hanoman 0.1.24 → 0.1.25

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.24",
-  "sha": "3024ec0",
-  "builtAt": "2026-08-10T03:28:41.335Z"
+  "version": "0.1.25",
+  "sha": "53d6464",
+  "builtAt": "2026-08-10T04:26:46.836Z"
 }

package/dist/server.js

@@ -26094,10 +26094,64 @@ async function pruneOldTickets(now = Date.now()) {
   }
 }
 
+// src/services/ticket-intake.ts
+init_db();
+var TICKET_UPLOAD = {
+  MAX_FILES: 3,
+  MAX_BYTES: 5 * 1024 * 1024,
+  OK_MIME: /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp"])
+};
+async function parseTicketUpload(req) {
+  const fields = {};
+  const files = [];
+  try {
+    for await (const part of req.parts()) {
+      if (part.type === "file") {
+        const buf = await part.toBuffer();
+        if (part.file?.truncated || !TICKET_UPLOAD.OK_MIME.has(part.mimetype) || files.length >= TICKET_UPLOAD.MAX_FILES) continue;
+        files.push({ buf, mime: part.mimetype, name: String(part.filename ?? "gambar") });
+      } else {
+        fields[part.fieldname] = String(part.value ?? "");
+      }
+    }
+  } catch {
+    return null;
+  }
+  return { fields, files };
+}
+async function intakeTicket(input) {
+  const { ticket, key } = await createTicket({
+    projectId: input.projectId,
+    category: input.category,
+    title: input.title,
+    detail: input.detail,
+    reporterEmail: input.reporterEmail
+  });
+  await notifySynced("ticket", ticket.id);
+  for (const f of input.files) {
+    const { storageKey, size } = await saveUpload(f.buf, f.mime);
+    const att = await prisma.ticketAttachment.create({
+      data: {
+        ticketId: ticket.id,
+        projectId: input.projectId,
+        filename: f.name.slice(0, 200),
+        mimeType: f.mime,
+        size,
+        storageKey
+      }
+    });
+    await notifySynced("ticketAttachment", att.id);
+  }
+  await recordNewTicket(ticket.id, input.projectId, input.projectName, input.category, input.title);
+  void pruneOldTickets();
+  return { ticket, key };
+}
+
 // src/services/help-ratelimit.ts
 init_config2();
 var ipBuckets = /* @__PURE__ */ new Map();
 var projBuckets = /* @__PURE__ */ new Map();
+var acctBuckets = /* @__PURE__ */ new Map();
 function take(map, k, cap, now) {
   const b = map.get(k) ?? { tokens: cap, ts: now };
   b.tokens = Math.min(cap, b.tokens + (now - b.ts) * cap / 6e4);
@@ -26115,13 +26169,15 @@ function helpRateOk(projectId, ip, now = Date.now()) {
   const projCap = effectiveInt("HANOMAN_HELP_RATE_PER_MIN_PROJECT") ?? 20;
   return take(ipBuckets, ip, ipCap, now) && take(projBuckets, projectId, projCap, now);
 }
+function portalTicketRateOk(userId, projectId, now = Date.now()) {
+  const acctCap = effectiveInt("HANOMAN_PORTAL_TICKET_RATE_PER_MIN") ?? 5;
+  const projCap = effectiveInt("HANOMAN_HELP_RATE_PER_MIN_PROJECT") ?? 20;
+  return take(acctBuckets, userId, acctCap, now) && take(projBuckets, projectId, projCap, now);
+}
 
 // src/routes/help.ts
 var CATEGORIES = ["bug", "fitur", "pertanyaan", "lainnya"];
 var HONEYPOT_FIELD = "hc_trap";
-var OK_MIME = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp"]);
-var MAX_FILES2 = 3;
-var MAX_BYTES = 5 * 1024 * 1024;
 var zField = external_exports.object({
   category: zTicketCategory,
   title: external_exports.string().min(1).max(200),
@@ -26141,21 +26197,9 @@ async function help_default(app2) {
     if (!p || !p.helpEnabled) return reply.code(404).send({ error: "not found" });
     if (!helpRateOk(slug, req.ip)) return reply.code(429).send({ error: "terlalu banyak permintaan" });
     if (!req.isMultipart?.()) return reply.code(400).send({ error: "butuh multipart/form-data" });
-    const fields = {};
-    const files = [];
-    try {
-      for await (const part of req.parts()) {
-        if (part.type === "file") {
-          const buf = await part.toBuffer();
-          if (part.file?.truncated || !OK_MIME.has(part.mimetype) || files.length >= MAX_FILES2) continue;
-          files.push({ buf, mime: part.mimetype, name: String(part.filename ?? "gambar") });
-        } else {
-          fields[part.fieldname] = String(part.value ?? "");
-        }
-      }
-    } catch {
-      return reply.code(400).send({ error: "unggahan tak valid" });
-    }
+    const upload = await parseTicketUpload(req);
+    if (!upload) return reply.code(400).send({ error: "unggahan tak valid" });
+    const { fields, files } = upload;
     if (fields[HONEYPOT_FIELD]) {
       console.warn(`help: honeypot terpicu \xB7 project=${slug} ip=${req.ip}`);
       return reply.code(200).send({ ok: true });
@@ -26167,23 +26211,15 @@ async function help_default(app2) {
       email: fields.email
     });
     if (!parsed.success) return reply.code(400).send({ error: "field wajib tak lengkap / tak valid" });
-    const { ticket, key } = await createTicket({
+    const { ticket, key } = await intakeTicket({
       projectId: slug,
+      projectName: p.name,
       category: parsed.data.category,
       title: parsed.data.title,
       detail: parsed.data.detail,
-      reporterEmail: parsed.data.email
+      reporterEmail: parsed.data.email,
+      files
     });
-    await notifySynced("ticket", ticket.id);
-    for (const f of files) {
-      const { storageKey, size } = await saveUpload(f.buf, f.mime);
-      const att = await prisma.ticketAttachment.create({
-        data: { ticketId: ticket.id, projectId: slug, filename: f.name.slice(0, 200), mimeType: f.mime, size, storageKey }
-      });
-      await notifySynced("ticketAttachment", att.id);
-    }
-    await recordNewTicket(ticket.id, slug, p.name, parsed.data.category, parsed.data.title);
-    void pruneOldTickets();
     const statusPath = `/help/${encodeURIComponent(slug)}/status/${encodeURIComponent(key)}`;
     return reply.code(201).send({ number: ticket.number, key, statusPath });
   });
@@ -30038,18 +30074,20 @@ async function webhooks_default(app2) {
 }
 
 // src/routes/portal.ts
+init_zod();
 init_src();
 init_db();
 
 // src/services/client-access.ts
 init_db();
 var segments = (path) => path.replace(/^\/api\/?/, "").replace(/\/+$/, "").split("/").filter(Boolean);
+var isPortalTicketSubmit = (method, seg) => method === "POST" && seg.length === 4 && seg[1] === "projects" && seg[3] === "tickets";
 function clientRouteAllowed(method, path) {
   const seg = segments(path);
   if (seg.includes("..")) return false;
   const top = seg[0] ?? "";
   const read = method === "GET" || method === "HEAD";
-  if (top === "portal") return read;
+  if (top === "portal") return read || isPortalTicketSubmit(method, seg);
   if (top === "help") return true;
   if (top === "auth") {
     const sub = seg[1] ?? "";
@@ -30071,6 +30109,11 @@ async function hasProjectAccess(userId, projectId) {
 
 // src/routes/portal.ts
 var NOT_FOUND = { error: "not found" };
+var zPortalTicket = external_exports.object({
+  category: zTicketCategory,
+  title: external_exports.string().min(1).max(200),
+  detail: external_exports.string().min(1).max(1e4)
+});
 async function specStages(ids) {
   const wanted = [...new Set(ids.filter((v) => !!v))];
   if (!wanted.length) return /* @__PURE__ */ new Map();
@@ -30113,6 +30156,31 @@ async function portal_default(app2) {
     const stages = await specStages([t.specId]);
     return toPortalTicketDetail(t, stages.get(t.specId ?? "") ?? null);
   });
+  app2.post("/portal/projects/:id/tickets", async (req, reply) => {
+    const { id } = req.params;
+    const p = await prisma.project.findUnique({ where: { id } });
+    if (!p || !await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    if (!portalTicketRateOk(req.user.id, id)) return reply.code(429).send({ error: "terlalu banyak permintaan" });
+    if (!req.isMultipart?.()) return reply.code(400).send({ error: "butuh multipart/form-data" });
+    const upload = await parseTicketUpload(req);
+    if (!upload) return reply.code(400).send({ error: "unggahan tak valid" });
+    const parsed = zPortalTicket.safeParse({
+      category: upload.fields.category,
+      title: upload.fields.title,
+      detail: upload.fields.detail
+    });
+    if (!parsed.success) return reply.code(400).send({ error: "field wajib tak lengkap / tak valid" });
+    const { ticket } = await intakeTicket({
+      projectId: id,
+      projectName: p.name,
+      category: parsed.data.category,
+      title: parsed.data.title,
+      detail: parsed.data.detail,
+      reporterEmail: req.user.email,
+      files: upload.files
+    });
+    return reply.code(201).send(toPortalTicket(ticket, null));
+  });
 }
 
 // src/routes/client-accounts.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hanoman",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "description": "Orchestrator + dashboard workflow docs-driven untuk sesi Claude Code / Codex",
   "type": "module",
   "repository": {