fix: fix bugs

apps/api/src/api/auth-middleware.ts

@@ -0,0 +1,51 @@
+import type { Elysia } from "elysia";
+import { fail } from "./response";
+
+const BYPASS_PATHS = new Set([
+	"/api/auth/login",
+	"/api/auth/logout",
+	"/api/auth/refresh",
+	"/api/auth/me",
+	"/api/health",
+	"/api/github/callback",
+	"/api/github/webhook",
+	"/api/agents/register",
+	"/api/agents/p2p-sync",
+]);
+
+export const authMiddleware = (app: Elysia) =>
+	app.onBeforeHandle(async ({ request, set, path }) => {
+		if (BYPASS_PATHS.has(path)) return;
+
+		const cookie = request.headers.get("cookie") || "";
+		const match = cookie.match(/(?:^|;\s*)dequel_session=([^;]+)/);
+		if (match) {
+			const { verifyAccessToken } = await import("../utils/auth");
+			const payload = await verifyAccessToken(match[1]);
+			if (payload) return;
+		}
+
+		const authHeader = request.headers.get("authorization");
+		if (authHeader?.startsWith("Bearer ")) {
+			const token = authHeader.slice(7);
+			if (token) {
+				const { validateApiKey } = await import("../db/repo");
+				const { canPerformMethod, parsePermissions, requiredPermissionForMethod } = await import(
+					"../utils/permissions"
+				);
+				const key = await validateApiKey(token);
+				if (!key) {
+					set.status = 401;
+					return fail("Invalid API key");
+				}
+				if (!canPerformMethod(parsePermissions(key.permissions), request.method)) {
+					set.status = 403;
+					return fail(`API key is missing the ${requiredPermissionForMethod(request.method)} scope`);
+				}
+				return;
+			}
+		}
+
+		set.status = 401;
+		return fail("Authentication required");
+	});

apps/api/src/api/databases/index.ts

@@ -6,14 +6,18 @@ import {
 	deleteDatabase,
 	getDatabaseById,
 	getProjectById,
+	getServerById,
 	listAllDatabases,
 	listDatabases,
 	updateDatabaseSettings,
 	updateDatabaseStatus,
 } from "../../db/repo";
+import { loadCaddyCert } from "../../tunnels/cert-store";
 import type { Database } from "../../types";
 import { config } from "../../utils/config";
+import { removeDbGatewayRoute, syncDbGatewayRoute } from "../../utils/db-caddy-route";
 import { resolveServerIp } from "../../utils/dns";
+import { probeTcp } from "../../utils/tcp-probe";
 import { created, fail, ok } from "../response";
 import { executeDatabaseQuery, getDatabaseTables } from "./query";
 
@@ -60,6 +64,14 @@ const isNonLoopbackIp = (value: string): boolean => {
 	return !value.startsWith("127.");
 };
 
+const resolveDbExternalHost = async (serverId: string | null): Promise<string> => {
+	if (serverId) {
+		const server = await getServerById(serverId);
+		if (server && isNonLoopbackIp(server.host)) return server.host;
+	}
+	return resolveServerIp();
+};
+
 const createManagedDatabase = async (body: any, projectId: string | null, set: any) => {
 	if (projectId && !(await getProjectById(projectId))) {
 		set.status = 404;
@@ -76,6 +88,7 @@ const createManagedDatabase = async (body: any, projectId: string | null, set: a
 		return fail("A database with this name already exists");
 	}
 	const dbRecord = await createDbRecord({ ...validation.input, projectId });
+	void syncDbGatewayRoute(dbRecord);
 	const { provisionDatabase } = await import("../../databases/manager");
 	provisionDatabase(dbRecord).catch((err: Error) => console.error("DB provision failed", err));
 	return created(sanitizeDatabase(dbRecord));
@@ -118,27 +131,50 @@ export const databasesRoutes = new Elysia()
 				? `${dbRecord.internalHost}.${baseDomain}`
 				: null;
 		if (gatewayHost) {
+			const reachable = await probeTcp(gatewayHost, 443);
+			const hasRealCert = config.caddyDataDir
+				? (await loadCaddyCert(config.caddyDataDir, gatewayHost)) !== null
+				: false;
 			return ok({
 				username: dbRecord.username,
 				password: dbRecord.password,
 				internalConnectionString: dbRecord.connectionString,
-				externalConnectionString: buildGatewayConnectionString(dbRecord, gatewayHost),
+				externalConnectionString: buildGatewayConnectionString(dbRecord, gatewayHost, hasRealCert),
 				externalHost: gatewayHost,
 				externalPort: 443,
+				externalReachable: reachable,
+				warning: reachable
+					? null
+					: `Gateway endpoint ${gatewayHost}:443 is not reachable from the network — check the gateway service and DNS.`,
 			});
 		}
-		const externalHost = dbRecord.publicAccess && dbRecord.externalPort ? await resolveServerIp() : null;
+		const externalHost =
+			dbRecord.publicAccess && dbRecord.externalPort ? await resolveDbExternalHost(dbRecord.serverId ?? null) : null;
 		const usableHost = externalHost && isNonLoopbackIp(externalHost) ? externalHost : null;
-		const externalConnectionString = usableHost
-			? buildConnectionString(dbRecord, usableHost, dbRecord.externalPort!)
-			: null;
+		if (usableHost && dbRecord.externalPort) {
+			const reachable = await probeTcp(usableHost, dbRecord.externalPort);
+			return ok({
+				username: dbRecord.username,
+				password: dbRecord.password,
+				internalConnectionString: dbRecord.connectionString,
+				externalConnectionString: buildConnectionString(dbRecord, usableHost, dbRecord.externalPort),
+				externalHost: usableHost,
+				externalPort: dbRecord.externalPort,
+				externalReachable: reachable,
+				warning: reachable
+					? null
+					: `Public endpoint ${usableHost}:${dbRecord.externalPort} is not reachable — open the port in your cloud security group or firewall to allow external clients.`,
+			});
+		}
 		return ok({
 			username: dbRecord.username,
 			password: dbRecord.password,
 			internalConnectionString: dbRecord.connectionString,
-			externalConnectionString,
-			externalHost: usableHost,
-			externalPort: usableHost ? dbRecord.externalPort : null,
+			externalConnectionString: null,
+			externalHost: null,
+			externalPort: null,
+			externalReachable: null,
+			warning: null,
 		});
 	})
 	.post("/databases/:id/start", async ({ params: { id }, set }) => {
@@ -235,7 +271,12 @@ export const databasesRoutes = new Elysia()
 			backupSchedule: body?.backupSchedule,
 			backupRetention: body?.backupRetention,
 		});
-		return ok(sanitizeDatabase(updated!));
+		if (!updated) {
+			set.status = 404;
+			return fail("Database not found");
+		}
+		void syncDbGatewayRoute(updated);
+		return ok(sanitizeDatabase(updated));
 	})
 	.delete("/databases/:id", async ({ params: { id }, set }) => {
 		const dbRecord = await findDatabase(id, set);
@@ -259,6 +300,7 @@ export const databasesRoutes = new Elysia()
 				return fail("Database resources could not be deleted; cleanup will be retried automatically");
 			}
 			await deleteDatabase(id);
+			void removeDbGatewayRoute(current);
 			return ok(null, "Database deleted");
 		});
 	});
@@ -272,12 +314,13 @@ const buildConnectionString = (dbRecord: DatabaseRecord, host: string, port: num
 	return `${protocol}://${dbRecord.username}:${dbRecord.password}@${host}:${port}/${dbRecord.databaseName}`;
 };
 
-const buildGatewayConnectionString = (dbRecord: DatabaseRecord, host: string) => {
+const buildGatewayConnectionString = (dbRecord: DatabaseRecord, host: string, hasRealCert: boolean) => {
 	const auth = `${dbRecord.username}:${dbRecord.password}`;
 	const path = `/${dbRecord.databaseName}`;
 	if (dbRecord.type === "redis") return `rediss://:${dbRecord.password}@${host}:443`;
 	if (dbRecord.type === "mongodb") {
-		return `mongodb://${auth}@${host}:443${path}?authSource=admin&tls=true&tlsAllowInvalidCertificates=true`;
+		const tls = hasRealCert ? "tls=true" : "tls=true&tlsAllowInvalidCertificates=true";
+		return `mongodb://${auth}@${host}:443${path}?authSource=admin&${tls}`;
 	}
 	return `postgresql://${auth}@${host}:443${path}?sslmode=require`;
 };

apps/api/src/api/deployments/index.ts

@@ -16,6 +16,7 @@ import { executorFor } from "../../executors/dispatch";
 import { orchestrator } from "../../orchestrator";
 import { summarizeDeploymentError } from "../../orchestrator/deployment-errors";
 import { logBus } from "../../orchestrator/log-bus";
+import { readRuntimeLogs, runtimeLogFollowerArgs } from "../../orchestrator/runtime-logs";
 import { config } from "../../utils/config";
 import { terminateWithEscalation } from "../../utils/process-exec";
 import { isPrivateGitUrl } from "../../utils/validate";
@@ -142,9 +143,17 @@ export const deploymentsRoutes = new Elysia()
 			set.status = 400;
 			return fail("archive file is required for upload source");
 		}
+		const safeName = basename(file.name || "project.zip").replace(/[^a-zA-Z0-9._-]/g, "_");
+		if (![".zip", ".tar", ".tar.gz", ".tgz"].some((ext) => safeName.toLowerCase().endsWith(ext))) {
+			set.status = 400;
+			return fail("Unsupported archive format. Use .zip, .tar, .tar.gz, or .tgz");
+		}
+		if (file.size === 0) {
+			set.status = 400;
+			return fail("Archive file is empty");
+		}
 		const uploadsDir = join(config.workspaceRoot, "uploads");
 		await mkdir(uploadsDir, { recursive: true });
-		const safeName = basename(file.name || "project.zip").replace(/[^a-zA-Z0-9._-]/g, "_");
 		const uploadPath = join(uploadsDir, `${Date.now()}-${safeName}`);
 		const bytes = new Uint8Array(await file.arrayBuffer());
 		await writeFile(uploadPath, bytes);
@@ -330,20 +339,8 @@ export const deploymentsRoutes = new Elysia()
 			set.status = 404;
 			return fail("Deployment not found");
 		}
-		const { run } = await import("../../orchestrator/runtime");
-		const containerName = deployment.containerName || `deploy-${id}`;
 		try {
-			const output = await run("docker", ["logs", "--tail", "200", containerName]);
-			const lines = output
-				.split("\n")
-				.filter(Boolean)
-				.map((line, i) => ({
-					sequence: i + 1,
-					message: line,
-					timestamp: new Date().toISOString(),
-					stage: "runtime" as const,
-				}));
-			return ok(lines);
+			return ok(await readRuntimeLogs(deployment));
 		} catch {
 			return ok([]);
 		}
@@ -355,7 +352,6 @@ export const deploymentsRoutes = new Elysia()
 			return fail("Deployment not found");
 		}
 		const encoder = new TextEncoder();
-		const containerName = deployment.containerName || `deploy-${id}`;
 		let closed = false;
 		let childProcess: import("node:child_process").ChildProcess | null = null;
 		const stop = () => {
@@ -375,16 +371,27 @@ export const deploymentsRoutes = new Elysia()
 					controller.enqueue(encoder.encode(`event: ${eventName}\ndata: ${JSON.stringify(payload)}\n\n`));
 				};
 				const { spawn } = await import("node:child_process");
-				const isPosix = process.platform !== "win32";
-				const child = spawn("docker", ["logs", "--tail", "100", "--follow", containerName], {
-					detached: isPosix,
+				const child = spawn("docker", await runtimeLogFollowerArgs(deployment), {
 					stdio: ["ignore", "pipe", "pipe"],
 				});
 				childProcess = child;
 				if (closed) {
 					terminateWithEscalation(child, 2000);
+					try {
+						controller.close();
+					} catch {}
 					return;
 				}
+				child.on("error", (err) => {
+					send("log", {
+						sequence: 0,
+						message: `docker logs failed: ${err.message}`,
+						timestamp: new Date().toISOString(),
+						stage: "runtime",
+					});
+					send("close", { reason: "spawn failed" });
+					stop();
+				});
 				let seq = 0;
 				child.stdout.on("data", (chunk: Buffer) => {
 					if (closed) return;

apps/api/src/api/github/index.ts

@@ -9,7 +9,6 @@ import {
 	setGithubIntegration,
 } from "../../db/repo";
 import { orchestrator } from "../../orchestrator";
-import { config } from "../../utils/config";
 import { fail, ok } from "../response";
 
 const validateToken = async (token: string): Promise<boolean> => {
@@ -249,7 +248,11 @@ export const githubRoutes = new Elysia({ prefix: "/github" })
 		}
 		const webhookUrl = `${publicUrl(request).origin}/api/github/webhook`;
 		const integration = await getGithubIntegration();
-		const secret = integration?.webhookSecret || config.githubWebhookSecret;
+		const secret = integration?.webhookSecret || "";
+		if (!secret) {
+			set.status = 400;
+			return fail("Set a webhook secret in Settings before registering a webhook");
+		}
 
 		try {
 			const hooks = await fetchGitHub(`/repos/${params.owner}/${params.repo}/hooks`, token);

apps/api/src/api/index.ts

@@ -1,9 +1,10 @@
 import { Elysia } from "elysia";
-import { fail } from "./response";
+import { fixdiagRoutes } from "../fixdiag/routes";
 import { agentRoutes } from "./agents";
 import { alertsRoutes } from "./alerts";
 import { apiKeysRoutes } from "./api-keys";
 import { authRoutes } from "./auth";
+import { authMiddleware } from "./auth-middleware";
 import { backupRoutes } from "./backups";
 import { databasesRoutes } from "./databases";
 import { deploymentsRoutes } from "./deployments";
@@ -14,59 +15,17 @@ import { healthRoutes } from "./health";
 import { projectsRoutes } from "./projects";
 import { projectStatusRoutes } from "./projects/status";
 import { prometheusRoutes } from "./prometheus";
+import { fail } from "./response";
 import { routesRoutes } from "./routes";
 import { scalingRoutes } from "./scaling";
 import { serverInfoRoutes } from "./server-info";
 import { serversRoutes } from "./servers";
 import { settingsRoutes } from "./settings";
 import { llmSettingsRoutes } from "./settings/llm";
-import { fixdiagRoutes } from "../fixdiag/routes";
 import { sharedEnvLinksRoutes, sharedEnvVarsRoutes } from "./shared-env-vars";
 import { sshKeysRoutes } from "./ssh-keys";
 import { volumesRoutes } from "./volumes";
 
-const BYPASS_PATHS = new Set([
-	"/api/auth/login",
-	"/api/auth/logout",
-	"/api/auth/refresh",
-	"/api/auth/me",
-	"/api/health",
-	"/api/github/callback",
-	"/api/github/webhook",
-	"/api/agents/register",
-	"/api/agents/p2p-sync",
-]);
-
-const authMiddleware = (app: Elysia) =>
-	app.onBeforeHandle(async ({ request, set, path }) => {
-		if (BYPASS_PATHS.has(path)) return;
-
-		const cookie = request.headers.get("cookie") || "";
-		const match = cookie.match(/(?:^|;\s*)dequel_session=([^;]+)/);
-		if (match) {
-			const { verifyAccessToken } = await import("../utils/auth");
-			const payload = await verifyAccessToken(match[1]);
-			if (payload) return;
-			set.status = 401;
-			return fail("Invalid session");
-		}
-
-		const authHeader = request.headers.get("authorization");
-		if (authHeader?.startsWith("Bearer ")) {
-			const token = authHeader.slice(7);
-			if (token) {
-				const { validateApiKey } = await import("../db/repo");
-				const key = await validateApiKey(token);
-				if (key) return;
-				set.status = 401;
-				return fail("Invalid API key");
-			}
-		}
-
-		set.status = 401;
-		return fail("Authentication required");
-	});
-
 const INTERNAL_ERROR =
 	/Failed query:|params:|getaddrinfo|ECONNREFUSED|ETIMEDOUT|EAI_AGAIN|EHOSTUNREACH|timeout exceeded|node:internal|Cannot read propert|is not a function|is not a constructor|Unexpected token/i;