feat: initial scaffold - backend, frontend, Prisma schema, Docker

- Prisma schema: User, Session, RepoConfig, Preview, Job, WebhookToken, NoConfigComment, AdminSettings - Backend: auth (login/logout/me/first-user setup), webhook handler with HMAC verification, EC2 service, SSH service, deploy pipeline, job queue worker, cron workers - Frontend: Login with first-user detection, Dashboard, PreviewDetail with live log streaming, Settings, Repos config, Admin panel, SetupWizard, Privacy page - Docker Compose and Dockerfile for self-hosted deployment - Uses bcryptjs for Node 24 compatibility Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-07-25 00:18:08 +02:00
parent ca2efdadea
commit 40d484bede
108 changed files with 13393 additions and 0 deletions
@@ -0,0 +1,249 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ec2_exports = {};
+__export(ec2_exports, {
+  createPreviewSecurityGroup: () => createPreviewSecurityGroup,
+  deleteKeyPairAws: () => deleteKeyPairAws,
+  deleteSecurityGroupAws: () => deleteSecurityGroupAws,
+  describeAllManagedInstances: () => describeAllManagedInstances,
+  generateAndImportKeyPair: () => generateAndImportKeyPair,
+  generateSshKeyPair: () => generateSshKeyPair,
+  launchInstance: () => launchInstance,
+  makeEc2Client: () => makeEc2Client,
+  makeStsClient: () => makeStsClient,
+  terminateInstance: () => terminateInstance,
+  validateAwsCredentials: () => validateAwsCredentials,
+  waitForInstanceRunning: () => waitForInstanceRunning
+});
+module.exports = __toCommonJS(ec2_exports);
+var import_client_ec2 = require("@aws-sdk/client-ec2");
+var import_client_sts = require("@aws-sdk/client-sts");
+var import_crypto = require("crypto");
+var import_logger = require("../lib/logger");
+var import_encryption = require("../lib/encryption");
+const log = (0, import_logger.createLogger)("EC2");
+const UBUNTU_22_04_AMI = {
+  "us-east-1": "ami-0e86e20dae9224db8",
+  "us-east-2": "ami-0a0d9cf81c479446a",
+  "us-west-1": "ami-05c969369880fa2c2",
+  "us-west-2": "ami-03f8acd418785369b",
+  "eu-west-1": "ami-0694d931cee176e7d",
+  "eu-west-2": "ami-0f3d9639a5674d559",
+  "eu-west-3": "ami-022e307f4b9e39f45",
+  "eu-central-1": "ami-0faab6bdbac9486fb",
+  "ap-southeast-1": "ami-0823c236601fef765",
+  "ap-southeast-2": "ami-07620139298af599e",
+  "ap-northeast-1": "ami-0b7546e839d7ace12",
+  "ap-northeast-2": "ami-042e76978adeb8c48",
+  "ap-south-1": "ami-076e3a557efe1aa9c",
+  "sa-east-1": "ami-0eed58016fbe42de3",
+  "ca-central-1": "ami-024f768de9e73d4f4",
+  "eu-north-1": "ami-00381a880aa48c6c6",
+  "me-south-1": "ami-09574f34b8dcd2eac",
+  "af-south-1": "ami-08fdcf06b39fe83ec"
+};
+function makeEc2Client(user) {
+  const accessKeyId = user.awsAccessKeyId ? (0, import_encryption.decrypt)(user.awsAccessKeyId) : "";
+  const secretAccessKey = user.awsSecretAccessKey ? (0, import_encryption.decrypt)(user.awsSecretAccessKey) : "";
+  return new import_client_ec2.EC2Client({
+    region: user.awsRegion,
+    credentials: { accessKeyId, secretAccessKey }
+  });
+}
+function makeStsClient(user) {
+  const accessKeyId = user.awsAccessKeyId ? (0, import_encryption.decrypt)(user.awsAccessKeyId) : "";
+  const secretAccessKey = user.awsSecretAccessKey ? (0, import_encryption.decrypt)(user.awsSecretAccessKey) : "";
+  return new import_client_sts.STSClient({
+    region: user.awsRegion,
+    credentials: { accessKeyId, secretAccessKey }
+  });
+}
+async function validateAwsCredentials(user) {
+  try {
+    const sts = makeStsClient(user);
+    const res = await sts.send(new import_client_sts.GetCallerIdentityCommand({}));
+    return { success: true, arn: res.Arn };
+  } catch (e) {
+    return { success: false, error: e.message };
+  }
+}
+function generateSshKeyPair() {
+  const { privateKey, publicKey } = (0, import_crypto.generateKeyPairSync)("rsa", {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: "pkcs1", format: "pem" },
+    privateKeyEncoding: { type: "pkcs1", format: "pem" }
+  });
+  const pubKeyOpenSsh = rsaPemToOpenSsh(publicKey);
+  return { privateKey, publicKey: pubKeyOpenSsh };
+}
+function rsaPemToOpenSsh(pem) {
+  const { publicKeyEncoding } = (0, import_crypto.generateKeyPairSync)("rsa", {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: "pkcs8", format: "pem" },
+    privateKeyEncoding: { type: "pkcs8", format: "pem" }
+  });
+  void publicKeyEncoding;
+  const der = Buffer.from(
+    pem.replace(/-----BEGIN RSA PUBLIC KEY-----/, "").replace(/-----END RSA PUBLIC KEY-----/, "").replace(/\n/g, ""),
+    "base64"
+  );
+  const type = Buffer.from("ssh-rsa");
+  function encodeBuffer(buf) {
+    const len = Buffer.allocUnsafe(4);
+    len.writeUInt32BE(buf.length, 0);
+    return Buffer.concat([len, buf]);
+  }
+  const typeEncoded = encodeBuffer(type);
+  const rsaKeyData = der;
+  const base64Key = Buffer.concat([typeEncoded, rsaKeyData]).toString("base64");
+  return `ssh-rsa ${base64Key} pp-generated`;
+}
+async function generateAndImportKeyPair(ec2, keyName) {
+  const { privateKey, publicKey } = generateSshKeyPair();
+  await ec2.send(new import_client_ec2.ImportKeyPairCommand({
+    KeyName: keyName,
+    PublicKeyMaterial: Buffer.from(publicKey)
+  }));
+  return { privateKey };
+}
+async function createPreviewSecurityGroup(ec2, groupName, port) {
+  const describe = await ec2.send(new import_client_ec2.DescribeSecurityGroupsCommand({
+    Filters: [{ Name: "group-name", Values: [groupName] }]
+  }));
+  if (describe.SecurityGroups && describe.SecurityGroups.length > 0) {
+    return describe.SecurityGroups[0].GroupId;
+  }
+  const res = await ec2.send(new import_client_ec2.CreateSecurityGroupCommand({
+    GroupName: groupName,
+    Description: `PP Preview security group: ${groupName}`
+  }));
+  const groupId = res.GroupId;
+  await ec2.send(new import_client_ec2.AuthorizeSecurityGroupIngressCommand({
+    GroupId: groupId,
+    IpPermissions: [
+      {
+        IpProtocol: "tcp",
+        FromPort: 22,
+        ToPort: 22,
+        IpRanges: [{ CidrIp: "0.0.0.0/0" }]
+      },
+      {
+        IpProtocol: "tcp",
+        FromPort: port,
+        ToPort: port,
+        IpRanges: [{ CidrIp: "0.0.0.0/0" }]
+      }
+    ]
+  }));
+  return groupId;
+}
+const BOOTSTRAP_SCRIPT = `#!/bin/bash
+set -e
+apt-get update -y
+apt-get install -y curl git unzip build-essential
+curl -fsSL https://get.docker.com | sh
+systemctl enable docker
+systemctl start docker
+apt-get install -y docker-compose-plugin
+curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
+export NVM_DIR="/root/.nvm"
+source "$NVM_DIR/nvm.sh"
+nvm install --lts
+nvm alias default lts/*
+`;
+async function launchInstance(opts) {
+  const ami = UBUNTU_22_04_AMI[opts.region] ?? UBUNTU_22_04_AMI["us-east-1"];
+  const tagSpecs = Object.entries(opts.tags).map(([k, v]) => ({ Key: k, Value: v }));
+  tagSpecs.push({ Key: "Name", Value: `pp-preview-${opts.tags["pp:previewId"]}` });
+  const res = await opts.ec2.send(new import_client_ec2.RunInstancesCommand({
+    ImageId: ami,
+    InstanceType: opts.instanceType,
+    MinCount: 1,
+    MaxCount: 1,
+    KeyName: opts.keyName,
+    SecurityGroupIds: [opts.securityGroupId],
+    UserData: Buffer.from(BOOTSTRAP_SCRIPT).toString("base64"),
+    TagSpecifications: [
+      { ResourceType: "instance", Tags: tagSpecs }
+    ]
+  }));
+  return res.Instances[0].InstanceId;
+}
+async function waitForInstanceRunning(ec2, instanceId, maxWaitMs = 3e5) {
+  const start = Date.now();
+  while (Date.now() - start < maxWaitMs) {
+    const res = await ec2.send(new import_client_ec2.DescribeInstancesCommand({
+      InstanceIds: [instanceId]
+    }));
+    const inst = res.Reservations?.[0]?.Instances?.[0];
+    if (inst?.State?.Name === "running" && inst.PublicIpAddress) {
+      return inst.PublicIpAddress;
+    }
+    await sleep(5e3);
+  }
+  throw new Error(`Instance ${instanceId} did not reach running state within timeout`);
+}
+async function terminateInstance(ec2, instanceId) {
+  await ec2.send(new import_client_ec2.TerminateInstancesCommand({ InstanceIds: [instanceId] }));
+}
+async function deleteKeyPairAws(ec2, keyName) {
+  try {
+    await ec2.send(new import_client_ec2.DeleteKeyPairCommand({ KeyName: keyName }));
+  } catch (e) {
+    log.warn({ e, keyName }, "Failed to delete key pair");
+  }
+}
+async function deleteSecurityGroupAws(ec2, groupName) {
+  try {
+    const describe = await ec2.send(new import_client_ec2.DescribeSecurityGroupsCommand({
+      Filters: [{ Name: "group-name", Values: [groupName] }]
+    }));
+    const groupId = describe.SecurityGroups?.[0]?.GroupId;
+    if (groupId) {
+      await ec2.send(new import_client_ec2.DeleteSecurityGroupCommand({ GroupId: groupId }));
+    }
+  } catch (e) {
+    log.warn({ e, groupName }, "Failed to delete security group");
+  }
+}
+async function describeAllManagedInstances(ec2) {
+  const res = await ec2.send(new import_client_ec2.DescribeInstancesCommand({
+    Filters: [{ Name: "tag:pp:managed", Values: ["true"] }, { Name: "instance-state-name", Values: ["running", "pending", "stopping", "stopped"] }]
+  }));
+  return (res.Reservations ?? []).flatMap((r) => r.Instances ?? []);
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createPreviewSecurityGroup,
+  deleteKeyPairAws,
+  deleteSecurityGroupAws,
+  describeAllManagedInstances,
+  generateAndImportKeyPair,
+  generateSshKeyPair,
+  launchInstance,
+  makeEc2Client,
+  makeStsClient,
+  terminateInstance,
+  validateAwsCredentials,
+  waitForInstanceRunning
+});
+//# sourceMappingURL=ec2.js.map