feat: two-way sync between support tickets and Gitea issues (v0.63.0)

Outbound (already existed one-way: ticket create -> Gitea issue) now also mirrors status changes: closing/reopening a ticket in the admin UI closes/reopens the linked Gitea issue, and replies posted from Epicure (by the ticket owner or an admin) post as a comment on the issue. Captures and stores the Gitea issue number at creation time to address these follow-up calls without re-parsing the issue URL. Inbound: new webhook receiver at /api/webhooks/gitea, verified via HMAC-SHA256 signature (X-Gitea-Signature) with a configurable GITEA_WEBHOOK_SECRET site setting, deduped by delivery id the same way the existing Stripe receiver dedupes events. Handles "issues" (closed/reopened -> ticket status) and "issue_comment" (created -> appends to the ticket's comment thread), skipping comments Epicura already posted itself (matched by Gitea comment id) to avoid loops. New support_ticket_comments table backs a lightweight conversation thread on both the user-facing support page and the admin support manager, each comment tagged by author (user/admin/gitea). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-20 23:34:39 +02:00
parent 274c50c2f6
commit b17984fbef
22 changed files with 6642 additions and 17 deletions
@@ -0,0 +1,86 @@
+import { NextRequest, NextResponse } from "next/server";
+import crypto from "node:crypto";
+import { db, supportTickets, supportTicketComments, processedGiteaEvents, eq } from "@epicure/db";
+import { getSiteSetting } from "@/lib/site-settings";
+import { verifyGiteaSignature } from "@/lib/gitea";
+
+type GiteaIssuePayload = {
+  action?: string;
+  number?: number;
+  issue?: { number?: number };
+  comment?: { id?: number; body?: string };
+};
+
+export async function POST(req: NextRequest) {
+  const secret = await getSiteSetting("GITEA_WEBHOOK_SECRET");
+  if (!secret) {
+    return NextResponse.json({ error: "Gitea webhook not configured" }, { status: 400 });
+  }
+
+  const rawBody = await req.text();
+  const signature = req.headers.get("x-gitea-signature");
+  if (!signature || !verifyGiteaSignature(rawBody, signature, secret)) {
+    return NextResponse.json({ error: "Invalid signature" }, { status: 401 });
+  }
+
+  // Gitea includes a per-delivery id that stays stable across redeliveries
+  // of the same event, same dedupe pattern as the Stripe receiver.
+  const deliveryId = req.headers.get("x-gitea-delivery");
+  if (deliveryId) {
+    const [inserted] = await db
+      .insert(processedGiteaEvents)
+      .values({ id: deliveryId })
+      .onConflictDoNothing()
+      .returning({ id: processedGiteaEvents.id });
+    if (!inserted) {
+      return NextResponse.json({ received: true, duplicate: true });
+    }
+  }
+
+  const eventType = req.headers.get("x-gitea-event");
+  let payload: GiteaIssuePayload;
+  try {
+    payload = JSON.parse(rawBody) as GiteaIssuePayload;
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+  }
+
+  const issueNumber = payload.issue?.number ?? payload.number;
+  if (!issueNumber) {
+    return NextResponse.json({ received: true });
+  }
+
+  const ticket = await db.query.supportTickets.findFirst({ where: eq(supportTickets.giteaIssueNumber, issueNumber) });
+  if (!ticket) {
+    return NextResponse.json({ received: true });
+  }
+
+  if (eventType === "issues") {
+    if (payload.action === "closed" && ticket.status !== "closed") {
+      await db.update(supportTickets).set({ status: "closed", updatedAt: new Date() }).where(eq(supportTickets.id, ticket.id));
+    } else if (payload.action === "reopened" && ticket.status === "closed") {
+      await db.update(supportTickets).set({ status: "open", updatedAt: new Date() }).where(eq(supportTickets.id, ticket.id));
+    }
+  } else if (eventType === "issue_comment" && payload.action === "created" && payload.comment?.body) {
+    const giteaCommentId = payload.comment.id ?? null;
+    // A comment Epicure just posted via the API already has a row here
+    // (inserted synchronously when it was sent) — skip it so the webhook
+    // delivery for our own comment doesn't create a duplicate.
+    const existing = giteaCommentId
+      ? await db.query.supportTicketComments.findFirst({ where: eq(supportTicketComments.giteaCommentId, giteaCommentId) })
+      : null;
+    if (!existing) {
+      await db.insert(supportTicketComments).values({
+        id: crypto.randomUUID(),
+        ticketId: ticket.id,
+        authorType: "gitea",
+        authorId: null,
+        body: payload.comment.body,
+        giteaCommentId,
+        createdAt: new Date(),
+      });
+    }
+  }
+
+  return NextResponse.json({ received: true });
+}