Update app.py

app.py

@@ -5,7 +5,7 @@ from pathlib import Path
 
 from fastapi import FastAPI, UploadFile, File, HTTPException, Depends, Form, Request
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import JSONResponse, HTMLResponse, PlainTextResponse
+from fastapi.responses import JSONResponse, HTMLResponse, PlainTextResponse, Response
 from pydantic import BaseModel
 from passlib.context import CryptContext
 from jose import JWTError, jwt
@@ -13,21 +13,21 @@ from jose import JWTError, jwt
 # ── Config ────────────────────────────────────────────────────────────────────
 SECRET_KEY        = os.environ.get("SECRET_KEY", "php-hosting-secret-key-change-me")
 ALGORITHM         = "HS256"
-TOKEN_EXPIRE_MINS = 60 * 24 * 7   # 7 days
+TOKEN_EXPIRE_MINS = 60 * 24 * 7
 
-MAX_FILE_BYTES    = 25 * 1024 * 1024        # 25 MB per file
-MAX_USER_BYTES    = 500 * 1024 * 1024       # 500 MB per user
-MAX_TOTAL_BYTES   = 15 * 1024 * 1024 * 1024 # 15 GB total
+MAX_FILE_BYTES    = 25 * 1024 * 1024
+MAX_USER_BYTES    = 500 * 1024 * 1024
+MAX_TOTAL_BYTES   = 15 * 1024 * 1024 * 1024
 
-# ── Storage paths (HF persistent storage) ─────────────────────────────────────
+# ── Storage paths ─────────────────────────────────────────────────────────────
 DATA_DIR  = Path("/data")
-USERS_DIR = DATA_DIR / "users"   # /data/users/<username>/<repo>/<files>
+USERS_DIR = DATA_DIR / "users"
 DB_FILE   = DATA_DIR / "db" / "users.json"
 
 USERS_DIR.mkdir(parents=True, exist_ok=True)
 DB_FILE.parent.mkdir(parents=True, exist_ok=True)
 
-# ── Simple JSON database ───────────────────────────────────────────────────────
+# ── Database ──────────────────────────────────────────────────────────────────
 def load_db() -> dict:
     if DB_FILE.exists():
         try:
@@ -39,16 +39,26 @@ def load_db() -> dict:
 def save_db(db: dict):
     DB_FILE.write_text(json.dumps(db, indent=2))
 
-# ── Security ───────────────────────────────────────────────────────────────────
-pwd_ctx = CryptContext(schemes=["bcrypt"], deprecated="auto")
+# ── Security ──────────────────────────────────────────────────────────────────
+pwd_ctx = CryptContext(
+    schemes=["bcrypt"],
+    deprecated="auto",
+    bcrypt__rounds=10
+)
 
 def hash_password(p: str) -> str:
-    return pwd_ctx.hash(p)
+    try:
+        return pwd_ctx.hash(p)
+    except Exception as e:
+        raise HTTPException(500, f"Password hashing error: {e}")
 
 def verify_password(plain: str, hashed: str) -> bool:
-    return pwd_ctx.verify(plain, hashed)
+    try:
+        return pwd_ctx.verify(plain, hashed)
+    except:
+        return False
 
-def create_jwt(data: dict):
+def create_jwt(data: dict) -> str:
     to_encode = data.copy()
     expire = datetime.utcnow() + timedelta(minutes=TOKEN_EXPIRE_MINS)
     to_encode.update({"exp": expire})
@@ -72,7 +82,10 @@ def repo_dir(username: str, repo: str) -> Path:
     return p
 
 def get_dir_size(path: Path) -> int:
-    return sum(f.stat().st_size for f in path.rglob("*") if f.is_file())
+    try:
+        return sum(f.stat().st_size for f in path.rglob("*") if f.is_file())
+    except:
+        return 0
 
 def get_total_storage() -> int:
     if USERS_DIR.exists():
@@ -110,6 +123,10 @@ app.add_middleware(
 def root():
     return {"status": "PHP Hosting Backend is running"}
 
+@app.get("/health")
+def health():
+    return {"status": "ok", "users": len(load_db())}
+
 # ── Register ───────────────────────────────────────────────────────────────────
 class RegisterBody(BaseModel):
     username: str
@@ -117,34 +134,40 @@ class RegisterBody(BaseModel):
 
 @app.post("/auth/register")
 def register(body: RegisterBody):
-    if len(body.username) < 3:
-        raise HTTPException(400, "Username must be at least 3 characters")
-    if not body.username.isalnum():
-        raise HTTPException(400, "Username must be letters and numbers only")
-    if len(body.password) < 8:
-        raise HTTPException(400, "Password must be at least 8 characters")
-
-    db = load_db()
-    if body.username in db:
-        raise HTTPException(400, "Username already taken")
-
-    db[body.username] = {
-        "username":      body.username,
-        "password_hash": hash_password(body.password),
-        "created_at":    datetime.utcnow().isoformat(),
-    }
-    save_db(db)
-
-    # Create user folder immediately
-    user_dir(body.username)
-
-    token = create_jwt({"sub": body.username})
-    return {
-        "access_token": token,
-        "token_type":   "bearer",
-        "username":     body.username,
-        "message":      "Account created successfully!"
-    }
+    try:
+        if len(body.username) < 3:
+            raise HTTPException(400, "Username must be at least 3 characters")
+        if not body.username.isalnum():
+            raise HTTPException(400, "Username must be letters and numbers only")
+        if len(body.password) < 8:
+            raise HTTPException(400, "Password must be at least 8 characters")
+
+        db = load_db()
+
+        if body.username in db:
+            raise HTTPException(400, "Username already taken")
+
+        hashed = hash_password(body.password)
+
+        db[body.username] = {
+            "username":      body.username,
+            "password_hash": hashed,
+            "created_at":    datetime.utcnow().isoformat(),
+        }
+        save_db(db)
+        user_dir(body.username)
+
+        token = create_jwt({"sub": body.username})
+        return {
+            "access_token": token,
+            "token_type":   "bearer",
+            "username":     body.username,
+            "message":      "Account created successfully!"
+        }
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(500, str(e))
 
 # ── Login ──────────────────────────────────────────────────────────────────────
 class LoginBody(BaseModel):
@@ -153,16 +176,21 @@ class LoginBody(BaseModel):
 
 @app.post("/auth/login")
 def login(body: LoginBody):
-    db = load_db()
-    user = db.get(body.username)
-    if not user or not verify_password(body.password, user["password_hash"]):
-        raise HTTPException(401, "Invalid username or password")
-    token = create_jwt({"sub": body.username})
-    return {
-        "access_token": token,
-        "token_type":   "bearer",
-        "username":     body.username,
-    }
+    try:
+        db = load_db()
+        user = db.get(body.username)
+        if not user or not verify_password(body.password, user["password_hash"]):
+            raise HTTPException(401, "Invalid username or password")
+        token = create_jwt({"sub": body.username})
+        return {
+            "access_token": token,
+            "token_type":   "bearer",
+            "username":     body.username,
+        }
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(500, str(e))
 
 # ── Upload files ───────────────────────────────────────────────────────────────
 @app.post("/upload")
@@ -171,140 +199,180 @@ async def upload_files(
     files: list[UploadFile] = File(...),
     user: dict = Depends(get_current_user)
 ):
-    if not repo.isalnum():
-        raise HTTPException(400, "Repo name must be letters and numbers only")
-
-    # Check total storage
-    total = get_total_storage()
-    if total >= MAX_TOTAL_BYTES:
-        raise HTTPException(507, "Platform storage full. Contact admin.")
-
-    # Check user storage
-    udir = user_dir(user["username"])
-    user_used = get_dir_size(udir)
-    if user_used >= MAX_USER_BYTES:
-        raise HTTPException(507, "Your storage limit (500 MB) reached.")
-
-    rdir = repo_dir(user["username"], repo)
-    uploaded = []
-
-    for f in files:
-        content = await f.read()
-        if len(content) > MAX_FILE_BYTES:
-            raise HTTPException(413, f"{f.filename} exceeds 25 MB limit")
-
-        safe_name = Path(f.filename).name
-        file_path = rdir / safe_name
-        file_path.write_bytes(content)
-
-        uploaded.append({
-            "filename": safe_name,
-            "size":     len(content),
-            "url":      f"https://php-hosting.emalawi.workers.dev/{user['username']}/{repo}/{safe_name}"
-        })
-
-    return {
-        "uploaded": uploaded,
-        "repo":     repo,
-        "repo_url": f"https://php-hosting.emalawi.workers.dev/{user['username']}/{repo}"
-    }
+    try:
+        if not repo.isalnum():
+            raise HTTPException(400, "Repo name must be letters and numbers only")
+
+        total = get_total_storage()
+        if total >= MAX_TOTAL_BYTES:
+            raise HTTPException(507, "Platform storage full. Contact admin.")
+
+        udir = user_dir(user["username"])
+        user_used = get_dir_size(udir)
+        if user_used >= MAX_USER_BYTES:
+            raise HTTPException(507, "Your storage limit (500 MB) reached.")
+
+        rdir = repo_dir(user["username"], repo)
+        uploaded = []
+
+        for f in files:
+            content = await f.read()
+            if len(content) > MAX_FILE_BYTES:
+                raise HTTPException(413, f"{f.filename} exceeds 25 MB limit")
+            safe_name = Path(f.filename).name
+            file_path = rdir / safe_name
+            file_path.write_bytes(content)
+            uploaded.append({
+                "filename": safe_name,
+                "size":     len(content),
+                "url":      f"https://php-hosting.emalawi19.workers.dev/{user['username']}/{repo}/{safe_name}"
+            })
+
+        return {
+            "uploaded": uploaded,
+            "repo":     repo,
+            "repo_url": f"https://php-hosting.emalawi19.workers.dev/{user['username']}/{repo}"
+        }
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(500, str(e))
 
 # ── List repos and files ───────────────────────────────────────────────────────
 @app.get("/files")
 def list_files(user: dict = Depends(get_current_user)):
-    udir = user_dir(user["username"])
-    repos = []
-    for repo_path in sorted(udir.iterdir()):
-        if repo_path.is_dir():
-            files = []
-            for fp in sorted(repo_path.iterdir()):
-                if fp.is_file():
-                    files.append({
-                        "filename":  fp.name,
-                        "size":      fp.stat().st_size,
-                        "url":       f"https://php-hosting.emalawi.workers.dev/{user['username']}/{repo_path.name}/{fp.name}"
-                    })
-            repos.append({
-                "repo":     repo_path.name,
-                "repo_url": f"https://php-hosting.emalawi.workers.dev/{user['username']}/{repo_path.name}",
-                "files":    files
-            })
-    used = get_dir_size(udir)
-    return {
-        "username": user["username"],
-        "repos":    repos,
-        "used_mb":  round(used / (1024 * 1024), 2),
-        "limit_mb": 500
-    }
+    try:
+        udir = user_dir(user["username"])
+        repos = []
+        for repo_path in sorted(udir.iterdir()):
+            if repo_path.is_dir():
+                files = []
+                for fp in sorted(repo_path.iterdir()):
+                    if fp.is_file():
+                        files.append({
+                            "filename": fp.name,
+                            "size":     fp.stat().st_size,
+                            "url":      f"https://php-hosting.emalawi19.workers.dev/{user['username']}/{repo_path.name}/{fp.name}"
+                        })
+                repos.append({
+                    "repo":     repo_path.name,
+                    "repo_url": f"https://php-hosting.emalawi19.workers.dev/{user['username']}/{repo_path.name}",
+                    "files":    files
+                })
+        used = get_dir_size(udir)
+        return {
+            "username": user["username"],
+            "repos":    repos,
+            "used_mb":  round(used / (1024 * 1024), 2),
+            "limit_mb": 500
+        }
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(500, str(e))
 
 # ── Delete file ────────────────────────────────────────────────────────────────
 @app.delete("/files/{repo}/{filename}")
 def delete_file(repo: str, filename: str, user: dict = Depends(get_current_user)):
-    fp = USERS_DIR / user["username"] / repo / filename
-    if not fp.exists():
-        raise HTTPException(404, "File not found")
-    fp.unlink()
-    return {"message": f"{filename} deleted"}
+    try:
+        fp = USERS_DIR / user["username"] / repo / filename
+        if not fp.exists():
+            raise HTTPException(404, "File not found")
+        fp.unlink()
+        return {"message": f"{filename} deleted"}
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(500, str(e))
 
 # ── Delete repo ────────────────────────────────────────────────────────────────
 @app.delete("/repo/{repo}")
 def delete_repo(repo: str, user: dict = Depends(get_current_user)):
-    rdir = USERS_DIR / user["username"] / repo
-    if not rdir.exists():
-        raise HTTPException(404, "Repo not found")
-    shutil.rmtree(rdir)
-    return {"message": f"Repo {repo} deleted"}
-
-# ── Serve PHP / static files (called by Cloudflare Worker) ────────────────────
+    try:
+        rdir = USERS_DIR / user["username"] / repo
+        if not rdir.exists():
+            raise HTTPException(404, "Repo not found")
+        shutil.rmtree(rdir)
+        return {"message": f"Repo {repo} deleted"}
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(500, str(e))
+
+# ── Serve PHP / static files ───────────────────────────────────────────────────
 @app.get("/serve/{username}/{repo}/{filename:path}")
 def serve_file(username: str, repo: str, filename: str):
-    file_path = USERS_DIR / username / repo / filename
-    if not file_path.exists():
-        raise HTTPException(404, "File not found")
-
-    content = file_path.read_bytes()
-
-    if filename.endswith(".php"):
-        with tempfile.NamedTemporaryFile(suffix=".php", delete=False) as tmp:
-            tmp.write(content)
-            tmp_path = tmp.name
-        try:
-            result = subprocess.run(
-                ["php", tmp_path],
-                capture_output=True, text=True, timeout=30
-            )
-            output = result.stdout
-            if result.returncode != 0:
-                output = f"<pre style='color:red'>PHP Error:\n{result.stderr}</pre>"
-        except subprocess.TimeoutExpired:
-            output = "<pre style='color:red'>Error: Script timed out (30s limit)</pre>"
-        finally:
-            os.unlink(tmp_path)
-        return HTMLResponse(content=output)
-
-    # Serve static files
-    ext = filename.split(".")[-1].lower()
-    mime_map = {
-        "html": "text/html", "css": "text/css",
-        "js":   "application/javascript", "json": "application/json",
-        "png":  "image/png", "jpg": "image/jpeg",
-        "gif":  "image/gif", "svg": "image/svg+xml",
-        "txt":  "text/plain"
-    }
-    mime = mime_map.get(ext, "application/octet-stream")
-    from fastapi.responses import Response
-    return Response(content=content, media_type=mime)
-
-# ── Storage stats (admin) ──────────────────────────────────────────────────────
+    try:
+        file_path = USERS_DIR / username / repo / filename
+        if not file_path.exists():
+            raise HTTPException(404, "File not found")
+
+        content = file_path.read_bytes()
+
+        if filename.endswith(".php"):
+            with tempfile.NamedTemporaryFile(
+                suffix=".php", delete=False, dir="/tmp"
+            ) as tmp:
+                tmp.write(content)
+                tmp_path = tmp.name
+            try:
+                result = subprocess.run(
+                    ["php", tmp_path],
+                    capture_output=True,
+                    text=True,
+                    timeout=30
+                )
+                output = result.stdout
+                if result.returncode != 0:
+                    output = f"<pre style='color:red;font-family:monospace;padding:20px'>PHP Error:\n{result.stderr}</pre>"
+            except subprocess.TimeoutExpired:
+                output = "<pre style='color:red'>Error: Script timed out (30s limit)</pre>"
+            except FileNotFoundError:
+                output = "<pre style='color:red'>Error: PHP not installed on server</pre>"
+            finally:
+                try:
+                    os.unlink(tmp_path)
+                except:
+                    pass
+            return HTMLResponse(content=output)
+
+        ext = filename.split(".")[-1].lower()
+        mime_map = {
+            "html": "text/html",
+            "css":  "text/css",
+            "js":   "application/javascript",
+            "json": "application/json",
+            "png":  "image/png",
+            "jpg":  "image/jpeg",
+            "jpeg": "image/jpeg",
+            "gif":  "image/gif",
+            "svg":  "image/svg+xml",
+            "txt":  "text/plain",
+            "ico":  "image/x-icon",
+        }
+        mime = mime_map.get(ext, "application/octet-stream")
+        return Response(content=content, media_type=mime)
+
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(500, str(e))
+
+# ── Storage stats ──────────────────────────────────────────────────────────────
 @app.get("/storage")
 def storage_stats(user: dict = Depends(get_current_user)):
-    udir = user_dir(user["username"])
-    user_used = get_dir_size(udir)
-    total_used = get_total_storage()
-    return {
-        "user_used_mb":   round(user_used / (1024 * 1024), 2),
-        "user_limit_mb":  500,
-        "total_used_gb":  round(total_used / (1024 ** 3), 3),
-        "total_limit_gb": 15,
-        "percent_used":   round((user_used / MAX_USER_BYTES) * 100, 2)
-    }
+    try:
+        udir = user_dir(user["username"])
+        user_used  = get_dir_size(udir)
+        total_used = get_total_storage()
+        return {
+            "user_used_mb":    round(user_used / (1024 * 1024), 2),
+            "user_limit_mb":   500,
+            "total_used_gb":   round(total_used / (1024 ** 3), 3),
+            "total_limit_gb":  15,
+            "percent_used":    round((user_used / MAX_USER_BYTES) * 100, 2)
+        }
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(500, str(e))