openship 0.1.0 → 0.1.1

package/apps/api/src/lib/notifications.ts

@@ -0,0 +1,195 @@
+/**
+ * Deployment notifications — email alerts for build/deploy lifecycle events.
+ *
+ * Uses the existing SMTP transport from lib/mail.ts.
+ * Gracefully no-ops when SMTP is not configured (self-hosted without email).
+ *
+ * Event types:
+ *   - deployment_success  — build & deploy completed
+ *   - build_failed        — build phase failed
+ *   - deployment_failed   — deploy phase failed (container didn't start)
+ *   - push_received       — git push triggered a deployment
+ *   - ssl_expiring        — TLS certificate expires soon
+ *   - ssl_renewed         — TLS certificate was auto-renewed
+ *   - project_limit       — user approaching project/build limits
+ */
+
+import { sendMail, smtpEnabled } from "./mail";
+import { env } from "../config/env";
+
+// ─── Event types ─────────────────────────────────────────────────────────────
+
+export type NotificationEvent =
+  | "deployment_success"
+  | "build_failed"
+  | "deployment_failed"
+  | "push_received"
+  | "ssl_expiring"
+  | "ssl_renewed"
+  | "project_limit";
+
+export interface NotificationContext {
+  /** User email to send to */
+  email: string;
+  /** Project name */
+  projectName: string;
+  /** Additional event-specific data */
+  data?: Record<string, unknown>;
+}
+
+// ─── Templates ───────────────────────────────────────────────────────────────
+
+function subjectFor(event: NotificationEvent, ctx: NotificationContext): string {
+  switch (event) {
+    case "deployment_success":
+      return `✅ Deployment succeeded — ${ctx.projectName}`;
+    case "build_failed":
+      return `❌ Build failed — ${ctx.projectName}`;
+    case "deployment_failed":
+      return `❌ Deployment failed — ${ctx.projectName}`;
+    case "push_received":
+      return `🔄 New push detected — ${ctx.projectName}`;
+    case "ssl_expiring":
+      return `⚠️ SSL certificate expiring — ${ctx.data?.domain ?? ctx.projectName}`;
+    case "ssl_renewed":
+      return `🔒 SSL certificate renewed — ${ctx.data?.domain ?? ctx.projectName}`;
+    case "project_limit":
+      return `⚠️ Approaching project limit`;
+  }
+}
+
+function htmlFor(event: NotificationEvent, ctx: NotificationContext): string {
+  const dashboardUrl = env.DASHBOARD_URL;
+  const d = ctx.data ?? {};
+
+  switch (event) {
+    case "deployment_success":
+      return `
+        <h2>Deployment Succeeded</h2>
+        <p><strong>${ctx.projectName}</strong> was deployed successfully.</p>
+        ${d.branch ? `<p>Branch: <code>${d.branch}</code></p>` : ""}
+        ${d.commitSha ? `<p>Commit: <code>${String(d.commitSha).slice(0, 7)}</code></p>` : ""}
+        ${d.url ? `<p>Live at: <a href="${d.url}">${d.url}</a></p>` : ""}
+        ${d.durationMs ? `<p>Build time: ${Math.round(Number(d.durationMs) / 1000)}s</p>` : ""}
+        <p><a href="${dashboardUrl}">Open Dashboard</a></p>
+      `;
+
+    case "build_failed":
+      return `
+        <h2>Build Failed</h2>
+        <p>The build for <strong>${ctx.projectName}</strong> failed.</p>
+        ${d.branch ? `<p>Branch: <code>${d.branch}</code></p>` : ""}
+        ${d.error ? `<p>Error: <code>${d.error}</code></p>` : ""}
+        ${d.logs ? `<details><summary>Build Logs (last 50 lines)</summary><pre>${d.logs}</pre></details>` : ""}
+        <p><a href="${dashboardUrl}">Open Dashboard</a></p>
+      `;
+
+    case "deployment_failed":
+      return `
+        <h2>Deployment Failed</h2>
+        <p>The container for <strong>${ctx.projectName}</strong> failed to start.</p>
+        ${d.error ? `<p>Error: <code>${d.error}</code></p>` : ""}
+        <p><a href="${dashboardUrl}">Open Dashboard</a></p>
+      `;
+
+    case "push_received":
+      return `
+        <h2>New Push Detected</h2>
+        <p>A new push was received for <strong>${ctx.projectName}</strong>.</p>
+        ${d.branch ? `<p>Branch: <code>${d.branch}</code></p>` : ""}
+        ${d.author ? `<p>Author: ${d.author}</p>` : ""}
+        ${d.commitMessage ? `<p>Message: ${d.commitMessage}</p>` : ""}
+        <p>A new deployment has been triggered automatically.</p>
+      `;
+
+    case "ssl_expiring":
+      return `
+        <h2>SSL Certificate Expiring</h2>
+        <p>The TLS certificate for <strong>${d.domain}</strong> expires in <strong>${d.daysLeft} days</strong>.</p>
+        <p>Auto-renewal will be attempted. If it fails, manual intervention may be required.</p>
+      `;
+
+    case "ssl_renewed":
+      return `
+        <h2>SSL Certificate Renewed</h2>
+        <p>The TLS certificate for <strong>${d.domain}</strong> has been renewed.</p>
+        ${d.expiresAt ? `<p>New expiry: ${d.expiresAt}</p>` : ""}
+      `;
+
+    case "project_limit":
+      return `
+        <h2>Approaching Project Limit</h2>
+        <p>You are using <strong>${d.current}</strong> of <strong>${d.limit}</strong> allowed projects.</p>
+        <p>Consider archiving unused projects or upgrading your plan.</p>
+      `;
+  }
+}
+
+// ─── Public API ──────────────────────────────────────────────────────────────
+
+/**
+ * Send a deployment lifecycle notification.
+ * No-ops when SMTP is unconfigured — safe to call unconditionally.
+ */
+export async function notify(
+  event: NotificationEvent,
+  ctx: NotificationContext,
+): Promise<void> {
+  if (!smtpEnabled) return;
+
+  try {
+    await sendMail({
+      to: ctx.email,
+      subject: subjectFor(event, ctx),
+      html: htmlFor(event, ctx),
+    });
+  } catch (err) {
+    // Never throw from notifications — they are best-effort
+    console.error(`[notify] Failed to send ${event} email to ${ctx.email}:`, err);
+  }
+}
+
+/**
+ * Convenience: send a deployment success notification.
+ */
+export async function notifyDeploySuccess(
+  email: string,
+  project: { name: string },
+  deployment: { branch: string; commitSha?: string | null; url?: string | null; durationMs?: number },
+): Promise<void> {
+  await notify("deployment_success", {
+    email,
+    projectName: project.name,
+    data: {
+      branch: deployment.branch,
+      commitSha: deployment.commitSha,
+      url: deployment.url,
+      durationMs: deployment.durationMs,
+    },
+  });
+}
+
+/**
+ * Convenience: send a build failure notification.
+ */
+export async function notifyBuildFailed(
+  email: string,
+  project: { name: string },
+  details: { branch: string; error: string; logs?: string },
+): Promise<void> {
+  // Trim logs to last 50 lines to avoid huge emails
+  const trimmedLogs = details.logs
+    ?.split("\n")
+    .slice(-50)
+    .join("\n");
+
+  await notify("build_failed", {
+    email,
+    projectName: project.name,
+    data: {
+      branch: details.branch,
+      error: details.error,
+      logs: trimmedLogs,
+    },
+  });
+}

package/apps/api/src/lib/openship-cloud.ts

@@ -0,0 +1,101 @@
+/**
+ * Openship Cloud — namespace provisioning + token minting.
+ *
+ * Runs on the SaaS API (CLOUD_MODE=true) only. Local instances
+ * call POST /api/cloud/token to get a namespace-scoped token,
+ * then use `new Oblien({ token })` to drive the full pipeline
+ * themselves (workspaces.create, build, deploy — everything).
+ *
+ * Two responsibilities:
+ *   1. ensureNamespace(userId) — create-if-not-exists, cached
+ *   2. issueNamespaceToken(userId) — mint a scoped token for the namespace
+ */
+
+import { Oblien } from "oblien";
+import { env } from "../config/env";
+
+// ─── Oblien client (master credentials — SaaS only) ─────────────────────────
+
+let _client: Oblien | null = null;
+
+function getClient(): Oblien {
+  if (_client) return _client;
+
+  const clientId = env.OBLIEN_CLIENT_ID;
+  const clientSecret = env.OBLIEN_CLIENT_SECRET;
+
+  if (!clientId || !clientSecret) {
+    throw new Error("Oblien credentials not configured (OBLIEN_CLIENT_ID / OBLIEN_CLIENT_SECRET)");
+  }
+
+  _client = new Oblien({ clientId, clientSecret });
+  return _client;
+}
+
+// ─── Namespace management ────────────────────────────────────────────────────
+
+/** Cache: userId → namespace slug */
+const namespaceCache = new Map<string, string>();
+
+/**
+ * Ensure an Oblien namespace exists for a user.
+ *
+ * Slug: `os-{userId}`. Idempotent — 409 on duplicate is handled.
+ */
+export async function ensureNamespace(userId: string): Promise<string> {
+  const cached = namespaceCache.get(userId);
+  if (cached) return cached;
+
+  const client = getClient();
+  const slug = `os-${userId}`;
+
+  try {
+    const res = await client.namespaces.create({ name: `Openship ${userId}`, slug });
+    const nsSlug = res.data.slug ?? slug;
+    namespaceCache.set(userId, nsSlug);
+    return nsSlug;
+  } catch (err: unknown) {
+    const status = (err as { status?: number }).status;
+    if (status !== 409) throw err;
+
+    // Already exists — fetch and cache
+    const existing = await client.namespaces.get(slug);
+    const nsSlug = existing.data.slug ?? slug;
+    namespaceCache.set(userId, nsSlug);
+    return nsSlug;
+  }
+}
+
+// ─── Token minting ───────────────────────────────────────────────────────────
+
+export interface NamespaceTokenResult {
+  token: string;
+  namespace: string;
+  expiresAt: string;
+}
+
+/**
+ * Issue a namespace-scoped Oblien token for a user.
+ *
+ * The token gives full access to the user's namespace — create workspaces,
+ * manage lifecycle, deploy, etc. Local instances use this to construct
+ * `new Oblien({ token })` and run the full CloudRuntime pipeline.
+ *
+ * TTL: 30 minutes (covers build + deploy + some buffer).
+ */
+export async function issueNamespaceToken(userId: string): Promise<NamespaceTokenResult> {
+  const client = getClient();
+  const namespace = await ensureNamespace(userId);
+
+  const result = await client.tokens.create({
+    scope: "namespace",
+    namespace,
+    ttl: 1800,
+  });
+
+  return {
+    token: result.token,
+    namespace,
+    expiresAt: result.expiresAt,
+  };
+}

package/apps/api/src/lib/resources.ts

@@ -0,0 +1,96 @@
+/**
+ * Resource utilities.
+ *
+ * Single source of truth: DEFAULT_RESOURCE_CONFIG / DEFAULT_BUILD_RESOURCE_CONFIG
+ * in @repo/adapters. Everything flows from there.
+ */
+
+import {
+  DEFAULT_RESOURCE_CONFIG,
+  DEFAULT_BUILD_RESOURCE_CONFIG,
+  type ResourceConfig,
+} from "@repo/adapters";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+/**
+ * Normalize a possibly-legacy DB value into cpuCores.
+ * Old format: { cpus, cpuConfig: { quotaUs, periodUs }, memoryMb }
+ * New format: { cpuCores, memoryMb }
+ */
+function extractCpuCores(raw: Record<string, unknown>): number | undefined {
+  if (typeof raw.cpuCores === "number") return raw.cpuCores;
+  const cfg = raw.cpuConfig as { quotaUs?: number; periodUs?: number } | undefined;
+  if (cfg?.quotaUs && cfg?.periodUs) return cfg.quotaUs / cfg.periodUs;
+  if (typeof raw.cpus === "number") return raw.cpus;
+  return undefined;
+}
+
+// ─── Public API ──────────────────────────────────────────────────────────────
+
+export interface DeploymentResources {
+  build: ResourceConfig;
+  production: ResourceConfig;
+  sleepMode: string;
+  port: number;
+}
+
+/**
+ * Encode ResourceConfig → display format (for API responses).
+ */
+export function encodeResources(
+  production?: ResourceConfig | null,
+  build?: ResourceConfig | null,
+  sleepMode = "auto_sleep",
+  port = 3000,
+): DeploymentResources {
+  return {
+    build: build ?? { ...DEFAULT_BUILD_RESOURCE_CONFIG },
+    production: production ?? { ...DEFAULT_RESOURCE_CONFIG },
+    sleepMode,
+    port,
+  };
+}
+
+/**
+ * Validate user resource input → ResourceConfig.
+ */
+export function decodeResources(input: {
+  cpuCores?: number;
+  memoryMb?: number;
+  diskMb?: number;
+}): ResourceConfig {
+  const cores = input.cpuCores ?? DEFAULT_RESOURCE_CONFIG.cpuCores;
+  const mem = input.memoryMb ?? DEFAULT_RESOURCE_CONFIG.memoryMb;
+  const disk = input.diskMb ?? DEFAULT_RESOURCE_CONFIG.diskMb;
+
+  if (cores < 0.25 || cores > 4.0) {
+    throw new Error("CPU cores must be between 0.25 and 4.00");
+  }
+  if (mem < 128 || mem > 8192) {
+    throw new Error("Memory must be between 128 MB and 8192 MB");
+  }
+  if (disk < 64 || disk > 204800) {
+    throw new Error("Disk must be between 64 MB and 204800 MB");
+  }
+
+  return { cpuCores: cores, memoryMb: mem, diskMb: disk };
+}
+
+/**
+ * Ensure a ResourceConfig has all fields populated with safe defaults.
+ * Handles legacy DB format ({ cpus, cpuConfig }) transparently.
+ */
+export function withDefaults(
+  config?: ResourceConfig | Record<string, unknown> | null,
+  defaults = DEFAULT_RESOURCE_CONFIG,
+): ResourceConfig {
+  if (!config) return { ...defaults };
+
+  const raw = config as Record<string, unknown>;
+  const cpuCores = extractCpuCores(raw) ?? defaults.cpuCores;
+  const memoryMb = (typeof raw.memoryMb === "number" ? raw.memoryMb : undefined) ?? defaults.memoryMb;
+  const diskMb = (typeof raw.diskMb === "number" ? raw.diskMb : undefined) ?? defaults.diskMb;
+
+  return { cpuCores, memoryMb, diskMb };
+}

package/apps/api/src/lib/screenshots.ts

@@ -0,0 +1,189 @@
+/**
+ * Screenshot service — captures website screenshots after deployment.
+ *
+ * Dispatches to a headless browser service (Puppeteer/Playwright container)
+ * and optionally uploads the result to a CDN.
+ *
+ * Configurable via env vars:
+ *   SCREENSHOT_SERVICE_URL  — URL of the screenshot micro-service
+ *   CDN_UPLOAD_URL          — URL of the CDN upload endpoint
+ *
+ * Gracefully no-ops when the screenshot service is not configured.
+ */
+
+import { env } from "../config/env";
+
+// ─── Types ───────────────────────────────────────────────────────────────────
+
+export interface ScreenshotOptions {
+  /** URL to capture */
+  url: string;
+  /** Viewport width (default 1600) */
+  width?: number;
+  /** Viewport height (default 900) */
+  height?: number;
+  /** Device scale factor (default 2 for retina) */
+  scale?: number;
+  /** Whether to capture full-page screenshot */
+  fullPage?: boolean;
+  /** Timeout in ms before aborting (default 15000) */
+  timeout?: number;
+}
+
+export interface ScreenshotResult {
+  /** Temporary URL of the captured screenshot */
+  tempUrl: string;
+  /** CDN URL after upload (null if CDN not configured) */
+  cdnUrl: string | null;
+  /** Image dimensions */
+  width: number;
+  height: number;
+  /** File size in bytes */
+  sizeBytes: number;
+}
+
+// ─── Service ─────────────────────────────────────────────────────────────────
+
+const screenshotServiceUrl = env.SCREENSHOT_SERVICE_URL;
+const cdnUploadUrl = env.CDN_UPLOAD_URL;
+
+/** Whether the screenshot service is available */
+export const screenshotEnabled = !!screenshotServiceUrl;
+
+/**
+ * Capture a screenshot of a deployed site.
+ * Returns null when screenshot service is not configured.
+ */
+export async function captureScreenshot(
+  opts: ScreenshotOptions,
+): Promise<ScreenshotResult | null> {
+  if (!screenshotServiceUrl) return null;
+
+  const {
+    url,
+    width = 1600,
+    height = 900,
+    scale = 2,
+    fullPage = false,
+    timeout = 15_000,
+  } = opts;
+
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeout);
+
+    const res = await fetch(`${screenshotServiceUrl}/screenshot`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ url, width, height, scale, fullPage }),
+      signal: controller.signal,
+    });
+
+    clearTimeout(timer);
+
+    if (!res.ok) {
+      console.error(`[screenshot] Service returned ${res.status}: ${await res.text()}`);
+      return null;
+    }
+
+    const data = (await res.json()) as {
+      url: string;
+      width: number;
+      height: number;
+      size: number;
+    };
+
+    // Upload to CDN if configured
+    let cdnUrl: string | null = null;
+    if (cdnUploadUrl && data.url) {
+      cdnUrl = await uploadToCdn(data.url);
+    }
+
+    return {
+      tempUrl: data.url,
+      cdnUrl,
+      width: data.width,
+      height: data.height,
+      sizeBytes: data.size,
+    };
+  } catch (err) {
+    if ((err as Error).name === "AbortError") {
+      console.warn(`[screenshot] Timed out after ${timeout}ms for ${url}`);
+    } else {
+      console.error(`[screenshot] Failed to capture ${url}:`, err);
+    }
+    return null;
+  }
+}
+
+/**
+ * Capture a screenshot after deploying a project.
+ * Skips backend-only stacks (no UI to screenshot).
+ */
+export async function capturePostDeployScreenshot(
+  siteUrl: string,
+  stack: string,
+): Promise<ScreenshotResult | null> {
+  // Skip for backend-only stacks — no point screenshotting an API
+  const skipStacks = new Set([
+    "express", "fastify", "hono", "nestjs", "koa", "elysia", "adonis",
+    "go", "gin", "fiber", "echo",
+    "rust", "actix", "axum", "rocket",
+    "python", "django", "flask", "fastapi",
+    "rails", "sinatra", "laravel", "symfony",
+    "springboot", "quarkus", "dotnet", "phoenix",
+    "node", "docker",
+  ]);
+
+  if (skipStacks.has(stack)) return null;
+
+  return captureScreenshot({
+    url: siteUrl,
+    width: 1600,
+    height: 900,
+    scale: 2,
+    timeout: 15_000,
+  });
+}
+
+// ─── CDN upload ──────────────────────────────────────────────────────────────
+
+async function uploadToCdn(imageUrl: string): Promise<string | null> {
+  if (!cdnUploadUrl) return null;
+
+  try {
+    const res = await fetch(cdnUploadUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ url: imageUrl }),
+    });
+
+    if (!res.ok) {
+      console.error(`[screenshot] CDN upload failed: ${res.status}`);
+      return null;
+    }
+
+    const data = (await res.json()) as { url: string };
+    return data.url;
+  } catch (err) {
+    console.error("[screenshot] CDN upload error:", err);
+    return null;
+  }
+}
+
+/**
+ * Clean up temporary screenshot from the browser service.
+ */
+export async function cleanupScreenshot(tempUrl: string): Promise<void> {
+  if (!screenshotServiceUrl) return;
+
+  try {
+    await fetch(`${screenshotServiceUrl}/cleanup`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ url: tempUrl }),
+    });
+  } catch {
+    // Best-effort cleanup
+  }
+}