feat: two-way sync between support tickets and Gitea issues (v0.63.0)

Outbound (already existed one-way: ticket create -> Gitea issue) now
also mirrors status changes: closing/reopening a ticket in the admin
UI closes/reopens the linked Gitea issue, and replies posted from
Epicure (by the ticket owner or an admin) post as a comment on the
issue. Captures and stores the Gitea issue number at creation time
to address these follow-up calls without re-parsing the issue URL.

Inbound: new webhook receiver at /api/webhooks/gitea, verified via
HMAC-SHA256 signature (X-Gitea-Signature) with a configurable
GITEA_WEBHOOK_SECRET site setting, deduped by delivery id the same
way the existing Stripe receiver dedupes events. Handles "issues"
(closed/reopened -> ticket status) and "issue_comment" (created ->
appends to the ticket's comment thread), skipping comments Epicura
already posted itself (matched by Gitea comment id) to avoid loops.

New support_ticket_comments table backs a lightweight conversation
thread on both the user-facing support page and the admin support
manager, each comment tagged by author (user/admin/gitea).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/admin/settings/route.ts

@@ -25,6 +25,7 @@ const ALLOWED_KEYS: SiteSettingKey[] = [
   "GITEA_URL",
   "GITEA_TOKEN",
   "GITEA_REPO",
+  "GITEA_WEBHOOK_SECRET",
 ];
 
 export async function PUT(req: NextRequest) {

apps/web/app/api/v1/admin/support/[id]/comments/route.ts

@@ -0,0 +1,60 @@
+import { NextRequest, NextResponse } from "next/server";
+import crypto from "node:crypto";
+import { z } from "zod";
+import { db, supportTickets, supportTicketComments, eq, asc } from "@epicure/db";
+import { requireAdmin } from "@/lib/api-auth";
+import { postGiteaComment } from "@/lib/gitea";
+
+const CreateCommentBody = z.object({
+  body: z.string().trim().min(1).max(3000),
+});
+
+export async function GET(_req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const { response } = await requireAdmin();
+  if (response) return response;
+
+  const { id } = await params;
+  const comments = await db.query.supportTicketComments.findMany({
+    where: eq(supportTicketComments.ticketId, id),
+    orderBy: asc(supportTicketComments.createdAt),
+  });
+
+  return NextResponse.json(comments);
+}
+
+export async function POST(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const { session, response } = await requireAdmin();
+  if (response) return response;
+
+  const { id } = await params;
+  const ticket = await db.query.supportTickets.findFirst({ where: eq(supportTickets.id, id) });
+  if (!ticket) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const parsed = CreateCommentBody.safeParse(await req.json());
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
+  }
+
+  let giteaCommentId: number | null = null;
+  if (ticket.giteaIssueNumber) {
+    const { id: commentId } = await postGiteaComment(ticket.giteaIssueNumber, parsed.data.body);
+    giteaCommentId = commentId;
+  }
+
+  const commentId = crypto.randomUUID();
+  const now = new Date();
+  await db.insert(supportTicketComments).values({
+    id: commentId,
+    ticketId: id,
+    authorType: "admin",
+    authorId: session!.user.id,
+    body: parsed.data.body,
+    giteaCommentId,
+    createdAt: now,
+  });
+
+  return NextResponse.json(
+    { id: commentId, ticketId: id, authorType: "admin", authorId: session!.user.id, body: parsed.data.body, createdAt: now.toISOString() },
+    { status: 201 }
+  );
+}

apps/web/app/api/v1/admin/support/[id]/route.ts

@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { db, supportTickets, supportTicketAttachments, eq } from "@epicure/db";
 import { requireAdmin } from "@/lib/api-auth";
-import { createGiteaIssue, buildGiteaIssueBody } from "@/lib/gitea";
+import { createGiteaIssue, buildGiteaIssueBody, setGiteaIssueState } from "@/lib/gitea";
 
 const UpdateTicketBody = z.object({
   status: z.enum(["open", "triaged", "closed"]).optional(),
@@ -27,6 +27,11 @@ export async function PATCH(req: NextRequest, { params }: { params: Promise<{ id
 
   if (parsed.data.status) {
     updates.status = parsed.data.status;
+    // Mirror the status change onto the linked Gitea issue — best-effort,
+    // never blocks the ticket update on Gitea being reachable.
+    if (ticket.giteaIssueNumber && parsed.data.status !== ticket.status) {
+      void setGiteaIssueState(ticket.giteaIssueNumber, parsed.data.status === "closed" ? "closed" : "open");
+    }
   }
 
   if (parsed.data.retryGitea) {
@@ -35,12 +40,13 @@ export async function PATCH(req: NextRequest, { params }: { params: Promise<{ id
       .from(supportTicketAttachments)
       .where(eq(supportTicketAttachments.ticketId, id));
 
-    const { url, error } = await createGiteaIssue({
+    const { url, number, error } = await createGiteaIssue({
       type: ticket.type,
       title: ticket.title,
       body: buildGiteaIssueBody({ description: ticket.description, userId: ticket.userId, attachments }),
     });
     updates.giteaIssueUrl = url;
+    updates.giteaIssueNumber = number;
     updates.giteaError = error;
   }