feat: establish NekoNest Cloud control and relay

2026-08-12 23:25:43 +08:00
commit f27606b709
222 changed files with 71456 additions and 0 deletions
@@ -0,0 +1,43 @@
+import { getCloudViewer } from "@/app/cloud-auth";
+import { resolveBetaAccessRequest } from "@/db/repository";
+import { apiError, readJsonMutation } from "../../respond";
+
+export async function POST(request: Request) {
+  try {
+    const viewer = await getCloudViewer();
+    if (!viewer) {
+      return Response.json(
+        { error: "authentication_required", message: "请先登录" },
+        { status: 401 },
+      );
+    }
+    if (!viewer.isAdmin) {
+      return Response.json(
+        { error: "forbidden", message: "没有商业后台权限" },
+        { status: 403 },
+      );
+    }
+    const payload = await readJsonMutation<{
+      requestId?: string;
+      action?: "approve" | "decline";
+      capacitySlots?: number;
+      endsAt?: string;
+      response?: string;
+      reason?: string;
+      idempotencyKey?: string;
+    }>(request);
+    const result = await resolveBetaAccessRequest({
+      actorId: viewer.userId,
+      requestId: payload.requestId ?? "",
+      action: payload.action ?? "decline",
+      capacitySlots: payload.capacitySlots ?? 0,
+      endsAt: payload.endsAt ?? "",
+      response: payload.response ?? "",
+      reason: payload.reason ?? "",
+      idempotencyKey: payload.idempotencyKey ?? "",
+    });
+    return Response.json(result);
+  } catch (error) {
+    return apiError(error);
+  }
+}
@@ -0,0 +1,14 @@
+import { getCloudViewer } from "@/app/cloud-auth";
+import { setPublicBeta } from "@/db/repository";
+import { apiError, readJsonMutation } from "../../respond";
+
+export async function POST(request: Request) {
+  try {
+    const viewer = await getCloudViewer();
+    if (!viewer) return Response.json({ error: "authentication_required", message: "请先登录" }, { status: 401 });
+    if (!viewer.isAdmin) return Response.json({ error: "forbidden", message: "没有商业后台权限" }, { status: 403 });
+    const payload = await readJsonMutation<{ enabled?: boolean; capacitySlots?: number | null; reason?: string; idempotencyKey?: string }>(request);
+    const beta = await setPublicBeta({ actorId: viewer.userId, enabled: payload.enabled ?? false, capacitySlots: payload.capacitySlots ?? null, reason: payload.reason ?? "", idempotencyKey: payload.idempotencyKey ?? "" });
+    return Response.json({ beta });
+  } catch (error) { return apiError(error); }
+}
@@ -0,0 +1,18 @@
+import { getCloudViewer } from "@/app/cloud-auth";
+import { createExemption, revokeExemption } from "@/db/repository";
+import { apiError, readJsonMutation } from "../../respond";
+
+export async function POST(request: Request) {
+  try {
+    const viewer = await getCloudViewer();
+    if (!viewer) return Response.json({ error: "authentication_required", message: "请先登录" }, { status: 401 });
+    if (!viewer.isAdmin) return Response.json({ error: "forbidden", message: "没有商业后台权限" }, { status: 403 });
+    const payload = await readJsonMutation<{ action?: string; grantId?: string; accountId?: string; capacitySlots?: number | null; endsAt?: string; reason?: string; idempotencyKey?: string }>(request);
+    if (payload.action === "revoke") {
+      const grant = await revokeExemption({ actorId: viewer.userId, grantId: payload.grantId ?? "", reason: payload.reason ?? "", idempotencyKey: payload.idempotencyKey ?? "" });
+      return Response.json({ grant });
+    }
+    const grant = await createExemption({ actorId: viewer.userId, accountId: payload.accountId ?? "", capacitySlots: payload.capacitySlots ?? null, endsAt: payload.endsAt ?? "", reason: payload.reason ?? "", idempotencyKey: payload.idempotencyKey ?? "" });
+    return Response.json({ grant }, { status: 201 });
+  } catch (error) { return apiError(error); }
+}
@@ -0,0 +1,37 @@
+import { getCloudViewer } from "@/app/cloud-auth";
+import { resolveFeedback } from "@/db/repository";
+import { apiError, readJsonMutation } from "../../respond";
+
+export async function POST(request: Request) {
+  try {
+    const viewer = await getCloudViewer();
+    if (!viewer) {
+      return Response.json(
+        { error: "authentication_required", message: "请先登录" },
+        { status: 401 },
+      );
+    }
+    if (!viewer.isAdmin) {
+      return Response.json(
+        { error: "forbidden", message: "没有公测后台权限" },
+        { status: 403 },
+      );
+    }
+    const payload = await readJsonMutation<{
+      feedbackId?: string;
+      response?: string;
+      reason?: string;
+      idempotencyKey?: string;
+    }>(request);
+    const feedback = await resolveFeedback({
+      feedbackId: payload.feedbackId ?? "",
+      actorId: viewer.userId,
+      response: payload.response ?? "",
+      reason: payload.reason ?? "",
+      idempotencyKey: payload.idempotencyKey ?? "",
+    });
+    return Response.json({ feedback });
+  } catch (error) {
+    return apiError(error);
+  }
+}
@@ -0,0 +1,61 @@
+import { getCloudViewer } from "@/app/cloud-auth";
+import {
+  createServiceIncident,
+  resolveServiceIncident,
+} from "@/db/repository";
+import { apiError, readJsonMutation } from "../../respond";
+
+export async function POST(request: Request) {
+  try {
+    const viewer = await getCloudViewer();
+    if (!viewer) {
+      return Response.json(
+        { error: "authentication_required", message: "请先登录" },
+        { status: 401 },
+      );
+    }
+    if (!viewer.isAdmin) {
+      return Response.json(
+        { error: "forbidden", message: "没有公测后台权限" },
+        { status: 403 },
+      );
+    }
+    const payload = await readJsonMutation<{
+      action?: string;
+      incidentId?: string;
+      severity?: string;
+      title?: string;
+      message?: string;
+      resolution?: string;
+      reason?: string;
+      idempotencyKey?: string;
+    }>(request);
+
+    if (payload.action === "create") {
+      const incident = await createServiceIncident({
+        actorId: viewer.userId,
+        severity: payload.severity ?? "",
+        title: payload.title ?? "",
+        message: payload.message ?? "",
+        reason: payload.reason ?? "",
+        idempotencyKey: payload.idempotencyKey ?? "",
+      });
+      return Response.json({ incident }, { status: 201 });
+    }
+    if (payload.action === "resolve") {
+      const incident = await resolveServiceIncident({
+        incidentId: payload.incidentId ?? "",
+        actorId: viewer.userId,
+        resolution: payload.resolution ?? "",
+        reason: payload.reason ?? "",
+      });
+      return Response.json({ incident });
+    }
+    return Response.json(
+      { error: "invalid_incident_action", message: "请选择有效的故障公告操作" },
+      { status: 400 },
+    );
+  } catch (error) {
+    return apiError(error);
+  }
+}
@@ -0,0 +1,14 @@
+import { getCloudViewer } from "@/app/cloud-auth";
+import { updateLaunchGate, type LaunchGateRecord } from "@/db/repository";
+import { apiError, readJsonMutation } from "../../respond";
+
+export async function POST(request: Request) {
+  try {
+    const viewer = await getCloudViewer();
+    if (!viewer) return Response.json({ error: "authentication_required", message: "请先登录" }, { status: 401 });
+    if (!viewer.isAdmin) return Response.json({ error: "forbidden", message: "没有商业后台权限" }, { status: 403 });
+    const payload = await readJsonMutation<{ key?: string; status?: LaunchGateRecord["status"]; owner?: string; evidenceUrl?: string; notes?: string; reason?: string; idempotencyKey?: string }>(request);
+    const gate = await updateLaunchGate({ actorId: viewer.userId, key: payload.key ?? "", status: payload.status ?? "blocked", owner: payload.owner ?? "", evidenceUrl: payload.evidenceUrl ?? "", notes: payload.notes ?? "", reason: payload.reason ?? "", idempotencyKey: payload.idempotencyKey ?? "" });
+    return Response.json({ gate });
+  } catch (error) { return apiError(error); }
+}
@@ -0,0 +1,13 @@
+import { getCloudViewer } from "@/app/cloud-auth";
+import { DomainError } from "@/db/repository";
+import { apiError, readJsonMutation } from "../../respond";
+
+export async function POST(request: Request) {
+  try {
+    const viewer = await getCloudViewer();
+    if (!viewer) return Response.json({ error: "authentication_required", message: "请先登录" }, { status: 401 });
+    if (!viewer.isAdmin) return Response.json({ error: "forbidden", message: "没有商业后台权限" }, { status: 403 });
+    await readJsonMutation<{ period?: "month" | "year"; amountMinor?: number; reason?: string; idempotencyKey?: string }>(request);
+    throw new DomainError("paid_features_deferred", "免费公测阶段不发布价格版本", 409);
+  } catch (error) { return apiError(error); }
+}
@@ -0,0 +1,40 @@
+import { getCloudViewer } from "@/app/cloud-auth";
+import { beginRelayMigration } from "@/db/relay-migrations";
+import { apiError, readJsonMutation } from "../../respond";
+
+export async function POST(request: Request) {
+  try {
+    const viewer = await getCloudViewer();
+    if (!viewer) {
+      return Response.json(
+        { error_code: "authentication_required", message: "请先登录", retryable: false },
+        { status: 401 },
+      );
+    }
+    if (!viewer.isAdmin) {
+      return Response.json(
+        { error_code: "forbidden", message: "没有 Relay 迁移权限", retryable: false },
+        { status: 403 },
+      );
+    }
+    const payload = await readJsonMutation<{
+      tenant_id?: string;
+      target_node_id?: string;
+      reason?: string;
+      idempotency_key?: string;
+    }>(request);
+    const migration = await beginRelayMigration({
+      tenantId: payload.tenant_id ?? "",
+      targetNodeId: payload.target_node_id ?? "",
+      actorId: viewer.userId,
+      reason: payload.reason ?? "",
+      idempotencyKey: payload.idempotency_key ?? "",
+    });
+    return Response.json(
+      { migration_id: migration.id, state: migration.state, started_at: migration.started_at },
+      { status: 202, headers: { "cache-control": "no-store" } },
+    );
+  } catch (error) {
+    return apiError(error);
+  }
+}
@@ -0,0 +1,38 @@
+import { getCloudViewer } from "@/app/cloud-auth";
+import { beginRelayPurge } from "@/db/relay-purges";
+import { apiError, readJsonMutation } from "../../respond";
+
+export async function POST(request: Request) {
+  try {
+    const viewer = await getCloudViewer();
+    if (!viewer) {
+      return Response.json(
+        { error_code: "authentication_required", message: "请先登录", retryable: false },
+        { status: 401 },
+      );
+    }
+    if (!viewer.isAdmin) {
+      return Response.json(
+        { error_code: "forbidden", message: "没有永久删除租户数据的权限", retryable: false },
+        { status: 403 },
+      );
+    }
+    const payload = await readJsonMutation<{
+      deletion_request_id?: string;
+      reason?: string;
+      confirmation?: string;
+    }>(request);
+    const purge = await beginRelayPurge({
+      deletionRequestId: payload.deletion_request_id ?? "",
+      actorId: viewer.userId,
+      reason: payload.reason ?? "",
+      confirmation: payload.confirmation ?? "",
+    });
+    return Response.json(
+      { purge_id: purge.id, state: purge.state, started_at: purge.started_at },
+      { status: 202, headers: { "cache-control": "no-store" } },
+    );
+  } catch (error) {
+    return apiError(error);
+  }
+}
@@ -0,0 +1,34 @@
+import { getCloudViewer } from "@/app/cloud-auth";
+import { runRetentionMaintenance } from "@/db/repository";
+import { apiError, readJsonMutation } from "../../respond";
+
+export async function POST(request: Request) {
+  try {
+    const viewer = await getCloudViewer();
+    if (!viewer) {
+      return Response.json(
+        { error: "authentication_required", message: "请先登录" },
+        { status: 401 },
+      );
+    }
+    if (!viewer.isAdmin) {
+      return Response.json(
+        { error: "forbidden", message: "没有公测后台权限" },
+        { status: 403 },
+      );
+    }
+
+    const payload = await readJsonMutation<{
+      confirmed?: boolean;
+      reason?: string;
+    }>(request);
+    const retention = await runRetentionMaintenance({
+      actorId: viewer.userId,
+      confirmed: payload.confirmed === true,
+      reason: payload.reason ?? "",
+    });
+    return Response.json({ retention });
+  } catch (error) {
+    return apiError(error);
+  }
+}