Update app.py

app.py

@@ -1,12 +1,13 @@
-import os, io, json, subprocess, tempfile, secrets, shutil
+import os, json, subprocess, tempfile, shutil, base64
 import bcrypt
 from datetime import datetime, timedelta
-from typing import Optional
 from pathlib import Path
+from typing import Optional
 
+import httpx
 from fastapi import FastAPI, UploadFile, File, HTTPException, Depends, Form, Request
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import JSONResponse, HTMLResponse, PlainTextResponse, Response
+from fastapi.responses import HTMLResponse, Response
 from pydantic import BaseModel
 from jose import JWTError, jwt
 
@@ -15,19 +16,20 @@ SECRET_KEY        = os.environ.get("SECRET_KEY", "php-hosting-secret-key-change-
 ALGORITHM         = "HS256"
 TOKEN_EXPIRE_MINS = 60 * 24 * 7
 
-MAX_FILE_BYTES  = 25 * 1024 * 1024
-MAX_USER_BYTES  = 500 * 1024 * 1024
-MAX_TOTAL_BYTES = 15 * 1024 * 1024 * 1024
+MAX_FILE_BYTES = 25 * 1024 * 1024   # 25 MB per file
 
-# ── Storage paths ─────────────────────────────────────────────────────────────
-DATA_DIR  = Path("/data")
-USERS_DIR = DATA_DIR / "users"
-DB_FILE   = DATA_DIR / "db" / "users.json"
+# ── GitHub Config ─────────────────────────────────────────────────────────────
+GITHUB_TOKEN    = os.environ.get("GITHUB_TOKEN")
+GITHUB_USERNAME = os.environ.get("GITHUB_USERNAME")
+GITHUB_REPO     = "Master"
+GITHUB_BASE     = "PHP/Users"
+GITHUB_API      = "https://api.github.com"
 
-USERS_DIR.mkdir(parents=True, exist_ok=True)
+# ── Local DB (users only — no files stored locally) ───────────────────────────
+DATA_DIR = Path("/data")
+DB_FILE  = DATA_DIR / "db" / "users.json"
 DB_FILE.parent.mkdir(parents=True, exist_ok=True)
 
-# ── Database ──────────────────────────────────────────────────────────────────
 def load_db() -> dict:
     if DB_FILE.exists():
         try:
@@ -42,18 +44,15 @@ def save_db(db: dict):
 # ── Security ──────────────────────────────────────────────────────────────────
 def hash_password(p: str) -> str:
     try:
-        # Encode to bytes and safely truncate to 72 bytes (bcrypt's limit)
-        pwd_bytes = p.encode('utf-8')[:72]
+        pwd_bytes = p.encode("utf-8")[:72]
         salt = bcrypt.gensalt(rounds=10)
-        return bcrypt.hashpw(pwd_bytes, salt).decode('utf-8')
+        return bcrypt.hashpw(pwd_bytes, salt).decode("utf-8")
     except Exception as e:
         raise HTTPException(500, f"Password hashing error: {e}")
 
 def verify_password(plain: str, hashed: str) -> bool:
     try:
-        pwd_bytes = plain.encode('utf-8')[:72]
-        hashed_bytes = hashed.encode('utf-8')
-        return bcrypt.checkpw(pwd_bytes, hashed_bytes)
+        return bcrypt.checkpw(plain.encode("utf-8")[:72], hashed.encode("utf-8"))
     except:
         return False
 
@@ -69,27 +68,87 @@ def decode_jwt(token: str):
     except JWTError:
         return None
 
-# ── Storage helpers ────────────────────────────────────────────────────────────
-def user_dir(username: str) -> Path:
-    p = USERS_DIR / username
-    p.mkdir(parents=True, exist_ok=True)
-    return p
-
-def repo_dir(username: str, repo: str) -> Path:
-    p = user_dir(username) / repo
-    p.mkdir(parents=True, exist_ok=True)
-    return p
-
-def get_dir_size(path: Path) -> int:
-    try:
-        return sum(f.stat().st_size for f in path.rglob("*") if f.is_file())
-    except:
-        return 0
-
-def get_total_storage() -> int:
-    if USERS_DIR.exists():
-        return get_dir_size(USERS_DIR)
-    return 0
+# ── GitHub API helpers ─────────────────────────────────────────────────────────
+def gh_headers() -> dict:
+    if not GITHUB_TOKEN:
+        raise HTTPException(500, "GitHub token not configured")
+    return {
+        "Authorization": f"token {GITHUB_TOKEN}",
+        "Accept":        "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+    }
+
+def gh_path(username: str, repo: str = None, filename: str = None) -> str:
+    path = f"{GITHUB_BASE}/{username}"
+    if repo:
+        path += f"/{repo}"
+    if filename:
+        path += f"/{filename}"
+    return path
+
+async def gh_get_file(path: str) -> Optional[dict]:
+    url = f"{GITHUB_API}/repos/{GITHUB_USERNAME}/{GITHUB_REPO}/contents/{path}"
+    async with httpx.AsyncClient(timeout=30) as client:
+        res = await client.get(url, headers=gh_headers())
+        if res.status_code == 404:
+            return None
+        if res.status_code != 200:
+            raise HTTPException(res.status_code, f"GitHub error: {res.text}")
+        return res.json()
+
+async def gh_put_file(path: str, content_bytes: bytes, message: str, sha: str = None):
+    url  = f"{GITHUB_API}/repos/{GITHUB_USERNAME}/{GITHUB_REPO}/contents/{path}"
+    body = {
+        "message": message,
+        "content": base64.b64encode(content_bytes).decode("utf-8"),
+    }
+    if sha:
+        body["sha"] = sha
+    async with httpx.AsyncClient(timeout=60) as client:
+        res = await client.put(url, headers=gh_headers(), json=body)
+        if res.status_code not in (200, 201):
+            raise HTTPException(res.status_code, f"GitHub upload error: {res.text}")
+        return res.json()
+
+async def gh_delete_file(path: str, sha: str, message: str):
+    url  = f"{GITHUB_API}/repos/{GITHUB_USERNAME}/{GITHUB_REPO}/contents/{path}"
+    body = {"message": message, "sha": sha}
+    async with httpx.AsyncClient(timeout=30) as client:
+        res = await client.delete(url, headers=gh_headers(), json=body)
+        if res.status_code not in (200, 204):
+            raise HTTPException(res.status_code, f"GitHub delete error: {res.text}")
+
+async def gh_list_folder(path: str) -> list:
+    url = f"{GITHUB_API}/repos/{GITHUB_USERNAME}/{GITHUB_REPO}/contents/{path}"
+    async with httpx.AsyncClient(timeout=30) as client:
+        res = await client.get(url, headers=gh_headers())
+        if res.status_code == 404:
+            return []
+        if res.status_code != 200:
+            return []
+        return res.json()
+
+async def gh_create_placeholder(path: str, username: str):
+    placeholder_path = f"{path}/.gitkeep"
+    existing = await gh_get_file(placeholder_path)
+    if not existing:
+        await gh_put_file(
+            placeholder_path,
+            b"",
+            f"Create folder for {username}"
+        )
+
+async def gh_ensure_repo_exists():
+    url = f"{GITHUB_API}/repos/{GITHUB_USERNAME}/{GITHUB_REPO}"
+    async with httpx.AsyncClient(timeout=30) as client:
+        res = await client.get(url, headers=gh_headers())
+        if res.status_code == 404:
+            create_url = f"{GITHUB_API}/user/repos"
+            await client.post(create_url, headers=gh_headers(), json={
+                "name":    GITHUB_REPO,
+                "private": True,
+                "description": "PHP Hosting Storage"
+            })
 
 # ── Auth dependency ────────────────────────────────────────────────────────────
 def get_current_user(request: Request) -> dict:
@@ -120,11 +179,11 @@ app.add_middleware(
 
 @app.get("/")
 def root():
-    return {"status": "PHP Hosting Backend is running"}
+    return {"status": "PHP Hosting Backend is running", "storage": "GitHub"}
 
 @app.get("/health")
 def health():
-    return {"status": "ok", "users": len(load_db())}
+    return {"status": "ok", "users": len(load_db()), "storage": "GitHub"}
 
 # ── Register ───────────────────────────────────────────────────────────────────
 class RegisterBody(BaseModel):
@@ -132,7 +191,7 @@ class RegisterBody(BaseModel):
     password: str
 
 @app.post("/auth/register")
-def register(body: RegisterBody):
+async def register(body: RegisterBody):
     try:
         if len(body.username) < 3:
             raise HTTPException(400, "Username must be at least 3 characters")
@@ -142,19 +201,23 @@ def register(body: RegisterBody):
             raise HTTPException(400, "Password must be at least 8 characters")
 
         db = load_db()
-
         if body.username in db:
             raise HTTPException(400, "Username already taken")
 
         hashed = hash_password(body.password)
 
+        # Create user folder in GitHub: PHP/Users/username/
+        await gh_ensure_repo_exists()
+        user_folder = gh_path(body.username)
+        await gh_create_placeholder(user_folder, body.username)
+
         db[body.username] = {
             "username":      body.username,
             "password_hash": hashed,
             "created_at":    datetime.utcnow().isoformat(),
+            "github_path":   user_folder,
         }
         save_db(db)
-        user_dir(body.username)
 
         token = create_jwt({"sub": body.username})
         return {
@@ -202,25 +265,26 @@ async def upload_files(
         if not repo.isalnum():
             raise HTTPException(400, "Repo name must be letters and numbers only")
 
-        total = get_total_storage()
-        if total >= MAX_TOTAL_BYTES:
-            raise HTTPException(507, "Platform storage full. Contact admin.")
-
-        udir = user_dir(user["username"])
-        user_used = get_dir_size(udir)
-        if user_used >= MAX_USER_BYTES:
-            raise HTTPException(507, "Your storage limit (500 MB) reached.")
-
-        rdir = repo_dir(user["username"], repo)
         uploaded = []
-
         for f in files:
             content = await f.read()
             if len(content) > MAX_FILE_BYTES:
                 raise HTTPException(413, f"{f.filename} exceeds 25 MB limit")
-            safe_name = Path(f.filename).name
-            file_path = rdir / safe_name
-            file_path.write_bytes(content)
+
+            safe_name   = Path(f.filename).name
+            file_path   = gh_path(user["username"], repo, safe_name)
+
+            # Check if file already exists (for update)
+            existing = await gh_get_file(file_path)
+            sha      = existing["sha"] if existing else None
+
+            await gh_put_file(
+                file_path,
+                content,
+                f"Upload {safe_name} to {user['username']}/{repo}",
+                sha
+            )
+
             uploaded.append({
                 "filename": safe_name,
                 "size":     len(content),
@@ -239,30 +303,39 @@ async def upload_files(
 
 # ── List repos and files ───────────────────────────────────────────────────────
 @app.get("/files")
-def list_files(user: dict = Depends(get_current_user)):
+async def list_files(user: dict = Depends(get_current_user)):
     try:
-        udir = user_dir(user["username"])
-        repos = []
-        for repo_path in sorted(udir.iterdir()):
-            if repo_path.is_dir():
-                files = []
-                for fp in sorted(repo_path.iterdir()):
-                    if fp.is_file():
+        user_folder = gh_path(user["username"])
+        items       = await gh_list_folder(user_folder)
+        repos       = []
+        total_size  = 0
+
+        for item in items:
+            if item.get("type") == "dir":
+                repo_name  = item["name"]
+                repo_items = await gh_list_folder(f"{user_folder}/{repo_name}")
+                files      = []
+                for fi in repo_items:
+                    if fi.get("type") == "file" and fi["name"] != ".gitkeep":
+                        size = fi.get("size", 0)
+                        total_size += size
                         files.append({
-                            "filename": fp.name,
-                            "size":     fp.stat().st_size,
-                            "url":      f"https://php-hosting.emalawi19.workers.dev/{user['username']}/{repo_path.name}/{fp.name}"
+                            "filename": fi["name"],
+                            "size":     size,
+                            "sha":      fi["sha"],
+                            "url":      f"https://php-hosting.emalawi19.workers.dev/{user['username']}/{repo_name}/{fi['name']}"
                         })
-                repos.append({
-                    "repo":     repo_path.name,
-                    "repo_url": f"https://php-hosting.emalawi19.workers.dev/{user['username']}/{repo_path.name}",
-                    "files":    files
-                })
-        used = get_dir_size(udir)
+                if files:
+                    repos.append({
+                        "repo":     repo_name,
+                        "repo_url": f"https://php-hosting.emalawi19.workers.dev/{user['username']}/{repo_name}",
+                        "files":    files
+                    })
+
         return {
             "username": user["username"],
             "repos":    repos,
-            "used_mb":  round(used / (1024 * 1024), 2),
+            "used_mb":  round(total_size / (1024 * 1024), 2),
             "limit_mb": 500
         }
     except HTTPException:
@@ -272,12 +345,17 @@ def list_files(user: dict = Depends(get_current_user)):
 
 # ── Delete file ────────────────────────────────────────────────────────────────
 @app.delete("/files/{repo}/{filename}")
-def delete_file(repo: str, filename: str, user: dict = Depends(get_current_user)):
+async def delete_file(repo: str, filename: str, user: dict = Depends(get_current_user)):
     try:
-        fp = USERS_DIR / user["username"] / repo / filename
-        if not fp.exists():
+        file_path = gh_path(user["username"], repo, filename)
+        existing  = await gh_get_file(file_path)
+        if not existing:
             raise HTTPException(404, "File not found")
-        fp.unlink()
+        await gh_delete_file(
+            file_path,
+            existing["sha"],
+            f"Delete {filename} from {user['username']}/{repo}"
+        )
         return {"message": f"{filename} deleted"}
     except HTTPException:
         raise
@@ -286,12 +364,17 @@ def delete_file(repo: str, filename: str, user: dict = Depends(get_current_user)
 
 # ── Delete repo ────────────────────────────────────────────────────────────────
 @app.delete("/repo/{repo}")
-def delete_repo(repo: str, user: dict = Depends(get_current_user)):
+async def delete_repo(repo: str, user: dict = Depends(get_current_user)):
     try:
-        rdir = USERS_DIR / user["username"] / repo
-        if not rdir.exists():
-            raise HTTPException(404, "Repo not found")
-        shutil.rmtree(rdir)
+        repo_folder = gh_path(user["username"], repo)
+        items       = await gh_list_folder(repo_folder)
+        for item in items:
+            if item.get("type") == "file":
+                await gh_delete_file(
+                    f"{repo_folder}/{item['name']}",
+                    item["sha"],
+                    f"Delete {item['name']} from {user['username']}/{repo}"
+                )
         return {"message": f"Repo {repo} deleted"}
     except HTTPException:
         raise
@@ -300,13 +383,21 @@ def delete_repo(repo: str, user: dict = Depends(get_current_user)):
 
 # ── Serve PHP / static files ───────────────────────────────────────────────────
 @app.get("/serve/{username}/{repo}/{filename:path}")
-def serve_file(username: str, repo: str, filename: str):
+async def serve_file(username: str, repo: str, filename: str):
     try:
-        file_path = USERS_DIR / username / repo / filename
-        if not file_path.exists():
-            raise HTTPException(404, "File not found")
+        file_path = gh_path(username, repo, filename)
+        file_info = await gh_get_file(file_path)
+
+        if not file_info:
+            # Try index.php fallback
+            if filename == "index.php":
+                file_info = await gh_get_file(gh_path(username, repo, "index.html"))
+                if file_info:
+                    filename = "index.html"
+            if not file_info:
+                raise HTTPException(404, "File not found")
 
-        content = file_path.read_bytes()
+        content = base64.b64decode(file_info["content"].replace("\n", ""))
 
         if filename.endswith(".php"):
             with tempfile.NamedTemporaryFile(
@@ -335,7 +426,7 @@ def serve_file(username: str, repo: str, filename: str):
                     pass
             return HTMLResponse(content=output)
 
-        ext = filename.split(".")[-1].lower()
+        ext      = filename.split(".")[-1].lower()
         mime_map = {
             "html": "text/html",
             "css":  "text/css",
@@ -359,17 +450,23 @@ def serve_file(username: str, repo: str, filename: str):
 
 # ── Storage stats ──────────────────────────────────────────────────────────────
 @app.get("/storage")
-def storage_stats(user: dict = Depends(get_current_user)):
+async def storage_stats(user: dict = Depends(get_current_user)):
     try:
-        udir = user_dir(user["username"])
-        user_used  = get_dir_size(udir)
-        total_used = get_total_storage()
+        user_folder = gh_path(user["username"])
+        items       = await gh_list_folder(user_folder)
+        total_size  = 0
+        for item in items:
+            if item.get("type") == "dir":
+                repo_items = await gh_list_folder(f"{user_folder}/{item['name']}")
+                for fi in repo_items:
+                    if fi.get("type") == "file":
+                        total_size += fi.get("size", 0)
         return {
-            "user_used_mb":   round(user_used / (1024 * 1024), 2),
+            "user_used_mb":   round(total_size / (1024 * 1024), 2),
             "user_limit_mb":  500,
-            "total_used_gb":  round(total_used / (1024 ** 3), 3),
+            "total_used_gb":  round(total_size / (1024 ** 3), 3),
             "total_limit_gb": 15,
-            "percent_used":   round((user_used / MAX_USER_BYTES) * 100, 2)
+            "percent_used":   round((total_size / (500 * 1024 * 1024)) * 100, 2)
         }
     except HTTPException:
         raise