Webklar-Kundenbereich/server/services/previewDeploy.js

import { execFile } from 'node:child_process'
import { promisify } from 'node:util'
import fs from 'node:fs/promises'
import path from 'node:path'
import { config } from '../config.js'
import { listDocuments, Query } from './appwriteAdmin.js'

const execFileAsync = promisify(execFile)

/**
 * Subdomains, die als "oeffentliche Website" (ohne Login) laufen sollen.
 * Diese bekommen in syncPreviewTls einen Router OHNE preview-auth-ForwardAuth.
 * Faellt bei Appwrite-Fehlern bewusst auf ein leeres Set zurueck -> alle Seiten
 * bleiben dann login-geschuetzt (sicherer Default).
 */
async function getPublicSubdomains() {
  try {
    const docs = await listDocuments(config.collections.websiteProjects, [
      Query.equal('isPublic', true),
      Query.limit(500),
    ])
    return new Set(docs.map((d) => d.subdomain).filter(Boolean))
  } catch (err) {
    console.error('[previewDeploy] getPublicSubdomains fehlgeschlagen:', err.message)
    return new Set()
  }
}

export async function fetchPreviewConfig(repoFullName, branch) {
  const [owner, repo] = repoFullName.split('/')
  if (!owner || !repo || !config.gitea.apiToken) {
    return null
  }

  const url = `${config.gitea.baseUrl}/api/v1/repos/${owner}/${repo}/contents/.webklar-preview.json?ref=${encodeURIComponent(branch)}`
  const response = await fetch(url, {
    headers: { Authorization: `token ${config.gitea.apiToken}` },
  })

  if (!response.ok) return null

  const data = await response.json()
  const content = Buffer.from(data.content || '', 'base64').toString('utf8')
  return JSON.parse(content)
}

export function defaultPreviewConfig(repoFullName) {
  const repoName = repoFullName.split('/').pop() || 'preview'
  return {
    enabled: false,
    type: 'static',
    branch: 'main',
    displayName: repoName,
    subdomain: repoName,
  }
}

async function cloneRepo(cloneUrl, targetDir, branch) {
  await fs.rm(targetDir, { recursive: true, force: true })
  await fs.mkdir(targetDir, { recursive: true })
  await execFileAsync('git', [
    'clone',
    '--depth',
    '1',
    '--branch',
    branch,
    cloneUrl,
    targetDir,
  ])
}

async function deployStatic(sourceDir, targetDir, indexSubdir = '') {
  const webroot = indexSubdir ? path.join(sourceDir, indexSubdir) : sourceDir
  await fs.rm(targetDir, { recursive: true, force: true })
  await fs.mkdir(targetDir, { recursive: true })
  await execFileAsync('cp', ['-R', `${webroot}/.`, targetDir])
}

async function deployNodeBuild(sourceDir, targetDir) {
  await execFileAsync('npm', ['ci'], { cwd: sourceDir })
  await execFileAsync('npm', ['run', 'build'], { cwd: sourceDir })
  const distDir = path.join(sourceDir, 'dist')
  await deployStatic(distDir, targetDir)
}

export function buildPreviewUrl(subdomain) {
  return `https://${subdomain}.${config.preview.baseHost}`
}

/**
 * Schreibt pro deployter Preview-Subdomain einen Traefik-Router mit Host()-Regel
 * nach preview-hosts.yml, damit Let's Encrypt (HTTP-01) gueltige Zertifikate
 * ausstellt. HostRegexp allein liefert nur das Default-Zertifikat ("Nicht sicher").
 * Ersetzt traefik/scripts/sync-preview-tls.sh (bash fehlt im Alpine-Container).
 */
export async function syncPreviewTls() {
  const previewRoot = config.preview.deployRoot
  const outDir = config.preview.traefikDynamicDir
  if (!previewRoot || !outDir) {
    return { synced: false, reason: 'PREVIEW_DEPLOY_ROOT oder TRAEFIK_DYNAMIC_DIR nicht gesetzt' }
  }

  const baseHost = config.preview.baseHost
  let entries = []
  try {
    entries = await fs.readdir(previewRoot, { withFileTypes: true })
  } catch {
    entries = []
  }

  const slugs = entries
    .filter((entry) => entry.isDirectory() && /^[a-z0-9-]+$/.test(entry.name))
    .map((entry) => entry.name)
    .sort()

  const publicSet = await getPublicSubdomains()

  const blocks = slugs.map((name) => {
    const host = `${name}.${baseHost}`
    const id = `preview-${name}`
    const isPublic = publicSet.has(name)
    // Oeffentliche Website: HTTPS-Router OHNE preview-auth -> frei zugaenglich.
    // Preview (Standard): mit preview-chain (ForwardAuth) -> login-geschuetzt.
    const httpsMiddlewareLines = isPublic
      ? []
      : ['      middlewares:', '        - preview-chain@docker']
    return [
      `    ${id}-https:`,
      `      rule: "Host(\`${host}\`)"`,
      '      entryPoints:',
      '        - websecure',
      '      service: preview-nginx@docker',
      ...httpsMiddlewareLines,
      '      priority: 100',
      '      tls:',
      '        certResolver: letsencrypt',
      '',
      `    ${id}-http:`,
      `      rule: "Host(\`${host}\`)"`,
      '      entryPoints:',
      '        - web',
      '      service: preview-nginx@docker',
      '      middlewares:',
      '        - preview-sites-redirect@docker',
      '      priority: 100',
    ].join('\n')
  })

  const content = [
    '# Auto-generated by previewDeploy.syncPreviewTls - do not edit manually',
    'http:',
    '  routers:',
    ...blocks,
    '',
  ].join('\n')

  await fs.mkdir(outDir, { recursive: true })
  await fs.writeFile(path.join(outDir, 'preview-hosts.yml'), content, 'utf8')
  return { synced: true, hosts: slugs.length }
}

export async function runDeploy(repoFullName, branch, previewConfig) {
  if (!config.preview.deployRoot) {
    return { deployed: false, reason: 'PREVIEW_DEPLOY_ROOT nicht gesetzt' }
  }

  const subdomain = previewConfig.subdomain || repoFullName.split('/').pop()
  const cloneUrl = `${config.gitea.baseUrl}/${repoFullName}.git`
  const workDir = path.join(process.cwd(), 'preview-data', repoFullName.replace(/\//g, '_'))
  const targetDir = path.join(config.preview.deployRoot, subdomain)

  await cloneRepo(cloneUrl, workDir, branch)

  if (previewConfig.type === 'node_build') {
    await deployNodeBuild(workDir, targetDir)
  } else {
    await deployStatic(workDir, targetDir, previewConfig.index || '')
  }

  let tls = { synced: false }
  try {
    tls = await syncPreviewTls()
  } catch (err) {
    console.error('[previewDeploy] TLS-Sync fehlgeschlagen:', err.message)
    tls = { synced: false, error: err.message }
  }

  return { deployed: true, subdomain, targetDir, tls }
}

/**
 * Entfernt das Deploy-Verzeichnis einer Subdomain und synchronisiert die
 * Traefik-TLS-Router neu (z.B. beim Aendern der Subdomain oder Archivieren).
 */
export async function removeDeploy(subdomain) {
  if (!subdomain || !config.preview.deployRoot) return { removed: false }
  if (!/^[a-z0-9-]+$/.test(subdomain)) return { removed: false, reason: 'ungueltige Subdomain' }
  const targetDir = path.join(config.preview.deployRoot, subdomain)
  await fs.rm(targetDir, { recursive: true, force: true })

  let tls = { synced: false }
  try {
    tls = await syncPreviewTls()
  } catch (err) {
    console.error('[previewDeploy] TLS-Sync nach removeDeploy fehlgeschlagen:', err.message)
    tls = { synced: false, error: err.message }
  }
  return { removed: true, subdomain, tls }
}