openship 0.1.1 → 0.1.7

package/apps/api/src/lib/compose-parser.ts

@@ -1,138 +0,0 @@
-/**
- * Docker Compose parser — extracts services, ports, volumes, depends_on,
- * and environment from a docker-compose.yml / compose.yml file.
- *
- * Used by the prepare service to populate the services UI for compose projects.
- */
-
-import { parse as parseYaml } from "yaml";
-
-// ─── Types ───────────────────────────────────────────────────────────────────
-
-export interface ComposeService {
-  name: string;
-  image?: string;
-  build?: string;
-  ports: string[];
-  dependsOn: string[];
-  environment: Record<string, string>;
-  volumes: string[];
-}
-
-export interface ComposeParseResult {
-  services: ComposeService[];
-  volumes: string[];
-  networks: string[];
-}
-
-// ─── Parser ──────────────────────────────────────────────────────────────────
-
-export function parseComposeFile(content: string): ComposeParseResult {
-  const doc = parseYaml(content);
-
-  if (!doc || typeof doc !== "object") {
-    return { services: [], volumes: [], networks: [] };
-  }
-
-  const rawServices = doc.services ?? {};
-  const services: ComposeService[] = [];
-
-  for (const [name, def] of Object.entries(rawServices)) {
-    if (!def || typeof def !== "object") continue;
-    const svc = def as Record<string, unknown>;
-
-    services.push({
-      name,
-      image: typeof svc.image === "string" ? svc.image : undefined,
-      build: parseBuild(svc.build),
-      ports: parsePorts(svc.ports),
-      dependsOn: parseDependsOn(svc.depends_on),
-      environment: parseEnvironment(svc.environment),
-      volumes: parseVolumes(svc.volumes),
-    });
-  }
-
-  const volumes = doc.volumes ? Object.keys(doc.volumes) : [];
-  const networks = doc.networks ? Object.keys(doc.networks) : [];
-
-  return { services, volumes, networks };
-}
-
-// ─── Field parsers ───────────────────────────────────────────────────────────
-
-function parseBuild(build: unknown): string | undefined {
-  if (typeof build === "string") return build;
-  if (build && typeof build === "object") {
-    const b = build as Record<string, unknown>;
-    return (typeof b.context === "string" ? b.context : undefined) ?? ".";
-  }
-  return undefined;
-}
-
-function parsePorts(ports: unknown): string[] {
-  if (!Array.isArray(ports)) return [];
-  return ports.map((p) => {
-    if (typeof p === "string") return p;
-    if (typeof p === "number") return String(p);
-    if (p && typeof p === "object") {
-      const port = p as Record<string, unknown>;
-      const target = port.target ?? port.container_port;
-      const published = port.published ?? port.host_port;
-      if (target) {
-        return published ? `${published}:${target}` : String(target);
-      }
-    }
-    return String(p);
-  });
-}
-
-function parseDependsOn(deps: unknown): string[] {
-  if (Array.isArray(deps)) return deps.filter((d): d is string => typeof d === "string");
-  if (deps && typeof deps === "object") return Object.keys(deps);
-  return [];
-}
-
-function parseEnvironment(env: unknown): Record<string, string> {
-  if (!env) return {};
-
-  // Array form: ["KEY=value", "KEY2=value2"]
-  if (Array.isArray(env)) {
-    const result: Record<string, string> = {};
-    for (const item of env) {
-      if (typeof item !== "string") continue;
-      const eqIdx = item.indexOf("=");
-      if (eqIdx > 0) {
-        result[item.slice(0, eqIdx)] = item.slice(eqIdx + 1);
-      } else {
-        result[item] = "";
-      }
-    }
-    return result;
-  }
-
-  // Object form: { KEY: value }
-  if (typeof env === "object") {
-    const result: Record<string, string> = {};
-    for (const [key, val] of Object.entries(env as Record<string, unknown>)) {
-      result[key] = val != null ? String(val) : "";
-    }
-    return result;
-  }
-
-  return {};
-}
-
-function parseVolumes(vols: unknown): string[] {
-  if (!Array.isArray(vols)) return [];
-  return vols.map((v) => {
-    if (typeof v === "string") return v;
-    if (v && typeof v === "object") {
-      const vol = v as Record<string, unknown>;
-      const src = vol.source ?? vol.name;
-      const tgt = vol.target;
-      if (src && tgt) return `${src}:${tgt}`;
-      if (tgt) return String(tgt);
-    }
-    return String(v);
-  });
-}

package/apps/api/src/lib/controller-helpers.ts

@@ -1,90 +0,0 @@
-/**
- * Shared controller helpers — used across all Hono route handlers.
- *
- * Eliminates duplication of getUserId / param / platform() across controllers.
- */
-
-import type { Context } from "hono";
-import {
-  initPlatform,
-  getPlatform,
-  type Platform,
-  type PlatformTarget,
-  type PlatformConfig,
-} from "@repo/adapters";
-import { env } from "../config/env";
-
-// ─── Auth helpers ────────────────────────────────────────────────────────────
-
-/** Extract the authenticated user ID from Hono context */
-export function getUserId(c: Context): string {
-  const user = c.get("user");
-  if (!user?.id) throw new Error("Unauthorized: no user in context");
-  return user.id;
-}
-
-/** Extract and validate a required route parameter */
-export function param(c: Context, name: string): string {
-  const val = c.req.param(name);
-  if (!val) throw new Error(`Missing route param: ${name}`);
-  return val;
-}
-
-// ─── Platform resolution ─────────────────────────────────────────────────────
-
-/**
- * Resolve the deployment target from environment config.
- *
- * CLOUD_MODE (SaaS hosting) and DEPLOY_MODE=cloud (Oblien runtime) both
- * need the cloud platform adapter, so either triggers the cloud config.
- * Auth/billing concerns are gated separately by CLOUD_MODE alone.
- *
- * Priority:
- *   1. CLOUD_MODE=true or DEPLOY_MODE=cloud → "cloud" (Oblien runtime)
- *   2. DEPLOY_MODE=desktop → "desktop"
- *   3. Default → "selfhosted" with docker or bare runtime
- */
-function resolveConfig(): PlatformConfig {
-  if (env.CLOUD_MODE || env.DEPLOY_MODE === "cloud") {
-    return {
-      target: "cloud",
-      cloudClientId: env.OBLIEN_CLIENT_ID,
-      cloudClientSecret: env.OBLIEN_CLIENT_SECRET,
-    };
-  }
-
-  if (env.DEPLOY_MODE === "desktop") {
-    return { target: "desktop" };
-  }
-
-  // Self-hosted: docker or bare
-  return {
-    target: "selfhosted",
-    runtime: env.DEPLOY_MODE === "bare" ? "bare" : "docker",
-  };
-}
-
-/**
- * Initialize the platform at server startup.
- *
- * Call this ONCE before the server starts handling requests.
- * After this, `platform()` returns the cached instance synchronously.
- */
-export async function bootstrapPlatform(): Promise<Platform> {
-  return initPlatform(resolveConfig());
-}
-
-/**
- * Get the platform — the single entry point for all service code.
- *
- * Returns: { runtime, routing, ssl, system }
- *   - runtime: build/deploy/stop/start lifecycle
- *   - routing: register/remove reverse-proxy routes
- *   - ssl: provision/renew TLS certificates
- *   - system: prerequisite validation (self-hosted only, null otherwise)
- *
- * All service code uses this. Nothing constructs adapters directly.
- */
-export function platform(): Platform {
-  return getPlatform();
-}

package/apps/api/src/lib/email-templates.ts

@@ -1,94 +0,0 @@
-/**
- * Email templates for Openship.
- *
- * Each template returns { subject, html, text } so they can be
- * passed directly to sendMail(). Keep all copy and markup here
- * so auth.ts / other callers stay clean.
- */
-
-/* ------------------------------------------------------------------ */
-/*  Shared layout                                                      */
-/* ------------------------------------------------------------------ */
-
-const BRAND = "Openship";
-
-function layout(body: string) {
-  return `
-<!DOCTYPE html>
-<html lang="en">
-<head><meta charset="utf-8" /><meta name="viewport" content="width=device-width" /></head>
-<body style="margin:0;padding:0;background:#f9fafb;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif">
-  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="padding:40px 20px">
-    <tr><td align="center">
-      <table role="presentation" width="480" cellpadding="0" cellspacing="0" style="background:#ffffff;border-radius:16px;padding:40px;border:1px solid #e5e7eb">
-        <tr><td>
-          ${body}
-          <p style="color:#9ca3af;font-size:12px;margin-top:32px;border-top:1px solid #f3f4f6;padding-top:16px">
-            &copy; ${BRAND}
-          </p>
-        </td></tr>
-      </table>
-    </td></tr>
-  </table>
-</body>
-</html>`.trim();
-}
-
-function ctaButton(url: string, label: string) {
-  return `
-<table role="presentation" cellpadding="0" cellspacing="0" style="margin:24px 0">
-  <tr><td align="center" style="background:#000;border-radius:10px">
-    <a href="${url}" target="_blank" style="display:inline-block;padding:12px 28px;color:#fff;font-size:14px;font-weight:600;text-decoration:none">${label}</a>
-  </td></tr>
-</table>`.trim();
-}
-
-function greeting(name?: string | null) {
-  return `<p style="color:#111;font-size:15px;margin:0 0 16px">Hi ${name || "there"},</p>`;
-}
-
-/* ------------------------------------------------------------------ */
-/*  Reset password                                                     */
-/* ------------------------------------------------------------------ */
-
-export function resetPasswordEmail(user: { name?: string | null; email: string }, url: string) {
-  const html = layout(`
-    ${greeting(user.name)}
-    <p style="color:#374151;font-size:14px;line-height:1.6;margin:0 0 4px">
-      We received a request to reset your password. Click the button below to choose a new one.
-    </p>
-    ${ctaButton(url, "Reset password")}
-    <p style="color:#9ca3af;font-size:13px;margin:0">
-      If you didn't request this, you can safely ignore this email. The link expires in 1 hour.
-    </p>
-  `);
-
-  return {
-    subject: "Reset your Openship password",
-    html,
-    text: `Hi ${user.name || "there"},\n\nReset your password: ${url}\n\nIf you didn't request this, ignore this email. The link expires in 1 hour.`,
-  };
-}
-
-/* ------------------------------------------------------------------ */
-/*  Verify email                                                       */
-/* ------------------------------------------------------------------ */
-
-export function verifyEmailTemplate(user: { name?: string | null; email: string }, url: string) {
-  const html = layout(`
-    ${greeting(user.name)}
-    <p style="color:#374151;font-size:14px;line-height:1.6;margin:0 0 4px">
-      Please verify your email address to get started with ${BRAND}.
-    </p>
-    ${ctaButton(url, "Verify email")}
-    <p style="color:#9ca3af;font-size:13px;margin:0">
-      If you didn't create an account, you can ignore this email.
-    </p>
-  `);
-
-  return {
-    subject: "Verify your Openship email",
-    html,
-    text: `Hi ${user.name || "there"},\n\nVerify your email: ${url}\n\nIf you didn't create an account, ignore this email.`,
-  };
-}

package/apps/api/src/lib/encryption.ts

@@ -1,102 +0,0 @@
-/**
- * Application-level encryption for sensitive data (env vars, secrets).
- *
- * Uses AES-256-GCM (authenticated encryption) via Node.js built-in crypto.
- * The encryption key is derived from BETTER_AUTH_SECRET (which every install
- * already has) — no extra env var needed.
- *
- * Format:  base64( iv:16 || authTag:16 || ciphertext )
- *
- * Usage:
- *   import { encrypt, decrypt } from "../lib/encryption";
- *   const sealed = encrypt("my secret");
- *   const plain  = decrypt(sealed); // "my secret"
- */
-
-import {
-  createCipheriv,
-  createDecipheriv,
-  createHash,
-  randomBytes,
-} from "node:crypto";
-import { env } from "../config/env";
-
-// ─── Key derivation ──────────────────────────────────────────────────────────
-
-const ALGORITHM = "aes-256-gcm" as const;
-const IV_LENGTH = 16;
-const AUTH_TAG_LENGTH = 16;
-
-/**
- * Derive a deterministic 256-bit key from the auth secret.
- * SHA-256 always produces 32 bytes — exactly what AES-256 needs.
- */
-function deriveKey(): Buffer {
-  return createHash("sha256")
-    .update(env.BETTER_AUTH_SECRET)
-    .digest();
-}
-
-// ─── Public API ──────────────────────────────────────────────────────────────
-
-/**
- * Encrypt a plaintext string.
- * Returns a base64-encoded string containing IV + auth tag + ciphertext.
- */
-export function encrypt(plaintext: string): string {
-  const key = deriveKey();
-  const iv = randomBytes(IV_LENGTH);
-
-  const cipher = createCipheriv(ALGORITHM, key, iv);
-  const encrypted = Buffer.concat([
-    cipher.update(plaintext, "utf8"),
-    cipher.final(),
-  ]);
-  const authTag = cipher.getAuthTag();
-
-  // Pack: iv (16) + authTag (16) + ciphertext (variable)
-  const packed = Buffer.concat([iv, authTag, encrypted]);
-  return packed.toString("base64");
-}
-
-/**
- * Decrypt a value produced by `encrypt()`.
- * Throws if the data is tampered with or the key is wrong.
- */
-export function decrypt(sealed: string): string {
-  const key = deriveKey();
-  const packed = Buffer.from(sealed, "base64");
-
-  if (packed.length < IV_LENGTH + AUTH_TAG_LENGTH) {
-    throw new Error("Invalid encrypted data: too short");
-  }
-
-  const iv = packed.subarray(0, IV_LENGTH);
-  const authTag = packed.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
-  const ciphertext = packed.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
-
-  const decipher = createDecipheriv(ALGORITHM, key, iv);
-  decipher.setAuthTag(authTag);
-
-  const decrypted = Buffer.concat([
-    decipher.update(ciphertext),
-    decipher.final(),
-  ]);
-
-  return decrypted.toString("utf8");
-}
-
-/**
- * Encrypt a JSON-serialisable value.
- * Convenience wrapper for structured data like env var arrays.
- */
-export function encryptJson<T>(value: T): string {
-  return encrypt(JSON.stringify(value));
-}
-
-/**
- * Decrypt a value produced by `encryptJson()`.
- */
-export function decryptJson<T = unknown>(sealed: string): T {
-  return JSON.parse(decrypt(sealed)) as T;
-}

package/apps/api/src/lib/local-user.ts

@@ -1,65 +0,0 @@
-/**
- * Local user — auto-provisioned DB user for self-hosted/desktop mode.
- *
- * In local mode the API trusts all requests (it only listens on 127.0.0.1).
- * However, controllers reference `userId` as a FK, so a real user row must
- * exist. This module lazily creates one on first access and caches it.
- *
- * The user is an admin with `autoProvisioned = true`.
- */
-
-import { randomUUID } from "node:crypto";
-import { repos } from "@repo/db";
-
-const LOCAL_EMAIL = "local@openship.local";
-
-/** Shape expected by Hono context consumers (`c.get("user")`) */
-export interface LocalUser {
-  id: string;
-  name: string;
-  email: string;
-  emailVerified: boolean;
-  role: string;
-  autoProvisioned: boolean;
-}
-
-/** Cached user — avoids a DB hit on every request after the first. */
-let cached: LocalUser | null = null;
-
-/**
- * Ensure a local user row exists in the database and return it.
- *
- * - First call: looks up `local@openship.local`, creates if missing.
- * - Subsequent calls: returns the in-memory cache (zero DB cost).
- */
-export async function ensureLocalUser(): Promise<LocalUser> {
-  if (cached) return cached;
-
-  let row = await repos.user.findByEmail(LOCAL_EMAIL);
-
-  if (!row) {
-    // Insert directly — no password/session needed in local mode.
-    const id = randomUUID();
-    const { db, schema } = await import("@repo/db");
-    await db.insert(schema.user).values({
-      id,
-      name: "Local User",
-      email: LOCAL_EMAIL,
-      emailVerified: true,
-      role: "admin",
-      autoProvisioned: true,
-    });
-    row = await repos.user.findById(id);
-  }
-
-  cached = {
-    id: row!.id,
-    name: row!.name,
-    email: row!.email,
-    emailVerified: row!.emailVerified,
-    role: row!.role,
-    autoProvisioned: row!.autoProvisioned,
-  };
-
-  return cached;
-}

package/apps/api/src/lib/mail.ts

@@ -1,48 +0,0 @@
-import nodemailer from "nodemailer";
-import { env } from "../config/env";
-
-/**
- * Lightweight email sender using SMTP.
- *
- * Only available when SMTP_HOST is configured.
- * Self-hosted instances without SMTP skip email-dependent features
- * (verification, password reset) gracefully.
- */
-
-export const smtpEnabled = !!(env.SMTP_HOST && env.SMTP_USER && env.SMTP_PASS);
-
-export type SendMailOptions = {
-  to: string;
-  subject: string;
-  html: string;
-  text?: string;
-};
-
-/** Reusable transport — created once when SMTP is available. */
-const transport = smtpEnabled
-  ? nodemailer.createTransport({
-      host: env.SMTP_HOST,
-      port: env.SMTP_PORT ?? 587,
-      secure: (env.SMTP_PORT ?? 587) === 465,
-      auth: {
-        user: env.SMTP_USER,
-        pass: env.SMTP_PASS,
-      },
-    })
-  : null;
-
-/** Send an email via SMTP. No-ops when SMTP is not configured. */
-export async function sendMail(opts: SendMailOptions): Promise<void> {
-  if (!transport) {
-    console.warn("[mail] SMTP not configured — skipping email to", opts.to);
-    return;
-  }
-
-  await transport.sendMail({
-    from: env.SMTP_FROM,
-    to: opts.to,
-    subject: opts.subject,
-    html: opts.html,
-    ...(opts.text ? { text: opts.text } : {}),
-  });
-}