forked from wangziqi/gongxue-base
feat: scaffold supabase multi-tenant backend
This commit is contained in:
Codex
@@ -0,0 +1,30 @@
|
||||
import { readPocketBaseSchema, fieldsOf } from './pb-schema.js';
|
||||
|
||||
const { absPath, collections, byId } = readPocketBaseSchema();
|
||||
|
||||
const businessCollections = collections.filter(c => !c.name.startsWith('_'));
|
||||
const authCollections = collections.filter(c => c.type === 'auth');
|
||||
const relationCount = collections.reduce(
|
||||
(count, collection) => count + fieldsOf(collection).filter(field => field.type === 'relation').length,
|
||||
0,
|
||||
);
|
||||
|
||||
console.log(`PocketBase schema: ${absPath}`);
|
||||
console.log(`Collections: ${collections.length}`);
|
||||
console.log(`Business collections: ${businessCollections.length}`);
|
||||
console.log(`Auth collections: ${authCollections.map(c => c.name).join(', ') || 'none'}`);
|
||||
console.log(`Relation fields: ${relationCount}`);
|
||||
console.log('');
|
||||
|
||||
for (const collection of businessCollections.sort((a, b) => a.name.localeCompare(b.name))) {
|
||||
const fields = fieldsOf(collection);
|
||||
const relationFields = fields.filter(field => field.type === 'relation');
|
||||
const relationSummary = relationFields
|
||||
.map(field => {
|
||||
const target = field.collectionId ? byId.get(field.collectionId)?.name || field.collectionId : '?';
|
||||
return `${field.name}->${target}`;
|
||||
})
|
||||
.join(', ');
|
||||
|
||||
console.log(`${collection.name.padEnd(24)} ${collection.type.padEnd(6)} fields=${String(fields.length).padStart(2)} relations=${relationSummary || '-'}`);
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
import { DEFAULT_DATABASE_URL } from '../../../packages/config/src/index.js';
|
||||
import { createPool, query as runQuery, queryOne as runQueryOne } from '../../../packages/db/src/index.js';
|
||||
import { loadEnv } from './env.js';
|
||||
|
||||
loadEnv();
|
||||
|
||||
export const pool = createPool({
|
||||
connectionString: process.env.DATABASE_URL || DEFAULT_DATABASE_URL,
|
||||
max: 5,
|
||||
});
|
||||
|
||||
export async function query<T = unknown>(sql: string, params: unknown[] = []): Promise<T[]> {
|
||||
return runQuery<T>(pool, sql, params);
|
||||
}
|
||||
|
||||
export async function queryOne<T = unknown>(sql: string, params: unknown[] = []): Promise<T | null> {
|
||||
return runQueryOne<T>(pool, sql, params);
|
||||
}
|
||||
|
||||
export async function closeDb() {
|
||||
await pool.end();
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
import { loadDotenv } from '../../../packages/config/src/index.js';
|
||||
|
||||
export function loadEnv() {
|
||||
loadDotenv();
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,38 @@
|
||||
import fs from 'node:fs';
|
||||
import path from 'node:path';
|
||||
|
||||
export interface PocketBaseField {
|
||||
name: string;
|
||||
type: string;
|
||||
required?: boolean;
|
||||
hidden?: boolean;
|
||||
values?: string[];
|
||||
collectionId?: string;
|
||||
maxSelect?: number;
|
||||
}
|
||||
|
||||
export interface PocketBaseCollection {
|
||||
id: string;
|
||||
name: string;
|
||||
type: string;
|
||||
fields?: PocketBaseField[];
|
||||
schema?: PocketBaseField[];
|
||||
listRule?: string;
|
||||
viewRule?: string;
|
||||
createRule?: string;
|
||||
updateRule?: string;
|
||||
deleteRule?: string;
|
||||
}
|
||||
|
||||
export function readPocketBaseSchema(schemaPath = process.env.PB_SCHEMA_PATH || '../../docs/pb_schema.json') {
|
||||
const absPath = path.resolve(process.cwd(), schemaPath);
|
||||
const raw = JSON.parse(fs.readFileSync(absPath, 'utf8'));
|
||||
const collections = (Array.isArray(raw) ? raw : raw.collections || []) as PocketBaseCollection[];
|
||||
const byId = new Map(collections.map(c => [c.id, c]));
|
||||
const byName = new Map(collections.map(c => [c.name, c]));
|
||||
return { absPath, collections, byId, byName };
|
||||
}
|
||||
|
||||
export function fieldsOf(collection: PocketBaseCollection) {
|
||||
return collection.fields || collection.schema || [];
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
import { readPocketBaseSchema, fieldsOf } from './pb-schema.js';
|
||||
|
||||
const { collections, byId, absPath } = readPocketBaseSchema();
|
||||
|
||||
const sensitivePattern = /(password|token|secret|private|session|openid|unionid|accesskey|appkey|apikey|apiV3Key|notifyToken|aesKey|mchId|appSecret)/i;
|
||||
const likelySafeKeyPattern = /(^key$|fieldKey|tokenKey)$/i;
|
||||
const jsonRiskPattern = /(stats|progress|config|settings|raw|payload|metadata|fieldValues|svipRegions|recentActivities)/i;
|
||||
|
||||
interface Risk {
|
||||
severity: 'critical' | 'high' | 'medium' | 'low';
|
||||
collection: string;
|
||||
field?: string;
|
||||
message: string;
|
||||
}
|
||||
|
||||
const risks: Risk[] = [];
|
||||
|
||||
for (const collection of collections.filter(c => !c.name.startsWith('_'))) {
|
||||
const fields = fieldsOf(collection);
|
||||
|
||||
if (collection.name === 'settings') {
|
||||
risks.push({
|
||||
severity: 'critical',
|
||||
collection: collection.name,
|
||||
message: 'Monolithic settings table mixes public config and secrets. Split into tenant_settings, tenant_payment_accounts and app_private.tenant_secrets.',
|
||||
});
|
||||
}
|
||||
|
||||
if (collection.name === 'users') {
|
||||
risks.push({
|
||||
severity: 'high',
|
||||
collection: collection.name,
|
||||
message: 'Legacy users table mixes auth, profile, roles, learning stats, membership and referral data. Split before migration.',
|
||||
});
|
||||
}
|
||||
|
||||
for (const field of fields) {
|
||||
if ((sensitivePattern.test(field.name) && !likelySafeKeyPattern.test(field.name)) || field.hidden) {
|
||||
risks.push({
|
||||
severity: field.hidden || sensitivePattern.test(field.name) ? 'critical' : 'high',
|
||||
collection: collection.name,
|
||||
field: field.name,
|
||||
message: `Sensitive or hidden field "${field.name}" must not be copied into public normalized tables.`,
|
||||
});
|
||||
}
|
||||
|
||||
if (field.type === 'json' && jsonRiskPattern.test(field.name)) {
|
||||
risks.push({
|
||||
severity: 'medium',
|
||||
collection: collection.name,
|
||||
field: field.name,
|
||||
message: `JSON field "${field.name}" needs explicit normalization or a documented reason to remain JSONB.`,
|
||||
});
|
||||
}
|
||||
|
||||
if (field.type === 'relation' && field.collectionId) {
|
||||
const target = byId.get(field.collectionId);
|
||||
if (!target) {
|
||||
risks.push({
|
||||
severity: 'high',
|
||||
collection: collection.name,
|
||||
field: field.name,
|
||||
message: `Relation points to missing collection id "${field.collectionId}".`,
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const order: Record<Risk['severity'], number> = { critical: 0, high: 1, medium: 2, low: 3 };
|
||||
risks.sort((a, b) => order[a.severity] - order[b.severity] || a.collection.localeCompare(b.collection));
|
||||
|
||||
console.log(`PocketBase schema risk report: ${absPath}`);
|
||||
console.log(`Risks: ${risks.length}`);
|
||||
console.log('');
|
||||
|
||||
for (const risk of risks) {
|
||||
const location = risk.field ? `${risk.collection}.${risk.field}` : risk.collection;
|
||||
console.log(`[${risk.severity.toUpperCase()}] ${location} - ${risk.message}`);
|
||||
}
|
||||
@@ -0,0 +1,354 @@
|
||||
import { closeDb, query } from './db.js';
|
||||
import { loadEnv } from './env.js';
|
||||
|
||||
loadEnv();
|
||||
|
||||
type CheckStatus = 'pass' | 'warn' | 'fail';
|
||||
|
||||
interface CheckResult {
|
||||
name: string;
|
||||
status: CheckStatus;
|
||||
count?: number;
|
||||
message: string;
|
||||
}
|
||||
|
||||
const tenantId = process.env.TENANT_ID || '00000000-0000-0000-0000-000000000001';
|
||||
const failOnWarnings = process.env.FAIL_ON_WARNINGS === 'true';
|
||||
|
||||
async function scalar(sql: string, params: unknown[] = []) {
|
||||
const rows = await query<{ count: string }>(sql, params);
|
||||
return Number(rows[0]?.count || 0);
|
||||
}
|
||||
|
||||
function result(name: string, count: number, failMessage: string, passMessage: string, warnOnly = false): CheckResult {
|
||||
if (count > 0) {
|
||||
return {
|
||||
name,
|
||||
status: warnOnly ? 'warn' : 'fail',
|
||||
count,
|
||||
message: failMessage,
|
||||
};
|
||||
}
|
||||
return { name, status: 'pass', count, message: passMessage };
|
||||
}
|
||||
|
||||
async function tableCounts(): Promise<CheckResult[]> {
|
||||
const tables = [
|
||||
'platform_users',
|
||||
'regions',
|
||||
'region_modules',
|
||||
'module_nodes',
|
||||
'schools',
|
||||
'majors',
|
||||
'subjects',
|
||||
'categories',
|
||||
'questions',
|
||||
'orders',
|
||||
'svip_plans',
|
||||
'activation_codes',
|
||||
'vocabulary_units',
|
||||
'vocabulary_words',
|
||||
'handbook_subjects',
|
||||
'handbook_chapters',
|
||||
'handbook_entries',
|
||||
'products',
|
||||
];
|
||||
|
||||
const checks: CheckResult[] = [];
|
||||
for (const table of tables) {
|
||||
const count =
|
||||
table === 'platform_users'
|
||||
? await scalar('select count(*) from public.platform_users')
|
||||
: await scalar(`select count(*) from public.${table} where tenant_id = $1`, [tenantId]);
|
||||
checks.push({
|
||||
name: `count:${table}`,
|
||||
status: 'pass',
|
||||
count,
|
||||
message: `${table} rows: ${count}`,
|
||||
});
|
||||
}
|
||||
return checks;
|
||||
}
|
||||
|
||||
async function validationChecks(): Promise<CheckResult[]> {
|
||||
const checks: CheckResult[] = [];
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'tenant_exists',
|
||||
(await scalar('select count(*) from public.tenants where id = $1', [tenantId])) === 0 ? 1 : 0,
|
||||
'Tenant seed is missing. Run Supabase seed or set TENANT_ID to an existing tenant.',
|
||||
'Tenant exists.',
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'raw_records_not_normalized',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.pb_raw_records r
|
||||
join public.pb_import_runs run on run.id = r.run_id
|
||||
where r.tenant_id = $1
|
||||
and run.id = (
|
||||
select id from public.pb_import_runs
|
||||
where tenant_id = $1
|
||||
order by started_at desc
|
||||
limit 1
|
||||
)
|
||||
and r.collection_name in (
|
||||
'regions','region_modules','module_nodes','schools','majors','subjects',
|
||||
'categories','questions','users','orders','svip_plans','codes',
|
||||
'vocabulary_units','vocabulary','handbook_subjects','handbook_chapters',
|
||||
'handbook_entries','banners','faqs','announcements'
|
||||
)
|
||||
and r.normalized = false
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'Some core raw records from the latest run were not normalized.',
|
||||
'All latest-run core raw records are marked normalized.',
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'questions_without_current_version',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.questions
|
||||
where tenant_id = $1 and current_version_id is null
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'Questions exist without a current version.',
|
||||
'Every question has a current version.',
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'question_versions_wrong_tenant',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.questions q
|
||||
join public.question_versions v on v.question_id = q.id
|
||||
where q.tenant_id = $1 and v.tenant_id <> q.tenant_id
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'Some question_versions have a different tenant_id from their question.',
|
||||
'Question version tenant_id values match their questions.',
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'questions_unresolved_subjects',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.questions
|
||||
where tenant_id = $1 and legacy_subject_id is not null and subject_id is null
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'Some questions still have legacy_subject_id but no resolved subject_id.',
|
||||
'Question subject references are resolved.',
|
||||
true,
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'questions_unresolved_categories',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.questions
|
||||
where tenant_id = $1 and legacy_category_id is not null and category_id is null
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'Some questions still have legacy_category_id but no resolved category_id.',
|
||||
'Question category references are resolved.',
|
||||
true,
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'orders_unresolved_users',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.orders
|
||||
where tenant_id = $1 and legacy_user_id is not null and user_id is null
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'Some orders still have legacy_user_id but no resolved user_id.',
|
||||
'Order user references are resolved.',
|
||||
true,
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'orders_paid_without_payment',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.orders o
|
||||
where o.tenant_id = $1
|
||||
and o.status = 'paid'
|
||||
and not exists (
|
||||
select 1 from public.payments p
|
||||
where p.tenant_id = o.tenant_id and p.order_id = o.id
|
||||
)
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'Paid orders exist without payment rows.',
|
||||
'Paid orders have payment rows.',
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'entitlements_unresolved_user',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.entitlements e
|
||||
left join public.platform_users u on u.id = e.user_id
|
||||
where e.tenant_id = $1 and u.id is null
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'Entitlements exist without a valid user.',
|
||||
'Entitlements reference valid users.',
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'public_sensitive_profile_keys',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.platform_users
|
||||
where raw_profile::text ~* '"(password|tokenKey|secret|sessionKey|openId|unionId|wechatSessionKey|qqOpenId|wechatOpenId|wechatUnionId)"'
|
||||
`,
|
||||
),
|
||||
'Sensitive identity or credential keys remain in platform_users.raw_profile.',
|
||||
'No sensitive identity or credential keys found in platform_users.raw_profile.',
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'student_stats_legacy_arrays',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.student_profiles
|
||||
where tenant_id = $1 and (stats ? 'favorites' or stats ? 'wrongBook')
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'student_profiles.stats still contains favorites/wrongBook legacy arrays.',
|
||||
'student profile stats no longer contain favorites/wrongBook arrays.',
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'public_settings_sensitive_keys',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.tenant_settings
|
||||
where tenant_id = $1
|
||||
and public_config::text ~* '(secret|privatekey|sessionkey|accesskey|appkey|apikey|api_v3_key|notifytoken|aeskey)'
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'Sensitive-looking keys remain in tenant_settings.public_config.',
|
||||
'No sensitive-looking keys found in tenant public settings.',
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'public_crm_secret_leak',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.crm_config
|
||||
where tenant_id = $1 and secret_ref is not null and secret_ref !~ '^app_private\\.tenant_secrets:'
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'CRM config contains an unsafe secret_ref value.',
|
||||
'CRM config stores only private secret references.',
|
||||
),
|
||||
);
|
||||
|
||||
checks.push(
|
||||
result(
|
||||
'critical_import_issues',
|
||||
await scalar(
|
||||
`
|
||||
select count(*)
|
||||
from public.pb_import_issues
|
||||
where tenant_id = $1
|
||||
and severity = 'critical'
|
||||
and run_id = (
|
||||
select id from public.pb_import_runs
|
||||
where tenant_id = $1
|
||||
order by started_at desc
|
||||
limit 1
|
||||
)
|
||||
`,
|
||||
[tenantId],
|
||||
),
|
||||
'Critical import issues exist in the latest run. Review pb_import_issues before launch.',
|
||||
'No critical import issues in the latest run.',
|
||||
true,
|
||||
),
|
||||
);
|
||||
|
||||
return checks;
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const checks = [...(await tableCounts()), ...(await validationChecks())];
|
||||
let failures = 0;
|
||||
let warnings = 0;
|
||||
|
||||
for (const check of checks) {
|
||||
const prefix = check.status === 'pass' ? 'PASS' : check.status === 'warn' ? 'WARN' : 'FAIL';
|
||||
console.log(`[${prefix}] ${check.name}: ${check.message}${check.count === undefined ? '' : ` (${check.count})`}`);
|
||||
if (check.status === 'fail') failures += 1;
|
||||
if (check.status === 'warn') warnings += 1;
|
||||
}
|
||||
|
||||
console.log(`Validation complete: ${failures} failures, ${warnings} warnings.`);
|
||||
|
||||
if (failures > 0 || (failOnWarnings && warnings > 0)) {
|
||||
process.exitCode = 1;
|
||||
}
|
||||
}
|
||||
|
||||
main()
|
||||
.catch(error => {
|
||||
console.error(error);
|
||||
process.exitCode = 1;
|
||||
})
|
||||
.finally(async () => {
|
||||
await closeDb();
|
||||
});
|
||||
Reference in New Issue
Block a user