feat: initial scaffold - backend, frontend, Prisma schema, Docker

- Prisma schema: User, Session, RepoConfig, Preview, Job, WebhookToken, NoConfigComment, AdminSettings - Backend: auth (login/logout/me/first-user setup), webhook handler with HMAC verification, EC2 service, SSH service, deploy pipeline, job queue worker, cron workers - Frontend: Login with first-user detection, Dashboard, PreviewDetail with live log streaming, Settings, Repos config, Admin panel, SetupWizard, Privacy page - Docker Compose and Dockerfile for self-hosted deployment - Uses bcryptjs for Node 24 compatibility Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-07-25 00:18:08 +02:00
parent ca2efdadea
commit 40d484bede
108 changed files with 13393 additions and 0 deletions
@@ -0,0 +1,204 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var user_exports = {};
+__export(user_exports, {
+  getUserSettings: () => getUserSettings,
+  getWebhookSecret: () => getWebhookSecret,
+  regenerateWebhookSecret: () => regenerateWebhookSecret,
+  updateAws: () => updateAws,
+  updateGitea: () => updateGitea,
+  updatePassword: () => updatePassword,
+  updateUsername: () => updateUsername
+});
+module.exports = __toCommonJS(user_exports);
+var import_bcryptjs = __toESM(require("bcryptjs"));
+var import_crypto = require("crypto");
+var import_db = require("../../lib/db");
+var import_response = require("../../lib/response");
+var import_errors = require("../../lib/errors");
+var import_encryption = require("../../lib/encryption");
+var import_gitea = require("../../services/gitea");
+var import_ec2 = require("../../services/ec2");
+var import_env = require("../../lib/env");
+function requireAuth(ctr) {
+  const auth = ctr.getAuth?.();
+  if (!auth?.success) return null;
+  return auth.user;
+}
+async function getUserSettings(ctr) {
+  const user = requireAuth(ctr);
+  if (!user) return (0, import_response.makeResponse)({ ctr, content: { code: import_errors.ERROR_MESSAGES.UNAUTHORIZED.code, message: import_errors.ERROR_MESSAGES.UNAUTHORIZED.message } });
+  const webhookToken = await import_db.prisma.webhookToken.findUnique({ where: { userId: user.id } });
+  const fullUser = await import_db.prisma.user.findUnique({ where: { id: user.id } });
+  return (0, import_response.makeResponse)({
+    ctr,
+    content: {
+      code: 200,
+      data: {
+        id: user.id,
+        username: user.username,
+        giteaUsername: fullUser?.giteaUsername,
+        giteaInstanceUrl: fullUser?.giteaInstanceUrl,
+        giteaPatSet: !!fullUser?.giteaPAT,
+        awsAccessKeyId: fullUser?.awsAccessKeyId ? "****" : null,
+        awsRegion: fullUser?.awsRegion,
+        webhookUrl: `${import_env.env.PP_BASE_URL}/webhook/${user.id}`,
+        webhookSecret: webhookToken?.token ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : null,
+        webhookTokenExists: !!webhookToken
+      }
+    }
+  });
+}
+async function updateUsername(ctr) {
+  const user = requireAuth(ctr);
+  if (!user) return (0, import_response.makeResponse)({ ctr, content: { code: 401, message: import_errors.ERROR_MESSAGES.UNAUTHORIZED.message } });
+  const body = await ctr.body();
+  const { username } = body || {};
+  if (!username || typeof username !== "string") return (0, import_response.makeResponse)({ ctr, content: { code: 400, message: "Username required" } });
+  const existing = await import_db.prisma.user.findFirst({ where: { username, id: { not: user.id } } });
+  if (existing) return (0, import_response.makeResponse)({ ctr, content: { code: 409, message: "Username already taken" } });
+  await import_db.prisma.user.update({ where: { id: user.id }, data: { username } });
+  return (0, import_response.makeResponse)({ ctr, content: { code: 200, message: "Username updated" } });
+}
+async function updatePassword(ctr) {
+  const user = requireAuth(ctr);
+  if (!user) return (0, import_response.makeResponse)({ ctr, content: { code: 401, message: import_errors.ERROR_MESSAGES.UNAUTHORIZED.message } });
+  const body = await ctr.body();
+  const { currentPassword, newPassword } = body || {};
+  if (!currentPassword || !newPassword) return (0, import_response.makeResponse)({ ctr, content: { code: 400, message: "Current and new passwords required" } });
+  const fullUser = await import_db.prisma.user.findUnique({ where: { id: user.id } });
+  if (!fullUser) return (0, import_response.makeResponse)({ ctr, content: { code: 404, message: "User not found" } });
+  const valid = await import_bcryptjs.default.compare(currentPassword, fullUser.passwordHash);
+  if (!valid) return (0, import_response.makeResponse)({ ctr, content: { code: 401, message: "Current password incorrect" } });
+  const hash = await import_bcryptjs.default.hash(newPassword, 12);
+  await import_db.prisma.user.update({ where: { id: user.id }, data: { passwordHash: hash } });
+  return (0, import_response.makeResponse)({ ctr, content: { code: 200, message: "Password updated" } });
+}
+async function updateGitea(ctr) {
+  const user = requireAuth(ctr);
+  if (!user) return (0, import_response.makeResponse)({ ctr, content: { code: 401, message: import_errors.ERROR_MESSAGES.UNAUTHORIZED.message } });
+  const body = await ctr.body();
+  const { giteaInstanceUrl, giteaUsername, giteaPAT } = body || {};
+  if (!giteaInstanceUrl || !giteaUsername) {
+    return (0, import_response.makeResponse)({ ctr, content: { code: 400, message: "Gitea URL and username required" } });
+  }
+  const cleanUrl = giteaInstanceUrl.replace(/\/+$/, "");
+  const validation = await (0, import_gitea.validateGiteaUrl)(cleanUrl);
+  if (!validation.success) {
+    return (0, import_response.makeResponse)({ ctr, content: { code: 400, message: `Gitea validation failed: ${validation.error}` } });
+  }
+  const data = { giteaInstanceUrl: cleanUrl, giteaUsername };
+  if (giteaPAT) data.giteaPAT = (0, import_encryption.encrypt)(giteaPAT);
+  await import_db.prisma.user.update({ where: { id: user.id }, data });
+  return (0, import_response.makeResponse)({ ctr, content: { code: 200, message: `Connected to Gitea ${validation.version}`, data: { version: validation.version } } });
+}
+async function updateAws(ctr) {
+  const user = requireAuth(ctr);
+  if (!user) return (0, import_response.makeResponse)({ ctr, content: { code: 401, message: import_errors.ERROR_MESSAGES.UNAUTHORIZED.message } });
+  const body = await ctr.body();
+  const { awsAccessKeyId, awsSecretAccessKey, awsRegion } = body || {};
+  if (!awsAccessKeyId || !awsSecretAccessKey || !awsRegion) {
+    return (0, import_response.makeResponse)({ ctr, content: { code: 400, message: "AWS credentials and region required" } });
+  }
+  const tempUser = {
+    ...user,
+    awsAccessKeyId: (0, import_encryption.encrypt)(awsAccessKeyId),
+    awsSecretAccessKey: (0, import_encryption.encrypt)(awsSecretAccessKey),
+    awsRegion
+  };
+  const validation = await (0, import_ec2.validateAwsCredentials)(tempUser);
+  if (!validation.success) {
+    return (0, import_response.makeResponse)({ ctr, content: { code: 400, message: `AWS validation failed: ${validation.error}` } });
+  }
+  await import_db.prisma.user.update({
+    where: { id: user.id },
+    data: {
+      awsAccessKeyId: (0, import_encryption.encrypt)(awsAccessKeyId),
+      awsSecretAccessKey: (0, import_encryption.encrypt)(awsSecretAccessKey),
+      awsRegion
+    }
+  });
+  return (0, import_response.makeResponse)({ ctr, content: { code: 200, message: `Connected as ${validation.arn}`, data: { arn: validation.arn } } });
+}
+async function getWebhookSecret(ctr) {
+  const user = requireAuth(ctr);
+  if (!user) return (0, import_response.makeResponse)({ ctr, content: { code: 401, message: import_errors.ERROR_MESSAGES.UNAUTHORIZED.message } });
+  let token = await import_db.prisma.webhookToken.findUnique({ where: { userId: user.id } });
+  if (!token) {
+    const secret = (0, import_crypto.randomBytes)(32).toString("hex");
+    token = await import_db.prisma.webhookToken.create({ data: { userId: user.id, token: secret } });
+  }
+  return (0, import_response.makeResponse)({ ctr, content: { code: 200, data: { token: token.token } } });
+}
+async function regenerateWebhookSecret(ctr) {
+  const user = requireAuth(ctr);
+  if (!user) return (0, import_response.makeResponse)({ ctr, content: { code: 401, message: import_errors.ERROR_MESSAGES.UNAUTHORIZED.message } });
+  const newSecret = (0, import_crypto.randomBytes)(32).toString("hex");
+  await import_db.prisma.webhookToken.upsert({
+    where: { userId: user.id },
+    update: { token: newSecret },
+    create: { userId: user.id, token: newSecret }
+  });
+  const fullUser = await import_db.prisma.user.findUnique({ where: { id: user.id } });
+  if (!fullUser?.giteaInstanceUrl) {
+    return (0, import_response.makeResponse)({ ctr, content: { code: 200, message: "Secret regenerated (no Gitea hooks to update)", data: { token: newSecret } } });
+  }
+  const configs = await import_db.prisma.repoConfig.findMany({
+    where: { userId: user.id, giteaWebhookId: { not: null } }
+  });
+  const { updateWebhookSecret } = await import("../../services/gitea");
+  const webhookUrl = `${import_env.env.PP_BASE_URL}/webhook/${user.id}`;
+  const errors = [];
+  for (const config of configs) {
+    try {
+      await updateWebhookSecret(fullUser, config.repoOwner, config.repoName, config.giteaWebhookId, webhookUrl, newSecret);
+    } catch (e) {
+      errors.push(`${config.repoOwner}/${config.repoName}: ${e.message}`);
+    }
+  }
+  return (0, import_response.makeResponse)({
+    ctr,
+    content: {
+      code: 200,
+      message: errors.length ? `Secret regenerated with ${errors.length} hook update errors` : "Secret regenerated and all hooks updated",
+      data: { token: newSecret, errors }
+    }
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getUserSettings,
+  getWebhookSecret,
+  regenerateWebhookSecret,
+  updateAws,
+  updateGitea,
+  updatePassword,
+  updateUsername
+});
+//# sourceMappingURL=user.js.map