openship 0.1.1 → 0.1.7

package/apps/api/src/lib/system-debug.ts

@@ -1,10 +0,0 @@
-import { env } from "../config/env";
-
-export function systemDebug(scope: string, message: string): void {
-  if (!env.SYSTEM_DEBUG_LOGS) return;
-  console.log(`[system-debug][${scope}] ${new Date().toISOString()} ${message}`);
-}
-
-export function formatDuration(startMs: number): string {
-  return `${Date.now() - startMs}ms`;
-}

package/apps/api/src/middleware/auth.ts

@@ -1,60 +0,0 @@
-import type { Context, Next } from "hono";
-import { auth } from "../lib/auth";
-import { env } from "../config/env";
-import { ensureLocalUser } from "../lib/local-user";
-
-/**
- * Session authentication middleware.
- *
- * - Desktop: try real Better Auth session first (cloud-authenticated users),
- *            fall back to zero-auth local admin if no session exists.
- * - Self-hosted: validates Better Auth session (email/password registration).
- * - SaaS (CLOUD_MODE): validates Better Auth session (standard flow).
- *
- * Supports both cookie-based sessions (dashboard) and Bearer tokens (CLI/API).
- *
- * Usage:
- *   app.get("/api/projects", authMiddleware, handler);
- */
-export async function authMiddleware(c: Context, next: Next) {
-  /* Desktop mode: try real session first, fall back to zero-auth */
-  if (env.DEPLOY_MODE === "desktop") {
-    try {
-      const session = await auth.api.getSession({
-        headers: c.req.raw.headers,
-      });
-      if (session) {
-        c.set("user", session.user);
-        c.set("session", session.session);
-        return next();
-      }
-    } catch {
-      // No valid session — fall through
-    }
-
-    // Zero-auth fallback — only when authMode is "none" (self-hosted desktop).
-    // Cloud-auth users must re-authenticate via Openship Cloud.
-    const { getAuthMode } = await import("../lib/auth-mode");
-    const authMode = await getAuthMode();
-    if (authMode !== "none") {
-      return c.json({ error: "Unauthorized" }, 401);
-    }
-
-    const user = await ensureLocalUser();
-    c.set("user", user);
-    c.set("session", { id: "desktop", userId: user.id });
-    return next();
-  }
-
-  const session = await auth.api.getSession({
-    headers: c.req.raw.headers,
-  });
-
-  if (!session) {
-    return c.json({ error: "Unauthorized" }, 401);
-  }
-
-  c.set("user", session.user);
-  c.set("session", session.session);
-  await next();
-}

package/apps/api/src/middleware/error-handler.ts

@@ -1,41 +0,0 @@
-import type { Context, Next } from "hono";
-import { ZodError } from "zod";
-import { AppError } from "@repo/core";
-
-/**
- * Global error handler middleware.
- * Catches errors thrown anywhere in the request chain and returns
- * a consistent JSON response.
- *
- * Order of precedence:
- * 1. ZodError → 400 with field-level details
- * 2. AppError subclass → statusCode + message + code
- * 3. Unknown → 500
- */
-export async function errorHandler(c: Context, next: Next) {
-  try {
-    await next();
-  } catch (err: unknown) {
-    if (err instanceof ZodError) {
-      return c.json(
-        {
-          error: "Validation error",
-          code: "VALIDATION_ERROR",
-          details: err.flatten().fieldErrors,
-        },
-        400,
-      );
-    }
-
-    if (err instanceof AppError) {
-      const { message, code, statusCode } = err;
-      return c.json(
-        { error: message, code },
-        statusCode as 400 | 401 | 403 | 404 | 409 | 500,
-      );
-    }
-
-    console.error("[UNHANDLED ERROR]", err);
-    return c.json({ error: "Internal server error" }, 500);
-  }
-}

package/apps/api/src/middleware/index.ts

@@ -1,5 +0,0 @@
-export { authMiddleware } from "./auth";
-export { internalAuth } from "./internal-auth";
-export { localOnly } from "./local-only";
-export { rateLimiter } from "./rate-limiter";
-export { errorHandler } from "./error-handler";

package/apps/api/src/middleware/internal-auth.ts

@@ -1,40 +0,0 @@
-import { timingSafeEqual } from "node:crypto";
-import type { Context, Next } from "hono";
-import { env } from "../config";
-
-/**
- * Middleware that validates the internal token for Electron → API calls.
- *
- * The desktop app generates a shared secret on first run and passes it
- * to the API via the INTERNAL_TOKEN env var. This allows Electron to push
- * system settings (SSH, tunnel, build mode) directly without user auth.
- *
- * Uses timing-safe comparison to prevent side-channel leakage.
- *
- * Expects: `X-Internal-Token: <token>` header.
- */
-export async function internalAuth(c: Context, next: Next) {
-  // If no internal token is configured, allow the request.
-  // localOnly middleware (applied before this) already blocks cloud mode.
-  // Self-hosted users control their own machine — localhost trust is standard.
-  if (!env.INTERNAL_TOKEN) {
-    await next();
-    return;
-  }
-
-  const token = c.req.header("X-Internal-Token");
-
-  if (!token) {
-    return c.json({ error: "Unauthorized" }, 401);
-  }
-
-  // Timing-safe comparison — prevents response-time side-channel attacks
-  const expected = Buffer.from(env.INTERNAL_TOKEN, "utf-8");
-  const received = Buffer.from(token, "utf-8");
-
-  if (expected.length !== received.length || !timingSafeEqual(expected, received)) {
-    return c.json({ error: "Unauthorized" }, 401);
-  }
-
-  await next();
-}

package/apps/api/src/middleware/local-only.ts

@@ -1,20 +0,0 @@
-import type { Context, Next } from "hono";
-import { env } from "../config";
-
-/**
- * Middleware that restricts a route to self-hosted instances only.
- *
- * Returns 404 when CLOUD_MODE=true (i.e. the managed openship.com SaaS).
- * Self-hosted deployments (docker, bare, desktop) — even those using
- * GitHub App auth or OAuth — retain full local filesystem access.
- *
- * This prevents RCE via local path endpoints on the public SaaS site
- * while keeping the feature available for all self-hosted setups.
- */
-export async function localOnly(c: Context, next: Next) {
-  if (env.CLOUD_MODE) {
-    return c.notFound();
-  }
-
-  await next();
-}

package/apps/api/src/middleware/rate-limiter.ts

@@ -1,35 +0,0 @@
-import type { Context, Next } from "hono";
-
-/**
- * Rate-limiting middleware.
- * Uses a simple in-memory store (swap for Redis in production).
- */
-const requestCounts = new Map<string, { count: number; resetAt: number }>();
-
-export async function rateLimiter(c: Context, next: Next) {
-  const path = c.req.path;
-  
-  // Skip rate limiting for get-session - it's a safe read-only endpoint
-  // that gets called frequently on page navigations
-  if (path === "/api/auth/get-session") {
-    await next();
-    return;
-  }
-  
-  const ip = c.req.header("x-forwarded-for") || "unknown";
-  const now = Date.now();
-  const window = 60_000; // 1 minute
-  const maxRequests = 100;
-
-  const entry = requestCounts.get(ip);
-
-  if (!entry || now > entry.resetAt) {
-    requestCounts.set(ip, { count: 1, resetAt: now + window });
-  } else if (entry.count >= maxRequests) {
-    return c.json({ error: "Too many requests" }, 429);
-  } else {
-    entry.count++;
-  }
-
-  await next();
-}

package/apps/api/src/modules/analytics/analytics.controller.ts

@@ -1,111 +0,0 @@
-/**
- * Analytics controller — handlers for analytics + usage + stats endpoints.
- */
-
-import type { Context } from "hono";
-import { streamSSE } from "hono/streaming";
-import { getUserId, platform } from "../../lib/controller-helpers";
-import { repos } from "@repo/db";
-import * as analyticsService from "./analytics.service";
-import type { TAnalyticsQuery, TUsageQuery, TUsageStreamQuery } from "./analytics.schema";
-
-// ─── Request analytics ───────────────────────────────────────────────────────
-
-/** GET /analytics — cumulative summary */
-export async function summary(c: Context) {
-  const userId = getUserId(c);
-  const { projectId } = c.req.query() as unknown as TAnalyticsQuery;
-  const data = await analyticsService.getAnalyticsSummary(projectId, userId);
-  return c.json({ data });
-}
-
-/** GET /analytics/periods — time-series periods */
-export async function periods(c: Context) {
-  const userId = getUserId(c);
-  const { projectId, from, to } = c.req.query() as unknown as TAnalyticsQuery;
-  const data = await analyticsService.getAnalyticsPeriods(projectId, userId, from, to);
-  return c.json({ data });
-}
-
-// ─── Deployment stats ────────────────────────────────────────────────────────
-
-/** GET /analytics/deployments — deployment success/fail/avg build stats */
-export async function deploymentStats(c: Context) {
-  const userId = getUserId(c);
-  const { projectId } = c.req.query() as unknown as TAnalyticsQuery;
-  const data = await analyticsService.getDeploymentStats(projectId, userId);
-  return c.json({ data });
-}
-
-// ─── Resource usage ──────────────────────────────────────────────────────────
-
-/** GET /analytics/usage — current container resource usage */
-export async function usage(c: Context) {
-  const userId = getUserId(c);
-  const { projectId } = c.req.query() as unknown as TUsageQuery;
-  const data = await analyticsService.getContainerUsage(projectId, userId);
-  return c.json({ data });
-}
-
-/** GET /analytics/container — container info (status, IP, uptime) */
-export async function containerInfo(c: Context) {
-  const userId = getUserId(c);
-  const { projectId } = c.req.query() as unknown as TUsageQuery;
-  const data = await analyticsService.getContainerInfo(projectId, userId);
-  return c.json({ data });
-}
-
-/** GET /analytics/usage/stream — SSE stream of real-time resource usage */
-export async function usageStream(c: Context) {
-  const userId = getUserId(c);
-  const { projectId } = c.req.query() as unknown as TUsageStreamQuery;
-
-  // Verify project access
-  const project = await repos.project.findById(projectId);
-  if (!project || project.userId !== userId) {
-    return c.json({ error: "Project not found" }, 404);
-  }
-
-  if (!project.activeDeploymentId) {
-    return c.json({ error: "No active deployment" }, 404);
-  }
-
-  const dep = await repos.deployment.findById(project.activeDeploymentId);
-  if (!dep?.containerId) {
-    return c.json({ error: "No active container" }, 404);
-  }
-
-  const { runtime } = platform();
-
-  return streamSSE(c, async (sseStream) => {
-    const intervalMs = 5_000; // 5 seconds
-    let running = true;
-
-    sseStream.onAbort(() => { running = false; });
-
-    while (running) {
-      try {
-        const stats = await runtime.getUsage(dep.containerId!);
-        await sseStream.writeSSE({
-          event: "usage",
-          data: JSON.stringify({ timestamp: new Date().toISOString(), ...stats }),
-        });
-      } catch {
-        await sseStream.writeSSE({
-          event: "error",
-          data: JSON.stringify({ error: "Failed to fetch usage" }),
-        });
-      }
-      await new Promise((r) => setTimeout(r, intervalMs));
-    }
-  });
-}
-
-// ─── Dashboard ───────────────────────────────────────────────────────────────
-
-/** GET /analytics/dashboard — overview stats for user's dashboard home */
-export async function dashboard(c: Context) {
-  const userId = getUserId(c);
-  const data = await analyticsService.getDashboardStats(userId);
-  return c.json({ data });
-}

package/apps/api/src/modules/analytics/analytics.routes.ts

@@ -1,29 +0,0 @@
-/**
- * Analytics routes — mounted at /api/analytics in app.ts.
- *
- * All routes require authentication.
- */
-
-import { Hono } from "hono";
-import { authMiddleware } from "../../middleware";
-import * as ctrl from "./analytics.controller";
-
-export const analyticsRoutes = new Hono();
-
-/* All analytics routes require authentication */
-analyticsRoutes.use("*", authMiddleware);
-
-/* ─── Request analytics ────────────────────────────────────────────────── */
-analyticsRoutes.get("/", ctrl.summary);
-analyticsRoutes.get("/periods", ctrl.periods);
-
-/* ─── Deployment stats ─────────────────────────────────────────────────── */
-analyticsRoutes.get("/deployments", ctrl.deploymentStats);
-
-/* ─── Resource usage ───────────────────────────────────────────────────── */
-analyticsRoutes.get("/usage", ctrl.usage);
-analyticsRoutes.get("/usage/stream", ctrl.usageStream);
-analyticsRoutes.get("/container", ctrl.containerInfo);
-
-/* ─── Dashboard ────────────────────────────────────────────────────────── */
-analyticsRoutes.get("/dashboard", ctrl.dashboard);

package/apps/api/src/modules/analytics/analytics.schema.ts

@@ -1,37 +0,0 @@
-/**
- * Analytics schemas — TypeBox validation for analytics endpoints.
- */
-
-import { Type, type Static } from "@sinclair/typebox";
-
-// ─── Query params ────────────────────────────────────────────────────────────
-
-export const AnalyticsQuery = Type.Object({
-  projectId: Type.String({ minLength: 1 }),
-  /** ISO date string — start of range */
-  from: Type.Optional(Type.String()),
-  /** ISO date string — end of range */
-  to: Type.Optional(Type.String()),
-  /** Include live (real-time) data from the running container */
-  live: Type.Optional(Type.Boolean({ default: false })),
-});
-
-export const UsageQuery = Type.Object({
-  projectId: Type.String({ minLength: 1 }),
-  /** ISO date string — start of range */
-  from: Type.Optional(Type.String()),
-  /** ISO date string — end of range */
-  to: Type.Optional(Type.String()),
-  /** Bucket size in minutes for time-series data (min 10) */
-  bucketMinutes: Type.Optional(Type.Number({ minimum: 10, default: 60 })),
-});
-
-export const UsageStreamQuery = Type.Object({
-  projectId: Type.String({ minLength: 1 }),
-});
-
-// ─── Inferred types ──────────────────────────────────────────────────────────
-
-export type TAnalyticsQuery = Static<typeof AnalyticsQuery>;
-export type TUsageQuery = Static<typeof UsageQuery>;
-export type TUsageStreamQuery = Static<typeof UsageStreamQuery>;

package/apps/api/src/modules/analytics/analytics.service.ts

@@ -1,264 +0,0 @@
-/**
- * Analytics service — request analytics, resource usage, and deployment stats.
- *
- * Data sources:
- *   - DB:      Historical aggregated periods, cumulative counters
- *   - Redis:   Live request logs + counters (populated by the reverse-proxy)
- *   - Adapter: Real-time container resource usage (CPU, memory, network)
- *
- * The runtime integration is behind the Platform interface, so this
- * service works identically with Docker (self-hosted) and Oblien (cloud).
- */
-
-import { repos } from "@repo/db";
-import { NotFoundError } from "@repo/core";
-import { platform } from "../../lib/controller-helpers";
-import type { ResourceUsage } from "@repo/adapters";
-
-// ─── Types ───────────────────────────────────────────────────────────────────
-
-export interface AnalyticsSummary {
-  /** Total requests (all time) */
-  totalRequests: number;
-  /** Total unique visitors */
-  uniqueVisitors: number;
-  /** Bandwidth in bytes */
-  bandwidthIn: number;
-  bandwidthOut: number;
-  /** Average response time in ms */
-  avgResponseTimeMs: number;
-  /** Last flush timestamp */
-  lastUpdated: string | null;
-}
-
-export interface AnalyticsPeriod {
-  /** Period start */
-  from: string;
-  /** Period end */
-  to: string;
-  requests: number;
-  uniqueVisitors: number;
-  bandwidthIn: number;
-  bandwidthOut: number;
-  avgResponseTimeMs: number;
-  topPaths: { path: string; count: number }[];
-  trafficByHour: Record<string, number>;
-}
-
-export interface DeploymentStats {
-  totalDeployments: number;
-  successfulDeployments: number;
-  failedDeployments: number;
-  avgBuildDurationMs: number;
-  /** Deployments per day for the last N days */
-  dailyCounts: { date: string; total: number; success: number; failed: number }[];
-}
-
-export interface ContainerUsageSnapshot {
-  timestamp: string;
-  cpuPercent: number;
-  memoryMb: number;
-  diskMb: number;
-  networkRxBytes: number;
-  networkTxBytes: number;
-}
-
-// ─── Analytics summary ───────────────────────────────────────────────────────
-
-/**
- * Get cumulative analytics summary for a project.
- * Returns totals from DB + optional live increment from Redis.
- */
-export async function getAnalyticsSummary(
-  projectId: string,
-  userId: string,
-): Promise<AnalyticsSummary> {
-  const project = await repos.project.findById(projectId);
-  if (!project || project.userId !== userId) {
-    throw new NotFoundError("Project", projectId);
-  }
-
-  // TODO: Fetch from analytics_summary table once analytics flush is wired
-  // For now, return zero-state
-  return {
-    totalRequests: 0,
-    uniqueVisitors: 0,
-    bandwidthIn: 0,
-    bandwidthOut: 0,
-    avgResponseTimeMs: 0,
-    lastUpdated: null,
-  };
-}
-
-// ─── Analytics periods ───────────────────────────────────────────────────────
-
-/**
- * Get aggregated analytics periods for a date range.
- * Used for charts and detailed reports.
- */
-export async function getAnalyticsPeriods(
-  projectId: string,
-  userId: string,
-  from?: string,
-  to?: string,
-): Promise<AnalyticsPeriod[]> {
-  const project = await repos.project.findById(projectId);
-  if (!project || project.userId !== userId) {
-    throw new NotFoundError("Project", projectId);
-  }
-
-  // TODO: Fetch from analytics_period table once analytics flush is wired
-  return [];
-}
-
-// ─── Deployment stats ────────────────────────────────────────────────────────
-
-/**
- * Get deployment statistics for a project:
- *   - Total / success / failed counts
- *   - Average build duration
- *   - Daily deployments for the last 30 days
- */
-export async function getDeploymentStats(
-  projectId: string,
-  userId: string,
-  days = 30,
-): Promise<DeploymentStats> {
-  const project = await repos.project.findById(projectId);
-  if (!project || project.userId !== userId) {
-    throw new NotFoundError("Project", projectId);
-  }
-
-  // Fetch all deployments for counting
-  const { rows: deployments } = await repos.deployment.listByProject(projectId, {
-    page: 1,
-    perPage: 10_000, // Get all for stats
-  });
-
-  const total = deployments.length;
-  const success = deployments.filter((d) => d.status === "ready").length;
-  const failed = deployments.filter((d) => d.status === "failed").length;
-
-  // Average build duration of successful deployments
-  const successDeps = deployments.filter(
-    (d) => d.status === "ready" && d.buildDurationMs,
-  );
-  const avgBuild =
-    successDeps.length > 0
-      ? Math.round(
-          successDeps.reduce((sum, d) => sum + (d.buildDurationMs ?? 0), 0) /
-            successDeps.length,
-        )
-      : 0;
-
-  // Daily counts for the last N days
-  const now = new Date();
-  const dailyCounts: DeploymentStats["dailyCounts"] = [];
-  for (let i = days - 1; i >= 0; i--) {
-    const date = new Date(now);
-    date.setDate(date.getDate() - i);
-    const dateStr = date.toISOString().split("T")[0]!;
-
-    const dayDeps = deployments.filter((d) => {
-      const depDate = new Date(d.createdAt).toISOString().split("T")[0];
-      return depDate === dateStr;
-    });
-
-    dailyCounts.push({
-      date: dateStr,
-      total: dayDeps.length,
-      success: dayDeps.filter((d) => d.status === "ready").length,
-      failed: dayDeps.filter((d) => d.status === "failed").length,
-    });
-  }
-
-  return {
-    totalDeployments: total,
-    successfulDeployments: success,
-    failedDeployments: failed,
-    avgBuildDurationMs: avgBuild,
-    dailyCounts,
-  };
-}
-
-// ─── Resource usage (live) ───────────────────────────────────────────────────
-
-/**
- * Get current resource usage for a project's active container.
- * Returns null if no active deployment.
- */
-export async function getContainerUsage(
-  projectId: string,
-  userId: string,
-): Promise<ResourceUsage | null> {
-  const project = await repos.project.findById(projectId);
-  if (!project || project.userId !== userId) {
-    throw new NotFoundError("Project", projectId);
-  }
-
-  if (!project.activeDeploymentId) return null;
-
-  const dep = await repos.deployment.findById(project.activeDeploymentId);
-  if (!dep?.containerId) return null;
-
-  const { runtime } = platform();
-  return runtime.getUsage(dep.containerId);
-}
-
-/**
- * Get container info (status, IP, uptime, current usage).
- */
-export async function getContainerInfo(
-  projectId: string,
-  userId: string,
-) {
-  const project = await repos.project.findById(projectId);
-  if (!project || project.userId !== userId) {
-    throw new NotFoundError("Project", projectId);
-  }
-
-  if (!project.activeDeploymentId) return null;
-
-  const dep = await repos.deployment.findById(project.activeDeploymentId);
-  if (!dep?.containerId) return null;
-
-  const { runtime } = platform();
-  return runtime.getContainerInfo(dep.containerId);
-}
-
-// ─── Dashboard home stats ────────────────────────────────────────────────────
-
-/**
- * Get overview stats for the user's dashboard home.
- */
-export async function getDashboardStats(userId: string) {
-  const { rows: projects, total: totalProjects } = await repos.project.listByUser(
-    userId,
-    { page: 1, perPage: 10_000 },
-  );
-
-  const activeProjects = projects.filter((p) => p.activeDeploymentId).length;
-
-  // Aggregate deployment counts across all projects
-  let totalDeployments = 0;
-  let failedDeployments = 0;
-  let successDeployments = 0;
-
-  for (const p of projects.slice(0, 50)) {
-    // Limit to 50 projects for perf
-    const { rows } = await repos.deployment.listByProject(p.id, { page: 1, perPage: 100 });
-    totalDeployments += rows.length;
-    failedDeployments += rows.filter((d) => d.status === "failed").length;
-    successDeployments += rows.filter((d) => d.status === "ready").length;
-  }
-
-  return {
-    projects: { total: totalProjects, active: activeProjects },
-    deployments: {
-      total: totalDeployments,
-      success: successDeployments,
-      failed: failedDeployments,
-      pending: totalDeployments - successDeployments - failedDeployments,
-    },
-  };
-}