zeekay
d02a70442d
migrate: pocketbase/dbx → hanzoai/dbx v1.12.0
...
Drop-in replacement — same API, same package name (dbx).
75 Go files updated. Zero pocketbase references in imports.
2026-03-02 13:54:55 -07:00
zeekay
f9d1b0af80
feat: accept UUID-length record IDs (max 36 chars, was 15) — IAM sub compatibility
2026-03-02 16:49:27 -07:00
zeekay
f9c0e3642a
fix: remove unused log import and dead UI copy from Dockerfile
...
Drop leftover "log" import in record_query_expand.go (debug fprintf
already removed). Remove COPY of ui/dist in Dockerfile since the
embedded UI is no longer built as a separate stage.
2026-03-02 01:15:20 -07:00
zeekay
157b7127ab
security: fix critical and high findings from red team review
...
- C1: add orgId field to _tasks/_workflows, filter all queries by org
- C2: validate spaceID/orgID with regex before Temporal visibility queries
- H1: add sync.RWMutex to orgClients map (prevent concurrent map panic)
- H2: atomic FailTask with CASE expression (eliminate TOCTOU race)
- H4: extractCreator uses authenticated user ID, not raw headers
- Add orgId to collection schemas, store methods, and API filters
2026-03-02 01:02:45 -07:00
zeekay
1dd61d8947
fix(tests): resolve remaining core test failures
...
- record_query_test: replace expired verification token with dynamic
generation via tests.GetUserVerificationToken()
- record_field_resolver_test: update expected SQL — json_object('pb',...)
→ json_object('base',...) and '$.pb.*' → '$.base.*' paths (6 subtests)
2026-03-01 21:02:52 -07:00
zeekay
fcfaa37ce2
chore: strip all PocketBase cruft from codebase
...
- Delete 7 one-off migration utilities (cmd/fix*, cmd/token*)
- Rename env vars: PB_ID_TOKEN_LEEWAY → HZ_ID_TOKEN_LEEWAY,
PB_FILES_DELETE_MAX_WORKERS → HZ_FILES_DELETE_MAX_WORKERS
- Rename temp file prefix: pb_buffer_file_ → hz_buffer_
- Rename test data dir: pb_base_app_test_data_dir → test_data_dir
- Strip all "PocketBase" from comments (→ "Base" or removed)
- Strip pb_data references in backup error messages
- Update @group PocketBase → @group Base in JSVM type docs
- Update filesystem blob/s3 package doc comments
- _hzf_ field IDs in test DB (already done prior commit)
Zero remaining PocketBase/pb_ references in production Go code.
Only legitimate deps remain: pocketbase/dbx (query builder),
pocketbase/tygoja (JS VM bindings).
2026-03-01 20:44:11 -07:00
zeekay
79555afb30
chore: strip _pbf_ PocketBase prefixes, unify to _hzf_
...
- Test fixture DB: rename all _pbf_* field IDs to _hzf_*
- collection_test.go: update hardcoded field IDs to match
- record_crud.go: __pb_create__ → __hzf_create__
- base_backup.go: old_pb_data_ → old_hz_data_
- Remove stale _hz_users_auth_ mapping from tokenreplace
2026-03-01 18:52:30 -07:00
zeekay
3fe483ac1b
refactor: remove _hz_ prefix from collection IDs, add brand-neutral logo config
...
Remove all _hz_ prefixes from collection IDs, internal markers, and test
fixtures. The default users collection is now _users_auth_ instead of
_hz_users_auth_. Internal SQL parser tokens renamed from __hz_join__/__hz_discard__
to __join__/__discard__. Backup prefix changed from @auto_hz_backup_ to
@auto_backup_. Test database updated with correct collection IDs and indexes.
JWT tokens in test files regenerated with new collection IDs.
Add LogoURL field to MetaConfig so the admin UI logo is configurable via
app settings instead of hardcoded. FullPage.svelte and App.svelte sidebar
now read logo and app name from the settings store, falling back to
defaults when not configured.
2026-03-01 23:48:36 -07:00
zeekay
ee7255323b
fix: replace remaining pb references with base in ApiClient.js
2026-03-01 21:59:17 -07:00
zeekay
cf0252a28e
Merge remote-tracking branch 'upstream/master'
...
# Conflicts:
# apis/record_auth_with_otp.go
# core/base_backup.go
# go.mod
# go.sum
# plugins/jsvm/internal/types/generated/types.d.ts
# tools/router/rereadable_read_closer_test.go
# ui/dist/assets/AuthMethodsDocs-C2aSYmNv.js
# ui/dist/assets/AuthRefreshDocs-BapWJLRK.js
# ui/dist/assets/AuthWithOAuth2Docs-Ck_pnbL8.js
# ui/dist/assets/AuthWithOtpDocs-D8uWq_C5.js
# ui/dist/assets/AuthWithPasswordDocs-BQyMhAeO.js
# ui/dist/assets/BatchApiDocs-rvUuWLZE.js
# ui/dist/assets/CodeEditor-DrMyw8z_.js
# ui/dist/assets/CreateApiDocs-XWzcGuMB.js
# ui/dist/assets/DeleteApiDocs-CScE0aw3.js
# ui/dist/assets/EmailChangeDocs-CxOtrB4s.js
# ui/dist/assets/FieldsQueryParam-BzNUQIb5.js
# ui/dist/assets/FilterAutocompleteInput-Dm2G2coC.js
# ui/dist/assets/Leaflet-DyumpnOc.js
# ui/dist/assets/ListApiDocs-CdOzMZnr.js
# ui/dist/assets/PageInstaller-vIXdffAJ.js
# ui/dist/assets/PageOAuth2RedirectFailure-ClpyaW_B.js
# ui/dist/assets/PageOAuth2RedirectSuccess-BLZml1eK.js
# ui/dist/assets/PageRecordConfirmEmailChange-Cm3O2YD1.js
# ui/dist/assets/PageRecordConfirmPasswordReset-D0XfuL45.js
# ui/dist/assets/PageRecordConfirmVerification-CYyNYH_v.js
# ui/dist/assets/PageSuperuserConfirmPasswordReset-BvlQ0_9t.js
# ui/dist/assets/PageSuperuserRequestPasswordReset-gUPMclJZ.js
# ui/dist/assets/PasswordResetDocs-DMF1vqE0.js
# ui/dist/assets/RealtimeApiDocs-CNVij_C2.js
# ui/dist/assets/UpdateApiDocs-CwQ3ZhFQ.js
# ui/dist/assets/VerificationDocs-DUeWWjrS.js
# ui/dist/assets/ViewApiDocs-gocWxbTE.js
# ui/dist/assets/index-CWGqJiyp.js
# ui/dist/index.html
2026-03-01 19:27:21 -07:00
Gani Georgiev
9feb83cdad
applied lint typo fixes
2026-03-02 22:31:27 +02:00
Gani Georgiev
c475d3dd52
added todo for the extra rule constraint
2026-03-02 22:14:49 +02:00
zeekay
85387a93ab
feat(base): add PostgreSQL dialect and DBConnect
...
SQLDialect interface abstracts SQLite vs PostgreSQL SQL differences:
- JSON ops (json_extract vs ->>, json_each vs jsonb_array_elements)
- Date formatting (strftime vs to_char)
- Schema introspection (PRAGMA vs information_schema)
- ID generation (randomblob vs gen_random_bytes)
Adds PostgresDBConnect via pgx driver and DataDSN/AuxDSN config fields
for connecting Base to Neon serverless PostgreSQL instead of SQLite.
2026-03-01 18:37:50 -08:00
Gani Georgiev
765b02e6e8
wrap extra client-side ListRule filter with existence check and replaced the map with a slice to minimize test flakiness
2026-03-01 00:09:05 +02:00
zeekay
6759ac456c
Rebrand PocketBase imports to Hanzo Base across all Go files
...
Replace github.com/pocketbase/pocketbase with github.com/hanzoai/base
in 106 Go source files. Keep pocketbase/dbx and pocketbase/tygoja as-is
(upstream dependencies). Add compiled binary to .gitignore. Include
realtime DX design document inspired by Convex patterns.
2026-02-27 09:43:39 -08:00
zeekay
4b4d307330
Merge remote-tracking branch 'upstream/master'
...
# Conflicts:
# .github/SECURITY.md
# plugins/jsvm/internal/types/generated/types.d.ts
# ui/dist/assets/AuthMethodsDocs-Dpd1KLEi.js
# ui/dist/assets/AuthRefreshDocs-KmFqCz1h.js
# ui/dist/assets/AuthWithOAuth2Docs-CyJfh606.js
# ui/dist/assets/AuthWithOtpDocs-CuAOVtzX.js
# ui/dist/assets/AuthWithPasswordDocs-CmHb4Jjn.js
# ui/dist/assets/BatchApiDocs-LUXI6B6N.js
# ui/dist/assets/DeleteApiDocs-KmnbmZ-6.js
# ui/dist/assets/EmailChangeDocs-DhDDRSkd.js
# ui/dist/assets/FieldsQueryParam-C7N80dkz.js
# ui/dist/assets/ListApiDocs-BZTCC2fq.js
# ui/dist/assets/PageInstaller-Cdywf0VY.js
# ui/dist/assets/PageOAuth2RedirectFailure-9trAN4R5.js
# ui/dist/assets/PageOAuth2RedirectSuccess-BKErE1i9.js
# ui/dist/assets/PageRecordConfirmEmailChange-B83GxdXn.js
# ui/dist/assets/PageRecordConfirmPasswordReset-72PfbDaZ.js
# ui/dist/assets/PageRecordConfirmVerification-Cudgspq-.js
# ui/dist/assets/PageSuperuserConfirmPasswordReset-BvmdsmYF.js
# ui/dist/assets/PageSuperuserRequestPasswordReset-B8e2B4ZR.js
# ui/dist/assets/PasswordResetDocs-Do427Hpy.js
# ui/dist/assets/RealtimeApiDocs-DydjyGiu.js
# ui/dist/assets/VerificationDocs-CTnb2Ar3.js
# ui/dist/assets/ViewApiDocs-D9o91Lhw.js
2026-02-27 08:57:15 -08:00
zeekay
4b229fae5b
Merge remote-tracking branch 'upstream/master'
...
# Conflicts:
# core/record_field_resolver_multi_match.go
# ui/dist/assets/AuthMethodsDocs-ChShXLwE.js
# ui/dist/assets/AuthMethodsDocs-Cqvl0T_l.js
# ui/dist/assets/AuthMethodsDocs-DIqhS7qY.js
# ui/dist/assets/AuthRefreshDocs-CHakkNnn.js
# ui/dist/assets/AuthRefreshDocs-DLb1qree.js
# ui/dist/assets/AuthRefreshDocs-DXgrlMdk.js
# ui/dist/assets/AuthWithOAuth2Docs-Bl8VRxNv.js
# ui/dist/assets/AuthWithOAuth2Docs-DVBOel22.js
# ui/dist/assets/AuthWithOAuth2Docs-I213UiJ7.js
# ui/dist/assets/AuthWithOtpDocs-B9tL6gIN.js
# ui/dist/assets/AuthWithOtpDocs-C2PPm9-Z.js
# ui/dist/assets/AuthWithOtpDocs-qEMoMG3D.js
# ui/dist/assets/AuthWithPasswordDocs-B8JWDbPL.js
# ui/dist/assets/AuthWithPasswordDocs-BTHeYJwE.js
# ui/dist/assets/AuthWithPasswordDocs-D9rqgLpO.js
# ui/dist/assets/BatchApiDocs-BV4PYYXn.js
# ui/dist/assets/BatchApiDocs-DXa997am.js
# ui/dist/assets/BatchApiDocs-Di2Qe2dV.js
# ui/dist/assets/DeleteApiDocs-C3IINRwz.js
# ui/dist/assets/DeleteApiDocs-LfmVp4Uf.js
# ui/dist/assets/DeleteApiDocs-SU4XdGhJ.js
# ui/dist/assets/EmailChangeDocs-COx1USU5.js
# ui/dist/assets/EmailChangeDocs-D-qNHT_P.js
# ui/dist/assets/EmailChangeDocs-DpfXIE_V.js
# ui/dist/assets/FieldsQueryParam-BYe9ZK-G.js
# ui/dist/assets/FieldsQueryParam-L8vpHeF4.js
# ui/dist/assets/FieldsQueryParam-z0dGQ6uY.js
# ui/dist/assets/ListApiDocs-BCTT-AOz.js
# ui/dist/assets/ListApiDocs-C0_GwI7k.js
# ui/dist/assets/ListApiDocs-T9_aO-pW.js
# ui/dist/assets/PageInstaller-B22bivaN.js
# ui/dist/assets/PageInstaller-C0BBhyBx.js
# ui/dist/assets/PageInstaller-IYSwJhZW.js
# ui/dist/assets/PageOAuth2RedirectFailure-BjbpqlFj.js
# ui/dist/assets/PageOAuth2RedirectFailure-COyNF79R.js
# ui/dist/assets/PageOAuth2RedirectFailure-DPmGG9zv.js
# ui/dist/assets/PageOAuth2RedirectSuccess-6cMXLFAX.js
# ui/dist/assets/PageOAuth2RedirectSuccess-CdkCarGH.js
# ui/dist/assets/PageOAuth2RedirectSuccess-DSEIHeQL.js
# ui/dist/assets/PageRecordConfirmEmailChange-BYW-6ASg.js
# ui/dist/assets/PageRecordConfirmEmailChange-Bm1CIYvq.js
# ui/dist/assets/PageRecordConfirmEmailChange-BpaqOT4u.js
# ui/dist/assets/PageRecordConfirmPasswordReset--wx_u2lI.js
# ui/dist/assets/PageRecordConfirmPasswordReset-CoeY2Z_C.js
# ui/dist/assets/PageRecordConfirmPasswordReset-Ptya5bfe.js
# ui/dist/assets/PageRecordConfirmVerification-6xjF3T0O.js
# ui/dist/assets/PageRecordConfirmVerification-C1UTIIJh.js
# ui/dist/assets/PageRecordConfirmVerification-C4LixXvA.js
# ui/dist/assets/PageSuperuserConfirmPasswordReset-19z2IFg4.js
# ui/dist/assets/PageSuperuserConfirmPasswordReset-DwNi0ugQ.js
# ui/dist/assets/PageSuperuserConfirmPasswordReset-SMnDTRNi.js
# ui/dist/assets/PageSuperuserRequestPasswordReset-BpDW217f.js
# ui/dist/assets/PageSuperuserRequestPasswordReset-DK63qE6z.js
# ui/dist/assets/PageSuperuserRequestPasswordReset-bG02qLIM.js
# ui/dist/assets/PasswordResetDocs-CE67mLC0.js
# ui/dist/assets/PasswordResetDocs-CHAK0vma.js
# ui/dist/assets/PasswordResetDocs-Dap-N4rx.js
# ui/dist/assets/RealtimeApiDocs-BooTSQCb.js
# ui/dist/assets/RealtimeApiDocs-CoHmYVEx.js
# ui/dist/assets/RealtimeApiDocs-D7ds3fHt.js
# ui/dist/assets/VerificationDocs-B42AIoCQ.js
# ui/dist/assets/VerificationDocs-BS7b11zH.js
# ui/dist/assets/VerificationDocs-ZhkdFVIl.js
# ui/dist/assets/ViewApiDocs-BXmRLHZ1.js
# ui/dist/assets/ViewApiDocs-DM5JJQjh.js
# ui/dist/assets/ViewApiDocs-DRpxcuJR.js
# ui/public/fonts/source-sans-pro/source-sans-pro-v18-latin_cyrillic-700.woff2
# ui/public/fonts/ubuntu-mono/ubuntu-mono-v17-cyrillic_latin-700.woff2
2026-02-22 01:17:16 -08:00
Gani Georgiev
1c2c92429e
[ #7538 ] set OnlyInt:true when a view column expression is loosely known to return int-only values
2026-02-22 11:06:08 +02:00
zeekay
86273e0e2c
feat: rebrand to Hanzo Base with GeoPoint field support and token management
2026-02-13 22:12:10 -08:00
Gani Georgiev
00d399e33f
bumped app version
2026-02-13 17:21:34 +02:00
Gani Georgiev
961f1341a7
renamed arguments to make it more clear that they are dangeous
2026-02-13 16:40:29 +02:00
Gani Georgiev
7140e64f4d
added extra collection field exist check to minimize misuse and have a more clear error message
2026-01-27 16:46:04 +02:00
Gani Georgiev
047efb30cd
revert GROUP BY optimization
2026-01-18 18:38:40 +02:00
Gani Georgiev
1b560439fe
fixed comment typos
2026-01-17 10:58:12 +02:00
Gani Georgiev
51aa5868a0
replaced NoCoalesce with NullFallback and updated tests
2026-01-15 18:06:15 +02:00
Gani Georgiev
d48823e527
added strftime filter function
2026-01-15 14:27:53 +02:00
Gani Georgiev
b416e5c7cc
added more UpdateQuery tests
2026-01-13 22:15:50 +02:00
Gani Georgiev
babd16d998
use group by instead of distinct when possible
2026-01-13 18:47:32 +02:00
Gani Georgiev
5246440639
[ #7444 ] remove unnecessery subquery when resolving single back-relation fields
2026-01-13 14:54:35 +02:00
Gani Georgiev
12254ce0f7
added dumy request info to directly return an error on invalid API rule
2025-11-22 10:58:32 +02:00
Gani Georgiev
9b4060cad0
added :changed request body modifier
2025-11-17 13:58:43 +02:00
Gani Georgiev
cf6a73d956
[ #7314 ] added ALERT_INFO placeholder to the auth alert mail template
2025-11-10 17:56:36 +02:00
Gani Georgiev
a0d10d89bf
added pk test for * character
2025-11-10 07:17:01 +02:00
Gani Georgiev
7280265706
[ #7312 ] added extra id validations
2025-11-09 15:24:24 +02:00
Gani Georgiev and Felix
b7e686c889
[ #7305 ] fixed deadlock when manually triggering the OnTerminate hook
...
Co-authored-by: Felix <[email protected]
2025-11-07 17:03:15 +02:00
Gani Georgiev
b2aa6ec4fb
flatten relation joins
2025-11-03 14:21:01 +02:00
Gani Georgiev
5da4d91488
set allowHiddenFields to prevent infinite recursion
2025-11-01 14:54:22 +02:00
Gani Georgiev
60ce7d0ced
add extra subquery check for client-side relation filtering
2025-10-31 22:22:28 +02:00
Gani Georgiev
5ac66022fe
disallow client-side filtering and sorting of relations where the collection of the last targeted field has superusers only List/Search API rule
2025-10-23 17:22:47 +03:00
Gani Georgiev
de8f1afebc
[ #7268 ] added FileDownloadRequestEvent.ThumbError field
2025-10-23 11:48:59 +03:00
Gani Georgiev and Loic B.
21e881eb35
[ #7208 ] exlude lost+found from the backups
...
Co-authored-by: Loic B. <[email protected]
2025-09-28 08:28:28 +03:00
Gani Georgiev
2a6e598286
updated scaffold apis to use random id during the collections initialization and made index columns check on the UI case insensitive
2025-08-26 22:02:00 +03:00
Gani Georgiev
dae6c7a47d
updated random generator tests
2025-08-22 21:20:30 +03:00
Gani Georgiev
2eeae22a43
renamed to execve to make it more clear
2025-08-22 20:47:58 +03:00
Jesse Sivonen and GitHub
eb3ae57c44
[ #7116 ] exclude syscall.Exec for WASM
2025-08-22 20:44:13 +03:00
Gani Georgiev
8ff1260f3d
[ #7098 ] fixed RateLimitRule.Audience code comment
2025-08-15 19:29:42 +03:00
Gani Georgiev
8159f6578f
updated go deps
2025-07-19 11:01:35 +03:00
Gani Georgiev
95f0f8b220
use the nonconcurrent pool for running PRAGMA optimize
2025-07-19 10:02:44 +03:00
Gani Georgiev
fdf33f1135
[ #3233 ] added optional ServeEvent.Listener field
2025-06-29 15:41:55 +03:00
Gani Georgiev
0176273a1d
[ #6972 ] wrapped backup restore in a transaction as an extra precaution
2025-06-26 22:21:04 +03:00
zeekay
Gani Georgiev