@nexttylabs/echo 0.2.0

package/app/api/organizations/[orgId]/members/route.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { buildListMembersHandler } from "./handler";
+import { auth } from "@/lib/auth/config";
+import { db } from "@/lib/db";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+if (!db) {
+  throw new Error("Database not initialized");
+}
+
+export const GET = buildListMembersHandler({ auth, db });

package/app/api/organizations/[orgId]/route.ts

@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { buildGetOrganizationHandler, buildUpdateOrganizationHandler } from "./handler";
+import { auth } from "@/lib/auth/config";
+import { db } from "@/lib/db";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+if (!db) {
+  throw new Error("Database not initialized");
+}
+
+export const GET = buildGetOrganizationHandler({ auth, db });
+export const PUT = buildUpdateOrganizationHandler({ auth, db });

package/app/api/organizations/handler.ts

@@ -0,0 +1,97 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextResponse } from "next/server";
+import { randomUUID } from "crypto";
+import { eq } from "drizzle-orm";
+import { createOrganizationSchema } from "@/lib/validations/organizations";
+import { organizations, organizationMembers } from "@/lib/db/schema";
+import { generateSlug } from "@/lib/utils/slug";
+import type { db as database } from "@/lib/db";
+
+type Database = NonNullable<typeof database>;
+
+type CreateOrganizationDeps = {
+  auth: {
+    api: {
+      getSession: (args: { headers: Headers }) => Promise<{ user: { id: string; role?: string } } | null>;
+    };
+  };
+  db: {
+    select: Database["select"];
+    transaction: Database["transaction"];
+  };
+};
+
+export function buildCreateOrganizationHandler(deps: CreateOrganizationDeps) {
+  return async function POST(req: Request) {
+    const session = await deps.auth.api.getSession({ headers: req.headers });
+    if (!session) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    if (session.user.role !== "admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    let body: unknown;
+    try {
+      body = await req.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid request body" }, { status: 400 });
+    }
+
+    const parsed = createOrganizationSchema.safeParse(body);
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: "Invalid request body", details: parsed.error.issues },
+        { status: 400 },
+      );
+    }
+
+    const { name, description } = parsed.data;
+
+    let slug = generateSlug(name);
+    let counter = 0;
+    while (true) {
+      const existing = await deps.db
+        .select()
+        .from(organizations)
+        .where(eq(organizations.slug, slug))
+        .limit(1);
+      if (!existing.length) break;
+      counter += 1;
+      slug = `${generateSlug(name)}-${counter}`;
+    }
+
+    const organizationId = randomUUID();
+
+    const [org] = await deps.db.transaction(async (tx) => {
+      const [created] = await tx
+        .insert(organizations)
+        .values({ id: organizationId, name, slug, description })
+        .returning();
+      await tx.insert(organizationMembers).values({
+        organizationId,
+        userId: session.user.id,
+        role: "admin",
+      });
+      return [created];
+    });
+
+    return NextResponse.json({ data: { ...org, description } }, { status: 201 });
+  };
+}

package/app/api/organizations/route.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { buildCreateOrganizationHandler } from "./handler";
+import { auth } from "@/lib/auth/config";
+import { db } from "@/lib/db";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+if (!db) {
+  throw new Error("Database not initialized");
+}
+
+export const POST = buildCreateOrganizationHandler({ auth, db });

package/app/api/tags/sync/route.ts

@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+import { headers } from "next/headers";
+import { eq } from "drizzle-orm";
+import { db } from "@/lib/db";
+import { tags, PREDEFINED_TAGS } from "@/lib/db/schema";
+import { auth } from "@/lib/auth/config";
+import { apiError } from "@/lib/api/errors";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function POST(req: NextRequest) {
+  if (!db) {
+    return NextResponse.json(
+      { error: "Database not configured", code: "DATABASE_NOT_CONFIGURED" },
+      { status: 500 },
+    );
+  }
+
+  try {
+    const session = await auth.api.getSession({ headers: await headers() });
+
+    if (!session?.user) {
+      return NextResponse.json(
+        { error: "Authentication required", code: "UNAUTHORIZED" },
+        { status: 401 },
+      );
+    }
+
+    const body = await req.json();
+    const { slug } = body;
+
+    if (!slug || typeof slug !== "string") {
+      return NextResponse.json(
+        { error: "Invalid slug", code: "VALIDATION_ERROR" },
+        { status: 400 },
+      );
+    }
+
+    const predefined = PREDEFINED_TAGS.find((t) => t.slug === slug);
+
+    if (!predefined) {
+      return NextResponse.json(
+        { error: "Unknown tag", code: "NOT_FOUND" },
+        { status: 400 },
+      );
+    }
+
+    let [tag] = await db
+      .select()
+      .from(tags)
+      .where(eq(tags.slug, slug))
+      .limit(1);
+
+    if (!tag) {
+      const [created] = await db
+        .insert(tags)
+        .values({
+          name: predefined.name,
+          slug: predefined.slug,
+          color: "#3b82f6",
+        })
+        .returning();
+      tag = created;
+    }
+
+    return NextResponse.json(tag);
+  } catch (error) {
+    return apiError(error);
+  }
+}

package/app/api/upload/handler.ts

@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextResponse } from "next/server";
+import { attachments } from "@/lib/db/schema";
+import { apiError, validationError } from "@/lib/api/errors";
+import type { FileValidationResult } from "@/lib/upload/file-validator";
+import type { db as database } from "@/lib/db";
+
+type Database = NonNullable<typeof database>;
+
+type UploadDeps = {
+  db: {
+    insert: Database["insert"];
+  };
+  validateFile: (file: File) => FileValidationResult;
+  saveFile: (file: File) => Promise<{ fileName: string; filePath: string; fullPath: string }>;
+};
+
+export function buildUploadHandler(deps: UploadDeps) {
+  return async function POST(req: Request) {
+    try {
+      const formData = await req.formData();
+      const feedbackIdRaw = formData.get("feedbackId");
+      const feedbackId = Number(feedbackIdRaw);
+
+      if (!feedbackIdRaw || Number.isNaN(feedbackId)) {
+        return validationError(undefined, "feedbackId is required");
+      }
+
+      const files = formData.getAll("files").filter(Boolean) as File[];
+
+      if (!files.length) {
+        return validationError(undefined, "No files provided");
+      }
+
+      const validationResults = files.map(deps.validateFile);
+      const invalid = validationResults.filter((result) => !result.valid);
+      if (invalid.length) {
+        return validationError(invalid, "Validation failed");
+      }
+
+      const saved = await Promise.all(
+        files.map(async (file) => {
+          const stored = await deps.saveFile(file);
+          const [attachment] = await deps.db
+            .insert(attachments)
+            .values({
+              feedbackId,
+              fileName: stored.fileName,
+              filePath: stored.filePath,
+              fileSize: file.size,
+              mimeType: file.type,
+            })
+            .returning();
+          return attachment;
+        }),
+      );
+
+      return NextResponse.json({ data: saved }, { status: 201 });
+    } catch (error) {
+      return apiError(error);
+    }
+  };
+}

package/app/api/upload/route.ts

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextResponse } from "next/server";
+import { buildUploadHandler } from "./handler";
+import { db } from "@/lib/db";
+import { saveFile } from "@/lib/upload/storage";
+import { validateFile } from "@/lib/upload/file-validator";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function POST(req: Request) {
+  if (!db) {
+    return NextResponse.json(
+      { error: "Database not configured", code: "DATABASE_NOT_CONFIGURED" },
+      { status: 500 },
+    );
+  }
+
+  const handler = buildUploadHandler({ db, saveFile, validateFile });
+  return handler(req);
+}

package/app/api/v1/feedback/[id]/route.ts

@@ -0,0 +1,276 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+import { requireApiKey } from "@/lib/middleware/api-key";
+import { db } from "@/lib/db";
+import { feedback } from "@/lib/db/schema";
+import { eq, and, isNull } from "drizzle-orm";
+import { z, ZodError } from "zod";
+import { logger } from "@/lib/logger";
+import { getOrgContext } from "@/lib/auth/org-context";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+const updateFeedbackSchema = z.object({
+  title: z.string().min(1).max(200).optional(),
+  description: z.string().max(5000).optional(),
+  type: z.enum(["bug", "feature", "issue", "other"]).optional(),
+  priority: z.enum(["low", "medium", "high"]).optional(),
+  status: z.enum(["new", "in-progress", "planned", "completed", "closed"]).optional(),
+});
+
+export async function GET(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const auth = await requireApiKey(req);
+  if (auth.error) return auth.error;
+
+  const { organizationId } = auth.context!;
+  const { id } = await params;
+  const feedbackId = parseInt(id);
+
+  if (isNaN(feedbackId)) {
+    return NextResponse.json(
+      { error: "Invalid feedback ID", code: "INVALID_ID" },
+      { status: 400 },
+    );
+  }
+
+  if (!db) {
+    return NextResponse.json(
+      { error: "Database not configured", code: "DATABASE_NOT_CONFIGURED" },
+      { status: 500 },
+    );
+  }
+
+  try {
+    const context = await getOrgContext({
+      request: req,
+      db,
+      organizationId,
+    });
+    const result = await db
+      .select()
+      .from(feedback)
+      .where(
+        and(
+          eq(feedback.feedbackId, feedbackId),
+          eq(feedback.organizationId, context.organizationId),
+          isNull(feedback.deletedAt),
+        ),
+      )
+      .limit(1);
+
+    if (result.length === 0) {
+      return NextResponse.json(
+        { error: "Feedback not found", code: "NOT_FOUND" },
+        { status: 404 },
+      );
+    }
+
+    return NextResponse.json({ data: result[0] });
+  } catch (error) {
+    if (error instanceof Error && error.message === "Missing organization") {
+      return NextResponse.json(
+        { error: "Organization ID is required", code: "MISSING_ORG_ID" },
+        { status: 400 },
+      );
+    }
+    logger.error({ err: error }, "API error");
+    return NextResponse.json(
+      { error: "Internal server error", code: "INTERNAL_ERROR" },
+      { status: 500 },
+    );
+  }
+}
+
+export async function PUT(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const auth = await requireApiKey(req);
+  if (auth.error) return auth.error;
+
+  const { organizationId } = auth.context!;
+  const { id } = await params;
+  const feedbackId = parseInt(id);
+
+  if (isNaN(feedbackId)) {
+    return NextResponse.json(
+      { error: "Invalid feedback ID", code: "INVALID_ID" },
+      { status: 400 },
+    );
+  }
+
+  if (!db) {
+    return NextResponse.json(
+      { error: "Database not configured", code: "DATABASE_NOT_CONFIGURED" },
+      { status: 500 },
+    );
+  }
+
+  try {
+    const context = await getOrgContext({
+      request: req,
+      db,
+      organizationId,
+    });
+    const body = await req.json();
+    const validated = updateFeedbackSchema.parse(body);
+
+    const existing = await db
+      .select()
+      .from(feedback)
+      .where(
+        and(
+          eq(feedback.feedbackId, feedbackId),
+          eq(feedback.organizationId, context.organizationId),
+          isNull(feedback.deletedAt),
+        ),
+      )
+      .limit(1);
+
+    if (existing.length === 0) {
+      return NextResponse.json(
+        { error: "Feedback not found", code: "NOT_FOUND" },
+        { status: 404 },
+      );
+    }
+
+    const result = await db
+      .update(feedback)
+      .set({
+        ...validated,
+        updatedAt: new Date(),
+      })
+      .where(
+        and(
+          eq(feedback.feedbackId, feedbackId),
+          eq(feedback.organizationId, context.organizationId),
+        ),
+      )
+      .returning();
+
+    logger.info({ feedbackId }, "Feedback updated via API");
+
+    return NextResponse.json({ data: result[0] });
+  } catch (error) {
+    if (error instanceof ZodError) {
+      return NextResponse.json(
+        {
+          error: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: error.issues,
+        },
+        { status: 400 },
+      );
+    }
+    if (error instanceof Error && error.message === "Missing organization") {
+      return NextResponse.json(
+        { error: "Organization ID is required", code: "MISSING_ORG_ID" },
+        { status: 400 },
+      );
+    }
+
+    logger.error({ err: error }, "API error");
+    return NextResponse.json(
+      { error: "Internal server error", code: "INTERNAL_ERROR" },
+      { status: 500 },
+    );
+  }
+}
+
+export async function DELETE(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const auth = await requireApiKey(req);
+  if (auth.error) return auth.error;
+
+  const { organizationId } = auth.context!;
+  const { id } = await params;
+  const feedbackId = parseInt(id);
+
+  if (isNaN(feedbackId)) {
+    return NextResponse.json(
+      { error: "Invalid feedback ID", code: "INVALID_ID" },
+      { status: 400 },
+    );
+  }
+
+  if (!db) {
+    return NextResponse.json(
+      { error: "Database not configured", code: "DATABASE_NOT_CONFIGURED" },
+      { status: 500 },
+    );
+  }
+
+  try {
+    const context = await getOrgContext({
+      request: req,
+      db,
+      organizationId,
+    });
+    const existing = await db
+      .select()
+      .from(feedback)
+      .where(
+        and(
+          eq(feedback.feedbackId, feedbackId),
+          eq(feedback.organizationId, context.organizationId),
+          isNull(feedback.deletedAt),
+        ),
+      )
+      .limit(1);
+
+    if (existing.length === 0) {
+      return NextResponse.json(
+        { error: "Feedback not found", code: "NOT_FOUND" },
+        { status: 404 },
+      );
+    }
+
+    await db
+      .update(feedback)
+      .set({ deletedAt: new Date() })
+      .where(
+        and(
+          eq(feedback.feedbackId, feedbackId),
+          eq(feedback.organizationId, context.organizationId),
+        ),
+      );
+
+    logger.info({ feedbackId }, "Feedback deleted via API");
+
+    return NextResponse.json({ success: true }, { status: 200 });
+  } catch (error) {
+    if (error instanceof Error && error.message === "Missing organization") {
+      return NextResponse.json(
+        { error: "Organization ID is required", code: "MISSING_ORG_ID" },
+        { status: 400 },
+      );
+    }
+    logger.error({ err: error }, "API error");
+    return NextResponse.json(
+      { error: "Internal server error", code: "INTERNAL_ERROR" },
+      { status: 500 },
+    );
+  }
+}