feat: two-way sync between support tickets and Gitea issues (v0.63.0)

Outbound (already existed one-way: ticket create -> Gitea issue) now
also mirrors status changes: closing/reopening a ticket in the admin
UI closes/reopens the linked Gitea issue, and replies posted from
Epicure (by the ticket owner or an admin) post as a comment on the
issue. Captures and stores the Gitea issue number at creation time
to address these follow-up calls without re-parsing the issue URL.

Inbound: new webhook receiver at /api/webhooks/gitea, verified via
HMAC-SHA256 signature (X-Gitea-Signature) with a configurable
GITEA_WEBHOOK_SECRET site setting, deduped by delivery id the same
way the existing Stripe receiver dedupes events. Handles "issues"
(closed/reopened -> ticket status) and "issue_comment" (created ->
appends to the ticket's comment thread), skipping comments Epicura
already posted itself (matched by Gitea comment id) to avoid loops.

New support_ticket_comments table backs a lightweight conversation
thread on both the user-facing support page and the admin support
manager, each comment tagged by author (user/admin/gitea).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/support/[id]/comments/route.ts

@@ -0,0 +1,67 @@
+import { NextRequest, NextResponse } from "next/server";
+import crypto from "node:crypto";
+import { z } from "zod";
+import { db, supportTickets, supportTicketComments, eq, asc } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+import { postGiteaComment } from "@/lib/gitea";
+
+const CreateCommentBody = z.object({
+  body: z.string().trim().min(1).max(3000),
+});
+
+export async function GET(_req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const { id } = await params;
+  const ticket = await db.query.supportTickets.findFirst({ where: eq(supportTickets.id, id) });
+  if (!ticket || ticket.userId !== session!.user.id) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  const comments = await db.query.supportTicketComments.findMany({
+    where: eq(supportTicketComments.ticketId, id),
+    orderBy: asc(supportTicketComments.createdAt),
+  });
+
+  return NextResponse.json(comments);
+}
+
+export async function POST(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const { id } = await params;
+  const ticket = await db.query.supportTickets.findFirst({ where: eq(supportTickets.id, id) });
+  if (!ticket || ticket.userId !== session!.user.id) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  const parsed = CreateCommentBody.safeParse(await req.json());
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
+  }
+
+  let giteaCommentId: number | null = null;
+  if (ticket.giteaIssueNumber) {
+    const { id: commentId } = await postGiteaComment(ticket.giteaIssueNumber, parsed.data.body);
+    giteaCommentId = commentId;
+  }
+
+  const commentId = crypto.randomUUID();
+  const now = new Date();
+  await db.insert(supportTicketComments).values({
+    id: commentId,
+    ticketId: id,
+    authorType: "user",
+    authorId: session!.user.id,
+    body: parsed.data.body,
+    giteaCommentId,
+    createdAt: now,
+  });
+
+  return NextResponse.json(
+    { id: commentId, ticketId: id, authorType: "user", authorId: session!.user.id, body: parsed.data.body, createdAt: now.toISOString() },
+    { status: 201 }
+  );
+}

apps/web/app/api/v1/support/route.ts

@@ -66,7 +66,7 @@ export async function POST(req: NextRequest) {
   const id = crypto.randomUUID();
   const now = new Date();
 
-  const { url: giteaIssueUrl, error: giteaError } = await createGiteaIssue({
+  const { url: giteaIssueUrl, number: giteaIssueNumber, error: giteaError } = await createGiteaIssue({
     type,
     title,
     body: buildGiteaIssueBody({ description, userId: session!.user.id, attachments }),
@@ -80,6 +80,7 @@ export async function POST(req: NextRequest) {
     description,
     status: "open",
     giteaIssueUrl,
+    giteaIssueNumber,
     giteaError,
     createdAt: now,
     updatedAt: now,