openship 0.1.1 → 0.1.8

package/apps/api/src/modules/github/github.controller.ts

@@ -1,387 +0,0 @@
-/**
- * GitHub controller — Hono request handlers.
- *
- * Every handler:
- *   1. Extracts user from context (set by authMiddleware)
- *   2. Validates params/query/body via TypeBox schemas (at the route level)
- *   3. Delegates to service/auth functions
- *   4. Returns a consistent JSON response
- *
- * No direct GitHub API calls here — that's the service's job.
- */
-
-import type { Context } from "hono";
-import { env } from "../../config/env";
-import { auth } from "../../lib/auth";
-import * as githubAuth from "./github.auth";
-import * as localAuth from "./github.local-auth";
-import * as githubService from "./github.service";
-
-// ─── Helpers ─────────────────────────────────────────────────────────────────
-
-/** Extract authenticated user ID from Hono context (set by authMiddleware). */
-function getUserId(c: Context): string {
-  const user = c.get("user");
-  return user?.id;
-}
-
-/** Safely extract a required route param. */
-function param(c: Context, name: string): string {
-  const val = c.req.param(name);
-  if (!val) throw new Error(`Missing route param: ${name}`);
-  return val;
-}
-
-// ─── Status / Connection ─────────────────────────────────────────────────────
-
-/** GET /github/status — Check if user is connected to GitHub */
-export async function getStatus(c: Context) {
-  const userId = getUserId(c);
-  const status = await githubAuth.getUserStatus(userId);
-  return c.json({ ...status, mode: githubAuth.getGitHubAuthMode() });
-}
-
-/** GET /github/home — User's GitHub home: status + accounts + repos */
-export async function getHome(c: Context) {
-  const userId = getUserId(c);
-  const data = await githubService.getUserHome(userId);
-  return c.json({ ...data, selfHosted: !env.CLOUD_MODE });
-}
-
-/** POST /github/connect — Normalized connection flow.
- *
- *  Returns a consistent shape regardless of auth mode:
- *
- *  Already connected:
- *    { connected: true }
- *
- *  Needs redirect (OAuth or App install):
- *    { connected: false, flow: "redirect", url: "https://..." }
- *
- *  Device flow (desktop with CLIENT_ID):
- *    { connected: false, flow: "device_code", userCode, verificationUri, ... }
- *
- *  Terminal instruction (desktop without CLIENT_ID):
- *    { connected: false, flow: "terminal", command, message }
- *
- *  The frontend is mode-agnostic — it just reacts to `flow`.
- */
-export async function connect(c: Context) {
-  const userId = getUserId(c);
-  const mode = githubAuth.getGitHubAuthMode();
-  const hasOAuth = !!(await githubAuth.getUserToken(userId));
-
-  // ── Already connected? ─────────────────────────────────────
-  if (mode === "token" && env.GITHUB_TOKEN) {
-    return c.json({ connected: true });
-  }
-
-  if (mode === "cli") {
-    const ghCliToken = await localAuth.getLocalGhToken();
-    if (ghCliToken || hasOAuth) {
-      return c.json({ connected: true });
-    }
-  }
-
-  if ((mode === "app" || mode === "oauth") && hasOAuth) {
-    if (mode === "app") {
-      // Has OAuth but still needs App installation → redirect to install page
-      return c.json({ connected: false, flow: "redirect" as const, url: githubAuth.getInstallUrl() });
-    }
-    // OAuth mode, has token → already connected
-    return c.json({ connected: true });
-  }
-
-  // ── CLI: no token yet ──────────────────────────────────────
-  if (mode === "cli") {
-    // No GITHUB_CLIENT_ID → run `gh auth login` in terminal
-    if (!env.GITHUB_CLIENT_ID) {
-      return c.json({
-        connected: false,
-        flow: "terminal" as const,
-        command: "gh auth login",
-        message: "Run this command in your terminal, then click refresh.",
-      });
-    }
-    // Has CLIENT_ID → start device flow
-    try {
-      const verification = await localAuth.startDeviceFlow(userId);
-      return c.json({
-        connected: false,
-        flow: "device_code" as const,
-        userCode: verification.user_code,
-        verificationUri: verification.verification_uri,
-        expiresIn: verification.expires_in,
-        interval: verification.interval,
-      });
-    } catch (err) {
-      return c.json({ connected: false, error: (err as Error).message }, 500);
-    }
-  }
-
-  // ── Token mode with no token ───────────────────────────────
-  if (mode === "token") {
-    return c.json({
-      connected: false,
-      flow: "terminal" as const,
-      command: "GITHUB_TOKEN=ghp_... (set in environment)",
-      message: "Set the GITHUB_TOKEN environment variable and restart the server.",
-    });
-  }
-
-  // ── App / OAuth: need GitHub OAuth → generate URL server-side ──
-  const callbackURL = mode === "app" ? "/auth/callback/install" : "/auth/callback/close";
-
-  try {
-    const result = await auth.api.signInSocial({
-      body: {
-        provider: "github",
-        callbackURL,
-      },
-      headers: c.req.raw.headers,
-    });
-
-    if (result?.url) {
-      return c.json({ connected: false, flow: "redirect" as const, url: result.url });
-    }
-  } catch { /* fall through */ }
-
-  return c.json({ connected: false, error: "Unable to start GitHub authorization" }, 500);
-}
-
-/** GET /github/local-status — Check if the machine has `gh` CLI auth available.
- *  Gated by `localOnly` middleware — never reaches this handler in cloud modes.
- */
-export async function getLocalStatus(c: Context) {
-  const localStatus = await localAuth.getLocalGhStatus();
-  return c.json({
-    ...localStatus,
-    activeMode: githubAuth.getGitHubAuthMode(),
-  });
-}
-
-/** GET /github/connect/poll — Poll the device flow status.
- *  Gated by `localOnly` middleware.
- */
-export async function pollConnect(c: Context) {
-  const userId = getUserId(c);
-  const status = localAuth.getDeviceFlowStatus(userId);
-  if (!status) {
-    return c.json({ status: "none" as const }, 404);
-  }
-  return c.json(status);
-}
-
-/** POST /github/disconnect — Disconnect GitHub (remove installations) */
-export async function disconnect(c: Context) {
-  const userId = getUserId(c);
-  await githubAuth.disconnectUser(userId);
-  return c.json({ success: true });
-}
-
-// ─── Accounts / Organisations ────────────────────────────────────────────────
-
-/** GET /github/accounts — List connected GitHub accounts (user + orgs) */
-export async function listAccounts(c: Context) {
-  const userId = getUserId(c);
-  const mode = githubAuth.getGitHubAuthMode();
-
-  if (mode !== "app") {
-    // Non-app modes: build account list from /user + /user/orgs
-    const status = await githubAuth.getUserStatus(userId);
-    if (!status.connected) return c.json({ data: [] });
-    const accounts = await githubService.listUserAccounts(userId, status);
-    return c.json({ data: accounts });
-  }
-
-  const installations = await githubAuth.getUserInstallations(userId);
-  const accounts = githubAuth.mapAccounts(installations);
-  return c.json({ data: accounts });
-}
-
-/** GET /github/orgs — List user's org accounts */
-export async function listOrgs(c: Context) {
-  const userId = getUserId(c);
-  const mode = githubAuth.getGitHubAuthMode();
-
-  if (mode !== "app") {
-    const orgs = await githubService.listUserOrgsViaApi(userId);
-    return c.json({ data: orgs });
-  }
-
-  const orgs = await githubService.listUserOrgs(userId);
-  return c.json({ data: orgs });
-}
-
-/** GET /github/orgs/repos — List all orgs with their repos */
-export async function listOrgsWithRepos(c: Context) {
-  const userId = getUserId(c);
-  const mode = githubAuth.getGitHubAuthMode();
-
-  if (mode !== "app") {
-    const data = await githubService.listUserOrgsWithReposViaApi(userId);
-    return c.json({ data });
-  }
-
-  const data = await githubService.listUserOrgsWithRepos(userId);
-  return c.json({ data });
-}
-
-// ─── Repositories ────────────────────────────────────────────────────────────
-
-/** GET /github/repos — List repos (mode-aware) */
-export async function listRepos(c: Context) {
-  const userId = getUserId(c);
-  const owner = c.req.query("owner");
-  const mode = githubAuth.getGitHubAuthMode();
-
-  if (mode !== "app") {
-    // If the owner matches the authenticated user, fetch their own repos
-    // (not /orgs/{owner}/repos which would 404 for a user account)
-    const status = await githubAuth.getUserStatus(userId);
-    const isOwnAccount = owner && status.connected && owner === status.login;
-    const repos = await githubService.listUserOwnedRepos(userId, isOwnAccount ? undefined : (owner || undefined));
-    return c.json({ data: repos });
-  }
-
-  // App mode: use GitHub App installation
-  if (!owner) {
-    const status = await githubAuth.getUserStatus(userId);
-    if (!status.connected) {
-      return c.json({ error: "Not connected to GitHub" }, 400);
-    }
-    const repos = await githubService.listInstallationRepos(userId, status.login);
-    return c.json({ data: repos });
-  }
-
-  const repos = await githubService.listInstallationRepos(userId, owner);
-  return c.json({ data: repos });
-}
-
-/** GET /github/orgs/:org/repos — List repos for an organisation */
-export async function listOrgRepos(c: Context) {
-  const userId = getUserId(c);
-  const org = param(c, "org");
-  const mode = githubAuth.getGitHubAuthMode();
-
-  if (mode !== "app") {
-    const repos = await githubService.listUserOwnedRepos(userId, org);
-    return c.json({ data: repos });
-  }
-
-  const repos = await githubService.listInstallationRepos(userId, org);
-  return c.json({ data: repos });
-}
-
-/** GET /github/repos/:owner/:repo — Get a single repository */
-export async function getRepo(c: Context) {
-  const userId = getUserId(c);
-  const owner = param(c, "owner");
-  const repo = param(c, "repo");
-  const withBranches = c.req.query("branches") === "true";
-
-  const data = await githubService.getRepository(userId, owner, repo, { withBranches });
-  return c.json({ data });
-}
-
-/** POST /github/repos — Create a new repository */
-export async function createRepo(c: Context) {
-  const userId = getUserId(c);
-  const body = await c.req.json();
-
-  const data = await githubService.createRepository(userId, body.name, {
-    description: body.description,
-    private: body.private,
-    owner: body.owner,
-  });
-
-  return c.json({ data }, 201);
-}
-
-/** DELETE /github/repos/:owner/:repo — Delete a repository */
-export async function deleteRepo(c: Context) {
-  const userId = getUserId(c);
-  const owner = param(c, "owner");
-  const repo = param(c, "repo");
-
-  await githubService.deleteRepository(userId, owner, repo);
-  return c.json({ success: true });
-}
-
-// ─── Branches ────────────────────────────────────────────────────────────────
-
-/** GET /github/repos/:owner/:repo/branches — List branches */
-export async function listBranches(c: Context) {
-  const userId = getUserId(c);
-  const owner = param(c, "owner");
-  const repo = param(c, "repo");
-
-  const data = await githubService.listBranches(userId, owner, repo);
-  return c.json({ data });
-}
-
-// ─── Files ───────────────────────────────────────────────────────────────────
-
-/** GET /github/repos/:owner/:repo/files — List files in a directory */
-export async function listFiles(c: Context) {
-  const userId = getUserId(c);
-  const owner = param(c, "owner");
-  const repo = param(c, "repo");
-  const branch = c.req.query("branch");
-  const path = c.req.query("path");
-
-  const data = await githubService.listFiles(userId, owner, repo, { branch: branch ?? undefined, path: path ?? undefined });
-  return c.json({ data });
-}
-
-/** GET /github/repos/:owner/:repo/file — Get a single file's content */
-export async function getFile(c: Context) {
-  const userId = getUserId(c);
-  const owner = param(c, "owner");
-  const repo = param(c, "repo");
-  const file = c.req.query("file") ?? "package.json";
-  const branch = c.req.query("branch");
-
-  const data = await githubService.getFileContent(userId, owner, repo, file, {
-    branch: branch ?? undefined,
-    json: file.endsWith(".json"),
-  });
-  return c.json({ data });
-}
-
-// ─── Webhooks ────────────────────────────────────────────────────────────────
-
-/** GET /github/repos/:owner/:repo/webhooks — List repo webhooks */
-export async function listWebhooks(c: Context) {
-  const userId = getUserId(c);
-  const owner = param(c, "owner");
-  const repo = param(c, "repo");
-
-  const data = await githubService.listWebhooks(userId, owner, repo);
-  return c.json({ data });
-}
-
-/** POST /github/repos/:owner/:repo/webhooks — Register a webhook (create or find existing) */
-export async function registerWebhook(c: Context) {
-  const userId = getUserId(c);
-  const owner = param(c, "owner");
-  const repo = param(c, "repo");
-
-  const data = await githubService.registerWebhook(userId, owner, repo);
-  return c.json({ data });
-}
-
-/** DELETE /github/repos/:owner/:repo/webhooks — Delete a webhook */
-export async function deleteWebhook(c: Context) {
-  const userId = getUserId(c);
-  const owner = param(c, "owner");
-  const repo = param(c, "repo");
-  const body = await c.req.json();
-
-  if (!body.hookId) {
-    return c.json({ error: "hookId is required" }, 400);
-  }
-
-  await githubService.deleteWebhook(userId, owner, repo, body.hookId);
-  return c.json({ success: true });
-}

package/apps/api/src/modules/github/github.local-auth.ts

@@ -1,251 +0,0 @@
-/**
- * GitHub local auth — resolves GitHub credentials from the machine's `gh` CLI.
- *
- * Used in local / desktop mode where there is no GitHub App and no OAuth
- * callback. Users authenticate via `gh auth login` on their machine and
- * we piggyback on that token.
- *
- * Resolution order:
- *   1. `gh auth token` subprocess (works on any OS where `gh` is in PATH)
- *   2. Read `~/.config/gh/hosts.yml` directly (fallback when `gh` binary is missing)
- *
- * This module also exposes `getLocalGhStatus()` — a convenience that validates
- * the resolved token against the GitHub API and returns the user profile.
- *
- * SAFETY: All functions check `getGitHubAuthMode()` (the single source of
- * truth from github.auth) and are no-ops when mode is "app" or "oauth" —
- * prevents subprocess execution and filesystem reads on cloud servers.
- */
-
-import { execFile } from "child_process";
-import { readFile } from "fs/promises";
-import { homedir } from "os";
-import { join } from "path";
-import { createOAuthDeviceAuth } from "@octokit/auth-oauth-device";
-import { env } from "../../config/env";
-import { TtlCache } from "../../lib/cache";
-import { getGitHubAuthMode } from "./github.auth";
-
-// ─── Cache ───────────────────────────────────────────────────────────────────
-
-const cache = new TtlCache<string>({ maxSize: 100, sweepIntervalMs: 60_000 });
-
-// ─── Token resolution ────────────────────────────────────────────────────────
-
-/**
- * Resolve the GitHub token from the local `gh` CLI.
- * Result is cached for 5 minutes to avoid shelling out on every request.
- * Returns null immediately in cloud modes (app / oauth).
- */
-export async function getLocalGhToken(): Promise<string | null> {
-  const mode = getGitHubAuthMode();
-  if (mode === "app" || mode === "oauth") return null;
-
-  const cacheKey = "local:gh-cli-token";
-  const cached = cache.get(cacheKey);
-  if (cached) return cached;
-
-  let token = await ghAuthTokenViaCli();
-  if (!token) {
-    token = await ghAuthTokenViaConfig();
-  }
-  if (token) {
-    cache.set(cacheKey, token, 5 * 60);
-  }
-  return token;
-}
-
-/**
- * Invalidate the cached gh CLI token (e.g. after the user re-authenticates).
- */
-export function invalidateLocalGhToken(): void {
-  cache.invalidateBySubstring("local:gh-cli-token");
-}
-
-// ─── Status ──────────────────────────────────────────────────────────────────
-
-/**
- * Check whether the machine has a valid `gh` CLI token and return the
- * associated GitHub user profile.
- * Returns { available: false } immediately in cloud modes (app / oauth).
- */
-export async function getLocalGhStatus(): Promise<
-  | { available: true; login: string; id: number; avatar_url: string }
-  | { available: false }
-> {
-  const mode = getGitHubAuthMode();
-  if (mode === "app" || mode === "oauth") return { available: false };
-
-  const token = await getLocalGhToken();
-  if (!token) return { available: false };
-
-  try {
-    const res = await fetch("https://api.github.com/user", {
-      headers: {
-        Authorization: `Bearer ${token}`,
-        Accept: "application/vnd.github+json",
-        "X-GitHub-Api-Version": "2022-11-28",
-      },
-    });
-    if (!res.ok) return { available: false };
-    const user = (await res.json()) as { login: string; id: number; avatar_url: string };
-    return { available: true, ...user };
-  } catch {
-    return { available: false };
-  }
-}
-
-// ─── Internal helpers ────────────────────────────────────────────────────────
-
-/** Try `gh auth token` subprocess. */
-function ghAuthTokenViaCli(): Promise<string | null> {
-  return new Promise((resolve) => {
-    execFile("gh", ["auth", "token"], { timeout: 5_000 }, (err, stdout) => {
-      if (err || !stdout) return resolve(null);
-      const t = stdout.trim();
-      resolve(t || null);
-    });
-  });
-}
-
-/** Read token from the gh CLI config file (`~/.config/gh/hosts.yml`). */
-async function ghAuthTokenViaConfig(): Promise<string | null> {
-  try {
-    const configDir = process.env.GH_CONFIG_DIR || join(homedir(), ".config", "gh");
-    const raw = await readFile(join(configDir, "hosts.yml"), "utf-8");
-    // Simple line-by-line YAML parse — look for `oauth_token:` under `github.com:`
-    const ghSection = raw.split(/\n/).reduce<{ inGithub: boolean; token: string | null }>(
-      (acc, line) => {
-        if (/^github\.com:/i.test(line.trim())) acc.inGithub = true;
-        else if (/^\S/.test(line)) acc.inGithub = false;
-        if (acc.inGithub) {
-          const m = line.match(/^\s+oauth_token:\s*(.+)/);
-          if (m && !acc.token) acc.token = m[1].trim();
-        }
-        return acc;
-      },
-      { inGithub: false, token: null },
-    );
-    return ghSection.token || null;
-  } catch {
-    return null;
-  }
-}
-
-// ─── OAuth Device Flow ───────────────────────────────────────────────────────
-
-export interface Verification {
-  device_code: string;
-  user_code: string;
-  verification_uri: string;
-  expires_in: number;
-  interval: number;
-}
-
-interface DeviceFlowState {
-  status: "pending" | "waiting" | "complete" | "error";
-  verification: Verification | null;
-  token: string | null;
-  error: string | null;
-}
-
-/** Active device flows keyed by userId. Only one per user at a time. */
-const activeFlows = new Map<string, DeviceFlowState>();
-
-/**
- * Start a GitHub OAuth device flow for a user.
- *
- * Returns the verification info (user_code, verification_uri) that the
- * frontend should display. The flow polls GitHub in the background — use
- * `getDeviceFlowStatus()` to check when the user has completed auth.
- *
- * Requires `GITHUB_CLIENT_ID` in env. No-op in cloud modes.
- */
-export async function startDeviceFlow(userId: string): Promise<Verification> {
-  const mode = getGitHubAuthMode();
-  if (mode === "app" || mode === "oauth") {
-    throw new Error("Device flow is not available in cloud/oauth mode");
-  }
-
-  const clientId = env.GITHUB_CLIENT_ID;
-  if (!clientId) {
-    throw new Error("GITHUB_CLIENT_ID is required for the device flow");
-  }
-
-  // Cancel any existing flow for this user
-  activeFlows.delete(userId);
-
-  const state: DeviceFlowState = {
-    status: "pending",
-    verification: null,
-    token: null,
-    error: null,
-  };
-  activeFlows.set(userId, state);
-
-  return new Promise<Verification>((resolveVerification, rejectVerification) => {
-    const auth = createOAuthDeviceAuth({
-      clientId,
-      clientType: "oauth-app",
-      scopes: ["repo", "read:org", "read:user"],
-      onVerification: (verification) => {
-        state.status = "waiting";
-        state.verification = verification;
-        resolveVerification(verification);
-      },
-    });
-
-    // Start polling in background — resolves when user completes auth
-    auth({ type: "oauth" })
-      .then((result) => {
-        state.status = "complete";
-        state.token = result.token;
-        // Cache the token so resolveToken() picks it up
-        cache.set("local:gh-cli-token", result.token, 8 * 60 * 60);
-      })
-      .catch((err: Error) => {
-        state.status = "error";
-        state.error = err.message;
-        // If onVerification never fired, reject the start promise
-        if (!state.verification) {
-          rejectVerification(err);
-        }
-      });
-  });
-}
-
-/**
- * Check the status of an active device flow for a user.
- * Returns null if no flow exists.
- */
-export function getDeviceFlowStatus(userId: string): {
-  status: "waiting" | "complete" | "error";
-  token?: string;
-  error?: string;
-} | null {
-  const state = activeFlows.get(userId);
-  if (!state || state.status === "pending") return null;
-
-  const result: { status: "waiting" | "complete" | "error"; token?: string; error?: string } = {
-    status: state.status,
-  };
-
-  if (state.status === "complete" && state.token) {
-    result.token = state.token;
-    // Clean up after the token has been retrieved
-    activeFlows.delete(userId);
-  }
-  if (state.status === "error") {
-    result.error = state.error ?? "Unknown error";
-    activeFlows.delete(userId);
-  }
-
-  return result;
-}
-
-/**
- * Cancel an active device flow for a user.
- */
-export function cancelDeviceFlow(userId: string): void {
-  activeFlows.delete(userId);
-}

package/apps/api/src/modules/github/github.routes.ts

@@ -1,50 +0,0 @@
-/**
- * GitHub routes — all authenticated GitHub endpoints.
- *
- * Mounted at /api/github in app.ts.
- * Every route goes through authMiddleware (session required).
- *
- * TypeBox validation is applied at the route level using typebox-validator
- * for params/query/body where applicable.
- */
-
-import { Hono } from "hono";
-import { authMiddleware, localOnly } from "../../middleware";
-import * as ctrl from "./github.controller";
-
-export const githubRoutes = new Hono();
-
-/* All GitHub routes require authentication */
-githubRoutes.use("*", authMiddleware);
-
-/* ─── Status / Connection ──────────────────────────────────────────────── */
-githubRoutes.get("/status", ctrl.getStatus);
-githubRoutes.get("/local-status", localOnly, ctrl.getLocalStatus);
-githubRoutes.get("/connect/poll", localOnly, ctrl.pollConnect);
-githubRoutes.get("/home", ctrl.getHome);
-githubRoutes.post("/connect", ctrl.connect);
-githubRoutes.post("/disconnect", ctrl.disconnect);
-
-/* ─── Accounts / Organisations ─────────────────────────────────────────── */
-githubRoutes.get("/accounts", ctrl.listAccounts);
-githubRoutes.get("/orgs", ctrl.listOrgs);
-githubRoutes.get("/orgs/repos", ctrl.listOrgsWithRepos);
-githubRoutes.get("/orgs/:org/repos", ctrl.listOrgRepos);
-
-/* ─── Repositories ─────────────────────────────────────────────────────── */
-githubRoutes.get("/repos", ctrl.listRepos);
-githubRoutes.post("/repos", ctrl.createRepo);
-githubRoutes.get("/repos/:owner/:repo", ctrl.getRepo);
-githubRoutes.delete("/repos/:owner/:repo", ctrl.deleteRepo);
-
-/* ─── Branches ─────────────────────────────────────────────────────────── */
-githubRoutes.get("/repos/:owner/:repo/branches", ctrl.listBranches);
-
-/* ─── Files ────────────────────────────────────────────────────────────── */
-githubRoutes.get("/repos/:owner/:repo/files", ctrl.listFiles);
-githubRoutes.get("/repos/:owner/:repo/file", ctrl.getFile);
-
-/* ─── Repo Webhooks ────────────────────────────────────────────────────── */
-githubRoutes.get("/repos/:owner/:repo/webhooks", ctrl.listWebhooks);
-githubRoutes.post("/repos/:owner/:repo/webhooks", ctrl.registerWebhook);
-githubRoutes.delete("/repos/:owner/:repo/webhooks", ctrl.deleteWebhook);