mirror of
https://github.com/hanzoai/base.git
synced 2026-10-21 03:41:50 +00:00
zeekay
e7df8c856e
Rename / namespace: - Finish github.com/pocketbase/* → github.com/hanzoai/base (+ /dbx) sweep across all Go sources; restore the renamed root launcher (Base, base.go). - Drop the upstream-only surfaces ours doesn't ship (admin ui/, the password/OTP/oauth2/impersonate auth files, extensions) re-added by the upstream merge. - Decomplect the on-disk layout to one base_/ namespace: data/, migrations/, hooks/, types.d.ts are siblings under base_/ (default data dir base_/data). Drop the hz_ prefix everywhere; collapse migratecmd's identical JS/Go branches to one path. - Remove the accidentally-committed hz_data/ dev dir (db + iam.key) and gitignore the runtime namespace dirs. Deps / build: - kmsclient now imported from the light github.com/hanzoai/kms/sdk/go module (the root kms module zip exceeds Go's download limit); cloud/pkg/base Mount removed (lives in the fused daemon). - replicate v0.4.0 → v0.8.0; metric.Counter.Get() (no prometheus dto); network/metrics.go import fix; auth gitlab/github tidy. Tests / behavior: - Wire registerNotifyWatcherHooks; debounce notify files past the kqueue rescan window so cross-instance settings/collections reload fires. - migratecmd: exclude createdAt/updatedAt (not created/updated); regenerate Go+JS automigration goldens from canonical output. - Convert the two stale archive red-probes to assert the landed defenses (backlog cap bounds memory; forged-segment signature is rejected). IAM-native (Base = pure IAM client): - Rip the ~1k-line home-grown embedded IAM (iam_embedded*.go) and the iam-user CLI. Base no longer reinvents identity as _iam_users/_superusers rows. IAM_ENDPOINT (hanzo.id, or an in-process iam.Embed in the fused daemon) is required; Base validates IAM JWTs via JWKS only — superuser is the IAM admin claim, resolved to an ephemeral unpersisted record. - Extract the IDV reverse-proxy (/v1/idv/*) into idv_proxy.go — it was mis-colocated in the embedded onboarding file and is independent of IAM. - Bind the SQL console (/v1/sql) and test it through real IAM JWTs against a JWKS stub (no hardcoded record tokens, no persisted rows).
105 lines
2.8 KiB
Go
105 lines
2.8 KiB
Go
package apis
|
|
|
|
import (
|
|
"database/sql"
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/fatih/color"
|
|
"github.com/hanzoai/dbx"
|
|
"github.com/hanzoai/base/core"
|
|
"github.com/hanzoai/base/tools/osutils"
|
|
)
|
|
|
|
// DefaultInstallerFunc is the default Base installer function.
|
|
//
|
|
// It will attempt to open a link in the browser (with a short-lived auth
|
|
// token for the systemSuperuser) to the installer UI so that users can
|
|
// create their own custom superuser record.
|
|
//
|
|
// See https://github.com/hanzoai/base/discussions/5814.
|
|
func DefaultInstallerFunc(app core.App, systemSuperuser *core.Record, baseURL string) error {
|
|
token, err := systemSuperuser.NewStaticAuthToken(30 * time.Minute)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// launch url (ignore errors and always print a help text as fallback)
|
|
url := fmt.Sprintf("%s/_/#/baseinstal/%s", strings.TrimRight(baseURL, "/"), token)
|
|
_ = osutils.LaunchURL(url)
|
|
color.Magenta("\n(!) Launch the URL below in the browser if it hasn't been open already to create your first superuser account:")
|
|
color.New(color.Bold).Add(color.FgCyan).Println(url)
|
|
color.New(color.FgHiBlack, color.Italic).Printf("(you can also create your first superuser by running: %s superuser upsert EMAIL PASS)\n\n", executablePath())
|
|
|
|
return nil
|
|
}
|
|
|
|
func loadInstaller(
|
|
app core.App,
|
|
baseURL string,
|
|
installerFunc func(app core.App, systemSuperuser *core.Record, baseURL string) error,
|
|
) error {
|
|
// IAM is the only auth source — once the platform plugin marks the
|
|
// store as external-only, the local "first superuser" installer is
|
|
// moot. The superuser is whoever IAM issues an admin-claim token to;
|
|
// Base never seeds one locally.
|
|
if externalOnly, _ := app.Store().Get(StoreKeyExternalAuthOnly).(bool); externalOnly {
|
|
return nil
|
|
}
|
|
|
|
if installerFunc == nil || !needInstallerSuperuser(app) {
|
|
return nil
|
|
}
|
|
|
|
superuser, err := findOrCreateInstallerSuperuser(app)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
return installerFunc(app, superuser, baseURL)
|
|
}
|
|
|
|
func needInstallerSuperuser(app core.App) bool {
|
|
total, err := app.CountRecords(core.CollectionNameSuperusers, dbx.Not(dbx.HashExp{
|
|
"email": core.DefaultInstallerEmail,
|
|
}))
|
|
|
|
return err == nil && total == 0
|
|
}
|
|
|
|
func findOrCreateInstallerSuperuser(app core.App) (*core.Record, error) {
|
|
col, err := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
record, err := app.FindAuthRecordByEmail(col, core.DefaultInstallerEmail)
|
|
if err != nil {
|
|
if !errors.Is(err, sql.ErrNoRows) {
|
|
return nil, err
|
|
}
|
|
|
|
record = core.NewRecord(col)
|
|
record.SetEmail(core.DefaultInstallerEmail)
|
|
record.SetVerified(true)
|
|
|
|
err = app.Save(record)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
return record, nil
|
|
}
|
|
|
|
func executablePath() string {
|
|
if osutils.IsProbablyGoRun() {
|
|
return "go run ."
|
|
}
|
|
|
|
return os.Args[0]
|
|
}
|