feat: initial scaffold - backend, frontend, Prisma schema, Docker

- Prisma schema: User, Session, RepoConfig, Preview, Job, WebhookToken, NoConfigComment, AdminSettings - Backend: auth (login/logout/me/first-user setup), webhook handler with HMAC verification, EC2 service, SSH service, deploy pipeline, job queue worker, cron workers - Frontend: Login with first-user detection, Dashboard, PreviewDetail with live log streaming, Settings, Repos config, Admin panel, SetupWizard, Privacy page - Docker Compose and Dockerfile for self-hosted deployment - Uses bcryptjs for Node 24 compatibility Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-07-25 00:18:08 +02:00
parent ca2efdadea
commit 40d484bede
108 changed files with 13393 additions and 0 deletions
@@ -0,0 +1,182 @@
+import bcrypt from "bcryptjs";
+import { randomBytes } from "crypto";
+import { prisma } from "../../lib/db";
+import { makeResponse } from "../../lib/response";
+import { ERROR_MESSAGES } from "../../lib/errors";
+import { encrypt, decrypt } from "../../lib/encryption";
+import { validateGiteaUrl } from "../../services/gitea";
+import { validateAwsCredentials } from "../../services/ec2";
+import { env } from "../../lib/env";
+
+function requireAuth(ctr: any) {
+  const auth = ctr.getAuth?.();
+  if (!auth?.success) return null;
+  return auth.user;
+}
+
+export async function getUserSettings(ctr: any) {
+  const user = requireAuth(ctr);
+  if (!user) return makeResponse({ ctr, content: { code: ERROR_MESSAGES.UNAUTHORIZED.code, message: ERROR_MESSAGES.UNAUTHORIZED.message } });
+
+  const webhookToken = await prisma.webhookToken.findUnique({ where: { userId: user.id } });
+  const fullUser = await prisma.user.findUnique({ where: { id: user.id } });
+
+  return makeResponse({
+    ctr, content: {
+      code: 200, data: {
+        id: user.id,
+        username: user.username,
+        giteaUsername: fullUser?.giteaUsername,
+        giteaInstanceUrl: fullUser?.giteaInstanceUrl,
+        giteaPatSet: !!fullUser?.giteaPAT,
+        awsAccessKeyId: fullUser?.awsAccessKeyId ? "****" : null,
+        awsRegion: fullUser?.awsRegion,
+        webhookUrl: `${env.PP_BASE_URL}/webhook/${user.id}`,
+        webhookSecret: webhookToken?.token ? "••••••••" : null,
+        webhookTokenExists: !!webhookToken,
+      }
+    }
+  });
+}
+
+export async function updateUsername(ctr: any) {
+  const user = requireAuth(ctr);
+  if (!user) return makeResponse({ ctr, content: { code: 401, message: ERROR_MESSAGES.UNAUTHORIZED.message } });
+  const body = await ctr.body();
+  const { username } = body || {};
+  if (!username || typeof username !== "string") return makeResponse({ ctr, content: { code: 400, message: "Username required" } });
+
+  const existing = await prisma.user.findFirst({ where: { username, id: { not: user.id } } });
+  if (existing) return makeResponse({ ctr, content: { code: 409, message: "Username already taken" } });
+
+  await prisma.user.update({ where: { id: user.id }, data: { username } });
+  return makeResponse({ ctr, content: { code: 200, message: "Username updated" } });
+}
+
+export async function updatePassword(ctr: any) {
+  const user = requireAuth(ctr);
+  if (!user) return makeResponse({ ctr, content: { code: 401, message: ERROR_MESSAGES.UNAUTHORIZED.message } });
+  const body = await ctr.body();
+  const { currentPassword, newPassword } = body || {};
+  if (!currentPassword || !newPassword) return makeResponse({ ctr, content: { code: 400, message: "Current and new passwords required" } });
+
+  const fullUser = await prisma.user.findUnique({ where: { id: user.id } });
+  if (!fullUser) return makeResponse({ ctr, content: { code: 404, message: "User not found" } });
+
+  const valid = await bcrypt.compare(currentPassword, fullUser.passwordHash);
+  if (!valid) return makeResponse({ ctr, content: { code: 401, message: "Current password incorrect" } });
+
+  const hash = await bcrypt.hash(newPassword, 12);
+  await prisma.user.update({ where: { id: user.id }, data: { passwordHash: hash } });
+  return makeResponse({ ctr, content: { code: 200, message: "Password updated" } });
+}
+
+export async function updateGitea(ctr: any) {
+  const user = requireAuth(ctr);
+  if (!user) return makeResponse({ ctr, content: { code: 401, message: ERROR_MESSAGES.UNAUTHORIZED.message } });
+  const body = await ctr.body();
+  const { giteaInstanceUrl, giteaUsername, giteaPAT } = body || {};
+
+  if (!giteaInstanceUrl || !giteaUsername) {
+    return makeResponse({ ctr, content: { code: 400, message: "Gitea URL and username required" } });
+  }
+
+  const cleanUrl = giteaInstanceUrl.replace(/\/+$/, "");
+  const validation = await validateGiteaUrl(cleanUrl);
+  if (!validation.success) {
+    return makeResponse({ ctr, content: { code: 400, message: `Gitea validation failed: ${validation.error}` } });
+  }
+
+  const data: any = { giteaInstanceUrl: cleanUrl, giteaUsername };
+  if (giteaPAT) data.giteaPAT = encrypt(giteaPAT);
+
+  await prisma.user.update({ where: { id: user.id }, data });
+  return makeResponse({ ctr, content: { code: 200, message: `Connected to Gitea ${validation.version}`, data: { version: validation.version } } });
+}
+
+export async function updateAws(ctr: any) {
+  const user = requireAuth(ctr);
+  if (!user) return makeResponse({ ctr, content: { code: 401, message: ERROR_MESSAGES.UNAUTHORIZED.message } });
+  const body = await ctr.body();
+  const { awsAccessKeyId, awsSecretAccessKey, awsRegion } = body || {};
+
+  if (!awsAccessKeyId || !awsSecretAccessKey || !awsRegion) {
+    return makeResponse({ ctr, content: { code: 400, message: "AWS credentials and region required" } });
+  }
+
+  const tempUser = {
+    ...user,
+    awsAccessKeyId: encrypt(awsAccessKeyId),
+    awsSecretAccessKey: encrypt(awsSecretAccessKey),
+    awsRegion,
+  };
+  const validation = await validateAwsCredentials(tempUser as any);
+  if (!validation.success) {
+    return makeResponse({ ctr, content: { code: 400, message: `AWS validation failed: ${validation.error}` } });
+  }
+
+  await prisma.user.update({
+    where: { id: user.id },
+    data: {
+      awsAccessKeyId: encrypt(awsAccessKeyId),
+      awsSecretAccessKey: encrypt(awsSecretAccessKey),
+      awsRegion,
+    },
+  });
+
+  return makeResponse({ ctr, content: { code: 200, message: `Connected as ${validation.arn}`, data: { arn: validation.arn } } });
+}
+
+export async function getWebhookSecret(ctr: any) {
+  const user = requireAuth(ctr);
+  if (!user) return makeResponse({ ctr, content: { code: 401, message: ERROR_MESSAGES.UNAUTHORIZED.message } });
+
+  let token = await prisma.webhookToken.findUnique({ where: { userId: user.id } });
+  if (!token) {
+    const secret = randomBytes(32).toString("hex");
+    token = await prisma.webhookToken.create({ data: { userId: user.id, token: secret } });
+  }
+
+  return makeResponse({ ctr, content: { code: 200, data: { token: token.token } } });
+}
+
+export async function regenerateWebhookSecret(ctr: any) {
+  const user = requireAuth(ctr);
+  if (!user) return makeResponse({ ctr, content: { code: 401, message: ERROR_MESSAGES.UNAUTHORIZED.message } });
+
+  const newSecret = randomBytes(32).toString("hex");
+  await prisma.webhookToken.upsert({
+    where: { userId: user.id },
+    update: { token: newSecret },
+    create: { userId: user.id, token: newSecret },
+  });
+
+  const fullUser = await prisma.user.findUnique({ where: { id: user.id } });
+  if (!fullUser?.giteaInstanceUrl) {
+    return makeResponse({ ctr, content: { code: 200, message: "Secret regenerated (no Gitea hooks to update)", data: { token: newSecret } } });
+  }
+
+  const configs = await prisma.repoConfig.findMany({
+    where: { userId: user.id, giteaWebhookId: { not: null } },
+  });
+
+  const { updateWebhookSecret } = await import("../../services/gitea");
+  const webhookUrl = `${env.PP_BASE_URL}/webhook/${user.id}`;
+  const errors: string[] = [];
+
+  for (const config of configs) {
+    try {
+      await updateWebhookSecret(fullUser as any, config.repoOwner, config.repoName, config.giteaWebhookId!, webhookUrl, newSecret);
+    } catch (e: any) {
+      errors.push(`${config.repoOwner}/${config.repoName}: ${e.message}`);
+    }
+  }
+
+  return makeResponse({
+    ctr, content: {
+      code: 200,
+      message: errors.length ? `Secret regenerated with ${errors.length} hook update errors` : "Secret regenerated and all hooks updated",
+      data: { token: newSecret, errors },
+    }
+  });
+}