@nexttylabs/echo 0.2.0

package/lib/middleware/rbac.ts

@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+import { getServerSession } from "@/lib/auth/session";
+import { hasPermission, type Permission, type UserRole } from "@/lib/auth/permissions";
+
+export async function requirePermission(
+  permission: Permission,
+  req: NextRequest
+): Promise<NextResponse> {
+  const session = await getServerSession(req);
+  const role = (session?.user as { role?: UserRole })?.role;
+
+  if (!role) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  if (!hasPermission(role, permission)) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  return NextResponse.next();
+}

package/lib/middleware/request-id.test.ts

@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, it, expect } from "bun:test";
+import { generateRequestId } from "./request-id";
+
+describe("generateRequestId", () => {
+  it("returns a UUID v4", () => {
+    const id = generateRequestId();
+    expect(id).toMatch(
+      /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
+    );
+  });
+});

package/lib/middleware/request-id.ts

@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function generateRequestId(): string {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+    return crypto.randomUUID();
+  }
+
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  bytes[6] = (bytes[6] & 0x0f) | 0x40;
+  bytes[8] = (bytes[8] & 0x3f) | 0x80;
+
+  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}

package/lib/middleware/request-logger.test.ts

@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, it, expect } from "bun:test";
+import { logRequest, logResponse } from "./request-logger";
+
+describe("request logger", () => {
+  it("returns reqId and logger with bindings", () => {
+    const req = new Request("http://localhost/api/health", {
+      headers: { "x-request-id": "req-123" },
+    });
+
+    const { log, reqId } = logRequest(req);
+
+    expect(reqId).toBe("req-123");
+    expect(log.bindings().reqId).toBe("req-123");
+  });
+
+  it("logs response without throwing", () => {
+    expect(() => logResponse("req-123", 200, 12)).not.toThrow();
+  });
+});

package/lib/middleware/request-logger.ts

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { logger } from "@/lib/logger";
+
+export function logRequest(req: Request) {
+  const reqId = req.headers.get("x-request-id") || "unknown";
+  const log = logger.child({ reqId });
+
+  log.info(
+    {
+      method: req.method,
+      url: req.url,
+      userAgent: req.headers.get("user-agent"),
+      referer: req.headers.get("referer"),
+    },
+    "Incoming request",
+  );
+
+  return { log, reqId };
+}
+
+export function logResponse(reqId: string, status: number, duration: number) {
+  const log = logger.child({ reqId });
+  log.info({ status, duration }, "Request completed");
+  return log;
+}

package/lib/middleware/with-rate-limit.ts

@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextRequest } from 'next/server';
+import { rateLimit, RateLimitConfig } from '@/lib/middleware/rate-limit';
+import { RATE_LIMITS } from '@/lib/config/rate-limits';
+
+export function withRateLimit(type: keyof typeof RATE_LIMITS) {
+  return async (req: NextRequest) => {
+    const config = RATE_LIMITS[type];
+    return rateLimit(req, config);
+  };
+}
+
+export function withCustomRateLimit(config: RateLimitConfig) {
+  return async (req: NextRequest) => {
+    return rateLimit(req, config);
+  };
+}

package/lib/portal/analytics.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function getEmptyPortalAnalytics() {
+  return { timeseries: [], topViewed: [], topVoted: [], topCommented: [] };
+}

package/lib/portal/contributors.ts

@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+interface ContributorStats {
+  votes: number;
+  comments: number;
+  accepted: number;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export function getContributorLevel(_stats: ContributorStats): number {
+  return 1;
+}

package/lib/portal/i18n.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function getDefaultPortalI18n() {
+  return { defaultLocale: "en", supportedLocales: ["en", "zh-CN", "jp"] };
+}

package/lib/portal/leaderboard-settings.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function getDefaultLeaderboardSettings() {
+  return { enabled: true, anonymizeUsers: false };
+}

package/lib/portal/modules.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function getDefaultPortalModules() {
+  return { feedback: true, roadmap: true, changelog: true };
+}

package/lib/portal/portal-copy.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function getDefaultPortalCopy() {
+  return { title: "反馈中心", description: "", ctaLabel: "提交反馈" };
+}

package/lib/portal/public-context.tsx

@@ -0,0 +1,110 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { eq } from "drizzle-orm";
+import { db } from "@/lib/db";
+import { organizations, organizationSettings } from "@/lib/db/schema";
+import type { PortalConfig } from "@/lib/db/schema";
+import type { PortalSection } from "@/components/portal/portal-tab-nav";
+import { FileText, Map, MessageSquare } from "lucide-react";
+
+export type PortalModulesConfig = NonNullable<PortalConfig["modules"]>;
+
+const defaultModules: PortalModulesConfig = {
+  feedback: true,
+  roadmap: true,
+  changelog: true,
+  help: true,
+};
+
+export async function getPortalPublicContext(organizationSlug: string) {
+  if (!db) return null;
+
+  const organization = await db.query.organizations.findFirst({
+    where: eq(organizations.slug, organizationSlug),
+  });
+
+  if (!organization) return null;
+
+  const [settings] = await db
+    .select({ portalConfig: organizationSettings.portalConfig })
+    .from(organizationSettings)
+    .where(eq(organizationSettings.organizationId, organization.id))
+    .limit(1);
+
+  const portalConfig = settings?.portalConfig ?? {};
+  const portalEnabled = portalConfig?.sharing?.enabled ?? true;
+  const modules = {
+    ...defaultModules,
+    ...(portalConfig.modules ?? {}),
+  };
+
+  const sharing = {
+    allowPublicVoting: portalConfig?.sharing?.allowPublicVoting ?? true,
+    allowPublicComments: portalConfig?.sharing?.allowPublicComments ?? false,
+    showVoteCount: portalConfig?.sharing?.showVoteCount ?? true,
+    showAuthor: portalConfig?.sharing?.showAuthor ?? false,
+  };
+
+  const seo = {
+    noIndex: portalConfig?.seo?.noIndex ?? false,
+  };
+
+  return {
+    organization,
+    portalConfig,
+    portalEnabled,
+    modules,
+    sharing,
+    seo,
+  };
+}
+
+export function getPortalSections(
+  organizationSlug: string,
+  modules: PortalModulesConfig,
+): PortalSection[] {
+  const baseHref = `/${organizationSlug}`;
+  const sections: PortalSection[] = [];
+
+  if (modules.feedback) {
+    sections.push({
+      label: "Feedback",
+      href: baseHref,
+      exact: true,
+      icon: <MessageSquare className="h-4 w-4" />,
+    });
+  }
+
+  if (modules.roadmap) {
+    sections.push({
+      label: "Roadmap",
+      href: `${baseHref}/roadmap`,
+      icon: <Map className="h-4 w-4" />,
+    });
+  }
+
+  if (modules.changelog) {
+    sections.push({
+      label: "Changelog",
+      href: `${baseHref}/changelog`,
+      icon: <FileText className="h-4 w-4" />,
+    });
+  }
+
+  return sections;
+}

package/lib/portal/seo.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function getDefaultPortalSeo() {
+  return { title: "反馈中心" };
+}

package/lib/portal/settings-context.ts

@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { auth } from "@/lib/auth/config";
+import { getUserOrganization } from "@/lib/auth/organization";
+import { db } from "@/lib/db";
+import { getPortalSettings } from "@/lib/services/portal-settings";
+import type { UserRole } from "@/lib/auth/permissions";
+
+export async function getPortalAdminContext() {
+  const session = await auth.api.getSession({ headers: await headers() });
+
+  if (!session?.user) {
+    redirect("/login");
+  }
+
+  if (!db) {
+    throw new Error("Database connection not available");
+  }
+
+  const organization = await getUserOrganization(db, session.user.id);
+  if (!organization) {
+    redirect("/settings/organizations/new");
+  }
+
+  const resolvedRole = (organization.role as UserRole) ?? "customer";
+  const isAdminOrPM = resolvedRole === "admin" || resolvedRole === "product_manager";
+
+  if (!isAdminOrPM) {
+    redirect("/settings/profile");
+  }
+
+  const portalConfig = await getPortalSettings(organization.id);
+
+  return {
+    organization,
+    portalConfig,
+    role: resolvedRole,
+  };
+}

package/lib/portal/sharing.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function getPortalShareMethods() {
+  return ["link", "widget", "embedded"] as const;
+}

package/lib/portal/sorting.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function getDefaultPortalSorting() {
+  return { order: "top" } as const;
+}

package/lib/portal/theme.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function getDefaultPortalTheme() {
+  return { name: "clean" };
+}