feat: implement git repository management

- Add backend API for git repository CRUD (create, list, delete)
- Support bare repository initialization and mirror cloning
- Add cascade delete for repositories when project is deleted
- Add frontend page for repository management per project
- Update project page with link to repositories
- Add repo_base_path to config
- Quality gates: ruff, mypy, typecheck, lint, build all pass

apps/api/src/api/git_repositories.py

@@ -0,0 +1,188 @@
+import os
+import shutil
+import subprocess
+import uuid
+from typing import Annotated
+
+from fastapi import APIRouter, Cookie, Depends, HTTPException, Response, status
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.auth.jwt_service import decode_access_token
+from src.config import Settings
+from src.database import SessionLocal
+from src.models.git_repository import GitRepository
+from src.models.project import Project
+from src.models.user import User
+
+router = APIRouter(prefix="/projects", tags=["git-repositories"])
+
+
+async def get_db_session():
+    async with SessionLocal() as session:
+        yield session
+
+
+async def get_current_user_id(
+    access_token: Annotated[str | None, Cookie()] = None,
+) -> uuid.UUID:
+    if not access_token:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="missing access token")
+
+    try:
+        claims = decode_access_token(settings=Settings(), token=access_token)
+        return uuid.UUID(str(claims["sub"]))
+    except Exception:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="invalid access token")
+
+
+async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
+    user = await session.get(User, user_id)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
+    return user
+
+
+async def _get_owned_project(
+    project_id: uuid.UUID,
+    user_id: uuid.UUID,
+    session: AsyncSession,
+) -> Project:
+    project = await session.get(Project, project_id)
+    if project is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="project not found")
+    if project.owner_id != user_id:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="not project owner")
+    return project
+
+
+def _get_repo_path(user_id: uuid.UUID, project_id: uuid.UUID, name: str) -> str:
+    base = Settings().repo_base_path or "/data/repos"
+    return os.path.join(base, str(user_id), str(project_id), f"{name}.git")
+
+
+class GitRepositoryCreate(BaseModel):
+    name: str
+    remote_url: str | None = None
+
+
+class GitRepositoryResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    name: str
+    path: str
+    project_id: uuid.UUID
+    owner_id: uuid.UUID
+    is_mirror: bool
+    remote_url: str | None
+    last_push: str | None
+    created_at: str | None
+
+
+@router.post("/{project_id}/repositories", response_model=GitRepositoryResponse, status_code=status.HTTP_201_CREATED)
+async def create_repository(
+    project_id: uuid.UUID,
+    data: GitRepositoryCreate,
+    user_id: uuid.UUID = Depends(get_current_user_id),
+    session: AsyncSession = Depends(get_db_session),
+) -> GitRepository:
+    _user = await _get_user(session, user_id)
+    _project = await _get_owned_project(project_id, user_id, session)
+
+    # Check for duplicate name
+    existing = await session.execute(
+        select(GitRepository).where(
+            GitRepository.project_id == project_id,
+            GitRepository.name == data.name,
+        )
+    )
+    if existing.scalar_one_or_none():
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="repository name already exists")
+
+    repo_path = _get_repo_path(user_id, project_id, data.name)
+
+    # Ensure parent directory exists
+    os.makedirs(os.path.dirname(repo_path), exist_ok=True)
+
+    if data.remote_url:
+        # Clone as mirror
+        try:
+            result = subprocess.run(
+                ["git", "clone", "--mirror", data.remote_url, repo_path],
+                capture_output=True,
+                text=True,
+                timeout=300,
+            )
+            if result.returncode != 0:
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=f"failed to clone repository: {result.stderr}",
+                )
+        except subprocess.TimeoutExpired:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="clone operation timed out")
+        except FileNotFoundError:
+            raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="git command not found")
+    else:
+        # Init bare repo
+        try:
+            result = subprocess.run(
+                ["git", "init", "--bare", repo_path],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+        except FileNotFoundError:
+            raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="git command not found")
+
+    repo = GitRepository(
+        name=data.name,
+        path=repo_path,
+        project_id=project_id,
+        owner_id=user_id,
+        is_mirror=bool(data.remote_url),
+        remote_url=data.remote_url,
+    )
+    session.add(repo)
+    await session.commit()
+    await session.refresh(repo)
+    return repo
+
+
+@router.get("/{project_id}/repositories", response_model=list[GitRepositoryResponse])
+async def list_repositories(
+    project_id: uuid.UUID,
+    user_id: uuid.UUID = Depends(get_current_user_id),
+    session: AsyncSession = Depends(get_db_session),
+) -> list[GitRepository]:
+    _user = await _get_user(session, user_id)
+    _project = await _get_owned_project(project_id, user_id, session)
+
+    result = await session.execute(
+        select(GitRepository).where(GitRepository.project_id == project_id)
+    )
+    return list(result.scalars().all())
+
+
+@router.delete("/{project_id}/repositories/{repo_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_repository(
+    project_id: uuid.UUID,
+    repo_id: uuid.UUID,
+    user_id: uuid.UUID = Depends(get_current_user_id),
+    session: AsyncSession = Depends(get_db_session),
+) -> Response:
+    _user = await _get_user(session, user_id)
+    _project = await _get_owned_project(project_id, user_id, session)
+
+    repo = await session.get(GitRepository, repo_id)
+    if repo is None or repo.project_id != project_id:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="repository not found")
+
+    # Remove from disk
+    if os.path.exists(repo.path):
+        shutil.rmtree(repo.path)
+
+    await session.delete(repo)
+    await session.commit()
+    return Response(status_code=status.HTTP_204_NO_CONTENT)

apps/api/src/api/projects.py

@@ -1,3 +1,5 @@
+import os
+import shutil
 import uuid
 from typing import Annotated
 
@@ -9,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from src.auth.jwt_service import decode_access_token
 from src.config import Settings
 from src.database import SessionLocal
+from src.models.git_repository import GitRepository
 from src.models.project import Project
 from src.models.ssh_key import SSHKey
 from src.models.user import User
@@ -135,6 +138,15 @@ async def delete_project(
 ) -> Response:
     await _get_user(session, user_id)
     project = await _get_owned_project(project_id, user_id, session)
+
+    # Delete repositories from disk and database
+    result = await session.execute(select(GitRepository).where(GitRepository.project_id == project_id))
+    repositories = result.scalars().all()
+    for repo in repositories:
+        if os.path.exists(repo.path):
+            shutil.rmtree(repo.path)
+        await session.delete(repo)
+
     await session.delete(project)
     await session.commit()
     return Response(status_code=status.HTTP_204_NO_CONTENT)

apps/api/src/config.py

@@ -45,6 +45,9 @@ class Settings(BaseSettings):
     access_token_ttl_minutes: int = 15
     refresh_token_ttl_days: int = 7
 
+    # Repository storage
+    repo_base_path: str = "/data/repos"
+
     model_config = SettingsConfigDict(env_file=".env", extra="ignore", populate_by_name=True)
 
     @property

apps/api/src/main.py

@@ -2,6 +2,7 @@ from fastapi import FastAPI
 from fastapi.staticfiles import StaticFiles
 
 from src.api.auth import router as auth_router
+from src.api.git_repositories import router as git_repositories_router
 from src.api.projects import router as projects_router
 from src.api.ssh_keys import router as ssh_keys_router
 from src.api.users import router as users_router
@@ -11,4 +12,5 @@ app.include_router(auth_router)
 app.include_router(projects_router)
 app.include_router(users_router)
 app.include_router(ssh_keys_router)
+app.include_router(git_repositories_router)
 app.mount("/uploads", StaticFiles(directory="uploads"), name="uploads")