@ripla/godd-mcp 0.1.2-beta-20260312091403

package/notes-api/app/schemas/auth.py

@@ -0,0 +1,45 @@
+"""Auth-related Pydantic schemas."""
+
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+
+
+class LoginRequest(BaseModel):
+    """Login request body."""
+
+    username: str
+    password: str
+
+
+class TokenResponse(BaseModel):
+    """Login/refresh response with access token."""
+
+    access_token: str = Field(..., alias="accessToken")
+    user: "UserInfo"
+    expires_at: str = Field(..., alias="expiresAt")
+
+    model_config = {"populate_by_name": True}
+
+
+class UserInfo(BaseModel):
+    """Minimal user info in token response."""
+
+    id: str
+    username: str
+    display_name: str = Field(..., alias="displayName")
+    role: str
+
+    model_config = {"populate_by_name": True}
+
+
+class ChangePasswordRequest(BaseModel):
+    """Change password request."""
+
+    current_password: str = Field(..., alias="currentPassword")
+    new_password: str = Field(..., min_length=8, alias="newPassword")
+
+    model_config = {"populate_by_name": True}
+
+
+TokenResponse.model_rebuild()

package/notes-api/app/schemas/user.py

@@ -0,0 +1,41 @@
+"""User-related Pydantic schemas."""
+
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+
+
+class UserCreate(BaseModel):
+    """Create user request."""
+
+    username: str
+    display_name: str = Field(..., alias="displayName")
+    password: str
+    role: str
+
+    model_config = {"populate_by_name": True}
+
+
+class UserUpdate(BaseModel):
+    """Update user request (partial)."""
+
+    display_name: str | None = Field(None, alias="displayName")
+    role: str | None = None
+    password: str | None = None
+
+    model_config = {"populate_by_name": True}
+
+
+class UserResponse(BaseModel):
+    """User response (no password)."""
+
+    id: str
+    username: str
+    display_name: str = Field(..., alias="displayName")
+    role: str
+    failed_login_attempts: int | None = None
+    locked_until: datetime | None = None
+    created_at: datetime
+    updated_at: datetime
+
+    model_config = {"populate_by_name": True, "from_attributes": True}

package/notes-api/app/security.py

@@ -0,0 +1,94 @@
+"""JWT authentication and password hashing."""
+
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+import bcrypt
+import jwt
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from app.config import settings
+
+HTTP_BEARER = HTTPBearer(auto_error=False)
+
+
+def hash_password(plain: str) -> str:
+    """Hash password with bcrypt."""
+    return bcrypt.hashpw(plain.encode("utf-8"), bcrypt.gensalt(rounds=12)).decode("utf-8")
+
+
+def verify_password(plain: str, hashed: str) -> bool:
+    """Verify password against hash."""
+    return bcrypt.checkpw(plain.encode("utf-8"), hashed.encode("utf-8"))
+
+
+def create_access_token(
+    sub: str,
+    username: str,
+    display_name: str,
+    role: str,
+) -> str:
+    """Create JWT access token."""
+    now = datetime.now(timezone.utc)
+    exp = now + timedelta(minutes=settings.jwt_access_expires_min)
+    payload = {
+        "sub": sub,
+        "username": username,
+        "displayName": display_name,
+        "role": role,
+        "exp": exp,
+        "iat": now,
+    }
+    return jwt.encode(
+        payload,
+        settings.jwt_secret,
+        algorithm="HS256",
+    )
+
+
+def verify_access_token(token: str) -> dict[str, Any]:
+    """Verify JWT and return payload."""
+    try:
+        payload = jwt.decode(
+            token,
+            settings.jwt_secret,
+            algorithms=["HS256"],
+        )
+        return payload
+    except jwt.InvalidTokenError:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token",
+        )
+
+
+async def auth_dependency(
+    credentials: HTTPAuthorizationCredentials | None = Depends(HTTP_BEARER),
+) -> dict[str, Any]:
+    """FastAPI dependency: require valid JWT Bearer token."""
+    if not credentials or not credentials.credentials:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Authorization header required",
+        )
+    return verify_access_token(credentials.credentials)
+
+
+def require_role(*roles: str):
+    """Return dependency that checks user has one of the given roles."""
+
+    async def _check(
+        payload: dict[str, Any] = Depends(auth_dependency),
+    ) -> dict[str, Any]:
+        role = payload.get("role")
+        if not role or role not in roles:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Insufficient permissions",
+            )
+        return payload
+
+    return _check

package/notes-api/app/services/__init__.py

@@ -0,0 +1 @@
+"""Business logic services."""

package/notes-api/app/services/audit.py

@@ -0,0 +1,25 @@
+"""Audit log service."""
+
+from uuid import UUID
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models import NotesAuditLog
+
+
+async def audit_log(
+    db: AsyncSession,
+    user_id: UUID | None,
+    action: str,
+    ip_address: str | None = None,
+    detail: dict | None = None,
+) -> None:
+    """Record an audit log entry."""
+    entry = NotesAuditLog(
+        user_id=user_id,
+        action=action,
+        ip_address=ip_address,
+        detail=detail,
+    )
+    db.add(entry)
+    await db.flush()

package/notes-api/app/services/business_date.py

@@ -0,0 +1,38 @@
+"""Business date calculation."""
+
+from __future__ import annotations
+
+from datetime import datetime
+from zoneinfo import ZoneInfo
+
+
+def compute_business_date(now: datetime, start_hour: int, timezone: str) -> str:
+    """Compute business date. Hours before start_hour count as previous day."""
+    tz = ZoneInfo(timezone)
+    local = now.astimezone(tz)
+    if local.hour < start_hour:
+        from datetime import timedelta
+
+        prev = local - timedelta(days=1)
+        return prev.strftime("%Y-%m-%d")
+    return local.strftime("%Y-%m-%d")
+
+
+async def get_business_date(db, now: datetime | None = None) -> str:
+    """Get business date from settings. db is AsyncSession."""
+    from sqlalchemy import select
+
+    from app.models import NotesSetting
+
+    if now is None:
+        now = datetime.now(ZoneInfo("UTC"))
+
+    result = await db.execute(select(NotesSetting).where(NotesSetting.key == "business_day_start_hour"))
+    row = result.scalar_one_or_none()
+    start_hour = int(row.value) if row else 6
+
+    result = await db.execute(select(NotesSetting).where(NotesSetting.key == "timezone"))
+    row = result.scalar_one_or_none()
+    tz = str(row.value) if row else "Asia/Tokyo"
+
+    return compute_business_date(now, start_hour, tz)

package/notes-api/app/services/github.py

@@ -0,0 +1,140 @@
+"""GitHub Contents API client."""
+
+from __future__ import annotations
+
+import httpx
+from app.config import settings
+
+
+def get_github_config() -> dict:
+    """Get GitHub config from settings."""
+    if not settings.github_token:
+        raise ValueError("GITHUB_TOKEN is required. Set it in .env or environment variables.")
+    return {
+        "token": settings.github_token,
+        "owner": settings.github_owner,
+        "repo": settings.github_repo,
+        "branch": settings.github_branch,
+        "docs_path": settings.docs_path,
+    }
+
+
+def get_mock_tree() -> list:
+    """Mock tree for demo mode."""
+    return [
+        {"name": "README.md", "path": "docs/README.md", "type": "file"},
+        {
+            "name": "001_project",
+            "path": "docs/001_project",
+            "type": "dir",
+            "children": [
+                {"name": "README.md", "path": "docs/001_project/README.md", "type": "file"},
+                {"name": "features.csv", "path": "docs/001_project/features.csv", "type": "file"},
+            ],
+        },
+        {
+            "name": "002_business_flow",
+            "path": "docs/002_business_flow",
+            "type": "dir",
+            "children": [
+                {"name": "README.md", "path": "docs/002_business_flow/README.md", "type": "file"},
+                {"name": "flow-overview.drawio", "path": "docs/002_business_flow/flow-overview.drawio", "type": "file"},
+            ],
+        },
+    ]
+
+
+def get_mock_file_content(file_path: str) -> dict:
+    """Mock file content for demo mode."""
+    return {
+        "path": file_path,
+        "content": f"# {file_path}\n\nこのファイルはモックデータです。\n\nGITHUB_TOKEN を設定すると、実際のリポジトリからドキュメントが読み込まれます。",
+        "sha": "mock-sha",
+        "size": 100,
+        "encoding": "utf-8",
+    }
+
+
+async def fetch_directory_tree(dir_path: str, config: dict) -> list:
+    """Fetch directory tree from GitHub Contents API."""
+    url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/contents/{dir_path}?ref={config['branch']}"
+    async with httpx.AsyncClient() as client:
+        resp = await client.get(
+            url,
+            headers={
+                "Authorization": f"Bearer {config['token']}",
+                "Accept": "application/vnd.github.v3+json",
+                "User-Agent": "ripla-docs-api",
+            },
+        )
+        resp.raise_for_status()
+    entries = resp.json()
+    if not isinstance(entries, list):
+        return []
+
+    entries.sort(key=lambda e: (0 if e.get("type") == "dir" else 1, e.get("name", "")))
+    tree = []
+    for entry in entries:
+        if entry.get("type") == "dir":
+            children = await fetch_directory_tree(entry["path"], config)
+            tree.append({"name": entry["name"], "path": entry["path"], "type": "dir", "children": children})
+        elif entry.get("type") == "file":
+            tree.append({"name": entry["name"], "path": entry["path"], "type": "file"})
+    return tree
+
+
+async def fetch_file_content(file_path: str, config: dict) -> dict:
+    """Fetch file content from GitHub."""
+    url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/contents/{file_path}?ref={config['branch']}"
+    async with httpx.AsyncClient() as client:
+        resp = await client.get(
+            url,
+            headers={
+                "Authorization": f"Bearer {config['token']}",
+                "Accept": "application/vnd.github.v3+json",
+                "User-Agent": "ripla-docs-api",
+            },
+        )
+        resp.raise_for_status()
+    entry = resp.json()
+    if entry.get("type") != "file":
+        raise ValueError(f"{file_path} is not a file")
+
+    content = ""
+    if entry.get("content") and entry.get("encoding") == "base64":
+        import base64
+
+        content = base64.b64decode(entry["content"]).decode("utf-8")
+    return {
+        "path": entry["path"],
+        "content": content,
+        "sha": entry["sha"],
+        "size": entry.get("size", 0),
+        "encoding": "utf-8",
+    }
+
+
+async def fetch_file_commits(file_path: str, config: dict) -> list:
+    """Fetch file commit history from GitHub."""
+    url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/commits?path={file_path}&sha={config['branch']}&per_page=10"
+    async with httpx.AsyncClient() as client:
+        resp = await client.get(
+            url,
+            headers={
+                "Authorization": f"Bearer {config['token']}",
+                "Accept": "application/vnd.github.v3+json",
+                "User-Agent": "ripla-docs-api",
+            },
+        )
+        if resp.status_code != 200:
+            return []
+    data = resp.json()
+    return [
+        {
+            "sha": c["sha"][:7],
+            "message": c["commit"]["message"].split("\n")[0],
+            "author": c["commit"]["author"]["name"],
+            "date": c["commit"]["author"]["date"],
+        }
+        for c in data
+    ]

package/notes-api/app/services/github_pr.py

@@ -0,0 +1,120 @@
+"""GitHub PR and branch operations."""
+
+from __future__ import annotations
+
+import httpx
+from app.config import settings
+
+
+def _config() -> dict:
+    if not settings.github_token:
+        raise ValueError("GITHUB_TOKEN required")
+    return {
+        "token": settings.github_token,
+        "owner": settings.github_owner,
+        "repo": settings.github_repo,
+        "branch": settings.github_branch,
+    }
+
+
+def _headers(config: dict) -> dict:
+    return {
+        "Authorization": f"Bearer {config['token']}",
+        "Accept": "application/vnd.github.v3+json",
+        "User-Agent": "ripla-docs-api",
+        "Content-Type": "application/json",
+    }
+
+
+async def get_branch_sha(branch_name: str, config: dict) -> str:
+    """Get latest commit SHA of a branch."""
+    url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/git/ref/heads/{branch_name}"
+    async with httpx.AsyncClient() as client:
+        resp = await client.get(url, headers=_headers(config))
+        resp.raise_for_status()
+    return resp.json()["object"]["sha"]
+
+
+async def create_branch(branch_name: str, base_sha: str, config: dict) -> None:
+    """Create a new branch."""
+    url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/git/refs"
+    async with httpx.AsyncClient() as client:
+        resp = await client.post(
+            url,
+            headers=_headers(config),
+            json={"ref": f"refs/heads/{branch_name}", "sha": base_sha},
+        )
+        if resp.status_code not in (200, 201):
+            body = resp.text
+            if "422" not in str(resp.status_code) and "Reference already exists" not in body:
+                resp.raise_for_status()
+
+
+async def delete_branch(branch_name: str, config: dict) -> None:
+    """Delete a branch."""
+    url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/git/refs/heads/{branch_name}"
+    async with httpx.AsyncClient() as client:
+        resp = await client.delete(url, headers=_headers(config))
+        if resp.status_code not in (200, 204, 422):
+            resp.raise_for_status()
+
+
+async def commit_file(
+    branch_name: str,
+    file_path: str,
+    content: str,
+    message: str,
+    existing_sha: str | None,
+    config: dict,
+) -> dict:
+    """Create or update file via Contents API."""
+    import base64
+
+    url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/contents/{file_path}"
+    body = {
+        "message": message,
+        "content": base64.b64encode(content.encode("utf-8")).decode("ascii"),
+        "branch": branch_name,
+    }
+    if existing_sha:
+        body["sha"] = existing_sha
+    async with httpx.AsyncClient() as client:
+        resp = await client.put(url, headers=_headers(config), json=body)
+        resp.raise_for_status()
+    return {"sha": resp.json()["content"]["sha"]}
+
+
+async def find_open_auto_prs(config: dict) -> list:
+    """Find open PRs with docs-auto label."""
+    url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/pulls?state=open&per_page=100"
+    async with httpx.AsyncClient() as client:
+        resp = await client.get(url, headers=_headers(config))
+        resp.raise_for_status()
+    prs = resp.json()
+    return [p for p in prs if any(l.get("name") == "docs-auto" for l in p.get("labels", []))]
+
+
+async def create_pr(title: str, head: str, base: str, body: str, labels: list[str], config: dict) -> dict:
+    """Create a PR."""
+    url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/pulls"
+    async with httpx.AsyncClient() as client:
+        resp = await client.post(
+            url,
+            headers=_headers(config),
+            json={"title": title, "head": head, "base": base, "body": body, "draft": False},
+        )
+        resp.raise_for_status()
+    pr = resp.json()
+    if labels:
+        label_url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/issues/{pr['number']}/labels"
+        async with httpx.AsyncClient() as client:
+            await client.post(label_url, headers=_headers(config), json={"labels": labels})
+    return pr
+
+
+async def close_pr(pr_number: int, config: dict) -> None:
+    """Close a PR."""
+    url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/pulls/{pr_number}"
+    async with httpx.AsyncClient() as client:
+        resp = await client.patch(url, headers=_headers(config), json={"state": "closed"})
+        resp.raise_for_status()