nobalmako 1.0.0

package/src/app/api/teams/route.ts

@@ -0,0 +1,217 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getUserFromToken } from '@/lib/auth';
+import { db } from '@/lib/db';
+import { teams, teamMembers } from '@/lib/schema';
+import { createAuditLog } from '@/lib/audit';
+import { eq, or, exists, and } from 'drizzle-orm';
+
+export async function GET() {
+  try {
+    const user = await getUserFromToken();
+
+    if (!user) {
+      return NextResponse.json(
+        { error: 'Not authenticated' },
+        { status: 401 }
+      );
+    }
+
+    // Get teams where user is owner or member
+    const userTeams = await db
+      .select()
+      .from(teams)
+      .where(
+        or(
+          eq(teams.ownerId, user.id),
+          exists(
+            db.select()
+              .from(teamMembers)
+              .where(and(eq(teamMembers.teamId, teams.id), eq(teamMembers.userId, user.id)))
+          )
+        )
+      );
+
+    return NextResponse.json({ teams: userTeams });
+  } catch (error) {
+    console.error('Get teams error:', error);
+    return NextResponse.json(
+      { error: 'Internal server error' },
+      { status: 500 }
+    );
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const user = await getUserFromToken();
+
+    if (!user) {
+      return NextResponse.json(
+        { error: 'Not authenticated' },
+        { status: 401 }
+      );
+    }
+
+    const { name, description, color } = await request.json();
+
+    if (!name) {
+      return NextResponse.json(
+        { error: 'Name is required' },
+        { status: 400 }
+      );
+    }
+
+    const [newTeam] = await db.insert(teams).values({
+      name,
+      description,
+      color: color || '#3b82f6',
+      ownerId: user.id,
+    }).returning();
+
+    // Audit log
+    await createAuditLog({
+      userId: user.id,
+      teamId: newTeam.id,
+      action: 'create',
+      resourceType: 'team',
+      resourceId: newTeam.id,
+      newValue: { name, description, color: color || '#3b82f6' },
+    });
+
+    return NextResponse.json({ team: newTeam });
+  } catch (error) {
+    console.error('Create team error:', error);
+    return NextResponse.json(
+      { error: 'Internal server error' },
+      { status: 500 }
+    );
+  }
+}
+export async function PUT(request: NextRequest) {
+  try {
+    const user = await getUserFromToken();
+
+    if (!user) {
+      return NextResponse.json(
+        { error: 'Not authenticated' },
+        { status: 401 }
+      );
+    }
+
+    const { id, name, description, color } = await request.json();
+
+    if (!id) {
+      return NextResponse.json(
+        { error: 'Team ID is required' },
+        { status: 400 }
+      );
+    }
+
+    if (!name) {
+      return NextResponse.json(
+        { error: 'Name is required' },
+        { status: 400 }
+      );
+    }
+
+    // Check if user owns the team
+    const existingTeam = await db
+      .select()
+      .from(teams)
+      .where(eq(teams.id, id))
+      .limit(1);
+
+    if (!existingTeam.length || existingTeam[0].ownerId !== user.id) {
+      return NextResponse.json(
+        { error: 'Team not found or access denied' },
+        { status: 404 }
+      );
+    }
+
+    const [updatedTeam] = await db
+      .update(teams)
+      .set({
+        name,
+        description,
+        color: color || existingTeam[0].color,
+        updatedAt: new Date(),
+      })
+      .where(eq(teams.id, id))
+      .returning();
+
+    // Audit log
+    await createAuditLog({
+      userId: user.id,
+      teamId: id,
+      action: 'update',
+      resourceType: 'team',
+      resourceId: id,
+      oldValue: { name: existingTeam[0].name, description: existingTeam[0].description, color: existingTeam[0].color },
+      newValue: { name, description, color: color || existingTeam[0].color },
+    });
+
+    return NextResponse.json({ team: updatedTeam });
+  } catch (error) {
+    console.error('Update team error:', error);
+    return NextResponse.json(
+      { error: 'Internal server error' },
+      { status: 500 }
+    );
+  }
+}
+
+export async function DELETE(request: NextRequest) {
+  try {
+    const user = await getUserFromToken();
+
+    if (!user) {
+      return NextResponse.json(
+        { error: 'Not authenticated' },
+        { status: 401 }
+      );
+    }
+
+    const { id } = await request.json();
+
+    if (!id) {
+      return NextResponse.json(
+        { error: 'Team ID is required' },
+        { status: 400 }
+      );
+    }
+
+    // Check if user owns the team
+    const existingTeam = await db
+      .select()
+      .from(teams)
+      .where(eq(teams.id, id))
+      .limit(1);
+
+    if (!existingTeam.length || existingTeam[0].ownerId !== user.id) {
+      return NextResponse.json(
+        { error: 'Team not found or access denied' },
+        { status: 404 }
+      );
+    }
+
+    await db.delete(teams).where(eq(teams.id, id));
+
+    // Audit log
+    await createAuditLog({
+      userId: user.id,
+      teamId: id,
+      action: 'delete',
+      resourceType: 'team',
+      resourceId: id,
+      oldValue: { name: existingTeam[0].name, description: existingTeam[0].description },
+    });
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error('Delete team error:', error);
+    return NextResponse.json(
+      { error: 'Internal server error' },
+      { status: 500 }
+    );
+  }
+}

package/src/app/api/variable-history/route.ts

@@ -0,0 +1,218 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getUserFromToken } from '@/lib/auth';
+import { db } from '@/lib/db';
+import { variableHistory, teams, environmentVariables, users, teamMembers } from '@/lib/schema';
+import { eq, and, desc, or, exists } from 'drizzle-orm';
+import { decrypt } from '@/lib/crypto';
+import { hasPermission, Permissions } from '@/lib/permissions';
+
+export async function GET(request: NextRequest) {
+  try {
+    const user = await getUserFromToken();
+
+    if (!user) {
+      return NextResponse.json(
+        { error: 'Not authenticated' },
+        { status: 401 }
+      );
+    }
+
+    const { searchParams } = new URL(request.url);
+    const variableId = searchParams.get('variableId');
+    const teamId = searchParams.get('teamId');
+
+    if (!variableId && !teamId) {
+      return NextResponse.json(
+        { error: 'Variable ID or Team ID is required' },
+        { status: 400 }
+      );
+    }
+
+    let whereCondition;
+    if (variableId) {
+      // Check if user has access to this variable
+      const variableCheck = await db
+        .select()
+        .from(environmentVariables)
+        .innerJoin(teams, eq(environmentVariables.teamId, teams.id))
+        .where(
+          and(
+            eq(environmentVariables.id, variableId),
+            or(
+              eq(teams.ownerId, user.id),
+              exists(
+                db.select()
+                  .from(teamMembers)
+                  .where(and(eq(teamMembers.teamId, teams.id), eq(teamMembers.userId, user.id)))
+              )
+            )
+          )
+        )
+        .limit(1);
+
+      if (!variableCheck.length) {
+        return NextResponse.json(
+          { error: 'Variable not found or access denied' },
+          { status: 404 }
+        );
+      }
+      whereCondition = eq(variableHistory.variableId, variableId);
+    } else {
+      // Check if user owns or is a member of the team
+      if (!teamId) {
+        return NextResponse.json(
+          { error: 'Team ID is required' },
+          { status: 400 }
+        );
+      }
+
+      const teamCheck = await db
+        .select()
+        .from(teams)
+        .where(
+          and(
+            eq(teams.id, teamId),
+            or(
+              eq(teams.ownerId, user.id),
+              exists(
+                db.select()
+                  .from(teamMembers)
+                  .where(and(eq(teamMembers.teamId, teams.id), eq(teamMembers.userId, user.id)))
+              )
+            )
+          )
+        )
+        .limit(1);
+
+      if (!teamCheck.length) {
+        return NextResponse.json(
+          { error: 'Team not found or access denied' },
+          { status: 403 }
+        );
+      }
+      whereCondition = eq(variableHistory.teamId, teamId);
+    }
+
+    // Get variable history with user details
+    const history = await db
+      .select({
+        id: variableHistory.id,
+        variableId: variableHistory.variableId,
+        key: variableHistory.key,
+        value: variableHistory.value,
+        description: variableHistory.description,
+        isSecret: variableHistory.isSecret,
+        changeType: variableHistory.changeType,
+        createdAt: variableHistory.createdAt,
+        changer: {
+          id: users.id,
+          name: users.name,
+          email: users.email,
+        },
+      })
+      .from(variableHistory)
+      .innerJoin(users, eq(variableHistory.changedBy, users.id))
+      .where(whereCondition)
+      .orderBy(desc(variableHistory.createdAt))
+      .limit(100); // Limit to last 100 changes
+
+    // Decrypt history values
+    const decryptedHistory = history.map(h => ({
+      ...h,
+      value: decrypt(h.value)
+    }));
+
+    return NextResponse.json({ history: decryptedHistory });
+  } catch (error) {
+    console.error('Get variable history error:', error);
+    return NextResponse.json(
+      { error: 'Internal server error' },
+      { status: 500 }
+    );
+  }
+}
+export async function POST(request: NextRequest) {
+  try {
+    const user = await getUserFromToken();
+
+    if (!user) {
+      return NextResponse.json(
+        { error: 'Not authenticated' },
+        { status: 401 }
+      );
+    }
+
+    const { historyId } = await request.json();
+
+    if (!historyId) {
+      return NextResponse.json(
+        { error: 'History ID is required' },
+        { status: 400 }
+      );
+    }
+
+    // Get the history entry
+    const [historyEntry] = await db
+      .select()
+      .from(variableHistory)
+      .where(eq(variableHistory.id, historyId))
+      .limit(1);
+
+    if (!historyEntry) {
+      return NextResponse.json(
+        { error: 'History entry not found' },
+        { status: 404 }
+      );
+    }
+
+    // Verify user has permission to manage secrets in this team
+    const canManage = await hasPermission(user.id, historyEntry.teamId, Permissions.MANAGE_SECRETS);
+
+    if (!canManage) {
+      return NextResponse.json(
+        { error: 'Forbidden: You do not have permission to manage secrets in this project' },
+        { status: 403 }
+      );
+    }
+
+    // Roll back the variable
+    const [updatedVariable] = await db
+      .update(environmentVariables)
+      .set({
+        value: historyEntry.value, // It's already encrypted in history
+        description: historyEntry.description,
+        isSecret: historyEntry.isSecret,
+        updatedBy: user.id,
+        updatedAt: new Date(),
+      })
+      .where(eq(environmentVariables.id, historyEntry.variableId))
+      .returning();
+
+    // Create a new history entry for the rollback
+    await db.insert(variableHistory).values({
+      variableId: historyEntry.variableId,
+      teamId: historyEntry.teamId,
+      environmentId: historyEntry.environmentId,
+      key: historyEntry.key,
+      value: historyEntry.value, // Already encrypted
+      description: historyEntry.description,
+      isSecret: historyEntry.isSecret,
+      changedBy: user.id,
+      changeType: 'update',
+    });
+
+    return NextResponse.json({ 
+      message: 'Variable rolled back successfully',
+      variable: {
+        ...updatedVariable,
+        value: decrypt(updatedVariable.value)
+      }
+    });
+  } catch (error) {
+    console.error('Rollback variable error:', error);
+    return NextResponse.json(
+      { error: 'Internal server error' },
+      { status: 500 }
+    );
+  }
+}