openship 0.1.0 → 0.1.1

package/apps/api/src/modules/github/github.types.ts

@@ -0,0 +1,158 @@
+/**
+ * GitHub types — shared interfaces for the entire GitHub module.
+ */
+
+// ─── GitHub API response shapes ──────────────────────────────────────────────
+
+export interface GitHubUser {
+  login: string;
+  id: number;
+  avatar_url: string;
+  html_url: string;
+  type: "User" | "Organization";
+  name?: string;
+  email?: string;
+}
+
+export interface GitHubRepository {
+  id: number;
+  name: string;
+  full_name: string;
+  owner: { login: string; id: number; avatar_url: string };
+  private: boolean;
+  visibility: string;
+  html_url: string;
+  clone_url: string;
+  ssh_url: string;
+  default_branch: string;
+  description: string | null;
+  language: string | null;
+  size: number;
+  forks: number;
+  watchers: number;
+  stargazers_count: number;
+  license: unknown;
+  created_at: string;
+  updated_at: string;
+  pushed_at: string;
+}
+
+export interface GitHubBranch {
+  name: string;
+  commit: { sha: string; url: string };
+  protected: boolean;
+}
+
+export interface GitHubInstallation {
+  id: number;
+  account: {
+    login: string;
+    id: number;
+    avatar_url: string;
+    type: "User" | "Organization";
+  };
+  app_id: number;
+  target_type: string;
+  permissions: Record<string, string>;
+  events: string[];
+}
+
+export interface GitHubWebhook {
+  id: number;
+  active: boolean;
+  events: string[];
+  config: { url: string; content_type: string };
+}
+
+export interface GitHubFileContent {
+  name: string;
+  path: string;
+  sha: string;
+  size: number;
+  type: "file" | "dir";
+  content?: string; // base64-encoded
+  encoding?: string;
+  download_url: string | null;
+}
+
+export interface GitHubCheckRun {
+  id: number;
+  status: string;
+  conclusion: string | null;
+}
+
+// ─── Push webhook payload ────────────────────────────────────────────────────
+
+export interface GitHubPushCommit {
+  id: string;
+  message: string;
+  timestamp: string;
+  url: string;
+  author: { name: string; email: string; username?: string };
+  committer: { name: string; email: string; username?: string };
+  added: string[];
+  removed: string[];
+  modified: string[];
+}
+
+export interface GitHubPushPayload {
+  ref: string;
+  head_commit: GitHubPushCommit;
+  repository: {
+    name: string;
+    full_name: string;
+    owner: { login: string; id: number };
+  };
+  sender: { id: number; login: string };
+  hook_id?: number;
+}
+
+// ─── Installation webhook payload ────────────────────────────────────────────
+
+export interface GitHubInstallationPayload {
+  action: "created" | "deleted" | "suspend" | "unsuspend";
+  installation: GitHubInstallation;
+  sender: { id: number; login: string };
+}
+
+// ─── Mapped types for API responses ──────────────────────────────────────────
+
+export interface MappedRepository {
+  full_name: string;
+  name: string;
+  owner: string;
+  description: string | null;
+  html_url: string;
+  private: boolean;
+  visibility: string;
+  default_branch: string;
+  language: string | null;
+  size: number;
+  forks: number;
+  watchers: number;
+  stars: number;
+  license: unknown;
+  created_at: string;
+  updated_at: string;
+  pushed_at: string;
+}
+
+export interface MappedAccount {
+  login: string;
+  id: number;
+  avatar_url: string;
+  type: string;
+}
+
+export interface RepositoryDetail {
+  id: number;
+  name: string;
+  full_name: string;
+  owner: string;
+  private: boolean;
+  default_branch: string;
+  clone_url: string;
+  ssh_url: string;
+  html_url: string;
+  branches?: GitHubBranch[];
+}

package/apps/api/src/modules/github/github.webhook.ts

@@ -0,0 +1,186 @@
+/**
+ * GitHub webhook handler — processes incoming GitHub App webhook events.
+ *
+ * Implements the WebhookProvider interface so it plugs into the
+ * unified webhook dispatcher in modules/webhooks/.
+ *
+ * Handles:
+ *   - installation.created  → store installation in DB
+ *   - installation.deleted  → remove installation from DB
+ *   - push                  → trigger redeployment (delegates to deployment service)
+ *   - check_run             → acknowledged, no action
+ */
+
+import { repos } from "@repo/db";
+import { env } from "../../config/env";
+import { verifyHmacSha256 } from "../webhooks/webhook.service";
+import type {
+  WebhookProvider,
+  WebhookVerifyResult,
+  WebhookHandlerResult,
+} from "../webhooks/webhook.types";
+import type {
+  GitHubInstallationPayload,
+  GitHubPushPayload,
+} from "./github.types";
+
+// ─── Push deduplication (prevents concurrent deploys for same repo) ──────────
+
+const activePushes = new Set<string>();
+
+// ─── GitHub Webhook Provider ─────────────────────────────────────────────────
+
+export const githubWebhookProvider: WebhookProvider = {
+  name: "github",
+
+  verify(payload: string | Buffer, headers: Record<string, string>): WebhookVerifyResult {
+    const secret = env.GITHUB_WEBHOOK_SECRET;
+    if (!secret) {
+      return { valid: false, error: "GITHUB_WEBHOOK_SECRET is not configured" };
+    }
+
+    const signature = headers["x-hub-signature-256"];
+    if (!signature) {
+      return { valid: false, error: "Missing x-hub-signature-256 header" };
+    }
+
+    const valid = verifyHmacSha256(payload, secret, signature);
+    return valid ? { valid: true } : { valid: false, error: "Invalid signature" };
+  },
+
+  async handle(payload: unknown, headers: Record<string, string>): Promise<WebhookHandlerResult> {
+    const event = headers["x-github-event"];
+
+    switch (event) {
+      case "installation":
+        return handleInstallation(payload as GitHubInstallationPayload);
+      case "push":
+        return handlePush(payload as GitHubPushPayload);
+      case "check_run":
+        return { success: true, event, message: "Check run acknowledged" };
+      case "ping":
+        return { success: true, event, message: "Pong" };
+      default:
+        return { success: true, event, message: `Event '${event}' not handled` };
+    }
+  },
+};
+
+// ─── Installation events ─────────────────────────────────────────────────────
+
+async function handleInstallation(
+  payload: GitHubInstallationPayload,
+): Promise<WebhookHandlerResult> {
+  switch (payload.action) {
+    case "created":
+      return handleInstallationCreated(payload);
+    case "deleted":
+      return handleInstallationDeleted(payload);
+    default:
+      return {
+        success: true,
+        event: "installation",
+        message: `Installation action '${payload.action}' not handled`,
+      };
+  }
+}
+
+async function handleInstallationCreated(
+  payload: GitHubInstallationPayload,
+): Promise<WebhookHandlerResult> {
+  const senderId = String(payload.sender.id);
+  const installationId = payload.installation.id;
+  const accountLogin = payload.installation.account.login.toLowerCase();
+  const accountType = payload.installation.account.type;
+
+  /* Find the user by their GitHub provider ID in Better Auth's account table */
+  const account = await findUserByGitHubId(senderId);
+  if (!account) {
+    return { success: false, event: "installation", error: "No linked user found for this GitHub account" };
+  }
+
+  await repos.gitInstallation.upsert({
+    userId: account.userId,
+    provider: "github",
+    installationId,
+    owner: accountLogin,
+    ownerType: accountType,
+    providerUserId: senderId,
+    providerOwnerId: String(payload.installation.account.id),
+    isOrg: accountType === "Organization",
+  });
+
+  return { success: true, event: "installation", message: `Installation created for ${accountLogin}` };
+}
+
+async function handleInstallationDeleted(
+  payload: GitHubInstallationPayload,
+): Promise<WebhookHandlerResult> {
+  const senderId = String(payload.sender.id);
+  const installationId = payload.installation.id;
+
+  const account = await findUserByGitHubId(senderId);
+  if (!account) {
+    return { success: false, event: "installation", error: "No linked user found" };
+  }
+
+  await repos.gitInstallation.removeByInstallationId(account.userId, installationId);
+
+  return { success: true, event: "installation", message: "Installation removed" };
+}
+
+// ─── Push events ─────────────────────────────────────────────────────────────
+
+async function handlePush(payload: GitHubPushPayload): Promise<WebhookHandlerResult> {
+  const owner = payload.repository?.owner?.login;
+  const repo = payload.repository?.name;
+
+  if (!owner || !repo) {
+    return { success: false, event: "push", error: "Missing repository info in payload" };
+  }
+
+  const pushKey = `${owner}/${repo}`.toLowerCase();
+
+  /* Deduplicate: skip if we're already processing a push for this repo */
+  if (activePushes.has(pushKey)) {
+    return { success: true, event: "push", message: "Already processing a push for this repo" };
+  }
+
+  activePushes.add(pushKey);
+
+  try {
+    /**
+     * TODO: Integrate with deployment service once it's implemented.
+     *
+     * The flow should be:
+     *   1. Look up project by owner+repo in the deployments/projects table
+     *   2. Create a new build session
+     *   3. Queue the deployment via BullMQ
+     *   4. Create a GitHub check run to track status
+     *
+     * For now we log and acknowledge the event so the webhook infrastructure
+     * is fully operational.
+     */
+    console.log(`[GitHub Webhook] Push received: ${owner}/${repo} ref=${payload.ref}`);
+    console.log(`[GitHub Webhook] Commit: ${payload.head_commit?.id?.slice(0, 7)} — ${payload.head_commit?.message}`);
+
+    return {
+      success: true,
+      event: "push",
+      message: `Push event processed for ${owner}/${repo}`,
+    };
+  } finally {
+    activePushes.delete(pushKey);
+  }
+}
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+/**
+ * Find our user by their GitHub account ID using Better Auth's account table.
+ */
+async function findUserByGitHubId(githubId: string) {
+  const account = await repos.account.findByProviderAccountId("github", githubId);
+  if (!account) return null;
+  return { userId: account.userId, accountId: account.accountId };
+}

package/apps/api/src/modules/github/index.ts

@@ -0,0 +1,16 @@
+/**
+ * GitHub module barrel — exports routes and registers the webhook provider.
+ *
+ * Import this module in app.ts to:
+ *   1. Mount GitHub REST routes at /api/github
+ *   2. Auto-register the GitHub webhook provider with the unified webhook system
+ */
+
+export { githubRoutes } from "./github.routes";
+
+/* ─── Auto-register webhook provider ────────────────────────────────────── */
+
+import { registerWebhookProvider } from "../webhooks/webhook.service";
+import { githubWebhookProvider } from "./github.webhook";
+
+registerWebhookProvider(githubWebhookProvider);

package/apps/api/src/modules/health/health.routes.ts

@@ -2,9 +2,44 @@
  * Health check module — used by load balancers and Docker health checks.
  */
 import { Hono } from "hono";
+import { hostname } from "node:os";
+import { env } from "../../config/env";
+
+/** Computed once — hostname never changes at runtime. */
+const machineName = env.DEPLOY_MODE === "desktop" ? hostname() : undefined;
 
 export const healthRoutes = new Hono();
 
 healthRoutes.get("/", (c) => {
   return c.json({ status: "ok", timestamp: new Date().toISOString() });
 });
+
+/** GET /health/env — static deployment info (no auth, cached by callers). */
+healthRoutes.get("/env", async (c) => {
+  // authMode tells the dashboard which login flow to use:
+  //   "none"   → zero-auth, auto-provisioned local user (desktop default)
+  //   "cloud"  → external auth on Openship Cloud
+  //   "local"  → local Better Auth (self-hosted server / SaaS)
+  let authMode: string;
+
+  if (env.DEPLOY_MODE === "desktop") {
+    // Desktop: authMode is set during onboarding (none or cloud)
+    try {
+      const { repos } = await import("@repo/db");
+      const settings = await repos.instanceSettings.get();
+      authMode = settings?.authMode ?? "none";
+    } catch {
+      authMode = "none";
+    }
+  } else {
+    authMode = "local";
+  }
+
+  return c.json({
+    selfHosted: !env.CLOUD_MODE,
+    deployMode: env.DEPLOY_MODE,
+    authMode,
+    cloudAuthUrl: env.OPENSHIP_CLOUD_DASHBOARD_URL,
+    ...(machineName && { machineName }),
+  });
+});