feat: add secure module marketplace runtime (#745)

app/Http/Controllers/Admin/Modules/MarketplacePairingController.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace App\Http\Controllers\Admin\Modules;
+
+use App\Http\Controllers\Controller;
+use App\Models\MarketplaceCredential;
+use App\Services\Marketplace\MarketplaceClient;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Crypt;
+
+class MarketplacePairingController extends Controller
+{
+    public function __construct(private MarketplaceClient $client) {}
+
+    public function start(): JsonResponse
+    {
+        $this->authorize('manage modules');
+        $response = $this->client->beginPairing();
+        $data = $response->json();
+        if (! $response->successful() || ! is_array($data) || ! is_string($data['device_code'] ?? null)) {
+            return response()->json(['error' => 'marketplace_unavailable'], 503);
+        }
+
+        $ttl = max(60, (int) ($data['expires_in'] ?? 600));
+        Cache::put($this->cacheKey(), $data['device_code'], now()->addSeconds($ttl));
+
+        return response()->json([
+            'device_code' => $data['device_code'],
+            'user_code' => $data['user_code'] ?? null,
+            'verification_uri' => $data['verification_uri'] ?? $data['verification_uri_complete'] ?? null,
+            'verification_uri_complete' => $data['verification_uri_complete'] ?? null,
+            'expires_in' => $ttl,
+            'interval' => max(1, (int) ($data['interval'] ?? 5)),
+        ], 201);
+    }
+
+    public function poll(): JsonResponse
+    {
+        $this->authorize('manage modules');
+        $deviceCode = Cache::get($this->cacheKey());
+        if (! is_string($deviceCode)) {
+            return response()->json(['error' => 'pairing_expired'], 422);
+        }
+
+        $response = $this->client->pollPairing($deviceCode);
+        $data = $response->json();
+        if ($response->status() === 428 || ($data['error'] ?? null) === 'authorization_pending') {
+            return response()->json(['status' => 'pending']);
+        }
+        if (! $response->successful() || ! is_array($data) || ! is_string($data['installation_token'] ?? null)) {
+            return response()->json(['error' => 'pairing_failed'], 422);
+        }
+
+        MarketplaceCredential::query()->delete();
+        MarketplaceCredential::query()->create([
+            'credential' => Crypt::encryptString($data['installation_token']),
+            'device_id' => is_scalar($data['installation']['id'] ?? null) ? (string) $data['installation']['id'] : null,
+            'paired_at' => now(),
+        ]);
+        Cache::forget($this->cacheKey());
+
+        return response()->json(['status' => 'paired']);
+    }
+
+    public function status(): JsonResponse
+    {
+        $this->authorize('manage modules');
+        $credential = MarketplaceCredential::query()->latest('id')->first();
+
+        return response()->json([
+            'paired' => $credential !== null,
+            'expired' => $credential?->expires_at?->isPast() ?? false,
+            'paired_at' => $credential?->paired_at?->toIso8601String(),
+        ]);
+    }
+
+    public function disconnect(): JsonResponse
+    {
+        $this->authorize('manage modules');
+        if (MarketplaceCredential::query()->exists()) {
+            // Revocation releases any entitlement activation tied to this
+            // installation. Local disconnect still succeeds if the control
+            // plane is temporarily unavailable.
+            $this->client->revokeInstallation();
+        }
+        MarketplaceCredential::query()->delete();
+        Cache::forget($this->cacheKey());
+
+        return response()->json(['success' => true]);
+    }
+
+    private function cacheKey(): string
+    {
+        return 'marketplace.device-pairing';
+    }
+}

app/Http/Controllers/Admin/Modules/ModuleInstallationController.php

@@ -3,67 +3,22 @@
 namespace App\Http\Controllers\Admin\Modules;
 
 use App\Http\Controllers\Controller;
-use App\Http\Requests\UnzipUpdateRequest;
-use App\Http\Requests\UploadModuleRequest;
-use App\Support\Module\ModuleInstaller;
+use App\Http\Requests\InstallMarketplaceModuleRequest;
+use App\Services\Marketplace\MarketplaceInstaller;
 use Illuminate\Http\JsonResponse;
-use Illuminate\Http\Request;
 
 class ModuleInstallationController extends Controller
 {
-    public function download(Request $request): JsonResponse
+    public function install(InstallMarketplaceModuleRequest $request, MarketplaceInstaller $installer): JsonResponse
     {
         $this->authorize('manage modules');
 
-        $response = ModuleInstaller::download(
-            (string) $request->slug,
-            (string) $request->version,
-            $request->checksum_sha256 ? (string) $request->checksum_sha256 : null,
+        $response = $installer->install(
+            $request->string('slug')->toString(),
+            $request->string('version')->toString(),
+            $request->string('channel')->toString() ?: (string) config('invoiceshelf.marketplace.channel', 'stable'),
         );
 
-        return response()->json($response);
-    }
-
-    public function upload(UploadModuleRequest $request): JsonResponse
-    {
-        $this->authorize('manage modules');
-
-        $response = ModuleInstaller::upload($request);
-
-        return response()->json($response);
-    }
-
-    public function unzip(UnzipUpdateRequest $request): JsonResponse
-    {
-        $this->authorize('manage modules');
-
-        $path = ModuleInstaller::unzip($request->module_name ?? $request->module, $request->path);
-
-        return response()->json([
-            'success' => true,
-            'path' => $path,
-        ]);
-    }
-
-    public function copy(Request $request): JsonResponse
-    {
-        $this->authorize('manage modules');
-
-        $response = ModuleInstaller::copyFiles($request->module_name ?? $request->module, $request->path);
-
-        return response()->json([
-            'success' => $response,
-        ]);
-    }
-
-    public function complete(Request $request): JsonResponse
-    {
-        $this->authorize('manage modules');
-
-        $response = ModuleInstaller::complete($request->module_name ?? $request->module, $request->version);
-
-        return response()->json([
-            'success' => $response,
-        ]);
+        return response()->json($response, $response['success'] ? 200 : 422);
     }
 }

app/Http/Controllers/Admin/Modules/ModulesController.php

@@ -7,55 +7,51 @@ use App\Events\ModuleEnabledEvent;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\ModuleResource;
 use App\Models\Module as ModelsModule;
-use App\Support\Module\ModuleInstaller;
+use App\Services\Marketplace\MarketplaceClient;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Nwidart\Modules\Facades\Module;
 
 class ModulesController extends Controller
 {
-    public function index(Request $request)
+    public function index(MarketplaceClient $client)
     {
         $this->authorize('manage modules');
 
-        $response = ModuleInstaller::getModules();
+        $response = $client->catalog();
+        $body = $response->json();
+        $modules = is_array($body) ? ($body['modules'] ?? $body['data'] ?? null) : null;
 
-        if (($response['status'] ?? 0) !== 200 || ! isset($response['body']->modules)) {
+        if (! $response->successful() || ! is_array($modules)) {
             return response()->json(['error' => 'marketplace_unavailable'], 503);
         }
 
-        return ModuleResource::collection(collect($response['body']->modules));
+        return ModuleResource::collection(collect($modules));
     }
 
-    public function show(Request $request, string $module)
+    public function show(string $module, MarketplaceClient $client)
     {
         $this->authorize('manage modules');
 
-        $response = ModuleInstaller::getModule($module);
+        $response = $client->module($module);
+        $body = $response->json();
 
-        if (($response['status'] ?? 0) === 404) {
+        if ($response->status() === 404) {
             return response()->json(['error' => 'not_found'], 404);
         }
 
-        if (($response['status'] ?? 0) !== 200 || ! isset($response['body']->data)) {
+        if (! $response->successful() || ! is_array($body) || ! is_array($body['module'] ?? null)) {
             return response()->json(['error' => 'marketplace_unavailable'], 503);
         }
 
-        return (new ModuleResource($response['body']->data))
+        return (new ModuleResource($body['module']))
             ->additional(['meta' => [
                 'modules' => ModuleResource::collection(
-                    collect($response['body']->meta->modules ?? [])
+                    collect($body['meta']['modules'] ?? [])
                 ),
             ]]);
     }
 
-    public function checkToken(Request $request): JsonResponse
-    {
-        $this->authorize('manage modules');
-
-        return ModuleInstaller::checkToken($request->api_token);
-    }
-
     public function enable(Request $request, string $module): JsonResponse
     {
         $this->authorize('manage modules');