Initial release v1.0.0

Open-source marketplace for AI Agent skills. Features: - Next.js 15 web app with i18n (en/fa) - CLI tool for skill installation (npx skillhub) - GitHub crawler/indexer with multi-strategy discovery - Security scanning for all indexed skills - Self-hostable with Docker Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-12 06:08:51 +03:30
commit 97b427831a
227 changed files with 48411 additions and 0 deletions
--- a/apps/web/app/api/ratings/me/route.ts
+++ b/apps/web/app/api/ratings/me/route.ts
@@ -0,0 +1,43 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { createDb, ratingQueries, userQueries } from '@skillhub/db';
+import { auth } from '@/lib/auth';
+import { withRateLimit, createRateLimitResponse, createRateLimitHeaders } from '@/lib/rate-limit';
+
+const db = createDb();
+
+export async function GET(request: NextRequest) {
+  // Rate limiting (authenticated)
+  const rateLimitResult = await withRateLimit(request, 'authenticated');
+  if (!rateLimitResult.allowed) {
+    return createRateLimitResponse(rateLimitResult);
+  }
+
+  try {
+    const session = await auth();
+    if (!session?.user?.githubId) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { searchParams } = new URL(request.url);
+    const skillId = searchParams.get('skillId');
+
+    if (!skillId) {
+      return NextResponse.json({ error: 'skillId is required' }, { status: 400 });
+    }
+
+    const dbUser = await userQueries.getByGithubId(db, session.user.githubId);
+    if (!dbUser) {
+      return NextResponse.json({ rating: null }, {
+        headers: createRateLimitHeaders(rateLimitResult),
+      });
+    }
+
+    const rating = await ratingQueries.getUserRating(db, dbUser.id, skillId);
+    return NextResponse.json({ rating }, {
+      headers: createRateLimitHeaders(rateLimitResult),
+    });
+  } catch (error) {
+    console.error('Error fetching user rating:', error);
+    return NextResponse.json({ error: 'Failed to fetch rating' }, { status: 500 });
+  }
+}
--- a/apps/web/app/api/ratings/route.test.ts
+++ b/apps/web/app/api/ratings/route.test.ts
@@ -0,0 +1,281 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { NextRequest } from 'next/server';
+
+// Helper to create mock skill
+function createMockSkill(overrides: Partial<{
+  id: string;
+  rating: number;
+  ratingCount: number;
+}> = {}) {
+  return {
+    id: 'test-owner/test-repo/test-skill',
+    name: 'test-skill',
+    rating: 4,
+    ratingCount: 10,
+    ...overrides,
+  };
+}
+
+// Helper to create mock user
+function createMockUser(overrides: Partial<{ id: string; githubId: string; username: string }> = {}) {
+  return {
+    id: 'user-123',
+    githubId: 'gh-12345',
+    username: 'testuser',
+    avatarUrl: 'https://example.com/avatar.png',
+    ...overrides,
+  };
+}
+
+// Helper to create mock rating
+function createMockRating(overrides: Partial<{
+  id: string;
+  rating: number;
+  review: string;
+}> = {}) {
+  return {
+    id: 'rating-1',
+    skillId: 'test-owner/test-repo/test-skill',
+    userId: 'user-123',
+    rating: 4,
+    review: 'Great skill!',
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    ...overrides,
+  };
+}
+
+// Mock auth
+const mockAuth = vi.fn();
+vi.mock('@/lib/auth', () => ({
+  auth: () => mockAuth(),
+}));
+
+// Mock db
+vi.mock('@skillhub/db', () => ({
+  createDb: vi.fn(() => ({})),
+  userQueries: {
+    getByGithubId: vi.fn(),
+  },
+  skillQueries: {
+    getById: vi.fn(),
+  },
+  ratingQueries: {
+    getForSkill: vi.fn(),
+    upsert: vi.fn(),
+  },
+}));
+
+import { GET, POST } from './route';
+import { userQueries, skillQueries, ratingQueries } from '@skillhub/db';
+
+describe('/api/ratings', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('GET', () => {
+    const createRequest = (searchParams: Record<string, string> = {}) => {
+      const url = new URL('http://localhost:3000/api/ratings');
+      Object.entries(searchParams).forEach(([key, value]) => {
+        url.searchParams.set(key, value);
+      });
+      return new NextRequest(url);
+    };
+
+    it('should return 400 when skillId missing', async () => {
+      const request = createRequest();
+      const response = await GET(request);
+      const data = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(data.error).toContain('skillId');
+    });
+
+    it('should return ratings for skill', async () => {
+      const mockSkill = createMockSkill();
+      const mockRatings = [
+        {
+          rating: createMockRating({ id: 'rating-1' }),
+          user: createMockUser(),
+        },
+      ];
+
+      vi.mocked(skillQueries.getById).mockResolvedValue(mockSkill as any);
+      vi.mocked(ratingQueries.getForSkill).mockResolvedValue(mockRatings as any);
+
+      const request = createRequest({ skillId: 'test-owner/test-repo/test-skill' });
+      const response = await GET(request);
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.ratings).toBeDefined();
+      expect(Array.isArray(data.ratings)).toBe(true);
+    });
+
+    it('should include user info', async () => {
+      const mockSkill = createMockSkill();
+      const mockRatings = [
+        {
+          rating: createMockRating(),
+          user: createMockUser({ username: 'testuser' }),
+        },
+      ];
+
+      vi.mocked(skillQueries.getById).mockResolvedValue(mockSkill as any);
+      vi.mocked(ratingQueries.getForSkill).mockResolvedValue(mockRatings as any);
+
+      const request = createRequest({ skillId: 'test-owner/test-repo/test-skill' });
+      const response = await GET(request);
+      const data = await response.json();
+
+      expect(data.ratings[0].user).toBeDefined();
+      expect(data.ratings[0].user.username).toBe('testuser');
+    });
+
+    it('should include rating summary', async () => {
+      const mockSkill = createMockSkill({ rating: 4, ratingCount: 10 });
+      vi.mocked(skillQueries.getById).mockResolvedValue(mockSkill as any);
+      vi.mocked(ratingQueries.getForSkill).mockResolvedValue([]);
+
+      const request = createRequest({ skillId: 'test-owner/test-repo/test-skill' });
+      const response = await GET(request);
+      const data = await response.json();
+
+      expect(data.summary).toBeDefined();
+      expect(data.summary.average).toBe(4);
+      expect(data.summary.count).toBe(10);
+    });
+
+    it('should respect pagination', async () => {
+      const mockSkill = createMockSkill();
+      vi.mocked(skillQueries.getById).mockResolvedValue(mockSkill as any);
+      vi.mocked(ratingQueries.getForSkill).mockResolvedValue([]);
+
+      const request = createRequest({
+        skillId: 'test-owner/test-repo/test-skill',
+        limit: '5',
+        offset: '10',
+      });
+      const response = await GET(request);
+
+      expect(response.status).toBe(200);
+      expect(ratingQueries.getForSkill).toHaveBeenCalledWith(
+        expect.anything(),
+        'test-owner/test-repo/test-skill',
+        5,
+        10
+      );
+    });
+  });
+
+  describe('POST', () => {
+    const createRequest = (body: unknown) => {
+      return new NextRequest('http://localhost:3000/api/ratings', {
+        method: 'POST',
+        body: JSON.stringify(body),
+        headers: { 'Content-Type': 'application/json' },
+      });
+    };
+
+    it('should return 401 when not authenticated', async () => {
+      mockAuth.mockResolvedValue(null);
+
+      const request = createRequest({ skillId: 'test-skill', rating: 5 });
+      const response = await POST(request);
+      const data = await response.json();
+
+      expect(response.status).toBe(401);
+      expect(data.error).toBe('Unauthorized');
+    });
+
+    it('should return 400 when skillId missing', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345' } });
+
+      const request = createRequest({ rating: 5 });
+      const response = await POST(request);
+      const data = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(data.error).toContain('skillId');
+    });
+
+    it('should return 400 when rating invalid', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345' } });
+
+      const request = createRequest({ skillId: 'test-skill', rating: 6 });
+      const response = await POST(request);
+      const data = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(data.error).toContain('between 1 and 5');
+    });
+
+    it('should return 400 when rating is zero', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345' } });
+
+      const request = createRequest({ skillId: 'test-skill', rating: 0 });
+      const response = await POST(request);
+      await response.json();
+
+      expect(response.status).toBe(400);
+    });
+
+    it('should return 404 when skill not found', async () => {
+      const mockUser = createMockUser();
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345' } });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(skillQueries.getById).mockResolvedValue(null as any);
+
+      const request = createRequest({ skillId: 'nonexistent', rating: 5 });
+      const response = await POST(request);
+      await response.json();
+
+      expect(response.status).toBe(404);
+    });
+
+    it('should create rating successfully', async () => {
+      const mockUser = createMockUser();
+      const mockSkill = createMockSkill();
+      const mockRating = createMockRating({ rating: 5 });
+
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345' } });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(skillQueries.getById).mockResolvedValue(mockSkill as any);
+      vi.mocked(ratingQueries.upsert).mockResolvedValue(mockRating as any);
+
+      const request = createRequest({
+        skillId: 'test-owner/test-repo/test-skill',
+        rating: 5,
+        review: 'Excellent!',
+      });
+      const response = await POST(request);
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.rating).toBeDefined();
+      expect(data.summary).toBeDefined();
+    });
+
+    it('should update existing rating', async () => {
+      const mockUser = createMockUser();
+      const mockSkill = createMockSkill({ rating: 4, ratingCount: 1 });
+      const mockRating = createMockRating({ rating: 4 });
+
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345' } });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(skillQueries.getById).mockResolvedValue(mockSkill as any);
+      vi.mocked(ratingQueries.upsert).mockResolvedValue(mockRating as any);
+
+      const request = createRequest({
+        skillId: 'test-owner/test-repo/test-skill',
+        rating: 4,
+      });
+      const response = await POST(request);
+      await response.json();
+
+      expect(response.status).toBe(200);
+      expect(ratingQueries.upsert).toHaveBeenCalled();
+    });
+  });
+});
--- a/apps/web/app/api/ratings/route.ts
+++ b/apps/web/app/api/ratings/route.ts
@@ -0,0 +1,122 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { createDb, ratingQueries, skillQueries, userQueries } from '@skillhub/db';
+import { auth } from '@/lib/auth';
+import { withRateLimit, createRateLimitResponse, createRateLimitHeaders } from '@/lib/rate-limit';
+import { sanitizeReview } from '@/lib/sanitize';
+
+const db = createDb();
+
+export async function GET(request: NextRequest) {
+  // Rate limiting
+  const rateLimitResult = await withRateLimit(request, 'anonymous');
+  if (!rateLimitResult.allowed) {
+    return createRateLimitResponse(rateLimitResult);
+  }
+
+  try {
+    const { searchParams } = new URL(request.url);
+    const skillId = searchParams.get('skillId');
+
+    // Parse and validate pagination parameters
+    const limitRaw = parseInt(searchParams.get('limit') || '10');
+    const limit = isNaN(limitRaw) || limitRaw < 1 ? 10 : Math.min(limitRaw, 100);
+
+    const offsetRaw = parseInt(searchParams.get('offset') || '0');
+    const offset = isNaN(offsetRaw) || offsetRaw < 0 ? 0 : offsetRaw;
+
+    if (!skillId) {
+      return NextResponse.json({ error: 'skillId is required' }, { status: 400 });
+    }
+
+    const ratings = await ratingQueries.getForSkill(db, skillId, limit, offset);
+    const skill = await skillQueries.getById(db, skillId);
+
+    return NextResponse.json({
+      ratings: ratings.map((r) => ({
+        id: r.rating.id,
+        rating: r.rating.rating,
+        review: r.rating.review,
+        createdAt: r.rating.createdAt,
+        updatedAt: r.rating.updatedAt,
+        user: {
+          id: r.user.id,
+          username: r.user.username,
+          avatarUrl: r.user.avatarUrl,
+        },
+      })),
+      summary: {
+        average: skill?.rating || 0,
+        count: skill?.ratingCount || 0,
+      },
+    }, {
+      headers: createRateLimitHeaders(rateLimitResult),
+    });
+  } catch (error) {
+    console.error('Error fetching ratings:', error);
+    return NextResponse.json({ error: 'Failed to fetch ratings' }, { status: 500 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  // Rate limiting (authenticated tier for POST)
+  const rateLimitResult = await withRateLimit(request, 'authenticated');
+  if (!rateLimitResult.allowed) {
+    return createRateLimitResponse(rateLimitResult);
+  }
+
+  try {
+    const session = await auth();
+    if (!session?.user?.githubId) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const body = await request.json();
+    const { skillId, rating, review } = body;
+
+    if (!skillId) {
+      return NextResponse.json({ error: 'skillId is required' }, { status: 400 });
+    }
+
+    // Validate rating
+    const ratingValue = parseInt(rating);
+    if (isNaN(ratingValue) || ratingValue < 1 || ratingValue > 5) {
+      return NextResponse.json({ error: 'Rating must be between 1 and 5' }, { status: 400 });
+    }
+
+    // Get database user ID
+    const dbUser = await userQueries.getByGithubId(db, session.user.githubId);
+    if (!dbUser) {
+      return NextResponse.json({ error: 'User not found' }, { status: 404 });
+    }
+
+    // Verify skill exists
+    const skill = await skillQueries.getById(db, skillId);
+    if (!skill) {
+      return NextResponse.json({ error: 'Skill not found' }, { status: 404 });
+    }
+
+    // Upsert rating with sanitized review
+    const result = await ratingQueries.upsert(db, {
+      skillId,
+      userId: dbUser.id,
+      rating: ratingValue,
+      review: sanitizeReview(review) ?? undefined,
+    });
+
+    // Get updated skill aggregates
+    const updatedSkill = await skillQueries.getById(db, skillId);
+
+    return NextResponse.json({
+      rating: result,
+      summary: {
+        average: updatedSkill?.rating || 0,
+        count: updatedSkill?.ratingCount || 0,
+      },
+    }, {
+      headers: createRateLimitHeaders(rateLimitResult),
+    });
+  } catch (error) {
+    console.error('Error creating rating:', error);
+    return NextResponse.json({ error: 'Failed to create rating' }, { status: 500 });
+  }
+}