feat: in-app support form with email + Gitea issue integration (v0.49.0)

Users can now report bugs, suggestions, or questions from a new /support
page. Each submission sends a confirmation email and, when GITEA_URL/
GITEA_TOKEN/GITEA_REPO are configured in admin Settings, opens a labeled
issue on that repo automatically (best-effort — failure doesn't block the
ticket). Admins get a Support section to triage status and retry failed
Gitea issue creation.

New support_tickets table, gitea.ts client, site-settings entries for the
three new secrets, and OpenAPI docs for the two user-facing endpoints.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/changelog.ts

@@ -1,5 +1,5 @@
 // Mirrors CHANGELOG.md at the repo root — update both together.
-export const APP_VERSION = "0.48.2";
+export const APP_VERSION = "0.49.0";
 
 export type ChangelogEntry = {
   version: string;
@@ -11,6 +11,13 @@ export type ChangelogEntry = {
 };
 
 export const CHANGELOG: ChangelogEntry[] = [
+  {
+    version: "0.49.0",
+    date: "2026-07-18 12:30",
+    added: [
+      "New Support page — report a bug, share a suggestion, or ask a question right from the app. Submissions email you a confirmation and (if an admin has configured a Gitea repo in Settings) automatically open a tracked issue. Admins get a Support section in the admin panel to triage tickets and retry issue creation.",
+    ],
+  },
   {
     version: "0.48.2",
     date: "2026-07-18 11:15",

apps/web/lib/email.ts

@@ -141,6 +141,24 @@ export function weeklyDigestHtml(opts: {
   );
 }
 
+export function supportTicketReceivedHtml(opts: {
+  type: string;
+  title: string;
+  ticketUrl: string;
+  giteaIssueUrl: string | null;
+}) {
+  const { type, title, ticketUrl, giteaIssueUrl } = opts;
+  const typeLabel = type === "bug" ? "bug report" : type === "suggestion" ? "suggestion" : "question";
+  return layout(
+    "We got your message — Epicure",
+    `<h1 style="margin:0 0 8px;font-size:24px;">Thanks for reaching out</h1>
+     <p style="margin:0 0 4px;color:#57534e;line-height:1.6;">We received your ${typeLabel}:</p>
+     <p style="margin:16px 0;padding:12px 16px;background:#fafaf9;border-radius:8px;border:1px solid #e7e5e4;font-weight:600;">${title}</p>
+     <p style="margin:0 0 4px;color:#57534e;line-height:1.6;">We'll follow up if we need more details.${giteaIssueUrl ? " It's also been logged for tracking." : ""}</p>
+     ${btn(ticketUrl, "View your ticket")}`
+  );
+}
+
 export function welcomeHtml(name: string) {
   return layout(
     "Welcome to Epicure",

apps/web/lib/gitea.ts

@@ -0,0 +1,55 @@
+import { getSiteSetting } from "@/lib/site-settings";
+
+const LABELS: Record<string, string[]> = {
+  bug: ["bug"],
+  suggestion: ["enhancement"],
+  question: ["question"],
+};
+
+/**
+ * Opens an issue on the configured Gitea repo for a support ticket. Returns
+ * the issue's HTML URL on success, or null if Gitea isn't configured or the
+ * request fails — callers must treat this as best-effort, not block on it,
+ * since the ticket itself is already saved regardless.
+ */
+export async function createGiteaIssue(opts: {
+  type: string;
+  title: string;
+  body: string;
+}): Promise<{ url: string | null; error: string | null }> {
+  const [baseUrl, token, repo] = await Promise.all([
+    getSiteSetting("GITEA_URL"),
+    getSiteSetting("GITEA_TOKEN"),
+    getSiteSetting("GITEA_REPO"),
+  ]);
+
+  if (!baseUrl || !token || !repo) {
+    return { url: null, error: null };
+  }
+
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/$/, "")}/api/v1/repos/${repo}/issues`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `token ${token}`,
+      },
+      body: JSON.stringify({
+        title: opts.title,
+        body: opts.body,
+        labels: LABELS[opts.type] ?? [],
+      }),
+      signal: AbortSignal.timeout(10000),
+    });
+
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      return { url: null, error: `Gitea returned ${res.status}: ${text.slice(0, 300)}` };
+    }
+
+    const issue = (await res.json()) as { html_url?: string };
+    return { url: issue.html_url ?? null, error: issue.html_url ? null : "Gitea response had no html_url" };
+  } catch (err) {
+    return { url: null, error: err instanceof Error ? err.message : "Unknown error" };
+  }
+}

apps/web/lib/openapi.ts

@@ -582,6 +582,21 @@ export function generateOpenApiSpec(): object {
   registry.registerPath({ method: "get", path: "/api/v1/webhooks/{id}/deliveries", summary: "List recent delivery attempts (most recent 20)", security, request: { params: idParam }, responses: { 200: { description: "Deliveries, newest first", content: { "application/json": { schema: z.array(WebhookDeliveryRef) } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "post", path: "/api/v1/webhooks/{id}/redeliver", summary: "Re-send a past delivery's payload", security, request: { params: idParam, body: { content: { "application/json": { schema: z.object({ deliveryId: z.string().uuid() }) } }, required: true } }, responses: { 200: { description: "Redelivery dispatched", content: { "application/json": { schema: z.object({ ok: z.boolean() }) } } }, 400: { description: "Validation error", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Webhook or delivery not found", content: { "application/json": { schema: ApiErrorRef } } } } });
 
+  // --- Support: bug reports, suggestions, and questions submitted in-app ---
+  const SupportTicketTypeEnum = z.enum(["bug", "suggestion", "question"]);
+  const SupportTicketStatusEnum = z.enum(["open", "triaged", "closed"]);
+  const SupportTicketRef = registry.register("SupportTicket", z.object({
+    id: z.string(), userId: z.string(), type: SupportTicketTypeEnum, title: z.string(), description: z.string(),
+    status: SupportTicketStatusEnum, giteaIssueUrl: z.string().nullable(), giteaError: z.string().nullable(),
+    createdAt: z.string().datetime(), updatedAt: z.string().datetime(),
+  }));
+  const CreateSupportTicketRef = registry.register("CreateSupportTicket", z.object({
+    type: SupportTicketTypeEnum, title: z.string().min(3).max(200), description: z.string().min(10).max(5000),
+  }));
+
+  registry.registerPath({ method: "get", path: "/api/v1/support", summary: "List your support tickets", security, responses: { 200: { description: "Tickets, newest first", content: { "application/json": { schema: z.array(SupportTicketRef) } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
+  registry.registerPath({ method: "post", path: "/api/v1/support", summary: "Submit a bug report, suggestion, or question", description: "Best-effort opens a matching issue on the configured Gitea repo (see giteaIssueUrl/giteaError) — this never blocks ticket creation. Sends a confirmation email.", security, request: { body: { content: { "application/json": { schema: CreateSupportTicketRef } }, required: true } }, responses: { 201: { description: "Created", content: { "application/json": { schema: SupportTicketRef } } }, 400: { description: "Validation error", content: { "application/json": { schema: ApiErrorRef } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
+
   // --- Conversations: 1:1 direct messages ---
   const ConversationSummaryRef = registry.register("ConversationSummary", z.object({
     id: z.string(),

apps/web/lib/site-settings.ts

@@ -15,13 +15,17 @@ export type SiteSettingKey =
   | "DEFAULT_VISION_PROVIDER"
   | "DEFAULT_VISION_MODEL"
   | "DEFAULT_MEAL_PLAN_PROVIDER"
-  | "DEFAULT_MEAL_PLAN_MODEL";
+  | "DEFAULT_MEAL_PLAN_MODEL"
+  | "GITEA_URL"
+  | "GITEA_TOKEN"
+  | "GITEA_REPO";
 
 const SECRET_KEYS: SiteSettingKey[] = [
   "OPENAI_API_KEY",
   "ANTHROPIC_API_KEY",
   "OPENROUTER_API_KEY",
   "VAPID_PRIVATE_KEY",
+  "GITEA_TOKEN",
 ];
 
 export function isSecretKey(key: SiteSettingKey): boolean {
@@ -58,6 +62,9 @@ export async function getAllSiteSettings(): Promise<Record<string, { value: stri
     "DEFAULT_VISION_MODEL",
     "DEFAULT_MEAL_PLAN_PROVIDER",
     "DEFAULT_MEAL_PLAN_MODEL",
+    "GITEA_URL",
+    "GITEA_TOKEN",
+    "GITEA_REPO",
   ];
 
   const result: Record<string, { value: string | null; isSecret: boolean; fromDb: boolean }> = {};