openship 0.1.0 → 0.1.1

package/apps/api/src/lib/cloud-client.ts

@@ -0,0 +1,103 @@
+/**
+ * Cloud client — used by local/self-hosted instances to get
+ * an Oblien namespace token from api.openship.io.
+ *
+ * Auth is fully server-side: the user's Openship Cloud session
+ * is stored (encrypted) in user_settings.cloud_session_token.
+ * This module reads it from DB, fetches namespace tokens from
+ * the SaaS API, and caches them in memory.
+ *
+ * No client-side cookies or tokens involved.
+ */
+
+import { repos } from "@repo/db";
+import { env } from "../config/env";
+import { decrypt } from "./encryption";
+
+// ─── Namespace token cache ───────────────────────────────────────────────────
+
+interface TokenCache {
+  token: string;
+  namespace: string;
+  expiresAt: number; // epoch ms
+}
+
+const tokenCache = new Map<string, TokenCache>();
+const REFRESH_BUFFER_MS = 5 * 60 * 1000;
+
+// ─── Cloud session management ────────────────────────────────────────────────
+
+/**
+ * Disconnect from Openship Cloud — clear stored session.
+ */
+export async function disconnectCloud(userId: string): Promise<void> {
+  await repos.settings.update(userId, { cloudSessionToken: null });
+  tokenCache.delete(userId);
+}
+
+/**
+ * Check whether the user has a stored cloud session.
+ */
+export async function isCloudConnected(userId: string): Promise<boolean> {
+  const settings = await repos.settings.findByUser(userId);
+  return !!settings?.cloudSessionToken;
+}
+
+// ─── Namespace token fetching ────────────────────────────────────────────────
+
+/**
+ * Get a valid namespace-scoped Oblien token for a user.
+ *
+ * Reads the stored cloud session from DB, calls POST /api/cloud/token
+ * on the SaaS API, caches the result in memory.
+ *
+ * Returns null if the user isn't connected to Openship Cloud.
+ */
+export async function getCloudToken(
+  userId: string,
+): Promise<{ token: string; namespace: string } | null> {
+  // Check memory cache first
+  const cached = tokenCache.get(userId);
+  if (cached && cached.expiresAt - Date.now() > REFRESH_BUFFER_MS) {
+    return { token: cached.token, namespace: cached.namespace };
+  }
+
+  // Read stored session from DB
+  const settings = await repos.settings.findByUser(userId);
+  if (!settings?.cloudSessionToken) return null;
+
+  const sessionToken = decrypt(settings.cloudSessionToken);
+
+  // Fetch namespace token from SaaS API
+  const url = `${env.OPENSHIP_CLOUD_URL}/api/cloud/token`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${sessionToken}`,
+    },
+  });
+
+  if (!res.ok) {
+    // If 401, the stored session is expired — clear it
+    if (res.status === 401) {
+      await repos.settings.update(userId, { cloudSessionToken: null });
+      tokenCache.delete(userId);
+    }
+    return null;
+  }
+
+  const json = (await res.json()) as {
+    data: { token: string; namespace: string; expiresAt: string };
+  };
+
+  const { token, namespace, expiresAt } = json.data;
+
+  tokenCache.set(userId, {
+    token,
+    namespace,
+    expiresAt: new Date(expiresAt).getTime(),
+  });
+
+  return { token, namespace };
+}

package/apps/api/src/lib/compose-parser.ts

@@ -0,0 +1,138 @@
+/**
+ * Docker Compose parser — extracts services, ports, volumes, depends_on,
+ * and environment from a docker-compose.yml / compose.yml file.
+ *
+ * Used by the prepare service to populate the services UI for compose projects.
+ */
+
+import { parse as parseYaml } from "yaml";
+
+// ─── Types ───────────────────────────────────────────────────────────────────
+
+export interface ComposeService {
+  name: string;
+  image?: string;
+  build?: string;
+  ports: string[];
+  dependsOn: string[];
+  environment: Record<string, string>;
+  volumes: string[];
+}
+
+export interface ComposeParseResult {
+  services: ComposeService[];
+  volumes: string[];
+  networks: string[];
+}
+
+// ─── Parser ──────────────────────────────────────────────────────────────────
+
+export function parseComposeFile(content: string): ComposeParseResult {
+  const doc = parseYaml(content);
+
+  if (!doc || typeof doc !== "object") {
+    return { services: [], volumes: [], networks: [] };
+  }
+
+  const rawServices = doc.services ?? {};
+  const services: ComposeService[] = [];
+
+  for (const [name, def] of Object.entries(rawServices)) {
+    if (!def || typeof def !== "object") continue;
+    const svc = def as Record<string, unknown>;
+
+    services.push({
+      name,
+      image: typeof svc.image === "string" ? svc.image : undefined,
+      build: parseBuild(svc.build),
+      ports: parsePorts(svc.ports),
+      dependsOn: parseDependsOn(svc.depends_on),
+      environment: parseEnvironment(svc.environment),
+      volumes: parseVolumes(svc.volumes),
+    });
+  }
+
+  const volumes = doc.volumes ? Object.keys(doc.volumes) : [];
+  const networks = doc.networks ? Object.keys(doc.networks) : [];
+
+  return { services, volumes, networks };
+}
+
+// ─── Field parsers ───────────────────────────────────────────────────────────
+
+function parseBuild(build: unknown): string | undefined {
+  if (typeof build === "string") return build;
+  if (build && typeof build === "object") {
+    const b = build as Record<string, unknown>;
+    return (typeof b.context === "string" ? b.context : undefined) ?? ".";
+  }
+  return undefined;
+}
+
+function parsePorts(ports: unknown): string[] {
+  if (!Array.isArray(ports)) return [];
+  return ports.map((p) => {
+    if (typeof p === "string") return p;
+    if (typeof p === "number") return String(p);
+    if (p && typeof p === "object") {
+      const port = p as Record<string, unknown>;
+      const target = port.target ?? port.container_port;
+      const published = port.published ?? port.host_port;
+      if (target) {
+        return published ? `${published}:${target}` : String(target);
+      }
+    }
+    return String(p);
+  });
+}
+
+function parseDependsOn(deps: unknown): string[] {
+  if (Array.isArray(deps)) return deps.filter((d): d is string => typeof d === "string");
+  if (deps && typeof deps === "object") return Object.keys(deps);
+  return [];
+}
+
+function parseEnvironment(env: unknown): Record<string, string> {
+  if (!env) return {};
+
+  // Array form: ["KEY=value", "KEY2=value2"]
+  if (Array.isArray(env)) {
+    const result: Record<string, string> = {};
+    for (const item of env) {
+      if (typeof item !== "string") continue;
+      const eqIdx = item.indexOf("=");
+      if (eqIdx > 0) {
+        result[item.slice(0, eqIdx)] = item.slice(eqIdx + 1);
+      } else {
+        result[item] = "";
+      }
+    }
+    return result;
+  }
+
+  // Object form: { KEY: value }
+  if (typeof env === "object") {
+    const result: Record<string, string> = {};
+    for (const [key, val] of Object.entries(env as Record<string, unknown>)) {
+      result[key] = val != null ? String(val) : "";
+    }
+    return result;
+  }
+
+  return {};
+}
+
+function parseVolumes(vols: unknown): string[] {
+  if (!Array.isArray(vols)) return [];
+  return vols.map((v) => {
+    if (typeof v === "string") return v;
+    if (v && typeof v === "object") {
+      const vol = v as Record<string, unknown>;
+      const src = vol.source ?? vol.name;
+      const tgt = vol.target;
+      if (src && tgt) return `${src}:${tgt}`;
+      if (tgt) return String(tgt);
+    }
+    return String(v);
+  });
+}

package/apps/api/src/lib/controller-helpers.ts

@@ -0,0 +1,90 @@
+/**
+ * Shared controller helpers — used across all Hono route handlers.
+ *
+ * Eliminates duplication of getUserId / param / platform() across controllers.
+ */
+
+import type { Context } from "hono";
+import {
+  initPlatform,
+  getPlatform,
+  type Platform,
+  type PlatformTarget,
+  type PlatformConfig,
+} from "@repo/adapters";
+import { env } from "../config/env";
+
+// ─── Auth helpers ────────────────────────────────────────────────────────────
+
+/** Extract the authenticated user ID from Hono context */
+export function getUserId(c: Context): string {
+  const user = c.get("user");
+  if (!user?.id) throw new Error("Unauthorized: no user in context");
+  return user.id;
+}
+
+/** Extract and validate a required route parameter */
+export function param(c: Context, name: string): string {
+  const val = c.req.param(name);
+  if (!val) throw new Error(`Missing route param: ${name}`);
+  return val;
+}
+
+// ─── Platform resolution ─────────────────────────────────────────────────────
+
+/**
+ * Resolve the deployment target from environment config.
+ *
+ * CLOUD_MODE (SaaS hosting) and DEPLOY_MODE=cloud (Oblien runtime) both
+ * need the cloud platform adapter, so either triggers the cloud config.
+ * Auth/billing concerns are gated separately by CLOUD_MODE alone.
+ *
+ * Priority:
+ *   1. CLOUD_MODE=true or DEPLOY_MODE=cloud → "cloud" (Oblien runtime)
+ *   2. DEPLOY_MODE=desktop → "desktop"
+ *   3. Default → "selfhosted" with docker or bare runtime
+ */
+function resolveConfig(): PlatformConfig {
+  if (env.CLOUD_MODE || env.DEPLOY_MODE === "cloud") {
+    return {
+      target: "cloud",
+      cloudClientId: env.OBLIEN_CLIENT_ID,
+      cloudClientSecret: env.OBLIEN_CLIENT_SECRET,
+    };
+  }
+
+  if (env.DEPLOY_MODE === "desktop") {
+    return { target: "desktop" };
+  }
+
+  // Self-hosted: docker or bare
+  return {
+    target: "selfhosted",
+    runtime: env.DEPLOY_MODE === "bare" ? "bare" : "docker",
+  };
+}
+
+/**
+ * Initialize the platform at server startup.
+ *
+ * Call this ONCE before the server starts handling requests.
+ * After this, `platform()` returns the cached instance synchronously.
+ */
+export async function bootstrapPlatform(): Promise<Platform> {
+  return initPlatform(resolveConfig());
+}
+
+/**
+ * Get the platform — the single entry point for all service code.
+ *
+ * Returns: { runtime, routing, ssl, system }
+ *   - runtime: build/deploy/stop/start lifecycle
+ *   - routing: register/remove reverse-proxy routes
+ *   - ssl: provision/renew TLS certificates
+ *   - system: prerequisite validation (self-hosted only, null otherwise)
+ *
+ * All service code uses this. Nothing constructs adapters directly.
+ */
+export function platform(): Platform {
+  return getPlatform();
+}

package/apps/api/src/lib/email-templates.ts

@@ -0,0 +1,94 @@
+/**
+ * Email templates for Openship.
+ *
+ * Each template returns { subject, html, text } so they can be
+ * passed directly to sendMail(). Keep all copy and markup here
+ * so auth.ts / other callers stay clean.
+ */
+
+/* ------------------------------------------------------------------ */
+/*  Shared layout                                                      */
+/* ------------------------------------------------------------------ */
+
+const BRAND = "Openship";
+
+function layout(body: string) {
+  return `
+<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="utf-8" /><meta name="viewport" content="width=device-width" /></head>
+<body style="margin:0;padding:0;background:#f9fafb;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="padding:40px 20px">
+    <tr><td align="center">
+      <table role="presentation" width="480" cellpadding="0" cellspacing="0" style="background:#ffffff;border-radius:16px;padding:40px;border:1px solid #e5e7eb">
+        <tr><td>
+          ${body}
+          <p style="color:#9ca3af;font-size:12px;margin-top:32px;border-top:1px solid #f3f4f6;padding-top:16px">
+            &copy; ${BRAND}
+          </p>
+        </td></tr>
+      </table>
+    </td></tr>
+  </table>
+</body>
+</html>`.trim();
+}
+
+function ctaButton(url: string, label: string) {
+  return `
+<table role="presentation" cellpadding="0" cellspacing="0" style="margin:24px 0">
+  <tr><td align="center" style="background:#000;border-radius:10px">
+    <a href="${url}" target="_blank" style="display:inline-block;padding:12px 28px;color:#fff;font-size:14px;font-weight:600;text-decoration:none">${label}</a>
+  </td></tr>
+</table>`.trim();
+}
+
+function greeting(name?: string | null) {
+  return `<p style="color:#111;font-size:15px;margin:0 0 16px">Hi ${name || "there"},</p>`;
+}
+
+/* ------------------------------------------------------------------ */
+/*  Reset password                                                     */
+/* ------------------------------------------------------------------ */
+
+export function resetPasswordEmail(user: { name?: string | null; email: string }, url: string) {
+  const html = layout(`
+    ${greeting(user.name)}
+    <p style="color:#374151;font-size:14px;line-height:1.6;margin:0 0 4px">
+      We received a request to reset your password. Click the button below to choose a new one.
+    </p>
+    ${ctaButton(url, "Reset password")}
+    <p style="color:#9ca3af;font-size:13px;margin:0">
+      If you didn't request this, you can safely ignore this email. The link expires in 1 hour.
+    </p>
+  `);
+
+  return {
+    subject: "Reset your Openship password",
+    html,
+    text: `Hi ${user.name || "there"},\n\nReset your password: ${url}\n\nIf you didn't request this, ignore this email. The link expires in 1 hour.`,
+  };
+}
+
+/* ------------------------------------------------------------------ */
+/*  Verify email                                                       */
+/* ------------------------------------------------------------------ */
+
+export function verifyEmailTemplate(user: { name?: string | null; email: string }, url: string) {
+  const html = layout(`
+    ${greeting(user.name)}
+    <p style="color:#374151;font-size:14px;line-height:1.6;margin:0 0 4px">
+      Please verify your email address to get started with ${BRAND}.
+    </p>
+    ${ctaButton(url, "Verify email")}
+    <p style="color:#9ca3af;font-size:13px;margin:0">
+      If you didn't create an account, you can ignore this email.
+    </p>
+  `);
+
+  return {
+    subject: "Verify your Openship email",
+    html,
+    text: `Hi ${user.name || "there"},\n\nVerify your email: ${url}\n\nIf you didn't create an account, ignore this email.`,
+  };
+}

package/apps/api/src/lib/encryption.ts

@@ -0,0 +1,102 @@
+/**
+ * Application-level encryption for sensitive data (env vars, secrets).
+ *
+ * Uses AES-256-GCM (authenticated encryption) via Node.js built-in crypto.
+ * The encryption key is derived from BETTER_AUTH_SECRET (which every install
+ * already has) — no extra env var needed.
+ *
+ * Format:  base64( iv:16 || authTag:16 || ciphertext )
+ *
+ * Usage:
+ *   import { encrypt, decrypt } from "../lib/encryption";
+ *   const sealed = encrypt("my secret");
+ *   const plain  = decrypt(sealed); // "my secret"
+ */
+
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  randomBytes,
+} from "node:crypto";
+import { env } from "../config/env";
+
+// ─── Key derivation ──────────────────────────────────────────────────────────
+
+const ALGORITHM = "aes-256-gcm" as const;
+const IV_LENGTH = 16;
+const AUTH_TAG_LENGTH = 16;
+
+/**
+ * Derive a deterministic 256-bit key from the auth secret.
+ * SHA-256 always produces 32 bytes — exactly what AES-256 needs.
+ */
+function deriveKey(): Buffer {
+  return createHash("sha256")
+    .update(env.BETTER_AUTH_SECRET)
+    .digest();
+}
+
+// ─── Public API ──────────────────────────────────────────────────────────────
+
+/**
+ * Encrypt a plaintext string.
+ * Returns a base64-encoded string containing IV + auth tag + ciphertext.
+ */
+export function encrypt(plaintext: string): string {
+  const key = deriveKey();
+  const iv = randomBytes(IV_LENGTH);
+
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final(),
+  ]);
+  const authTag = cipher.getAuthTag();
+
+  // Pack: iv (16) + authTag (16) + ciphertext (variable)
+  const packed = Buffer.concat([iv, authTag, encrypted]);
+  return packed.toString("base64");
+}
+
+/**
+ * Decrypt a value produced by `encrypt()`.
+ * Throws if the data is tampered with or the key is wrong.
+ */
+export function decrypt(sealed: string): string {
+  const key = deriveKey();
+  const packed = Buffer.from(sealed, "base64");
+
+  if (packed.length < IV_LENGTH + AUTH_TAG_LENGTH) {
+    throw new Error("Invalid encrypted data: too short");
+  }
+
+  const iv = packed.subarray(0, IV_LENGTH);
+  const authTag = packed.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+  const ciphertext = packed.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(authTag);
+
+  const decrypted = Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final(),
+  ]);
+
+  return decrypted.toString("utf8");
+}
+
+/**
+ * Encrypt a JSON-serialisable value.
+ * Convenience wrapper for structured data like env var arrays.
+ */
+export function encryptJson<T>(value: T): string {
+  return encrypt(JSON.stringify(value));
+}
+
+/**
+ * Decrypt a value produced by `encryptJson()`.
+ */
+export function decryptJson<T = unknown>(sealed: string): T {
+  return JSON.parse(decrypt(sealed)) as T;
+}

package/apps/api/src/lib/local-user.ts

@@ -0,0 +1,65 @@
+/**
+ * Local user — auto-provisioned DB user for self-hosted/desktop mode.
+ *
+ * In local mode the API trusts all requests (it only listens on 127.0.0.1).
+ * However, controllers reference `userId` as a FK, so a real user row must
+ * exist. This module lazily creates one on first access and caches it.
+ *
+ * The user is an admin with `autoProvisioned = true`.
+ */
+
+import { randomUUID } from "node:crypto";
+import { repos } from "@repo/db";
+
+const LOCAL_EMAIL = "local@openship.local";
+
+/** Shape expected by Hono context consumers (`c.get("user")`) */
+export interface LocalUser {
+  id: string;
+  name: string;
+  email: string;
+  emailVerified: boolean;
+  role: string;
+  autoProvisioned: boolean;
+}
+
+/** Cached user — avoids a DB hit on every request after the first. */
+let cached: LocalUser | null = null;
+
+/**
+ * Ensure a local user row exists in the database and return it.
+ *
+ * - First call: looks up `local@openship.local`, creates if missing.
+ * - Subsequent calls: returns the in-memory cache (zero DB cost).
+ */
+export async function ensureLocalUser(): Promise<LocalUser> {
+  if (cached) return cached;
+
+  let row = await repos.user.findByEmail(LOCAL_EMAIL);
+
+  if (!row) {
+    // Insert directly — no password/session needed in local mode.
+    const id = randomUUID();
+    const { db, schema } = await import("@repo/db");
+    await db.insert(schema.user).values({
+      id,
+      name: "Local User",
+      email: LOCAL_EMAIL,
+      emailVerified: true,
+      role: "admin",
+      autoProvisioned: true,
+    });
+    row = await repos.user.findById(id);
+  }
+
+  cached = {
+    id: row!.id,
+    name: row!.name,
+    email: row!.email,
+    emailVerified: row!.emailVerified,
+    role: row!.role,
+    autoProvisioned: row!.autoProvisioned,
+  };
+
+  return cached;
+}

package/apps/api/src/lib/mail.ts

@@ -0,0 +1,48 @@
+import nodemailer from "nodemailer";
+import { env } from "../config/env";
+
+/**
+ * Lightweight email sender using SMTP.
+ *
+ * Only available when SMTP_HOST is configured.
+ * Self-hosted instances without SMTP skip email-dependent features
+ * (verification, password reset) gracefully.
+ */
+
+export const smtpEnabled = !!(env.SMTP_HOST && env.SMTP_USER && env.SMTP_PASS);
+
+export type SendMailOptions = {
+  to: string;
+  subject: string;
+  html: string;
+  text?: string;
+};
+
+/** Reusable transport — created once when SMTP is available. */
+const transport = smtpEnabled
+  ? nodemailer.createTransport({
+      host: env.SMTP_HOST,
+      port: env.SMTP_PORT ?? 587,
+      secure: (env.SMTP_PORT ?? 587) === 465,
+      auth: {
+        user: env.SMTP_USER,
+        pass: env.SMTP_PASS,
+      },
+    })
+  : null;
+
+/** Send an email via SMTP. No-ops when SMTP is not configured. */
+export async function sendMail(opts: SendMailOptions): Promise<void> {
+  if (!transport) {
+    console.warn("[mail] SMTP not configured — skipping email to", opts.to);
+    return;
+  }
+
+  await transport.sendMail({
+    from: env.SMTP_FROM,
+    to: opts.to,
+    subject: opts.subject,
+    html: opts.html,
+    ...(opts.text ? { text: opts.text } : {}),
+  });
+}