@nexttylabs/echo 0.2.0

package/app/api/webhooks/[webhookId]/route.ts

@@ -0,0 +1,213 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/lib/auth/config";
+import { z } from "zod";
+import { db } from "@/lib/db";
+import { webhooks } from "@/lib/db/schema";
+import { eq, and } from "drizzle-orm";
+import { apiError, validationError } from "@/lib/api/errors";
+import { getCurrentOrganizationId } from "@/lib/auth/organization";
+import { WEBHOOK_EVENTS } from "@/lib/webhooks/events";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+const validEvents = Object.values(WEBHOOK_EVENTS);
+
+const updateWebhookSchema = z.object({
+  name: z.string().min(1).max(100).optional(),
+  url: z.string().url().optional(),
+  events: z.array(z.string().refine((e) => validEvents.includes(e as typeof validEvents[number]), {
+    message: "Invalid event type",
+  })).min(1).optional(),
+  enabled: z.boolean().optional(),
+});
+
+type RouteParams = {
+  params: Promise<{ webhookId: string }>;
+};
+
+/**
+ * GET /api/webhooks/:webhookId - Get Webhook details
+ */
+export async function GET(req: NextRequest, { params }: RouteParams) {
+  const session = await auth.api.getSession({ headers: req.headers });
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const organizationId = await getCurrentOrganizationId(session.user.id);
+  if (!organizationId) {
+    return NextResponse.json(
+      { error: "No organization selected" },
+      { status: 400 },
+    );
+  }
+
+  if (!db) {
+    return NextResponse.json({ error: "Database not configured" }, { status: 500 });
+  }
+
+  const { webhookId } = await params;
+  const id = parseInt(webhookId, 10);
+  if (isNaN(id)) {
+    return NextResponse.json({ error: "Invalid webhook ID" }, { status: 400 });
+  }
+
+  try {
+    const webhook = await db.query.webhooks.findFirst({
+      where: and(
+        eq(webhooks.webhookId, id),
+        eq(webhooks.organizationId, organizationId),
+      ),
+    });
+
+    if (!webhook) {
+      return NextResponse.json({ error: "Webhook not found" }, { status: 404 });
+    }
+
+    return NextResponse.json({
+      data: {
+        webhookId: webhook.webhookId,
+        name: webhook.name,
+        url: webhook.url,
+        events: webhook.events,
+        enabled: webhook.enabled,
+        createdAt: webhook.createdAt,
+        updatedAt: webhook.updatedAt,
+      },
+    });
+  } catch (error) {
+    return apiError(error);
+  }
+}
+
+/**
+ * PATCH /api/webhooks/:webhookId - Update Webhook
+ */
+export async function PATCH(req: NextRequest, { params }: RouteParams) {
+  const session = await auth.api.getSession({ headers: req.headers });
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const organizationId = await getCurrentOrganizationId(session.user.id);
+  if (!organizationId) {
+    return NextResponse.json(
+      { error: "No organization selected" },
+      { status: 400 },
+    );
+  }
+
+  if (!db) {
+    return NextResponse.json({ error: "Database not configured" }, { status: 500 });
+  }
+
+  const { webhookId } = await params;
+  const id = parseInt(webhookId, 10);
+  if (isNaN(id)) {
+    return NextResponse.json({ error: "Invalid webhook ID" }, { status: 400 });
+  }
+
+  try {
+    const body = await req.json();
+    const validated = updateWebhookSchema.parse(body);
+
+    const existing = await db.query.webhooks.findFirst({
+      where: and(
+        eq(webhooks.webhookId, id),
+        eq(webhooks.organizationId, organizationId),
+      ),
+    });
+
+    if (!existing) {
+      return NextResponse.json({ error: "Webhook not found" }, { status: 404 });
+    }
+
+    const result = await db
+      .update(webhooks)
+      .set(validated)
+      .where(eq(webhooks.webhookId, id))
+      .returning();
+
+    return NextResponse.json({
+      data: {
+        webhookId: result[0].webhookId,
+        name: result[0].name,
+        url: result[0].url,
+        events: result[0].events,
+        enabled: result[0].enabled,
+        createdAt: result[0].createdAt,
+        updatedAt: result[0].updatedAt,
+      },
+    });
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return validationError(error.issues);
+    }
+    return apiError(error);
+  }
+}
+
+/**
+ * DELETE /api/webhooks/:webhookId - Delete Webhook
+ */
+export async function DELETE(req: NextRequest, { params }: RouteParams) {
+  const session = await auth.api.getSession({ headers: req.headers });
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const organizationId = await getCurrentOrganizationId(session.user.id);
+  if (!organizationId) {
+    return NextResponse.json(
+      { error: "No organization selected" },
+      { status: 400 },
+    );
+  }
+
+  if (!db) {
+    return NextResponse.json({ error: "Database not configured" }, { status: 500 });
+  }
+
+  const { webhookId } = await params;
+  const id = parseInt(webhookId, 10);
+  if (isNaN(id)) {
+    return NextResponse.json({ error: "Invalid webhook ID" }, { status: 400 });
+  }
+
+  try {
+    const existing = await db.query.webhooks.findFirst({
+      where: and(
+        eq(webhooks.webhookId, id),
+        eq(webhooks.organizationId, organizationId),
+      ),
+    });
+
+    if (!existing) {
+      return NextResponse.json({ error: "Webhook not found" }, { status: 404 });
+    }
+
+    await db.delete(webhooks).where(eq(webhooks.webhookId, id));
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    return apiError(error);
+  }
+}

package/app/api/webhooks/github/route.ts

@@ -0,0 +1,158 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+import { createHmac, timingSafeEqual } from "crypto";
+import { db } from "@/lib/db";
+import { feedback, githubIntegrations } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+import { logger } from "@/lib/logger";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+interface GitHubWebhookPayload {
+  action: string;
+  issue: {
+    id: number;
+    number: number;
+    title: string;
+    state: "open" | "closed";
+    html_url: string;
+  };
+  repository: {
+    id: number;
+    full_name: string;
+    owner: {
+      login: string;
+    };
+    name: string;
+  };
+}
+
+function verifySignature(
+  payload: string,
+  signature: string,
+  secret: string,
+): boolean {
+  const expectedSig = `sha256=${createHmac("sha256", secret).update(payload).digest("hex")}`;
+  try {
+    return timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSig));
+  } catch {
+    return false;
+  }
+}
+
+export async function POST(req: NextRequest) {
+  if (!db) {
+    return NextResponse.json(
+      { error: "Database not configured" },
+      { status: 500 },
+    );
+  }
+
+  try {
+    const signature = req.headers.get("X-Hub-Signature-256");
+    const event = req.headers.get("X-GitHub-Event");
+    const body = await req.text();
+
+    if (!signature || !event) {
+      return NextResponse.json({ error: "Missing headers" }, { status: 401 });
+    }
+
+    const configs = await db.select().from(githubIntegrations);
+
+    let validConfig = null;
+    for (const config of configs) {
+      if (
+        config.webhookSecret &&
+        verifySignature(body, signature, config.webhookSecret)
+      ) {
+        validConfig = config;
+        break;
+      }
+    }
+
+    if (!validConfig) {
+      return NextResponse.json({ error: "Invalid signature" }, { status: 401 });
+    }
+
+    const payload: GitHubWebhookPayload = JSON.parse(body);
+
+    if (event === "issues") {
+      await handleIssueEvent(payload);
+    }
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    logger.error({ err: error }, "GitHub webhook error");
+    return NextResponse.json(
+      { error: "Webhook processing failed" },
+      { status: 500 },
+    );
+  }
+}
+
+async function handleIssueEvent(payload: GitHubWebhookPayload) {
+  if (!db) return;
+
+  const { action, issue } = payload;
+
+  if (!["closed", "reopened"].includes(action)) {
+    return;
+  }
+
+  const feedbackData = await db
+    .select()
+    .from(feedback)
+    .where(eq(feedback.githubIssueId, issue.id))
+    .limit(1)
+    .then((rows) => rows[0]);
+
+  if (!feedbackData) {
+    logger.info({ githubIssueId: issue.id }, "No associated feedback found");
+    return;
+  }
+
+  const statusMapping: Record<string, string> = {
+    closed: "completed",
+    reopened: "in-progress",
+  };
+
+  const newStatus = statusMapping[action];
+
+  if (newStatus && newStatus !== feedbackData.status) {
+    await db
+      .update(feedback)
+      .set({
+        status: newStatus,
+        githubStatus: issue.state,
+        githubSyncedAt: new Date(),
+      })
+      .where(eq(feedback.feedbackId, feedbackData.feedbackId));
+
+    logger.info(
+      {
+        feedbackId: feedbackData.feedbackId,
+        action,
+        oldStatus: feedbackData.status,
+        newStatus,
+      },
+      "Status synced from GitHub webhook",
+    );
+  }
+}

package/app/api/webhooks/route.ts

@@ -0,0 +1,143 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/lib/auth/config";
+import { z } from "zod";
+import { db } from "@/lib/db";
+import { webhooks } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+import { randomBytes } from "crypto";
+import { apiError, validationError } from "@/lib/api/errors";
+import { getCurrentOrganizationId } from "@/lib/auth/organization";
+import { WEBHOOK_EVENTS } from "@/lib/webhooks/events";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+const validEvents = Object.values(WEBHOOK_EVENTS);
+
+const createWebhookSchema = z.object({
+  name: z.string().min(1).max(100),
+  url: z.string().url(),
+  events: z.array(z.string().refine((e) => validEvents.includes(e as typeof validEvents[number]), {
+    message: "Invalid event type",
+  })).min(1),
+});
+
+/**
+ * GET /api/webhooks - List Webhooks
+ */
+export async function GET(req: NextRequest) {
+  const session = await auth.api.getSession({ headers: req.headers });
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const organizationId = await getCurrentOrganizationId(session.user.id);
+  if (!organizationId) {
+    return NextResponse.json(
+      { error: "No organization selected" },
+      { status: 400 },
+    );
+  }
+
+  if (!db) {
+    return NextResponse.json({ error: "Database not configured" }, { status: 500 });
+  }
+
+  try {
+    const hooks = await db.query.webhooks.findMany({
+      where: eq(webhooks.organizationId, organizationId),
+    });
+
+    const sanitized = hooks.map((h) => ({
+      webhookId: h.webhookId,
+      name: h.name,
+      url: h.url,
+      events: h.events,
+      enabled: h.enabled,
+      createdAt: h.createdAt,
+      updatedAt: h.updatedAt,
+    }));
+
+    return NextResponse.json({ data: sanitized });
+  } catch (error) {
+    return apiError(error);
+  }
+}
+
+/**
+ * POST /api/webhooks - Create Webhook
+ */
+export async function POST(req: NextRequest) {
+  const session = await auth.api.getSession({ headers: req.headers });
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const organizationId = await getCurrentOrganizationId(session.user.id);
+  if (!organizationId) {
+    return NextResponse.json(
+      { error: "No organization selected" },
+      { status: 400 },
+    );
+  }
+
+  if (!db) {
+    return NextResponse.json({ error: "Database not configured" }, { status: 500 });
+  }
+
+  try {
+    const body = await req.json();
+    const validated = createWebhookSchema.parse(body);
+
+    const secret = randomBytes(32).toString("hex");
+
+    const result = await db
+      .insert(webhooks)
+      .values({
+        organizationId,
+        name: validated.name,
+        url: validated.url,
+        events: validated.events,
+        secret,
+      })
+      .returning();
+
+    return NextResponse.json(
+      {
+        data: {
+          webhookId: result[0].webhookId,
+          name: result[0].name,
+          url: result[0].url,
+          events: result[0].events,
+          enabled: result[0].enabled,
+          secret,
+          createdAt: result[0].createdAt,
+          warning: "Save this secret now. You will not be able to see it again.",
+        },
+      },
+      { status: 201 },
+    );
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return validationError(error.issues);
+    }
+    return apiError(error);
+  }
+}

package/app/globals.css

@@ -0,0 +1,139 @@
+@import "tailwindcss";
+@import "tw-animate-css";
+@import "shadcn/tailwind.css";
+
+@custom-variant dark (&:is(.dark *));
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --font-sans: var(--font-sans);
+  --font-mono: var(--font-geist-mono);
+  --color-sidebar-ring: var(--sidebar-ring);
+  --color-sidebar-border: var(--sidebar-border);
+  --color-sidebar-accent-foreground: var(--sidebar-accent-foreground);
+  --color-sidebar-accent: var(--sidebar-accent);
+  --color-sidebar-primary-foreground: var(--sidebar-primary-foreground);
+  --color-sidebar-primary: var(--sidebar-primary);
+  --color-sidebar-foreground: var(--sidebar-foreground);
+  --color-sidebar: var(--sidebar);
+  --color-chart-5: var(--chart-5);
+  --color-chart-4: var(--chart-4);
+  --color-chart-3: var(--chart-3);
+  --color-chart-2: var(--chart-2);
+  --color-chart-1: var(--chart-1);
+  --color-ring: var(--ring);
+  --color-input: var(--input);
+  --color-border: var(--border);
+  --color-destructive: var(--destructive);
+  --color-accent-foreground: var(--accent-foreground);
+  --color-accent: var(--accent);
+  --color-muted-foreground: var(--muted-foreground);
+  --color-muted: var(--muted);
+  --color-secondary-foreground: var(--secondary-foreground);
+  --color-secondary: var(--secondary);
+  --color-primary-foreground: var(--primary-foreground);
+  --color-primary: var(--primary);
+  --color-popover-foreground: var(--popover-foreground);
+  --color-popover: var(--popover);
+  --color-card-foreground: var(--card-foreground);
+  --color-card: var(--card);
+  --radius-sm: calc(var(--radius) - 4px);
+  --radius-md: calc(var(--radius) - 2px);
+  --radius-lg: var(--radius);
+  --radius-xl: calc(var(--radius) + 4px);
+  --radius-2xl: calc(var(--radius) + 8px);
+  --radius-3xl: calc(var(--radius) + 12px);
+  --radius-4xl: calc(var(--radius) + 16px);
+}
+
+:root {
+  /* Portal colors - matching Featurebase vibrant blue */
+  --portal-primary: oklch(0.6 0.2 250);
+  --portal-primary-hover: oklch(0.55 0.22 250);
+  --portal-background: oklch(0.97 0 0);
+  --portal-card: oklch(1 0 0);
+  --portal-card-border: oklch(0.92 0 0);
+
+  --background: oklch(1 0 0);
+  --foreground: oklch(0.145 0 0);
+  --card: oklch(1 0 0);
+  --card-foreground: oklch(0.145 0 0);
+  --popover: oklch(1 0 0);
+  --popover-foreground: oklch(0.145 0 0);
+  --primary: oklch(0.205 0 0);
+  --primary-foreground: oklch(0.985 0 0);
+  --secondary: oklch(0.97 0 0);
+  --secondary-foreground: oklch(0.205 0 0);
+  --muted: oklch(0.97 0 0);
+  --muted-foreground: oklch(0.556 0 0);
+  --accent: oklch(0.97 0 0);
+  --accent-foreground: oklch(0.205 0 0);
+  --destructive: oklch(0.58 0.22 27);
+  --border: oklch(0.922 0 0);
+  --input: oklch(0.922 0 0);
+  --ring: oklch(0.708 0 0);
+  --chart-1: oklch(0.809 0.105 251.813);
+  --chart-2: oklch(0.623 0.214 259.815);
+  --chart-3: oklch(0.546 0.245 262.881);
+  --chart-4: oklch(0.488 0.243 264.376);
+  --chart-5: oklch(0.424 0.199 265.638);
+  --radius: 0.625rem;
+  --sidebar: oklch(0.985 0 0);
+  --sidebar-foreground: oklch(0.145 0 0);
+  --sidebar-primary: oklch(0.205 0 0);
+  --sidebar-primary-foreground: oklch(0.985 0 0);
+  --sidebar-accent: oklch(0.97 0 0);
+  --sidebar-accent-foreground: oklch(0.205 0 0);
+  --sidebar-border: oklch(0.922 0 0);
+  --sidebar-ring: oklch(0.708 0 0);
+}
+
+.dark {
+  --portal-primary: oklch(0.65 0.18 250);
+  --portal-primary-hover: oklch(0.7 0.2 250);
+  --portal-background: oklch(0.15 0 0);
+  --portal-card: oklch(0.2 0 0);
+  --portal-card-border: oklch(0.25 0 0);
+
+  --background: oklch(0.145 0 0);
+  --foreground: oklch(0.985 0 0);
+  --card: oklch(0.205 0 0);
+  --card-foreground: oklch(0.985 0 0);
+  --popover: oklch(0.205 0 0);
+  --popover-foreground: oklch(0.985 0 0);
+  --primary: oklch(0.87 0.00 0);
+  --primary-foreground: oklch(0.205 0 0);
+  --secondary: oklch(0.269 0 0);
+  --secondary-foreground: oklch(0.985 0 0);
+  --muted: oklch(0.269 0 0);
+  --muted-foreground: oklch(0.708 0 0);
+  --accent: oklch(0.371 0 0);
+  --accent-foreground: oklch(0.985 0 0);
+  --destructive: oklch(0.704 0.191 22.216);
+  --border: oklch(1 0 0 / 10%);
+  --input: oklch(1 0 0 / 15%);
+  --ring: oklch(0.556 0 0);
+  --chart-1: oklch(0.809 0.105 251.813);
+  --chart-2: oklch(0.623 0.214 259.815);
+  --chart-3: oklch(0.546 0.245 262.881);
+  --chart-4: oklch(0.488 0.243 264.376);
+  --chart-5: oklch(0.424 0.199 265.638);
+  --sidebar: oklch(0.205 0 0);
+  --sidebar-foreground: oklch(0.985 0 0);
+  --sidebar-primary: oklch(0.488 0.243 264.376);
+  --sidebar-primary-foreground: oklch(0.985 0 0);
+  --sidebar-accent: oklch(0.269 0 0);
+  --sidebar-accent-foreground: oklch(0.985 0 0);
+  --sidebar-border: oklch(1 0 0 / 10%);
+  --sidebar-ring: oklch(0.556 0 0);
+}
+
+@layer base {
+  * {
+    @apply border-border outline-ring/50;
+  }
+  body {
+    @apply bg-background text-foreground;
+  }
+}