smoonb 1.0.7 → 1.0.9

package/src/commands/restore/index.js

@@ -12,17 +12,11 @@ const { isPostgresMajorSupported } = require('../backup/utils');
 const step00License = require('../backup/steps/00-license');
 const step01DockerValidation = require('../backup/steps/01-docker-validation');
 
-const SUPABASE_RESTORE_DOC_URL = 'https://supabase.com/docs/guides/platform/migrating-within-supabase/dashboard-restore';
+const { runRestore } = require('./runner');
 
 // Importar todas as etapas
 const step00BackupSelection = require('./steps/00-backup-selection');
 const step01ComponentsSelection = require('./steps/01-components-selection');
-const step03Database = require('./steps/03-database');
-const step04EdgeFunctions = require('./steps/04-edge-functions');
-const step05AuthSettings = require('./steps/05-auth-settings');
-const step06Storage = require('./steps/06-storage');
-const step07DatabaseSettings = require('./steps/07-database-settings');
-const step08RealtimeSettings = require('./steps/08-realtime-settings');
 const { sendTelemetry } = require('../../telemetry');
 
 module.exports = async (options = {}) => {
@@ -176,125 +170,9 @@ module.exports = async (options = {}) => {
       process.exit(0);
     }
 
-    // 5.1 Disclaimer: erros esperados durante restore (destacado)
-    ui.errorBold(`\n⚠️  ${getT('restore.disclaimer.errorsTitle')}\n`);
-    ui.info(`   ${getT('restore.disclaimer.errorsIntro')}`);
-    ui.info(`   ${getT('restore.disclaimer.errorsReason')}`);
-    ui.info('');
-    ui.info(`   ${getT('restore.disclaimer.supabaseDoc')}`);
-    ui.link(`   ${SUPABASE_RESTORE_DOC_URL}`);
-    ui.info('');
-    ui.warn(`   ${getT('restore.disclaimer.waitComplete')}`);
-    ui.warn(`   ${getT('restore.disclaimer.testResult')}`);
-    ui.info('');
-    const acceptErrors = await confirm(getT('restore.disclaimer.acceptProceed'), true);
-    if (!acceptErrors) {
-      ui.warn(`🚫 ${getT('restore.index.restoreCancelled')}`);
-      process.exit(0);
-    }
-
-    // 6. Executar restauração
-    ui.step(`\n🚀 ${getT('restore.index.startingRestore')}`);
-    
-    // Contar etapas totais para numeração dinâmica
-    let stepNumber = 0;
-    const totalSteps = (components.database ? 1 : 0) + 
-                      (components.edgeFunctions ? 1 : 0) + 
-                      (components.authSettings ? 1 : 0) + 
-                      (components.storage ? 1 : 0) + 
-                      (components.databaseSettings ? 1 : 0) + 
-                      (components.realtimeSettings ? 1 : 0);
-    
-    // Armazenar resultados para o resumo final
-    const restoreResults = {};
-    
-    // 6.1 Database (se selecionado)
-    if (components.database) {
-      stepNumber++;
-      ui.step(`\n📊 ${stepNumber}/${totalSteps} - ${getT('restore.index.restoringDatabase')}`);
-      await step03Database({
-        backupFilePath: path.join(selectedBackup.path, selectedBackup.backupFile),
-        targetDatabaseUrl: targetProject.targetDatabaseUrl
-      });
-      restoreResults.database = { success: true };
-    }
-    
-    // 6.2 Edge Functions (se selecionado)
-    if (components.edgeFunctions) {
-      stepNumber++;
-      ui.step(`\n⚡ ${stepNumber}/${totalSteps} - ${getT('restore.index.restoringEdgeFunctions')}`);
-      const edgeFunctionsResult = await step04EdgeFunctions({
-        backupPath: selectedBackup.path,
-        targetProject
-      });
-      restoreResults.edgeFunctions = edgeFunctionsResult || { success: true };
-    }
-    
-    // 6.3 Auth Settings (se selecionado)
-    if (components.authSettings) {
-      stepNumber++;
-      ui.step(`\n🔐 ${stepNumber}/${totalSteps} - ${getT('restore.index.restoringAuthSettings')}`);
-      await step05AuthSettings({
-        backupPath: selectedBackup.path,
-        targetProject
-      });
-      restoreResults.authSettings = { success: true };
-    }
-    
-    // 6.4 Storage Buckets (se selecionado)
-    if (components.storage) {
-      stepNumber++;
-      ui.step(`\n📦 ${stepNumber}/${totalSteps} - ${getT('restore.index.restoringStorageBuckets')}`);
-      const storageResult = await step06Storage({
-        backupPath: selectedBackup.path,
-        targetProject
-      });
-      restoreResults.storage = storageResult || { success: true };
-    }
-    
-    // 6.5 Database Settings (se selecionado)
-    if (components.databaseSettings) {
-      stepNumber++;
-      ui.step(`\n🔧 ${stepNumber}/${totalSteps} - ${getT('restore.index.restoringDatabaseSettings')}`);
-      await step07DatabaseSettings({
-        backupPath: selectedBackup.path,
-        targetProject
-      });
-      restoreResults.databaseSettings = { success: true };
-    }
-    
-    // 6.6 Realtime Settings (se selecionado)
-    if (components.realtimeSettings) {
-      stepNumber++;
-      ui.step(`\n🔄 ${stepNumber}/${totalSteps} - ${getT('restore.index.restoringRealtimeSettings')}`);
-      await step08RealtimeSettings({
-        backupPath: selectedBackup.path,
-        targetProject
-      });
-      restoreResults.realtimeSettings = { success: true };
-    }
-    
-    // report.json de restauração
-    const report = {
-      process: 'restore',
-      created_at: new Date().toISOString(),
-      target_project_id: targetProject.targetProjectId,
-      assets: {
-        env: path.join(processDir, 'env', '.env.local'),
-        env_map: path.join(processDir, 'env', 'env-map.json')
-      },
-      components: components,
-      results: restoreResults,
-      notes: [
-        'supabase/functions limpo antes e depois do deploy (se Edge Functions selecionado)'
-      ]
-    };
-    try {
-      fs.writeFileSync(path.join(processDir, 'report.json'), JSON.stringify(report, null, 2));
-    } catch {
-      // silencioso
-    }
-
+    const remapUrls = await confirm(getT('restore.verified.remapUrls'), true);
+    const restoreResults = await runRestore({ selectedBackup, components, targetProject, processDir, postgresMajor:parsedMajor, remapUrls });
+
     // Exibir resumo final
     ui.success(`\n🎉 ${getT('restore.index.restoreComplete')}`);
     ui.link(`🎯 ${getT('restore.index.targetProjectFinal', { projectId: targetProject.targetProjectId || getT('restore.index.notConfigured') })}`);
@@ -310,7 +188,10 @@ module.exports = async (options = {}) => {
     }
 
     if (restoreResults.authSettings) {
-      ui.success(`🔐 ${getT('restore.index.authSettingsRestored')}`);
+      if (restoreResults.authSettings.verified)
+        ui.success(`🔐 ${getT('restore.index.authSettingsRestored')}`);
+      else
+        ui.warn(getT('restore.smtp.accepted'));
     }
 
     if (restoreResults.storage) {

package/src/commands/restore/management.js

@@ -0,0 +1,96 @@
+const { isMasked } = require('../../utils/auth-secrets');
+
+async function management(
+  target,
+  endpoint,
+  { method = 'GET', body, fetchImpl = fetch } = {},
+) {
+  if (!/^[a-z0-9-]+$/.test(target.targetProjectId) || !target.targetAccessToken)
+    throw new Error('Management API credentials are required');
+  let response;
+  try {
+    response = await fetchImpl(
+      `https://api.supabase.com/v1/projects/${target.targetProjectId}/${endpoint}`,
+      {
+        method,
+        signal: AbortSignal.timeout(60000),
+        headers: {
+          Authorization: `Bearer ${target.targetAccessToken}`,
+          'Content-Type': 'application/json',
+        },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      },
+    );
+  } catch {
+    throw new Error(`Management API ${endpoint}: network failure`);
+  }
+  // Error response bodies may contain secrets from the submitted configuration.
+  if (!response.ok)
+    throw new Error(`Management API ${endpoint}: HTTP ${response.status}`);
+  return response.status === 204 ? null : response.json();
+}
+async function applyConfig(
+  target,
+  endpoint,
+  desired,
+  allowed,
+  request = management,
+  { writeOnly = {} } = {},
+) {
+  const secretFields = Object.keys(writeOnly);
+  for (const key of secretFields) {
+    if (
+      endpoint !== 'config/auth' ||
+      key !== 'smtp_pass' ||
+      !allowed.includes(key)
+    )
+      throw new Error(`Unsupported write-only configuration: ${key}`);
+    if (
+      typeof writeOnly[key] !== 'string' ||
+      !writeOnly[key].trim() ||
+      isMasked(writeOnly[key])
+    )
+      throw new Error(`A real credential is required: ${key}`);
+  }
+  if (endpoint === 'config/auth' && Object.hasOwn(desired, 'smtp_pass'))
+    throw new Error(
+      'SMTP password must be supplied separately, never copied from a configuration response',
+    );
+  const before = await request(target, endpoint);
+  const patch = { ...writeOnly };
+  const unsupported = [];
+  for (const [key, value] of Object.entries(desired)) {
+    if (JSON.stringify(before[key]) === JSON.stringify(value)) continue;
+    if (!allowed.includes(key)) {
+      unsupported.push(key);
+      continue;
+    }
+    if (isMasked(value))
+      throw new Error(`Masked configuration cannot be restored: ${key}`);
+    patch[key] = value;
+  }
+  if (unsupported.length)
+    throw new Error(
+      `Configuration requires manual migration: ${unsupported.join(', ')}`,
+    );
+  if (Object.keys(patch).length)
+    await request(target, endpoint, { method: 'PATCH', body: patch });
+  const after = await request(target, endpoint);
+  const differences = Object.keys(desired).filter(
+    (k) => JSON.stringify(desired[k]) !== JSON.stringify(after[k]),
+  );
+  if (differences.length)
+    throw new Error(
+      `Configuration verification failed: ${differences.join(', ')}`,
+    );
+  return {
+    success: true,
+    verified: secretFields.length === 0,
+    configuration_readback_verified: true,
+    write_only_fields_accepted: secretFields,
+    ...(secretFields.length ? { email_delivery_verified: false } : {}),
+    fields_verified: Object.keys(desired).length,
+    fields_updated: Object.keys(patch),
+  };
+}
+module.exports = { management, applyConfig };

package/src/commands/restore/pg.js

@@ -0,0 +1,83 @@
+const { spawn } = require('child_process');
+
+const ident = (value) => '"' + String(value).replace(/"/g, '""') + '"';
+const literal = (value) => "'" + String(value).replace(/'/g, "''") + "'";
+
+// SQL and credentials go through stdin/environment, never a shell command.
+function runSql(databaseUrl, sql, { postgresMajor = 17 } = {}) {
+  const url = new URL(databaseUrl);
+  if (!['postgres:', 'postgresql:'].includes(url.protocol))
+    throw new Error('Invalid database URL');
+  if (![15, 16, 17].includes(Number(postgresMajor)))
+    throw new Error('Unsupported PostgreSQL major');
+  const env = {
+    ...process.env,
+    PGHOST: url.hostname,
+    PGPORT: url.port || '5432',
+    PGUSER: decodeURIComponent(url.username),
+    PGPASSWORD: decodeURIComponent(url.password),
+    PGDATABASE: decodeURIComponent(url.pathname.slice(1) || 'postgres'),
+    PGSSLMODE: url.searchParams.get('sslmode') || 'prefer',
+    PGCONNECT_TIMEOUT: '20',
+  };
+  const args = [
+    'run',
+    '--rm',
+    '-i',
+    '--network',
+    'host',
+    ...[
+      'PGHOST',
+      'PGPORT',
+      'PGUSER',
+      'PGPASSWORD',
+      'PGDATABASE',
+      'PGSSLMODE',
+      'PGCONNECT_TIMEOUT',
+    ].flatMap((k) => ['-e', k]),
+    `postgres:${postgresMajor}`,
+    'psql',
+    '-X',
+    '-q',
+    '-A',
+    '-t',
+    '-v',
+    'ON_ERROR_STOP=1',
+    '-v',
+    'VERBOSITY=sqlstate',
+  ];
+  return new Promise((resolve, reject) => {
+    const child = spawn('docker', args, {
+      env,
+      windowsHide: true,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let output = '';
+    let errors = '';
+    child.stdout.on('data', (chunk) => {
+      output += chunk;
+    });
+    child.stderr.on('data', (chunk) => {
+      errors += chunk;
+    });
+    child.stdin.on('error', () => {});
+    child.on('error', () =>
+      reject(new Error('Could not start Docker PostgreSQL client')),
+    );
+    child.on('close', (code) => {
+      if (code !== 0) {
+        // COPY errors can contain customer records. Expose SQLSTATE only.
+        const states = [
+          ...new Set(errors.match(/\b[0-9A-Z]{5}\b/g) || []),
+        ].filter((x) => /\d/.test(x));
+        reject(
+          new Error(
+            `Database operation failed (exit ${code}; SQLSTATE ${states.join(', ') || 'unavailable'}). Transaction rolled back when applicable.`,
+          ),
+        );
+      } else resolve(output.trim());
+    });
+    child.stdin.end(sql);
+  });
+}
+module.exports = { runSql, ident, literal };

package/src/commands/restore/runner.js

@@ -0,0 +1,140 @@
+const fs = require('fs');
+const path = require('path');
+const { t } = require('../../i18n');
+const { buildRestore, readDump } = require('./dump');
+const { storagePlan } = require('./steps/06-storage');
+const { prepareAuth } = require('./auth');
+const steps = {
+  database: require('./steps/03-database'),
+  edgeFunctions: require('./steps/04-edge-functions'),
+  authSettings: require('./steps/05-auth-settings'),
+  storage: require('./steps/06-storage'),
+  databaseSettings: require('./steps/07-database-settings'),
+  realtimeSettings: require('./steps/08-realtime-settings'),
+};
+async function runRestore(
+  {
+    selectedBackup,
+    components,
+    targetProject,
+    processDir,
+    postgresMajor,
+    remapUrls = true,
+  },
+  implementations = steps,
+  { prepareAuthConfig = prepareAuth } = {},
+) {
+  if (selectedBackup.projectId === targetProject.targetProjectId)
+    throw new Error('Restore requires a different, empty destination project');
+  const context = {
+    backupPath: selectedBackup.path,
+    backupFilePath: path.join(selectedBackup.path, selectedBackup.backupFile),
+    targetProject,
+    targetDatabaseUrl: targetProject.targetDatabaseUrl,
+    sourceProjectId: selectedBackup.projectId,
+    targetProjectId: targetProject.targetProjectId,
+    postgresMajor,
+    remapUrls,
+  };
+  const report = {
+    process: 'restore',
+    smoonb_version: require('../../../package.json').version,
+    created_at: new Date().toISOString(),
+    source_project_id: selectedBackup.projectId,
+    target_project_id: targetProject.targetProjectId,
+    status: 'running',
+    components,
+    results: {},
+    remap_service_urls: remapUrls,
+    notes: [
+      'Local source files and backup archives are preserved.',
+      'Verification covers selected components; application login and workflows require acceptance testing.',
+    ],
+  };
+  const save = () =>
+    fs.writeFileSync(
+      path.join(processDir, 'report.json'),
+      JSON.stringify(report, null, 2),
+    );
+  save();
+  let current = 'preflight';
+  try {
+    if (targetProject.targetDatabaseUrl) {
+      const url = new URL(targetProject.targetDatabaseUrl);
+      const hosted =
+        url.hostname.endsWith('.supabase.co') ||
+        url.hostname.endsWith('.supabase.com');
+      if (
+        hosted &&
+        url.hostname !== `db.${targetProject.targetProjectId}.supabase.co` &&
+        !decodeURIComponent(url.username).endsWith(
+          `.${targetProject.targetProjectId}`,
+        )
+      )
+        throw new Error(
+          'Database connection does not match the destination project',
+        );
+    }
+    if (
+      targetProject.targetUrl &&
+      new URL(targetProject.targetUrl).hostname !==
+        `${targetProject.targetProjectId}.supabase.co`
+    )
+      throw new Error('API URL does not match the destination project');
+    // Parse and validate inventories before the first mutation.
+    if (components.database)
+      buildRestore(readDump(context.backupFilePath), context);
+    if (components.storage)
+      storagePlan(context.backupPath, context.backupFilePath);
+    // Resolve write-only credentials before restoring the database or any service.
+    if (components.authSettings)
+      context.authConfig = await prepareAuthConfig(context);
+    for (const [name, step] of Object.entries(implementations)) {
+      if (!components[name]) continue;
+      current = name;
+      report.results[name] = { success: false, status: 'running' };
+      save();
+      const labels = {
+        database: 'restoringDatabase',
+        edgeFunctions: 'restoringEdgeFunctions',
+        authSettings: 'restoringAuthSettings',
+        storage: 'restoringStorageBuckets',
+        databaseSettings: 'restoringDatabaseSettings',
+        realtimeSettings: 'restoringRealtimeSettings',
+      };
+      console.log((global.smoonbI18n?.t || t)(`restore.index.${labels[name]}`));
+      const result = await step(context);
+      const acceptedSmtp =
+        name === 'authSettings' &&
+        result?.configuration_readback_verified === true &&
+        result?.email_delivery_verified === false &&
+        result?.write_only_fields_accepted?.length === 1 &&
+        result.write_only_fields_accepted[0] === 'smtp_pass';
+      if (!result?.success || (!result?.verified && !acceptedSmtp))
+        throw new Error(`Component ${name} did not pass verification`);
+      report.results[name] = {
+        ...result,
+        status: result.verified
+          ? 'verified'
+          : 'applied_with_unverified_secrets',
+      };
+      save();
+      if (acceptedSmtp)
+        console.log((global.smoonbI18n?.t || t)('restore.smtp.accepted'));
+    }
+    report.status = Object.values(report.results).every((r) => r.verified)
+      ? 'verified'
+      : 'applied_with_unverified_secrets';
+    report.completed_at = new Date().toISOString();
+    save();
+    return report.results;
+  } catch (error) {
+    report.status = 'failed';
+    report.failed_component = current;
+    report.results[current] = { success: false, status: 'failed' };
+    report.completed_at = new Date().toISOString();
+    save();
+    throw error;
+  }
+}
+module.exports = { runRestore };

package/src/commands/restore/steps/03-database.js

@@ -1,84 +1,18 @@
-const chalk = require('chalk');
-const path = require('path');
-const { execSync } = require('child_process');
-const { t } = require('../../../i18n');
-const ui = require('../../../utils/cliUi');
-
-/**
- * Etapa 3: Restaurar Database via psql
- */
-module.exports = async ({ backupFilePath, targetDatabaseUrl }) => {
-  try {
-    const getT = global.smoonbI18n?.t || t;
-    const backupDirAbs = path.resolve(path.dirname(backupFilePath));
-    const fileName = path.basename(backupFilePath);
-    let uncompressedFile = fileName;
-    
-    // Verificar se é arquivo .backup.gz (compactado) ou .backup (descompactado)
-    if (fileName.endsWith('.backup.gz')) {
-      console.log(chalk.white(`   - ${getT('restore.steps.database.detectedGz')}`));
-      console.log(chalk.white(`   - ${getT('restore.steps.database.extractingGz')}`));
-      
-      const unzipCmd = [
-        'docker run --rm',
-        `-v "${backupDirAbs}:/host"`,
-        'postgres:17 gunzip /host/' + fileName
-      ].join(' ');
-      
-      execSync(unzipCmd, { stdio: 'pipe' });
-      uncompressedFile = fileName.replace('.gz', '');
-      console.log(chalk.white(`   - ${getT('restore.steps.database.uncompressed', { file: uncompressedFile })}`));
-    } else if (fileName.endsWith('.backup')) {
-      console.log(chalk.white(`   - ${getT('restore.steps.database.detectedBackup')}`));
-      console.log(chalk.white(`   - ${getT('restore.steps.database.proceeding')}`));
-    } else {
-      throw new Error(`Formato de arquivo inválido. Esperado .backup.gz ou .backup, recebido: ${fileName}`);
-    }
-    
-    // Extrair credenciais da URL de conexão
-    const urlMatch = targetDatabaseUrl.match(/postgresql:\/\/([^@:]+):([^@]+)@(.+)$/);
-    
-    if (!urlMatch) {
-      const getT = global.smoonbI18n?.t || t;
-      throw new Error(getT('error.databaseUrlInvalid'));
-    }
-    
-    // Comando psql conforme documentação oficial Supabase
-    const restoreCmd = [
-      'docker run --rm --network host',
-      `-v "${backupDirAbs}:/host"`,
-      `-e PGPASSWORD="${encodeURIComponent(urlMatch[2])}"`,
-      'postgres:17 psql',
-      `-d "${targetDatabaseUrl}"`,
-      `-f /host/${uncompressedFile}`
-    ].join(' ');
-    
-    console.log(chalk.cyan(`   - ${getT('restore.steps.database.executing')}`));
-    console.log(chalk.cyan(`   ℹ️ ${getT('restore.steps.database.followingDocs')}`));
-    console.log(chalk.yellow(`   ⚠️ ${getT('restore.steps.database.warning')}`));
-    console.log(chalk.yellow(`   ⚠️ ${getT('restore.steps.database.warningReason1')}`));
-    console.log(chalk.yellow(`   ⚠️ ${getT('restore.steps.database.warningReason2')}`));
-    
-    // Executar comando de restauração
-    execSync(restoreCmd, { stdio: 'inherit', encoding: 'utf8' });
-    
-    console.log(chalk.green(`   ✅ ${getT('restore.steps.database.success')}`));
-    ui.hint(`   ℹ️ ${getT('restore.steps.database.normalErrors')}`);
-    
-  } catch (error) {
-    // Erros esperados conforme documentação oficial Supabase
-    const getT = global.smoonbI18n?.t || t;
-    if (error.message.includes('already exists') || 
-        error.message.includes('constraint') ||
-        error.message.includes('duplicate') ||
-        error.stdout?.includes('already exists')) {
-      console.log(chalk.yellow(`   ⚠️ ${getT('restore.steps.database.expectedErrors')}`));
-      console.log(chalk.green(`   ✅ ${getT('restore.steps.database.success')}`));
-      ui.hint(`   ℹ️ ${getT('restore.steps.database.errorsIgnored')}`);
-    } else {
-      console.error(chalk.red(`   ❌ ${getT('restore.steps.database.error', { message: error.message })}`));
-      throw error;
-    }
-  }
-};
-
+const { readDump, buildRestore } = require('../dump');
+const { runSql } = require('../pg');
+module.exports = async ({
+  backupFilePath,
+  targetDatabaseUrl,
+  sourceProjectId,
+  targetProjectId,
+  remapUrls = true,
+  postgresMajor = 17,
+}) => {
+  const plan = buildRestore(readDump(backupFilePath), {
+    sourceProjectId,
+    targetProjectId,
+    remapUrls,
+  });
+  await runSql(targetDatabaseUrl, plan.sql, { postgresMajor });
+  return plan.summary;
+};