ta_data_mas 0.0.2

package/apps/api/src/sql-editor/sql-editor.service.ts

@@ -0,0 +1,154 @@
+import {
+  BadRequestException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import type {
+  FullQueryResults,
+  NeonQueryFunction,
+} from '@neondatabase/serverless';
+import { and, desc, eq } from 'drizzle-orm';
+import { DrizzleService } from '../db/drizzle.service';
+import { projects, organizations, queryHistory } from '../db/schema';
+import type { QueryResult } from '@apiDatabase/types';
+
+@Injectable()
+export class SqlEditorService {
+  constructor(private drizzle: DrizzleService) {}
+
+  private assertSafeIdentifier(name: string, label: string): void {
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+      throw new BadRequestException(`Invalid ${label}: ${name}`);
+    }
+  }
+
+  private parseSingleStatement(querySql: string): string {
+    const statements = querySql
+      .split(';')
+      .map((part) => part.trim())
+      .filter((part) => part.length > 0);
+
+    if (statements.length === 0) {
+      throw new BadRequestException('SQL query cannot be empty');
+    }
+
+    if (statements.length > 1) {
+      throw new BadRequestException(
+        'Only one SQL statement per run. Remove extra statements after a semicolon (e.g. a trailing SELECT).',
+      );
+    }
+
+    return statements[0];
+  }
+
+  private getNeonClient(): NeonQueryFunction<false, true> {
+    const client = (
+      this.drizzle.db as unknown as {
+        $client: NeonQueryFunction<false, true>;
+      }
+    ).$client;
+
+    if (!client?.transaction) {
+      throw new Error('Neon HTTP client is not available');
+    }
+
+    return client;
+  }
+
+  private normalizePgResult(result: FullQueryResults<false>): {
+    rows: Record<string, unknown>[];
+    rowCount: number;
+    command: string;
+  } {
+    const rows = (result.rows ?? []) as Record<string, unknown>[];
+
+    return {
+      rows,
+      rowCount: result.rowCount ?? rows.length,
+      command: result.command ?? 'SELECT',
+    };
+  }
+
+  private async getProject(orgSlug: string, projectSlug: string) {
+    const [row] = await this.drizzle.db
+      .select({
+        id: projects.id,
+        dbSchema: projects.dbSchema,
+      })
+      .from(projects)
+      .innerJoin(organizations, eq(projects.orgId, organizations.id))
+      .where(
+        and(eq(organizations.slug, orgSlug), eq(projects.slug, projectSlug)),
+      )
+      .limit(1);
+
+    if (!row) throw new NotFoundException('Project not found');
+    return row;
+  }
+
+  async executeQuery(
+    orgSlug: string,
+    projectSlug: string,
+    querySql: string,
+  ): Promise<QueryResult> {
+    const project = await this.getProject(orgSlug, projectSlug);
+    const statement = this.parseSingleStatement(querySql);
+
+    const normalised = statement.trim().toUpperCase();
+    const blocked = ['DROP DATABASE', 'DROP SCHEMA', 'TRUNCATE'];
+    if (blocked.some((b) => normalised.startsWith(b))) {
+      throw new BadRequestException('This statement is not allowed');
+    }
+
+    this.assertSafeIdentifier(project.dbSchema, 'project schema');
+
+    const start = Date.now();
+
+    try {
+      const neonSql = this.getNeonClient();
+
+      const results = await neonSql.transaction(
+        (txn) => [
+          txn`SET LOCAL search_path TO ${txn.unsafe(`"${project.dbSchema}", public`)}`,
+          txn`${txn.unsafe(statement)}`,
+        ],
+        { fullResults: true, readOnly: false },
+      );
+
+      const executionTimeMs = Date.now() - start;
+      const { rows, rowCount, command } = this.normalizePgResult(
+        results[results.length - 1],
+      );
+      const columns = rows.length > 0 ? Object.keys(rows[0]) : [];
+
+      await this.drizzle.db.insert(queryHistory).values({
+        projectId: project.id,
+        sql: querySql,
+        executionTimeMs,
+        rowCount,
+      });
+
+      return {
+        rows,
+        columns,
+        rowCount,
+        executionTimeMs,
+        command,
+      };
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : 'Query failed';
+      throw new BadRequestException(message);
+    }
+  }
+
+  async getHistory(orgSlug: string, projectSlug: string) {
+    const project = await this.getProject(orgSlug, projectSlug);
+
+    return this.drizzle.db
+      .select()
+      .from(queryHistory)
+      .where(eq(queryHistory.projectId, project.id))
+      .orderBy(desc(queryHistory.createdAt))
+      .limit(50);
+  }
+}

package/apps/api/src/storage/project-storage.controller.ts

@@ -0,0 +1,140 @@
+import {
+  All,
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Next,
+  Param,
+  Post,
+  Req,
+  Res,
+  UseGuards,
+} from '@nestjs/common';
+import type { NextFunction, Request, Response } from 'express';
+import { IsNumber, IsString } from 'class-validator';
+import { PROJECT_KEY_ROLES } from '@apiDatabase/constants';
+import { createRouteHandler } from 'uploadthing/express';
+import { StorageService } from './storage.service';
+import { storageRouter } from './uploadthing';
+import {
+  ProjectKeyGuard,
+  type ProjectKeyPayload,
+} from '../project-api/project-key.guard';
+import { ForbiddenException } from '@nestjs/common';
+
+class SaveObjectDto {
+  @IsString()
+  name!: string;
+
+  @IsNumber()
+  size!: number;
+
+  @IsString()
+  type!: string;
+
+  @IsString()
+  utKey!: string;
+
+  @IsString()
+  url!: string;
+}
+
+const utHandler = createRouteHandler({ router: storageRouter });
+
+@Controller('projects/:projectSlug/storage')
+@UseGuards(ProjectKeyGuard)
+export class ProjectStorageController {
+  constructor(private storageService: StorageService) {}
+
+  private getProjectKey(req: Request): ProjectKeyPayload {
+    return req['projectKey'] as ProjectKeyPayload;
+  }
+
+  private assertWriteAccess(req: Request): void {
+    const { role } = this.getProjectKey(req);
+    if (role !== PROJECT_KEY_ROLES.SERVICE_ROLE) {
+      throw new ForbiddenException(
+        'Write operations require the service role key',
+      );
+    }
+  }
+
+  @Get('buckets/:bucketName/objects')
+  async getObjects(
+    @Req() req: Request,
+    @Param('projectSlug') projectSlug: string,
+    @Param('bucketName') bucketName: string,
+  ) {
+    const { projectId } = this.getProjectKey(req);
+    await this.storageService.assertProjectSlug(projectId, projectSlug);
+    const bucket = await this.storageService.getBucketByName(
+      projectId,
+      bucketName,
+    );
+    return this.storageService.getObjects(bucket.id);
+  }
+
+  @All('buckets/:bucketName/upload')
+  async handleUpload(
+    @Req() req: Request,
+    @Res() res: Response,
+    @Next() next: NextFunction,
+    @Param('projectSlug') projectSlug: string,
+    @Param('bucketName') bucketName: string,
+  ): Promise<void> {
+    this.assertWriteAccess(req);
+    const { projectId } = this.getProjectKey(req);
+    await this.storageService.assertProjectSlug(projectId, projectSlug);
+    await this.storageService.getBucketByName(projectId, bucketName);
+
+    const originalUrl = req.url;
+    const queryIndex = originalUrl.indexOf('?');
+    const query = queryIndex >= 0 ? originalUrl.slice(queryIndex) : '';
+    req.url = `/${query}`;
+    utHandler(req, res, (err?: unknown) => {
+      req.url = originalUrl;
+      if (err) next(err);
+    });
+  }
+
+  @Post('buckets/:bucketName/objects')
+  async saveObject(
+    @Req() req: Request,
+    @Param('projectSlug') projectSlug: string,
+    @Param('bucketName') bucketName: string,
+    @Body() file: SaveObjectDto,
+  ) {
+    this.assertWriteAccess(req);
+    const { projectId } = this.getProjectKey(req);
+    await this.storageService.assertProjectSlug(projectId, projectSlug);
+    const bucket = await this.storageService.getBucketByName(
+      projectId,
+      bucketName,
+    );
+    return this.storageService.saveObject(bucket.id, file);
+  }
+
+  @Delete('objects/:objectId')
+  async deleteObject(
+    @Req() req: Request,
+    @Param('projectSlug') projectSlug: string,
+    @Param('objectId') objectId: string,
+  ) {
+    this.assertWriteAccess(req);
+    const { projectId } = this.getProjectKey(req);
+    await this.storageService.assertProjectSlug(projectId, projectSlug);
+    return this.storageService.deleteObject(objectId);
+  }
+
+  @Get('objects/:objectId/signed-url')
+  async getSignedUrl(
+    @Req() req: Request,
+    @Param('projectSlug') projectSlug: string,
+    @Param('objectId') objectId: string,
+  ) {
+    const { projectId } = this.getProjectKey(req);
+    await this.storageService.assertProjectSlug(projectId, projectSlug);
+    return this.storageService.getSignedUrl(objectId);
+  }
+}

package/apps/api/src/storage/storage.controller.ts

@@ -0,0 +1,118 @@
+import {
+  All,
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Next,
+  Param,
+  Post,
+  Req,
+  Res,
+  UseGuards,
+} from '@nestjs/common';
+import type { NextFunction, Request, Response } from 'express';
+import { createRouteHandler } from 'uploadthing/express';
+import { IsNumber, IsEnum, IsString } from 'class-validator';
+import { StorageService } from './storage.service';
+import { storageRouter } from './uploadthing';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth-guard';
+import { OrgRoleGuard } from '../auth/guards/org-role.guards';
+import type { BucketAccess } from '@apiDatabase/types';
+
+class CreateBucketDto {
+  @IsString()
+  name!: string;
+
+  @IsEnum(['public', 'private'])
+  access!: BucketAccess;
+}
+
+class SaveObjectDto {
+  @IsString()
+  name!: string;
+
+  @IsNumber()
+  size!: number;
+
+  @IsString()
+  type!: string;
+
+  @IsString()
+  utKey!: string;
+
+  @IsString()
+  url!: string;
+}
+
+const utHandler = createRouteHandler({ router: storageRouter });
+
+@Controller('orgs/:slug/projects/:projectSlug/storage')
+@UseGuards(JwtAuthGuard, OrgRoleGuard)
+export class StorageController {
+  constructor(private storageService: StorageService) {}
+
+  @Get('buckets')
+  getBuckets(
+    @Param('slug') slug: string,
+    @Param('projectSlug') projectSlug: string,
+  ) {
+    return this.storageService.getBuckets(slug, projectSlug);
+  }
+
+  @Post('buckets')
+  createBucket(
+    @Param('slug') slug: string,
+    @Param('projectSlug') projectSlug: string,
+    @Body() dto: CreateBucketDto,
+  ) {
+    return this.storageService.createBucket(
+      slug,
+      projectSlug,
+      dto.name,
+      dto.access,
+    );
+  }
+
+  @Delete('buckets/:bucketId')
+  deleteBucket(@Param('bucketId') bucketId: string) {
+    return this.storageService.deleteBucket(bucketId);
+  }
+
+  @Get('buckets/:bucketId/objects')
+  getObjects(@Param('bucketId') bucketId: string) {
+    return this.storageService.getObjects(bucketId);
+  }
+
+  // UploadThing upload endpoint — proxies the UT protocol (GET + POST)
+  @All('buckets/:bucketId/upload')
+  handleUpload(
+    @Req() req: Request,
+    @Res() res: Response,
+    @Next() next: NextFunction,
+  ): void {
+    const originalUrl = req.url;
+    const queryIndex = originalUrl.indexOf('?');
+    const query = queryIndex >= 0 ? originalUrl.slice(queryIndex) : '';
+    req.url = `/${query}`;
+    utHandler(req, res, (err?: unknown) => {
+      req.url = originalUrl;
+      if (err) next(err);
+    });
+  }
+
+  @Post('buckets/:bucketId/objects')
+  saveObject(@Param('bucketId') bucketId: string, @Body() file: SaveObjectDto) {
+    return this.storageService.saveObject(bucketId, file);
+  }
+
+  @Delete('objects/:objectId')
+  deleteObject(@Param('objectId') objectId: string) {
+    return this.storageService.deleteObject(objectId);
+  }
+
+  @Get('objects/:objectId/signed-url')
+  getSignedUrl(@Param('objectId') objectId: string) {
+    return this.storageService.getSignedUrl(objectId);
+  }
+}

package/apps/api/src/storage/storage.module.ts

@@ -0,0 +1,15 @@
+import { Module } from '@nestjs/common';
+import { StorageService } from './storage.service';
+import { StorageController } from './storage.controller';
+import { AuthModule } from '../auth/auth.module';
+import { ProjectStorageController } from './project-storage.controller';
+import { JwtModule } from '@nestjs/jwt';
+import { ProjectKeyGuard } from 'src/project-api/project-key.guard';
+
+@Module({
+  imports: [AuthModule, JwtModule.register({})],
+
+  providers: [StorageService, ProjectKeyGuard],
+  controllers: [StorageController, ProjectStorageController],
+})
+export class StorageModule {}

package/apps/api/src/storage/storage.service.ts

@@ -0,0 +1,191 @@
+import {
+  BadRequestException,
+  ForbiddenException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { and, eq } from 'drizzle-orm';
+import { UTApi } from 'uploadthing/server';
+import { DrizzleService } from '../db/drizzle.service';
+import {
+  projects,
+  organizations,
+  storageBuckets,
+  storageObjects,
+} from '../db/schema';
+import type { BucketAccess } from '@apiDatabase/types';
+
+@Injectable()
+export class StorageService {
+  private utapi = new UTApi();
+
+  constructor(private drizzle: DrizzleService) {}
+
+  private async getProject(orgSlug: string, projectSlug: string) {
+    const [row] = await this.drizzle.db
+      .select({ id: projects.id })
+      .from(projects)
+      .innerJoin(organizations, eq(projects.orgId, organizations.id))
+      .where(
+        and(eq(organizations.slug, orgSlug), eq(projects.slug, projectSlug)),
+      )
+      .limit(1);
+
+    if (!row) throw new NotFoundException('Project not found');
+    return row;
+  }
+
+  async getBuckets(orgSlug: string, projectSlug: string) {
+    const project = await this.getProject(orgSlug, projectSlug);
+    return this.drizzle.db
+      .select()
+      .from(storageBuckets)
+      .where(eq(storageBuckets.projectId, project.id));
+  }
+
+  async createBucket(
+    orgSlug: string,
+    projectSlug: string,
+    name: string,
+    access: BucketAccess,
+  ) {
+    const project = await this.getProject(orgSlug, projectSlug);
+
+    const trimmed = name.trim();
+    if (!trimmed) {
+      throw new BadRequestException('Bucket name is required');
+    }
+
+    const [bucket] = await this.drizzle.db
+      .insert(storageBuckets)
+      .values({ projectId: project.id, name: trimmed, access })
+      .returning();
+
+    return bucket;
+  }
+
+  async deleteBucket(bucketId: string) {
+    const objects = await this.drizzle.db
+      .select({ utKey: storageObjects.utKey })
+      .from(storageObjects)
+      .where(eq(storageObjects.bucketId, bucketId));
+
+    if (objects.length > 0) {
+      await this.utapi.deleteFiles(objects.map((o) => o.utKey));
+    }
+
+    await this.drizzle.db
+      .delete(storageBuckets)
+      .where(eq(storageBuckets.id, bucketId));
+
+    return { message: 'Bucket deleted' };
+  }
+
+  async getObjects(bucketId: string) {
+    return this.drizzle.db
+      .select()
+      .from(storageObjects)
+      .where(eq(storageObjects.bucketId, bucketId));
+  }
+
+  async saveObject(
+    bucketId: string,
+    file: {
+      name: string;
+      size: number;
+      type: string;
+      utKey: string;
+      url: string;
+    },
+  ) {
+    const [bucket] = await this.drizzle.db
+      .select()
+      .from(storageBuckets)
+      .where(eq(storageBuckets.id, bucketId))
+      .limit(1);
+
+    if (!bucket) throw new NotFoundException('Bucket not found');
+
+    const url = bucket.access === 'public' ? file.url : '';
+
+    const [object] = await this.drizzle.db
+      .insert(storageObjects)
+      .values({
+        bucketId,
+        name: file.name,
+        size: file.size,
+        mimeType: file.type,
+        utKey: file.utKey,
+        url,
+      })
+      .returning();
+
+    return object;
+  }
+
+  async deleteObject(objectId: string) {
+    const [object] = await this.drizzle.db
+      .select()
+      .from(storageObjects)
+      .where(eq(storageObjects.id, objectId))
+      .limit(1);
+
+    if (!object) throw new NotFoundException('File not found');
+
+    await this.utapi.deleteFiles(object.utKey);
+
+    await this.drizzle.db
+      .delete(storageObjects)
+      .where(eq(storageObjects.id, objectId));
+
+    return { message: 'File deleted' };
+  }
+
+  async getSignedUrl(objectId: string) {
+    const [object] = await this.drizzle.db
+      .select()
+      .from(storageObjects)
+      .where(eq(storageObjects.id, objectId))
+      .limit(1);
+
+    if (!object) throw new NotFoundException('File not found');
+
+    const { ufsUrl } = await this.utapi.generateSignedURL(object.utKey, {
+      expiresIn: 3600,
+    });
+
+    return { url: ufsUrl };
+  }
+  async assertProjectSlug(
+    projectId: string,
+    projectSlug: string,
+  ): Promise<void> {
+    const [project] = await this.drizzle.db
+      .select({ slug: projects.slug })
+      .from(projects)
+      .where(eq(projects.id, projectId))
+      .limit(1);
+
+    if (!project) throw new NotFoundException('Project not found');
+
+    if (project.slug !== projectSlug) {
+      throw new ForbiddenException('API key does not match this project URL');
+    }
+  }
+
+  async getBucketByName(projectId: string, bucketName: string) {
+    const [bucket] = await this.drizzle.db
+      .select()
+      .from(storageBuckets)
+      .where(
+        and(
+          eq(storageBuckets.projectId, projectId),
+          eq(storageBuckets.name, bucketName),
+        ),
+      )
+      .limit(1);
+
+    if (!bucket) throw new NotFoundException('Bucket not found');
+    return bucket;
+  }
+}

package/apps/api/src/storage/uploadthing.ts

@@ -0,0 +1,23 @@
+import { createUploadthing, type FileRouter } from 'uploadthing/express';
+import { FileRoute } from 'uploadthing/types';
+
+const f = createUploadthing();
+
+export const storageRouter: {
+  bucketUploader: FileRoute<{
+    input: undefined;
+    output: null;
+    errorShape: any;
+  }>;
+} = {
+  bucketUploader: f({
+    blob: {
+      maxFileSize: '512MB',
+      maxFileCount: 10,
+    },
+  }).onUploadComplete((data) => {
+    console.log('UploadThing upload complete:', data.file.name);
+  }),
+} satisfies FileRouter;
+
+export type OurStorageRouter = typeof storageRouter;

package/apps/api/src/table-editor/dto/alter-table.dto.ts

@@ -0,0 +1,15 @@
+import { IsIn, IsOptional, IsString } from 'class-validator';
+import { COLUMN_TYPES } from '@apiDatabase/constants';
+import type { ColumnType } from '@apiDatabase/types';
+
+export class AddColumnDto {
+  @IsString()
+  name!: string;
+
+  @IsIn(COLUMN_TYPES)
+  type!: ColumnType;
+
+  @IsOptional()
+  @IsString()
+  defaultValue?: string;
+}

package/apps/api/src/table-editor/dto/create-table.dto.ts

@@ -0,0 +1,54 @@
+import {
+  IsArray,
+  IsBoolean,
+  IsIn,
+  IsOptional,
+  IsString,
+  MinLength,
+  ValidateNested,
+} from 'class-validator';
+import { Type } from 'class-transformer';
+import { COLUMN_TYPES } from '@apiDatabase/constants';
+import type {
+  CreateTableInput,
+  CreateColumnInput,
+  ColumnType,
+} from '@apiDatabase/types';
+
+export class CreateColumnDto implements CreateColumnInput {
+  @IsString()
+  @MinLength(1)
+  name!: string;
+
+  @IsIn(COLUMN_TYPES)
+  type!: ColumnType;
+
+  @IsBoolean()
+  isNullable!: boolean;
+
+  @IsBoolean()
+  isPrimaryKey!: boolean;
+
+  @IsString()
+  @IsOptional()
+  defaultValue?: string;
+
+  @IsString()
+  @IsOptional()
+  foreignKeyTable?: string;
+
+  @IsString()
+  @IsOptional()
+  foreignKeyColumn?: string;
+}
+
+export class CreateTableDto implements CreateTableInput {
+  @IsString()
+  @MinLength(1)
+  name!: string;
+
+  @IsArray()
+  @ValidateNested({ each: true })
+  @Type(() => CreateColumnDto)
+  columns!: CreateColumnDto[];
+}