabaseFunctionsDir, funcName);
-      
-      console.log(chalk.white(`   - ${getT('restore.steps.edgeFunctions.copying', { funcName })}`));
-      
-      // Copiar recursivamente
-      await copyDirectoryRecursive(backupFuncPath, targetFuncPath);
-    }
-    
-    console.log(chalk.white(`   - ${getT('restore.steps.edgeFunctions.linking', { projectId: targetProject.targetProjectId })}`));
-    
-    // Linkar com o projeto destino
-    try {
-      execSync(`supabase link --project-ref ${targetProject.targetProjectId}`, {
-        stdio: 'pipe',
-        encoding: 'utf8',
-        timeout: 10000,
-        env: { ...process.env, SUPABASE_ACCESS_TOKEN: targetProject.targetAccessToken || '' }
-      });
-    } catch {
-      console.log(chalk.yellow(`   ⚠️  ${getT('restore.steps.edgeFunctions.linkMayExist')}`));
-    }
-    
-    // Deploy das Edge Functions
-    let successCount = 0;
-    for (const funcName of functions) {
-      console.log(chalk.white(`   - ${getT('restore.steps.edgeFunctions.deploying', { funcName })}`));
-      
-      try {
-        execSync(`supabase functions deploy ${funcName}`, {
-          cwd: process.cwd(),
-          stdio: 'pipe',
-          encoding: 'utf8',
-          timeout: 120000,
-          env: { ...process.env, SUPABASE_ACCESS_TOKEN: targetProject.targetAccessToken || '' }
-        });
-        
-        console.log(chalk.green(`   ✅ ${getT('restore.steps.edgeFunctions.deployed', { funcName })}`));
-        successCount++;
-      } catch (deployError) {
-        console.log(chalk.yellow(`   ⚠️  ${getT('restore.steps.edgeFunctions.deployFailed', { funcName, message: deployError.message })}`));
-      }
-    }
-    
-    // Limpar supabase/functions após deploy (arquivos temporários não são mais necessários)
-    console.log(chalk.cyan(`   - ${getT('restore.steps.edgeFunctions.cleaningAfter')}`));
-    try {
-      await fs.rm(supabaseFunctionsDir, { recursive: true, force: true });
-    } catch {
-      // Ignorar erro de limpeza
-    }
-    
-    console.log(chalk.green(`   ✅ ${getT('restore.steps.edgeFunctions.success')}`));
-    
-    return {
-      success: true,
-      functions_count: functions.length,
-      success_count: successCount
-    };
-    
-  } catch (error) {
-    const getT = global.smoonbI18n?.t || t;
-    console.error(chalk.red(`   ❌ ${getT('restore.steps.edgeFunctions.error', { message: error.message })}`));
-    throw error;
-  }
-};
-
+const fs = require('fs').promises;
+const os = require('os');
+const path = require('path');
+const { runSupabase } = require('../../../utils/supabaseCli');
+const { management } = require('../management');
+const { copyDirectoryRecursive } = require('../utils');
+module.exports = async (
+  { backupPath, targetProject },
+  { deploy = runSupabase, request = management } = {},
+) => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'smoonb-functions-'));
+  try {
+    const source = path.join(backupPath, 'edge-functions');
+    const names = (await fs.readdir(source, { withFileTypes: true }))
+      .filter((e) => e.isDirectory() && e.name !== '_shared')
+      .map((e) => e.name);
+    if (!names.length)
+      return {
+        success: true,
+        verified: true,
+        functions_count: 0,
+        success_count: 0,
+      };
+    if (names.some((n) => !/^[-a-zA-Z0-9_]+$/.test(n)))
+      throw new Error('Invalid function slug in backup');
+    await copyDirectoryRecursive(
+      source,
+      path.join(root, 'supabase', 'functions'),
+    );
+    const manifest = JSON.parse(
+      await fs.readFile(path.join(backupPath, 'backup-manifest.json'), 'utf8'),
+    );
+    const metadata = manifest.components?.edge_functions?.functions || [];
+    const settings = names.map((name) => ({
+      name,
+      verify_jwt:
+        metadata.find((f) => (f.slug || f.name) === name)?.verify_jwt ?? true,
+    }));
+    await fs.writeFile(
+      path.join(root, 'supabase', 'config.toml'),
+      `project_id = "smoonb-restore"\n` +
+        settings
+          .map((f) => `[functions.${f.name}]\nverify_jwt = ${f.verify_jwt}\n`)
+          .join('\n'),
+    );
+    for (const f of settings) {
+      const args = [
+        'functions',
+        'deploy',
+        f.name,
+        '--project-ref',
+        targetProject.targetProjectId,
+        '--workdir',
+        root,
+        '--use-api',
+      ];
+      if (!f.verify_jwt) args.push('--no-verify-jwt');
+      try {
+        deploy('supabase', args, {
+          cwd: root,
+          env: {
+            ...process.env,
+            SUPABASE_ACCESS_TOKEN: targetProject.targetAccessToken,
+          },
+          stdio: 'pipe',
+          timeout: 180000,
+          windowsHide: true,
+        });
+      } catch {
+        throw new Error(`Edge Function deployment failed: ${f.name}`);
+      }
+    }
+    const remote = await request(targetProject, 'functions');
+    for (const f of settings)
+      if (
+        !remote.some(
+          (r) =>
+            r.slug === f.name &&
+            r.status === 'ACTIVE' &&
+            r.verify_jwt === f.verify_jwt,
+        )
+      )
+        throw new Error(`Edge Function verification failed: ${f.name}`);
+    return {
+      success: true,
+      verified: true,
+      functions_count: names.length,
+      success_count: names.length,
+      local_sources_preserved: true,
+    };
+  } finally {
+    // Only the directory freshly allocated by mkdtemp is removed.
+    await fs.rm(root, { recursive: true, force: true });
+  }
+};