Workspace-owned deploy infra so AI agents can create and destroy
Coolify resources without ever touching the root admin token.
vibn_workspaces
+ coolify_server_uuid, coolify_destination_uuid
+ coolify_environment_name (default "production")
+ coolify_private_key_uuid, gitea_bot_ssh_key_id
ensureWorkspaceProvisioned
+ generates an ed25519 keypair per workspace
+ pushes pubkey to the Gitea bot user (read/write scoped by team)
+ registers privkey in Coolify as a reusable deploy key
New endpoints under /api/workspaces/[slug]/
apps/ POST (private-deploy-key from Gitea repo)
apps/[uuid] PATCH, DELETE?confirm=<name>
apps/[uuid]/domains GET, PATCH (policy: *.{ws}.vibnai.com only)
databases/ GET, POST (8 types incl. postgres, clickhouse, dragonfly)
databases/[uuid] GET, PATCH, DELETE?confirm=<name>
auth/ GET, POST (Pocketbase, Authentik, Keycloak, Pocket-ID, Logto, Supertokens)
auth/[uuid] DELETE?confirm=<name>
MCP (/api/mcp) gains 15 new tools that mirror the REST surface and
enforce the same workspace tenancy + delete-confirm guard.
Safety: destructive ops require ?confirm=<exact-resource-name>; volumes
are kept by default (pass delete_volumes=true to drop).
Made-with: Cursor
93 lines
2.8 KiB
TypeScript
93 lines
2.8 KiB
TypeScript
/**
|
|
* GET /api/workspaces/[slug]/auth/[uuid] — provider details
|
|
* DELETE /api/workspaces/[slug]/auth/[uuid]?confirm=<name>
|
|
* Volumes KEPT by default (don't blow away user accounts).
|
|
*/
|
|
|
|
import { NextResponse } from 'next/server';
|
|
import { requireWorkspacePrincipal } from '@/lib/auth/workspace-auth';
|
|
import {
|
|
getServiceInProject,
|
|
deleteService,
|
|
projectUuidOf,
|
|
TenantError,
|
|
} from '@/lib/coolify';
|
|
|
|
export async function GET(
|
|
request: Request,
|
|
{ params }: { params: Promise<{ slug: string; uuid: string }> }
|
|
) {
|
|
const { slug, uuid } = await params;
|
|
const principal = await requireWorkspacePrincipal(request, { targetSlug: slug });
|
|
if (principal instanceof NextResponse) return principal;
|
|
|
|
const ws = principal.workspace;
|
|
if (!ws.coolify_project_uuid) {
|
|
return NextResponse.json({ error: 'Workspace has no Coolify project yet' }, { status: 503 });
|
|
}
|
|
|
|
try {
|
|
const svc = await getServiceInProject(uuid, ws.coolify_project_uuid);
|
|
return NextResponse.json({
|
|
uuid: svc.uuid,
|
|
name: svc.name,
|
|
status: svc.status ?? null,
|
|
projectUuid: projectUuidOf(svc),
|
|
});
|
|
} catch (err) {
|
|
if (err instanceof TenantError) return NextResponse.json({ error: err.message }, { status: 403 });
|
|
return NextResponse.json({ error: 'Provider not found' }, { status: 404 });
|
|
}
|
|
}
|
|
|
|
export async function DELETE(
|
|
request: Request,
|
|
{ params }: { params: Promise<{ slug: string; uuid: string }> }
|
|
) {
|
|
const { slug, uuid } = await params;
|
|
const principal = await requireWorkspacePrincipal(request, { targetSlug: slug });
|
|
if (principal instanceof NextResponse) return principal;
|
|
|
|
const ws = principal.workspace;
|
|
if (!ws.coolify_project_uuid) {
|
|
return NextResponse.json({ error: 'Workspace has no Coolify project yet' }, { status: 503 });
|
|
}
|
|
|
|
let svc;
|
|
try {
|
|
svc = await getServiceInProject(uuid, ws.coolify_project_uuid);
|
|
} catch (err) {
|
|
if (err instanceof TenantError) return NextResponse.json({ error: err.message }, { status: 403 });
|
|
return NextResponse.json({ error: 'Provider not found' }, { status: 404 });
|
|
}
|
|
|
|
const url = new URL(request.url);
|
|
const confirm = url.searchParams.get('confirm');
|
|
if (confirm !== svc.name) {
|
|
return NextResponse.json(
|
|
{ error: 'Confirmation required', hint: `Pass ?confirm=${svc.name}` },
|
|
{ status: 409 }
|
|
);
|
|
}
|
|
|
|
const deleteVolumes = url.searchParams.get('delete_volumes') === 'true';
|
|
|
|
try {
|
|
await deleteService(uuid, {
|
|
deleteConfigurations: true,
|
|
deleteVolumes,
|
|
deleteConnectedNetworks: true,
|
|
dockerCleanup: true,
|
|
});
|
|
return NextResponse.json({
|
|
ok: true,
|
|
deleted: { uuid, name: svc.name, volumesKept: !deleteVolumes },
|
|
});
|
|
} catch (err) {
|
|
return NextResponse.json(
|
|
{ error: 'Coolify delete failed', details: err instanceof Error ? err.message : String(err) },
|
|
{ status: 502 }
|
|
);
|
|
}
|
|
}
|