@nexttylabs/echo 0.2.0

package/app/(public)/feedback/[id]/page.tsx

@@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { notFound } from "next/navigation";
+import { headers } from "next/headers";
+import { getTranslations } from "next-intl/server";
+import { getFeedbackById } from "@/lib/feedback/get-feedback-by-id";
+import { db } from "@/lib/db";
+import { auth } from "@/lib/auth/config";
+import { FeedbackDetail } from "@/components/feedback/feedback-detail";
+import { PublicComments } from "@/components/comment/public-comments";
+import Link from "next/link";
+import { Button } from "@/components/ui/button";
+
+export const dynamic = "force-dynamic";
+interface PageProps {
+  params: Promise<{ id: string }>;
+}
+
+export async function generateMetadata({ params }: PageProps) {
+  const t = await getTranslations("feedback.detail");
+  const { id: rawId } = await params;
+  const id = Number(rawId);
+  if (!db || !rawId || Number.isNaN(id)) {
+    return { title: t("publicTitle") };
+  }
+
+  const result = await getFeedbackById(db, id);
+  if (!result || "deleted" in result) {
+    return { title: t("publicTitle") };
+  }
+
+  return {
+    title: t("publicTitle"),
+    description: t("publicDescription"),
+    openGraph: {
+      title: t("publicTitle"),
+      description: t("publicDescription"),
+      type: "website",
+    },
+  };
+}
+
+export default async function FeedbackDetailPage({ params }: PageProps) {
+  const t = await getTranslations("feedback.detail");
+  const { id: rawId } = await params;
+  const id = Number(rawId);
+  if (!db || !rawId || Number.isNaN(id)) {
+    notFound();
+  }
+
+  const result = await getFeedbackById(db, id);
+  if (!result || "deleted" in result) {
+    notFound();
+  }
+
+  const session = await auth.api.getSession({ headers: await headers() });
+  const isAuthenticated = !!session?.user;
+
+  return (
+    <div className="container mx-auto max-w-3xl px-4 py-8">
+      <div className="mb-6 flex flex-wrap items-center justify-between gap-3">
+        <h2 className="text-sm text-muted-foreground">{t("publicHeader")}</h2>
+        <div className="flex flex-wrap gap-2">
+          <Button asChild variant="outline" size="sm">
+            <Link href="/">{t("publicBackHome")}</Link>
+          </Button>
+          <Button asChild size="sm">
+            <Link href="/">{t("publicContinueSubmit")}</Link>
+          </Button>
+        </div>
+      </div>
+      <FeedbackDetail
+        feedback={{
+          ...result.feedback,
+          attachments: [],
+        }}
+      />
+      <PublicComments
+        feedbackId={id}
+        isAuthenticated={isAuthenticated}
+        organizationId={result.feedback.organizationId}
+        allowPublicComments={false}
+        className="mt-6"
+      />
+    </div>
+  );
+}

package/app/(public)/invite/[token]/page.tsx

@@ -0,0 +1,121 @@
+"use client";
+
+
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { useEffect, useMemo, useState } from "react";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { Button } from "@/components/ui/button";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from "@/components/ui/card";
+
+type InviteStatus =
+  | "loading"
+  | "success"
+  | "expired"
+  | "unauthorized"
+  | "error";
+
+
+export default function InviteAcceptPage({
+  params,
+}: {
+  params: { token: string };
+}) {
+  const t = useTranslations("invite");
+  const [status, setStatus] = useState<InviteStatus>("loading");
+
+  const token = useMemo(() => params.token, [params.token]);
+
+  useEffect(() => {
+    let active = true;
+
+    const acceptInvite = async () => {
+      try {
+        const res = await fetch("/api/invitations/accept", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ token }),
+        });
+
+        if (!active) return;
+
+        if (res.status === 401) {
+          setStatus("unauthorized");
+          return;
+        }
+
+        if (res.status === 410) {
+          setStatus("expired");
+          return;
+        }
+
+        if (!res.ok) {
+          setStatus("error");
+          return;
+        }
+
+        setStatus("success");
+      } catch {
+        if (active) setStatus("error");
+      }
+    };
+
+    acceptInvite();
+
+    return () => {
+      active = false;
+    };
+  }, [token]);
+
+  return (
+    <div className="min-h-screen bg-linear-to-br from-slate-50 via-white to-slate-100 px-4 py-12">
+      <div className="mx-auto w-full max-w-xl">
+        <Card>
+          <CardHeader>
+            <CardTitle>{t(`status.${status}.title`)}</CardTitle>
+            <CardDescription>{t(`status.${status}.description`)}</CardDescription>
+          </CardHeader>
+          <CardContent className="flex flex-col gap-3">
+            {status === "success" ? (
+              <Button asChild>
+                <Link href="/dashboard">{t("buttons.dashboard")}</Link>
+              </Button>
+            ) : null}
+            {status === "unauthorized" ? (
+              <Button asChild>
+                <Link href="/login">{t("buttons.login")}</Link>
+              </Button>
+            ) : null}
+            {status === "expired" || status === "error" ? (
+              <Button asChild variant="outline">
+                <Link href="/dashboard">{t("buttons.back")}</Link>
+              </Button>
+            ) : null}
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+}

package/app/(public)/page.tsx

@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Hero } from "@/components/landing/hero";
+
+export default function Page() {
+  return <Hero />;
+}

package/app/(public)/widget/[organizationId]/page.tsx

@@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { notFound } from "next/navigation";
+import { eq } from "drizzle-orm";
+import type { Metadata } from "next";
+import { db } from "@/lib/db";
+import { organizations, organizationSettings } from "@/lib/db/schema";
+import WidgetForm from "@/components/widget/widget-form";
+
+interface WidgetPageProps {
+  params: Promise<{
+    organizationId: string;
+  }>;
+  searchParams: Promise<{
+    theme?: string;
+    primaryColor?: string;
+    buttonText?: string;
+    position?: string;
+  }>;
+}
+
+export async function generateMetadata({
+  params,
+}: WidgetPageProps): Promise<Metadata> {
+  const { organizationId } = await params;
+
+  if (!db) {
+    return { title: "Feedback" };
+  }
+
+  const [organization] = await db
+    .select({ name: organizations.name })
+    .from(organizations)
+    .where(eq(organizations.id, organizationId))
+    .limit(1);
+
+  return {
+    title: organization?.name || "Feedback",
+    robots: "noindex, nofollow",
+  };
+}
+
+export default async function WidgetPage({
+  params,
+  searchParams,
+}: WidgetPageProps) {
+  if (!db) {
+    return notFound();
+  }
+
+  const { organizationId } = await params;
+  const resolvedSearchParams = await searchParams;
+
+  const [organization] = await db
+    .select({ id: organizations.id, name: organizations.name })
+    .from(organizations)
+    .where(eq(organizations.id, organizationId))
+    .limit(1);
+
+  if (!organization) {
+    return notFound();
+  }
+
+  const [settings] = await db
+    .select({ widgetConfig: organizationSettings.widgetConfig })
+    .from(organizationSettings)
+    .where(eq(organizationSettings.organizationId, organizationId))
+    .limit(1);
+
+  const widgetConfig = settings?.widgetConfig || {};
+
+  const config = {
+    theme:
+      (resolvedSearchParams.theme as "light" | "dark" | "auto") ||
+      widgetConfig.theme ||
+      "auto",
+    primaryColor:
+      resolvedSearchParams.primaryColor || widgetConfig.primaryColor || "#3b82f6",
+    buttonText: resolvedSearchParams.buttonText
+      ? decodeURIComponent(resolvedSearchParams.buttonText)
+      : widgetConfig.buttonText || "Feedback",
+    position:
+      resolvedSearchParams.position ||
+      widgetConfig.buttonPosition ||
+      "bottom-right",
+    fields: widgetConfig.fields || {
+      showType: true,
+      showPriority: true,
+      showDescription: true,
+      requireEmail: false,
+    },
+    types: widgetConfig.types || ["bug", "feature", "issue"],
+    customCSS: widgetConfig.customCSS || "",
+  };
+
+  return (
+    <WidgetForm
+      organization={{
+        id: organization.id,
+        name: organization.name,
+      }}
+      config={config}
+    />
+  );
+}
+
+export const dynamic = "force-dynamic";

package/app/api/_utils.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextResponse } from 'next/server';
+
+export function setRateLimitHeaders(
+  response: NextResponse,
+  rateLimit: { limit: number; remaining: number; resetAt: string }
+): NextResponse {
+  response.headers.set('X-RateLimit-Limit', String(rateLimit.limit));
+  response.headers.set('X-RateLimit-Remaining', String(rateLimit.remaining));
+  response.headers.set('X-RateLimit-Reset', rateLimit.resetAt);
+
+  return response;
+}

package/app/api/admin/backup/route.ts

@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+import { getServerSession } from "@/lib/auth/session";
+import { hasPermission, PERMISSIONS, type UserRole } from "@/lib/auth/permissions";
+import {
+  backupDatabase,
+  listBackups,
+  getBackupConfig,
+} from "@/lib/services/backup";
+import { apiError } from "@/lib/api/errors";
+
+export async function POST(req: NextRequest) {
+  try {
+    const session = await getServerSession(req);
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const role = (session.user as { role: UserRole }).role;
+    if (!role || !hasPermission(role, PERMISSIONS.BACKUP_CREATE)) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const config = getBackupConfig();
+
+    backupDatabase(config).catch(console.error);
+
+    return NextResponse.json({
+      success: true,
+      message: "Backup started",
+    });
+  } catch (error) {
+    return apiError(error);
+  }
+}
+
+export async function GET(req: NextRequest) {
+  try {
+    const session = await getServerSession(req);
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const role = (session.user as { role: UserRole }).role;
+    if (!role || !hasPermission(role, PERMISSIONS.BACKUP_VIEW)) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const config = getBackupConfig();
+    const backups = await listBackups(config);
+
+    return NextResponse.json({ backups });
+  } catch (error) {
+    return apiError(error);
+  }
+}

package/app/api/api-keys/[keyId]/route.ts

@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/lib/auth/config";
+import { deleteApiKey, toggleApiKey } from "@/lib/services/api-keys";
+import { apiError } from "@/lib/api/errors";
+import { getCurrentOrganizationId } from "@/lib/auth/organization";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+type RouteParams = {
+  params: Promise<{ keyId: string }>;
+};
+
+/**
+ * DELETE /api/api-keys/:keyId - Delete API Key
+ */
+export async function DELETE(req: NextRequest, { params }: RouteParams) {
+  const session = await auth.api.getSession({ headers: req.headers });
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const organizationId = await getCurrentOrganizationId(session.user.id);
+  if (!organizationId) {
+    return NextResponse.json(
+      { error: "No organization selected" },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const { keyId } = await params;
+    await deleteApiKey(parseInt(keyId), organizationId);
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    return apiError(error);
+  }
+}
+
+/**
+ * PATCH /api/api-keys/:keyId - Update API Key (toggle disabled)
+ */
+export async function PATCH(req: NextRequest, { params }: RouteParams) {
+  const session = await auth.api.getSession({ headers: req.headers });
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const organizationId = await getCurrentOrganizationId(session.user.id);
+  if (!organizationId) {
+    return NextResponse.json(
+      { error: "No organization selected" },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const body = await req.json();
+    const { disabled } = body;
+
+    if (typeof disabled !== "boolean") {
+      return NextResponse.json(
+        { error: "disabled field is required (boolean)" },
+        { status: 400 },
+      );
+    }
+
+    const { keyId } = await params;
+    await toggleApiKey(parseInt(keyId), organizationId, disabled);
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    return apiError(error);
+  }
+}

package/app/api/api-keys/route.ts

@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/lib/auth/config";
+import { z } from "zod";
+import { createApiKey, listApiKeys } from "@/lib/services/api-keys";
+import { apiError, validationError } from "@/lib/api/errors";
+import { getCurrentOrganizationId } from "@/lib/auth/organization";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+const createKeySchema = z.object({
+  name: z.string().min(1).max(100),
+  expiresInDays: z.number().min(1).max(365).optional(),
+});
+
+/**
+ * GET /api/api-keys - List API Keys
+ */
+export async function GET(req: NextRequest) {
+  const session = await auth.api.getSession({ headers: req.headers });
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const organizationId = await getCurrentOrganizationId(session.user.id);
+  if (!organizationId) {
+    return NextResponse.json(
+      { error: "No organization selected" },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const keys = await listApiKeys(organizationId);
+
+    const sanitized = keys.map((k) => ({
+      keyId: k.keyId,
+      name: k.name,
+      prefix: k.prefix,
+      displayKey: `${k.prefix}...`,
+      disabled: k.disabled,
+      lastUsed: k.lastUsed,
+      createdAt: k.createdAt,
+    }));
+
+    return NextResponse.json({ data: sanitized });
+  } catch (error) {
+    return apiError(error);
+  }
+}
+
+/**
+ * POST /api/api-keys - Create API Key
+ */
+export async function POST(req: NextRequest) {
+  const session = await auth.api.getSession({ headers: req.headers });
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const organizationId = await getCurrentOrganizationId(session.user.id);
+  if (!organizationId) {
+    return NextResponse.json(
+      { error: "No organization selected" },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const body = await req.json();
+    const validated = createKeySchema.parse(body);
+
+    const { key, record } = await createApiKey(
+      organizationId,
+      validated.name,
+      validated.expiresInDays,
+    );
+
+    return NextResponse.json(
+      {
+        data: {
+          keyId: record.keyId,
+          name: record.name,
+          prefix: record.prefix,
+          key,
+          disabled: record.disabled,
+          createdAt: record.createdAt,
+          warning: "Save this key now. You will not be able to see it again.",
+        },
+      },
+      { status: 201 },
+    );
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return validationError(error.issues);
+    }
+    return apiError(error);
+  }
+}

package/app/api/auth/[...all]/route.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2026 Echo Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { auth } from "@/lib/auth/config";
+import { toNextJsHandler } from "better-auth/next-js";
+
+export const { GET, POST } = toNextJsHandler(auth);