@naviyra/cloud-panel 0.0.0-stage → 0.0.1

package/apps/panel/app/api/[...path]/route.js

@@ -0,0 +1,445 @@
+import bcrypt from "bcryptjs";
+import { randomUUID } from "node:crypto";
+import { cookies } from "next/headers";
+import { db } from "../../../lib/db.mjs";
+import { session, signIn } from "../../../lib/auth.mjs";
+import { agent, reconcile } from "../../../lib/agent.mjs";
+import { projectInput, idSchema, MAX_ZIP_BYTES } from "@naviyra/shared";
+import {
+  listDatabases,
+  createDatabase,
+  deleteDatabase,
+  resetDatabasePassword,
+} from "../../../lib/databases.mjs";
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+const attempts = (globalThis.naviyraAttempts ||= new Map());
+const json = (data, status = 200) =>
+  Response.json(data, { status, headers: { "Cache-Control": "no-store" } });
+async function readJson(req) {
+  if (Number(req.headers.get("content-length")) > 8192)
+    throw Object.assign(Error("Request too large"), { status: 413 });
+  const text = await req.text();
+  if (text.length > 8192)
+    throw Object.assign(Error("Request too large"), { status: 413 });
+  return JSON.parse(text);
+}
+async function handle(req, { params }) {
+  try {
+    const parts = (await params).path;
+    const route = parts.join("/");
+    const method = req.method;
+    if (method !== "GET") {
+      const expected = process.env.PUBLIC_ORIGIN || new URL(req.url).origin;
+      if (req.headers.get("origin") !== expected)
+        return json({ error: "Invalid request origin" }, 403);
+    }
+    if (route === "auth/login" && method === "POST") {
+      const body = await readJson(req);
+      const email = String(body.email || "")
+        .toLowerCase()
+        .trim();
+      const password = String(body.password || "");
+      if (email.length > 254 || password.length > 256)
+        return json({ error: "Invalid email or password" }, 400);
+      const now = Date.now();
+      for (const [key, value] of attempts)
+        if (value.until < now) attempts.delete(key);
+      if (attempts.size > 10000)
+        return json({ error: "Login temporarily unavailable" }, 429);
+      const entry = attempts.get(email) || {
+        count: 0,
+        until: now + 15 * 60 * 1000,
+      };
+      if (entry.count >= 10)
+        return json(
+          { error: "Too many attempts. Try again in 15 minutes." },
+          429,
+        );
+      entry.count++;
+      attempts.set(email, entry);
+      const user = (
+        await db.query("SELECT * FROM users WHERE email=$1", [email])
+      ).rows[0];
+      const valid = await bcrypt.compare(
+        password,
+        user?.password_hash ||
+          "$2b$12$C6UzMDM.H6dfI/f/IKcEe.5S1cNcq73EqEaGcAfRm4BSNTPTzBrme",
+      );
+      if (!user || !valid)
+        return json({ error: "Invalid email or password" }, 401);
+      await signIn(user);
+      attempts.delete(email);
+      return json({ ok: true });
+    }
+    if (route === "auth/logout" && method === "POST") {
+      (await cookies()).delete("naviyra_session");
+      return json({ ok: true });
+    }
+    const user = await session();
+    if (!user) return json({ error: "Please sign in" }, 401);
+    if (route === "me") return json(user);
+    if (method !== "GET" && user.role !== "admin")
+      return json({ error: "Administrator access required" }, 403);
+    if (route === "system" && method === "GET") {
+      try {
+        return json(await agent("/system/metrics"));
+      } catch (error) {
+        return json({ available: false, error: error.message }, 503);
+      }
+    }
+    if (route === "databases" && method === "GET")
+      return json(await listDatabases(user.id));
+    if (route === "databases" && method === "POST") {
+      const body = await readJson(req);
+      const created = await createDatabase(
+        user.id,
+        body.name,
+        body.engine,
+      );
+      await db.query(
+        "INSERT INTO audit_logs(user_id,action) VALUES($1,$2)",
+        [user.id, "database.create"],
+      );
+      return json(created, 201);
+    }
+    const databaseRoute = route.match(
+      /^databases\/([0-9a-f-]{36})(\/password)?$/i,
+    );
+    if (databaseRoute) {
+      const id = databaseRoute[1];
+      if (
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
+          id,
+        )
+      )
+        return json({ error: "Not found" }, 404);
+      if (databaseRoute[2] && method === "POST") {
+        const reset = await resetDatabasePassword(user.id, id);
+        await db.query(
+          "INSERT INTO audit_logs(user_id,action) VALUES($1,$2)",
+          [user.id, "database.password"],
+        );
+        return json(reset);
+      }
+      if (!databaseRoute[2] && method === "DELETE") {
+        await deleteDatabase(user.id, id);
+        await db.query(
+          "INSERT INTO audit_logs(user_id,action) VALUES($1,$2)",
+          [user.id, "database.delete"],
+        );
+        return json({ ok: true });
+      }
+      return json({ error: "Method not allowed" }, 405);
+    }
+    if (route === "projects" && method === "GET") {
+      const rows = (
+        await db.query(
+          "SELECT * FROM projects WHERE user_id=$1 ORDER BY created_at DESC",
+          [user.id],
+        )
+      ).rows;
+      const projects = await Promise.all(
+        rows.map(async (p) => {
+          try {
+            return await reconcile(p);
+          } catch (error) {
+            return { ...p, agent_error: error.message };
+          }
+        }),
+      );
+      return json(projects);
+    }
+    if (route === "projects" && method === "POST") {
+      const input = projectInput.parse(await readJson(req));
+      const id = randomUUID();
+      const host = (
+        await db.query("SELECT id FROM agents WHERE name='primary'")
+      ).rows[0];
+      if (!host)
+        throw Error("Run npm run db:seed to register the primary agent");
+      const result = await db.query(
+        "INSERT INTO projects(id,user_id,agent_id,name,subdomain,source_type,git_url,type,runtime_config) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9) RETURNING *",
+        [
+          id,
+          user.id,
+          host.id,
+          input.name,
+          input.subdomain,
+          input.source_type,
+          input.git_url,
+          input.type,
+          JSON.stringify(input.runtime_config),
+        ],
+      );
+      try {
+        await agent("/projects", {
+          method: "POST",
+          body: JSON.stringify({ id, ...input }),
+        });
+      } catch (error) {
+        await db.query("UPDATE projects SET status='failed' WHERE id=$1", [id]);
+        return json(
+          { ...result.rows[0], status: "failed", agent_error: error.message },
+          201,
+        );
+      }
+      await db.query(
+        "INSERT INTO audit_logs(user_id,project_id,action) VALUES($1,$2,$3)",
+        [user.id, id, "project.create"],
+      );
+      return json(result.rows[0], 201);
+    }
+    if (parts[0] === "cloudflare") {
+      const cfId = /^[a-f0-9]{32}$/i;
+      const audit = async (action) => {
+        await db.query(
+          "INSERT INTO audit_logs(user_id,action) VALUES($1,$2)",
+          [user.id, action],
+        );
+      };
+      if (route === "cloudflare/status" && method === "GET")
+        return json(await agent("/cloudflare/status"));
+      if (route === "cloudflare/login" && method === "GET")
+        return json(await agent("/cloudflare/login"));
+      if (route === "cloudflare/login" && method === "POST")
+        return json(await agent("/cloudflare/login", { method: "POST" }), 202);
+      if (route === "cloudflare/api-login" && method === "GET")
+        return json(await agent("/cloudflare/api-login"));
+      if (route === "cloudflare/api-login" && method === "POST")
+        return json(
+          await agent("/cloudflare/api-login", { method: "POST" }),
+          202,
+        );
+      if (route === "cloudflare/dns" && method === "GET")
+        return json(await agent("/cloudflare/dns"));
+      if (
+        parts.length === 3 &&
+        parts[1] === "dns" &&
+        method === "GET" &&
+        cfId.test(parts[2])
+      )
+        return json(await agent(`/cloudflare/dns/${parts[2]}`));
+      if (
+        parts.length === 3 &&
+        parts[1] === "dns" &&
+        method === "PUT" &&
+        cfId.test(parts[2])
+      ) {
+        const result = await agent(`/cloudflare/dns/${parts[2]}`, {
+          method: "PUT",
+          body: JSON.stringify(await readJson(req)),
+        });
+        await audit("dns.record.update");
+        return json(result);
+      }
+      if (route === "cloudflare/email" && method === "GET")
+        return json(await agent("/cloudflare/email"));
+      if (route === "cloudflare/email/routing" && method === "POST") {
+        const result = await agent("/cloudflare/email/routing", {
+          method: "POST",
+          body: JSON.stringify(await readJson(req)),
+        });
+        await audit(result.enabled ? "email.enable" : "email.disable");
+        return json(result);
+      }
+      if (route === "cloudflare/email/rules" && method === "POST") {
+        const result = await agent("/cloudflare/email/rules", {
+          method: "POST",
+          body: JSON.stringify(await readJson(req)),
+        });
+        await audit("email.rule.create");
+        return json(result, 201);
+      }
+      if (
+        parts.length === 4 &&
+        parts[1] === "email" &&
+        parts[2] === "rules" &&
+        cfId.test(parts[3]) &&
+        method === "PUT"
+      ) {
+        const result = await agent(`/cloudflare/email/rules/${parts[3]}`, {
+          method: "PUT",
+          body: JSON.stringify(await readJson(req)),
+        });
+        await audit("email.rule.update");
+        return json(result);
+      }
+      if (
+        parts.length === 4 &&
+        parts[1] === "email" &&
+        parts[2] === "rules" &&
+        cfId.test(parts[3]) &&
+        method === "DELETE"
+      ) {
+        const result = await agent(
+          `/cloudflare/email/rules/${parts[3]}?domain=${encodeURIComponent(new URL(req.url).searchParams.get("domain") || "")}`,
+          { method: "DELETE" },
+        );
+        await audit("email.rule.delete");
+        return json(result);
+      }
+      if (route === "cloudflare/email/addresses" && method === "POST") {
+        const result = await agent("/cloudflare/email/addresses", {
+          method: "POST",
+          body: JSON.stringify(await readJson(req)),
+        });
+        await audit("email.address.create");
+        return json(result, 201);
+      }
+      if (
+        parts.length === 4 &&
+        parts[1] === "email" &&
+        parts[2] === "addresses" &&
+        cfId.test(parts[3]) &&
+        method === "DELETE"
+      ) {
+        const result = await agent(`/cloudflare/email/addresses/${parts[3]}`, {
+          method: "DELETE",
+        });
+        await audit("email.address.delete");
+        return json(result);
+      }
+      return json({ error: "Not found" }, 404);
+    }
+    if (parts[0] === "projects" && parts[1]) {
+      const id = idSchema.parse(parts[1]);
+      const action = parts[2];
+      const project = (
+        await db.query("SELECT * FROM projects WHERE id=$1 AND user_id=$2", [
+          id,
+          user.id,
+        ])
+      ).rows[0];
+      if (!project) return json({ error: "Project not found" }, 404);
+      if (method === "GET" && !action) {
+        let current = project;
+        try {
+          current = await reconcile(project);
+        } catch (error) {
+          current = { ...project, agent_error: error.message };
+        }
+        const deployments = (
+          await db.query(
+            "SELECT * FROM deployments WHERE project_id=$1 ORDER BY created_at DESC LIMIT 20",
+            [id],
+          )
+        ).rows;
+        return json({ ...current, deployments });
+      }
+      if (method === "GET" && ["logs", "metrics"].includes(action))
+        return json(await agent(`/projects/${id}/${action}`));
+      if (method === "PUT" && action === "source") {
+        if (project.source_type !== "zip")
+          return json({ error: "This project uses Git" }, 400);
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of req.body) {
+          size += chunk.byteLength;
+          if (size > MAX_ZIP_BYTES)
+            return json({ error: "ZIP limit is 25 MB" }, 413);
+          chunks.push(Buffer.from(chunk));
+        }
+        await agent("/projects", {
+          method: "POST",
+          body: JSON.stringify(project),
+        });
+        return json(
+          await agent(`/projects/${id}/source`, {
+            method: "PUT",
+            headers: { "Content-Type": "application/zip" },
+            body: Buffer.concat(chunks),
+          }),
+        );
+      }
+      if (method === "POST" && action === "deploy") {
+        // Idempotent registration also repairs a prior panel-to-agent network failure.
+        await agent("/projects", {
+          method: "POST",
+          body: JSON.stringify(project),
+        });
+        await reconcile(project);
+        const deploymentId = randomUUID();
+        await db.query(
+          "INSERT INTO deployments(id,project_id,status,source_type) VALUES($1,$2,'queued',$3)",
+          [deploymentId, id, project.source_type],
+        );
+        try {
+          const remote = await agent(`/projects/${id}/deploy`, {
+            method: "POST",
+            body: JSON.stringify({ deployment_id: deploymentId }),
+          });
+          await db.query("UPDATE projects SET status=$2 WHERE id=$1", [
+            id,
+            remote.status,
+          ]);
+          await db.query(
+            "INSERT INTO audit_logs(user_id,project_id,action) VALUES($1,$2,$3)",
+            [user.id, id, "project.deploy"],
+          );
+          return json({ id: deploymentId, status: remote.status }, 202);
+        } catch (error) {
+          // A timed-out POST may have been accepted. Reconcile before declaring failure.
+          let accepted = false;
+          try {
+            const remote = await agent(`/projects/${id}`);
+            accepted = remote.deployment_id === deploymentId;
+          } catch {}
+          if (!accepted)
+            await db.query(
+              "UPDATE deployments SET status='failed',error=$2,finished_at=now() WHERE id=$1",
+              [deploymentId, error.message],
+            );
+          throw error;
+        }
+      }
+      if (method === "POST" && action === "restart") {
+        const result = await agent(`/projects/${id}/restart`, {
+          method: "POST",
+        });
+        await db.query(
+          "INSERT INTO audit_logs(user_id,project_id,action) VALUES($1,$2,$3)",
+          [user.id, id, "project.restart"],
+        );
+        return json(result);
+      }
+      if (method === "DELETE" && !action) {
+        try {
+          await agent(`/projects/${id}`, { method: "DELETE" });
+        } catch (error) {
+          if (error.status !== 404) throw error;
+        }
+        await db.query("DELETE FROM projects WHERE id=$1", [id]);
+        await db.query(
+          "INSERT INTO audit_logs(user_id,project_id,action) VALUES($1,$2,$3)",
+          [user.id, id, "project.delete"],
+        );
+        return json({ ok: true });
+      }
+    }
+    return json({ error: "Not found" }, 404);
+  } catch (error) {
+    if (error.code === "23505")
+      return json(
+        { error: "Name, hostname, or active deployment already exists" },
+        409,
+      );
+    if (error.name === "ZodError")
+      return json(
+        { error: error.issues.map((i) => i.message).join(". ") },
+        400,
+      );
+    console.error("[panel API]", error.message);
+    return json(
+      {
+        error: error.status
+          ? error.message
+          : error instanceof SyntaxError
+            ? "Invalid JSON"
+            : "Operation failed. Check the panel and agent logs.",
+      },
+      error.status || (error instanceof SyntaxError ? 400 : 500),
+    );
+  }
+}
+export { handle as GET, handle as POST, handle as PUT, handle as DELETE };