Phase 4: AI-driven app/database/auth lifecycle
Workspace-owned deploy infra so AI agents can create and destroy
Coolify resources without ever touching the root admin token.
vibn_workspaces
+ coolify_server_uuid, coolify_destination_uuid
+ coolify_environment_name (default "production")
+ coolify_private_key_uuid, gitea_bot_ssh_key_id
ensureWorkspaceProvisioned
+ generates an ed25519 keypair per workspace
+ pushes pubkey to the Gitea bot user (read/write scoped by team)
+ registers privkey in Coolify as a reusable deploy key
New endpoints under /api/workspaces/[slug]/
apps/ POST (private-deploy-key from Gitea repo)
apps/[uuid] PATCH, DELETE?confirm=<name>
apps/[uuid]/domains GET, PATCH (policy: *.{ws}.vibnai.com only)
databases/ GET, POST (8 types incl. postgres, clickhouse, dragonfly)
databases/[uuid] GET, PATCH, DELETE?confirm=<name>
auth/ GET, POST (Pocketbase, Authentik, Keycloak, Pocket-ID, Logto, Supertokens)
auth/[uuid] DELETE?confirm=<name>
MCP (/api/mcp) gains 15 new tools that mirror the REST surface and
enforce the same workspace tenancy + delete-confirm guard.
Safety: destructive ops require ?confirm=<exact-resource-name>; volumes
are kept by default (pass delete_volumes=true to drop).
Made-with: Cursor
This commit is contained in:
158
app/api/workspaces/[slug]/databases/[uuid]/route.ts
Normal file
158
app/api/workspaces/[slug]/databases/[uuid]/route.ts
Normal file
@@ -0,0 +1,158 @@
|
||||
/**
|
||||
* GET /api/workspaces/[slug]/databases/[uuid] — database details (incl. URLs)
|
||||
* PATCH /api/workspaces/[slug]/databases/[uuid] — update fields
|
||||
* DELETE /api/workspaces/[slug]/databases/[uuid]?confirm=<name>
|
||||
* Volumes KEPT by default (data). Pass &delete_volumes=true to drop.
|
||||
*/
|
||||
|
||||
import { NextResponse } from 'next/server';
|
||||
import { requireWorkspacePrincipal } from '@/lib/auth/workspace-auth';
|
||||
import {
|
||||
getDatabaseInProject,
|
||||
updateDatabase,
|
||||
deleteDatabase,
|
||||
projectUuidOf,
|
||||
TenantError,
|
||||
} from '@/lib/coolify';
|
||||
|
||||
export async function GET(
|
||||
request: Request,
|
||||
{ params }: { params: Promise<{ slug: string; uuid: string }> }
|
||||
) {
|
||||
const { slug, uuid } = await params;
|
||||
const principal = await requireWorkspacePrincipal(request, { targetSlug: slug });
|
||||
if (principal instanceof NextResponse) return principal;
|
||||
|
||||
const ws = principal.workspace;
|
||||
if (!ws.coolify_project_uuid) {
|
||||
return NextResponse.json({ error: 'Workspace has no Coolify project yet' }, { status: 503 });
|
||||
}
|
||||
|
||||
try {
|
||||
const db = await getDatabaseInProject(uuid, ws.coolify_project_uuid);
|
||||
return NextResponse.json({
|
||||
uuid: db.uuid,
|
||||
name: db.name,
|
||||
type: db.type ?? null,
|
||||
status: db.status,
|
||||
isPublic: db.is_public ?? false,
|
||||
publicPort: db.public_port ?? null,
|
||||
internalUrl: db.internal_db_url ?? null,
|
||||
externalUrl: db.external_db_url ?? null,
|
||||
projectUuid: projectUuidOf(db),
|
||||
});
|
||||
} catch (err) {
|
||||
if (err instanceof TenantError) return NextResponse.json({ error: err.message }, { status: 403 });
|
||||
return NextResponse.json({ error: 'Database not found' }, { status: 404 });
|
||||
}
|
||||
}
|
||||
|
||||
export async function PATCH(
|
||||
request: Request,
|
||||
{ params }: { params: Promise<{ slug: string; uuid: string }> }
|
||||
) {
|
||||
const { slug, uuid } = await params;
|
||||
const principal = await requireWorkspacePrincipal(request, { targetSlug: slug });
|
||||
if (principal instanceof NextResponse) return principal;
|
||||
|
||||
const ws = principal.workspace;
|
||||
if (!ws.coolify_project_uuid) {
|
||||
return NextResponse.json({ error: 'Workspace has no Coolify project yet' }, { status: 503 });
|
||||
}
|
||||
|
||||
try {
|
||||
await getDatabaseInProject(uuid, ws.coolify_project_uuid);
|
||||
} catch (err) {
|
||||
if (err instanceof TenantError) return NextResponse.json({ error: err.message }, { status: 403 });
|
||||
return NextResponse.json({ error: 'Database not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
let body: Record<string, unknown> = {};
|
||||
try {
|
||||
body = await request.json();
|
||||
} catch {
|
||||
return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 });
|
||||
}
|
||||
|
||||
const allowed = new Set([
|
||||
'name',
|
||||
'description',
|
||||
'is_public',
|
||||
'public_port',
|
||||
'image',
|
||||
'limits_memory',
|
||||
'limits_cpus',
|
||||
]);
|
||||
const patch: Record<string, unknown> = {};
|
||||
for (const [k, v] of Object.entries(body)) {
|
||||
if (allowed.has(k) && v !== undefined) patch[k] = v;
|
||||
}
|
||||
if (Object.keys(patch).length === 0) {
|
||||
return NextResponse.json({ error: 'No updatable fields in body' }, { status: 400 });
|
||||
}
|
||||
|
||||
try {
|
||||
await updateDatabase(uuid, patch);
|
||||
return NextResponse.json({ ok: true, uuid });
|
||||
} catch (err) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Coolify update failed', details: err instanceof Error ? err.message : String(err) },
|
||||
{ status: 502 }
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
export async function DELETE(
|
||||
request: Request,
|
||||
{ params }: { params: Promise<{ slug: string; uuid: string }> }
|
||||
) {
|
||||
const { slug, uuid } = await params;
|
||||
const principal = await requireWorkspacePrincipal(request, { targetSlug: slug });
|
||||
if (principal instanceof NextResponse) return principal;
|
||||
|
||||
const ws = principal.workspace;
|
||||
if (!ws.coolify_project_uuid) {
|
||||
return NextResponse.json({ error: 'Workspace has no Coolify project yet' }, { status: 503 });
|
||||
}
|
||||
|
||||
let db;
|
||||
try {
|
||||
db = await getDatabaseInProject(uuid, ws.coolify_project_uuid);
|
||||
} catch (err) {
|
||||
if (err instanceof TenantError) return NextResponse.json({ error: err.message }, { status: 403 });
|
||||
return NextResponse.json({ error: 'Database not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
const url = new URL(request.url);
|
||||
const confirm = url.searchParams.get('confirm');
|
||||
if (confirm !== db.name) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Confirmation required', hint: `Pass ?confirm=${db.name}` },
|
||||
{ status: 409 }
|
||||
);
|
||||
}
|
||||
|
||||
// Default: preserve volumes (it's a database — user data lives there).
|
||||
const deleteVolumes = url.searchParams.get('delete_volumes') === 'true';
|
||||
const deleteConfigurations = url.searchParams.get('delete_configurations') !== 'false';
|
||||
const deleteConnectedNetworks = url.searchParams.get('delete_connected_networks') !== 'false';
|
||||
const dockerCleanup = url.searchParams.get('docker_cleanup') !== 'false';
|
||||
|
||||
try {
|
||||
await deleteDatabase(uuid, {
|
||||
deleteConfigurations,
|
||||
deleteVolumes,
|
||||
deleteConnectedNetworks,
|
||||
dockerCleanup,
|
||||
});
|
||||
return NextResponse.json({
|
||||
ok: true,
|
||||
deleted: { uuid, name: db.name, volumesKept: !deleteVolumes },
|
||||
});
|
||||
} catch (err) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Coolify delete failed', details: err instanceof Error ? err.message : String(err) },
|
||||
{ status: 502 }
|
||||
);
|
||||
}
|
||||
}
|
||||
161
app/api/workspaces/[slug]/databases/route.ts
Normal file
161
app/api/workspaces/[slug]/databases/route.ts
Normal file
@@ -0,0 +1,161 @@
|
||||
/**
|
||||
* GET /api/workspaces/[slug]/databases — list databases in this workspace
|
||||
* POST /api/workspaces/[slug]/databases — provision a new database
|
||||
*
|
||||
* Supported `type` values (all that Coolify v4 can deploy):
|
||||
* postgresql | mysql | mariadb | mongodb | redis | keydb | dragonfly | clickhouse
|
||||
*
|
||||
* POST body:
|
||||
* {
|
||||
* type: "postgresql",
|
||||
* name?: "my-db",
|
||||
* isPublic?: true, // expose a host port for remote clients
|
||||
* publicPort?: 5433,
|
||||
* image?: "postgres:16",
|
||||
* credentials?: { ... } // type-specific (e.g. postgres_user)
|
||||
* limits?: { memory?: "1G", cpus?: "1" },
|
||||
* }
|
||||
*
|
||||
* Tenancy: every returned record is filtered to the workspace's own
|
||||
* Coolify project UUID.
|
||||
*/
|
||||
|
||||
import { NextResponse } from 'next/server';
|
||||
import { requireWorkspacePrincipal } from '@/lib/auth/workspace-auth';
|
||||
import {
|
||||
listDatabasesInProject,
|
||||
createDatabase,
|
||||
getDatabase,
|
||||
projectUuidOf,
|
||||
type CoolifyDatabaseType,
|
||||
} from '@/lib/coolify';
|
||||
import { slugify } from '@/lib/naming';
|
||||
|
||||
const SUPPORTED_TYPES: readonly CoolifyDatabaseType[] = [
|
||||
'postgresql',
|
||||
'mysql',
|
||||
'mariadb',
|
||||
'mongodb',
|
||||
'redis',
|
||||
'keydb',
|
||||
'dragonfly',
|
||||
'clickhouse',
|
||||
];
|
||||
|
||||
export async function GET(
|
||||
request: Request,
|
||||
{ params }: { params: Promise<{ slug: string }> }
|
||||
) {
|
||||
const { slug } = await params;
|
||||
const principal = await requireWorkspacePrincipal(request, { targetSlug: slug });
|
||||
if (principal instanceof NextResponse) return principal;
|
||||
|
||||
const ws = principal.workspace;
|
||||
if (!ws.coolify_project_uuid) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Workspace has no Coolify project yet', databases: [] },
|
||||
{ status: 503 }
|
||||
);
|
||||
}
|
||||
|
||||
try {
|
||||
const dbs = await listDatabasesInProject(ws.coolify_project_uuid);
|
||||
return NextResponse.json({
|
||||
workspace: { slug: ws.slug, coolifyProjectUuid: ws.coolify_project_uuid },
|
||||
databases: dbs.map(d => ({
|
||||
uuid: d.uuid,
|
||||
name: d.name,
|
||||
type: d.type ?? null,
|
||||
status: d.status,
|
||||
isPublic: d.is_public ?? false,
|
||||
publicPort: d.public_port ?? null,
|
||||
projectUuid: projectUuidOf(d),
|
||||
})),
|
||||
});
|
||||
} catch (err) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Coolify request failed', details: err instanceof Error ? err.message : String(err) },
|
||||
{ status: 502 }
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
export async function POST(
|
||||
request: Request,
|
||||
{ params }: { params: Promise<{ slug: string }> }
|
||||
) {
|
||||
const { slug } = await params;
|
||||
const principal = await requireWorkspacePrincipal(request, { targetSlug: slug });
|
||||
if (principal instanceof NextResponse) return principal;
|
||||
|
||||
const ws = principal.workspace;
|
||||
if (!ws.coolify_project_uuid) {
|
||||
return NextResponse.json({ error: 'Workspace has no Coolify project yet' }, { status: 503 });
|
||||
}
|
||||
|
||||
type Body = {
|
||||
type?: string;
|
||||
name?: string;
|
||||
description?: string;
|
||||
isPublic?: boolean;
|
||||
publicPort?: number;
|
||||
image?: string;
|
||||
credentials?: Record<string, unknown>;
|
||||
limits?: { memory?: string; cpus?: string };
|
||||
instantDeploy?: boolean;
|
||||
};
|
||||
let body: Body = {};
|
||||
try {
|
||||
body = (await request.json()) as Body;
|
||||
} catch {
|
||||
return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 });
|
||||
}
|
||||
|
||||
const type = body.type as CoolifyDatabaseType | undefined;
|
||||
if (!type || !SUPPORTED_TYPES.includes(type)) {
|
||||
return NextResponse.json(
|
||||
{ error: `\`type\` must be one of: ${SUPPORTED_TYPES.join(', ')}` },
|
||||
{ status: 400 }
|
||||
);
|
||||
}
|
||||
|
||||
const name = slugify(body.name ?? `${type}-${Date.now().toString(36)}`);
|
||||
|
||||
try {
|
||||
const created = await createDatabase({
|
||||
type,
|
||||
name,
|
||||
description: body.description,
|
||||
projectUuid: ws.coolify_project_uuid,
|
||||
serverUuid: ws.coolify_server_uuid ?? undefined,
|
||||
environmentName: ws.coolify_environment_name,
|
||||
destinationUuid: ws.coolify_destination_uuid ?? undefined,
|
||||
isPublic: body.isPublic,
|
||||
publicPort: body.publicPort,
|
||||
image: body.image,
|
||||
credentials: body.credentials,
|
||||
limits: body.limits,
|
||||
instantDeploy: body.instantDeploy ?? true,
|
||||
});
|
||||
|
||||
const db = await getDatabase(created.uuid);
|
||||
return NextResponse.json(
|
||||
{
|
||||
uuid: db.uuid,
|
||||
name: db.name,
|
||||
type: db.type ?? type,
|
||||
status: db.status,
|
||||
isPublic: db.is_public ?? false,
|
||||
publicPort: db.public_port ?? null,
|
||||
internalUrl: db.internal_db_url ?? null,
|
||||
externalUrl: db.external_db_url ?? null,
|
||||
},
|
||||
{ status: 201 }
|
||||
);
|
||||
} catch (err) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Coolify create failed', details: err instanceof Error ? err.message : String(err) },
|
||||
{ status: 502 }
|
||||
);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user