smoonb 1.0.7 → 1.0.9

package/src/commands/restore/auth-fields.json

@@ -0,0 +1,237 @@
+[
+  "site_url",
+  "disable_signup",
+  "jwt_exp",
+  "smtp_admin_email",
+  "smtp_host",
+  "smtp_port",
+  "smtp_user",
+  "smtp_pass",
+  "smtp_max_frequency",
+  "smtp_sender_name",
+  "mailer_allow_unverified_email_sign_ins",
+  "mailer_autoconfirm",
+  "mailer_subjects_invite",
+  "mailer_subjects_confirmation",
+  "mailer_subjects_recovery",
+  "mailer_subjects_email_change",
+  "mailer_subjects_magic_link",
+  "mailer_subjects_reauthentication",
+  "mailer_subjects_password_changed_notification",
+  "mailer_subjects_email_changed_notification",
+  "mailer_subjects_phone_changed_notification",
+  "mailer_subjects_mfa_factor_enrolled_notification",
+  "mailer_subjects_mfa_factor_unenrolled_notification",
+  "mailer_subjects_identity_linked_notification",
+  "mailer_subjects_identity_unlinked_notification",
+  "mailer_templates_invite_content",
+  "mailer_templates_confirmation_content",
+  "mailer_templates_recovery_content",
+  "mailer_templates_email_change_content",
+  "mailer_templates_magic_link_content",
+  "mailer_templates_reauthentication_content",
+  "mailer_templates_password_changed_notification_content",
+  "mailer_templates_email_changed_notification_content",
+  "mailer_templates_phone_changed_notification_content",
+  "mailer_templates_mfa_factor_enrolled_notification_content",
+  "mailer_templates_mfa_factor_unenrolled_notification_content",
+  "mailer_templates_identity_linked_notification_content",
+  "mailer_templates_identity_unlinked_notification_content",
+  "mailer_notifications_password_changed_enabled",
+  "mailer_notifications_email_changed_enabled",
+  "mailer_notifications_phone_changed_enabled",
+  "mailer_notifications_mfa_factor_enrolled_enabled",
+  "mailer_notifications_mfa_factor_unenrolled_enabled",
+  "mailer_notifications_identity_linked_enabled",
+  "mailer_notifications_identity_unlinked_enabled",
+  "mfa_max_enrolled_factors",
+  "uri_allow_list",
+  "external_anonymous_users_enabled",
+  "external_email_enabled",
+  "external_phone_enabled",
+  "saml_enabled",
+  "saml_external_url",
+  "security_sb_forwarded_for_enabled",
+  "security_captcha_enabled",
+  "security_captcha_provider",
+  "security_captcha_secret",
+  "sessions_timebox",
+  "sessions_inactivity_timeout",
+  "sessions_single_per_user",
+  "sessions_tags",
+  "rate_limit_anonymous_users",
+  "rate_limit_email_sent",
+  "rate_limit_sms_sent",
+  "rate_limit_verify",
+  "rate_limit_token_refresh",
+  "rate_limit_otp",
+  "rate_limit_web3",
+  "mailer_secure_email_change_enabled",
+  "refresh_token_rotation_enabled",
+  "password_hibp_enabled",
+  "password_min_length",
+  "password_required_characters",
+  "security_manual_linking_enabled",
+  "security_update_password_require_reauthentication",
+  "security_update_password_require_current_password",
+  "security_refresh_token_reuse_interval",
+  "mailer_otp_exp",
+  "mailer_otp_length",
+  "sms_autoconfirm",
+  "sms_max_frequency",
+  "sms_otp_exp",
+  "sms_otp_length",
+  "sms_provider",
+  "sms_messagebird_access_key",
+  "sms_messagebird_originator",
+  "sms_test_otp",
+  "sms_test_otp_valid_until",
+  "sms_textlocal_api_key",
+  "sms_textlocal_sender",
+  "sms_twilio_account_sid",
+  "sms_twilio_auth_token",
+  "sms_twilio_content_sid",
+  "sms_twilio_message_service_sid",
+  "sms_twilio_verify_account_sid",
+  "sms_twilio_verify_auth_token",
+  "sms_twilio_verify_message_service_sid",
+  "sms_vonage_api_key",
+  "sms_vonage_api_secret",
+  "sms_vonage_from",
+  "sms_template",
+  "hook_mfa_verification_attempt_enabled",
+  "hook_mfa_verification_attempt_uri",
+  "hook_mfa_verification_attempt_secrets",
+  "hook_password_verification_attempt_enabled",
+  "hook_password_verification_attempt_uri",
+  "hook_password_verification_attempt_secrets",
+  "hook_custom_access_token_enabled",
+  "hook_custom_access_token_uri",
+  "hook_custom_access_token_secrets",
+  "hook_send_sms_enabled",
+  "hook_send_sms_uri",
+  "hook_send_sms_secrets",
+  "hook_send_email_enabled",
+  "hook_send_email_uri",
+  "hook_send_email_secrets",
+  "hook_before_user_created_enabled",
+  "hook_before_user_created_uri",
+  "hook_before_user_created_secrets",
+  "hook_after_user_created_enabled",
+  "hook_after_user_created_uri",
+  "hook_after_user_created_secrets",
+  "external_apple_enabled",
+  "external_apple_client_id",
+  "external_apple_email_optional",
+  "external_apple_secret",
+  "external_apple_additional_client_ids",
+  "external_azure_enabled",
+  "external_azure_client_id",
+  "external_azure_email_optional",
+  "external_azure_secret",
+  "external_azure_url",
+  "external_bitbucket_enabled",
+  "external_bitbucket_client_id",
+  "external_bitbucket_email_optional",
+  "external_bitbucket_secret",
+  "external_discord_enabled",
+  "external_discord_client_id",
+  "external_discord_email_optional",
+  "external_discord_secret",
+  "external_facebook_enabled",
+  "external_facebook_client_id",
+  "external_facebook_email_optional",
+  "external_facebook_secret",
+  "external_figma_enabled",
+  "external_figma_client_id",
+  "external_figma_email_optional",
+  "external_figma_secret",
+  "external_github_enabled",
+  "external_github_client_id",
+  "external_github_email_optional",
+  "external_github_secret",
+  "external_gitlab_enabled",
+  "external_gitlab_client_id",
+  "external_gitlab_email_optional",
+  "external_gitlab_secret",
+  "external_gitlab_url",
+  "external_google_enabled",
+  "external_google_client_id",
+  "external_google_email_optional",
+  "external_google_secret",
+  "external_google_additional_client_ids",
+  "external_google_skip_nonce_check",
+  "external_kakao_enabled",
+  "external_kakao_client_id",
+  "external_kakao_email_optional",
+  "external_kakao_secret",
+  "external_keycloak_enabled",
+  "external_keycloak_client_id",
+  "external_keycloak_email_optional",
+  "external_keycloak_secret",
+  "external_keycloak_url",
+  "external_linkedin_oidc_enabled",
+  "external_linkedin_oidc_client_id",
+  "external_linkedin_oidc_email_optional",
+  "external_linkedin_oidc_secret",
+  "external_slack_oidc_enabled",
+  "external_slack_oidc_client_id",
+  "external_slack_oidc_email_optional",
+  "external_slack_oidc_secret",
+  "external_notion_enabled",
+  "external_notion_client_id",
+  "external_notion_email_optional",
+  "external_notion_secret",
+  "external_slack_enabled",
+  "external_slack_client_id",
+  "external_slack_email_optional",
+  "external_slack_secret",
+  "external_spotify_enabled",
+  "external_spotify_client_id",
+  "external_spotify_email_optional",
+  "external_spotify_secret",
+  "external_twitch_enabled",
+  "external_twitch_client_id",
+  "external_twitch_email_optional",
+  "external_twitch_secret",
+  "external_twitter_enabled",
+  "external_twitter_client_id",
+  "external_twitter_email_optional",
+  "external_twitter_secret",
+  "external_x_enabled",
+  "external_x_client_id",
+  "external_x_email_optional",
+  "external_x_secret",
+  "external_workos_enabled",
+  "external_workos_client_id",
+  "external_workos_secret",
+  "external_workos_url",
+  "external_web3_solana_enabled",
+  "external_web3_ethereum_enabled",
+  "external_zoom_enabled",
+  "external_zoom_client_id",
+  "external_zoom_email_optional",
+  "external_zoom_secret",
+  "db_max_pool_size",
+  "db_max_pool_size_unit",
+  "api_max_request_duration",
+  "mfa_totp_enroll_enabled",
+  "mfa_totp_verify_enabled",
+  "mfa_web_authn_enroll_enabled",
+  "mfa_web_authn_verify_enabled",
+  "passkey_enabled",
+  "webauthn_rp_display_name",
+  "webauthn_rp_id",
+  "webauthn_rp_origins",
+  "mfa_phone_enroll_enabled",
+  "mfa_phone_verify_enabled",
+  "mfa_phone_max_frequency",
+  "mfa_phone_otp_length",
+  "mfa_phone_template",
+  "nimbus_oauth_client_id",
+  "nimbus_oauth_client_secret",
+  "oauth_server_enabled",
+  "oauth_server_allow_dynamic_registration",
+  "oauth_server_authorization_path",
+  "custom_oauth_enabled"
+]

package/src/commands/restore/auth.js

@@ -0,0 +1,65 @@
+const fs = require('fs');
+const path = require('path');
+const inquirer = require('inquirer');
+const { t } = require('../../i18n');
+const { remapServiceUrls } = require('./dump');
+const { isMasked } = require('../../utils/auth-secrets');
+
+async function prepareAuth(
+  { backupPath, targetProject, remapUrls = true },
+  {
+    prompt = (questions) => inquirer.prompt(questions),
+    interactive = Boolean(process.stdin.isTTY),
+    log = console.log,
+  } = {},
+) {
+  const getT = global.smoonbI18n?.t || t;
+  const backup = JSON.parse(
+    fs.readFileSync(path.join(backupPath, 'auth-settings.json'), 'utf8'),
+  );
+  const settings =
+    backup.settings?.auth_url_config ||
+    backup.settings ||
+    backup.auth_url_config;
+  if (!settings || !Object.keys(settings).length)
+    throw new Error('Auth configuration missing from backup');
+  // Never replay an opaque value from a legacy backup as a password.
+  const { smtp_pass: stored, ...readable } = settings;
+  const desired = remapUrls
+    ? JSON.parse(
+        remapServiceUrls(
+          JSON.stringify(readable),
+          backup.project_id,
+          targetProject.targetProjectId,
+        ),
+      )
+    : readable;
+  const needsPassword = Boolean(
+    stored || settings.smtp_host || backup.secrets?.smtp_pass?.requires_input,
+  );
+  const writeOnly = {};
+  if (needsPassword) {
+    log(getT('restore.smtp.explanation'));
+    if (!interactive) throw new Error(getT('restore.smtp.interactiveRequired'));
+    const validate = (value) =>
+      typeof value === 'string' &&
+      value.trim().length > 0 &&
+      !isMasked(value) &&
+      value !== stored;
+    const answer = await prompt([
+      {
+        type: 'password',
+        name: 'smtpPassword',
+        mask: '*',
+        message: getT('restore.smtp.password'),
+        validate: (value) => validate(value) || getT('restore.smtp.required'),
+      },
+    ]);
+    if (!validate(answer.smtpPassword))
+      throw new Error(getT('restore.smtp.required'));
+    writeOnly.smtp_pass = answer.smtpPassword;
+  }
+  return { desired, writeOnly };
+}
+
+module.exports = { prepareAuth };

package/src/commands/restore/dump.js

@@ -0,0 +1,284 @@
+const fs = require('fs');
+const zlib = require('zlib');
+const { ident, literal } = require('./pg');
+const managed = new Set([
+  'auth',
+  'storage',
+  'realtime',
+  '_realtime',
+  'extensions',
+  'graphql',
+  'graphql_public',
+  'pgbouncer',
+  'vault',
+  'supabase_functions',
+  'net',
+  'cron',
+  'pgsodium',
+  'pgsodium_masks',
+]);
+const isApplication = (schema) =>
+  schema !== '-' && !managed.has(schema) && !schema.startsWith('pg_');
+
+function readDump(file) {
+  const bytes = fs.readFileSync(file);
+  const text = (file.endsWith('.gz') ? zlib.gunzipSync(bytes) : bytes)
+    .toString('utf8')
+    .replace(/\r\n/g, '\n');
+  const matches = [
+    ...text.matchAll(
+      /^-- (?:Data for )?Name: (.*); Type: ([A-Z ]+); Schema: (.*); Owner: (.*)$/gm,
+    ),
+  ];
+  if (!matches.length)
+    throw new Error('Unsupported or incomplete plain PostgreSQL backup');
+  const sections = matches.map((m, i) => ({
+    name: m[1],
+    type: m[2],
+    schema: m[3],
+    owner: m[4],
+    sql: text
+      .slice(m.index + m[0].length, matches[i + 1]?.index ?? text.length)
+      .replace(/^(?:\n|--\n)+/, '')
+      .trim(),
+  }));
+  return {
+    sections,
+    tables: sections.filter((s) => s.type === 'TABLE DATA').map(parseCopy),
+  };
+}
+function parseCopy(section) {
+  const m = section.sql.match(
+    /^COPY (.+?) \((.+)\) FROM stdin;\n([\s\S]*?)^\\\.$/m,
+  );
+  if (!m)
+    throw new Error(
+      `Unsupported data section: ${section.schema}.${section.name}`,
+    );
+  const lines = m[3] ? m[3].replace(/\n$/, '').split('\n') : [];
+  return {
+    schema: section.schema,
+    name: section.name,
+    table: m[1],
+    columns: m[2],
+    lines,
+  };
+}
+function decodeCopy(value) {
+  if (value === '\\N') return null;
+  return value.replace(/\\([0-7]{1,3}|x[0-9a-f]{1,2}|.)/gi, (_, code) => {
+    if (/^[0-7]/.test(code)) return String.fromCharCode(parseInt(code, 8));
+    if (/^x/i.test(code))
+      return String.fromCharCode(parseInt(code.slice(1), 16));
+    return (
+      { t: '\t', n: '\n', r: '\r', b: '\b', f: '\f', v: '\v' }[code] || code
+    );
+  });
+}
+function records(table) {
+  if (!table) return [];
+  const columns = table.columns
+    .split(/,\s*/)
+    .map((x) => x.replace(/^"|"$/g, '').replace(/""/g, '"'));
+  return table.lines.map((line) =>
+    Object.fromEntries(
+      line.split('\t').map((v, i) => [columns[i], decodeCopy(v)]),
+    ),
+  );
+}
+function textArray(value) {
+  if (value === null || value === undefined) return null;
+  if (Array.isArray(value)) return value;
+  if (!value.startsWith('{') || !value.endsWith('}'))
+    throw new Error('Invalid PostgreSQL text array');
+  if (value === '{}') return [];
+  const result = [];
+  let item = '',
+    quoted = false,
+    escaped = false;
+  for (const char of value.slice(1, -1)) {
+    if (escaped) {
+      item += char;
+      escaped = false;
+    } else if (char === '\\') escaped = true;
+    else if (char === '"') quoted = !quoted;
+    else if (char === ',' && !quoted) {
+      result.push(item);
+      item = '';
+    } else item += char;
+  }
+  if (quoted || escaped) throw new Error('Invalid PostgreSQL text array');
+  result.push(item);
+  return result;
+}
+function remapServiceUrls(text, source, target) {
+  if (!source || !target || source === target) return text;
+  for (const ref of [source, target])
+    if (!/^[a-z0-9-]+$/.test(ref)) throw new Error('Invalid project reference');
+  return text.replace(
+    new RegExp(
+      `(?<![a-z0-9.-])${source}\\.supabase\\.co(?=[:/\\\\"'\\s]|$)`,
+      'g',
+    ),
+    `${target}.supabase.co`,
+  );
+}
+function resetObjectAcl(schemas) {
+  const scope = schemas.map(literal).join(',');
+  return `DO $smoonb_acl$ DECLARE o record; g record; BEGIN
+  FOR o IN
+    SELECT 'TABLE' kind,format('%I.%I',n.nspname,c.relname) object,c.relowner owner,c.relacl acl,false public_default
+    FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname IN (${scope}) AND c.relkind IN ('r','p','v','m','f')
+    UNION ALL SELECT 'SEQUENCE',format('%I.%I',n.nspname,c.relname),c.relowner,c.relacl,false FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname IN (${scope}) AND c.relkind='S'
+    UNION ALL SELECT 'FUNCTION',format('%I.%I(%s)',n.nspname,p.proname,pg_get_function_identity_arguments(p.oid)),p.proowner,p.proacl,true FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace WHERE n.nspname IN (${scope}) AND p.prokind IN ('f','w')
+  LOOP
+    FOR g IN SELECT DISTINCT grantee FROM aclexplode(o.acl) WHERE grantee<>o.owner LOOP
+      EXECUTE format('REVOKE ALL ON %s %s FROM %s',o.kind,o.object,CASE WHEN g.grantee=0 THEN 'PUBLIC' ELSE quote_ident(pg_get_userbyid(g.grantee)) END);
+    END LOOP;
+    IF o.public_default THEN EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO PUBLIC',o.object); END IF;
+  END LOOP;
+  END $smoonb_acl$;`;
+}
+const verifyForeignKeys = `DO $smoonb_fk$ DECLARE fk record; join_sql text; null_sql text; bad boolean; BEGIN
+ FOR fk IN SELECT c.* FROM pg_constraint c JOIN pg_namespace n ON n.oid=c.connamespace WHERE c.contype='f' AND n.nspname NOT LIKE 'pg_%' LOOP
+  SELECT string_agg(format('c.%I = p.%I',a.attname,b.attname),' AND '),string_agg(format('c.%I IS NOT NULL',a.attname),' AND ')
+  INTO join_sql,null_sql FROM unnest(fk.conkey,fk.confkey) WITH ORDINALITY k(a,b,i)
+  JOIN pg_attribute a ON a.attrelid=fk.conrelid AND a.attnum=k.a JOIN pg_attribute b ON b.attrelid=fk.confrelid AND b.attnum=k.b;
+  EXECUTE format('SELECT EXISTS(SELECT 1 FROM %s c WHERE %s AND NOT EXISTS(SELECT 1 FROM %s p WHERE %s))',fk.conrelid::regclass,null_sql,fk.confrelid::regclass,join_sql) INTO bad;
+  IF bad THEN RAISE EXCEPTION 'Foreign key verification failed: %',fk.conname; END IF;
+ END LOOP;
+END $smoonb_fk$;`;
+function buildRestore(
+  dump,
+  { sourceProjectId, targetProjectId, remapUrls = true } = {},
+) {
+  const { sections, tables } = dump;
+  const schemas = [
+    ...new Set(sections.map((s) => s.schema).filter(isApplication)),
+  ];
+  if (!schemas.length) throw new Error('No application schema in backup');
+  const sql = [
+    "BEGIN; SET LOCAL statement_timeout=0; SET LOCAL lock_timeout='30s'; SET LOCAL check_function_bodies=false; SET LOCAL session_replication_role=replica; SET LOCAL search_path='';",
+  ];
+  const clean = (s) => s.sql.replace(/^\\.*$/gm, '');
+  const app = (s) =>
+    isApplication(s.schema) ||
+    (s.type === 'SCHEMA' && isApplication(s.name)) ||
+    (s.type === 'ACL' &&
+      s.name.startsWith('SCHEMA ') &&
+      isApplication(s.name.slice(7)));
+  const selected = sections.filter(
+    (s) =>
+      app(s) ||
+      s.type === 'EXTENSION' ||
+      (managed.has(s.schema) &&
+        (s.type === 'POLICY' ||
+          (s.type === 'TRIGGER' &&
+            /EXECUTE (?:FUNCTION|PROCEDURE) (?:public|"public")\./.test(
+              s.sql,
+            )))),
+  );
+  const late = new Set([
+    'TABLE DATA',
+    'SEQUENCE SET',
+    'ACL',
+    'DEFAULT ACL',
+    'FK CONSTRAINT',
+    'TRIGGER',
+    'POLICY',
+    'ROW SECURITY',
+  ]);
+  for (const s of selected.filter((s) => !late.has(s.type))) sql.push(clean(s));
+  const restored = tables.filter(
+    (t) =>
+      isApplication(t.schema) ||
+      (t.schema === 'auth' && t.name !== 'schema_migrations') ||
+      (t.schema === 'storage' && ['objects', 'buckets'].includes(t.name)),
+  );
+  const unsupported = tables.filter(
+    (t) =>
+      t.lines.length &&
+      !restored.includes(t) &&
+      !['schema_migrations', 'migrations'].includes(t.name),
+  );
+  if (unsupported.length)
+    throw new Error(
+      `Backup has data requiring a dedicated migration: ${unsupported.map((t) => t.table).join(', ')}`,
+    );
+  let changedRows = 0;
+  for (const [i, t] of restored.entries()) {
+    const temp = ident(`smoonb_expected_${i}`);
+    let lines = t.lines;
+    if (remapUrls && isApplication(t.schema))
+      lines = lines.map((line) => {
+        const v = remapServiceUrls(line, sourceProjectId, targetProjectId);
+        if (v !== line) changedRows++;
+        return v;
+      });
+    sql.push(
+      `DO $smoonb_empty$ BEGIN IF EXISTS(SELECT 1 FROM ${t.table}) THEN RAISE EXCEPTION USING MESSAGE=${literal('Destination must be empty: ' + t.table)}; END IF; END $smoonb_empty$;`,
+    );
+    sql.push(
+      `CREATE TEMP TABLE ${temp} ON COMMIT DROP AS SELECT ${t.columns} FROM ${t.table} WITH NO DATA;`,
+    );
+    sql.push(
+      `COPY ${temp} (${t.columns}) FROM stdin;\n${lines.length ? lines.join('\n') + '\n' : ''}\\.`,
+    );
+    sql.push(
+      `INSERT INTO ${t.table} (${t.columns}) OVERRIDING SYSTEM VALUE SELECT ${t.columns} FROM ${temp};`,
+    );
+    const actual = `SELECT to_jsonb(r) FROM (SELECT ${t.columns} FROM ${t.table}) r`;
+    const expected = `SELECT to_jsonb(r) FROM (SELECT ${t.columns} FROM ${temp}) r`;
+    sql.push(
+      `DO $smoonb_rows$ BEGIN IF EXISTS((${actual} EXCEPT ALL ${expected}) UNION ALL (${expected} EXCEPT ALL ${actual})) THEN RAISE EXCEPTION USING MESSAGE=${literal('Data verification failed: ' + t.table)}; END IF; END $smoonb_rows$;`,
+    );
+  }
+  for (const s of sections.filter(
+    (s) => s.type === 'SEQUENCE SET' && (app(s) || s.schema === 'auth'),
+  ))
+    sql.push(clean(s));
+  for (const s of selected.filter((s) =>
+    ['FK CONSTRAINT', 'TRIGGER', 'POLICY', 'ROW SECURITY'].includes(s.type),
+  ))
+    sql.push(clean(s));
+  sql.push(resetObjectAcl(schemas));
+  // Supabase-managed administrator defaults are maintained by the platform;
+  // the customer postgres role cannot and must not impersonate supabase_admin.
+  for (const s of selected.filter(
+    (s) =>
+      s.type === 'ACL' ||
+      (s.type === 'DEFAULT ACL' && !s.owner.startsWith('supabase_')),
+  ))
+    sql.push(clean(s));
+  for (const s of sections.filter((s) => s.type === 'PUBLICATION TABLE'))
+    sql.push(clean(s));
+  sql.push(
+    verifyForeignKeys,
+    'SET LOCAL session_replication_role=origin; COMMIT;',
+  );
+  return {
+    sql: sql.join('\n'),
+    summary: {
+      success: true,
+      verified: true,
+      tables: restored.length,
+      rows: restored.reduce((n, t) => n + t.lines.length, 0),
+      remapped_rows: changedRows,
+      managed_schema_ddl: 'preserved_destination',
+      verification:
+        'all restored columns (multiset) and foreign keys, in transaction',
+    },
+  };
+}
+module.exports = {
+  readDump,
+  parseCopy,
+  records,
+  decodeCopy,
+  textArray,
+  remapServiceUrls,
+  buildRestore,
+  managed,
+  isApplication,
+  verifyForeignKeys,
+};