Release v1.0: Final Merge of Development Branch into Main

.dockerignore

@@ -0,0 +1,11 @@
+node_modules
+.git
+.gitignore
+.env
+.env.*
+*.log
+npm-debug.log*
+dist
+coverage
+.nyc_output
+tests

.eslintrc.js

@@ -1,5 +1,5 @@
 module.exports = {
-  env: { node: true, es2021: true },
+  env: { node: true, es2021: true, jest: true },
   extends: ['eslint:recommended'],
   parserOptions: { ecmaVersion: 'latest', sourceType: 'commonjs' },
   rules: {

.gitattributes

@@ -0,0 +1,2 @@
+* text=auto eol=lf
+*.js text eol=lf

.github/workflows/backend-cd-dev.yml

@@ -0,0 +1,125 @@
+name: Backend — Dev CD Pipeline
+
+on:
+  push:
+    branches:
+      - development
+
+jobs:
+  deploy-dev:
+    name: Build, Push & Deploy (Development)
+    runs-on: ubuntu-latest
+    environment: development
+
+    steps:
+      - name: Checkout backend repo
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install PostgreSQL client
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y postgresql-client
+
+      - name: Log in to Azure
+        uses: azure/login@v1
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: Log in to Azure Container Registry
+        run: |
+          echo ${{ secrets.ACR_PASSWORD }} | docker login ${{ secrets.ACR_LOGIN_SERVER }} \
+            --username ${{ secrets.ACR_USERNAME }} \
+            --password-stdin
+
+      - name: Build and push Docker image
+        run: |
+          docker build -t ${{ secrets.ACR_LOGIN_SERVER }}/backend:dev .
+          docker tag ${{ secrets.ACR_LOGIN_SERVER }}/backend:dev ${{ secrets.ACR_LOGIN_SERVER }}/backend:dev-${{ github.sha }}
+          docker push ${{ secrets.ACR_LOGIN_SERVER }}/backend:dev
+          docker push ${{ secrets.ACR_LOGIN_SERVER }}/backend:dev-${{ github.sha }}
+
+      - name: Run migrations against Azure PostgreSQL (dev)
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+        run: npm run migrate:up
+
+      - name: Register ACR credentials with Container App
+        run: |
+          az containerapp registry set \
+            --name ${{ secrets.CONTAINER_APP_NAME }} \
+            --resource-group ${{ secrets.AZURE_RESOURCE_GROUP }} \
+            --server ${{ secrets.ACR_LOGIN_SERVER }} \
+            --username ${{ secrets.ACR_USERNAME }} \
+            --password ${{ secrets.ACR_PASSWORD }}
+
+      - name: Set Container App environment variables
+        run: |
+          az containerapp update \
+            --name ${{ secrets.CONTAINER_APP_NAME }} \
+            --resource-group ${{ secrets.AZURE_RESOURCE_GROUP }} \
+            --set-env-vars \
+              NODE_ENV=development \
+              PORT=8080 \
+              BLOB_CONTAINER_AUDIO=audio \
+              BLOB_CONTAINER_MEDIA=media \
+              JWT_ACCESS_EXPIRES_IN=15m \
+              JWT_REFRESH_EXPIRES_IN=7d \
+              "EMAIL_FROM=Rythmify <rythmify.noreply@gmail.com>" \
+              BASE_URL=https://${{ secrets.CONTAINER_APP_URL }} \
+              CLIENT_URL=https://gray-grass-0ab138600.7.azurestaticapps.net \
+              APP_URL=https://gray-grass-0ab138600.7.azurestaticapps.net \
+              GOOGLE_CALLBACK_URL=https://gray-grass-0ab138600.7.azurestaticapps.net/api/v1/auth/google/callback \
+              JWT_SECRET=secretref:jwt-secret \
+              AZURE_STORAGE_CONNECTION_STRING=secretref:storage-connection-string \
+              DATABASE_URL=secretref:database-url \
+              GOOGLE_CLIENT_ID=secretref:google-client-id \
+              GOOGLE_CLIENT_SECRET=secretref:google-client-secret \
+              GMAIL_USER=secretref:gmail-user \
+              GMAIL_APP_PASSWORD=secretref:gmail-app-password \
+              RECAPTCHA_SECRET=secretref:recaptcha-secret \
+              GITHUB_CLIENT_ID=secretref:oauth-github-client-id \
+              GITHUB_CLIENT_SECRET=secretref:oauth-github-client-secret \
+              GITHUB_REDIRECT_URI=https://rythmify-backend-dev.livelypebble-6b7965ef.uaenorth.azurecontainerapps.io/api/v1/auth/oauth/github/callback
+
+      - name: Update Container App with new image
+        run: |
+          az containerapp update \
+            --name ${{ secrets.CONTAINER_APP_NAME }} \
+            --resource-group ${{ secrets.AZURE_RESOURCE_GROUP }} \
+            --image ${{ secrets.ACR_LOGIN_SERVER }}/backend:dev-${{ github.sha }}
+
+      - name: Wait for deployment to stabilize
+        run: sleep 30
+
+      - name: Smoke check dev deployment
+        run: |
+          DEV_URL=$(az containerapp show \
+            --name ${{ secrets.CONTAINER_APP_NAME }} \
+            --resource-group ${{ secrets.AZURE_RESOURCE_GROUP }} \
+            --query "properties.configuration.ingress.fqdn" \
+            --output tsv)
+          echo "Dev URL: https://$DEV_URL"
+          for i in $(seq 1 15); do
+            response=$(curl -sf "https://$DEV_URL/health") && echo "Health OK: $response" && break
+            echo "Attempt $i — not ready, waiting 10s..."
+            sleep 10
+          done
+          curl -sf "https://$DEV_URL/health" | grep -q '"status":"ok"' || { echo "Dev smoke check failed."; exit 1; }
+          echo "Dev deployment smoke check passed."
+
+      - name: Collect deployment logs on failure
+        if: failure()
+        run: |
+          az containerapp logs show \
+            --name ${{ secrets.CONTAINER_APP_NAME }} \
+            --resource-group ${{ secrets.AZURE_RESOURCE_GROUP }} \
+            --tail 50 || true

.github/workflows/backend-cd-main.yml

@@ -0,0 +1,149 @@
+name: Backend CD — VM Deploy
+
+on:
+  push:
+    branches:
+      - development
+
+jobs:
+  deploy:
+    name: Build, Push & Deploy to VM1
+    runs-on: ubuntu-latest
+    environment: development
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to Azure Container Registry
+        run: |
+          docker login ${{ secrets.ACR_LOGIN_SERVER }} \
+            -u ${{ secrets.ACR_USERNAME }} \
+            -p ${{ secrets.ACR_PASSWORD }}
+
+      - name: Build and push Docker image
+        run: |
+          IMAGE=${{ secrets.ACR_LOGIN_SERVER }}/backend
+          SHA=${{ github.sha }}
+
+          docker build -t $IMAGE:main -t $IMAGE:main-${SHA::7} .
+          docker push $IMAGE:main
+          docker push $IMAGE:main-${SHA::7}
+
+      - name: Write SSH key to file
+        run: |
+          echo "${{ secrets.VM_SSH_KEY }}" > vm_key.pem
+          chmod 600 vm_key.pem
+
+      - name: Create deploy script
+        run: |
+          cat > deploy.sh << 'SCRIPT'
+          #!/bin/bash
+          set -e
+
+          docker login $ACR_LOGIN_SERVER \
+            -u $ACR_USERNAME \
+            -p $ACR_PASSWORD
+
+          docker pull $IMAGE
+
+          docker run --rm \
+            -e DATABASE_URL="$DATABASE_URL" \
+            $IMAGE \
+            npm run migrate:up
+
+          docker stop rythmify-backend || true
+          docker rm   rythmify-backend || true
+
+          docker run -d \
+            --name rythmify-backend \
+            --restart unless-stopped \
+            -p 8080:8080 \
+            -e NODE_ENV=production \
+            -e PORT=8080 \
+            -e DATABASE_URL="$DATABASE_URL" \
+            -e JWT_SECRET="$JWT_SECRET" \
+            -e AZURE_STORAGE_CONNECTION_STRING="$AZURE_STORAGE_CONNECTION_STRING" \
+            -e BLOB_CONTAINER_AUDIO=audio \
+            -e BLOB_CONTAINER_MEDIA=media \
+            -e JWT_ACCESS_EXPIRES_IN=15m \
+            -e JWT_REFRESH_EXPIRES_IN=7d \
+            -e GOOGLE_CLIENT_ID="$GOOGLE_CLIENT_ID" \
+            -e GOOGLE_CLIENT_SECRET="$GOOGLE_CLIENT_SECRET" \
+            -e GOOGLE_CALLBACK_URL="http://rythmify-back.duckdns.org/api/v1/auth/google/callback" \
+            -e GMAIL_USER="$GMAIL_USER" \
+            -e GMAIL_APP_PASSWORD="$GMAIL_APP_PASSWORD" \
+            -e RECAPTCHA_SECRET="$RECAPTCHA_SECRET" \
+            -e BASE_URL="http://rythmify-back.duckdns.org" \
+            -e CLIENT_URL="http://rythmify.duckdns.org" \
+            -e APP_URL="http://rythmify.duckdns.org" \
+            -e "EMAIL_FROM=Rythmify <rythmify.noreply@gmail.com>" \
+            -e GITHUB_CLIENT_ID="$OAUTH_GITHUB_CLIENT_ID" \
+            -e GITHUB_CLIENT_SECRET="$OAUTH_GITHUB_CLIENT_SECRET" \
+            -e GITHUB_REDIRECT_URI="http://rythmify-back.duckdns.org/api/v1/auth/oauth/github/callback" \
+            -e FCM_PROJECT_ID="$FCM_PROJECT_ID" \
+            -e FCM_CLIENT_EMAIL="$FCM_CLIENT_EMAIL" \
+            -e FCM_PRIVATE_KEY="$FCM_PRIVATE_KEY" \
+            -e REDIS_ENABLED=true \
+            -e REDIS_URL=redis://host.docker.internal:6379 \
+            $IMAGE
+
+          sleep 30
+
+          PASSED=false
+          for i in $(seq 1 10); do
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/health)
+            if [ "$STATUS" = "200" ]; then
+              echo "Smoke check passed — HTTP $STATUS"
+              PASSED=true
+              break
+            fi
+            echo "Attempt $i — not ready yet (HTTP $STATUS), waiting 10s..."
+            sleep 10
+          done
+
+          if [ "$PASSED" = "false" ]; then
+            echo "Smoke check FAILED after 10 attempts"
+            docker logs rythmify-backend --tail 50
+            exit 1
+          fi
+          SCRIPT
+
+      - name: Substitute variables into deploy script
+        run: |
+          export IMAGE ACR_LOGIN_SERVER ACR_USERNAME ACR_PASSWORD \
+                 DATABASE_URL JWT_SECRET AZURE_STORAGE_CONNECTION_STRING \
+                 GOOGLE_CLIENT_ID GOOGLE_CLIENT_SECRET GMAIL_USER \
+                 GMAIL_APP_PASSWORD RECAPTCHA_SECRET
+          envsubst < deploy.sh > deploy-final.sh
+        env:
+          IMAGE: ${{ secrets.ACR_LOGIN_SERVER }}/backend:main
+          ACR_LOGIN_SERVER: ${{ secrets.ACR_LOGIN_SERVER }}
+          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+          DATABASE_URL: ${{ secrets.DATABASE_URL_PROD }}
+          JWT_SECRET: ${{ secrets.JWT_SECRET }}
+          AZURE_STORAGE_CONNECTION_STRING: ${{ secrets.AZURE_STORAGE_CONNECTION_STRING }}
+          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+          GMAIL_USER: ${{ secrets.GMAIL_USER }}
+          GMAIL_APP_PASSWORD: ${{ secrets.GMAIL_APP_PASSWORD }}
+          RECAPTCHA_SECRET: ${{ secrets.RECAPTCHA_SECRET }}
+
+      - name: Copy deploy script to VM1
+        run: |
+          scp -i vm_key.pem \
+              -o StrictHostKeyChecking=no \
+              deploy-final.sh \
+              ${{ secrets.VM_USER }}@${{ secrets.VM_HOST }}:/home/rythmify/deploy.sh
+
+      - name: Execute deploy script on VM1
+        run: |
+          ssh -i vm_key.pem \
+              -o StrictHostKeyChecking=no \
+              ${{ secrets.VM_USER }}@${{ secrets.VM_HOST }} \
+              "chmod +x /home/rythmify/deploy.sh && bash /home/rythmify/deploy.sh"
+
+      - name: Clean up SSH key and scripts
+        if: always()
+        run: rm -f vm_key.pem deploy.sh deploy-final.sh