ta_data_mas 0.0.2

package/apps/api/src/projects/projects.service.ts

@@ -0,0 +1,136 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { and, eq, isNull } from 'drizzle-orm';
+import { randomBytes } from 'crypto';
+import slugify from 'slugify';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { DrizzleService } from '../db/drizzle.service';
+import { projects, organizations, orgMembers } from '../db/schema';
+import { CreateProjectDto } from './dto/create-project.dto';
+import { PROJECT_KEY_ROLES } from '@apiDatabase/constants';
+
+@Injectable()
+export class ProjectsService {
+  constructor(
+    private drizzle: DrizzleService,
+    private jwtService: JwtService,
+    private configService: ConfigService,
+  ) {}
+
+  // Utils
+  private generateProjectSlug(name: string): string {
+    const base = slugify(name, { lower: true, strict: true });
+    const suffix = randomBytes(3).toString('hex');
+    return `${base}-${suffix}`;
+  }
+
+  private generateDbSchema(): string {
+    return `proj_${randomBytes(4).toString('hex')}`;
+  }
+
+  private signProjectKey(projectId: string, role: string): string {
+    return this.jwtService.sign(
+      { projectId, role },
+      {
+        secret: this.configService.get<string>('PROJECT_JWT_SECRET'),
+        // project keys don't expire — they're rotated manually if compromised
+        expiresIn: '100y',
+      },
+    );
+  }
+
+  private async provisionSchema(dbSchema: string): Promise<void> {
+    await this.drizzle.db.execute(`CREATE SCHEMA IF NOT EXISTS "${dbSchema}"`);
+  }
+
+  //   Queries
+  async getProjectsForOrg(orgSlug: string, userId: string) {
+    return this.drizzle.db
+      .select({
+        id: projects.id,
+        name: projects.name,
+        slug: projects.slug,
+        projectUrl: projects.projectUrl,
+        createdAt: projects.createdAt,
+        updatedAt: projects.updatedAt,
+      })
+      .from(projects)
+      .innerJoin(organizations, eq(projects.orgId, organizations.id))
+      .innerJoin(
+        orgMembers,
+        and(
+          eq(orgMembers.orgId, organizations.id),
+          eq(orgMembers.userId, userId),
+          isNull(orgMembers.removedAt),
+        ),
+      )
+      .where(eq(organizations.slug, orgSlug));
+  }
+
+  async getProjectBySlug(orgSlug: string, projectSlug: string, userId: string) {
+    const [row] = await this.drizzle.db
+      .select()
+      .from(projects)
+      .innerJoin(organizations, eq(projects.orgId, organizations.id))
+      .innerJoin(
+        orgMembers,
+        and(
+          eq(orgMembers.orgId, organizations.id),
+          eq(orgMembers.userId, userId),
+          isNull(orgMembers.removedAt),
+        ),
+      )
+      .where(
+        and(eq(organizations.slug, orgSlug), eq(projects.slug, projectSlug)),
+      )
+      .limit(1);
+
+    if (!row) throw new NotFoundException('Project not found');
+    return row;
+  }
+
+  async createProject(orgSlug: string, dto: CreateProjectDto) {
+    const [org] = await this.drizzle.db
+      .select()
+      .from(organizations)
+      .where(eq(organizations.slug, orgSlug))
+      .limit(1);
+
+    if (!org) throw new NotFoundException('Organization not found');
+
+    const projectSlug = this.generateProjectSlug(dto.name);
+    const dbSchema = this.generateDbSchema();
+    const projectUrl = `${this.configService.get<string>('API_URL')}/projects/${projectSlug}`;
+
+    await this.provisionSchema(dbSchema);
+    const authJwtSecret = randomBytes(32).toString('hex');
+
+    const [project] = await this.drizzle.db
+      .insert(projects)
+      .values({
+        orgId: org.id,
+        name: dto.name,
+        slug: projectSlug,
+        dbSchema,
+        projectUrl,
+        anonKey: '',
+        serviceRoleKey: '',
+        authJwtSecret,
+      })
+      .returning();
+
+    const anonKey = this.signProjectKey(project.id, PROJECT_KEY_ROLES.ANON);
+    const serviceRoleKey = this.signProjectKey(
+      project.id,
+      PROJECT_KEY_ROLES.SERVICE_ROLE,
+    );
+
+    const [updated] = await this.drizzle.db
+      .update(projects)
+      .set({ anonKey, serviceRoleKey })
+      .where(eq(projects.id, project.id))
+      .returning();
+
+    return updated;
+  }
+}

package/apps/api/src/realtime/realtime-socket.type.ts

@@ -0,0 +1,14 @@
+import type { DefaultEventsMap, Socket } from 'socket.io';
+import type { PROJECT_KEY_ROLES } from '@apiDatabase/constants';
+
+export interface RealtimeSocketData {
+  projectId?: string;
+  role?: (typeof PROJECT_KEY_ROLES)[keyof typeof PROJECT_KEY_ROLES];
+}
+
+export type RealtimeSocket = Socket<
+  DefaultEventsMap,
+  DefaultEventsMap,
+  DefaultEventsMap,
+  RealtimeSocketData
+>;

package/apps/api/src/realtime/realtime.controller.ts

@@ -0,0 +1,63 @@
+import {
+  Controller,
+  Delete,
+  NotFoundException,
+  Param,
+  Post,
+  UseGuards,
+} from '@nestjs/common';
+import { and, eq } from 'drizzle-orm';
+import { TriggerService } from './trigger.service';
+import { DrizzleService } from '../db/drizzle.service';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth-guard';
+import { OrgRoleGuard } from '../auth/guards/org-role.guards';
+import { projects, organizations } from '../db/schema';
+
+@Controller('orgs/:slug/projects/:projectSlug/realtime')
+@UseGuards(JwtAuthGuard, OrgRoleGuard)
+export class RealtimeController {
+  constructor(
+    private triggerService: TriggerService,
+    private drizzle: DrizzleService,
+  ) {}
+
+  private async getProject(orgSlug: string, projectSlug: string) {
+    const [row] = await this.drizzle.db
+      .select({ id: projects.id, dbSchema: projects.dbSchema })
+      .from(projects)
+      .innerJoin(organizations, eq(projects.orgId, organizations.id))
+      .where(
+        and(eq(organizations.slug, orgSlug), eq(projects.slug, projectSlug)),
+      )
+      .limit(1);
+
+    if (!row) throw new NotFoundException('Project not found');
+    return row;
+  }
+
+  @Post(':tableName/enable')
+  async enableRealtime(
+    @Param('slug') slug: string,
+    @Param('projectSlug') projectSlug: string,
+    @Param('tableName') tableName: string,
+  ) {
+    const project = await this.getProject(slug, projectSlug);
+    await this.triggerService.enableRealtime(
+      project.dbSchema,
+      project.id,
+      tableName,
+    );
+    return { message: `Realtime enabled for ${tableName}` };
+  }
+
+  @Delete(':tableName/disable')
+  async disableRealtime(
+    @Param('slug') slug: string,
+    @Param('projectSlug') projectSlug: string,
+    @Param('tableName') tableName: string,
+  ) {
+    const project = await this.getProject(slug, projectSlug);
+    await this.triggerService.disableRealtime(project.dbSchema, tableName);
+    return { message: `Realtime disabled for ${tableName}` };
+  }
+}

package/apps/api/src/realtime/realtime.gateway.ts

@@ -0,0 +1,150 @@
+import {
+  ConnectedSocket,
+  MessageBody,
+  OnGatewayConnection,
+  OnGatewayDisconnect,
+  SubscribeMessage,
+  WebSocketGateway,
+  WebSocketServer,
+} from '@nestjs/websockets';
+import { Server, Socket } from 'socket.io';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { RealtimeService } from './realtime.service';
+import { REALTIME_EVENTS, PROJECT_KEY_ROLES } from '@apiDatabase/constants';
+import type { RealtimeEvent } from '@apiDatabase/types';
+import type { ProjectKeyPayload } from '../project-api/project-key.guard';
+import type { RealtimeSocket } from './realtime-socket.type';
+
+type SocketCallbackEntry = {
+  projectId: string;
+  tableName: string;
+  callback: (event: RealtimeEvent) => void;
+};
+
+@WebSocketGateway({
+  namespace: '/realtime',
+  cors: {
+    origin: process.env.WEB_URL ?? 'http://localhost:3001',
+    credentials: true,
+  },
+})
+export class RealtimeGateway
+  implements OnGatewayConnection, OnGatewayDisconnect
+{
+  @WebSocketServer()
+  server!: Server;
+
+  private socketCallbacks = new Map<string, SocketCallbackEntry[]>();
+
+  constructor(
+    private realtimeService: RealtimeService,
+    private jwtService: JwtService,
+    private configService: ConfigService,
+  ) {}
+
+  async handleConnection(client: RealtimeSocket) {
+    const token = client.handshake.auth['token'] as string | undefined;
+
+    if (!token) {
+      client.emit(REALTIME_EVENTS.ERROR, 'Missing API key');
+      client.disconnect();
+      return;
+    }
+
+    try {
+      const payload = this.jwtService.verify<ProjectKeyPayload>(token, {
+        secret: this.configService.get<string>('PROJECT_JWT_SECRET'),
+      });
+
+      if (
+        payload.role !== PROJECT_KEY_ROLES.ANON &&
+        payload.role !== PROJECT_KEY_ROLES.SERVICE_ROLE
+      ) {
+        throw new Error('Invalid key role');
+      }
+
+      client.data.projectId = payload.projectId;
+      client.data.role = payload.role;
+      await client.join(`project:${payload.projectId}`);
+    } catch {
+      client.emit(REALTIME_EVENTS.ERROR, 'Invalid API key');
+      client.disconnect();
+    }
+  }
+
+  handleDisconnect(client: Socket) {
+    const callbacks = this.socketCallbacks.get(client.id) ?? [];
+    for (const { projectId, tableName, callback } of callbacks) {
+      this.realtimeService.unsubscribe(projectId, tableName, callback);
+    }
+    this.socketCallbacks.delete(client.id);
+  }
+
+  @SubscribeMessage(REALTIME_EVENTS.SUBSCRIBE)
+  async handleSubscribe(
+    @ConnectedSocket() client: RealtimeSocket,
+    @MessageBody() tableName: string,
+  ) {
+    const projectId = client.data.projectId;
+    if (!projectId || !tableName?.trim()) return;
+
+    const normalizedTable = tableName.trim();
+    const room = `project:${projectId}:table:${normalizedTable}`;
+
+    const existing = this.socketCallbacks.get(client.id) ?? [];
+    if (
+      existing.some(
+        (entry) =>
+          entry.projectId === projectId && entry.tableName === normalizedTable,
+      )
+    ) {
+      return;
+    }
+
+    await client.join(room);
+
+    const callback = (event: RealtimeEvent) => {
+      this.server.to(room).emit(REALTIME_EVENTS.EVENT, event);
+    };
+
+    await this.realtimeService.subscribe(projectId, normalizedTable, callback);
+
+    existing.push({
+      projectId,
+      tableName: normalizedTable,
+      callback,
+    });
+    this.socketCallbacks.set(client.id, existing);
+  }
+
+  @SubscribeMessage(REALTIME_EVENTS.UNSUBSCRIBE)
+  async handleUnsubscribe(
+    @ConnectedSocket() client: RealtimeSocket,
+    @MessageBody() tableName: string,
+  ) {
+    const projectId = client.data.projectId;
+    if (!projectId || !tableName?.trim()) return;
+
+    const normalizedTable = tableName.trim();
+    const room = `project:${projectId}:table:${normalizedTable}`;
+    await client.leave(room);
+
+    const callbacks = this.socketCallbacks.get(client.id) ?? [];
+    const entry = callbacks.find(
+      (c) => c.projectId === projectId && c.tableName === normalizedTable,
+    );
+
+    if (entry) {
+      this.realtimeService.unsubscribe(
+        projectId,
+        normalizedTable,
+        entry.callback,
+      );
+      this.socketCallbacks.set(
+        client.id,
+        callbacks.filter((c) => c !== entry),
+      );
+    }
+  }
+}

package/apps/api/src/realtime/realtime.module.ts

@@ -0,0 +1,14 @@
+import { Module } from '@nestjs/common';
+import { RealtimeGateway } from './realtime.gateway';
+import { RealtimeService } from './realtime.service';
+import { RealtimeController } from './realtime.controller';
+import { TriggerService } from './trigger.service';
+import { AuthModule } from '../auth/auth.module';
+import { OrgRoleGuard } from '../auth/guards/org-role.guards';
+
+@Module({
+  imports: [AuthModule],
+  providers: [RealtimeGateway, RealtimeService, TriggerService, OrgRoleGuard],
+  controllers: [RealtimeController],
+})
+export class RealtimeModule {}

package/apps/api/src/realtime/realtime.service.ts

@@ -0,0 +1,101 @@
+import { Injectable, OnModuleDestroy } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Client, neonConfig } from '@neondatabase/serverless';
+import { TriggerService } from './trigger.service';
+import type { RealtimeEvent } from '@apiDatabase/types';
+
+neonConfig.webSocketConstructor = WebSocket;
+
+type NotifyCallback = (event: RealtimeEvent) => void;
+
+@Injectable()
+export class RealtimeService implements OnModuleDestroy {
+  private listeners = new Map<
+    string,
+    {
+      client: Client;
+      callbacks: Set<NotifyCallback>;
+    }
+  >();
+
+  constructor(private configService: ConfigService) {}
+
+  // Neon LISTEN/NOTIFY requires a direct (non-pooler) connection
+  private getListenConnectionString(): string {
+    const realtime = this.configService.get<string>('REALTIME_DATABASE_URL');
+    const database = this.configService.get<string>('DATABASE_URL');
+    const url = realtime ?? database;
+    if (!url) {
+      throw new Error('DATABASE_URL is not configured');
+    }
+    let clean = url.replace('-pooler', '').trim();
+    clean = clean.replace(/([?&])(sslmode|channel_binding)=[^&]*/g, '$1');
+    clean = clean.replace(/[?&]$/, '').replace(/\?&/, '?');
+    return clean;
+  }
+
+  async subscribe(
+    projectId: string,
+    tableName: string,
+    callback: NotifyCallback,
+  ): Promise<void> {
+    const channel = TriggerService.channelName(projectId, tableName);
+
+    const existing = this.listeners.get(channel);
+    if (existing) {
+      existing.callbacks.add(callback);
+      return;
+    }
+
+    const client = new Client({
+      connectionString: this.getListenConnectionString(),
+    });
+
+    await client.connect();
+
+    client.on('notification', (msg) => {
+      if (!msg.payload) return;
+      try {
+        const event = JSON.parse(msg.payload) as RealtimeEvent;
+        const entry = this.listeners.get(channel);
+        entry?.callbacks.forEach((cb) => cb(event));
+      } catch {
+        // malformed payload — ignore
+      }
+    });
+
+    // channel names are lowercase identifiers — no double quotes needed
+    await client.query(`LISTEN ${channel}`);
+
+    this.listeners.set(channel, {
+      client,
+      callbacks: new Set([callback]),
+    });
+  }
+
+  unsubscribe(
+    projectId: string,
+    tableName: string,
+    callback: NotifyCallback,
+  ): void {
+    const channel = TriggerService.channelName(projectId, tableName);
+    const entry = this.listeners.get(channel);
+    if (!entry) return;
+
+    entry.callbacks.delete(callback);
+
+    if (entry.callbacks.size === 0) {
+      void entry.client.query(`UNLISTEN ${channel}`).finally(() => {
+        void entry.client.end();
+      });
+      this.listeners.delete(channel);
+    }
+  }
+
+  async onModuleDestroy() {
+    await Promise.all(
+      [...this.listeners.values()].map(({ client }) => client.end()),
+    );
+    this.listeners.clear();
+  }
+}

package/apps/api/src/realtime/trigger.service.ts

@@ -0,0 +1,95 @@
+import { BadRequestException, Injectable } from '@nestjs/common';
+import { DrizzleService } from '../db/drizzle.service';
+
+@Injectable()
+export class TriggerService {
+  constructor(private drizzle: DrizzleService) {}
+
+  private assertSafeIdentifier(name: string, label: string): void {
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+      throw new BadRequestException(`Invalid ${label}: ${name}`);
+    }
+  }
+
+  static channelName(projectId: string, tableName: string): string {
+    return `project_${projectId.replace(/-/g, '_')}_${tableName}`;
+  }
+
+  async enableRealtime(
+    dbSchema: string,
+    projectId: string,
+    tableName: string,
+  ): Promise<void> {
+    this.assertSafeIdentifier(dbSchema, 'schema name');
+    this.assertSafeIdentifier(tableName, 'table name');
+
+    const channel = TriggerService.channelName(projectId, tableName);
+    const fnName = `${tableName}_notify`;
+
+    await this.drizzle.db.execute(`
+      CREATE OR REPLACE FUNCTION "${dbSchema}"."${fnName}"()
+      RETURNS TRIGGER AS $$
+      DECLARE
+        payload JSON;
+      BEGIN
+        IF TG_OP = 'DELETE' THEN
+          payload = json_build_object(
+            'type', TG_OP,
+            'table', TG_TABLE_NAME,
+            'record', row_to_json(OLD),
+            'oldRecord', row_to_json(OLD),
+            'projectId', '${projectId}',
+            'timestamp', now()::text
+          );
+          PERFORM pg_notify('${channel}', payload::text);
+          RETURN OLD;
+        ELSIF TG_OP = 'UPDATE' THEN
+          payload = json_build_object(
+            'type', TG_OP,
+            'table', TG_TABLE_NAME,
+            'record', row_to_json(NEW),
+            'oldRecord', row_to_json(OLD),
+            'projectId', '${projectId}',
+            'timestamp', now()::text
+          );
+          PERFORM pg_notify('${channel}', payload::text);
+          RETURN NEW;
+        ELSE
+          payload = json_build_object(
+            'type', TG_OP,
+            'table', TG_TABLE_NAME,
+            'record', row_to_json(NEW),
+            'projectId', '${projectId}',
+            'timestamp', now()::text
+          );
+          PERFORM pg_notify('${channel}', payload::text);
+          RETURN NEW;
+        END IF;
+      END;
+      $$ LANGUAGE plpgsql;
+    `);
+
+    await this.drizzle.db.execute(`
+      DROP TRIGGER IF EXISTS "${tableName}_realtime_trigger"
+      ON "${dbSchema}"."${tableName}";
+    `);
+
+    await this.drizzle.db.execute(`
+      CREATE TRIGGER "${tableName}_realtime_trigger"
+      AFTER INSERT OR UPDATE OR DELETE
+      ON "${dbSchema}"."${tableName}"
+      FOR EACH ROW
+      EXECUTE FUNCTION "${dbSchema}"."${fnName}"();
+    `);
+  }
+
+  async disableRealtime(dbSchema: string, tableName: string): Promise<void> {
+    this.assertSafeIdentifier(dbSchema, 'schema name');
+    this.assertSafeIdentifier(tableName, 'table name');
+
+    await this.drizzle.db.execute(`
+      DROP TRIGGER IF EXISTS "${tableName}_realtime_trigger"
+      ON "${dbSchema}"."${tableName}";
+    `);
+  }
+}

package/apps/api/src/sql-editor/dto/execute-query.dto.ts

@@ -0,0 +1,7 @@
+import { IsString, MinLength } from 'class-validator';
+
+export class ExecuteQueryDto {
+  @IsString()
+  @MinLength(1)
+  sql!: string;
+}

package/apps/api/src/sql-editor/sql-editor.controller.ts

@@ -0,0 +1,28 @@
+import { Body, Controller, Get, Param, Post, UseGuards } from '@nestjs/common';
+import { SqlEditorService } from './sql-editor.service';
+import { ExecuteQueryDto } from './dto/execute-query.dto';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth-guard';
+import { OrgRoleGuard } from '../auth/guards/org-role.guards';
+
+@Controller('orgs/:slug/projects/:projectSlug/sql')
+@UseGuards(JwtAuthGuard, OrgRoleGuard)
+export class SqlEditorController {
+  constructor(private sqlEditorService: SqlEditorService) {}
+
+  @Post()
+  executeQuery(
+    @Param('slug') slug: string,
+    @Param('projectSlug') projectSlug: string,
+    @Body() dto: ExecuteQueryDto,
+  ) {
+    return this.sqlEditorService.executeQuery(slug, projectSlug, dto.sql);
+  }
+
+  @Get('history')
+  getHistory(
+    @Param('slug') slug: string,
+    @Param('projectSlug') projectSlug: string,
+  ) {
+    return this.sqlEditorService.getHistory(slug, projectSlug);
+  }
+}

package/apps/api/src/sql-editor/sql-editor.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { SqlEditorService } from './sql-editor.service';
+import { SqlEditorController } from './sql-editor.controller';
+import { AuthModule } from '../auth/auth.module';
+import { OrgRoleGuard } from '../auth/guards/org-role.guards';
+
+@Module({
+  imports: [AuthModule],
+  providers: [SqlEditorService, OrgRoleGuard],
+  controllers: [SqlEditorController],
+})
+export class SqlEditorModule {}