Implement a comprehensive app distribution system supporting both public
(npm registry) and private (tarball upload) installation channels.
Backend:
- Add AppRegistrationSourceType enum (npm, tarball, none) to track app origin
- Add AppPackageResolverService for resolving packages from npm or tarball sources
- Add ApplicationInstallService with PostgreSQL advisory locks for safe installs
- Add AppUpgradeService with version checking and rollback support
- Add tarball upload REST endpoint with secure extraction (path traversal protection)
- Add marketplace catalog sync cron job (hourly) from hardcoded catalog index
- Add app version check cron job (every 6 hours) to detect available updates
- Disable yarn lifecycle scripts (enableScripts: false) to prevent RCE via postinstall
- Add database migration for sourceType, sourcePackage, latestAvailableVersion fields
Frontend:
- Add "Install from npm" modal for manual package installation
- Add "Upload tarball" modal for direct .tar.gz uploads
- Add upgrade mutation and version container with upgrade button
- Add blue "Update" badge on installed apps table when newer version available
- Fetch application registrations to compare installed vs latest versions
- Migrate styled components from Emotion to Linaria (matching main migration)
- Remove redundant sourcePackage mutation argument (derived from universalIdentifier)
Testing:
- Add integration tests for app distribution (install, upgrade, tarball upload)
- Add integration tests for marketplace catalog sync
Made-with: Cursor
Félix Malfait
d2ebe3edb2