openship 0.1.1 → 0.1.7

package/apps/api/src/modules/system/setup-session.ts

@@ -1,255 +0,0 @@
-/**
- * Setup session manager — tracks active system install SSE streams.
- *
- * Similar to the build session manager but simpler: tracks install
- * progress per component, streams real-time logs to subscribers,
- * and supports log replay for late joiners / page reloads.
- */
-
-import { TtlCache } from "../../lib/cache";
-
-// ─── Types ───────────────────────────────────────────────────────────────────
-
-export type SetupSessionStatus = "running" | "completed" | "failed";
-
-export interface ComponentProgress {
-  name: string;
-  label: string;
-  status: "pending" | "installing" | "installed" | "failed";
-  error?: string;
-}
-
-export interface SetupLogEntry {
-  timestamp: string;
-  component: string;
-  message: string;
-  level: "info" | "warn" | "error";
-}
-
-export interface SetupSessionState {
-  id: string;
-  status: SetupSessionStatus;
-  components: ComponentProgress[];
-  logs: SetupLogEntry[];
-  subscribers: Set<SseWriter>;
-  startedAt: number;
-  finishedAt?: number;
-}
-
-export type SseWriter = (event: string, data: string) => boolean;
-
-// ─── Cache ───────────────────────────────────────────────────────────────────
-
-/** Active setup sessions — keyed by session ID. TTL 30 min. */
-const sessions = new TtlCache<SetupSessionState>({
-  maxSize: 50,
-  sweepIntervalMs: 60_000,
-});
-
-// ─── Heartbeat ───────────────────────────────────────────────────────────────
-
-const heartbeatTimer = setInterval(() => {
-  for (const session of sessions.values()) {
-    const dead: SseWriter[] = [];
-    for (const writer of session.subscribers) {
-      const ok = writer("ping", "{}");
-      if (!ok) dead.push(writer);
-    }
-    for (const w of dead) session.subscribers.delete(w);
-  }
-}, 15_000);
-
-if (heartbeatTimer.unref) heartbeatTimer.unref();
-
-// ─── Public API ──────────────────────────────────────────────────────────────
-
-/** Create a new setup session. */
-export function createSetupSession(
-  componentNames: { name: string; label: string }[],
-): SetupSessionState {
-  const id = `setup_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-  const state: SetupSessionState = {
-    id,
-    status: "running",
-    components: componentNames.map((c) => ({
-      name: c.name,
-      label: c.label,
-      status: "pending",
-    })),
-    logs: [],
-    subscribers: new Set(),
-    startedAt: Date.now(),
-  };
-  sessions.set(id, state, 1800); // 30 min TTL
-  return state;
-}
-
-/** Get a session by ID. */
-export function getSetupSession(id: string): SetupSessionState | null {
-  return sessions.get(id);
-}
-
-/** Get the currently active session (status === "running"). */
-export function getActiveSetupSession(): SetupSessionState | null {
-  for (const session of sessions.values()) {
-    if (session.status === "running") return session;
-  }
-  return null;
-}
-
-/** Update a component's progress and broadcast. */
-export function updateComponentProgress(
-  sessionId: string,
-  componentName: string,
-  status: ComponentProgress["status"],
-  error?: string,
-): void {
-  const session = sessions.get(sessionId);
-  if (!session) return;
-
-  const comp = session.components.find((c) => c.name === componentName);
-  if (comp) {
-    comp.status = status;
-    comp.error = error;
-  }
-
-  broadcast(session, "progress", JSON.stringify({
-    type: "progress",
-    component: componentName,
-    status,
-    error,
-    components: session.components,
-  }));
-}
-
-/** Append a log entry and broadcast to subscribers. */
-export function appendSetupLog(
-  sessionId: string,
-  component: string,
-  message: string,
-  level: SetupLogEntry["level"] = "info",
-): void {
-  const session = sessions.get(sessionId);
-  if (!session) return;
-
-  const entry: SetupLogEntry = {
-    timestamp: new Date().toISOString(),
-    component,
-    message,
-    level,
-  };
-
-  session.logs.push(entry);
-  // Cap logs for memory safety
-  if (session.logs.length > 5000) {
-    session.logs.splice(0, session.logs.length - 5000);
-  }
-
-  broadcast(session, "log", JSON.stringify({
-    type: "log",
-    ...entry,
-  }));
-}
-
-/** Mark the session as completed or failed and notify subscribers. */
-export function finishSetupSession(
-  sessionId: string,
-  status: "completed" | "failed",
-): void {
-  const session = sessions.get(sessionId);
-  if (!session) return;
-
-  session.status = status;
-  session.finishedAt = Date.now();
-
-  broadcast(session, "complete", JSON.stringify({
-    type: "complete",
-    status,
-    components: session.components,
-    durationMs: session.finishedAt - session.startedAt,
-  }));
-
-  // Send end event and close all subscribers
-  const endPayload = JSON.stringify({ type: "end", status });
-  for (const writer of session.subscribers) {
-    writer("end", endPayload);
-  }
-  session.subscribers.clear();
-}
-
-/** Subscribe an SSE writer to a session; replays existing logs. */
-export function subscribeSetupSession(
-  sessionId: string,
-  writer: SseWriter,
-): { success: boolean; unsubscribe: () => void } {
-  const session = sessions.get(sessionId);
-  if (!session) return { success: false, unsubscribe: () => {} };
-
-  // Enforce subscriber limit
-  if (session.subscribers.size >= 10) {
-    const oldest = session.subscribers.values().next().value;
-    if (oldest) {
-      oldest("end", JSON.stringify({ message: "Evicted: subscriber limit reached" }));
-      session.subscribers.delete(oldest);
-    }
-  }
-
-  session.subscribers.add(writer);
-
-  // Replay current progress state
-  writer("progress", JSON.stringify({
-    type: "progress",
-    component: null,
-    status: session.status,
-    components: session.components,
-  }));
-
-  // Replay existing logs
-  for (const entry of session.logs) {
-    const ok = writer("log", JSON.stringify({ type: "log", ...entry }));
-    if (!ok) {
-      session.subscribers.delete(writer);
-      return { success: false, unsubscribe: () => {} };
-    }
-  }
-
-  // If session already finished, send completion + end  
-  if (session.status !== "running") {
-    writer("complete", JSON.stringify({
-      type: "complete",
-      status: session.status,
-      components: session.components,
-      durationMs: (session.finishedAt ?? Date.now()) - session.startedAt,
-    }));
-    writer("end", JSON.stringify({ type: "end", status: session.status }));
-    session.subscribers.delete(writer);
-  }
-
-  return {
-    success: true,
-    unsubscribe: () => session.subscribers.delete(writer),
-  };
-}
-
-/** Remove a session. */
-export function removeSetupSession(id: string): void {
-  const session = sessions.get(id);
-  if (session) {
-    for (const writer of session.subscribers) {
-      writer("end", JSON.stringify({ message: "Session removed" }));
-    }
-    session.subscribers.clear();
-  }
-  sessions.delete(id);
-}
-
-// ─── Internal ────────────────────────────────────────────────────────────────
-
-function broadcast(session: SetupSessionState, event: string, data: string): void {
-  const dead: SseWriter[] = [];
-  for (const writer of session.subscribers) {
-    const ok = writer(event, data);
-    if (!ok) dead.push(writer);
-  }
-  for (const w of dead) session.subscribers.delete(w);
-}

package/apps/api/src/modules/system/setup.controller.ts

@@ -1,128 +0,0 @@
-/**
- * Setup controller — Electron → API direct push of instance config.
- *
- * Called once after onboarding with the internal token.
- * Persists SSH credentials, tunnel config, and default build mode
- * as instance-level settings (not per-user).
- *
- * Security: These handlers are loaded via dynamic import only in
- * self-hosted mode. Additionally, each handler checks CLOUD_MODE as
- * defense-in-depth — if somehow mounted in cloud, they refuse to run.
- */
-
-import type { Context } from "hono";
-import { repos } from "@repo/db";
-import { env } from "../../config";
-import { clearAuthModeCache } from "../../lib/auth-mode";
-import { sshManager } from "../../lib/ssh-manager";
-
-/** Guard — returns 404 in cloud mode (defense-in-depth) */
-function assertNotCloud(c: Context): boolean {
-  if (env.CLOUD_MODE) {
-    c.status(404);
-    c.body(null);
-    return false;
-  }
-  return true;
-}
-
-/** POST /system/setup — push all instance settings from desktop app */
-export async function setup(c: Context) {
-  if (!assertNotCloud(c)) return c.res;
-
-  const body = await c.req.json();
-
-  await repos.instanceSettings.upsert({
-    serverName: body.serverName || null,
-    authMode: body.authMode || "none",
-    sshHost: body.sshHost || null,
-    sshPort: body.sshPort || 22,
-    sshUser: body.sshUser || "root",
-    sshAuthMethod: body.sshAuthMethod || null,
-    sshPassword: body.sshPassword || null,
-    sshKeyPath: body.sshKeyPath || null,
-    sshKeyPassphrase: body.sshKeyPassphrase || null,
-    sshJumpHost: body.sshJumpHost || null,
-    sshArgs: body.sshArgs || null,
-    tunnelProvider: body.tunnelProvider || null,
-    tunnelToken: body.tunnelToken || null,
-    defaultBuildMode: body.defaultBuildMode || "auto",
-  });
-
-  sshManager.invalidate();
-  clearAuthModeCache();
-  return c.json({ ok: true });
-}
-
-/** GET /system/setup — retrieve current instance settings */
-export async function getSetup(c: Context) {
-  if (!assertNotCloud(c)) return c.res;
-
-  const settings = await repos.instanceSettings.get();
-
-  if (!settings) {
-    return c.json({ configured: false });
-  }
-
-  return c.json({
-    configured: true,
-    serverName: settings.serverName,
-    authMode: settings.authMode,
-    sshHost: settings.sshHost,
-    sshPort: settings.sshPort,
-    sshUser: settings.sshUser,
-    sshAuthMethod: settings.sshAuthMethod,
-    sshKeyPath: settings.sshKeyPath,
-    sshJumpHost: settings.sshJumpHost,
-    sshArgs: settings.sshArgs,
-    tunnelProvider: settings.tunnelProvider,
-    defaultBuildMode: settings.defaultBuildMode,
-  });
-}
-
-/** PATCH /system/settings — partial update from dashboard settings page */
-export async function updateSettings(c: Context) {
-  if (!assertNotCloud(c)) return c.res;
-
-  const body = await c.req.json();
-
-  // Only allow updating specific fields — never overwrite passwords
-  // from the dashboard unless explicitly provided.
-  const patch: Record<string, unknown> = {};
-
-  if (body.serverName !== undefined) patch.serverName = body.serverName || null;
-  if (body.authMode !== undefined) patch.authMode = body.authMode || "none";
-  if (body.sshHost !== undefined) patch.sshHost = body.sshHost || null;
-  if (body.sshPort !== undefined) patch.sshPort = body.sshPort || 22;
-  if (body.sshUser !== undefined) patch.sshUser = body.sshUser || "root";
-  if (body.sshAuthMethod !== undefined) patch.sshAuthMethod = body.sshAuthMethod || null;
-  if (body.sshPassword !== undefined) patch.sshPassword = body.sshPassword || null;
-  if (body.sshKeyPath !== undefined) patch.sshKeyPath = body.sshKeyPath || null;
-  if (body.sshKeyPassphrase !== undefined) patch.sshKeyPassphrase = body.sshKeyPassphrase || null;
-  if (body.sshJumpHost !== undefined) patch.sshJumpHost = body.sshJumpHost || null;
-  if (body.sshArgs !== undefined) patch.sshArgs = body.sshArgs || null;
-  if (body.tunnelProvider !== undefined) patch.tunnelProvider = body.tunnelProvider || null;
-  if (body.tunnelToken !== undefined) patch.tunnelToken = body.tunnelToken || null;
-  if (body.defaultBuildMode !== undefined) patch.defaultBuildMode = body.defaultBuildMode || "auto";
-
-  if (Object.keys(patch).length === 0) {
-    return c.json({ error: "No fields to update" }, 400);
-  }
-
-  await repos.instanceSettings.upsert(patch);
-
-  sshManager.invalidate();
-  clearAuthModeCache();
-  return c.json({ ok: true });
-}
-
-/** DELETE /system/settings — remove server configuration */
-export async function deleteSettings(c: Context) {
-  if (!assertNotCloud(c)) return c.res;
-
-  await repos.instanceSettings.delete();
-
-  sshManager.invalidate();
-  clearAuthModeCache();
-  return c.json({ ok: true });
-}

package/apps/api/src/modules/system/system.routes.ts

@@ -1,42 +0,0 @@
-/**
- * System routes — mounted at /api/system in app.ts.
- *
- * Self-hosted only (gated by localOnly in app.ts).
- *
- * Auth strategies:
- *   - /setup routes use internalAuth (Electron → API, no user session)
- *   - all other routes use authMiddleware (auto-injected local user)
- */
-
-import { Hono } from "hono";
-import { authMiddleware, internalAuth, localOnly } from "../../middleware";
-import * as fs from "./filesystem.controller";
-import * as setup from "./setup.controller";
-import * as serverCheck from "./server-check.controller";
-
-export const systemRoutes = new Hono();
-
-systemRoutes.use("*", localOnly);
-
-/* ── Internal routes (Electron → API with shared token) ─────────── */
-systemRoutes.post("/setup", internalAuth, setup.setup);
-systemRoutes.get("/setup", internalAuth, setup.getSetup);
-
-/* ── Authenticated routes (dashboard settings page) ─────────────── */
-systemRoutes.get("/settings", authMiddleware, setup.getSetup);
-systemRoutes.patch("/settings", authMiddleware, setup.updateSettings);
-systemRoutes.delete("/settings", authMiddleware, setup.deleteSettings);
-
-/* ── Server check & install (dashboard setup wizard) ────────────── */
-systemRoutes.post("/check", authMiddleware, serverCheck.checkServer);
-systemRoutes.post("/install", authMiddleware, serverCheck.installComponent);
-systemRoutes.post("/install/stream", authMiddleware, serverCheck.installStream);
-systemRoutes.get("/install/stream", authMiddleware, serverCheck.attachInstallStream);
-systemRoutes.get("/install/session", authMiddleware, serverCheck.getInstallSession);
-
-/* ── Server monitoring (live stats via SSE) ─────────────────────── */
-systemRoutes.get("/monitor/stream", authMiddleware, serverCheck.monitorStream);
-
-/* ── Authenticated routes (local user auto-injected) ────────────── */
-systemRoutes.use("/browse", authMiddleware);
-systemRoutes.get("/browse", fs.browse);

package/apps/api/src/modules/webhooks/webhook.controller.ts

@@ -1,64 +0,0 @@
-/**
- * Webhook controller — unified entry point for GitHub and Stripe webhooks.
- *
- * Each provider has a dedicated POST route (`/api/webhooks/:provider`).
- * The controller verifies the signature, then delegates to the registered
- * provider handler. This keeps provider-specific logic out of this file.
- */
-
-import type { Context } from "hono";
-import { getWebhookProvider } from "./webhook.service";
-import type { WebhookProviderName } from "./webhook.types";
-
-/** Allowed provider names — rejects anything else at the route level. */
-const ALLOWED_PROVIDERS = new Set<string>(["github", "stripe"]);
-
-/**
- * Generic webhook handler — looks up the provider by route param
- * and delegates verification + handling to it.
- */
-export async function handleWebhook(c: Context) {
-  const providerName = c.req.param("provider");
-
-  if (!providerName || !ALLOWED_PROVIDERS.has(providerName)) {
-    return c.json({ error: "Not found" }, 404);
-  }
-
-  return dispatchProvider(c, providerName as WebhookProviderName);
-}
-
-// ─── Internal ────────────────────────────────────────────────────────────────
-
-async function dispatchProvider(c: Context, providerName: WebhookProviderName) {
-  const provider = getWebhookProvider(providerName);
-
-  if (!provider) {
-    return c.json({ error: `Webhook provider '${providerName}' is not configured` }, 404);
-  }
-
-  /* Read the raw body once — needed for signature verification */
-  const rawBody = await c.req.text();
-
-  /* Flatten headers into a plain object */
-  const headers: Record<string, string> = {};
-  c.req.raw.headers.forEach((value, key) => {
-    headers[key.toLowerCase()] = value;
-  });
-
-  /* Step 1: Verify signature */
-  const verification = provider.verify(rawBody, headers);
-  if (!verification.valid) {
-    return c.json({ error: verification.error ?? "Invalid signature" }, 401);
-  }
-
-  /* Step 2: Parse and handle */
-  let payload: unknown;
-  try {
-    payload = JSON.parse(rawBody);
-  } catch {
-    return c.json({ error: "Invalid JSON body" }, 400);
-  }
-
-  const result = await provider.handle(payload, headers);
-  return c.json(result, result.success ? 200 : 400);
-}

package/apps/api/src/modules/webhooks/webhook.routes.ts

@@ -1,15 +0,0 @@
-/**
- * Webhook routes — unified entry point for GitHub and Stripe.
- *
- * POST /api/webhooks/:provider — dispatches to the registered provider
- *
- * Only "github" and "stripe" are accepted. All other paths return 404.
- * These routes do NOT require session auth — they verify signatures instead.
- */
-
-import { Hono } from "hono";
-import { handleWebhook } from "./webhook.controller";
-
-export const webhookRoutes = new Hono();
-
-webhookRoutes.post("/:provider", handleWebhook);

package/apps/api/src/modules/webhooks/webhook.service.ts

@@ -1,52 +0,0 @@
-/**
- * Webhook service — provider registry and signature helpers.
- *
- * Providers register themselves at startup so the controller can dispatch
- * to the correct handler without importing provider-specific code directly.
- */
-
-import crypto from "crypto";
-import type { WebhookProvider, WebhookProviderName } from "./webhook.types";
-
-// ─── Provider registry ───────────────────────────────────────────────────────
-
-const providers = new Map<WebhookProviderName, WebhookProvider>();
-
-export function registerWebhookProvider(provider: WebhookProvider) {
-  providers.set(provider.name, provider);
-}
-
-export function getWebhookProvider(name: WebhookProviderName): WebhookProvider | undefined {
-  return providers.get(name);
-}
-
-export function listWebhookProviders(): WebhookProviderName[] {
-  return Array.from(providers.keys());
-}
-
-// ─── Shared crypto helpers ───────────────────────────────────────────────────
-
-/**
- * Verify an HMAC-SHA256 signature (used by GitHub, many others).
- *
- * @param payload  Raw request body
- * @param secret   Shared secret
- * @param signature Header value (e.g. "sha256=abc...")
- * @param prefix   Prefix before the hex digest (default "sha256=")
- */
-export function verifyHmacSha256(
-  payload: string | Buffer,
-  secret: string,
-  signature: string,
-  prefix = "sha256=",
-): boolean {
-  const buf = Buffer.isBuffer(payload) ? payload : Buffer.from(payload, "utf8");
-  const computed = `${prefix}${crypto.createHmac("sha256", secret).update(buf).digest("hex")}`;
-
-  if (signature.length !== computed.length) return false;
-
-  return crypto.timingSafeEqual(
-    Buffer.from(signature, "utf8"),
-    Buffer.from(computed, "utf8"),
-  );
-}

package/apps/api/src/modules/webhooks/webhook.types.ts

@@ -1,35 +0,0 @@
-/**
- * Webhook types — shared across all webhook providers.
- *
- * Every provider (GitHub, Stripe) implements the WebhookProvider interface
- * so the central dispatcher can handle verification and routing uniformly.
- */
-
-/** Supported webhook providers */
-export type WebhookProviderName = "github" | "stripe";
-
-/** Result of verifying a webhook signature */
-export interface WebhookVerifyResult {
-  valid: boolean;
-  error?: string;
-}
-
-/** Standardised result returned by any webhook handler */
-export interface WebhookHandlerResult {
-  success: boolean;
-  event?: string;
-  message?: string;
-  error?: string;
-}
-
-/**
- * Interface every webhook provider must implement.
- *
- * `verify()` checks the cryptographic signature.
- * `handle()` parses the event and dispatches to the correct business-logic handler.
- */
-export interface WebhookProvider {
-  readonly name: WebhookProviderName;
-  verify(payload: string | Buffer, headers: Record<string, string>): WebhookVerifyResult;
-  handle(payload: unknown, headers: Record<string, string>): Promise<WebhookHandlerResult>;
-}

package/apps/api/tsconfig.json

@@ -1,14 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "baseUrl": ".",
-    "lib": ["ES2022"],
-    "types": ["node"],
-    "paths": {
-      "@/*": ["./src/*"]
-    },
-    "outDir": "dist"
-  },
-  "include": ["src/**/*.ts"],
-  "exclude": ["node_modules", "dist"]
-}

package/apps/cli/package.json

@@ -1,26 +0,0 @@
-{
-  "name": "@repo/cli",
-  "version": "0.1.0",
-  "type": "module",
-  "bin": {
-    "openship": "./dist/index.js"
-  },
-  "scripts": {
-    "build": "tsup src/index.ts --format esm --dts --clean",
-    "lint": "tsc --noEmit",
-    "clean": "rm -rf dist .turbo node_modules"
-  },
-  "dependencies": {
-    "@repo/core": "workspace:*",
-    "commander": "^14.0.3",
-    "chalk": "^5.6.2",
-    "ora": "^9.3.0",
-    "prompts": "^2.4.0"
-  },
-  "devDependencies": {
-    "@types/prompts": "^2.4.0",
-    "tsx": "^4.21.0",
-    "tsup": "^8.5.1",
-    "typescript": "^5.9.3"
-  }
-}

package/apps/cli/src/commands/deploy.ts

@@ -1,11 +0,0 @@
-import { Command } from "commander";
-
-export const deployCommand = new Command("deploy")
-  .description("Deploy the current project")
-  .option("--prod", "Deploy to production")
-  .option("--preview", "Create a preview deployment")
-  .action(async (opts) => {
-    // TODO: Read openship.json, upload or push, trigger deployment via API
-    const env = opts.prod ? "production" : "preview";
-    console.log(`Deploying to ${env}...`);
-  });

package/apps/cli/src/commands/init.ts

@@ -1,8 +0,0 @@
-import { Command } from "commander";
-
-export const initCommand = new Command("init")
-  .description("Initialize an Openship project in the current directory")
-  .action(async () => {
-    // TODO: Create openship.json config, detect framework, link to account
-    console.log("Initializing Openship project...");
-  });

package/apps/cli/src/commands/login.ts

@@ -1,8 +0,0 @@
-import { Command } from "commander";
-
-export const loginCommand = new Command("login")
-  .description("Authenticate with your Openship account")
-  .action(async () => {
-    // TODO: Open browser for OAuth or prompt for API token
-    console.log("Logging in...");
-  });

package/apps/cli/src/commands/logs.ts

@@ -1,9 +0,0 @@
-import { Command } from "commander";
-
-export const logsCommand = new Command("logs")
-  .description("Stream deployment logs")
-  .argument("[deploymentId]", "Deployment ID (defaults to latest)")
-  .action(async (deploymentId?: string) => {
-    // TODO: Connect to API and stream logs
-    console.log(`Streaming logs for ${deploymentId || "latest deployment"}...`);
-  });