feat: add Git platform and release management

Author: Curtis Delicata

app/Contracts/GitPlatformClient.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Contracts;
+
+use App\Models\GitRepository;
+
+interface GitPlatformClient
+{
+    /** @return list<array<string, mixed>> */
+    public function repositories(): array;
+
+    /** @return list<array<string, mixed>> */
+    public function records(GitRepository $repository, string $type): array;
+
+    /** @return array<string, mixed> */
+    public function createRelease(GitRepository $repository, string $version, string $name, string $changelog): array;
+}

app/Enums/GitProvider.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+enum GitProvider: string
+{
+    case GitHub = 'github';
+    case GitLab = 'gitlab';
+    case Bitbucket = 'bitbucket';
+}

app/Enums/TokenAbility.php

@@ -27,6 +27,8 @@ enum TokenAbility: string
     case IspServicesWrite = 'isp-services:write';
     case VoipRead = 'voip:read';
     case VoipWrite = 'voip:write';
+    case GitRead = 'git:read';
+    case GitWrite = 'git:write';
 
     /**
      * @return list<string>

app/Http/Controllers/Api/GitIntegrationController.php

@@ -0,0 +1,169 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Enums\GitProvider;
+use App\Http\Controllers\Controller;
+use App\Jobs\SyncGitConnection;
+use App\Models\GitConnection;
+use App\Models\GitRelease;
+use App\Models\GitRepository;
+use App\Models\User;
+use App\Services\Git\GitPlatformClientFactory;
+use App\Services\ReleaseManagementService;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use Symfony\Component\HttpFoundation\Response;
+
+class GitIntegrationController extends Controller
+{
+    public function __construct(
+        private readonly GitPlatformClientFactory $clients,
+        private readonly ReleaseManagementService $releases,
+    ) {}
+
+    public function connections(Request $request): JsonResponse
+    {
+        return response()->json($this->connectionsQuery($request)->withCount('repositories')->paginate(25));
+    }
+
+    public function storeConnection(Request $request): JsonResponse
+    {
+        $teamId = $this->teamId($request);
+        $data = $request->validate([
+            'provider' => ['required', Rule::enum(GitProvider::class)],
+            'name' => [
+                'required', 'string', 'max:255',
+                Rule::unique('git_connections', 'name')->where('team_id', $teamId)
+                    ->where('provider', $request->input('provider')),
+            ],
+            'base_url' => 'required|url:https|max:2048',
+            'access_token' => 'required|string|min:8|max:4096',
+            'webhook_secret' => 'nullable|string|min:16|max:4096',
+            'is_active' => 'sometimes|boolean',
+        ]);
+        $data['team_id'] = $teamId;
+
+        return response()->json(GitConnection::query()->create($data), Response::HTTP_CREATED);
+    }
+
+    public function updateConnection(Request $request, int $connection): JsonResponse
+    {
+        $model = $this->connection($request, $connection);
+        $model->update($request->validate([
+            'name' => 'sometimes|string|max:255',
+            'base_url' => 'sometimes|url:https|max:2048',
+            'access_token' => 'sometimes|string|min:8|max:4096',
+            'webhook_secret' => 'nullable|string|min:16|max:4096',
+            'is_active' => 'sometimes|boolean',
+        ]));
+
+        return response()->json($model->refresh());
+    }
+
+    public function destroyConnection(Request $request, int $connection): Response
+    {
+        $this->connection($request, $connection)->delete();
+
+        return response()->noContent();
+    }
+
+    public function sync(Request $request, int $connection): JsonResponse
+    {
+        $model = $this->connection($request, $connection);
+        SyncGitConnection::dispatch($model->id);
+
+        return response()->json(['queued' => true], Response::HTTP_ACCEPTED);
+    }
+
+    public function repositories(Request $request): JsonResponse
+    {
+        return response()->json(
+            GitRepository::query()
+                ->whereHas('connection', fn (Builder $query) => $query->where('team_id', $this->teamId($request)))
+                ->withCount('syncRecords')
+                ->paginate(25)
+        );
+    }
+
+    public function repository(Request $request, int $repository): JsonResponse
+    {
+        return response()->json($this->repositoryForTeam($request, $repository)->load([
+            'syncRecords', 'releases',
+        ]));
+    }
+
+    public function createRelease(Request $request, int $repository): JsonResponse
+    {
+        $repo = $this->repositoryForTeam($request, $repository);
+        $data = $request->validate([
+            'version' => [
+                'required', 'string', 'max:100',
+                Rule::unique('git_releases', 'version')->where('git_repository_id', $repo->id),
+            ],
+            'name' => 'required|string|max:255',
+            'changelog' => 'nullable|string|max:100000',
+        ]);
+        $release = $this->releases->create(
+            $repo,
+            $this->clients->make($repo->connection),
+            $data['version'],
+            $data['name'],
+            $data['changelog'] ?? null
+        );
+
+        return response()->json($release, Response::HTTP_CREATED);
+    }
+
+    public function trackDeployment(Request $request, int $release): JsonResponse
+    {
+        $model = GitRelease::query()
+            ->whereHas(
+                'repository.connection',
+                fn (Builder $query) => $query->where('team_id', $this->teamId($request))
+            )
+            ->findOrFail($release);
+        $data = $request->validate([
+            'environment' => 'required|string|max:100',
+            'status' => 'required|string|max:100',
+            'completed' => 'sometimes|boolean',
+        ]);
+
+        return response()->json($this->releases->trackDeployment(
+            $model,
+            $data['environment'],
+            $data['status'],
+            (bool) ($data['completed'] ?? false)
+        ));
+    }
+
+    /** @return Builder<GitConnection> */
+    private function connectionsQuery(Request $request): Builder
+    {
+        return GitConnection::query()->where('team_id', $this->teamId($request));
+    }
+
+    private function connection(Request $request, int $id): GitConnection
+    {
+        return $this->connectionsQuery($request)->findOrFail($id);
+    }
+
+    private function repositoryForTeam(Request $request, int $id): GitRepository
+    {
+        return GitRepository::query()
+            ->whereHas('connection', fn (Builder $query) => $query->where('team_id', $this->teamId($request)))
+            ->findOrFail($id);
+    }
+
+    private function teamId(Request $request): ?int
+    {
+        /** @var User|null $user */
+        $user = $request->user();
+
+        return $user?->current_team_id;
+    }
+}

app/Http/Controllers/Api/GitWebhookController.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Enums\GitProvider;
+use App\Http\Controllers\Controller;
+use App\Jobs\SyncGitConnection;
+use App\Models\GitConnection;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class GitWebhookController extends Controller
+{
+    public function __invoke(Request $request, GitConnection $connection): JsonResponse
+    {
+        abort_unless($connection->is_active && $this->validSignature($request, $connection), Response::HTTP_UNAUTHORIZED);
+
+        SyncGitConnection::dispatch($connection->id);
+
+        return response()->json(['accepted' => true], Response::HTTP_ACCEPTED);
+    }
+
+    private function validSignature(Request $request, GitConnection $connection): bool
+    {
+        if ($connection->webhook_secret === null || $connection->webhook_secret === '') {
+            return false;
+        }
+
+        if ($connection->provider === GitProvider::GitLab) {
+            $token = $request->header('X-Gitlab-Token');
+
+            return is_string($token) && hash_equals($connection->webhook_secret, $token);
+        }
+
+        $header = $connection->provider === GitProvider::GitHub
+            ? $request->header('X-Hub-Signature-256')
+            : $request->header('X-Hub-Signature');
+        $expected = 'sha256='.hash_hmac('sha256', $request->getContent(), $connection->webhook_secret);
+
+        return is_string($header) && hash_equals($expected, $header);
+    }
+}

app/Jobs/SyncGitConnection.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Jobs;
+
+use App\Models\GitConnection;
+use App\Services\Git\GitPlatformClientFactory;
+use App\Services\GitSyncService;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+
+class SyncGitConnection implements ShouldQueue
+{
+    use Queueable;
+
+    public int $tries = 3;
+
+    public function __construct(public readonly int $connectionId) {}
+
+    public function handle(GitSyncService $sync, GitPlatformClientFactory $clients): void
+    {
+        $connection = GitConnection::query()->where('is_active', true)->findOrFail($this->connectionId);
+        $sync->syncConnection($connection, $clients->make($connection));
+    }
+}

app/Models/GitConnection.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use App\Enums\GitProvider;
+use App\Traits\HasTeam;
+use Database\Factories\GitConnectionFactory;
+use Illuminate\Database\Eloquent\Attributes\Fillable;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Support\Carbon;
+
+/**
+ * @property int $id
+ * @property int $team_id
+ * @property GitProvider $provider
+ * @property string $name
+ * @property string $base_url
+ * @property string $access_token
+ * @property string|null $webhook_secret
+ * @property bool $is_active
+ * @property Carbon|null $last_synced_at
+ */
+#[Fillable([
+    'team_id', 'provider', 'name', 'base_url', 'access_token', 'webhook_secret',
+    'is_active', 'last_synced_at',
+])]
+class GitConnection extends Model
+{
+    use HasFactory;
+    use HasTeam;
+
+    protected $hidden = ['access_token', 'webhook_secret'];
+
+    protected static function newFactory(): GitConnectionFactory
+    {
+        return GitConnectionFactory::new();
+    }
+
+    protected function casts(): array
+    {
+        return [
+            'provider' => GitProvider::class,
+            'access_token' => 'encrypted',
+            'webhook_secret' => 'encrypted',
+            'is_active' => 'boolean',
+            'last_synced_at' => 'datetime',
+        ];
+    }
+
+    public function repositories(): HasMany
+    {
+        return $this->hasMany(GitRepository::class);
+    }
+}

app/Models/GitRelease.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Attributes\Fillable;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Support\Carbon;
+
+/**
+ * @property int $id
+ * @property int $git_repository_id
+ * @property string|null $external_id
+ * @property string $version
+ * @property string $name
+ * @property string|null $changelog
+ * @property Carbon|null $released_at
+ * @property Carbon|null $deployed_at
+ */
+#[Fillable([
+    'git_repository_id', 'external_id', 'version', 'name', 'changelog', 'state',
+    'web_url', 'deployment_environment', 'deployment_status', 'released_at', 'deployed_at',
+])]
+class GitRelease extends Model
+{
+    protected function casts(): array
+    {
+        return ['released_at' => 'datetime', 'deployed_at' => 'datetime'];
+    }
+
+    public function repository(): BelongsTo
+    {
+        return $this->belongsTo(GitRepository::class, 'git_repository_id');
+    }
+}