Skip to content

fix(cli): upload via CF workers instead of Supabase edge #3150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
riderx wants to merge 40 commits into
base: main
Choose a base branch
from
+3,549 −1,119
Open

fix(cli): upload via CF workers instead of Supabase edge #3150

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
40 commits
Select commit Hold shift + click to select a range
252ad17
fix(cli): upload via CF workers instead of Supabase edge
cursoragent Aug 21, 2026
ec8fc63
fix(backend): lint and typecheck for CLI upload endpoints
cursoragent Aug 21, 2026
70c684d
fix(cli): mount private CLI routes on Supabase edge for local tests
cursoragent Aug 21, 2026
f7eb5c6
fix(cli): use guarded openExternalUrl in upload plan HTTP check
cursoragent Aug 21, 2026
272fa09
fix(api): forward capgkey for CLI warnings RPC on upload path
cursoragent Aug 21, 2026
3b97b1d
test(cli): expect HTTP upload-channel readback in preview lifecycle
cursoragent Aug 21, 2026
adf9b00
fix(cli): address PR #3150 review comments on upload HTTP migration
cursoragent Aug 21, 2026
bc82a5d
fix(backend): satisfy requireObjectBody generic constraint for typecheck
cursoragent Aug 21, 2026
3dbd0d0
fix(cli): address CodeRabbit and CodeQL review on upload HTTP migration
cursoragent Aug 21, 2026
990b0e9
fix(cli): align permission helper test mock with isSupabaseClient
cursoragent Aug 24, 2026
c552f5d
fix: CI failures for prepare upload replica lag and iOS resume gate
cursoragent Aug 24, 2026
440969c
fix(api): allow bundle/prepare to reset completed versions for re-upload
cursoragent Aug 24, 2026
763d64c
fix(cli): reset appflow p8 provide chain and show Issuer ID step
cursoragent Aug 24, 2026
d008b5a
fix(api): coerce prepare re-upload version id to number
cursoragent Aug 24, 2026
987effd
fix(db): restamp prepare_reupload_reset_guc migration after main advance
cursoragent Aug 26, 2026
ba6052b
fix(cli): address CodeRabbit review after main merge sync
cursoragent Aug 26, 2026
4ca1c83
fix(cli): remove unused getAppId import after main merge
cursoragent Aug 26, 2026
63f68b8
fix(db): restore r2-direct manifest jsonb guard in prepare_reupload m…
cursoragent Aug 27, 2026
274d98d
fix(cli): address CodeRabbit review on upload HTTP migration
cursoragent Aug 27, 2026
deb7423
fix(cli): CI lint + stabilize TUI path input submit
cursoragent Aug 27, 2026
6c67eda
fix(db): restore prepare_reupload_reset GUC after manifest guard migr…
cursoragent Aug 27, 2026
92777c8
fix(cli): address CodeRabbit review on deb7423
cursoragent Aug 27, 2026
095e9ef
fix(cli): split transport vs missing-id errors in lookupUploadVersionId
cursoragent Aug 27, 2026
2bef722
chore(cli): merge main into cursor/cli-upload-cf-workers-7b3e
cursoragent Aug 31, 2026
c7dff40
chore(cli): merge main into cursor/cli-upload-cf-workers-7b3e
cursoragent Sep 1, 2026
fa16c5f
fix(db): require internal role for prepare_reupload_reset GUC
cursoragent Sep 1, 2026
57fd0db
fix(db): drop superseded prepare_reupload_reset migration
cursoragent Sep 1, 2026
217d182
chore(cli): merge main into cursor/cli-upload-cf-workers-7b3e
cursoragent Sep 1, 2026
989b7e7
feat(cli): replace remaining supabase RPC calls with Capgo HTTP APIs
cursoragent Sep 1, 2026
e91058b
fix(cli): satisfy TypeScript on org HTTP helpers
cursoragent Sep 1, 2026
2b54edb
fix(cli): widen 2FA preflight permissions and thread self-host hosts
cursoragent Sep 1, 2026
889b469
fix(cli): drop dead org-name fallback in organization set tracking
cursoragent Sep 1, 2026
3e7a544
fix(cli): allow channel-scoped 2FA preflight and treat unknown member…
cursoragent Sep 1, 2026
7b918a1
fix(cli): limit 2FA app-binding fallback to app and channel scopes
cursoragent Sep 1, 2026
d5fcf74
fix(cli): typecheck plan actions and drop unused withSupabaseSource e…
cursoragent Sep 1, 2026
e2aef92
fix(test): keep 2FA API key cleanup going after a failed DELETE
cursoragent Sep 1, 2026
47370ab
fix(cli): address CodeRabbit plan, 2FA lookup, and app-list nits
cursoragent Sep 1, 2026
6bfd823
fix(test): mock hostOptionsFromSupabase in CLI permission helper
cursoragent Sep 1, 2026
fafe7ad
fix(test): pin TUI FakeCapgo HTTP check-permission route
cursoragent Sep 1, 2026
2ddbbdc
fix(test): retry wrangler 503 on files-security app DELETE
cursoragent Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 16 additions & 22 deletions cli/TODO_HTTP_API.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,27 +2,25 @@

## Missing endpoints (block full supabase-js removal)

- [ ] GET/POST private/cli identity (`get_user_id` / `request_actor_user_id` + 2FA flags)
- [ ] POST private/cli/check-permission (`cli_check_permission` / `assertCliPermission` / `hasCliPermission`)
- [ ] GET organization v7-enriched fields (`get_orgs_v7` / rich org list with plan + warnings)
- [ ] Billing/entitlement RPCs (`is_paying_org`, `is_trial_org`, `has_usage_credits_org`, `is_allowed_action_org*`, `checkPlanValid`)
- [ ] 2FA member/org access RPCs (`reject_access_due_to_2fa_*`, `check_org_members_2fa_enabled`, `has_2fa_enabled`)
- [ ] Password policy member status RPC (`check_org_members_password_policy`)
- [ ] Org CLI warnings RPC (`get_organization_cli_warnings`)
- [x] GET organization v7-enriched fields (`GET /private/cli/orgs` wraps `get_orgs_v7`)
- [x] Password policy / 2FA member status (`GET /private/cli/org-member-compliance`)
- [ ] POST organization via API key (JWT-only `middlewareAuth` today)
- [ ] Icon / storage uploads via Capgo HTTP (still supabase storage)
- [ ] Channel-scoped current bundle HTTP that preserves `channel.read` RBAC (`get_channel_current_bundle_rbac`)
- [x] Channel-scoped current bundle HTTP that preserves `channel.read` RBAC (`GET /private/cli/channel-current-bundle`)
- [ ] PUT app fields still missing from HTTP: `allow_preview`, `build_timeout_seconds`, `default_upload_channel`
- [ ] GET organization security fields (`enforcing_2fa`, `password_policy_config`, API-key policy flags)
- [x] GET organization security fields (`enforcing_2fa`, `password_policy_config`, API-key policy flags)
- [ ] GET channel fields still missing from HTTP response: `ios`, `android`, `owner_org`
- [ ] Bundle upload finalize / version upsert / encryption field writes (keep existing partial `invokeCapgoCliApi` in upload)
- [x] POST `bundle/prepare` — version upsert for CLI upload (`updateOrCreateVersion` → Capgo HTTP)
- [x] GET `bundle/lookup` — version existence / latest name for auto-bump
- [x] POST `private/finish_tus_upload` — set `r2_path` after TUS
- [x] POST/GET `private/cli/*` — permission, plan, warnings, 2FA, orgs, current bundle, user id
- [ ] Bundle compatibility `native_packages` dedicated endpoint (today via full GET bundle rows)
- [ ] User-scoped storage cleanup path `apps/${appId}/${userId}` on app delete

## Partial (endpoint exists, CLI still needs more)

- [ ] GET organization — usable for name/created_by/logo, not security settings
- [ ] GET organization/members — member list migrated; 2FA/password enrichment still RPC
- [x] GET organization — security settings now included in HTTP payload
- [x] GET organization/members — member list + 2FA/password enrichment via `/private/cli/org-member-compliance`
- [ ] PUT app — core settings migrated; preview/timeout/default upload channel still SDK
- [ ] GET channel — list/find migrated; display defaults ios/android to false
- [ ] GET/DELETE bundle — list/delete migrated; empty list currently returns API error that CLI maps to `[]`
Expand All @@ -31,16 +29,12 @@

## Still on supabase-js (file references)

- `cli/src/utils.ts` — `resolveUserIdFromApiKey`, `hasCliPermission` / `assertCliPermission`, `checkPlanValid`, `updateOrCreateChannel` fallback, storage helpers
- `cli/src/api/app.ts` — `check2FAComplianceForApp` (`reject_access_due_to_2fa_for_app`)
- `cli/src/channel/currentBundle.ts` — channel row + `get_channel_current_bundle_rbac`
- `cli/src/app/set.ts` — icon storage upload; `allow_preview` / `build_timeout_seconds` / `default_upload_channel`; download-channel helpers
CLI `src/` no longer calls `supabase.rpc`. Remaining supabase-js use is PostgREST/storage, not RPC:
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.

- `cli/src/app/set.ts` — icon storage upload; `allow_preview` / `build_timeout_seconds` / `default_upload_channel`
- `cli/src/app/delete.ts` — user-scoped storage cleanup
- `cli/src/app/add.ts` — icon storage upload; org permission RPCs
- `cli/src/organization/set.ts` — org security field reads + 2FA/password RPCs (writes already HTTP)
- `cli/src/organization/members.ts` — org security settings select + 2FA/password RPCs (member list HTTP)
- `cli/src/bundle/upload.ts` — version upsert / finalize / encryption writes
- `cli/src/app/add.ts` — icon storage upload
- `cli/src/bundle/upload.ts` — AI auto-bump manifest fetch still uses supabase-js
- `cli/src/bundle/compatibility.ts` — native package reads when not using HTTP bundle payload
- `cli/src/bundle/unlink.ts` — still uses permission/plan RPCs around HTTP unlink
- `cli/src/bundle/unlink.ts` — `checkVersionNotUsedInChannel` still uses supabase-js PostgREST
- `cli/src/channel/set.ts` — `checkCompatibilityNativePackages` still needs supabase client
- `cli/src/preview/qr.ts` — 2FA + permission checks still SDK
5 changes: 4 additions & 1 deletion cli/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,7 +176,7 @@
"test:android-version": "bun test/test-android-version.mjs",
"test:platform-flow-contract": "bun test/test-platform-flow-contract.mjs",
"test:tail-engine-shared": "bun test/test-tail-engine-shared.mjs",
"test": "bun run build && bun run test:helper-dce && bun run test:version-detection:setup && bun run test:bundle && bun run test:bundle-validation && bun run test:functional && bun run test:semver && bun run test:auto-bump-version && bun run test:auto-bump-ai-diff && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:fail-on-incompatible && bun run test:native-dependencies && bun run test:package-json-guard && bun run test:credentials && bun run test:credentials-export && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:build-cancellation && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:cli-headers && bun run test:min-cli-version && bun run test:authenticated-command-invocation && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:preview-qr && bun run test:app-set-options && bun run test:mcp-analytics && bun run test:mcp-instructions && bun run test:mcp-live-update-onboarding && bun run test:mcp-stdout-guard && bun run test:mcp-platform-select && bun run test:mcp-explain-scopes && bun run test:mcp-oauth-reopen && bun run test:mcp-broker-oauth && bun run test:mcp-broker-session && bun run test:mcp-credentials-manage && bun run test:mcp-resume-prompt && bun run test:mcp-build-job && bun run test:mcp-build-tools && bun run test:app-created-source && bun run test:app-add-exists && bun run test:app-list-output-text && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:cli-recovery && bun run test:create-supabase-client && bun run test:build-platform-selection && bun run test:builder-project-discovery && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-monorepo-targeting && bun run test:init-app-conflict && bun run test:channel-add-exists && bun run test:wait-log && bun run test:init-guardrails && bun run test:init-replay && bun run test:init-telemetry && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:mcp-no-key-handshake && bun run test:auth-session && bun run test:version-detection && bun run test:platform-paths && bun run test:project-type-detection && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:asc-key-protocol && bun run test:apple-api-import-helpers && bun run test:apple-api-verify-key && bun run test:bundle-id-detector && bun run test:apple-api-app-list && bun run test:app-verification && bun run test:pbxproj-parser && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:cicd-failure-help && bun run test:ai-sse-parser && bun run test:ai-render-markdown && bun run test:ai-stream-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit && bun run test:ai-analyze-stream && bun run test:support-mailto && bun run test:support-redact && bun run test:support-internal-log && bun run test:support-help-menu && bun run test:support-contact && bun run test:support-upload-prompt && bun run test:support-bundle-files && bun run test:self-update && bun run test:update-prompt && bun run test:apple-api-cert-create && bun run test:android-tail-engine && bun run test:android-tail-render && bun run test:android-tail-routing && bun run test:dev-gate-stripped && bun run test:frame-fit-ios-shared && bun run test:ios-confirm-app-id && bun run test:ios-create-new && bun run test:ios-e2e && bun run test:ios-flow-contract && bun run test:ios-import-discovery && bun run test:ios-import-export && bun run test:ios-import-pickers && bun run test:ios-import-recovery && bun run test:ios-recovery && bun run test:ios-resume && bun run test:ios-tail-handoff && bun run test:ios-tui-render && bun run test:p8-error && bun run test:ios-tui-routing && bun run test:ios-updater-sync-validation && bun run test:ios-verify-app && bun run test:ios-marketing-version && bun run test:android-version && bun run test:platform-flow-contract && bun run test:tail-engine-shared && bun run test:prescan && bun run test:android-reporting-api && bun run test:android-app-verification && bun run test:android-rename && bun run test:appflow-auth && bun run test:appflow-api-map && bun run test:appflow-validate && bun run test:appflow-flow && bun run test:appflow-gapfill && bun run test:appflow-engine && bun run test:appflow-tail && bun run test:appflow-fetch && bun run test:appflow-sa-decode && bun run test:app-permission-helper && bun run test:2fa-compliance-network && bun run test:organization-set-api-host && bun run test:trial-warning && bun run test:plan-validation",
"test": "bun run build && bun run test:helper-dce && bun run test:version-detection:setup && bun run test:bundle && bun run test:bundle-validation && bun run test:functional && bun run test:semver && bun run test:auto-bump-version && bun run test:auto-bump-ai-diff && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:upload-http-path && bun run test:no-rpc && bun run test:filtered-text-input-submit && bun run test:fail-on-incompatible && bun run test:native-dependencies && bun run test:package-json-guard && bun run test:credentials && bun run test:credentials-export && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:build-cancellation && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:cli-headers && bun run test:min-cli-version && bun run test:authenticated-command-invocation && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:preview-qr && bun run test:app-set-options && bun run test:mcp-analytics && bun run test:mcp-instructions && bun run test:mcp-live-update-onboarding && bun run test:mcp-stdout-guard && bun run test:mcp-platform-select && bun run test:mcp-explain-scopes && bun run test:mcp-oauth-reopen && bun run test:mcp-broker-oauth && bun run test:mcp-broker-session && bun run test:mcp-credentials-manage && bun run test:mcp-resume-prompt && bun run test:mcp-build-job && bun run test:mcp-build-tools && bun run test:app-created-source && bun run test:app-add-exists && bun run test:app-list-output-text && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:cli-recovery && bun run test:create-supabase-client && bun run test:build-platform-selection && bun run test:builder-project-discovery && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-monorepo-targeting && bun run test:init-app-conflict && bun run test:channel-add-exists && bun run test:wait-log && bun run test:init-guardrails && bun run test:init-replay && bun run test:init-telemetry && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:mcp-no-key-handshake && bun run test:auth-session && bun run test:version-detection && bun run test:platform-paths && bun run test:project-type-detection && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:asc-key-protocol && bun run test:apple-api-import-helpers && bun run test:apple-api-verify-key && bun run test:bundle-id-detector && bun run test:apple-api-app-list && bun run test:app-verification && bun run test:pbxproj-parser && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:cicd-failure-help && bun run test:ai-sse-parser && bun run test:ai-render-markdown && bun run test:ai-stream-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit && bun run test:ai-analyze-stream && bun run test:support-mailto && bun run test:support-redact && bun run test:support-internal-log && bun run test:support-help-menu && bun run test:support-contact && bun run test:support-upload-prompt && bun run test:support-bundle-files && bun run test:self-update && bun run test:update-prompt && bun run test:apple-api-cert-create && bun run test:android-tail-engine && bun run test:android-tail-render && bun run test:android-tail-routing && bun run test:dev-gate-stripped && bun run test:frame-fit-ios-shared && bun run test:ios-confirm-app-id && bun run test:ios-create-new && bun run test:ios-e2e && bun run test:ios-flow-contract && bun run test:ios-import-discovery && bun run test:ios-import-export && bun run test:ios-import-pickers && bun run test:ios-import-recovery && bun run test:ios-recovery && bun run test:ios-resume && bun run test:ios-tail-handoff && bun run test:ios-tui-render && bun run test:p8-error && bun run test:ios-tui-routing && bun run test:ios-updater-sync-validation && bun run test:ios-verify-app && bun run test:ios-marketing-version && bun run test:android-version && bun run test:platform-flow-contract && bun run test:tail-engine-shared && bun run test:prescan && bun run test:android-reporting-api && bun run test:android-app-verification && bun run test:android-rename && bun run test:appflow-auth && bun run test:appflow-api-map && bun run test:appflow-validate && bun run test:appflow-flow && bun run test:appflow-gapfill && bun run test:appflow-engine && bun run test:appflow-tail && bun run test:appflow-fetch && bun run test:appflow-sa-decode && bun run test:app-permission-helper && bun run test:2fa-compliance-network && bun run test:organization-set-api-host && bun run test:trial-warning && bun run test:plan-validation",
"test:build-platform-selection": "bun test/test-build-platform-selection.mjs",
"test:builder-project-discovery": "bun test/test-builder-project-discovery.mjs",
"test:ai-log-capture": "bun test/test-ai-log-capture.mjs",
Expand Down Expand Up @@ -219,6 +219,9 @@
"test:appflow-fetch": "bun test/test-appflow-fetch.mjs",
"test:appflow-sa-decode": "bun test/test-appflow-sa-decode.mjs",
"test:app-permission-helper": "bun test/test-app-permission-helper.mjs",
"test:upload-http-path": "bun test/test-upload-http-path.mjs",
"test:no-rpc": "bun test/test-no-rpc.mjs",
"test:filtered-text-input-submit": "bun test/test-filtered-text-input-submit.mjs",
"test:2fa-compliance-network": "bun test/test-2fa-compliance-network.mjs",
"test:organization-set-api-host": "bun test/test-organization-set-api-host.mjs",
"test:trial-warning": "bun test/test-trial-warning.mjs",
Expand Down
4 changes: 1 addition & 3 deletions cli/src/analytics/track.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ import { isTruthyEnvValue } from '../posthog'
import { findSavedKeySilent, getAppId, getConfig, sendEvent } from '../utils'
import { resolveOwnerOrgId } from './org-resolver'
import { categorizeCliError, categorizeHttpStatus } from './error-category'
import { deriveSupabaseOperation, setSupabaseCallRecorder, SLOW_THRESHOLD_MS, withSupabaseSource } from './supabase-perf'
import { deriveSupabaseOperation, setSupabaseCallRecorder, SLOW_THRESHOLD_MS } from './supabase-perf'
import type { SupabaseCallInfo } from './supabase-perf'

// Global analytics props + invocation source live in ./global-props so the
Expand Down Expand Up @@ -334,6 +334,4 @@ function recordSupabaseCall(info: SupabaseCallInfo): void {

setSupabaseCallRecorder(recordSupabaseCall)

// Re-export so call sites can `import { withSupabaseSource } from '../analytics/track'`.
export { withSupabaseSource }
export { enableSupabaseInstrumentation } from './supabase-perf'
Loading
Loading